Continuous authentication method and apparatus based on hierarchical fingerprints

Abstract

The present application relates to the technical field of information security. Provided are a continuous authentication method and apparatus based on hierarchical fingerprints. The method comprises: constructing hierarchical fingerprint information corresponding to a terminal device, wherein the hierarchical fingerprint information comprises at least one of electronic device layer information, network and protocol layer information, plug-in layer information and behavior authentication layer information; on the basis of the hierarchical fingerprint information, performing preliminary authentication on the terminal device; and when the preliminary authentication performed on the terminal device is successful, executing the following continuous authentication process: when behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and acquiring a random number sequence on the basis of a second timestamp selected in a previous authentication process; taking the first timestamp and the random number sequence as authentication challenge information, and sending same to the terminal device; and receiving from the terminal device response information made for the authentication challenge information, and authenticating the terminal device on the basis of the response information.

Description

Continuous authentication method and device based on hierarchical fingerprint

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application number 202410143514.6, filed on January 31, 2024, entitled “Continuous Authentication Method and Device Based on Hierarchical Fingerprint”, which is incorporated herein by reference in its entirety. Technical Field

[0003] The present application relates to the field of information security technology, and in particular to a continuous authentication method and device based on hierarchical fingerprints. Background Art

[0004] With the rapid development of cloud computing technology, cloud platforms have become core hubs for storing, processing, and sharing data, while end devices are becoming increasingly connected. However, this rapid expansion of the digital ecosystem has also brought new security challenges, among which traditional one-time authentication methods are becoming increasingly inadequate. Faced with increasingly complex and diverse cyber threats, ensuring the security of communications between cloud platforms and end devices has become a top priority.

[0005] Currently, traditional authentication methods are usually only performed when users log in. However, this one-time verification method is difficult to prevent potential threats caused by subsequent changes in device status, unauthorized access, etc., resulting in low communication security between the cloud platform and terminal devices. Summary of the Invention

[0006] The present application provides a hierarchical fingerprint-based continuous authentication method and device to solve the problem of low communication security between cloud platforms and terminal devices in the prior art.

[0007] This application provides a continuous authentication method based on hierarchical fingerprints, including:

[0008] Constructing hierarchical fingerprint information corresponding to the terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information;

[0009] Performing preliminary authentication on the terminal device based on the hierarchical fingerprint information;

[0010] If the initial authentication of the terminal device is successful, the following continuous authentication process is performed:

[0011] When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process;

[0012] Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device;

[0013] Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

[0014] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the response information includes a first hash sequence, which is a hash sequence calculated by a hash algorithm after the terminal device selects a first log sequence from the first log information of the terminal device based on the random number sequence;

[0015] The authenticating the terminal device based on the response information includes:

[0016] Based on the random number sequence, selecting a second log sequence from the second log information of the cloud platform;

[0017] Based on the second log sequence, calculating a corresponding second hash sequence using a hash algorithm;

[0018] Verify whether the first hash sequence is consistent with the second hash sequence;

[0019] If the first hash sequence is consistent with the second hash sequence, the terminal device is successfully authenticated.

[0020] If the first hash sequence is inconsistent with the second hash sequence, the authentication of the terminal device fails.

[0021] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the response information further includes a fingerprint information hash value, and the fingerprint information hash value includes a historical first fingerprint information hash value and / or an updated second fingerprint information hash value;

[0022] The method further comprises:

[0023] Verifying whether the first fingerprint information hash value is consistent with the third fingerprint information hash value pre-stored in the cloud platform;

[0024] If the first hash sequence is consistent with the second hash sequence, the authentication of the terminal device is successful, including:

[0025] If the first hash sequence is consistent with the second hash sequence, and the first fingerprint information hash value is consistent with the third fingerprint information hash value, then the terminal device is successfully authenticated.

[0026] If the first hash sequence and the second hash sequence are inconsistent, then the authentication of the terminal device fails, including:

[0027] If the first hash sequence is inconsistent with the second hash sequence, or the first fingerprint information hash value is inconsistent with the third fingerprint information hash value, the current authentication of the terminal device fails.

[0028] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the response information further includes a flag bit, which is used to indicate whether at least one of the electronic device layer information, network and protocol layer information, and plug-in layer information corresponding to the terminal device is updated;

[0029] The method further comprises:

[0030] When the flag indicates that at least one of the electronic device layer information, network and protocol layer information, and plug-in layer information corresponding to the terminal device has been updated, the first hash sequence is consistent with the second hash sequence, and the first fingerprint information hash value is consistent with the third fingerprint information hash value, the third fingerprint information hash value is replaced with the updated second fingerprint information hash value.

[0031] According to a hierarchical fingerprint-based continuous authentication method provided by the present application, the method further includes:

[0032] If the authentication of the terminal device fails N times in a row, the communication connection between the cloud platform and the terminal device is disconnected; wherein N is an integer greater than 1.

[0033] According to a hierarchical fingerprint-based continuous authentication method provided by the present application, the method further includes:

[0034] Receiving behavioral data from the terminal device;

[0035] Inputting the behavior data of the terminal device into a preset abnormal behavior classification model to obtain a current trust score of the terminal at the current moment output by the abnormal behavior classification model; wherein the abnormal behavior classification model is used to identify abnormal behavior data in the behavior data of the terminal device and calculate the current trust score of the terminal device at the current moment based on the abnormal behavior data;

[0036] Based on the current trust score, the trust score of the terminal device is updated to obtain a total trust score;

[0037] If the total trust score is within a preset abnormal range, the communication connection between the cloud platform and the terminal device is disconnected.

[0038] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the trust score of the terminal device is updated based on the current trust score to obtain a total trust score, including:

[0039] Based on the current trust score Formula (1) is used to update the trust score of the terminal device to obtain the total trust score

[0040] Among them, i represents the i-th terminal device, t i represents the current moment of the i-th terminal device, α represents the attenuation coefficient, e t Used to adjust the different update rates of positive and negative trust.

[0041] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the electronic device layer information includes at least one of the following:

[0042] Main hardware information;

[0043] System time and clock drift information;

[0044] Persistent cookies.

[0045] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the step of constructing hierarchical fingerprint information corresponding to a terminal device includes:

[0046] Normalizing at least one of the main hardware information and the persistent cookies through a preset hash calculation to obtain a standardized representation result;

[0047] Based on the standardized representation result and the system time and clock drift information, electronic component layer information in the hierarchical fingerprint information is constructed.

[0048] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the main hardware information includes the correspondence between the device type and the device information to be collected;

[0049] The standardizing at least one of the main hardware information and the persistent cookies includes:

[0050] At least one vector or matrix is ​​constructed based on the device information to be collected, and the vector or matrix is ​​standardized.

[0051] According to a continuous authentication method based on hierarchical fingerprints provided by this application, the network and protocol layer information includes at least one of the following:

[0052] Media Access Control MAC address;

[0053] Geolocation information;

[0054] Protocol fingerprint information;

[0055] Domain Name System DNS resolution information;

[0056] Clock offset information.

[0057] According to a continuous authentication method based on hierarchical fingerprints provided by this application, the plug-in layer information includes at least one of the following:

[0058] Plugin fingerprint information;

[0059] System fingerprint plug-in information.

[0060] According to a continuous authentication method based on hierarchical fingerprints provided by this application, the behavior authentication layer information includes at least one of the following:

[0061] System performance information;

[0062] Hardware sensor information;

[0063] Remote control fingerprint information;

[0064] Log information.

[0065] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the step of constructing hierarchical fingerprint information corresponding to a terminal device includes:

[0066] Collecting behavioral data of the terminal device;

[0067] Constructing a terminal behavior feature of the terminal device based on the behavior data; wherein the terminal behavior feature includes at least one of a cloud platform feature and a user feature;

[0068] Dividing the terminal behavior feature into a type feature and a first numerical feature;

[0069] Converting the type feature into a second numerical feature by encoding;

[0070] performing an outlier elimination operation and a standardization operation on at least one of the first numerical feature and the second numerical feature to obtain processed target data;

[0071] A principal component analysis operation is performed on the target data to obtain a behavior feature representation vector corresponding to the terminal device as behavior authentication layer information in the hierarchical fingerprint information.

[0072] According to a continuous authentication method based on hierarchical fingerprints provided by the present application, the electronic device layer information, the network and protocol layer information, the plug-in layer information, and the behavior authentication layer information are respectively represented in the form of numerical vectors, and a target numerical vector formed by combining the numerical vectors serves as the hierarchical fingerprint information;

[0073] The method further comprises:

[0074] At pre-set intervals, perform the following operations:

[0075] Extracting a current target numerical vector, and determining a distance similarity between the current target numerical vector and a previously extracted historical target numerical vector;

[0076] If the distance similarity is greater than a first threshold range, it is determined that the authentication of the terminal device has failed.

[0077] The present application also provides a hierarchical fingerprint-based continuous authentication device, comprising:

[0078] A construction module, configured to construct hierarchical fingerprint information corresponding to the terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information;

[0079] A preliminary authentication module, configured to perform preliminary authentication on the terminal device based on the hierarchical fingerprint information;

[0080] The continuous authentication module is used to execute the following continuous authentication process when the initial authentication of the terminal device is successful:

[0081] When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process;

[0082] Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device;

[0083] Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

[0084] The present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the continuous authentication method based on hierarchical fingerprint as described above is implemented.

[0085] The present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the continuous authentication method based on hierarchical fingerprint as described above is implemented.

[0086] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-described continuous authentication methods based on hierarchical fingerprints.

[0087] The continuous authentication method and device based on hierarchical fingerprint provided by the present application first constructs the corresponding hierarchical fingerprint information for each terminal device, and can perform preliminary authentication and subsequent continuous authentication on the terminal device based on the hierarchical fingerprint information. Specifically, the terminal device is first preliminarily authenticated based on the hierarchical fingerprint information. After the preliminary authentication is successful, if the behavior information of the behavior authentication layer information in the hierarchical fingerprint information changes, the terminal device is authenticated. Specifically, the first timestamp after the behavior information occurs is selected, and based on the second timestamp selected in the previous round of authentication, a random number sequence is obtained, and then the first timestamp and the random number sequence are sent to the terminal device as authentication challenge information, and the response information made by the terminal device regarding the authentication challenge information is received, and authentication is performed based on the response information. Compared with the related technology that only performs authentication once when the user logs in, the present application can perform preliminary authentication and subsequent continuous authentication on the terminal device based on the constructed hierarchical fingerprint information, which can effectively prevent potential threats caused by subsequent changes in device status, unauthorized access, etc., thereby improving the communication security between the cloud platform and the terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0089] FIG1 is a flow chart of a continuous authentication method based on hierarchical fingerprints provided by the present application;

[0090] FIG2 is a schematic diagram of the fingerprint hierarchy in the hierarchical fingerprint-based continuous authentication method provided by the present application;

[0091] FIG3 is a schematic diagram of the structure of a continuous authentication device based on hierarchical fingerprints provided by the present application;

[0092] FIG4 is a schematic structural diagram of the electronic device provided in this application. DETAILED DESCRIPTION

[0093] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0094] The following describes the hierarchical fingerprint-based continuous authentication method and device of the present application with reference to the accompanying drawings.

[0095] FIG1 is a flow chart of a continuous authentication method based on hierarchical fingerprints provided by the present application. As shown in FIG1 , the continuous authentication method based on hierarchical fingerprints includes steps 101 to 103; wherein:

[0096] Step 101: Construct hierarchical fingerprint information corresponding to a terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information.

[0097] Step 102: Perform preliminary authentication on the terminal device based on the hierarchical fingerprint information.

[0098] Step 103: If the initial authentication of the terminal device is successful, the following continuous authentication process is performed:

[0099] When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process;

[0100] Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device;

[0101] Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

[0102] In related technologies, traditional authentication methods are usually only performed when the user logs in, but this one-time verification method is difficult to prevent potential threats caused by subsequent changes in device status, unauthorized access, etc., resulting in low communication security between the current cloud platform and terminal devices.

[0103] In response to the above problems, an embodiment of the present application provides a continuous authentication method based on hierarchical fingerprints. First, corresponding hierarchical fingerprint information is constructed for each terminal device. The terminal device can be initially authenticated and subsequently continuously authenticated based on the hierarchical fingerprint information. Specifically, the terminal device is initially authenticated based on the hierarchical fingerprint information. After the initial authentication is successful, if the behavioral information of the behavioral authentication layer information in the hierarchical fingerprint information changes, the terminal device is authenticated.

[0104] Specifically, the first timestamp after the behavior information occurs is selected, for example, the first timestamp is randomly selected within a certain time range after the behavior information occurs. Compared with periodically selecting the first timestamp, randomly selecting the first timestamp is more random, which is convenient for effectively authenticating the terminal device.

[0105] In addition, based on the second timestamp selected in the previous round of authentication, a random number sequence is obtained, such as a sequence of 1, 3, 5, 7, etc., and then the first timestamp and the random number sequence are sent to the terminal device as authentication challenge information, and the response information made by the terminal device regarding the authentication challenge information is received to authenticate the terminal device based on the response information.

[0106] It should be noted that when the initial authentication of the terminal device is successful, whenever the behavior information in the behavior authentication layer information of the terminal device changes, the cloud platform can select a first timestamp and authenticate the terminal device under the timestamp.

[0107] Optionally, authentication challenge information and response information are transmitted between the cloud platform and the terminal device. Specifically, the transmission can be encrypted by a session key to ensure the authenticity and validity of the authentication challenge information and response information. The session key can be a key obtained by combining a dynamic master key and a static master key set in advance.

[0108] Optionally, the first timestamp in the authentication challenge information can be used by the terminal device to first check the freshness of the first timestamp. For example, the terminal device records the current timestamp of the received authentication challenge information, and calculates whether the difference between the current timestamp and the first timestamp is within a certain threshold range. If so, it is considered that the freshness of the first timestamp meets the requirements, and the random number sequence in the authentication challenge information can be used to perform the next step; if not, it is considered that the freshness of the first timestamp does not meet the requirements, and it can be considered that this authentication has failed, and the challenge response authentication process needs to be repeated.

[0109] Similarly, the response information made by the terminal device to the authentication challenge information also includes the third timestamp. Before the cloud platform authenticates the terminal device based on the response information, it can first check the freshness of the third timestamp, and proceed to the next step of authentication after confirming that the freshness of the third timestamp meets the requirements.

[0110] The hierarchical fingerprint information constructed in the embodiment of the present application is described in detail below.

[0111] Figure 2 is a schematic diagram of the fingerprint hierarchy in the continuous authentication method based on hierarchical fingerprints provided in the present application. As shown in Figure 2, the hierarchical fingerprint of the embodiment of the present application divides the terminal architecture into four layers according to the degree of dynamic change of fingerprint information, and is divided into the following layers from low to high according to the degree of dynamic change: electronic device layer, network and protocol layer, plug-in layer and behavior authentication layer.

[0112] (1) Electronics layer: This focuses on the hardware characteristics of the terminal device, including processor architecture, storage structure, hardware module configuration, etc. By analyzing these hardware characteristics, a basic level of fingerprint data can be established, which helps capture the underlying physical characteristics of the device and provides a reliable foundation for the uniqueness of the fingerprint.

[0113] (2) Network and protocol layer: Consider the network connection and communication protocol of the terminal device. By analyzing the network behavior of the device and the communication pattern with other devices, information about the device's communication behavior can be obtained, which helps to identify the device's network characteristics and increase the complexity and diversity of fingerprint data.

[0114] (3) Plug-in layer: This layer focuses on the plug-ins, applications, and services deployed on the device to identify unique software features. This includes analyzing the versions and configurations of installed software and applications on the device, providing detailed data about the device's software environment for fingerprinting.

[0115] (4) Behavioral Authentication Layer: This layer focuses on the terminal device's usage behavior, access patterns, and other information related to user operating habits. By analyzing these behavioral characteristics, fingerprint data closely related to the device user's behavior can be obtained. This helps to combine fingerprint data with the actual user's usage habits and behavior.

[0116] The specific composition of hierarchical fingerprint information is described below.

[0117] The fingerprint information extracted from the terminal device includes the following four levels. When generating a fingerprint, you can select some or all of them according to security requirements.

[0118] The first category: electronic device layer. There are various inherent system information in electronic devices.

[0119] Optionally, the electronic device layer information may include at least one of the following:

[0120] 1) Main hardware information;

[0121] Specifically, the central processing unit (CPU), registers, sound card, network card, scrambler, encryptor, decryptor, underlying register information and physical data information of each port.

[0122] 2) System time and clock drift information;

[0123] Specifically, the device's system time can be accessed via JavaScript and used to infer the device's time zone, whether it observes daylight saving time, and Coordinated Universal Time (UTC) clock drift.

[0124] 3) Persistent cookies.

[0125] Specifically, persistent cookies are stored in the browser Evercookie, which stores the user's terminal identifier on the device by using various technologies such as HTML5 local storage, HTTP ETags or Flash cookies, allowing websites to reconstruct cookies deleted by users.

[0126] Optionally, the implementation of constructing the hierarchical fingerprint information corresponding to the terminal device may include:

[0127] Normalizing at least one of the main hardware information and the persistent cookies through a preset hash calculation to obtain a standardized representation result;

[0128] Based on the standardized representation result and the system time and clock drift information, electronic component layer information in the hierarchical fingerprint information is constructed.

[0129] Specifically, the main hardware information and persistent cookies can be converted into standardized numerical representations through hash calculations, and the current timestamp of the system can be recorded for timeliness verification.

[0130] Optionally, the main hardware information may include a correspondence between device types and device information to be collected;

[0131] The implementation method of standardizing at least one of the main hardware information and the persistent cookies may include:

[0132] At least one vector or matrix is ​​constructed based on the device information to be collected, and the vector or matrix is ​​standardized.

[0133] Specifically, the device information to be collected can be combined into a vector or a matrix to form a numerical representation, thereby obtaining a numerical vector corresponding to the electronic device layer information.

[0134] The second category: Network and protocol layer. This layer contains various network and protocol configuration data information of terminal devices.

[0135] Optionally, the network and protocol layer information may include at least one of the following:

[0136] 1) Media Access Control (MAC) address;

[0137] Specifically, the MAC address can be used for judgment, and WHOIS can also be queried to obtain more information, such as the autonomous system and the name of the registered organization.

[0138] 2) Geographic location information;

[0139] Specifically, geographic location information can be determined through several mechanisms. Browsers typically expose application programming interfaces (APIs), such as through the navigator BOM object. Through these APIs, the user's permission can be requested to obtain the current location, which can be obtained through Global Positioning System (GPS) hardware, cellular triangulation, WiFi information, or user-provided information. Network-based mechanisms also include WHOIS queries based on Internet Protocol (IP) addresses, inference based on routing data, and geolocation.

[0140] 3) Protocol fingerprint information;

[0141] Specifically, protocol fingerprint information is used for higher-level protocols to distinguish browser software, versions, and configurations, such as Transmission Control Protocol (TCP) / IP configuration, HTTP header, user-agent, supported languages, character encoding lists, and DoNotTrack parameters. In addition, the browser's TLS library can use the ClientHello packet to obtain fingerprints from the handshake sequence of negotiated parameters. Relevant information includes the client-side Transport Layer Security (TLS) version, supported cipher suites, their order, compression options and extension lists, and related parameters such as elliptic curve parameters.

[0142] 4) Domain Name System (DNS) resolution information;

[0143] Specifically, many users' default DNS resolver is configured by the operator, but a few users may set up other DNS, such as Alibaba Cloud or OpenDNS. When the user attempts to resolve, the website's DNS server receives the DNS resolution request from the user and then associates the randomly generated subdomain with the one originally generated for the user.

[0144] 5) Clock offset information.

[0145] Specifically, TCP timestamps can be passively analyzed to measure user clock offset—the rate of deviation between the user clock and the real time.

[0146] Optionally, the above information may be represented in the form of a numerical vector. Specifically, a hash function may be used to perform digitization to obtain a numerical vector corresponding to the network and protocol layer information.

[0147] The third category: plug-in layer, which contains various plug-ins and driver information installed to implement various functions.

[0148] Optionally, the plug-in layer information may include at least one of the following:

[0149] 1) Plug-in fingerprint information;

[0150] Specifically, when logging into the network or watching a live broadcast, the plug-ins that need to be downloaded can be queried (by embedding the web page plug-in object) to collect system information, and the information is more detailed than that provided by JavaScript.

[0151] 2) System fingerprint plug-in information.

[0152] Specifically, the software may install special plug-ins, such as early online banking, which can provide more powerful fingerprint information, including hardware identifiers, operating system installation date and installed driver versions. Such plug-ins are now generally reported by antivirus software.

[0153] Optionally, the above information may be represented in the form of a numerical vector. Specifically, a hash function may be used to perform digitization to obtain a numerical vector corresponding to the plug-in layer information.

[0154] The fourth category: the behavioral authentication layer, which contains behavioral data generated by various interactions between users and terminal devices. This information can be collected not only through live streaming software but also by executing specific code in the browser running on the live streaming software to observe the effects, such as measuring execution time or analyzing output to collect device information.

[0155] Optionally, the behavior authentication layer information may include at least one of the following:

[0156] 1) System performance information;

[0157] Specifically, we run a browser engine benchmark on a series of computationally intensive operations and measure the runtime to infer device performance characteristics.

[0158] 2) Hardware sensor information;

[0159] Specifically, mobile device sensors can be fingerprinted based on manufacturing and factory calibration variations, for example, measuring the calibration errors of a phone’s accelerometer or the frequency response of a speaker-microphone system.

[0160] 3) Remote control fingerprint information;

[0161] Specifically, when the user uses the remote control, an event is triggered. When the remote control switches pages, different speed momentums are generated.

[0162] 4) Log information.

[0163] Specifically, when a user uses a terminal device, various log information will be generated during the use process, such as the history of various software or browsers such as the websites visited, the web pages clicked, the videos watched, etc., the usage of various functions supported by various software, such as collection, download, cache and other software usage records, the usage of various functions supported by various devices, such as fast forward and rewind, double-speed playback and other device usage records on the TV side, etc.

[0164] Optionally, the implementation of constructing the hierarchical fingerprint information corresponding to the terminal device may include:

[0165] Collecting behavioral data of the terminal device;

[0166] Constructing a terminal behavior feature of the terminal device based on the behavior data; wherein the terminal behavior feature includes at least one of a cloud platform feature and a user feature;

[0167] Dividing the terminal behavior feature into a type feature and a first numerical feature;

[0168] Converting the type feature into a second numerical feature by encoding;

[0169] performing an outlier elimination operation and a standardization operation on at least one of the first numerical feature and the second numerical feature to obtain processed target data;

[0170] A principal component analysis operation is performed on the target data to obtain a behavior feature representation vector corresponding to the terminal device as behavior authentication layer information in the hierarchical fingerprint information.

[0171] Specifically, due to the diverse behaviors of user terminals, the information in the behavior authentication layer needs to have a certain degree of fault tolerance. Therefore, a certain degree of error tolerance is required when extracting terminal behavior information. Here, depending on the application scenario, the behaviors of different terminal devices can be collected to construct terminal features from both the system and user perspectives. The features can then be preprocessed and divided into categorical features and numerical features. For categorical features, the category encoding is converted into numerical features, and for numerical features, outliers are removed and the values ​​are normalized. The processed data is subjected to principal component analysis to obtain the feature representation vector for each terminal device, which serves as the numerical vector corresponding to the behavior authentication layer information.

[0172] Optionally, the electronic device layer information, the network and protocol layer information, the plug-in layer information, and the behavior authentication layer information may be respectively represented in the form of numerical vectors, and a target numerical vector formed by combining the numerical vectors serves as the hierarchical fingerprint information;

[0173] Specific authentication process: Every pre-set first time, perform the following operations:

[0174] Extracting a current target numerical vector, and determining a distance similarity between the current target numerical vector and a previously extracted historical target numerical vector;

[0175] If the distance similarity is greater than a first threshold range, it is determined that the authentication of the terminal device has failed.

[0176] Specifically, after obtaining information from each layer, four numerical vectors are generated. These four numerical vectors can be combined into one numerical vector based on the order of the hierarchical fingerprints mentioned above, with a dynamic degree from low to high. The order is: electronic device layer fingerprint - network and protocol layer fingerprint - plug-in layer fingerprint - behavioral authentication layer fingerprint. At regular intervals, the cloud platform extracts the aforementioned hierarchical fingerprints and calculates the distance similarity with the last extracted hierarchical fingerprint. If the fingerprint distance is greater than a certain range (the range is determined by the security level of the specific application scenario), then the fingerprint of the terminal device is abnormal and needs to be re-authenticated or blocked.

[0177] The following examples illustrate the hierarchical fingerprint generation strategy in the embodiment of the present application:

[0178] According to the above-mentioned hierarchical information of the device, the hierarchical fingerprint-based continuous authentication method provided in this application may also include a specific hierarchical fingerprint generation strategy.

[0179] [1] Electronic device layer fingerprint: The main hardware information and persistent cookies are converted into standardized numerical representations through hash calculations, and the current timestamp of the system is recorded for timeliness verification. Among them, the main hardware information is collected according to the following Table 1:

[0180] Table 1 Correspondence between device type and device information in main hardware information

[0181] The device information to be collected can be combined into a vector or matrix to form a numerical representation.

[0182] [2] Network and protocol layer fingerprint: This application will obtain the MAC address of the device's network interface, identify the network protocol version used by the device, record the domain name information resolved by the device through DNS, and obtain the device's geographic location information using methods such as IP address or GPS.

[0183] [3] Plugin layer fingerprint: In this layer, this application will extract plugin fingerprints, which collect information about browser plugins, extensions, or other applications installed on the device, as well as system software fingerprints, which obtain version information of the operating system and its related software. The above information will be digitized using a hash function.

[0184] [4] Behavior authentication layer fingerprint: Due to the diverse behaviors of user terminals, the information of the behavior authentication layer needs to have a certain degree of fault tolerance. Therefore, when extracting terminal behavior information, a certain degree of error tolerance is required. Here, according to the application scenario, the behaviors of different terminal devices can be collected to construct terminal features from both the system and user aspects. The features can then be preprocessed. The features are divided into category features and numerical features. For category features, the category encoding is converted into numerical features. For numerical features, outliers are removed and the numerical values ​​are normalized. The processed data is subjected to principal component analysis to obtain the feature representation vector of each terminal device. Specifically, taking the radio and television architecture as an example, the radio and television architecture can be abstracted as a cloud platform-TV terminal-mobile remote control terminal architecture. Its behavior authentication layer features are shown in Table 2 below:

[0185] Table 2 Behavior authentication layer characteristics

[0186] After obtaining the information of each layer, four numerical vectors will be generated. According to the order of the hierarchical fingerprints mentioned above, the four numerical vectors are spliced ​​from low to high in the degree of dynamicity to form a numerical vector, that is, the order is: electronic device layer fingerprint-network and protocol layer fingerprint-plug-in layer fingerprint-behavior authentication layer fingerprint. At regular intervals, the cloud platform will extract the fingerprints of the above layers and calculate the distance similarity with the last extracted hierarchical fingerprint. If the fingerprint distance is greater than a certain range (the range is determined by the security level of the specific application scenario), then the fingerprint of the terminal device is abnormal and needs to be re-authenticated or blocked.

[0187] The effectiveness of the hierarchical fingerprint generation strategy mentioned above is explained below:

[0188] 1) Security: Because the hierarchical fingerprint information comes from the four-layer architecture of the terminal device and includes the behavioral characteristics of the user using the terminal device, even if an adversary attacks a single device and forges its hardware information, it is difficult to completely forge the user's behavioral information. This solution mitigates the risk of single-point attacks to a certain extent.

[0189] 2) Fault Tolerance: The more dynamic a fingerprint is, the greater the likelihood of fluctuations. However, in hierarchical fingerprints, fluctuations in lower-order fingerprints have little impact on distance, so hierarchical fingerprints can tolerate a certain degree of fluctuation. Less dynamic fingerprints typically have strong identity uniqueness, such as the MAC address of a terminal device. Therefore, changes in these fingerprints can cause large deviations in distance, thereby detecting terminal anomalies.

[0190] In the continuous authentication method based on hierarchical fingerprints provided in the embodiment of the present application, compared with the related technology that only performs authentication once when the user logs in, the present application can perform preliminary authentication and subsequent continuous authentication of the terminal device based on the constructed hierarchical fingerprint information, which can effectively prevent potential threats caused by subsequent changes in device status, unauthorized access, etc., thereby improving the communication security between the cloud platform and the terminal device.

[0191] Optionally, the response information may include a first hash sequence, where the first hash sequence is a hash sequence calculated by a hash algorithm after the terminal device selects a first log sequence from the first log information of the terminal device based on the random number sequence;

[0192] The implementation of authenticating the terminal device based on the response information may include:

[0193] Based on the random number sequence, selecting a second log sequence from the second log information of the cloud platform;

[0194] Based on the second log sequence, calculating a corresponding second hash sequence using a hash algorithm;

[0195] Verify whether the first hash sequence is consistent with the second hash sequence;

[0196] If the first hash sequence is consistent with the second hash sequence, the terminal device is successfully authenticated.

[0197] If the first hash sequence is inconsistent with the second hash sequence, the authentication of the terminal device fails.

[0198] Specifically, when the behavior information in the behavior authentication layer information changes, the terminal device can use a random number sequence to select the first log sequence L from the first log information of the behavior authentication layer information, and then calculate the hash result of each first log information through a hash algorithm to construct a hash sequence HL as the first hash sequence.

[0199] The terminal device can include the first hash sequence in the response information and send it to the cloud platform. The cloud platform can select the second log sequence from the second log information of the cloud platform based on the random number sequence. It should be noted that the first log information and the second log information here correspond to each other. It can be considered that after the terminal device communicates with the cloud platform, the first log information will be generated on the terminal device side, and the second log information will be generated accordingly on the cloud platform side. Therefore, under normal circumstances, the log sequences selected using the same random number sequence should be consistent. This application also calculates the corresponding second hash sequence based on the second log sequence through a hash algorithm to compare the first hash sequence and the second hash sequence. If the first hash sequence is consistent with the second hash sequence, it is considered that the authentication of the terminal device is successful; if the first hash sequence is inconsistent with the second hash sequence, it is considered that the authentication of the terminal device has failed.

[0200] Optionally, the response information may further include a fingerprint information hash value, where the fingerprint information hash value includes a historical first fingerprint information hash value and / or an updated second fingerprint information hash value;

[0201] The above-mentioned continuous authentication method based on hierarchical fingerprint may further include the following steps:

[0202] Verifying whether the first fingerprint information hash value is consistent with the third fingerprint information hash value pre-stored in the cloud platform;

[0203] If the first hash sequence is consistent with the second hash sequence, the method for successfully authenticating the terminal device may include:

[0204] If the first hash sequence is consistent with the second hash sequence, and the first fingerprint information hash value is consistent with the third fingerprint information hash value, then the terminal device is successfully authenticated.

[0205] If the first hash sequence is inconsistent with the second hash sequence, the implementation method of failing to authenticate the terminal device may include:

[0206] If the first hash sequence is inconsistent with the second hash sequence, or the first fingerprint information hash value is inconsistent with the third fingerprint information hash value, the current authentication of the terminal device fails.

[0207] Specifically, the embodiment of the present application, on the basis of verifying whether the first hash sequence is consistent with the second hash sequence, is also set to verify whether the first fingerprint information hash value is consistent with the third fingerprint information hash value, that is, to further determine whether this authentication is still for the same terminal device. If the hash sequences are consistent and the fingerprint information hash values ​​are also consistent, it can be considered that the authentication of the terminal device is successful. If one of them is inconsistent, it is considered that the authentication of the terminal device has failed, which improves the accuracy of the authentication and thereby improves the communication security between the cloud platform and the terminal device.

[0208] Optionally, the response information may further include a flag bit, wherein the flag bit is used to indicate whether at least one of the electronic device layer information, network and protocol layer information, and plug-in layer information corresponding to the terminal device is updated;

[0209] The above-mentioned continuous authentication method based on hierarchical fingerprint may further include the following steps:

[0210] When the flag indicates that at least one of the electronic device layer information, network and protocol layer information, and plug-in layer information corresponding to the terminal device has been updated, the first hash sequence is consistent with the second hash sequence, and the first fingerprint information hash value is consistent with the third fingerprint information hash value, the third fingerprint information hash value is replaced with the updated second fingerprint information hash value.

[0211] Specifically, the response information of the terminal device also includes a flag bit, which is used to indicate whether the electronic device layer information, network and protocol layer information, and plug-in layer information that are less frequently updated in the terminal device have been updated. If the cloud platform determines through the flag bit that an update has occurred, it is necessary to synchronize the fingerprint information hash value in the cloud platform. Specifically, it is possible to first verify whether the first hash sequence and the second hash sequence in the response information are consistent, and whether the historical first fingerprint information hash value is consistent with the third fingerprint information hash value stored in the current cloud platform. If the above contents are verified to be consistent, the third fingerprint information hash value stored in the cloud platform is updated to the updated second fingerprint information hash value in the response information to facilitate the next verification of the fingerprint information hash value.

[0212] Optionally, if the authentication of the terminal device fails N times in a row, the communication connection between the cloud platform and the terminal device may be disconnected; wherein N is an integer greater than 1.

[0213] Specifically, in order to avoid disconnection of the communication connection between the cloud platform and the terminal device due to misauthentication, the present application can be set to disconnect the communication connection between the cloud platform and the terminal device when the cloud platform fails to authenticate the terminal device N times in a row. N can be set according to actual conditions and is not limited in the present application.

[0214] Optionally, this application can also perform trust monitoring on the behavioral data of the terminal device, specifically:

[0215] Receiving behavioral data from the terminal device;

[0216] Inputting the behavior data of the terminal device into a preset abnormal behavior classification model to obtain a current trust score of the terminal at the current moment output by the abnormal behavior classification model; wherein the abnormal behavior classification model is used to identify abnormal behavior data in the behavior data of the terminal device and calculate the current trust score of the terminal device at the current moment based on the abnormal behavior data;

[0217] Based on the current trust score, the trust score of the terminal device is updated to obtain a total trust score;

[0218] If the total trust score is within a preset abnormal range, the communication connection between the cloud platform and the terminal device is disconnected.

[0219] Specifically, the embodiments of the present application can also use machine learning to monitor the trust of the behavioral data of the terminal device. The specific cloud platform can receive the behavioral data from the terminal device and input the behavioral data into a pre-trained abnormal behavior classification model, so that the abnormal behavior classification model can identify the abnormal behavior data in the behavioral data of the terminal device, and calculate the current trust score of the terminal device at the current moment based on the abnormal behavior data, and then update the trust score of the terminal device based on the current trust score to obtain an updated total trust score. If the total trust score is within a pre-set abnormal range, it indicates that the terminal device has a potential security problem and the communication connection between the cloud platform and the terminal device needs to be disconnected.

[0220] In some embodiments, the total trust score is within a preset abnormal interval, for example, the total trust score drops below a certain threshold, which can be set according to actual conditions.

[0221] Optionally, the updating of the trust score of the terminal device based on the current trust score to obtain a total trust score may include:

[0222] Based on the current trust score Formula (1) is used to update the trust score of the terminal device to obtain the total trust score

[0223] Among them, i represents the i-th terminal device, t i represents the current moment of the i-th terminal device, α represents the attenuation coefficient, e t Used to adjust the different update rates of positive and negative trust.

[0224] Specifically, as time goes by, the contribution of the previous trust score of the terminal device to the current trust score decreases, so the parameter α is used to control the decay speed. A smaller α means a slower decay. Usually, the value of α is [0, 1]. t It is used to adjust the different update rates of positive and negative trust, so that the time spent on accumulating trust or the level at which the terminal can interact with the cloud platform is higher.

[0225] Optionally, e t The calculation formula example is as follows:

[0226] 1-(1-e t ) β if e t ≥0.5

[0227] Among them, β and γ are rate adjustment parameters, which are used to change the rate of trust update.

[0228] The new trust rating is added to the previous result with gradually decreasing weight, forming an iterative effect while ensuring that the final result remains in the range of 0 to 1. For terminal devices with low trust, the cloud platform will block their access and restrict the operation of applications on the terminal devices.

[0229] The following example illustrates the hierarchical fingerprint-based continuous authentication method provided in the embodiments of the present application.

[0230] To ensure that the identities of both parties remain unchanged during communication, communication between cloud platforms and end devices requires frequent identity verification after data exchange begins to ensure connection security. Furthermore, end device behavior varies, including but not limited to data transmission patterns, access patterns, and usage frequency. Traditional cryptographic authentication struggles to flexibly adjust authentication policies as end device behavior changes. Furthermore, the dynamic nature of end device behavior cannot be ignored. During end-to-end operation, changes in software and hardware status, user operation modes, and other factors can impact device security. Traditional one-time authentication, however, cannot monitor end-to-end connectivity.

[0231] Based on the above-mentioned problems, the embodiment of the present application provides a continuous authentication method based on hierarchical fingerprints, constructs hierarchical fingerprint information for terminal devices, and realizes continuous authentication and behavior evaluation. Among them, the hierarchical fingerprint divides the terminal architecture into four layers according to the degree of dynamic change of fingerprint information, and is divided into the following layers from low to high according to the degree of dynamic change: electronic device layer, network and protocol layer, plug-in layer and behavior authentication layer. Based on the indicators of terminal devices at different layers, the present application further constructs the hierarchical fingerprint information of terminal devices, and proposes a continuous authentication and trust evaluation scheme to realize the monitoring of terminal behavior.

[0232] Specifically, during the operation of the device, the cloud platform periodically collects the hierarchical fingerprint information of the terminal device and performs lightweight continuous authentication based on the previous authentication results to ensure that the terminal device is always in a legal and secure state, thereby improving the system's perception of the terminal device.

[0233] Furthermore, based on data from the behavioral authentication layer of the terminal device, the cloud platform can evaluate interactive behaviors using a deep learning-based abnormal behavior classification model based on the current terminal's operating status. The evaluation results are used to determine the trust level of the terminal device and stored in the cloud platform. If continuous authentication is interrupted or the trust level is too low, the terminal device will be alerted or its requests will be blocked. This continuous monitoring solution allows the system to promptly intercept abnormal behavior. By setting reasonable thresholds, once abnormal terminal device behavior is detected, the system can respond quickly, thereby preventing potential threats or attacks in a timely manner, helping to reduce potential risks and improve the overall security of the system.

[0234] (1) Program framework;

[0235] This application uses hierarchical fingerprint information in terminal devices to achieve continuous authentication and trust monitoring based on user behavior. The specific implementation steps are as follows:

[0236] Step 1: Use the constructed hierarchical fingerprint information to establish preliminary authentication of the terminal device;

[0237] Step 2: Based on the initial authentication established in step 1, the user's behavior information is continuously authenticated while using the terminal device;

[0238] Step 3: Conduct trust monitoring on behavioral information while users are using terminal devices.

[0239] (2) composition of the plan;

[0240] 1) Establishment of hierarchical fingerprint information;

[0241] Fingerprint collection is based on the integration of device hardware and software features to generate a unique identifier within a certain period of time. This identifier is widely used in areas such as device authentication, device management, and security control within a certain period of time. To comprehensively generate terminal fingerprints, multiple layers of the terminal device are considered, including hardware, network, software, and user behavior. Specifically, hierarchical fingerprinting divides the terminal architecture into four layers based on the degree of dynamic change. From the lowest to the highest level of dynamic change, these layers are divided into the electronics layer, the network and protocol layer, the plug-in layer, and the behavioral authentication layer.

[0242] By selecting an appropriate key generation algorithm, such as a hash algorithm, fingerprint data (hierarchical fingerprint information) that is deeply bound to the terminal is generated. To ensure the security of hierarchical fingerprint information, an appropriate key generation algorithm, such as a hash algorithm, is selected that can generate irreversible and unique fingerprint identifiers. Other algorithms that can generate irreversible and unique fingerprint identifiers can also be used here, without limitation. This algorithm selection ensures the security and tamper-proofing of fingerprint data, while also ensuring the uniqueness and durability of fingerprint identifiers within a certain period of time.

[0243] 2) Hierarchical fingerprint information composition;

[0244] The hierarchical fingerprint information extracted from the terminal device includes the following four levels. When generating a fingerprint, you can select some or all of them based on security requirements:

[0245] Category 1: Electronic device layer;

[0246] Category 2: Network and protocol layer;

[0247] The third category: plug-in layer;

[0248] Category 4: Behavior authentication layer.

[0249] For the specific information included in each layer, please refer to the content in the above embodiments.

[0250] 3) Behavior-based continuous authentication;

[0251] During the initialization phase, the terminal device fingerprint information fp0 is uploaded and stored in the cloud platform server when it leaves the factory. Fingerprint information fp0 is required for verification during the continuous authentication process.

[0252] First, the cloud platform uses the previously set dynamic master key and static master key combination as the session key. The cloud platform challenges the terminal device's historical behavior information through a random number sequence. By checking whether the terminal device's response information is consistent with the cloud platform, the terminal device is verified and the terminal device's fingerprint information stored in the cloud platform is updated. If the verification fails multiple times, the cloud platform will cut off the terminal device's use rights. The specific steps are as follows:

[0253] S1: During the use of the terminal device, the cloud platform randomly selects a timestamp T1 and constructs a fixed-length random number sequence R that includes both the timestamp before and after the previous round of challenge timestamp T0. It is encrypted using the session key and sent to the terminal device;

[0254] S2: After receiving the challenge, the terminal device decrypts the timestamp T1 and the random number sequence R, and verifies the freshness of the timestamp T1. If the timestamp is not fresh, it proceeds to step S6; otherwise, based on the log records generated by the interaction between the terminal device and the cloud platform, the random number sequence R is used to select the log information sequence L, calculate the hash result of each log, and construct the hash sequence H. L .

[0255] S3: If the fingerprint information contained in the first to third layers has not changed between the previous round and the current round, set the flag F to 0 and calculate the hash result of fp0 Otherwise, set the flag F to 1 and calculate the hash result of the old fingerprint information fp0 and the new fingerprint information fp1 and

[0256] S4: The terminal device sends a message encrypted with the session key to the cloud platform, including: the current timestamp T2, the hash sequence H L , flag F, fingerprint information hash value If the flag F is 1, then new fingerprint information fp1 and

[0257] S5: After receiving the response, the cloud platform decrypts the message, verifies the freshness of the timestamp, and verifies the hash sequence H L Check whether the hash result of the log record selected by the random number sequence R is consistent, and verify the fingerprint information hash value If the result is consistent, if the flag F is 1, it is necessary to update the fingerprint information of the terminal device to fp1 in the cloud platform and verify the hash result. If the above verification is correct, the response is valid and the authentication is completed. Otherwise, go to step S6.

[0258] S6: Authentication failed, challenge and response are repeated.

[0259] 4) behavioral trust assessment;

[0260] In order to achieve behavioral evaluation of terminal devices, this application also introduces the Trust Management Model (TMM) as a security assurance mechanism that can achieve dynamic behavior perception. By establishing a flexible trust relationship between objects, the interaction risk between malicious nodes and compromised nodes is reduced, so that the assessment of device security is not limited to the binary decision problem of 0 and 1 based on the encryption mechanism. The proposed model mainly consists of four core components: trust storage, trust collection, anomaly monitoring and trust update, and runs on the cloud platform. Specifically:

[0261] [a] The trust storage module records the historical trust scores of each terminal device. When a terminal device is first put into use, the cloud platform will record the initial trust value of the terminal device and bind it to the terminal device's unique identifier (ID).

[0262] For example, the initial trust value of the terminal device is set to 0.5, and then the trust value will change between 0 and 1 according to the behavior of the terminal device. Generally, good behavior will bring positive trust changes, while bad behavior will lead to deterioration of trust.

[0263] [b] The trust collection module is used to collect behavioral data from terminal devices, including application usage, file and data access, network communication behavior, device hardware status, location information, abnormal behavior, and security events. The collection and analysis of this behavioral data can be achieved through various means, including monitoring applications, system logs, network traffic, and hardware sensors. For example, in a cloud-end architecture, terminal device access behavior can be categorized as regular access, risky access, and threatening access, as shown in Table 3 below:

[0264] Table 3 Correspondence between behavior types and specific behaviors

[0265] Regular access includes logins, uploads, downloads, and queries. Risky access includes password guessing attempts, username guessing attempts, thread creation attempts, and port scan attempts. Threat access includes sensitive service access attempts, file permission modifications, illegal links, and bypassing privilege levels. In actual scenarios, these behaviors may vary depending on the application.

[0266] The [c] Anomaly Monitoring Module incorporates a deep learning-based abnormal behavior classification model, pre-established based on historical normal behavior data and the terminal's operational scenarios. This module, running on the cloud platform, leverages the behavioral data obtained from the Trust Collection Module to identify abnormal patterns that do not conform to the behavioral model. Devices classified as abnormal indicate potential security issues. Devices identified as abnormal are logged, and the cloud platform regularly audits terminal device behavior. The cloud platform pre-defines a terminal behavior trust table based on specific scenario requirements, which is used to classify terminal behavior and generate an evaluation E(t) of the terminal device's current behavior.

[0267] The calculation method of E(t) is E(t) = f(S·W s ).

[0268] S={s1,s2,s3,…,s n} represents the indicator used for trust evaluation during the interaction process. Different trust indicators can be assigned different weights W subjectively or objectively. s ={w1,w2,w3,…,w n The weights are used to classify behaviors in the network. The cloud platform can subjectively or according to certain rules determine the level assigned to terminal behaviors to adapt to different contexts. Behaviors with higher security levels can be assigned higher weights. f() represents the trust evaluation function, which can be determined based on different application environments. The trust evaluation range must fall between 0 and 1 to facilitate trust updates.

[0269] [d] The trust update model updates the trust value of the terminal device based on the trust evaluation provided by the anomaly monitoring module. The update relies on the following principles:

[0270] 1) Trust is updated based on the current trust score.

[0271] 2) A trust score greater than or equal to 0.5 (positive trust evaluation) will cause trust to increase more slowly, while a trust score less than 0.5 (negative trust evaluation) will cause trust to decrease more quickly.

[0272] 3) The final calculated trust score is a number between 0 and 1.

[0273] 4) As the number of updates increases, the influence of the previous trust score on the current trust score becomes smaller, reflecting the characteristic of trust decaying over time.

[0274] Specifically, let the current time t i , the trust score of terminal device i is The total trust score of the terminal device The calculation method is:

[0275] Where α is the decay coefficient. As the contribution of the terminal device's previous trust rating to the current trust score decreases over time, the parameter α is used to control the decay rate. A smaller α means a slower decay. The value of α is usually [0, 1]. t It is used to adjust the different update rates of positive and negative trust, so that the time spent on accumulating trust or the level at which the terminal can interact with the cloud platform is higher.

[0276] Optionally, e t The calculation formula example is as follows:

[0277] 1-(1-e t ) β if e t ≥0.5

[0278] Among them, β and γ are rate adjustment parameters, which are used to change the rate of trust update.

[0279] The new trust rating is added to the previous result with gradually decreasing weight, forming an iterative effect while ensuring that the final result remains in the range of 0 to 1. For terminal devices with low trust, the cloud platform will block their access and restrict the operation of applications on the terminal devices.

[0280] The following describes a hierarchical fingerprint-based continuous authentication device provided by the present application. The hierarchical fingerprint-based continuous authentication device described below and the hierarchical fingerprint-based continuous authentication method described above can refer to each other.

[0281] FIG3 is a schematic diagram of the structure of a continuous authentication device based on hierarchical fingerprints provided by the present application. As shown in FIG3 , the continuous authentication device 300 based on hierarchical fingerprints includes:

[0282] A construction module 301 is configured to construct hierarchical fingerprint information corresponding to a terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information;

[0283] A preliminary authentication module 302, configured to perform preliminary authentication on the terminal device based on the hierarchical fingerprint information;

[0284] The continuous authentication module 303 is configured to execute the following continuous authentication process if the initial authentication of the terminal device is successful:

[0285] When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process;

[0286] Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device;

[0287] Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

[0288] In the continuous authentication device based on hierarchical fingerprint provided in the embodiment of the present application, the construction module first constructs the corresponding hierarchical fingerprint information for each terminal device, and the preliminary authentication module and the continuous authentication module can respectively perform preliminary authentication and subsequent continuous authentication on the terminal device based on the hierarchical fingerprint information. Specifically, the terminal device is first preliminarily authenticated based on the hierarchical fingerprint information. After the preliminary authentication is successful, if the behavior information of the behavior authentication layer information in the hierarchical fingerprint information changes, the terminal device is authenticated. Specifically, the first timestamp after the behavior information occurs is selected, and based on the second timestamp selected in the previous round of authentication, a random number sequence is obtained, and then the first timestamp and the random number sequence are sent to the terminal device as authentication challenge information, and the response information made by the terminal device regarding the authentication challenge information is received, and authentication is performed based on the response information. Compared with the related technology that only performs authentication once when the user logs in, the present application can perform preliminary authentication and subsequent continuous authentication on the terminal device based on the constructed hierarchical fingerprint information, which can effectively prevent potential threats caused by subsequent changes in device status, unauthorized access, etc., thereby improving the communication security between the cloud platform and the terminal device.

[0289] Optionally, the response information includes a first hash sequence, where the first hash sequence is a hash sequence calculated by a hash algorithm after the terminal device selects a first log sequence from the first log information of the terminal device based on the random number sequence;

[0290] The continuous authentication module 303 is specifically used to:

[0291] Based on the random number sequence, selecting a second log sequence from the second log information of the cloud platform;

[0292] Based on the second log sequence, calculating a corresponding second hash sequence using a hash algorithm;

[0293] Verify whether the first hash sequence is consistent with the second hash sequence;

[0294] If the first hash sequence is consistent with the second hash sequence, the terminal device is successfully authenticated.

[0295] If the first hash sequence is inconsistent with the second hash sequence, the authentication of the terminal device fails.

[0296] Optionally, the response information further includes a fingerprint information hash value, where the fingerprint information hash value includes a historical first fingerprint information hash value and / or an updated second fingerprint information hash value;

[0297] The hierarchical fingerprint-based continuous authentication device 300 further includes:

[0298] A processing module, configured to verify whether the hash value of the first fingerprint information is consistent with the hash value of the third fingerprint information pre-stored in the cloud platform;

[0299] The continuous authentication module 303 is further specifically configured to:

[0300] If the first hash sequence is consistent with the second hash sequence, and the first fingerprint information hash value is consistent with the third fingerprint information hash value, then the terminal device is successfully authenticated.

[0301] If the first hash sequence is inconsistent with the second hash sequence, or the first fingerprint information hash value is inconsistent with the third fingerprint information hash value, the current authentication of the terminal device fails.

[0302] Optionally, the response information further includes a flag bit, and the flag bit is used to indicate whether at least one of the electronic device layer information, network and protocol layer information, and plug-in layer information corresponding to the terminal device is updated;

[0303] The processing module is also used to:

[0304] When the flag indicates that at least one of the electronic device layer information, network and protocol layer information, and plug-in layer information corresponding to the terminal device has been updated, the first hash sequence is consistent with the second hash sequence, and the first fingerprint information hash value is consistent with the third fingerprint information hash value, the third fingerprint information hash value is replaced with the updated second fingerprint information hash value.

[0305] Optionally, the processing module is further configured to:

[0306] If the authentication of the terminal device fails N times in a row, the communication connection between the cloud platform and the terminal device is disconnected; wherein N is an integer greater than 1.

[0307] Optionally, the hierarchical fingerprint-based continuous authentication device 300 further includes:

[0308] Trust monitoring module, used to:

[0309] Receiving behavioral data from the terminal device;

[0310] Inputting the behavior data of the terminal device into a preset abnormal behavior classification model to obtain a current trust score of the terminal at the current moment output by the abnormal behavior classification model; wherein the abnormal behavior classification model is used to identify abnormal behavior data in the behavior data of the terminal device and calculate the current trust score of the terminal device at the current moment based on the abnormal behavior data;

[0311] Based on the current trust score, the trust score of the terminal device is updated to obtain a total trust score;

[0312] If the total trust score is within a preset abnormal range, the communication connection between the cloud platform and the terminal device is disconnected.

[0313] Optionally, the trust monitoring module is specifically used to:

[0314] Based on the current trust score Formula (1) is used to update the trust score of the terminal device to obtain the total trust score

[0315] Among them, i represents the i-th terminal device, t i represents the current moment of the i-th terminal device, α represents the attenuation coefficient, e t Used to adjust the different update rates of positive and negative trust.

[0316] Optionally, the electronic device layer information may include at least one of the following:

[0317] 1) Main hardware information;

[0318] 2) System time and clock drift information;

[0319] 3) Persistent cookies.

[0320] Optionally, the construction module 301 is specifically configured to:

[0321] Normalizing at least one of the main hardware information and the persistent cookies through a preset hash calculation to obtain a standardized representation result;

[0322] Based on the standardized representation result and the system time and clock drift information, electronic component layer information in the hierarchical fingerprint information is constructed.

[0323] Optionally, the main hardware information includes a correspondence between device types and device information to be collected;

[0324] The construction module 301 is further specifically configured to: construct at least one vector or matrix based on the device information to be collected, and standardize the vector or matrix.

[0325] Optionally, the network and protocol layer information may include at least one of the following:

[0326] 1) MAC address;

[0327] 2) Geographic location information;

[0328] 3) Protocol fingerprint information;

[0329] 4) DNS resolution information;

[0330] 5) Clock offset information.

[0331] Optionally, the plug-in layer information may include at least one of the following:

[0332] 1) Plug-in fingerprint information;

[0333] 2) System fingerprint plug-in information.

[0334] Optionally, the behavior authentication layer information may include at least one of the following:

[0335] 1) System performance information;

[0336] 2) Hardware sensor information;

[0337] 3) Remote control fingerprint information;

[0338] 4) Log information.

[0339] Optionally, the construction module 301 is further specifically configured to:

[0340] Collecting behavioral data of the terminal device;

[0341] Constructing a terminal behavior feature of the terminal device based on the behavior data; wherein the terminal behavior feature includes at least one of a cloud platform feature and a user feature;

[0342] Dividing the terminal behavior feature into a type feature and a first numerical feature;

[0343] Converting the type feature into a second numerical feature by encoding;

[0344] performing an outlier elimination operation and a standardization operation on at least one of the first numerical feature and the second numerical feature to obtain processed target data;

[0345] A principal component analysis operation is performed on the target data to obtain a behavior feature representation vector corresponding to the terminal device as behavior authentication layer information in the hierarchical fingerprint information.

[0346] Optionally, the electronic device layer information, the network and protocol layer information, the plug-in layer information, and the behavior authentication layer information are respectively represented in the form of numerical vectors, and a target numerical vector formed by combining the numerical vectors serves as the hierarchical fingerprint information;

[0347] The processing module is further configured to: perform the following operations every preset first time interval:

[0348] Extracting a current target numerical vector, and determining a distance similarity between the current target numerical vector and a previously extracted historical target numerical vector;

[0349] If the distance similarity is greater than a first threshold range, it is determined that the authentication of the terminal device has failed.

[0350] FIG4 is a schematic diagram of the structure of an electronic device provided by the present application. As shown in FIG4 , the electronic device 400 may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440. The processor 410, the communication interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the continuous authentication method based on the hierarchical fingerprint, which includes:

[0351] Constructing hierarchical fingerprint information corresponding to the terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information;

[0352] Performing preliminary authentication on the terminal device based on the hierarchical fingerprint information;

[0353] If the initial authentication of the terminal device is successful, the following continuous authentication process is performed:

[0354] When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process;

[0355] Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device;

[0356] Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

[0357] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0358] On the other hand, the present application also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the hierarchical fingerprint-based continuous authentication method provided by the above methods, which includes:

[0359] Constructing hierarchical fingerprint information corresponding to the terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information;

[0360] Performing preliminary authentication on the terminal device based on the hierarchical fingerprint information;

[0361] If the initial authentication of the terminal device is successful, the following continuous authentication process is performed:

[0362] When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process;

[0363] Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device;

[0364] Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

[0365] In another aspect, the present application further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for performing the hierarchical fingerprint-based continuous authentication method provided by the above methods is implemented. The method includes:

[0366] Constructing hierarchical fingerprint information corresponding to the terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information;

[0367] Performing preliminary authentication on the terminal device based on the hierarchical fingerprint information;

[0368] If the initial authentication of the terminal device is successful, the following continuous authentication process is performed:

[0369] When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process;

[0370] Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device;

[0371] Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

[0372] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0373] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0374] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A continuous authentication method based on hierarchical fingerprints, comprising: Constructing hierarchical fingerprint information corresponding to the terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information; Performing preliminary authentication on the terminal device based on the hierarchical fingerprint information; If the initial authentication of the terminal device is successful, the following continuous authentication process is performed: When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process; Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device; Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

2. The continuous authentication method based on hierarchical fingerprint according to claim 1, wherein: The response information includes a first hash sequence, where the first hash sequence is a hash sequence calculated by a hash algorithm after the terminal device selects a first log sequence from the first log information of the terminal device based on the random number sequence; The authenticating the terminal device based on the response information includes: Based on the random number sequence, selecting a second log sequence from the second log information of the cloud platform; Based on the second log sequence, calculating a corresponding second hash sequence using a hash algorithm; Verify whether the first hash sequence is consistent with the second hash sequence; If the first hash sequence is consistent with the second hash sequence, the terminal device is successfully authenticated. If the first hash sequence is inconsistent with the second hash sequence, the authentication of the terminal device fails.

3. The continuous authentication method based on hierarchical fingerprint according to claim 2, wherein: The response information further includes a fingerprint information hash value, where the fingerprint information hash value includes a historical first fingerprint information hash value and / or an updated second fingerprint information hash value; The method further comprises: Verifying whether the first fingerprint information hash value is consistent with the third fingerprint information hash value pre-stored in the cloud platform; If the first hash sequence is consistent with the second hash sequence, the authentication of the terminal device is successful, including: If the first hash sequence is consistent with the second hash sequence, and the first fingerprint information hash value is consistent with the third fingerprint information hash value, then the terminal device is successfully authenticated. If the first hash sequence and the second hash sequence are inconsistent, then the authentication of the terminal device fails, including: If the first hash sequence is inconsistent with the second hash sequence, or the first fingerprint information hash value is inconsistent with the third fingerprint information hash value, the current authentication of the terminal device fails.

4. The continuous authentication method based on hierarchical fingerprint according to claim 3, wherein: The response information further includes a flag bit, which is used to indicate whether at least one of the electronic device layer information, network and protocol layer information, and plug-in layer information corresponding to the terminal device is updated; The method further comprises: When the flag indicates that at least one of the electronic device layer information, network and protocol layer information, and plug-in layer information corresponding to the terminal device has been updated, the first hash sequence is consistent with the second hash sequence, and the first fingerprint information hash value is consistent with the third fingerprint information hash value, the third fingerprint information hash value is replaced with the updated second fingerprint information hash value.

5. The hierarchical fingerprint-based continuous authentication method according to claim 1 , further comprising: If the authentication of the terminal device fails N times in a row, the communication connection between the cloud platform and the terminal device is disconnected; wherein N is an integer greater than 1.

6. The hierarchical fingerprint-based continuous authentication method according to claim 1, further comprising: Receiving behavioral data from the terminal device; Inputting the behavior data of the terminal device into a preset abnormal behavior classification model to obtain a current trust score of the terminal at the current moment output by the abnormal behavior classification model; wherein the abnormal behavior classification model is used to identify abnormal behavior data in the behavior data of the terminal device and calculate the current trust score of the terminal device at the current moment based on the abnormal behavior data; Based on the current trust score, the trust score of the terminal device is updated to obtain a total trust score; If the total trust score is within a preset abnormal range, the communication connection between the cloud platform and the terminal device is disconnected.

7. The continuous authentication method based on hierarchical fingerprint according to claim 6, wherein: The updating of the trust score of the terminal device based on the current trust score to obtain a total trust score includes: Based on the current trust score Formula (1) is used to update the trust score of the terminal device to obtain the total trust score Among them, i represents the i-th terminal device, t i represents the current moment of the i-th terminal device, α represents the attenuation coefficient, e t Used to adjust the different update rates of positive and negative trust.

8. The hierarchical fingerprint-based continuous authentication method according to any one of claims 1 to 7, wherein: The electronic device layer information includes at least one of the following: Main hardware information; System time and clock drift information; Persistent cookies.

9. The continuous authentication method based on hierarchical fingerprint according to claim 8, wherein: The step of constructing hierarchical fingerprint information corresponding to the terminal device includes: Normalizing at least one of the main hardware information and the persistent cookies through a preset hash calculation to obtain a standardized representation result; Based on the standardized representation result and the system time and clock drift information, electronic component layer information in the hierarchical fingerprint information is constructed.

10. The continuous authentication method based on hierarchical fingerprint according to claim 9, wherein: The main hardware information includes the corresponding relationship between the device type and the device information to be collected; The standardizing at least one of the main hardware information and the persistent cookies includes: At least one vector or matrix is constructed based on the device information to be collected, and the vector or matrix is standardized.

11. The hierarchical fingerprint-based continuous authentication method according to any one of claims 1 to 7, wherein: The network and protocol layer information includes at least one of the following: Media Access Control MAC address; Geolocation information; Protocol fingerprint information; Domain Name System DNS resolution information; Clock offset information.

12. The hierarchical fingerprint-based continuous authentication method according to any one of claims 1 to 7, wherein: The plug-in layer information includes at least one of the following: Plugin fingerprint information; System fingerprint plug-in information.

13. The hierarchical fingerprint-based continuous authentication method according to any one of claims 1 to 7, wherein: The behavior authentication layer information includes at least one of the following: System performance information; Hardware sensor information; Remote control fingerprint information; Log information.

14. The hierarchical fingerprint-based continuous authentication method according to any one of claims 1 to 7, wherein: The step of constructing hierarchical fingerprint information corresponding to the terminal device includes: Collecting behavioral data of the terminal device; Constructing a terminal behavior feature of the terminal device based on the behavior data; wherein the terminal behavior feature includes at least one of a cloud platform feature and a user feature; Dividing the terminal behavior feature into a type feature and a first numerical feature; Converting the type feature into a second numerical feature by encoding; performing an outlier elimination operation and a standardization operation on at least one of the first numerical feature and the second numerical feature to obtain processed target data; A principal component analysis operation is performed on the target data to obtain a behavior feature representation vector corresponding to the terminal device as behavior authentication layer information in the hierarchical fingerprint information.

15. The hierarchical fingerprint-based continuous authentication method according to any one of claims 1 to 7, wherein: The electronic device layer information, the network and protocol layer information, the plug-in layer information, and the behavior authentication layer information are respectively represented in the form of numerical vectors, and a target numerical vector formed by combining the numerical vectors is used as the hierarchical fingerprint information; The method further comprises: At pre-set intervals, perform the following operations: Extracting a current target numerical vector, and determining a distance similarity between the current target numerical vector and a previously extracted historical target numerical vector; If the distance similarity is greater than a first threshold range, it is determined that the authentication of the terminal device has failed.

16. A continuous authentication device based on hierarchical fingerprints, comprising: A construction module, configured to construct hierarchical fingerprint information corresponding to the terminal device; wherein the hierarchical fingerprint information includes at least one of electronic device layer information, network and protocol layer information, plug-in layer information, and behavior authentication layer information; A preliminary authentication module, configured to perform preliminary authentication on the terminal device based on the hierarchical fingerprint information; The continuous authentication module is used to execute the following continuous authentication process when the initial authentication of the terminal device is successful: When the behavior information in the behavior authentication layer information changes, selecting a first timestamp after the behavior information changes, and obtaining a random number sequence based on a second timestamp selected in the previous authentication process; Sending the first timestamp and the random number sequence as authentication challenge information to the terminal device; Receive response information from the terminal device to the authentication challenge information, and authenticate the terminal device based on the response information.

17. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the hierarchical fingerprint-based continuous authentication method according to any one of claims 1 to 15 is implemented.

Images