TWI604334B - Information System Certification Method - Google Patents

Description

Information system certification method

The invention relates to a method for information system authentication, which can automatically determine whether to perform a secondary verification login information system authentication method according to various environmental security states of the current information system.

User authentication login technology is a basic function of any information system. Especially for websites involving financial transactions or personal information related services, the security of user authentication login technology is very important.

The conventional website verification login method mainly performs a one-time verification login by inputting a user account and a password on the display interface of the user device, but the verification login method is too simple and easy to be cracked, which is quite insecure, and today's network In the road environment, a variety of Trojan viruses and spyware are rampant, and it is quite hidden and difficult to find. Internet hackers often steal user information without the user's awareness, resulting in user privacy violations and user property. Loss.

Therefore, the website verification login technology is quite important. The traditional website verification login technology does not judge the environmental security status of the current information system, regardless of whether the user is surfing the information system in a high-risk place where Internet information is exposed. Or the user is only at home and the company's simple online login information system, all use the same one-time verification login method to log in to the information system, which has a large loophole in security and does not guarantee the security of the user login information system. Therefore, users are at a high risk when using network services.

In view of the lack of the above-mentioned conventional skills, there is a need for improvement. The creator is constantly seeking solutions, and finally creates a more sophisticated and practical method of information system certification, which can benefit the public.

The invention utilizes a machine learning method to establish an environmental security decision module and combines the current current environmental feature data to assist the information system to configure a secure login mechanism mode, and the environmental security decision module determines the environmental security status of the current information system. One-time account password verification login and secondary verification login automatically make choices to strengthen network information security, to ensure user data and user login convenience.

The invention provides a method for authenticating an information system, comprising: connecting a network device to an information system, performing a first account password verification and successfully logging in, and collecting at least one current environmental feature data by using the information system, At least one current environmental characteristic data is used as a basis for judging the environmental security decision module established by the information system.

The information system puts at least one current environmental feature data into the environmental security decision module to determine whether a secondary verification login is required. When the environmental security decision module determines that the secondary verification login is not required, the information system The information system displays the result of the login. When the environmental security decision module determines that a secondary verification login is required, the information system displays a secondary verification login screen.

In the secondary verification login screen, the second verification login is performed by means of a second verification login combination. Finally, the information system displays the result of the secondary verification login, wherein the secondary verification login combination includes a dynamic password, a dynamic keyboard, Graphic verification, fingerprint or iris or sound A combination of one or more of tone recognition, smart card voucher card, identity badge, PIN code, USB disc, and security token.

The process of establishing the environmental security decision module is as follows: collecting at least one current environmental characteristic data, wherein at least one current environmental characteristic data includes an environment of the information system, an open environment or a closed environment, and the network of the information system The environment of the road architecture is public or intranet, the system catalog of this information system, the total number of connected users and current user traffic of this information system on a weekly or monthly or yearly basis, the information security antivirus software of this information system weekly or The monthly or annual risk value, the number of times the information system is attacked weekly or monthly or yearly, whether the information system sets a proxy server or firewall, whether the information system belongs to the front end has an information security prevention environment, this information Whether the current date of the system is a major festival or a day that affects the busy operation of the system, whether the information system level is a grade record of a special system or a general system, or one or both of the historical information context markers of the information system attempting to log in. The combination of the above.

The at least one current environmental feature data collected is normalized according to the characteristics of the at least one current environmental feature data, and then represented by a vector set.

The supervised learning classifier to which at least one current environmental feature data is applied is selected, wherein the supervised learning classifier is a decision tree, a support vector machine, a neural network, a linear classifier, a Bayesian classifier or a Gaussian mixture. model.

The internal parameter values of the supervised learning classifier are estimated by iterative method, and the training time and accuracy are controlled by setting a convergence threshold or an iteration number.

After the network device is connected to the information system, the information system collects at least one current environmental feature data over a period of time, and classifies at least one current environmental feature data through the supervised learning class. The device makes predictions.

The secondary verification login is determined based on the estimated confidence and the predicted result of the supervised learning classifier.

The present invention provides another method for authenticating an information system, which comprises collecting at least one current environmental feature data through an information system, and using at least one current environmental feature data as a basis for judging an environmental security decision module established by the entry information system, wherein The information system puts at least one current environmental characteristic data into the environmental security decision module to determine whether a secondary verification login is required, and when the environmental security decision module determines that the secondary verification login is not required, the information is transmitted through a network. The device is connected to the information system and the first account password verification login is performed, and the information system displays the result of the login.

When the environmental security decision-making module determines that a secondary verification login is required, the information system displays a secondary verification login screen, and in the secondary verification login screen, the secondary verification login is performed by means of a second verification login combination, and finally This information system displays the results of the secondary verification login, which includes the dynamic password, dynamic keyboard, graphic verification, fingerprint or iris or voice recognition, smart card voucher card, identification badge, PIN code, USB A combination of one or more of a disc and a security token.

The process of establishing the environmental security decision module is as follows: collecting at least one current environmental feature data, wherein at least one current environmental feature data includes an environment of an information system, an open environment or a closed environment, and an information system network architecture The environment is the public or intranet, the system directory of the information system, the information system weekly or monthly or yearly, the total number of connected users and current user traffic, information system information security anti-virus software weekly or monthly or yearly Risk value, number of attacks on the information system weekly or monthly or yearly, information system Does the system set whether the proxy server or firewall or information system belongs to the front end with the information security prevention mechanism environment, whether the current date of the information system is a major festival or the day when the system is busy, and whether the information system level is a special system or a general system. The level record, the information system attempts to log in to the wrong historical information context marker, or a combination of any two or more.

The at least one current environmental feature data collected is normalized according to the characteristics of the at least one current environmental feature data, and then represented by a vector set.

The supervised learning classifier to which at least one current environmental feature data is applied is compared, wherein the supervised learning classifier is a decision tree, a support vector machine, a neural network, a linear classifier, a Bayesian classifier or a Gaussian mixture model. .

The internal parameter values of the supervised learning classifier are estimated by iterative method, and the training time and accuracy are controlled by setting a convergence threshold or an iteration number.

After the network device is connected to the information system, the information system collects at least one current environmental feature data for a period of time, and predicts at least one current environmental feature data through the supervised learning classifier.

The secondary verification login is determined based on the estimated confidence and the predicted result of the supervised learning classifier.

The method of information system authentication of the present invention has the following advantages:

1. The present invention utilizes a machine learning method to establish an environmental security decision module and combines the current current environmental feature data to assist the information system to configure a secure login mechanism mode, and the environmental security decision module determines the environmental security status of the current information system. Select between the one-time account password verification login and the secondary verification login combination verification login, so that the information system can use the environmental security decision module to automatically determine whether it is necessary to continue the second inspection. Login to take into account the security and convenience of user login.

2. The technology of the present invention strengthens the security of the user login information system, so that the user can avoid intrusion or misappropriation of the network hacker when accessing the network resources, thereby avoiding the loss of the user property.

S101~S107‧‧‧Step procedure

S201~S207‧‧‧Step procedure

S301~S306‧‧‧Step procedure

401‧‧‧Slash

Figure 1 is a flow chart of a method for authentication of an information system of the present invention.

Figure 2 is a flow chart of another method of authentication of the information system of the present invention.

Figure 3 is a flow chart showing the establishment of the environmental security decision module of the present invention.

Figure 4 is a diagram showing the relationship between the total number of connected users of the information system of the present invention and the current user traffic of the information system.

The technical features, contents, and advantages of the present invention, as well as the advantages thereof, can be understood by the present inventors, and the present invention will be described in detail with reference to the accompanying drawings. The subject matter is only for the purpose of illustration and description. It is not intended to be a true proportion and precise configuration after the implementation of the present invention. Therefore, the scope and configuration relationship of the attached drawings should not be interpreted or limited. First described.

Please refer to FIG. 1 , which is a flowchart of a method for authenticating an information system according to the present invention. As shown in the figure, the step process includes:

S101: After connecting to an information system through a network device, the first verification succeeds in logging in through an account password in a verification login screen.

S102: Collecting at least one current environmental characteristic data by using the information system, and using at least one current environmental characteristic data as an environment environment established by determining to enter the information system using the machine learning mode The basis for the judgment of the full decision-making module.

S103: using the information system to put at least one current environmental feature data into the environmental security decision-making module, and assisting the information system to configure a secure login mechanism mode, wherein the environmental security decision-making module can determine the current login information system Is it necessary to continue the secondary verification login?

S104: When the environmental security decision module determines that the secondary verification login is not required, the information system displays the result of the login.

S105: When the environmental security decision module determines that a secondary verification login is required, the information system displays a secondary verification login screen.

S106: Perform secondary verification login through the second verification login combination in the secondary verification login screen, wherein the secondary verification login combination includes a dynamic password, a dynamic keyboard, a graphic verification, a fingerprint or an iris or a voice recognition, and wisdom. A combination of one or more of a card voucher card, an identification badge, a PIN code, a USB disc, and a security token.

S107: Finally, the information system displays the result of the secondary verification login. By means of the second verification of the login combination, the security of the user login information system can be enhanced, and the user can avoid the network when accessing the network resources. Intrusion or misappropriation of road hackers, thereby avoiding the loss of user property.

Please refer to FIG. 2, which is a flowchart of another method for authenticating the information system of the present invention. As shown in the figure, the step process includes:

S201: Collecting at least one current environmental feature data through an information system, and using at least one current environmental feature data as a basis for judging the environmental security decision module established by the information system using the machine learning mode.

S202: The at least one current environmental feature data is placed in the environmental security decision module by the information system, and the information system is configured to configure a secure login mechanism mode, and the environmental security decision module is utilized. When logging in to the information system, it is determined whether a secondary verification login is required.

S203: When the environmental security decision module determines that the secondary verification login is not required, after connecting to the information system through a network device, the first verification login is performed by using the account password in a verification login screen.

S204: The information system displays the result of the first verification login.

S205: When the environmental security decision module determines that the secondary verification login is required, the information system displays a secondary verification login screen.

S206: Perform secondary verification login through a second verification login combination in the secondary verification login screen, wherein the secondary verification login combination includes a dynamic password, a dynamic keyboard, a graphic verification, a fingerprint or iris or voice recognition, and a smart card certificate. A combination of one or more of a card, an identification badge, a PIN code, a USB disc, and a security token.

S207: The last information system displays the result of the secondary verification login. By means of the secondary verification of the login combination, the security of the user login information system can be enhanced, and the user can avoid the network when accessing the network resources. Intrusion or misappropriation of customers, thereby avoiding the loss of user property.

Please refer to FIG. 3, wherein FIG. 3 is a flow chart of establishing an environmental security decision module of the present invention, wherein the steps of establishing the environmental security decision module are as follows:

S301: Collect at least one current environmental feature data.

S302: Define a feature, and normalize the collected at least one current environment feature data according to the characteristic, and represent the vector set.

S303: Select a classifier to compare and select a supervised learning classifier to which at least one current environmental feature data is applied, thereby achieving a better classification effect.

S304: Train the classifier to estimate the internal parameters of the supervised learning classifier through an iterative method Value, and by setting a convergence threshold or an iteration number, to control training time and accuracy.

S305: The new data is evaluated. After the user connects to the information system through the network device, the information system collects at least one current environmental feature data for a period of time, and predicts at least one current environmental feature data through the supervised learning classifier.

S306: Generate a decision method, and determine whether to perform the secondary verification login according to the estimated confidence and the predicted result of the supervised learning classifier.

The process S301: collecting at least one current environment feature data, where the environment in which the information system is collected is an open environment or a closed environment, and the network architecture of the information system is a public network or an intranet, a system directory of the information system, Information system weekly or monthly or yearly connection of the total number of users and current user traffic, information system information security anti-virus software weekly or monthly or annual risk value, information system weekly or monthly or yearly attack The number of times, whether the information system sets the proxy server or firewall, whether the information system belongs to the front end has the information security prevention mechanism environment, whether the current date of the information system is a major festival or the day when the system is busy, whether the information system level is a special system or One of the general system level records, the information system attempts to log in to the wrong historical information context flag, or a combination of more than two.

The process S302: defining the feature includes the environment where the network is an open environment or a closed environment, and the parameter is a Boolean value, the total number of information system connection users and the current user flow of the information system are integers, see Table 1 below. As shown, at least one current environmental feature data collected is the total number of information system connection users and the current user traffic of the information system, and records whether the information system uses the dynamic password, and the dynamic password is represented by 〝1〞, and the unused dynamics are used. The password is indicated by 〝0〞.

Wherein the process S303: the selection classifier includes a linear classifier for comparing and selecting at least one current environment feature data, and the form is a1. X1+a2. X2+b, where x1 is the total number of users connected to the information system, x2 is the current user traffic of the information system, and a1, a2 and b are trainable parameters, wherein the supervised learning classifier is a decision tree, a support vector machine, a neural network. Road, linear classifier, Bayesian classifier or Gaussian mixture model.

Wherein the process S304: the training classifier comprises estimating the trainable parameters of the linear classifier through an iterative method, and training the trainable parameters of the linear classifier to find a set of parameters corresponding to the linear classifier, Referring to FIG. 4, FIG. 4 is a diagram showing the relationship between the total number of connected users of the information system of the present invention and the current user flow of the information system, by which the data points of the linear classifier can be classified into information system usage dynamics. The password category and the information system do not use dynamic passwords. The shape of the data points is divided into square (■) and round (●), and square (■) is dynamic. The password category, circle (●) is the unused dynamic password, and by this parameter, the linear classifier can be a1. X1+a2. X2+b is drawn in accordance with the form a1. X1+a2. X2+b slash 401, and the relationship diagram is divided into information system using dynamic password category and information system does not use dynamic password category, when the data point meets a1. X1+a2. The x2>b form uses the dynamic password category for the information system above the slash 401 when the data point matches a1. X1+a2. In the case of x2≦b, the information system below the slash 401 does not use the dynamic password category, thereby controlling the training time and accuracy.

The process S305: the new data evaluation comprises predicting the collected at least one current environmental feature data through a linear classifier to determine that the data point meets a1. X1+a2. X2>b form or a1. X1+a2. The x2≦b form is used to determine whether the information system uses dynamic passwords.

Wherein the process S306: generating the decision method comprises determining whether to perform the secondary verification login according to the estimated confidence and the result predicted by the linear classifier.

The above is intended to be illustrative only and not limiting. Any equivalent modifications or alterations to the spirit and scope of the invention are intended to be included in the scope of the appended claims.

S101~S107‧‧‧Step procedure

Claims (8)

A method for authentication of an information system, comprising the steps of: connecting a network device to an information system and successfully logging in for the first account password verification; the information system collecting at least one current environment feature data, and each current environment characteristic The data is used as a basis for judging an environmental security decision-making module established in the information system; the information system puts each current environmental characteristic data into the environmental security decision-making module to determine whether a secondary verification login is required; when the environment When the security decision module determines that the secondary verification login is not required, the information system displays the result of the login; when the environmental security decision module determines that the secondary verification login is required, the information system displays a secondary verification login screen. The second verification login is performed through the secondary verification login combination in the secondary verification login screen; and the information system displays the result of the secondary verification login. For example, the method for authenticating the information system described in claim 1 is as follows: the process for establishing the environmental security decision module is as follows: collecting current environmental characteristic data, wherein each current environmental characteristic data includes a network of the information system The environment in which the road is located is an open environment or a closed environment. The network architecture of the information system is in the public or intranet, the system directory of the information system, and the total number of connected users of the information system on a weekly or monthly or yearly basis. And the current user traffic, the weekly or monthly or annual risk value of the information security anti-virus software of the information system, the number of attacks on the information system weekly or monthly or yearly, whether the information system sets a proxy server or firewall Whether the information system belongs to the front-end information security prevention mechanism environment, whether the current date of the information system is a major festival or the day when the system is busy, whether the information system level is a special system or a general system level record, the information The system attempts to log in one of the incorrect historical information context markers or a combination of more than two; Each of the collected current environmental feature data is normalized according to the characteristics of each current environmental feature data, and is represented by a vector set; and a supervised learning classifier applicable to each current environmental feature data is compared and selected; The iterative method estimates the internal parameter value of the supervised learning classifier, and controls the training time and accuracy by setting a convergence threshold or an iteration number; when the network device is connected to the information system, the The information system collects each current environmental characteristic data for a period of time, and predicts each current environmental characteristic data through the supervised learning classifier; and determines whether the predicted result is based on the estimated confidence and the supervised learning classifier Perform a secondary verification login. The method for authenticating the information system described in claim 1, wherein the secondary verification login combination comprises the dynamic password, a dynamic keyboard, a graphic verification, a fingerprint or iris or voice recognition, a smart card voucher card, and an identification identity. A combination of one or more of a badge, PIN, USB disc, and security token. For example, the method for authenticating an information system described in claim 2, wherein the supervised learning classifier is a decision tree, a support vector machine, a neural network, a linear classifier, a Bayesian classifier, or a Gaussian mixture model. An information system authentication method includes the following steps: an information system collects at least one current environmental characteristic data, and uses the current environmental characteristic data as a basis for judging an environmental security decision module established in the information system; The information system puts the current environmental characteristic data into the environmental security decision module to determine whether a secondary verification login is required; when the environmental security decision module determines that the secondary verification login is not required, a network device is connected. To the information system and perform the first account password verification login; the information system displays the result of the login; when the environmental security decision module determines that a secondary verification login is required, the information system displays a secondary verification login screen; Performing a secondary verification login through the secondary verification login combination in the secondary verification login screen; The information system displays the results of the secondary verification login. For example, the method for authenticating the information system described in claim 5, wherein the establishment process of the environmental security decision module is as follows: collecting current environmental characteristic data, wherein each current environmental characteristic data includes a network of the information system The environment in which the road is located is an open environment or a closed environment. The network architecture of the information system is in the public or intranet, the system directory of the information system, and the total number of connected users of the information system on a weekly or monthly or yearly basis. And the current user traffic, the weekly or monthly or annual risk value of the information security anti-virus software of the information system, the number of attacks on the information system weekly or monthly or yearly, whether the information system sets a proxy server or firewall Whether the information system belongs to the front-end information security prevention mechanism environment, whether the current date of the information system is a major festival or the day when the system is busy, whether the information system level is a special system or a general system level record, the information The system attempts to log in one of the incorrect historical information context markers or a combination of more than two; Each of the collected current environmental feature data is normalized according to the characteristics of each current environmental feature data, and is represented by a vector set; and a supervised learning classifier applicable to each current environmental feature data is compared and selected; The iterative method estimates the internal parameter value of the supervised learning classifier, and controls the training time and accuracy by setting a convergence threshold or an iteration number; when the network device is connected to the information system, the The information system collects each current environmental characteristic data for a period of time, and predicts each current environmental characteristic data through the supervised learning classifier; and determines whether the predicted result is based on the estimated confidence and the supervised learning classifier Perform a secondary verification login. The method for authenticating the information system described in claim 5, wherein the secondary verification login combination comprises the dynamic password, dynamic keyboard, graphic verification, fingerprint or iris or voice recognition, smart card voucher card, identification identity A combination of one or more of a badge, PIN, USB disc, and security token. The method for authenticating an information system according to claim 5, wherein the supervised learning classifier is a decision tree, a support vector machine, a neural network, a linear classifier, a Bayesian classifier or a Gaussian mixture model.