WO2023000413A1 - 一种自适应跨域访问认证方法、系统、终端以及存储介质 - Google Patents

一种自适应跨域访问认证方法、系统、终端以及存储介质 Download PDF

Info

Publication number
WO2023000413A1
WO2023000413A1 PCT/CN2021/112276 CN2021112276W WO2023000413A1 WO 2023000413 A1 WO2023000413 A1 WO 2023000413A1 CN 2021112276 W CN2021112276 W CN 2021112276W WO 2023000413 A1 WO2023000413 A1 WO 2023000413A1
Authority
WO
WIPO (PCT)
Prior art keywords
cross
domain access
access
visitor
domain
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/112276
Other languages
English (en)
French (fr)
Inventor
李攀
宁立
张涌
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Institute of Advanced Technology of CAS
Original Assignee
Shenzhen Institute of Advanced Technology of CAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Institute of Advanced Technology of CAS filed Critical Shenzhen Institute of Advanced Technology of CAS
Publication of WO2023000413A1 publication Critical patent/WO2023000413A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities

Definitions

  • the application belongs to the technical field of computer information security, and in particular relates to an adaptive cross-domain access authentication method, system, terminal and storage medium.
  • the main methods of information access control include:
  • the present application provides an adaptive cross-domain access authentication method, system, terminal and storage medium, aiming to solve one of the above-mentioned technical problems in the prior art at least to a certain extent.
  • An adaptive cross-domain access authentication method comprising:
  • the cross-domain access data includes the visitor's account authority, login IP, access scene, mobilization of resources, and closeness between cross-domain access systems;
  • the access authority level includes trust, normal, risk and abnormality ;
  • the visitor's access to the subsystem is controlled according to the access authority level.
  • the technical solution adopted in the embodiment of the present application further includes: the cross-domain access data is the visitor's webpage and client login information and cache history information within a set number of days.
  • the cross-domain access data of the subsystem for collecting visitors also includes:
  • the adaptive cross-domain access authority network is composed of a four-layer fully connected neural network, and the adaptive cross-domain access authority network includes text information input and dynamic verification images of cross-domain access data Information input, when only the cross-domain access data of text information is input, the image information input is set to zero;
  • the number of neurons input by the text information of the adaptive cross-domain access authority network is 7*5, wherein 7 represents the number of days for collecting cross-domain access data, 5 represents account authority, login IP, access scenarios, mobilization of resources, and closeness between cross-domain access systems;
  • the first hidden layer of the adaptive cross-domain access network includes 1024 neurons, including 1024*5*7 weights and 1024 neurons respectively Bias;
  • the second hidden layer includes 256 neurons, including 256*1024 weights and 256 biases;
  • the third hidden layer includes 1024 neurons, including 1024*256 weights and 1024 biases ;
  • the output layer of the adaptive cross-domain access authority network includes four neurons, and the fully connected layer of each neuron is processed by linear rectification activation function and batch normalization;
  • the third hidden layer is calculated by the softmax function , output the access authority level of the visitor through the output layer.
  • the technical solution adopted in the embodiment of the present application further includes: controlling the visitor's access to the subsystem according to the access authority level is specifically:
  • the access level is risky or abnormal
  • enter the dynamic verification stage prompt the visitor through the client to log in as risky or abnormal, and dynamic verification is required, and collect the verification image of the visitor and the updated cross-domain access data.
  • the verification image and the updated cross-domain access data are simultaneously input into the adaptive cross-domain access network, and the self-adaptive cross-domain access authority network automatically adjusts the visitor's access authority in combination with the cross-domain access data and the verification image.
  • the technical solution adopted in the embodiment of the present application further includes: inputting the verification image and the updated cross-domain access data into the adaptive cross-domain access network at the same time, and the adaptive cross-domain access authority network combines cross-domain access Data and verification images automatically regulate the access rights of visitors as follows:
  • the image information input neurons of the self-adaptive cross-domain access authority network are 32*32*3, and the features are extracted through the hidden layer, and the last hidden layer of the image information input and the last hidden layer of the text information input
  • the layers are connected together as the input neurons of the upper layer of the four neurons of the output layer.
  • the technical solution adopted in the embodiment of the present application also includes: the self-adaptive cross-domain access authority network automatically adjusts the visitor's access authority in combination with cross-domain access data and verification images, specifically:
  • the self-adaptive cross-domain access rights network judges whether the visitor has passed the dynamic verification according to the cross-domain access data and the verification image, and if the dynamic verification is passed, the visitor's access rights are adjusted from risk or abnormality to normal; if the dynamic verification is not passed , adjust the access authority of the visitor from the risk level to abnormal, send an account login exception prompt message to the visitor whose access authority level is abnormal, and notify the administrator.
  • an adaptive cross-domain access authentication system including:
  • Data collection module used to collect cross-domain access data of the visitor's subsystem;
  • the cross-domain access data includes the visitor's account authority, login IP, access scene, mobilization of resources, and closeness between cross-domain access systems;
  • Authority judging module used to input the cross-domain access data into the trained adaptive cross-domain access authority network, and output the visitor's access authority level through the adaptive cross-domain access authority network;
  • the access authority level includes trust , Normal, Risky, and Abnormal;
  • Authority control module used to control the visitor's access to the subsystem according to the access authority level.
  • a terminal includes a processor and a memory coupled to the processor, wherein,
  • the memory stores program instructions for implementing the adaptive cross-domain access authentication method
  • the processor is configured to execute the program instructions stored in the memory to control adaptive cross-domain access authentication.
  • a storage medium storing program instructions executable by a processor, and the program instructions are used to execute the adaptive cross-domain access authentication method.
  • the beneficial effect of the embodiment of the present application lies in that: the adaptive cross-domain access authentication method, system, terminal and storage medium of the embodiment of the present application design an adaptive cross-domain access authority network, according to the access
  • the access authority of the visitor can be judged based on information such as the user's account authority, login IP, access scene, resource mobilization situation, and degree of closeness between cross-domain access systems, so that more comprehensive information can be obtained, and the judgment result is more accurate.
  • This application also designs a network structure for discriminating image verification information. When there is a risk or abnormality in cross-domain access, the image verification information is combined with the login information and the login authority is automatically adjusted to improve work efficiency and avoid one-size-fits-all recognition.
  • This application uses artificial intelligence to judge login permissions, and can update network parameters by increasing the number of data sets after multiple uses, making it more intelligent and efficient.
  • the present invention improves operating efficiency and reduces operating and maintenance costs by setting the server locally.
  • FIG. 1 is a flowchart of an adaptive cross-domain access authentication method according to the first embodiment of the present application
  • FIG. 2 is a flowchart of an adaptive cross-domain access authentication method according to the second embodiment of the present application
  • FIG. 3 is a schematic diagram of processing text information input by an adaptive cross-domain access authority network according to an embodiment of the present application
  • FIG. 4 is a schematic diagram of the processing of text information input and image information input by an adaptive cross-domain access authority network according to an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of an adaptive cross-domain access authentication system according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a storage medium according to an embodiment of the present application.
  • FIG. 1 is a flowchart of an adaptive cross-domain access authentication method according to the first embodiment of the present application.
  • the adaptive cross-domain access authentication method in the first embodiment of the present application includes the following steps:
  • S10 Collect visitor's subsystem cross-domain access data
  • the cross-domain access data includes the visitor's account authority, login IP, access scenarios, resource mobilization, and the degree of closeness between cross-domain access systems.
  • S11 Input the cross-domain access data into the trained adaptive cross-domain access authority network, and output the visitor's access authority level through the adaptive cross-domain access authority network;
  • the level of access authority includes four levels of trust, normal, risk, and abnormal; among them, trust usually refers to the situation that the administrator account of other subsystems is granted access rights and a fixed IP is frequently accessed for a period of time; normal usually refers to the situation of other subsystems.
  • S12 Control the visitor's access to the subsystem according to the access authority level.
  • FIG. 2 is a flowchart of an adaptive cross-domain access authentication method according to the second embodiment of the present application.
  • the adaptive cross-domain access authentication method in the second embodiment of the present application includes the following steps:
  • S20 Collect visitor's subsystem cross-domain access data
  • the cross-domain access data includes the visitor's webpage and client login information and cache history information within the set number of days (the embodiment of this application is set to 7 days), and each piece of cross-domain access data includes the visitor's Five account fixed information, including account authority, login IP, access scenario, resource mobilization, and cross-domain access between systems.
  • S21 Sort the cross-domain access data within a set number of days according to the timeline, number the cross-domain access data for each day, and convert the cross-domain access data into a text information format;
  • sorting and numbering the cross-domain access data of each day can ensure that the data is clearer and easier to find.
  • S22 Input the converted cross-domain access data into the trained adaptive cross-domain access authority network, and output the visitor's access authority level through the adaptive cross-domain access authority network;
  • the adaptive cross-domain access authority network consists of four layers of fully connected neural networks.
  • the network parameters are trained during the system testing phase, and the model data of other mature systems can be migrated. After the debugging is completed, the parameters are saved as default values, and a part of the data can be recorded during the official operation as a reference for future updates.
  • the adaptive cross-domain access authority network includes two inputs, namely text information input for cross-domain access data and image information input for dynamic verification.
  • the image information input is set to zero.
  • FIG. 3 it is a schematic diagram of processing text information input by an adaptive cross-domain access rights network.
  • the number of neurons input by the text information of the self-adaptive cross-domain access authority network is N*5, where N represents the number of days for collecting cross-domain access data.
  • N 7; 5 represents account authority, login IP, access Scenarios, mobilization of resources, and cross-domain access to the closeness of the five account fixed information.
  • the first hidden layer of the adaptive cross-domain access authority network includes 1024 neurons, including 1024*5*7 weights (weights) and 1024 biases (bias); the second hidden layer contains 256 neurons , respectively including 256*1024 weights and 256 biases; the third hidden layer contains 1024 neurons, respectively including 1024*256 weights and 1024 biases; the output layer includes four neurons, each neuron
  • the fully-connected layers of respectively, use linear rectification activation function and batch normalization processing. After the third hidden layer is calculated by the softmax function, the access level of the visitor is output through the output layer. Access rights include four levels of trust, normal, risk, and abnormal.
  • trust is usually the case where the administrator account of other subsystems is granted access rights and a fixed IP is frequently accessed for a period of time; normal is usually the management of other subsystems
  • the first cross-domain access to this subsystem with administrator privileges; the risk is usually cross-domain access by ordinary users of other subsystems, other administrator accounts changing IP addresses in a short period of time, or frequent access to unrelated subsystems.
  • the present application determines the visitor's access operation according to the access authority level output by the adaptive cross-domain access authority network.
  • S23 Determine whether the access authority level of the visitor belongs to trust, normal, risk or abnormality, if the access authority belongs to trust, execute S24; if the access authority belongs to normal, execute S25; if the access authority belongs to risk or abnormality, execute S27;
  • S25 Allow the visitor to obtain the access authority of the subsystem, and determine whether the visitor needs to increase the access authority, and if it is necessary to increase the access authority, execute S26;
  • S27 Enter the dynamic verification stage.
  • the client prompts the visitor to log in as risky or abnormal, and dynamic verification is required, and collects the visitor's verification image and updated cross-domain access data, and compares the verification image with the updated cross-domain access data.
  • the data is input into the adaptive cross-domain access network at the same time, and the adaptive cross-domain access network combines cross-domain access data and verification images to automatically adjust the access rights of visitors;
  • FIG. 4 it is a schematic diagram of processing text information input and image information input by an adaptive cross-domain access rights network.
  • the image information input neurons of the adaptive cross-domain access rights network are 32*32*3, and the features are extracted through the hidden layer. Connection, together as the input neuron of the upper layer of the four neurons of the output layer.
  • the adaptive cross-domain access authority network automatically adjusts the visitor's access authority in combination with the cross-domain access data and the verification image as follows: the adaptive cross-domain access authority network judges whether the visitor has passed the dynamic verification according to the cross-domain access data and the verification image , if the dynamic verification is passed, the visitor's access right is adjusted from risk or abnormal to normal; Send an account login exception prompt message and notify the administrator.
  • the adaptive cross-domain access authentication method of the embodiment of the present application designs an adaptive cross-domain access authority network, according to the account authority of the visitor, login IP, access scene, mobilization of resources, and cross-domain access between systems By using information such as closeness to judge the access authority of the visitor, more comprehensive information can be obtained, and the judgment result is more accurate.
  • This application also designs a network structure for discriminating image verification information. When there is a risk or abnormality in cross-domain access, the image verification information is combined with the login information and the login authority is automatically adjusted to improve work efficiency and avoid one-size-fits-all recognition. Inaccuracies of permissions or denial of permissions, and protection of accounts from disclosure.
  • This application uses artificial intelligence to judge login permissions, and can update network parameters by increasing the number of data sets after multiple uses, making it more intelligent and efficient.
  • the present invention improves operating efficiency and reduces operating and maintenance costs by setting the server locally.
  • FIG. 5 is a schematic structural diagram of an adaptive cross-domain access authentication system according to an embodiment of the present application.
  • the adaptive cross-domain access authentication system 40 of the embodiment of the present application includes:
  • Data collection module 41 used to collect cross-domain access data of the visitor's subsystems; wherein, the cross-domain access data includes the visitor's account authority, login IP, access scene, mobilization of resources, and closeness between cross-domain access systems.
  • Authority judging module 42 used to input the cross-domain access data into the trained adaptive cross-domain access authority network, and output the visitor's access authority level through the adaptive cross-domain access authority network; wherein, the access authority level includes trust, normal, There are four levels of risk and abnormality; among them, trust is usually the situation where administrator rights accounts of other subsystems are granted access rights and a fixed IP is frequently accessed for a period of time; normal is usually the first cross-domain access of administrator rights of other subsystems to this The situation of the subsystem; the risk is usually cross-domain access by ordinary users of other subsystems, changes of IP addresses by other administrator accounts in a short period of time, or frequent access to unrelated subsystems.
  • Authority control module 43 used to control the visitor's access to the subsystem according to the access authority level.
  • FIG. 6 is a schematic diagram of a terminal structure according to an embodiment of the present application.
  • the terminal 50 includes a processor 51 and a memory 52 coupled to the processor 51 .
  • the memory 52 stores program instructions for implementing the above adaptive cross-domain access authentication method.
  • the processor 51 is configured to execute program instructions stored in the memory 52 to control adaptive cross-domain access authentication.
  • the processor 51 may also be referred to as a CPU (Central Processing Unit, central processing unit).
  • the processor 51 may be an integrated circuit chip with signal processing capability.
  • the processor 51 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • FIG. 7 is a schematic structural diagram of a storage medium according to an embodiment of the present application.
  • the storage medium of the embodiment of the present application stores a program file 61 capable of realizing all the above-mentioned methods, wherein the program file 61 can be stored in the above-mentioned storage medium in the form of a software product, and includes several instructions to make a computer device (which can It is a personal computer, a server, or a network device, etc.) or a processor (processor) that executes all or part of the steps of the methods in various embodiments of the present invention.
  • a computer device which can It is a personal computer, a server, or a network device, etc.
  • processor processor
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. , or terminal devices such as computers, servers, mobile phones, and tablets.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

本申请涉及一种自适应跨域访问认证方法、系统、终端以及存储介质。所述方法包括：收集访问者的子系统跨域访问数据；所述跨域访问数据包括所述访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度；将所述跨域访问数据输入训练好的自适应跨域访问权限网络，通过所述自适应跨域访问权限网络输出访问者的访问权限等级；所述访问权限等级包括信任、正常、风险以及异常；根据所述访问权限等级控制所述访问者对子系统的访问。本申请实施例可以得到更全面的登录信息，使得判别结果更加准确，并提高了运行效率，降低了运行成本和维修成本。

Description

一种自适应跨域访问认证方法、系统、终端以及存储介质 技术领域
本申请属于计算机信息安全技术领域，特别涉及一种自适应跨域访问认证方法、系统、终端以及存储介质。
背景技术
随着信息技术的发展和无纸化办公的推进，一些政府部门、高校逐渐采用信息化系统来管理办公系统。然而不同部门之间职能不同，信息管理权限也不同，因此系统划分了不同安全等级域来确保整个办公系统能够安全的运行。不同部门间需要信息共享、协同办公等功能来提升办公效率，因此要求不同安全等级的子系统之间可以实现信息沟通、互相访问。这时，如何确保信息访问时的安全性以及系统高效运行就成为了亟待解决的问题。
现有技术中，信息访问控制主要方法包括：
一、通过防火墙、网关或分级账号权限等技术实现信息数据的互通。此类方法以过高的标准来控制访问者的访问权限，虽然限制了外来的非法入侵者，但也会降低不同部门间的协作效率。同时，在有大量任务提交时，系统过高的防护性会降低工作效率，也有可能造成系统的崩溃，且当管理员账号泄露时会造成安全事故。
二、采用远程云计算进行信息认证进而分发所需跨域访问的资源。该方法对网络要求比较高，当网速波动的时候会极大影响系统运行体验，在面对大量高并发的提交操作时，远程服务器的缺点就更明显。
三、基于区块链技术的跨域访问技术。该技术需要遵守区块链的加密法则，要将所要信息存储在登录的私钥中，造成空间冗余。
四、通过标记与审计结合的跨域访问方法。该方法难以处理账号泄露带来 的风险。
发明内容
本申请提供了一种自适应跨域访问认证方法、系统、终端以及存储介质，旨在至少在一定程度上解决现有技术中的上述技术问题之一。
为了解决上述问题，本申请提供了如下技术方案：
一种自适应跨域访问认证方法，包括：
收集访问者的子系统跨域访问数据；所述跨域访问数据包括所述访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度；
将所述跨域访问数据输入训练好的自适应跨域访问权限网络，通过所述自适应跨域访问权限网络输出访问者的访问权限等级；所述访问权限等级包括信任、正常、风险以及异常；
根据所述访问权限等级控制所述访问者对子系统的访问。
本申请实施例采取的技术方案还包括：所述跨域访问数据为访问者在设定天数内的网页及客户端登录信息和缓存历史信息。
本申请实施例采取的技术方案还包括：所述收集访问者的子系统跨域访问数据还包括：
按照时间线对所述设定天数内的跨域访问数据进行排序，对每一天的跨域访问数据进行编号，并将所述跨域访问数据转换为文本信息格式。
本申请实施例采取的技术方案还包括：所述自适应跨域访问权限网络由四层全连接神经网络组成，自适应跨域访问权限网络包括跨域访问数据的文本信息输入和动态验证的图像信息输入，当仅输入文本信息的跨域访问数据时，所述图像信息输入设为零；
假设所述设定天数为7天，则所述自适应跨域访问权限网络的文本信息输入的神经元为7*5个，其中7表示采集跨域访问数据的天数，5表示账号权限、登录IP、访问场景、调动资源情况以及跨域访问系统间密切程度；所述自适应跨域访问权限网络的第一层隐藏层包括1024个神经元，分别包括1024*5*7个权重和1024个偏置；第二层隐藏层包括256个神经元，分别包括256*1024个权重和256个偏置；第三层隐藏层包括1024个神经元，分别包括1024*256个权重和1024个偏置；自适应跨域访问权限网络的输出层包括四个神经元，每个神经元的全连接层分别采用线性整流激活函数和批归一化处理；由第三层隐藏层经过softmax函数进行计算后，通过所述输出层输出访问者的访问权限等级。
本申请实施例采取的技术方案还包括：所述根据所述访问权限等级控制所述访问者对子系统的访问具体为：
判断所述访问者的访问权限等级属于信任、正常、风险还是异常，如果访问权限等级为信任，允许所述访问者获得子系统管理员权限；如果访问权限等级为正常，允许访问者获得子系统的访问权限；并判断该访问者是否需要提升访问权限，如果需要提升访问权限，则向管理员发送提升访问权限申请；
如果访问权限等级为风险或异常，进入动态验证阶段，通过客户端提示访问者登录存在风险或异常，需要进行动态验证，并采集所述访问者的验证图像以及更新后的跨域访问数据，将所述验证图像与更新后的跨域访问数据同时输入到自适应跨域访问网络中，所述自适应跨域访问权限网络结合跨域访问数据和验证图像自动调节访问者的访问权限。
本申请实施例采取的技术方案还包括：所述将所述验证图像与更新后的跨域访问数据同时输入到自适应跨域访问网络中，所述自适应跨域访问权限网络结合跨域访问数据和验证图像自动调节访问者的访问权限具体为：
将所述验证图像切割为32*32大小，并将切割后的图像拉伸为向量后与更新后的跨域访问数据同时输入到自适应跨域访问网络中；
所述自适应跨域访问权限网络的图像信息输入的神经元为32*32*3个，经过隐藏层提取特征，所述图像信息输入的最后一层隐藏层与文本信息输入的最后一层隐藏层相连接，共同作为输出层四个神经元的上一层输入神经元。
本申请实施例采取的技术方案还包括：所述自适应跨域访问权限网络结合跨域访问数据和验证图像自动调节访问者的访问权限具体为：
所述自适应跨域访问权限网络根据跨域访问数据和验证图像判断访问者是否通过动态验证，如果通过动态验证，则将访问者的访问权限由风险或异常调整为正常；如果没有通过动态验证，则将访问者的访问权限由风险等级调整为异常，向访问权限等级为异常的访问者发送账号登录异常提示信息，并通知管理员。
本申请实施例采取的另一技术方案为：一种自适应跨域访问认证系统，包括：
数据收集模块：用于收集访问者的子系统跨域访问数据；所述跨域访问数据包括所述访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度；
权限判断模块：用于将所述跨域访问数据输入训练好的自适应跨域访问权限网络，通过所述自适应跨域访问权限网络输出访问者的访问权限等级；所述访问权限等级包括信任、正常、风险以及异常；
权限控制模块：用于根据所述访问权限等级控制所述访问者对子系统的访问。
本申请实施例采取的又一技术方案为：一种终端，所述终端包括处理器、与所述处理器耦接的存储器，其中，
所述存储器存储有用于实现所述自适应跨域访问认证方法的程序指令；
所述处理器用于执行所述存储器存储的所述程序指令以控制自适应跨域访问认证。
本申请实施例采取的又一技术方案为：一种存储介质，存储有处理器可运行的程序指令，所述程序指令用于执行所述自适应跨域访问认证方法。
相对于现有技术，本申请实施例产生的有益效果在于：本申请实施例的自适应跨域访问认证方法、系统、终端以及存储介质通过设计了一种自适应跨域访问权限网络，根据访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度等信息判别访问者的访问权限，可以得到更全面的信息，判别结果更加准确。本申请还设计了一种判别图像验证信息的网络结构，当跨域访问存在风险或异常时，将图像验证信息与登录信息相结合并自动调节登录权限，提高工作效率的同时，避免了一刀切承认权限或否认权限的不准确性，并保护账号以防泄露。本申请采用人工智能的方式判断登录权限，可以在多次使用后通过增加数据集数量来更新网络参数，使其更加智能高效。另外，本发明通过将服务器设置在本地，提高了运行效率，降低了运行成本和维修成本。
附图说明
图1是本申请第一实施例的自适应跨域访问认证方法的流程图；
图2是本申请第二实施例的自适应跨域访问认证方法的流程图；
图3为本申请实施例的自适应跨域访问权限网络对文本信息输入的处理示意图；
图4为本申请实施例的自适应跨域访问权限网络对文本信息输入和图像信息输入的处理示意图；
图5为本申请实施例的自适应跨域访问认证系统结构示意图；
图6为本申请实施例的终端结构示意图；
图7为本申请实施例的存储介质的结构示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
请参阅图1，是本申请第一实施例的自适应跨域访问认证方法的流程图。本申请第一实施例的自适应跨域访问认证方法包括以下步骤：
S10：收集访问者的子系统跨域访问数据；
其中，跨域访问数据包括访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度。
S11：将跨域访问数据输入训练好的自适应跨域访问权限网络，通过自适应跨域访问权限网络输出访问者的访问权限等级；
其中，访问权限等级包括信任、正常、风险以及异常四个等级；其中，信任通常为其他子系统的管理员权限账号被赋予访问权限且在一段时间固定IP频繁访问的情况；正常通常为其他子系统的管理员权限首次跨域访问此子系统的情况；风险通常为其他子系统普通用户跨域访问、其他管理员账号短时间更换IP地址或频繁访问无关子系统的情况。
S12：根据访问权限等级控制访问者对子系统的访问。
请参阅图2，是本申请第二实施例的自适应跨域访问认证方法的流程图。本申请第二实施例的自适应跨域访问认证方法包括以下步骤：
S20：收集访问者的子系统跨域访问数据；
本步骤中，跨域访问数据中包括访问者在设定天数(本申请实施例设定为7天)内的网页及客户端登录信息和缓存历史信息，每一条跨域访问数据包括访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度等5个账号固定信息。
S21：按照时间线对设定天数内的跨域访问数据进行排序，对每一天的跨域访问数据进行编号，并将跨域访问数据转换为文本信息格式；
本步骤中，对每一天的跨域访问数据进行排序和编号可以保证数据更加清晰，且便于查找。
S22：将转换后的跨域访问数据输入训练好的自适应跨域访问权限网络，通过自适应跨域访问权限网络输出访问者的访问权限等级；
本步骤中，自适应跨域访问权限网络由四层全连接神经网络组成。在系统测试阶段对网络参数进行训练，可以迁移其他成熟系统的模型数据，在调试完成后保存参数为默认值，在正式运行时可以记录一部分数据作为日后更新的参考。
具体的，自适应跨域访问权限网络包括两个输入，分别是跨域访问数据的文本信息输入和动态验证的图像信息输入。当仅输入文本信息的跨域访问数据时，图像信息输入设为零。如图3所示，为自适应跨域访问权限网络对文本信息输入的处理示意图。自适应跨域访问权限网络的文本信息输入的神经元为N*5个，其中N表示采集跨域访问数据的天数，本申请实施例中，N＝7；5表示账号权限、登录IP、访问场景、调动资源情况以及跨域访问系统间密切程 度五个账号固定信息。自适应跨域访问权限网络的第一层隐藏层包括1024个神经元，分别包括1024*5*7个权重(weights)和1024个偏置(bias)；第二层隐藏层含有256个神经元，分别包括256*1024个权重和256个偏置；第三层隐藏层含有1024个神经元，分别包括1024*256个权重和1024个偏置；输出层包括四个神经元，每个神经元的全连接层分别采用线性整流激活函数和批归一化处理。由第三层隐藏层经过softmax函数进行计算后，通过输出层输出访问者的访问权限等级。访问权限包括信任、正常、风险以及异常四个等级，其中，信任通常为其他子系统的管理员权限账号被赋予访问权限且在一段时间固定IP频繁访问的情况；正常通常为其他子系统的管理员权限首次跨域访问此子系统的情况；风险通常为其他子系统普通用户跨域访问、其他管理员账号短时间更换IP地址或频繁访问无关子系统的情况。本申请根据自适应跨域访问权限网络输出的访问权限等级来确定访问者的访问操作。
S23：判断访问者的访问权限等级属于信任、正常、风险还是异常，如果访问权限属于信任，执行S24；如果访问权限属于正常，执行S25；如果访问权限属于风险或异常，执行S27；
S24：允许访问者获得子系统管理员权限；
S25：允许访问者获得子系统的访问权限，并判断该访问者是否需要提升访问权限，如果需要提升访问权限，执行S26；
S26：向管理员发送提升访问权限申请；
S27：进入动态验证阶段，通过客户端提示访问者登录存在风险或异常，需要进行动态验证，并采集访问者的验证图像以及更新后的跨域访问数据，将验证图像与更新后的跨域访问数据同时输入到自适应跨域访问网络中，自适应跨域访问权限网络结合跨域访问数据和验证图像自动调节访问者的访问权限；
本步骤中，当文本信息输入的权限输出结果为风险或异常等级时，则需要进行动态验证，将验证图像切割为32*32大小，并将切割后的图像拉伸为向量后与更新后的跨域访问数据同时输入到自适应跨域访问网络中。如图4所示，为自适应跨域访问权限网络对文本信息输入和图像信息输入的处理示意图。此时，自适应跨域访问权限网络的图像信息输入的神经元为32*32*3个，经过隐藏层提取特征，数据在最后一层隐藏层与文本信息输入部分的最后一层隐藏层相连接，共同作为输出层四个神经元的上一层输入神经元。
进一步地，自适应跨域访问权限网络结合跨域访问数据和验证图像自动调整访问者的访问权限具体为：自适应跨域访问权限网络根据跨域访问数据和验证图像判断访问者是否通过动态验证，如果通过动态验证，则将访问者的访问权限由风险或异常调整为正常；如果没有通过动态验证，则将访问者的访问权限由风险等级调整为异常，向访问权限等级为异常的访问者发送账号登录异常提示信息，并通知管理员。
基于上述，本申请实施例的自适应跨域访问认证方法通过设计了一种自适应跨域访问权限网络，根据访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度等信息判别访问者的访问权限，可以得到更全面的信息，判别结果更加准确。本申请还设计了一种判别图像验证信息的网络结构，当跨域访问存在风险或异常时，将图像验证信息与登录信息相结合并自动调节登录权限，提高工作效率的同时，避免了一刀切承认权限或否认权限的不准确性，并保护账号以防泄露。本申请采用人工智能的方式判断登录权限，可以在多次使用后通过增加数据集数量来更新网络参数，使其更加智能高效。另外，本发明通过将服务器设置在本地，提高了运行效率，降低了运行成本和维修成本。
请参阅图5，为本申请实施例的自适应跨域访问认证系统结构示意图。本申请实施例的自适应跨域访问认证系统40包括：
数据收集模块41：用于收集访问者的子系统跨域访问数据；其中，跨域访问数据包括访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度。
权限判断模块42：用于将跨域访问数据输入训练好的自适应跨域访问权限网络，通过自适应跨域访问权限网络输出访问者的访问权限等级；其中，访问权限等级包括信任、正常、风险以及异常四个等级；其中，信任通常为其他子系统的管理员权限账号被赋予访问权限且在一段时间固定IP频繁访问的情况；正常通常为其他子系统的管理员权限首次跨域访问此子系统的情况；风险通常为其他子系统普通用户跨域访问、其他管理员账号短时间更换IP地址或频繁访问无关子系统的情况。
权限控制模块43：用于根据访问权限等级控制访问者对子系统的访问。
请参阅图6，为本申请实施例的终端结构示意图。该终端50包括处理器51、与处理器51耦接的存储器52。
存储器52存储有用于实现上述自适应跨域访问认证方法的程序指令。
处理器51用于执行存储器52存储的程序指令以控制自适应跨域访问认证。
其中，处理器51还可以称为CPU(Central Processing Unit，中央处理单元)。处理器51可能是一种集成电路芯片，具有信号的处理能力。处理器51还可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
请参阅图7，为本申请实施例的存储介质的结构示意图。本申请实施例的存储介质存储有能够实现上述所有方法的程序文件61，其中，该程序文件61可以以软件产品的形式存储在上述存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本发明各个实施方式方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质，或者是计算机、服务器、手机、平板等终端设备。
对所公开的实施例的上述说明，使本领域专业技术人员能够实现或使用本发明。对这些实施例的多种修改对本领域的专业技术人员来说将是显而易见的，本发明中所定义的一般原理可以在不脱离本发明的精神或范围的情况下，在其它实施例中实现。因此，本发明将不会被限制于本发明所示的这些实施例，而是要符合与本发明所公开的原理和新颖特点相一致的最宽的范围。

Claims (10)

  1. 一种自适应跨域访问认证方法，其特征在于，包括：
    收集访问者的子系统跨域访问数据；所述跨域访问数据包括所述访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度；
    将所述跨域访问数据输入训练好的自适应跨域访问权限网络，通过所述自适应跨域访问权限网络输出访问者的访问权限等级；所述访问权限等级包括信任、正常、风险以及异常；
    根据所述访问权限等级控制所述访问者对子系统的访问。
  2. 根据权利要求1所述的自适应跨域访问认证方法，其特征在于，所述跨域访问数据为访问者在设定天数内的网页及客户端登录信息和缓存历史信息。
  3. 根据权利要求2所述的自适应跨域访问认证方法，其特征在于，所述收集访问者的子系统跨域访问数据还包括：
    按照时间线对所述设定天数内的跨域访问数据进行排序，对每一天的跨域访问数据进行编号，并将所述跨域访问数据转换为文本信息格式。
  4. 根据权利要求3所述的自适应跨域访问认证方法，其特征在于，所述自适应跨域访问权限网络由四层全连接神经网络组成，自适应跨域访问权限网络包括跨域访问数据的文本信息输入和动态验证的图像信息输入，当仅输入文本信息的跨域访问数据时，所述图像信息输入设为零；
    假设所述设定天数为7天，则所述自适应跨域访问权限网络的文本信息输入的神经元为7*5个，其中7表示采集跨域访问数据的天数，5表示账号权限、登录IP、访问场景、调动资源情况以及跨域访问系统间密切程度；所述自适应跨域访问权限网络的第一层隐藏层包括1024个神经元，分别包括1024*5*7个权重 和1024个偏置；第二层隐藏层包括256个神经元，分别包括256*1024个权重和256个偏置；第三层隐藏层包括1024个神经元，分别包括1024*256个权重和1024个偏置；自适应跨域访问权限网络的输出层包括四个神经元，每个神经元的全连接层分别采用线性整流激活函数和批归一化处理；由第三层隐藏层经过softmax函数进行计算后，通过所述输出层输出访问者的访问权限等级。
  5. 根据权利要求4所述的自适应跨域访问认证方法，其特征在于，所述根据所述访问权限等级控制所述访问者对子系统的访问具体为：
    判断所述访问者的访问权限等级属于信任、正常、风险还是异常，如果访问权限等级为信任，允许所述访问者获得子系统管理员权限；如果访问权限等级为正常，允许访问者获得子系统的访问权限；并判断该访问者是否需要提升访问权限，如果需要提升访问权限，则向管理员发送提升访问权限申请；
    如果访问权限等级为风险或异常，进入动态验证阶段，通过客户端提示访问者登录存在风险或异常，需要进行动态验证，并采集所述访问者的验证图像以及更新后的跨域访问数据，将所述验证图像与更新后的跨域访问数据同时输入到自适应跨域访问网络中，所述自适应跨域访问权限网络结合跨域访问数据和验证图像自动调节访问者的访问权限。
  6. 根据权利要求5所述的自适应跨域访问认证方法，其特征在于，所述将所述验证图像与更新后的跨域访问数据同时输入到自适应跨域访问网络中，所述自适应跨域访问权限网络结合跨域访问数据和验证图像自动调节访问者的访问权限具体为：
    将所述验证图像切割为32*32大小，并将切割后的图像拉伸为向量后与更新后的跨域访问数据同时输入到自适应跨域访问网络中；
    所述自适应跨域访问权限网络的图像信息输入的神经元为32*32*3个，经过隐藏层提取特征，所述图像信息输入的最后一层隐藏层与文本信息输入的最后一层隐藏层相连接，共同作为输出层四个神经元的上一层输入神经元。
  7. 根据权利要求5所述的自适应跨域访问认证方法，其特征在于，所述自适应跨域访问权限网络结合跨域访问数据和验证图像自动调节访问者的访问权限具体为：
    所述自适应跨域访问权限网络根据跨域访问数据和验证图像判断访问者是否通过动态验证，如果通过动态验证，则将访问者的访问权限由风险或异常调整为正常；如果没有通过动态验证，则将访问者的访问权限由风险等级调整为异常，向访问权限等级为异常的访问者发送账号登录异常提示信息，并通知管理员。
  8. 一种自适应跨域访问认证系统，其特征在于，包括：
    数据收集模块：用于收集访问者的子系统跨域访问数据；所述跨域访问数据包括所述访问者的账号权限、登录IP、访问场景、调动资源情况、跨域访问系统间密切程度；
    权限判断模块：用于将所述跨域访问数据输入训练好的自适应跨域访问权限网络，通过所述自适应跨域访问权限网络输出访问者的访问权限等级；所述访问权限等级包括信任、正常、风险以及异常；
    权限控制模块：用于根据所述访问权限等级控制所述访问者对子系统的访问。
  9. 一种终端，其特征在于，所述终端包括处理器、与所述处理器耦接的存储器，其中，
    所述存储器存储有用于实现权利要求1-7任一项所述的自适应跨域访问认证方法的程序指令；
    所述处理器用于执行所述存储器存储的所述程序指令以控制自适应跨域访问认证。
  10. 一种存储介质，其特征在于，存储有处理器可运行的程序指令，所述程序指令用于执行权利要求1至7任一项所述自适应跨域访问认证方法。
PCT/CN2021/112276 2021-07-22 2021-08-12 一种自适应跨域访问认证方法、系统、终端以及存储介质 Ceased WO2023000413A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110830145.4 2021-07-22
CN202110830145.4A CN113676455B (zh) 2021-07-22 2021-07-22 一种自适应跨域访问认证方法、系统、终端以及存储介质

Publications (1)

Publication Number Publication Date
WO2023000413A1 true WO2023000413A1 (zh) 2023-01-26

Family

ID=78539794

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/112276 Ceased WO2023000413A1 (zh) 2021-07-22 2021-08-12 一种自适应跨域访问认证方法、系统、终端以及存储介质

Country Status (2)

Country Link
CN (1) CN113676455B (zh)
WO (1) WO2023000413A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116827660A (zh) * 2023-07-21 2023-09-29 中国移动通信集团江苏有限公司 账号权限安全控制方法、装置、设备及存储介质
CN117375893A (zh) * 2023-09-22 2024-01-09 南京中新赛克科技有限责任公司 一种基于r-GRU网络的工业互联网跨域访问请求潜在风险判别方法及判别系统
CN117857221A (zh) * 2024-03-07 2024-04-09 北京谷器数据科技有限公司 一种针对远程服务平台的权限管理方法及系统
CN118410514A (zh) * 2023-02-21 2024-07-30 南京霄浩田电子商务有限公司 一种安全性高的加密系统
CN118862187A (zh) * 2024-09-27 2024-10-29 山东野藤生物科技有限公司 一种基于区块链的药物研发临床医疗数据安全共享系统
CN118972101A (zh) * 2024-07-17 2024-11-15 北京建恒信安科技有限公司 基于身份安全的终端系统防护方法、系统及存储介质
CN119203096A (zh) * 2024-11-28 2024-12-27 江西展群科技有限公司 一种企业资源访问管理方法及平台

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118646603B (zh) * 2024-08-14 2024-10-29 成都优卡数信信息科技有限公司 一种数据访问权限控制方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003075516A1 (en) * 2002-03-04 2003-09-12 Telenor Asa A system and method for controlling the access to an external network
CN101719202A (zh) * 2009-11-12 2010-06-02 北京交通大学 一种基于动态信任管理的互操作安全保障方法
CN106341428A (zh) * 2016-11-21 2017-01-18 航天信息股份有限公司 一种跨域访问控制方法和系统
CN111611324A (zh) * 2020-05-06 2020-09-01 中国科学院信息工程研究所 一种跨域访问策略优化方法及装置

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7487233B2 (en) * 2001-12-05 2009-02-03 Canon Kabushiki Kaisha Device access based on centralized authentication
US8117325B1 (en) * 2008-04-29 2012-02-14 Juniper Networks, Inc. Policy-based cross-domain access control for SSL VPN
US8572675B2 (en) * 2009-04-03 2013-10-29 The Boeing Company System and method for facilitating the provision of web services across different internet security domains
CN102761551B (zh) * 2012-07-09 2014-12-17 郑州信大捷安信息技术股份有限公司 多级跨域访问控制系统及控制方法
CN104506480B (zh) * 2014-06-27 2018-11-23 深圳市永达电子信息股份有限公司 基于标记与审计结合的跨域访问控制方法及系统
CN105812323B (zh) * 2014-12-30 2019-08-27 Tcl集团股份有限公司 一种网络跨域访问数据的方法和装置
CN109842625A (zh) * 2019-02-02 2019-06-04 北京奇安信科技有限公司 一种动态访问控制方法及系统
CN111865885B (zh) * 2019-04-30 2022-07-01 中移(苏州)软件技术有限公司 一种访问控制方法、装置、设备及存储介质
CN110705688B (zh) * 2019-09-05 2023-07-07 创新先进技术有限公司 对操作事件进行风险评估的神经网络系统、方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003075516A1 (en) * 2002-03-04 2003-09-12 Telenor Asa A system and method for controlling the access to an external network
CN101719202A (zh) * 2009-11-12 2010-06-02 北京交通大学 一种基于动态信任管理的互操作安全保障方法
CN106341428A (zh) * 2016-11-21 2017-01-18 航天信息股份有限公司 一种跨域访问控制方法和系统
CN111611324A (zh) * 2020-05-06 2020-09-01 中国科学院信息工程研究所 一种跨域访问策略优化方法及装置

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118410514A (zh) * 2023-02-21 2024-07-30 南京霄浩田电子商务有限公司 一种安全性高的加密系统
CN116827660A (zh) * 2023-07-21 2023-09-29 中国移动通信集团江苏有限公司 账号权限安全控制方法、装置、设备及存储介质
CN117375893A (zh) * 2023-09-22 2024-01-09 南京中新赛克科技有限责任公司 一种基于r-GRU网络的工业互联网跨域访问请求潜在风险判别方法及判别系统
CN117375893B (zh) * 2023-09-22 2024-05-24 南京中新赛克科技有限责任公司 一种基于r-GRU网络的工业互联网跨域访问请求潜在风险判别方法及判别系统
CN117857221A (zh) * 2024-03-07 2024-04-09 北京谷器数据科技有限公司 一种针对远程服务平台的权限管理方法及系统
CN117857221B (zh) * 2024-03-07 2024-06-04 北京谷器数据科技有限公司 一种针对远程服务平台的权限管理方法及系统
CN118972101A (zh) * 2024-07-17 2024-11-15 北京建恒信安科技有限公司 基于身份安全的终端系统防护方法、系统及存储介质
CN118862187A (zh) * 2024-09-27 2024-10-29 山东野藤生物科技有限公司 一种基于区块链的药物研发临床医疗数据安全共享系统
CN119203096A (zh) * 2024-11-28 2024-12-27 江西展群科技有限公司 一种企业资源访问管理方法及平台

Also Published As

Publication number Publication date
CN113676455A (zh) 2021-11-19
CN113676455B (zh) 2022-08-19

Similar Documents

Publication Publication Date Title
CN113676455B (zh) 一种自适应跨域访问认证方法、系统、终端以及存储介质
US11722491B1 (en) Cumulative risk-based scoring for quorum authorization
US10992657B1 (en) Multi-account entity based access control
CN103842985B (zh) 强化安全防护的云系统及其安全防护管理方法
US20210241241A1 (en) Systems, methods, and apparatuses for conducting transactions between bots using distributed ledger technology in a cloud based computing environment
CN117978556B (zh) 一种数据访问控制方法、网络交换子系统及智能计算平台
US12132747B2 (en) User impact potential for security alert management
US11381972B2 (en) Optimizing authentication and management of wireless devices in zero trust computing environments
US12455971B2 (en) Application groups for enforcing data transfer controls
US20220272128A1 (en) Zero-trust decentralized cybersecurity architecture for endpoint devices
Gupta et al. Enabling attribute-based access control in NoSQL databases
US20250190587A1 (en) Assessing and identifying responses to security risks
Liu et al. Data‐Driven Zero Trust Key Algorithm
US11645297B2 (en) System and method for smart database driver
US20240114056A1 (en) Defining a security perimeter using knowledge of user behavior within a content management system
US11316864B2 (en) Method and apparatus for ephemeral roles implementing module
CN118246519A (zh) 一种用于联邦学习的系统
US12437062B1 (en) Custom loss functions for training models for cybersecurity applications
CN120378201A (zh) 一种电力网络上下文场景关联访问控制方法及系统
US20250265333A1 (en) Quantum Computing Fraud Protection System
US12563088B1 (en) System and method to dynamically analyze biometric data
CN119066696B (zh) 基于隐私保护的数据处理方法、装置、设备及存储介质
US20260064849A1 (en) Real-Time Artificial Intelligence Model Vulnerability Testing System
Liu et al. Research on the comprehensive application of cloud technology and Web 3.0
Btia et al. Secure Context-Aware Learning Platforms with Cognitive Adaptation Mechanisms

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21950655

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21950655

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 21950655

Country of ref document: EP

Kind code of ref document: A1