Account authentication method and device

Abstract

The embodiment of the invention provides an account authentication method and device, and relates to the technical field of information security. The method comprises the steps that after an authentication request which is sent by a user terminal and carries account information of an account to be authenticated is received, the number of times of continuous authentication failure corresponding tothe account to be authenticated is obtained; when the number of times of continuous authentication failures is larger than or equal to a preset verification threshold value, indication information issent to the user terminal, and the indication information is used for indicating input of a verification code; if the verification code sent by the user terminal is received and it is determined thatthe received verification code passes the verification, the to-be-authenticated account IS authenticated according to the account information; and if the verification code sent by the user terminal isnot received or it is determined that the received verification code does not pass the verification, the authentication request is discharded. By adopting the method, the user experience can be improved.

Description

technical field [0001] The present application relates to the technical field of information security, in particular to an account authentication method and device. Background technique [0002] In related technologies, the user usually uses the account information (such as user name and password) of the account to be authenticated for authentication, so as to obtain preset network permissions after successful authentication. However, this authentication method has security problems. When the attacker obtains the username of the account to be authenticated, the attacker can brute force crack the password corresponding to the username, that is, the attacker uses the automated cracking tool to Enter different passwords one by one for authentication until the entered password is correct. [0003] In order to prevent brute force cracking by attackers, in the prior art, the server usually detects the number of consecutive authentication failures when the server authenticates the...

AI Technical Summary

Problems solved by technology

At this time, the legitimate user of the account cannot authenticate the account. Only after the legitimate user requests the administrator to unlock the account to be authenticated can the authentication be performed, which brings additional unlocking operations to the legitimate user and affects the user experience.

Images