Login control method, device, electronic device and storage medium

Abstract

The present invention provides a login control method, device, electronic device and storage medium, the method comprising: sending a login request of a target network system to a server, so that the server determines a terminal device operating environment inspection strategy according to the security requirements of the target network system; receiving the terminal device operating environment inspection strategy; inspecting the operating environment of the terminal device according to the terminal device operating environment inspection strategy, and obtaining the credibility of the terminal device according to the inspection result; sending the credibility of the terminal device to the server, so that the server determines whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device. The present invention avoids the network security risks brought about by the network security architecture in the prior art that mainly determines the user login authority based on the network location of the user.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a login control method, device, electronic equipment and storage medium. Background Art

[0002] The rapid development of emerging information technologies such as cloud computing, big data, the Internet of Things, mobile Internet, and artificial intelligence has brought new challenges to information security.

[0003] The traditional perimeter-based network security architecture controls the user's login permissions based on the user's network location (such as the enterprise intranet or the enterprise extranet). In this network security architecture, it is usually assumed or defaulted that the enterprise intranet is secure, and users will not be subject to too many restrictions when logging in to the enterprise intranet.

[0004] However, in reality, external and internal attacks are becoming more and more severe, and advanced persistent attacks represented by APT attacks can still find various loopholes to break through the boundaries of enterprises. At the same time, internal threats such as unauthorized access to internal business, employee mistakes, and intentional data theft are also emerging.

[0005] Therefore, the traditional perimeter-based network security architecture can no longer meet the needs of information security. Summary of the invention

[0006] The present invention provides a login control method, device, electronic device and storage medium, which are used to solve the defect of network security risk brought by the network security architecture in the prior art that the user login authority is mainly determined based on the network location of the user.

[0007] A first aspect of the present invention provides a login control method, comprising:

[0008] Sending a login request of the target network system to the server, so that the server determines a terminal device operating environment inspection policy according to the security requirements of the target network system; wherein the terminal device operating environment inspection policy is used to describe the inspection items included in the inspection of the operating environment of the terminal device;

[0009] Receive terminal equipment operating environment inspection strategy;

[0010] According to the terminal device operating environment inspection strategy, the operating environment of the terminal device is inspected, and the credibility of the terminal device is obtained according to the inspection result;

[0011] The credibility of the terminal device is sent to the server, so that the server determines whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device.

[0012] According to a login control method provided by the present invention, the terminal device operating environment inspection strategy includes a virus information inspection item, and the virus information inspection item includes: a computer virus real-time existence inspection sub-item and a computer virus database update time inspection sub-item;

[0013] Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes:

[0014] Checking the types and quantities of computer viruses existing in the terminal device in real time to obtain a first virus information check result;

[0015] Checking the update time of the computer virus database of the terminal device to obtain a second virus information check result;

[0016] The credibility of the terminal device is determined according to the virus information check result; wherein the virus information check result includes a first virus information check result and a second virus information check result.

[0017] According to a login control method provided by the present invention, the terminal device operating environment inspection strategy includes a password information inspection item, and the password information inspection item includes: a password length inspection sub-item, a password usage period inspection sub-item, and a password complexity inspection sub-item;

[0018] Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes:

[0019] Checking the length of the password of the user logging into the terminal device to obtain a first password information check result;

[0020] Checking the validity period of the password of the user for logging into the terminal device to obtain a second password information check result;

[0021] Checking the complexity of the password of the user for logging into the terminal device to obtain a third password information check result;

[0022] The credibility of the terminal device is determined according to the password information check result; wherein the password information check result includes a first password information check result, a second password information check result and a third password information check result.

[0023] According to a login control method provided by the present invention, the terminal device operating environment inspection strategy includes a port information inspection item;

[0024] Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes:

[0025] Check the number and type of ports in the terminal device that are in an open state to obtain a port information check result;

[0026] The credibility of the terminal device is determined according to the port information checking result.

[0027] According to a login control method provided by the present invention, the terminal device operating environment inspection strategy includes one or more of the following inspection items: an account lockout strategy inspection item, a remote login inspection item, a software installation status inspection item, a sharing status inspection item, and an Internet access information inspection item;

[0028] Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes:

[0029] Checking a threshold of the number of failed login attempts and a lockout duration for a user's account to be locked due to a user's failed login attempts to the terminal device, and obtaining an account lockout policy check result;

[0030] Determining the credibility of the terminal device according to the account lock policy check result;

[0031] and / or, checking whether the terminal device allows remote login, and obtaining a remote login check result;

[0032] Determining the credibility of the terminal device according to the remote login check result;

[0033] and / or, checking whether the terminal device has any software that is prohibited from being installed, thereby obtaining a software installation status check;

[0034] Determining the credibility of the terminal device according to the software installation status check result;

[0035] and / or, checking whether a shared file directory exists on the terminal device to obtain a sharing status check result;

[0036] Determining the credibility of the terminal device according to the sharing status check result;

[0037] and / or, checking whether the terminal device is allowed to access the Internet, and obtaining an Internet access information checking result;

[0038] The credibility of the terminal device is determined according to the Internet access information checking result.

[0039] A second aspect of the present invention provides a login control method, comprising:

[0040] Receiving a login request from a terminal device to a target network system, and determining a terminal device operating environment check policy according to the security requirements of the target network system; wherein the terminal device operating environment check policy is used to describe the check items included in checking the operating environment of the terminal device;

[0041] Receive the credibility of the terminal device, and determine whether to allow the terminal device to log in to the target network system based on the credibility of the terminal device; wherein the credibility of the terminal device is obtained by checking the operating environment of the terminal device according to the terminal device operating environment checking strategy.

[0042] According to a login control method provided by the present invention, determining whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device includes:

[0043] When the credibility of the terminal device is greater than or equal to a preset credibility threshold, allowing the terminal device to log in to the target network system;

[0044] When the credibility of the terminal device is less than a preset credibility threshold, the connection between the terminal device and the target network system is blocked.

[0045] A third aspect of the present invention provides a login control system, comprising: a terminal device and a server, wherein the terminal device is communicatively connected with the server;

[0046] The terminal device is used to implement the steps of the login control method according to the first aspect of the present invention;

[0047] The server is used to implement the steps of the login control method described in the second aspect of the present invention.

[0048] The fourth aspect of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the login control method as described in the first aspect of the present invention are implemented, or the steps of the login control method as described in the second aspect of the present invention are implemented.

[0049] The fifth aspect of the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the login control method as described in the first aspect of the present invention are implemented, or the steps of the login control method as described in the second aspect of the present invention are implemented.

[0050] The sixth aspect of the present invention provides a computer program product, which includes computer executable instructions, which, when executed, are used to implement the steps of the login control method as described in the first aspect of the present invention, or to implement the steps of the login control method as described in the second aspect of the present invention.

[0051] The login control method, device, electronic device and storage medium provided by the present invention determine the credibility of the terminal device by checking the operating environment of the terminal device, and then determine whether the terminal device is allowed to log in to the target network system, avoiding the network security risks brought about by the network security architecture in the prior art that mainly determines the user login authority based on the user's network location. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 A schematic diagram of an application scenario of the login control method of the present invention;

[0054] Figure 2 One of the flow charts of the login control method of the present invention;

[0055] Figure 3 This is the second flowchart of the login control method of the present invention;

[0056] Figure 4 A schematic diagram of a terminal device in a login control system of the present invention;

[0057] Figure 5 A schematic diagram of a server in a login control system of the present invention;

[0058] Figure 6 This is a schematic structural diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] Combine the following Figure 1-Figure 6The invention describes a login control method, device, electronic device and storage medium.

[0061] Figure 1 FIG. 1 is a schematic diagram of an application scenario of the login control method of the present invention. Figure 1 As shown, a user wishes to log in to an intranet office system through a terminal device. The terminal device is first connected to a server, and the server checks the operating status of the terminal device based on the login control method of the present invention to determine whether the terminal has the authority to log in to the intranet office system.

[0062] exist Figure 1 In the application scenario shown, the intranet office system is used as the network system that the user terminal device needs to log in. Those skilled in the art should understand that the login control method of the present invention can also be used to implement login control of other types of network systems by the user terminal device.

[0063] In the embodiment of the present invention, the terminal device is an electronic device with an intelligent operating system, such as a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle terminal, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), and any other electronic device with an intelligent operating system, which is not specifically limited in the embodiment of the present invention.

[0064] Figure 2 is one of the flow charts of the login control method of the present invention, as shown in Figure 2 As shown, the login control method of the present invention can be applied to a terminal device, and the method includes:

[0065] Step 201: Send a login request of a target network system to a server, so that the server determines a terminal device operating environment inspection strategy according to the security requirements of the target network system.

[0066] In this embodiment, the target network system refers to the network system that the user expects to log in through the terminal device, such as an intranet office system, a public commercial network system, etc.

[0067] The target network system login request sent by the terminal device to the server contains information about the target network system, such as the domain name and IP address. After the server determines the target network system based on the login request, it can determine the terminal device operating environment inspection strategy based on the security requirements of the target network system.

[0068] The terminal device operating environment check policy is used to describe the check items included when checking the operating environment of the terminal device.

[0069] There may be many types of check items included in the terminal device operating environment check policy, such as check items on virus information, check items on password information, check items on port information, check items on account lock policy, check items on remote login, check items on software installation status, check items on sharing status, and check items on Internet access information, etc. The server determines the terminal device operating environment check policy according to the security requirements of the target network system.

[0070] For example, when the target network system to be logged in is an office network of a state agency, the security requirements are relatively high, and accordingly, the terminal device operating environment inspection policy at least includes inspection items on virus information, software installation status, and sharing status, etc. When the target network system to be logged in is a public network, the security requirements are relatively low, and accordingly, the terminal device operating environment inspection policy may only include inspection items on virus information.

[0071] Step 202: Receive a terminal device operating environment check strategy.

[0072] Step 203: Check the operating environment of the terminal device according to the terminal device operating environment check strategy, and obtain the credibility of the terminal device according to the check result.

[0073] In this embodiment, the terminal device operating environment inspection strategy includes at least a virus information inspection item.

[0074] The virus information check item is used to check the information related to computer viruses in the terminal device. Specifically, the virus information check item may include: a computer virus real-time existence check sub-item and a computer virus database update time check sub-item.

[0075] The computer virus real-time existence check sub-item is used to check the types and quantities of computer viruses that exist in the operating system of the terminal device in real time.

[0076] There are many types of computer viruses, and the harm caused by different types of computer viruses is different. Different numbers of computer viruses also cause different harms to the terminal device operating system. Therefore, the first virus information inspection result can be determined based on the type and number of computer viruses inspected.

[0077] The common way to express the result of the first virus information check is as a score. The higher the score, the lower the harm of the computer virus to the terminal device operating system. Assuming that the full score of the first virus information check result is 10 points, when there is no computer virus in the terminal device operating system, the first virus information check result can be a full score of 10 points. When there is a computer virus in the terminal device operating system, but the degree of harm of the computer virus is not high, such as the harm of the computer virus is mainly to occupy the computing resources and / or storage resources of the terminal device, the first virus information check result can be set to a higher score, such as 8 points. When there is a computer virus in the terminal device operating system, and the degree of harm of the computer virus is high, such as the harm of the computer virus is mainly to steal the user's sensitive information (such as personal identity information, bank account information, etc.), the first virus information check result can be set to a lower score, such as 1 point.

[0078] The computer virus database update time check sub-item is used to check the update time of the computer virus database installed on the terminal device.

[0079] Those skilled in the art know that computer viruses are constantly evolving, and therefore it is necessary to periodically update the computer virus database to ensure the ability to detect and kill emerging computer viruses.

[0080] According to the computer virus database update time check sub-item, the update time of the computer virus database is checked, and the second virus information check result is determined according to the check result.

[0081] The second virus information check result is commonly expressed as a score. The higher the score, the better the update of the computer virus database. Assuming that the full score of the second virus information check result is 10 points, if the computer virus database of the terminal device is the latest version of the computer virus database, then the second virus information check result is 10 points. If the computer virus database of the terminal device is not the latest version of the computer virus database, but the update time interval with the latest version is short, the second virus information check result can be set to a higher score, such as 7 points. If the computer virus database of the terminal device is not the latest version of the computer virus database, and the update time interval with the latest version is long, the second virus information check result can be set to a lower score, such as 3 points.

[0082] After the operating environment of the terminal device is checked, the credibility of the terminal device can be generated according to the obtained check results.

[0083] Take the terminal device operating environment inspection strategy that only includes the virus information inspection item as an example. Assuming that the full marks of the first virus information inspection result and the second virus information inspection result are both 10 points, the first virus information inspection result obtained by inspecting a terminal device is 7 points, the second virus information inspection result is 4 points, and the weights of the first virus information inspection result and the second virus information inspection result are the same, then the credibility of the terminal device is determined by the virus information inspection result, and its value is (7+4) / (10+10)=0.55.

[0084] Of course, in actual applications, the weights of the first virus information check result and the second virus information check result may be different. For example, a higher weight value, such as 0.8, is set for the first virus information check result, and a lower weight value, such as 0.2, is set for the second virus information check result, then the credibility of the terminal device is (0.8*7+0.2*4) / (0.8*10+0.2*10)=0.64.

[0085] The terminal device operating environment inspection strategy may also include other inspection items. If the terminal device operating environment inspection strategy includes other inspection items, then when calculating the credibility of the terminal device, the inspection results of other inspection items need to be included. This will be further explained in the following embodiments.

[0086] Step 204: Send the credibility of the terminal device to the server, so that the server determines whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device.

[0087] In the previous step, the credibility of the terminal device has been calculated. In this step, the credibility of the terminal device can be sent to the server. The server will compare the credibility of the terminal device with the preset credibility threshold. If the credibility of the terminal device is greater than or equal to the preset credibility threshold, the terminal device is allowed to log in to the target network system. If the credibility of the terminal device is less than the preset credibility threshold, the terminal device is not allowed to log in to the target network system, that is, the connection between the terminal device and the target network system is blocked.

[0088] For example, the preset credibility threshold is 0.6, and the credibility of a terminal device is 0.64, so the terminal device is allowed to log in to the target network system. The credibility of another terminal device is 0.55, so the terminal device is not allowed to log in to the target network system.

[0089] The login control method of the present invention determines the credibility of the terminal device by checking the operating environment of the terminal device, and then determines whether the terminal device is allowed to log in to the target network system, avoiding the network security risks brought about by the network security architecture in the prior art that mainly determines the user login authority based on the user's network location.

[0090] Based on any of the above embodiments, in this embodiment, the terminal device operating environment inspection strategy further includes a password information inspection item, and the password information inspection item includes: a password length inspection sub-item, a password usage period inspection sub-item, and a password complexity inspection sub-item;

[0091] Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes:

[0092] Checking the length of the password of the user logging into the terminal device to obtain a first password information check result;

[0093] Checking the validity period of the password of the user for logging into the terminal device to obtain a second password information check result;

[0094] Checking the complexity of the password of the user for logging into the terminal device to obtain a third password information check result;

[0095] The credibility of the terminal device is determined according to the password information check result; wherein the password information check result includes a first password information check result, a second password information check result and a third password information check result.

[0096] Passwords are an important means of ensuring network security. The password information check item is used to check the password information entered by the user when logging into the terminal device.

[0097] In this embodiment, the password information check item includes: a password length check sub-item, a password expiration check sub-item, and a password complexity check sub-item.

[0098] The password length check sub-item is used to check the password length. It is easy for those skilled in the art to understand that the shorter the password is, the easier it is to be cracked by others. For example, a two-digit password can be easily cracked by others using brute force enumeration. Therefore, the password length can reflect the difficulty of cracking the password to a certain extent.

[0099] According to the password length, the first check result of the password information can be obtained. The first check result of the password information is usually expressed as a score. The longer the password is, the higher the score is, and the shorter the password is, the lower the score is. Since a password of infinite length is not possible in practical applications, and when the password length reaches a certain value, further increasing the password length will not help network security, a threshold can be set for the password length. When the password length reaches the threshold, the first check result of the password information is full marks, and even if the password length is increased, the score of the first check result of the password information will not increase.

[0100] The password expiration check sub-item is used to check the password expiration. Theoretically, the longer the password expiration, the easier it is to be leaked or cracked by others. On the contrary, the shorter the password expiration, the less likely it is to be leaked or cracked by others. Therefore, the password expiration can reflect the difficulty of cracking the password to a certain extent.

[0101] The second password information check result can be obtained based on the password usage period. The second password information check result is usually expressed as a score. The shorter the password usage period, the higher the score, and the longer the password usage period, the lower the score.

[0102] The password complexity sub-item is used to check the complexity of the password. It is easy for those skilled in the art to understand that the more complex the password is, the harder it is to crack, and the simpler the password is, the easier it is to crack. For example, a user sets his or her birthday as his or her password, and the password is easy to crack by others. Another user sets an irregular string of numbers, letters, Chinese characters, and punctuation marks as a password, and the password is difficult to crack by others.

[0103] According to the password complexity, the third check result of the password information can be obtained. The third check result of the password information is usually expressed as a score. The higher the password complexity, the higher the score, and the lower the password complexity, the lower the score.

[0104] The credibility of the terminal device can be determined based on the password information check result. If the credibility of the terminal device is determined based only on the password information check result, it is essentially the same as the credibility of the terminal device determined based only on the virus information check result described in the previous embodiment, and will not be repeated here.

[0105] If the check items of the terminal device operating environment check policy include not only password information check items but also virus information check items, then when calculating the credibility of the terminal device, it is necessary to consider both the password information check result and the virus information check result.

[0106] For example, assume that the full marks of the first virus information check result and the second virus information check result are both 10 points, and the full marks of the first password information check result, the second password information check result, and the third password information check result are all 20 points. The first virus information check result obtained by checking a certain terminal device is 7 points, the second virus information check result is 4 points, the first password information check result is 15 points, the second password information check result is 10 points, and the third password information check result is 18 points. The weights of each check result are the same, so the credibility of the terminal device is (7+4+15+10+18) / (10+10+20+20+20)=0.675.

[0107] After the login control method of the present invention incorporates the password information checking result into the calculation of the terminal device credibility, the terminal device credibility can reflect the password information input by the user when logging into the terminal device, and can better ensure network security.

[0108] Based on any of the above embodiments, in this embodiment, the terminal device operating environment inspection strategy further includes a port information inspection item;

[0109] Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes:

[0110] Check the number and type of ports in the terminal device that are in an open state to obtain a port information check result;

[0111] The credibility of the terminal device is determined according to the port information checking result.

[0112] A port is an exit for a terminal device to communicate with the outside world. Generally, a terminal device should not open ports to the outside world. When a terminal device opens certain types of ports to the outside world, there will be certain network security risks. For example, when a terminal device opens TCP port 22, the outside world can remotely control the terminal device through SSH (Secure Shell); when a terminal device opens TCP port 20 and TCP port 21, the outside world can upload or download files to the terminal device through FTP (File Transfer Protocol). These ports are also called high-risk ports. Based on existing public literature, a list of high-risk ports can be obtained.

[0113] The port information check item is used to check whether there are high-risk ports in the terminal device that are open. The port information check result can be obtained based on the number and type of high-risk ports that are open. The type of high-risk ports can reflect their degree of harm, and the corresponding relationship between the type and the degree of harm can be obtained based on the existing network security data.

[0114] The port information check result is usually expressed as a score. The fewer high-risk ports that are open, the lower the risk, and the higher the score; the more high-risk ports that are open, the higher the risk, and the lower the score.

[0115] The credibility of the terminal device can be determined based on the port information check result. The credibility of the terminal device can be obtained based on the port information check result alone, or based on the port information check result and the check results of other check items. In the previous embodiment, the generation process of the credibility of the terminal device has been illustrated, so it will not be repeated in this embodiment.

[0116] After the login control method of the present invention incorporates the port information check result into the calculation of the terminal device credibility, the terminal device credibility can reflect the port status of the terminal device, making the judgment of the terminal device credibility more accurate and better ensuring network security.

[0117] Based on any of the above embodiments, in this embodiment, the terminal device operating environment inspection strategy further includes one or more of the following inspection items: an account lockout strategy inspection item, a remote login inspection item, a software installation status inspection item, a sharing status inspection item, and an Internet access information inspection item;

[0118] Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes:

[0119] Checking a threshold of the number of failed login attempts and a lockout duration for a user's account to be locked due to a user's failed login attempts to the terminal device, and obtaining an account lockout policy check result;

[0120] Determining the credibility of the terminal device according to the account lock policy check result;

[0121] and / or, checking whether the terminal device allows remote login, and obtaining a remote login check result;

[0122] Determining the credibility of the terminal device according to the remote login check result;

[0123] and / or, checking whether the terminal device has any software that is prohibited from being installed, thereby obtaining a software installation status check;

[0124] Determining the credibility of the terminal device according to the software installation status check result;

[0125] and / or, checking whether a shared file directory exists on the terminal device to obtain a sharing status check result;

[0126] Determining the credibility of the terminal device according to the sharing status check result;

[0127] and / or, checking whether the terminal device is allowed to access the Internet, and obtaining an Internet access information checking result;

[0128] The credibility of the terminal device is determined according to the Internet access information checking result.

[0129] In this embodiment, the account lockout policy check item includes a lockout times threshold check sub-item and a lockout duration check sub-item.

[0130] The lockout times threshold check sub-item is used to check the login failure times threshold for locking the account when the user fails to log in to the terminal device. For example, when a user logs in to the terminal device, due to various reasons, he fails to log in 4 times in a row. When the 5th login fails, the user's account is locked, and the lockout times threshold is 5.

[0131] The lockout threshold check result is usually expressed as a score. The smaller the lockout threshold, the fewer chances others have to log in, the higher the security, and the higher the score. Conversely, the larger the lockout threshold, the lower the score.

[0132] The lockout duration check sub-item is used to check the length of time that the account is locked when a user fails to log in to the terminal device. For example, if a user logs in to the terminal device and fails to log in multiple times in a row, the user's account is locked for 1 hour. 1 hour is the lockout duration.

[0133] The lockout duration check result is usually expressed as a score. The longer the lockout duration, the fewer chances others have to try to log in again, the higher the security, and the higher the score. Conversely, the shorter the lockout duration, the lower the score.

[0134] The account lock policy check result can be obtained according to the lock times threshold check result and the lock duration check result. According to the account lock policy check result, the credibility of the terminal device is obtained. In the previous embodiment, a similar calculation process has been described in detail, so it will not be repeated here.

[0135] The remote login check item is used to check whether the terminal device allows remote login. Those skilled in the art know that remote login is easily attacked by hackers or viruses, so when the terminal device allows remote login, its credibility will be affected.

[0136] The remote login check result is usually expressed as a score. When the terminal device allows remote login, the remote login check result is a lower score or no score, such as 0 points; when the terminal device does not allow remote login, the remote login check result is a higher score, such as 5 points.

[0137] According to the remote login check result, the credibility of the terminal device can be obtained. In the previous embodiment, similar calculation processes have been described in detail, so they will not be repeated here.

[0138] The software installation status check item is used to check whether there is any software (or service) prohibited from being installed in the operating system of the terminal device. Those skilled in the art know that some software (or service) developers set up malicious codes such as Trojans, backdoors, viruses, etc. for some purpose when developing software. Once users use these software (or services), it will bring hidden dangers to network security. For network security considerations, it is generally prohibited to install such software in terminal devices.

[0139] According to the software installation status check items, the terminal device is checked. The software installation status check result is usually expressed as a score. When the terminal device has software (or services) that are prohibited from being installed, the software installation status check result is a lower score or no score, such as 0 points; when the terminal device does not have software (or services) that are prohibited from being installed, the software installation status check result is a higher score, such as 5 points.

[0140] According to the software installation status check result, the credibility of the terminal device can be obtained. In the previous embodiment, similar calculation processes have been described in detail, so they will not be repeated here.

[0141] The sharing status check item is used to check whether there is a shared file directory in the operating system of the terminal device. Shared files refer to files that can be shared between different terminal devices. Since shared files can be operated by multiple terminal devices, there are security risks. For example, after terminal device A accesses a shared file F, the worm virus on terminal device A will remain on shared file F. When terminal device B accesses shared file F, the worm virus on shared file F will invade terminal device B.

[0142] Check the terminal device according to the sharing status check items. The sharing status check result is usually expressed as a score. When the terminal device has a shared file directory, the sharing status check result is a lower score or no score, such as 0 points; when the terminal device does not have a shared file directory, the sharing status check result is a higher score, such as 5 points.

[0143] According to the sharing situation check result, the credibility of the terminal device can be obtained. In the previous embodiment, similar calculation processes have been described in detail, so they will not be repeated here.

[0144] The Internet access information check item is used to check whether the terminal device can connect to the Internet. The Internet is a huge network that connects networks based on a set of common protocols. The Internet is a mixed bag of good and bad, with a lot of useful information, but also unstable factors such as computer viruses. Therefore, whether the terminal device is connected to the Internet is also an important factor affecting the credibility of the terminal device.

[0145] According to the Internet access information check items, the terminal device is checked. The Internet access information check result is usually expressed as a score. When the terminal device is allowed to access the Internet, the Internet access information check result is a lower score or no score, such as 0 points; when the terminal device is not allowed to access the Internet, the Internet access information check result is a higher score, such as 5 points.

[0146] According to the Internet access information checking result, the credibility of the terminal device can be obtained. In the previous embodiment, similar calculation processes have been described in detail, so they will not be repeated here.

[0147] The login control method of the present invention incorporates the inspection results of one or more inspection items such as account locking, remote login, software installation status, sharing status and Internet remote access into the calculation of the terminal device credibility, so that the calculated terminal device credibility can reflect the operating environment of the terminal device from more angles, the judgment of the terminal device credibility is more accurate, and the network security can be better guaranteed.

[0148] Figure 3 This is the second flow chart of the login control method of the present invention, as shown in Figure 3 As shown, the login control method of the present invention can be applied to a server, and the method includes:

[0149] Step 301: Receive a login request from a terminal device to a target network system, and determine a terminal device operating environment check strategy according to the security requirements of the target network system.

[0150] In this embodiment, the target network system refers to the network system that the user expects to log in through the terminal device, such as an intranet office system, a public commercial network system, etc.

[0151] The target network system login request sent by the terminal device to the server contains information about the target network system, such as the domain name and IP address. After the server determines the target network system based on the login request, it can determine the terminal device operating environment inspection strategy based on the security requirements of the target network system.

[0152] The terminal device operating environment check policy is used to describe the check items included when checking the operating environment of the terminal device.

[0153] There may be many types of check items included in the terminal device operating environment check policy, such as check items on virus information, check items on password information, check items on port information, check items on account lock policy, check items on remote login, check items on software installation status, check items on sharing status, and check items on Internet access information, etc. The server determines the terminal device operating environment check policy according to the security requirements of the target network system.

[0154] Step 302: Receive the credibility of the terminal device, and determine whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device.

[0155] In this embodiment, the credibility of the terminal device is obtained by checking the operating environment of the terminal device according to the terminal device operating environment checking strategy.

[0156] In the previous embodiment, the calculation process of the terminal device credibility has been described in detail, so it will not be repeated here.

[0157] After obtaining the credibility of the terminal device, the server compares the credibility of the terminal device with a preset credibility threshold. When the credibility of the terminal device is greater than or equal to the preset credibility threshold, the terminal device is allowed to log in to the target network system; when the credibility of the terminal device is less than the preset credibility threshold, the connection between the terminal device and the target network system is blocked.

[0158] The login control method of the present invention determines the credibility of the terminal device by checking the operating environment of the terminal device, and then determines whether the terminal device is allowed to log in to the target network system, avoiding the network security risks brought about by the network security architecture in the prior art that mainly determines the user login authority based on the user's network location.

[0159] The login control system provided by the present invention is described below. The login control system described below and the login control method described above can be referenced to each other.

[0160] The login control system of the present invention comprises: a terminal device and a server, wherein the terminal device is communicatively connected with the server.

[0161] Figure 4 Schematic diagram of a terminal device in the login control system of the present invention, such as Figure 4 As shown, the terminal device includes:

[0162] A login request sending module 401 is used to send a login request of a target network system to a server, so that the server determines a terminal device operating environment check policy according to the security requirements of the target network system; wherein the terminal device operating environment check policy is used to describe the check items included in the check of the terminal device operating environment;

[0163] A receiving module 402 is used to receive a terminal device operating environment check policy;

[0164] The credibility determination module 403 is used to check the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtain the credibility of the terminal device according to the checking result;

[0165] The credibility sending module 404 is used to send the credibility of the terminal device to the server, so that the server determines whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device.

[0166] Figure 5 Schematic diagram of a server in the login control system of the present invention, as shown in Figure 4 As shown, the server includes:

[0167] The terminal device operating environment check policy determination module 501 is used to receive a login request from a terminal device to a target network system, and determine a terminal device operating environment check policy according to the security requirements of the target network system; wherein the terminal device operating environment check policy is used to describe the check items included in the check of the terminal device operating environment;

[0168] The login request review module 502 is used to receive the credibility of the terminal device and determine whether to allow the terminal device to log in to the target network system based on the credibility of the terminal device; wherein the credibility of the terminal device is obtained by checking the operating environment of the terminal device according to the terminal device operating environment inspection strategy.

[0169] The login control system of the present invention determines the credibility of the terminal device by checking the operating environment of the terminal device, and then determines whether the terminal device is allowed to log in to the target network system, avoiding the network security risks brought about by the network security architecture in the prior art that mainly determines the user login authority based on the user's network location.

[0170] Figure 6 A schematic diagram of the structure of an electronic device provided by the present invention, such as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the login control method, which includes:

[0171] Sending a login request of the target network system to the server, so that the server determines a terminal device operating environment inspection policy according to the security requirements of the target network system; wherein the terminal device operating environment inspection policy is used to describe the inspection items included in the inspection of the operating environment of the terminal device;

[0172] Receive terminal equipment operating environment inspection strategy;

[0173] According to the terminal device operating environment inspection strategy, the operating environment of the terminal device is inspected, and the credibility of the terminal device is obtained according to the inspection result;

[0174] The credibility of the terminal device is sent to the server, so that the server determines whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device.

[0175] or include:

[0176] Receiving a login request from a terminal device to a target network system, and determining a terminal device operating environment check policy according to the security requirements of the target network system; wherein the terminal device operating environment check policy is used to describe the check items included in checking the operating environment of the terminal device;

[0177] Receive the credibility of the terminal device, and determine whether to allow the terminal device to log in to the target network system based on the credibility of the terminal device; wherein the credibility of the terminal device is obtained by checking the operating environment of the terminal device according to the terminal device operating environment checking strategy.

[0178] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0179] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, the computer can execute the login control method provided by the above methods, the method comprising:

[0180] Sending a login request of the target network system to the server, so that the server determines a terminal device operating environment inspection policy according to the security requirements of the target network system; wherein the terminal device operating environment inspection policy is used to describe the inspection items included in the inspection of the operating environment of the terminal device;

[0181] Receive terminal equipment operating environment inspection strategy;

[0182] According to the terminal device operating environment inspection strategy, the operating environment of the terminal device is inspected, and the credibility of the terminal device is obtained according to the inspection result;

[0183] The credibility of the terminal device is sent to the server, so that the server determines whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device.

[0184] or include:

[0185] Receiving a login request from a terminal device to a target network system, and determining a terminal device operating environment check policy according to the security requirements of the target network system; wherein the terminal device operating environment check policy is used to describe the check items included in checking the operating environment of the terminal device;

[0186] Receive the credibility of the terminal device, and determine whether to allow the terminal device to log in to the target network system based on the credibility of the terminal device; wherein the credibility of the terminal device is obtained by checking the operating environment of the terminal device according to the terminal device operating environment checking strategy.

[0187] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the computer program is implemented to perform the login control method provided above, the method comprising:

[0188] Sending a login request of the target network system to the server, so that the server determines a terminal device operating environment inspection policy according to the security requirements of the target network system; wherein the terminal device operating environment inspection policy is used to describe the inspection items included in the inspection of the operating environment of the terminal device;

[0189] Receive terminal equipment operating environment inspection strategy;

[0190] According to the terminal device operating environment inspection strategy, the operating environment of the terminal device is inspected, and the credibility of the terminal device is obtained according to the inspection result;

[0191] The credibility of the terminal device is sent to the server, so that the server determines whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device.

[0192] or include:

[0193] Receiving a login request from a terminal device to a target network system, and determining a terminal device operating environment check policy according to the security requirements of the target network system; wherein the terminal device operating environment check policy is used to describe the check items included in checking the operating environment of the terminal device;

[0194] Receive the credibility of the terminal device, and determine whether to allow the terminal device to log in to the target network system based on the credibility of the terminal device; wherein the credibility of the terminal device is obtained by checking the operating environment of the terminal device according to the terminal device operating environment checking strategy.

[0195] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0196] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0197] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A login control method, characterized in that: include: Sending a login request of the target network system to the server, so that the server determines a terminal device operating environment check policy according to the security requirements of the target network system; wherein the terminal device operating environment check policy is used to describe the check items included when checking the operating environment of the terminal device; when the security requirements of the target network system to be logged in are high, the corresponding terminal device operating environment check policy includes more check items than when the security requirements of the target network system to be logged in are low; Receive terminal equipment operating environment inspection strategy; According to the terminal device operating environment inspection strategy, the operating environment of the terminal device is inspected, and the credibility of the terminal device is obtained according to the inspection result; The credibility of the terminal device is sent to the server, so that the server determines whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device.

2. The login control method according to claim 1, characterized in that: The terminal device operation environment inspection strategy includes a virus information inspection item, and the virus information inspection item includes: a computer virus real-time existence inspection sub-item and a computer virus database update time inspection sub-item; Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes: Checking the types and quantities of computer viruses existing in the terminal device in real time to obtain a first virus information check result; Checking the update time of the computer virus database of the terminal device to obtain a second virus information check result; The credibility of the terminal device is determined according to the virus information check result; wherein the virus information check result includes a first virus information check result and a second virus information check result.

3. The login control method according to claim 1 or 2, characterized in that: The terminal device operating environment check strategy includes a password information check item, and the password information check item includes: a password length check sub-item, a password usage period check sub-item, and a password complexity check sub-item; Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes: Checking the length of the password of the user logging into the terminal device to obtain a first password information check result; Checking the validity period of the password of the user for logging into the terminal device to obtain a second password information check result; Checking the complexity of the password of the user for logging into the terminal device to obtain a third password information check result; The credibility of the terminal device is determined according to the password information check result; wherein the password information check result includes a first password information check result, a second password information check result and a third password information check result.

4. The login control method according to any one of claims 1 to 3, characterized in that: The terminal device operating environment inspection strategy includes a port information inspection item; Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes: Check the number and type of ports in the terminal device that are in an open state to obtain a port information check result; The credibility of the terminal device is determined according to the port information checking result.

5. The login control method according to any one of claims 1 to 4, characterized in that: The terminal device operating environment inspection strategy includes one or more of the following inspection items: an account lockout strategy inspection item, a remote login inspection item, a software installation status inspection item, a sharing status inspection item, and an Internet access information inspection item; Correspondingly, checking the operating environment of the terminal device according to the terminal device operating environment checking strategy, and obtaining the credibility of the terminal device according to the checking result, includes: Checking a threshold of the number of failed login attempts and a lockout duration for a user's account to be locked due to a user's failed login attempts to the terminal device, and obtaining an account lockout policy check result; Determining the credibility of the terminal device according to the account lock policy check result; and / or, checking whether the terminal device allows remote login, and obtaining a remote login check result; Determining the credibility of the terminal device according to the remote login check result; and / or, checking whether the terminal device has any software that is prohibited from being installed, thereby obtaining a software installation status check; Determining the credibility of the terminal device according to the software installation status check result; and / or, checking whether a shared file directory exists on the terminal device to obtain a sharing status check result; Determining the credibility of the terminal device according to the sharing status check result; and / or, checking whether the terminal device is allowed to access the Internet, and obtaining an Internet access information checking result; The credibility of the terminal device is determined according to the Internet access information checking result.

6. A login control method, characterized in that: include: Receive a login request from a terminal device to a target network system, and determine a terminal device operating environment check policy according to the security requirements of the target network system; wherein the terminal device operating environment check policy is used to describe the check items included when checking the operating environment of the terminal device; when the security requirements of the target network system to be logged in are high, the corresponding terminal device operating environment check policy includes more check items than when the security requirements of the target network system to be logged in are low; Receive the credibility of the terminal device, and determine whether to allow the terminal device to log in to the target network system based on the credibility of the terminal device; wherein the credibility of the terminal device is obtained by checking the operating environment of the terminal device according to the terminal device operating environment inspection strategy.

7. The login control method according to claim 6, characterized in that: The determining whether to allow the terminal device to log in to the target network system according to the credibility of the terminal device includes: When the credibility of the terminal device is greater than or equal to a preset credibility threshold, allowing the terminal device to log in to the target network system; When the credibility of the terminal device is less than a preset credibility threshold, the connection between the terminal device and the target network system is blocked.

8. A login control system, characterized in that: include: A terminal device and a server, wherein the terminal device is in communication connection with the server; The terminal device is used to implement the steps of the login control method according to any one of claims 1 to 5; The server is used to implement the steps of the login control method as claimed in claim 6 or 7.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the steps of the login control method according to any one of claims 1 to 5, or implements the steps of the login control method according to claim 6 or 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the login control method according to any one of claims 1 to 5 are implemented, or the steps of the login control method according to claim 6 or 7 are implemented.

11. A computer program product, comprising computer executable instructions, characterized in that: When executed, the instruction is used to implement the steps of the login control method according to any one of claims 1 to 5, or to implement the steps of the login control method according to claim 6 or 7.

Images