Dynamic negotiation authentication method and device, electronic equipment and storage medium

Abstract

The application provides a dynamic negotiation authentication method and device, electronic equipment and a storage medium. The method comprises the following steps: receiving an authentication request sent by a service invoker; the authentication request carries an authentication subject of a to-be-authenticated object in the service invoker; determining an authentication factor and an authentication protocol matched with the authentication subject in an authentication framework according to the type of the authentication subject; the authentication framework is provided with a corresponding relationship between the type of the authentication subject and the authentication factor and the authentication protocol; and authenticating the authentication request according to the determined authentication factor and authentication protocol to obtain an authentication result. The authentication framework provided with the corresponding relationship between various types of authentication factors and authentication protocols and the authentication subject provides an authentication method based on an extensible and dynamically negotiable authentication framework.

Description

Technical Field

[0001] This invention relates to the field of security authentication technology, and in particular to a dynamic negotiation authentication method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the development of information technology, information security technology is being applied more widely and deeply in various fields. In the field of information security, identity authentication is often the first key to using information systems, and its security is receiving increasing attention.

[0003] In existing authentication systems, authentication factors need to be built into the system, and the types of authentication factors are fixed. If new authentication factors or authentication methods are added, the code needs to be rewritten or modified according to the new authentication format in order to achieve an authenticable state. However, this greatly increases the development cost. Summary of the Invention

[0004] To address the problems in the prior art, embodiments of the present invention provide a dynamic negotiation authentication method, apparatus, electronic device, and storage medium.

[0005] Specifically, the embodiments of the present invention provide the following technical solutions:

[0006] In a first aspect, embodiments of the present invention provide a dynamic negotiation authentication method, including:

[0007] Receive an authentication request sent by a service caller; the authentication request carries the authentication subject of the object to be authenticated in the service caller;

[0008] Based on the type of the authentication subject, an authentication factor and authentication protocol matching the authentication subject are determined in the authentication framework; wherein, the authentication framework sets up a correspondence between the type of authentication subject and the authentication factor and authentication protocol;

[0009] The authentication request is authenticated according to the determined authentication factor and authentication protocol to obtain the authentication result.

[0010] Further, before determining the authentication factor and authentication protocol matching the authentication subject within the authentication framework based on the authentication subject, the method includes:

[0011] Based on the type of the authentication subject carried in the authentication request, determine whether the authentication subject carried in the authentication request needs to be pre-processed; if so, pre-process the authentication subject carried in the authentication request.

[0012] Specifically, preprocessing the authentication subject carried in the authentication request refers to converting the authentication subject carried in the authentication request into the authentication information required by the authentication protocol in the authentication framework.

[0013] Further, based on the type of authentication subject carried in the authentication request, it is determined whether the authentication subject carried in the authentication request needs to undergo pre-processing, including:

[0014] If the authentication request carries a single sign-on authentication subject, then it is determined that the single sign-on authentication subject needs to undergo preprocessing.

[0015] Accordingly, the authentication subject carried in the authentication request is pre-processed, including:

[0016] The single sign-on authentication subject is sent to a third-party authentication system for authentication to obtain a pre-authentication result, which is the authentication information required by the authentication protocol in the authentication framework.

[0017] Furthermore, the authentication framework also includes a function providing interface for providing public types of authentication factors and corresponding private authentication protocols;

[0018] Accordingly, if the authentication request carries an authentication subject of the object to be authenticated as a customized authentication subject, then the authentication factor and authentication protocol matching the customized authentication subject are determined to be the public type authentication factor and the corresponding private authentication protocol, and the authentication framework is used to jump to the specified customized authentication system for authentication through the function-provided interface.

[0019] The public type authentication factor and the corresponding private authentication protocol are set according to the authentication requirements of the customized authentication subject.

[0020] Furthermore, based on the type of the authentication subject, authentication factors and authentication protocols matching the authentication subject are determined within the authentication framework, including one or more of the following:

[0021] If the type of the authentication subject is cryptographic, then the authentication factors that match the authentication subject include cryptographic factors and the corresponding authentication protocol.

[0022] If the type of the authentication subject is a mobile phone number or email address, then the authentication factors that match the authentication subject include dynamic verification code factors and the corresponding authentication protocol.

[0023] If the type of the authentication subject is a one-time password type, then the authentication factors that match the authentication subject include dynamic password factors and the corresponding authentication protocol.

[0024] If the type of the authentication subject is a biometric feature type, then the authentication factors that match the authentication subject include biometric factors and corresponding authentication protocols.

[0025] Furthermore, after obtaining the authentication result, the method further includes: returning the authentication result to the business caller.

[0026] Secondly, embodiments of the present invention also provide a dynamic negotiation authentication device, comprising:

[0027] The receiving module is used to receive authentication requests sent by the business caller; the authentication request carries the authentication subject of the object to be authenticated in the business caller;

[0028] The dynamic negotiation module is used to determine the authentication factor and authentication protocol that match the authentication subject in the authentication framework based on the type of the authentication subject; wherein the authentication framework is configured with the correspondence between the type of authentication subject and the authentication factor and authentication protocol.

[0029] The authentication module is used to authenticate the authentication request according to the determined authentication factor and authentication protocol, and obtain the authentication result.

[0030] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the dynamic negotiation authentication method as described in the first aspect.

[0031] Fourthly, embodiments of the present invention also provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the dynamic negotiation authentication method as described in the first aspect.

[0032] Fifthly, embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the dynamic negotiation authentication method as described in the first aspect.

[0033] As can be seen from the above technical solutions, the dynamic negotiation authentication method, apparatus, electronic device, and storage medium provided in this embodiment of the invention, because the authentication framework includes a correspondence between the type of authentication subject, authentication factors, and authentication protocols, can dynamically negotiate one or more usable authentication factors based on the authentication framework and the type of the authentication subject of the object to be authenticated. Therefore, the method provided in this embodiment can flexibly negotiate usable authentication factors according to the type of the authentication subject of the object to be authenticated. Furthermore, because the authentication framework is flexible and configurable, it can be extended to support multiple authentication factors and authentication protocols. Thus, this embodiment has advantages such as simple and flexible use, convenient extension, and no need for developers to perform repetitive development.

[0034] Furthermore, in other embodiments of the present invention, the authentication framework can also support third-party authentication and private customized authentication. Thus, the embodiments of the present invention abstract the authentication protocol through the authentication framework. When a new factor needs to be accessed, the system using this framework can expose the authentication verification method to a third party or access party, allowing the access party to implement the verification method. System developers do not need to understand the authentication method of the new factor, thereby greatly reducing development costs. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 A flowchart of a dynamic negotiation authentication method provided in an embodiment of the present invention;

[0037] Figure 2 This is a schematic diagram of a dynamic negotiation authentication process provided in an embodiment of the present invention;

[0038] Figure 3 This is a schematic diagram of an authentication framework provided in an embodiment of the present invention;

[0039] Figure 4 This is a schematic diagram of the structure of a dynamic negotiation authentication device provided in an embodiment of the present invention;

[0040] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] Figure 1 A flowchart of the dynamic negotiation authentication method provided by an embodiment of the present invention is shown. Figure 1 As shown, the dynamic negotiation authentication method provided in this embodiment of the invention specifically includes the following steps:

[0043] Step 101: Receive an authentication request sent by the service caller; the authentication request carries the authentication subject of the object to be authenticated in the service caller;

[0044] Step 102: Based on the type of the authentication subject, determine the authentication factor and authentication protocol that match the authentication subject in the authentication framework; wherein, the authentication framework sets up a correspondence between the type of authentication subject and the authentication factor and authentication protocol;

[0045] Step 103: Authenticate the authentication request according to the determined authentication factor and authentication protocol to obtain the authentication result.

[0046] In this embodiment, it should be noted that in existing authentication systems, authentication factors need to be built into the system, and the types of authentication factors are fixed. If new authentication factors or authentication methods are added, the code needs to be rewritten or modified according to the new authentication format to achieve an authenticable state. To solve this problem, this embodiment provides an authentication framework, and abstracts authentication factors such as passwords, dynamic passwords, single sign-on, and biometrics from the authentication framework. It also summarizes authentication protocols such as passwords, dynamic passwords, single sign-on, and biometrics (used to verify the validity of authentication information in the authentication process), and abstracts precondition types such as passwords, passwords, and single sign-on (used to obtain the actual information to be verified before authentication verification). Therefore, this embodiment makes the authentication framework flexible and configurable through factor plug-in, supporting multiple authentication factors and schemes.

[0047] In this embodiment, it should be noted that the authentication factor can be understood as authentication elements, such as user password authentication.

[0048] In this embodiment, it should be noted that dynamic negotiation can be understood as negotiating one or more authentication factors that a user can use based on the authentication framework, according to the user's attributes and the factors that have been created.

[0049] For example, the authentication request carries the authentication subject of the object to be authenticated in the business caller. Assuming the object to be authenticated is a user, the authentication subject may be one or more types of password, dynamic password, single sign-on, and biometrics. Since the authentication framework establishes a correspondence between the type of authentication subject, authentication factors, and authentication protocols, one or more usable authentication factors can be dynamically negotiated based on the authentication framework and the type of the authentication subject of the object to be authenticated. Therefore, the method provided in this embodiment can flexibly negotiate usable authentication factors according to the type of the authentication subject of the object to be authenticated. Furthermore, because the authentication framework is flexible and configurable, it can be extended to support multiple authentication factors and protocols. Thus, this embodiment has advantages such as simple and flexible use, convenient extension, and no need for developers to perform repetitive development.

[0050] In this embodiment, it should be noted that factor plug-in can be understood as the authentication framework providing an abstracted authentication protocol and preconditions, the access party implementing the authentication logic itself, returning the authentication result to the authentication framework, and the framework then returning the result to the caller to complete the authentication.

[0051] In this embodiment, it should be noted that the authentication subject can be understood as the subject of the authentication process. The authentication subject includes the information that needs to be authenticated in the object to be authenticated. For example, when the object to be authenticated is a "user", the authentication subject of the object to be authenticated may include: password, phone number, email, one-time password, biometric features, etc.

[0052] It should be noted that there are two methods for identifying the "authentication subject":

[0053] 1. Use the Subject type; Examples: tag="email", value="xxx@xxx.com", tag="phone", value="18523847382", tag="*", value="xxx@xxx.com", tag="", value="ab192ef9-25c8-4122-8761-c30a8baa349e".

[0054] 2. Use a string type to identify the "authentication subject" as the "primary identifier" in the business logic. This is generally a unique ID used by the business, equivalent to using the Subject type with Subject.tag = "" (empty). `tag`: A specially agreed-upon value. "*": Represents the tag that the business needs to determine the value from. This is generally used when the business supports multiple "subject" identifiers, allowing users to input any identifier on the client side. "" (empty): Represents the primary identifier of the "subject" for the business, generally an internal ID. The tag_value of this tag is generally returned by the business logic from a PostHook. `value`: The value corresponding to the tag. Example: For individual users, the value is a specific mobile phone number, user ID, etc.

[0055] In this embodiment, the authentication protocol includes one or more of the following:

[0056] Passcode: Password-based verification is implemented by the business logic.

[0057] BasicAuth: Pass in the username and password, and convert them into a simple base64 string;

[0058] LDAP: Authentication implemented based on the LDAP protocol;

[0059] oauth2: Authentication based on the authorization code model;

[0060] msgotp: A password sent via message (SMS, voice push);

[0061] totp: Time-based One-time Password;

[0062] x509.1 Certificate: Authentication based on digital certificates;

[0063] UK: Certificate authentication based on USB;

[0064] SSO: Requires redirection to a third-party authentication system;

[0065] Common: Public type, private authentication protocol.

[0066] It is understandable that each protocol has its own authentication method, but they are all based on a check logic of user identifier + authentication code; the required dependency configuration parameters are different for each protocol; some protocols require pre-operation (steps), while others do not.

[0067] As can be seen from the above technical solution, the dynamic negotiation authentication method provided in this embodiment of the invention, because the authentication framework has a correspondence between the type of authentication subject, authentication factors, and authentication protocols, can dynamically negotiate one or more usable authentication factors based on the authentication framework and the type of the authentication subject of the object to be authenticated. Therefore, the method provided in this embodiment can flexibly negotiate usable authentication factors according to the type of the authentication subject of the object to be authenticated. Furthermore, because the authentication framework is flexible and configurable, it can be extended to support multiple authentication factors and authentication protocols. Thus, this embodiment has advantages such as simple and flexible use, convenient extension, and no need for developers to perform repetitive development.

[0068] Based on the above embodiments, in this embodiment, before determining the authentication factor and authentication protocol matching the authentication subject within the authentication framework according to the authentication subject, the method includes:

[0069] Based on the type of the authentication subject carried in the authentication request, determine whether the authentication subject carried in the authentication request needs to be pre-processed; if so, pre-process the authentication subject carried in the authentication request.

[0070] Specifically, preprocessing the authentication subject carried in the authentication request refers to converting the authentication subject carried in the authentication request into the authentication information required by the authentication protocol in the authentication framework.

[0071] Based on the above embodiments, in this embodiment, determining whether the authentication subject carried in the authentication request needs pre-processing according to the type of authentication subject carried in the authentication request includes:

[0072] If the authentication request carries a single sign-on authentication subject, then it is determined that the single sign-on authentication subject needs to undergo preprocessing.

[0073] Accordingly, the authentication subject carried in the authentication request is pre-processed, including:

[0074] The single sign-on authentication subject is sent to a third-party authentication system for authentication to obtain a pre-authentication result, which is the authentication information required by the authentication protocol in the authentication framework.

[0075] In this embodiment, some authentication requests require pre-processing. For example, the pre-processing for Single Sign-On (SSO) requires redirecting to a third-party business system to obtain a ticket after successful third-party authentication, and then providing the ticket to the authentication framework for secondary authentication. It is understood that pre-processing can also be called preaction, or pre-operation (steps), used to describe the operations performed before protocol authentication.

[0076] In this embodiment, the authentication factor can include various types, such as password, dynamic password, single sign-on, biometrics, etc., as shown in Table 1 below. Taking the authentication factor as an example, the authentication factor includes dependent parameter values ​​and pre-operation values. For example, the dependent parameter is a name, and the pre-operation includes a pre-callback.

[0077] It should be noted that in this embodiment, since the authentication framework establishes correspondences between various authentication subject types, authentication factors, and authentication protocols, one or more usable authentication factors can be dynamically negotiated based on the authentication framework and the authentication subject type of the object to be authenticated. Therefore, the method provided in this embodiment can flexibly negotiate usable authentication factors according to the authentication subject type of the object to be authenticated. Furthermore, because the authentication framework is flexible and configurable, it can be extended to support multiple authentication factors and protocols. Thus, this embodiment can implement different authentication schemes in an extensible manner. The authentication framework in this embodiment abstracts the authentication protocol and provides abstract methods for external access. The authentication process is as follows: Figure 2 As shown: The business initiates an authentication request to the authentication service. The authentication framework abstracts the preHook, check, and postHook interfaces. preHook: Before checking authentication information, it can convert the authentication subject into the authentication information required by the authentication protocol. If the authentication subject information is already complete, this method does not need to be implemented. check: The authentication information detection process requires authentication at the authentication source. This process also abstracts the providerHook interface to handle authentication, which the authentication source must implement. postHook: The post-authentication interface stores the current user information on the server. Finally, the authentication result is returned to the caller, ending the authentication process. Different protocols may differ, but the authentication process remains the same.

[0078] In this embodiment, the process of dynamically negotiating factors includes: a) obtaining the current user's information based on the authentication subject; b) obtaining a factor list; c) filtering out factors that are enabled; d) filtering out local password-related factors when the user has a password, filtering out dynamic verification code factors when there is a mobile phone number or email address, and filtering out OTP factors when there is a key required for one-time password verification; e) returning the filtered factor list.

[0079] Table 1

[0080]

[0081] Based on the above embodiments, in this embodiment, the authentication framework is further provided with a function providing interface for providing public type authentication factors and corresponding private authentication protocols;

[0082] Accordingly, if the authentication request carries an authentication subject of the object to be authenticated as a customized authentication subject, then the authentication factor and authentication protocol matching the customized authentication subject are determined to be the public type authentication factor and the corresponding private authentication protocol, and the authentication framework is used to jump to the specified customized authentication system for authentication through the function-provided interface.

[0083] The public type authentication factor and the corresponding private authentication protocol are set according to the authentication requirements of the customized authentication subject.

[0084] In this embodiment, it should be noted that the authentication framework provided abstracts authentication factors and summarizes them into authentication protocols such as passwords, dynamic passwords, single sign-on, and biometrics (used to verify the validity of authentication information in the authentication process). It also abstracts precondition types such as passwords, dynamic passwords, and single sign-on (used to obtain the actual information to be verified before authentication verification). The pluggable nature of the factors makes this authentication framework flexible and configurable, supporting multiple authentication factors and schemes, and enabling third-party authentication as well as private customized authentication.

[0085] In this embodiment, it should be noted that the specific composition of the authentication framework can be found in [reference needed]. Figure 3 As shown, this embodiment abstracts an authentication protocol within the framework. When a new factor needs to be integrated, this framework can expose the authentication verification method to a third party or the integrating party, who can then implement the verification method. System developers do not need to understand the authentication method of the new factor. In this embodiment, the framework can negotiate authentication factors based on the authentication subject input by the user. When more than one factor is negotiated, the user can choose the appropriate authentication factor. In this embodiment, the authentication framework provides a standard authentication scheme. For third-party factors or customized factors, common protocol type factors can be used for authentication. The framework itself does not need to be modified; only the authentication source needs to implement the providerHook interface required in the authentication process to complete the authentication.

[0086] It should be noted that, as Figure 2As shown, the business initiates an authentication request to the authentication service. The authentication framework abstracts the preHook, check, and postHook interfaces. Specifically: preHook: Before detecting authentication information, it converts the authentication subject into the authentication information required by the authentication protocol. If the authentication subject information is already complete, this method does not need to be implemented. check: The authentication information detection process requires authentication at the authentication source. This process also abstracts the providerHook interface to handle authentication, which the authentication source must implement. As mentioned earlier, for third-party factors or customized factors, common protocol type factors can be used for authentication. The framework itself does not need to be modified; only the authentication source needs to implement the providerHook interface required in the authentication process to complete the authentication. postHook: The post-authentication interface stores the current user information on the server. Finally, the authentication result is returned to the caller, ending the authentication process. Different protocols may exist, but the authentication process remains the same.

[0087] In this embodiment, it is understood that the authentication framework provided can also support third-party authentication and private customized authentication. Therefore, this embodiment of the invention abstracts the authentication protocol through the authentication framework. When a new factor needs to be accessed, the system using this framework can expose the authentication verification method to a third party or access party, who can then implement the verification method. System developers do not need to understand the authentication method of the new factor, thereby greatly reducing development costs.

[0088] Based on the above embodiments, in this embodiment, according to the authentication subject, an authentication factor and authentication protocol matching the authentication subject are determined in the authentication framework, including one or more of the following:

[0089] If the type of the authentication subject is cryptographic, then the authentication factors that match the authentication subject include cryptographic factors and the corresponding authentication protocol.

[0090] If the type of the authentication subject is a mobile phone number or email address, then the authentication factors that match the authentication subject include dynamic verification code factors and the corresponding authentication protocol.

[0091] If the type of the authentication subject is a one-time password type, then the authentication factors that match the authentication subject include dynamic password factors and the corresponding authentication protocol.

[0092] If the type of the authentication subject is a biometric feature type, then the authentication factors that match the authentication subject include biometric factors and corresponding authentication protocols.

[0093] In this embodiment, through a dynamic negotiation process, the authentication framework can negotiate one or more authentication factors that the user can use based on the user's attributes and currently created factors. For example, if the user information includes a mobile phone number, a mobile verification code factor can be negotiated. It should be noted in this embodiment that factor plug-in architecture can be understood as the authentication framework providing an abstracted authentication protocol and preconditions, while the access party implements its own authentication logic, returns the authentication result to the authentication framework, and the framework then returns the result to the caller, automatically completing the authentication process.

[0094] Based on the above embodiments, in this embodiment, after obtaining the authentication result, the method further includes: returning the authentication result to the service caller.

[0095] In this embodiment, it should be noted that the authentication framework negotiates one or more authentication factors that the user can use based on the user's attributes and currently created factors. For example, if the user information includes a mobile phone number, a mobile verification code factor can be negotiated. In this embodiment, through factor plug-in, the framework can provide an abstracted authentication protocol and preconditions. The access party implements its own authentication logic, returns the authentication result to the authentication framework, and the framework then returns the result to the caller to complete the authentication.

[0096] Figure 4 A schematic diagram of the structure of the dynamic negotiation authentication device provided in an embodiment of the present invention is shown. Figure 4 As shown, the dynamic negotiation authentication device provided in this embodiment includes:

[0097] The receiving module 21 is used to receive an authentication request sent by the service caller; the authentication request carries the authentication subject of the object to be authenticated in the service caller;

[0098] The dynamic negotiation module 22 is used to determine, based on the type of the authentication subject, the authentication factor and authentication protocol that match the authentication subject in the authentication framework; wherein, the authentication framework is configured with a correspondence between the type of the authentication subject and the authentication factor and authentication protocol;

[0099] The authentication module 23 is used to authenticate the authentication request according to the determined authentication factor and authentication protocol, and obtain the authentication result.

[0100] Since the dynamic negotiation authentication device provided in this embodiment of the invention can be used to execute the dynamic negotiation authentication method described in the above embodiments, and its working principle and beneficial effects are similar, it will not be described in detail here. For details, please refer to the description of the above embodiments.

[0101] In this embodiment, it should be noted that the various modules in the device of the present invention can be integrated into one unit or deployed separately. The above modules can be combined into one module or further divided into multiple sub-modules.

[0102] Based on the same inventive concept, another embodiment of the present invention provides an electronic device, see [link to previous document]. Figure 5 The electronic device specifically includes the following components: a processor 301, a memory 302, a communication interface 303, and a communication bus 304.

[0103] The processor 301, memory 302, and communication interface 303 communicate with each other through the communication bus 304.

[0104] The processor 301 is used to call the computer program in the memory 302. When the processor executes the computer program, it implements all the steps of the above-described dynamic negotiation authentication method. For example, when the processor executes the computer program, it implements the following process: receiving an authentication request sent by a service caller; the authentication request carries the authentication subject of the object to be authenticated in the service caller; determining the authentication factor and authentication protocol matching the authentication subject in the authentication framework according to the type of the authentication subject; wherein the authentication framework sets the correspondence between the type of authentication subject and the authentication factor and authentication protocol; and authenticating the authentication request according to the determined authentication factor and authentication protocol to obtain the authentication result.

[0105] It is understood that the refined and extended functions that the computer program can execute can be referred to the description of the above embodiments.

[0106] Based on the same inventive concept, another embodiment of the present invention provides a non-transitory computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements all the steps of the aforementioned dynamic negotiation authentication method. For example, when the processor executes the computer program, it performs the following process: receiving an authentication request sent by a service caller; the authentication request carrying the authentication subject of the object to be authenticated in the service caller; determining an authentication factor and authentication protocol matching the authentication subject in an authentication framework according to the type of the authentication subject; wherein the authentication framework sets a correspondence between the type of the authentication subject and the authentication factor and authentication protocol; and authenticating the authentication request according to the determined authentication factor and authentication protocol to obtain an authentication result.

[0107] It is understood that the refined and extended functions that the computer program can execute can be referred to the description of the above embodiments.

[0108] Based on the same inventive concept, another embodiment of the present invention provides a computer program product, which includes a computer program that, when executed by a processor, implements all the steps of the above-described dynamic negotiation authentication method. For example, when the processor executes the computer program, it implements the following process: receiving an authentication request sent by a service caller; the authentication request carrying the authentication subject of the object to be authenticated in the service caller; determining, in the authentication framework, an authentication factor and authentication protocol matching the authentication subject according to the type of the authentication subject; wherein, the authentication framework sets a correspondence between the type of the authentication subject and the authentication factor and authentication protocol; and authenticating the authentication request according to the determined authentication factor and authentication protocol to obtain an authentication result.

[0109] It is understood that the refined and extended functions that the computer program can execute can be referred to the description of the above embodiments.

[0110] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0111] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the embodiments of the present invention according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0112] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the dynamic negotiation authentication method described in various embodiments or some parts of embodiments.

[0113] Furthermore, in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0114] Furthermore, in this invention, the use of terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refers to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dynamic negotiation authentication method, characterized in that, include: Receive authentication requests sent by the business caller; The authentication request carries the authentication subject of the object to be authenticated in the business caller; Based on the type of the authentication subject, an authentication factor and authentication protocol matching the authentication subject are determined in the authentication framework; wherein, the authentication framework sets up a correspondence between the type of authentication subject and the authentication factor and authentication protocol; the authentication framework also sets up a functional interface for providing authentication factors of public types and corresponding private authentication protocols; Accordingly, if the authentication request carries an authentication subject of the object to be authenticated as a customized authentication subject, then the authentication factor and authentication protocol matching the customized authentication subject are determined to be the public type authentication factor and the corresponding private authentication protocol, and the authentication framework is used to jump to the specified customized authentication system for authentication through the function-provided interface. The public type authentication factor and the corresponding private authentication protocol are set according to the authentication requirements of the customized authentication subject; The authentication request is authenticated according to the determined authentication factor and authentication protocol to obtain the authentication result.

2. The dynamic negotiation authentication method according to claim 1, characterized in that, Before determining the authentication factor and authentication protocol matching the authentication subject within the authentication framework based on the authentication subject, the method includes: Based on the type of the authentication subject carried in the authentication request, determine whether the authentication subject carried in the authentication request needs to be pre-processed; if so, pre-process the authentication subject carried in the authentication request. Specifically, preprocessing the authentication subject carried in the authentication request refers to converting the authentication subject carried in the authentication request into the authentication information required by the authentication protocol in the authentication framework.

3. The dynamic negotiation authentication method according to claim 2, characterized in that, Based on the type of authentication subject carried in the authentication request, determine whether the authentication subject carried in the authentication request needs to undergo pre-processing, including: If the authentication request carries a single sign-on authentication subject, then it is determined that the single sign-on authentication subject needs to undergo preprocessing. Accordingly, the authentication subject carried in the authentication request is pre-processed, including: The single sign-on authentication subject is sent to a third-party authentication system for authentication to obtain a pre-authentication result, which is the authentication information required by the authentication protocol in the authentication framework.

4. The dynamic negotiation authentication method according to claim 1, characterized in that, Based on the type of the authentication subject, an authentication factor and authentication protocol matching the authentication subject are determined in the authentication framework, including one or more of the following: If the type of the authentication subject is cryptographic, then the authentication factors that match the authentication subject include cryptographic factors and the corresponding authentication protocol. If the type of the authentication subject is a mobile phone number or email address, then the authentication factors that match the authentication subject include dynamic verification code factors and the corresponding authentication protocol. If the type of the authentication subject is a one-time password type, then the authentication factors that match the authentication subject include dynamic password factors and the corresponding authentication protocol. If the type of the authentication subject is a biometric feature type, then the authentication factors that match the authentication subject include biometric factors and corresponding authentication protocols.

5. The dynamic negotiation authentication method according to claim 1, characterized in that, After obtaining the authentication result, the method further includes: returning the authentication result to the business caller.

6. A dynamic negotiation authentication device applied to the dynamic negotiation authentication method as described in any one of claims 1 to 5, characterized in that, include: The receiving module is used to receive authentication requests sent by the business caller; The authentication request carries the authentication subject of the object to be authenticated in the business caller; The dynamic negotiation module is used to determine the authentication factor and authentication protocol that match the authentication subject in the authentication framework based on the type of the authentication subject; wherein the authentication framework is configured with the correspondence between the type of authentication subject and the authentication factor and authentication protocol. The authentication module is used to authenticate the authentication request according to the determined authentication factor and authentication protocol, and obtain the authentication result.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the dynamic negotiation authentication method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the dynamic negotiation authentication method as described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the dynamic negotiation authentication method as described in any one of claims 1 to 5.

Images