Account authentication methods, devices, computer equipment, storage media

Abstract

This application relates to the field of big data technology, and in particular to account authentication methods, apparatus, computer equipment, and storage media. The method includes: receiving an SMS authentication request for an account sent by the previous authentication node; authenticating the SMS authentication request using an authentication strategy matching the node location of the authentication node; and, if the SMS authentication request is successfully authenticated, sending the authentication request to the next authentication node. In non-authentication scenarios, the above-described authentication strategy, which intercepts requests layer by layer from simple to complex, can quickly filter out malicious authentication requests, simplify user terminal operations, and improve authentication efficiency.

Description

Technical Field

[0001] This application relates to the field of big data technology, and in particular to account authentication methods, devices, computer equipment, and storage media. Background Technology

[0002] With the development of big data technology, various applications (APPs) have emerged to meet diverse needs. To maintain the secure operation of application servers, account authentication methods are often employed. Figure 1 The present invention illustrates an account authentication method based on SMS verification codes in related technologies, including step 1, where the user enters a mobile phone number and clicks to obtain an SMS verification code; step 2, where the user receives the SMS verification code, enters the SMS verification code, and clicks "OK"; and step 3, where the user verifies the SMS verification code, including whether the verification code is correct. If the verification is successful, the user can access the application service; if the verification fails, the user can re-enter the verification code or obtain a new verification code.

[0003] In the above method, step 1 is the initial step for the user to access the application server, which is in a non-authenticated (not logged in) state, making it vulnerable to exploitation by attackers: for example, (1) using machine calls to obtain a large number of SMS verification codes, resulting in communication cost losses and affecting the normal operation of the application server; (2) using machine calls to send a large number of SMS verification codes to unauthenticated accounts, causing trouble for unauthenticated accounts. In the non-authentication scenario, how to control SMS authentication from being maliciously exploited is a technical problem that urgently needs to be solved. Summary of the Invention

[0004] Therefore, it is necessary to provide account authentication methods, devices, computer equipment, computer-readable storage media, and computer program products to address at least one of the above-mentioned technical problems.

[0005] Firstly, this application provides an account authentication method. The method includes:

[0006] An authentication node applied in a communication system, the communication system including multiple authentication nodes between a client and an application server for SMS authentication requests, the method comprising:

[0007] Receive the short message authentication request for the account sent by the previous authentication node of the authentication node;

[0008] The SMS authentication request is processed using an authentication strategy that matches the node location of the authentication node.

[0009] If the SMS authentication request is successfully authenticated, the authentication request will be sent to the next authentication node of the authentication node.

[0010] In one possible implementation, the authentication node includes an application server, the authentication policy includes an authentication policy for the number of times the account is authenticated, and the authentication processing of the SMS authentication request using an authentication policy that matches the node location of the authentication node includes:

[0011] The number of first authentications of the account within a first time period and the number of second authentications of the account within a second time period are counted, wherein the first time period is shorter than the second time period;

[0012] If the first number of authentication attempts is less than the first threshold and the second number of authentication attempts is less than the second threshold, the authentication result is determined to be successful.

[0013] In one possible implementation, the number of times the account is authenticated includes the number of times the account's IP address is accessed and the number of times the account's terminal identification number for receiving SMS messages is entered.

[0014] In one possible implementation, the counting of the first authentication count of the account within a first time period and the second authentication count of the account within a second time period includes:

[0015] Obtain the identification information of the account;

[0016] Obtain the first number of authentications of the account within the first time period and the second number of authentications of the account within the second time period;

[0017] The identification information, the first authentication count, and the second authentication count are stored in a cached database as key-value pairs.

[0018] In one possible implementation, the authentication node includes a site server, and the authentication policy includes an authentication policy based on the IP address of the account and the frequency of access to the target resource. The authentication process for the SMS authentication request using an authentication policy that matches the node location of the authentication node includes:

[0019] Get the number of times an account's IP address accessed the target resource;

[0020] If the number of accesses is less than the access threshold corresponding to the target resource, the authentication result is determined to be successful.

[0021] In one possible implementation, the authentication node includes a site server, and the authentication policy includes an authentication policy based on the IP address of the account and the frequency of access to the target access path. The authentication process for the SMS authentication request using an authentication policy that matches the node location of the authentication node includes:

[0022] Before the SMS authentication request enters the site server, obtain the number of times the account's IP address accesses the target access path within a preset time period;

[0023] If the number of accesses is less than the preset frequency, the authentication result is determined to be successful.

[0024] In one possible implementation, the authentication node includes a client, and the authentication strategy includes an authentication strategy for the format of the terminal identification number corresponding to the account and an authentication strategy for the sending time interval of the SMS verification code.

[0025] Secondly, this application also provides an account authentication system, including multiple authentication nodes between the client and the application server for SMS authentication requests, wherein the authentication nodes include:

[0026] The receiving module is used to receive the short message authentication request for the account sent by the previous authentication node of the authentication node;

[0027] The authentication module is used to authenticate the SMS authentication request using an authentication strategy that matches the node location of the authentication node.

[0028] The sending module is used to send the authentication request to the next authentication node of the authentication node if the short message authentication request is successfully authenticated.

[0029] In one possible implementation, the authentication node includes an application server, the authentication policy includes an authentication policy for the number of times the account is authenticated, and the authentication module includes:

[0030] The statistics submodule is used to count the number of first authentications of the account within a first time period and the number of second authentications of the account within a second time period, wherein the first time period is shorter than the second time period;

[0031] The first authentication submodule is used to determine the authentication result as successful when the first authentication count is less than a first threshold and the second authentication count is less than a second threshold.

[0032] In one possible implementation, the number of times the account is authenticated includes the number of times the account's IP address is accessed and the number of times the account's terminal identification number for receiving SMS messages is entered.

[0033] In one possible implementation, the statistics submodule includes:

[0034] The first acquisition unit is used to acquire the identification information of the account;

[0035] The second acquisition unit is used to acquire the first number of times the account is authenticated within the first time period and the second number of times the account is authenticated within the second time period.

[0036] The storage unit is used to store the identification information, the first authentication count, and the second authentication count in a cached database in the form of key-value pairs.

[0037] In one possible implementation, the authentication node includes a site server, the authentication policy includes an authentication policy based on the IP address of the account and the frequency of access to the target resource, and the authentication module includes:

[0038] The first submodule is used to obtain the number of times an account's IP address accesses the target resource;

[0039] The second authentication submodule is used to determine the authentication result as successful when the number of accesses is less than the access threshold corresponding to the target resource.

[0040] In one possible implementation, the authentication node includes a site server, the authentication policy includes an authentication policy based on the IP address of an account and the frequency of access to a target access path, and the authentication module includes:

[0041] The second acquisition submodule is used to acquire the number of times the account's IP address accesses the target access path within a preset time period before the SMS authentication request enters the site server;

[0042] The third authentication submodule is used to determine the authentication result as successful if the number of accesses is less than a preset frequency.

[0043] In one possible implementation, the authentication node includes a client, and the authentication strategy includes an authentication strategy for the format of the terminal identification number corresponding to the account and an authentication strategy for the sending time interval of the SMS verification code.

[0044] Thirdly, this application also provides a computer device. A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method as described in any one of the embodiments of this disclosure.

[0045] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the method as described in any one of the embodiments of this disclosure.

[0046] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps: when executed by a processor, the computer program performs the steps described in any one of the embodiments of this disclosure.

[0047] In this embodiment of the disclosure, authentication policies matching the node positions are set in multiple authentication nodes of the communication system, and SMS authentication requests are authenticated layer by layer according to the corresponding authentication policies. This makes network traffic like passing through a "funnel," intercepting malicious SMS authentication requests layer by layer, leaving genuine SMS authentication requests. Furthermore, authentication policies can be set from simple to complex according to the node positions from front to back. Therefore, at the beginning of the SMS authentication request, the authentication policy in the client is the simplest, reducing user operations (e.g., no need to enter a graphic verification code), thereby intercepting malicious SMS authentication requests without the user's awareness. Furthermore, in non-authentication scenarios, the above-mentioned authentication policy of intercepting requests layer by layer from simple to complex can quickly filter malicious authentication requests, simplify user terminal operations, and improve authentication efficiency. Furthermore, by setting a penalty strategy that ranges from strict to lenient according to the node positions from front to back, a large number of malicious authentication requests from the front end can be effectively suppressed. In addition, by setting a reminder strategy that ranges from simple to comprehensive according to the node positions from front to back, the authentication details of the real account can be informed at the later authentication nodes, avoiding the waste of excessive system resources by informing the front end. Attached Figure Description

[0048] Figure 1 A flowchart of the existing account authentication method;

[0049] Figure 2 This is a flowchart illustrating an account authentication method in one embodiment;

[0050] Figure 3 This is a flowchart illustrating the account authentication method in another embodiment;

[0051] Figure 4 This is a flowchart illustrating step S301 in one embodiment;

[0052] Figure 5 This is a flowchart illustrating the account authentication method in another embodiment;

[0053] Figure 6 This is a flowchart illustrating the account authentication method in another embodiment;

[0054] Figure 7 This is a flowchart illustrating the account authentication method in another embodiment;

[0055] Figure 8 This is a structural block diagram of an account authentication system in one embodiment;

[0056] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. The acquisition, storage, use, and processing of data in the counting scheme of this application all comply with relevant national laws and regulations.

[0058] To facilitate understanding of the technical solutions provided by the embodiments of this disclosure by those skilled in the art, the technical environment for implementing the technical solutions will be described below.

[0059] In related technologies, image CAPTCHA verification is added before sending and verifying SMS verification codes to accounts. The image CAPTCHA is verified first, and only after successful verification is the SMS message sent, thus preventing attackers from launching attacks on the website. However, image CAPTCHAs themselves negatively impact user experience, making the process more cumbersome and difficult to recognize. Image CAPTCHAs should only be used in one place—either when sending or verifying an SMS verification code. Using them in two places results in a poor user experience. Furthermore, image CAPTCHAs are vulnerable to being cracked, while overly complex designs risk making them difficult to decipher.

[0060] Another related technology involves parsing user requests and setting the number of SMS messages sent or verifications for each phone number to reduce malicious attacks. However, in the non-authentication state, accounts have not yet been segmented, and the number of accounts is enormous. Therefore, the above-mentioned judgment settings would consume a large amount of valuable server data resources; furthermore, this scheme's filtering is not precise enough, setting too few times will be ineffective, and setting too many times will waste resources.

[0061] Based on practical technical needs similar to those described above, embodiments of this disclosure provide account authentication methods, apparatus, computer devices, and storage media.

[0062] In one embodiment, such as Figure 2 As shown, an account authentication method is provided, applied to authentication nodes in a communication system. The communication system includes multiple authentication nodes between a client and an application server for SMS authentication requests. The method includes the following steps:

[0063] Step S201: Receive the short message authentication request for the account sent by the previous authentication node of the authentication node.

[0064] The data acquisition, storage, use, and processing in this application's counting scheme all comply with relevant national laws and regulations. In this embodiment, the communication system includes the communication network hardware and communication channels through which the SMS authentication request traverses from the client's initiation to the application server's receipt. Corresponding authentication policies can be set in the client, communication network hardware, and application server to form authentication nodes. Multiple authentication nodes have a positional order. In one example, the communication network hardware traversed by the SMS authentication request may include: a client, a CDN content delivery network, a front-end security component, a web server, a gateway distribution server, and an application server. Corresponding authentication policies can be set in one or more of the aforementioned communication network hardware to obtain authentication nodes. For example, setting corresponding authentication policies in the client, front-end security component, web server, gateway distribution server, and application server forms an authentication node.

[0065] In this embodiment of the disclosure, the authentication node receives an SMS authentication request for the account sent by the preceding authentication node. In one example, if the current authentication node is a front-end security component, and the preceding authentication node of the front-end security component is assumed to be a client, then the front-end security component receives the SMS authentication request for the account sent by the client. In another example, if the current authentication node is an application server, and the preceding authentication node of the application server is assumed to be a gateway distribution server, then the application server receives the SMS authentication request for the account sent by the gateway distribution server.

[0066] Step S203: Authenticate the SMS authentication request using an authentication strategy that matches the node location of the authentication node.

[0067] In this embodiment, the node position includes the position of the authentication node in the order of the authentication nodes passed by the SMS request. For example, if the client is located at the initiating end of the SMS request, the client's node position corresponds to the first position; if the pre-security component is located after the client, the pre-security component's node position corresponds to the second position. In one example, authentication policies from simple to complex can be set according to the order of node positions from front to back, where front and back include the order in which the SMS request passes through the authentication nodes. Simple and complex can be relative and can be set based on the number of authentication objects and the number of authentication conditions. For example, the fewer the number of authentication objects and the fewer the authentication conditions, the simpler the authentication policy; the more the number of authentication objects and the more authentication conditions, the more complex the authentication policy. In another example, penalty policies from strict to lenient can be set according to the order of node positions from front to back, for example, the earlier the authentication node, the stricter the penalty policy. The penalty policy can be applied in real time to different authenticated accounts, and accounts that pass authentication may not be penalized. In another example, the alert strategy can be set from simple to comprehensive, following the order of node positions from front to back. For instance, if authentication fails at an earlier authentication node, the alert message sent would be simpler; for example, if the client's authentication strategy fails, no alert message might be sent. The alert message includes a reason for the authentication failure.

[0068] Step S205: If the SMS authentication request is successfully authenticated, the authentication request is sent to the next authentication node of the authentication node.

[0069] In this embodiment of the disclosure, if the SMS authentication request passes, the authentication request can be sent to the next authentication node of the authentication node. In one example, if the SMS authentication request fails, the account corresponding to the SMS authentication request can be penalized according to the corresponding penalty policy. In another example, if the SMS authentication request fails, a prompt message indicating the reason for the authentication failure can be sent to the account corresponding to the SMS authentication request.

[0070] In this embodiment of the disclosure, authentication policies matching the node positions are set in multiple authentication nodes of the communication system, and SMS authentication requests are authenticated layer by layer according to the corresponding authentication policies. This makes network traffic like passing through a "funnel," intercepting malicious SMS authentication requests layer by layer, leaving genuine SMS authentication requests. Furthermore, authentication policies can be set from simple to complex according to the node positions from front to back. Therefore, at the beginning of the SMS authentication request, the authentication policy in the client is the simplest, reducing user operations (e.g., no need to enter a graphic verification code), thereby intercepting malicious SMS authentication requests without the user's awareness. Furthermore, in non-authentication scenarios, the above-mentioned authentication policy of intercepting requests layer by layer from simple to complex can quickly filter malicious authentication requests, simplify user terminal operations, and improve authentication efficiency. Furthermore, by setting a penalty strategy that ranges from strict to lenient according to the node positions from front to back, a large number of malicious authentication requests from the front end can be effectively suppressed. In addition, by setting a reminder strategy that ranges from simple to comprehensive according to the node positions from front to back, the authentication details of the real account can be informed at the later authentication nodes, avoiding the waste of excessive system resources by informing the front end.

[0071] In one embodiment, such as Figure 3 As shown, an account authentication method is provided. The authentication node includes an application server, and the authentication policy includes an authentication policy for the number of times the account is authenticated. Step S203, which uses an authentication policy that matches the node location of the authentication node to authenticate the SMS authentication request, includes the following steps:

[0072] Step S301: Count the number of first authentications of the account within a first time period and the number of second authentications of the account within a second time period, wherein the first time period is shorter than the second time period.

[0073] The data acquisition, storage, use, and processing in this application's counting scheme all comply with relevant national laws and regulations. In this embodiment, the first duration and the second duration are not equal, with the first duration being shorter than the second duration. For example, the first duration is set to 1 minute, and the second duration is set to 1 day. The first duration can be used to count accounts that send multiple SMS authentication requests within a short period, thereby filtering accounts with high-frequency attack characteristics. The second duration can be used to count accounts that send multiple SMS authentication requests over a longer period, thereby filtering accounts with low-frequency attack characteristics.

[0074] In this embodiment of the disclosure, the number of authentication attempts is used to characterize the user's access frequency. In one example, counting the number of authentication attempts may include counting the number of times an account's IP address accesses the server; for example, the number of times account A accesses the application server using IP address A within a certain period. In another example, counting the number of authentication attempts may include counting the number of times an account inputs its terminal identification number for receiving SMS messages; for example, the number of times account B inputs its terminal identification number for receiving SMS messages on the login interface within a certain period. In yet another example, the count may include either counting the number of times an account's IP address accesses the server or counting the number of times an account inputs its terminal identification number for receiving SMS messages. In this embodiment of the disclosure, the terminal identification number for receiving SMS messages may include a mobile phone number or other communication number, and this disclosure does not impose any limitations on this.

[0075] Step S303: If the first number of authentication attempts is less than the first threshold and the second number of authentication attempts is less than the second threshold, the authentication result is determined to be successful.

[0076] In this embodiment of the disclosure, the setting of the first threshold and the second threshold can be determined according to different business scenarios. For example, when the business scenario is a certain activity day, there may be a large number of account schemes, and the threshold can be appropriately increased; for example, when the business scenario is a normal working day, the above threshold can be set according to the average value of historical visits. This disclosure does not impose any restrictions.

[0077] In this embodiment, a comprehensive reminder strategy can be set to provide users with user-friendly prompts. Since the application server typically acts as the last authentication node in the SMS authentication request transmission, its traffic is not significant, and the reminders here will not waste much system resource. If a normal account is affected, it can still pass authentication by following the reminder strategy.

[0078] This embodiment of the disclosure sets two durations, a first duration and a second duration, and counts the number of authentications within the first duration and the second duration respectively, to filter accounts targeted by high-frequency attacks and accounts targeted by low-frequency attacks. Accounts targeted by high-frequency attacks include those generating a large number of accesses in a short period, while accounts targeted by low-frequency attacks include those generating a large number of accesses over a long period, characterized by a low number of accesses in a short period but continuous access over a longer time interval. In this embodiment, for the application server, which generally acts as the last authentication node in the SMS authentication request transmission, relatively strict authentication conditions are set from both low-frequency and high-frequency perspectives, enabling more refined filtering and accurately filtering out authentication requests from malicious attack accounts.

[0079] In this embodiment of the disclosure, in order to further improve the strictness of the authentication conditions, the number of times an account is authenticated can be set to include the number of times the account's IP address is accessed and the number of times the terminal identification number of the account is input to receive SMS messages, which can make the filtering more refined.

[0080] Figure 4 This is a flowchart illustrating step S301 in one embodiment, referencing... Figure 4 As shown, step S301 includes:

[0081] Step S401: Obtain the identification information of the account;

[0082] Step S403: Obtain the first number of authentications of the account within the first time period and the second number of authentications of the account within the second time period;

[0083] Step S405: Store the identification information, the first authentication count, and the second authentication count in a cached database as key-value pairs.

[0084] The data acquisition, storage, use, and processing in this application's counting scheme all comply with relevant national laws and regulations. In this embodiment, the account identification information may include identification information corresponding to high-frequency terminal identification number access methods, high-frequency IP address access methods, low-frequency terminal identification number access methods, and low-frequency IP address access methods. For example, the identification information corresponding to the high-frequency IP address access method for account X is: IP-H_10.XX.XXX.200. The identification information corresponding to the high-frequency terminal identification number access method for account Y is: MOBILE-H_1501XXXXX78.

[0085] In this embodiment, the cached database may include a Redis database, a memcache database, etc. The aforementioned identification information is used as a Redis database KEY, and the authentication count corresponding to the identification information is stored in the same location as the value corresponding to the KEY, both stored as key-value pairs. In one example, an auto-increment operation is performed on the value corresponding to the KEY. When the KEY value is empty, a new value is created and set to 1. In one example, the auto-increment method includes obtaining the remaining duration of the KEY; if the KEY value is 1, it indicates the first access, and an expiration time is set for the KEY; if the KEY value is -1, it indicates an anomaly, the value is reset to 1, and an expiration time is set; if the KEY value is greater than a preset threshold, flow control is triggered, and 0 is output to indicate authentication failure; otherwise, 1 is output to indicate authentication success.

[0086] In this embodiment of the disclosure, the IP address can be obtained through the "X-Forwarded-For" field in the SMS authentication request. In one example, when obtaining the terminal identification number of the account from the SMS authentication request, format validation is performed. In one example, the above-mentioned increment operation can be performed using the LUA scripting language to ensure atomicity.

[0087] In this embodiment, a cached database is used to store identification information and authentication counts in key-value pairs, which has high read and write speeds and the operations are atomic, ensuring the accuracy and efficiency of counting.

[0088] Figure 5 This is a flowchart illustrating the account authentication method in another embodiment, see reference. Figure 5 As shown, the authentication node includes a site server, and the authentication policy includes an authentication policy based on the account's IP address and the frequency of access to the target resource. Step S203 involves authenticating the SMS authentication request using an authentication policy that matches the node location of the authentication node. This includes:

[0089] Step S501: Obtain the number of times the account's IP address accesses the target resource;

[0090] Step S503: If the number of accesses is less than the access threshold corresponding to the target resource, the authentication result is determined to be successful.

[0091] The data acquisition, storage, use, and processing in this application's counting scheme all comply with relevant national laws and regulations. This embodiment is applied to a site server. Since the site server has not yet implemented resource allocation for accounts, but is about to do so, an existing sliding window flow control algorithm can be used to control the overall traffic of SMS authentication requests, ensuring system security. In this embodiment, authentication parameters such as resource name, rate limiting mode, rate limiting threshold, and parameter index can be set in the sliding window flow control algorithm. In one example, an exception handling method can be set to restrict the accounts subject to rate limiting. In another example, annotations can be added to the flow control method, and historical data records can be set to allow different types of IP accounts to quickly pass or fail authentication.

[0092] In this embodiment of the disclosure, by utilizing the characteristics of resource distribution in the site server, a resource-based authentication policy is set for accounts, which can further restrict malicious SMS authentication requests.

[0093] Figure 6 This is a flowchart illustrating the account authentication method in another embodiment, see reference. Figure 5As shown, the authentication node includes a site server, and the authentication policy includes an authentication policy based on the account's IP address and the frequency of access to the target access path. Step S203 involves authenticating the SMS authentication request using an authentication policy that matches the node location of the authentication node. This includes:

[0094] Step S601: Before the SMS authentication request enters the site server, obtain the number of times the account's IP address accesses the target access path within a preset time period.

[0095] Step S603: If the number of accesses is less than the preset frequency, the authentication result is determined to be successful.

[0096] The data acquisition, storage, use, and processing in this application's counting scheme all comply with relevant national laws and regulations. In this embodiment, an authentication policy is applied to the account's IP address based on the frequency of access to the target access path before the SMS authentication request enters the site server. In one example, authentication can be performed after the SMS authentication request passes through the load balancer and before entering the site server. In one example, the access count includes the number of times the account's IP address accesses the target access path. In one example, the preset frequency may include, for example, 10 accesses within 60 seconds. The frequency duration can be less than a preset threshold, such as 1 minute, to reduce the impact on system efficiency. In one example, a stricter penalty policy can be set, such as prohibiting the use of all website functions for a certain period.

[0097] In this embodiment of the disclosure, regarding the authentication policy in front of the site server, the attack volume of SMS authentication requests is often large. Therefore, setting a relatively simple and lenient request frequency for IP addresses and blocking SMS authentication requests exceeding the frequency can eliminate the need for an authentication policy for the terminal identification number, thus avoiding the consequences of false blocking caused by setting a stricter authentication policy.

[0098] In one possible implementation, the authentication node includes a client, and the authentication strategy includes an authentication strategy for the format of the terminal identification number corresponding to the account and an authentication strategy for the sending time interval of the SMS verification code.

[0099] The data acquisition, storage, use, and processing in this application's counting scheme all comply with relevant national laws and regulations. In this embodiment, the client can perform format validation on the customer's input mobile phone number, such as requiring it to be an 11-digit pure number starting with 1; secondly, there is an authentication strategy for the SMS verification code sending interval. In one example, a countdown timer can be set on the front end, preventing the user from obtaining the verification code again within one minute after successful acquisition. This aims to prevent customers from accidentally entering or clicking the wrong information and to ensure the authenticity of ordinary customer traffic.

[0100] Figure 7 This is a flowchart illustrating an account authentication method in another embodiment. (Reference) Figure 7 As shown in the embodiments of this disclosure, authentication policies and penalty policies are set for different authentication nodes.

[0101] In this embodiment of the disclosure, when the authentication node includes a client, the client can perform format verification on the mobile phone number entered by the customer, such as requiring it to be an 11-digit pure number starting with 1; secondly, there is an authentication strategy for the time interval of sending SMS verification codes. In one example, a countdown can be set on the front end, and after successfully obtaining the verification code, it cannot be obtained again within one minute, etc., in order to prevent customers from accidentally entering or clicking, and to ensure the authenticity of ordinary customer traffic.

[0102] In this embodiment of the disclosure, when the authentication node includes a site server, corresponding to Figure 7 The second layer of protection in the system is a Web Application Firewall (WAF). The authentication policy includes an authentication policy based on the account's IP address and the frequency of access to the target access path. Step S203 involves authenticating the SMS authentication request using an authentication policy that matches the node location of the authentication node. This includes:

[0103] Step S601: Before the SMS authentication request enters the site server, obtain the number of times the account's IP address accesses the target access path within a preset time period.

[0104] Step S603: If the number of accesses is less than the preset frequency, the authentication result is determined to be successful.

[0105] In this embodiment of the disclosure, when the authentication node includes a site server, the authentication node includes a site server, and the authentication policy includes an authentication policy based on the IP address of the account and the frequency of access to the target resource. Step S203 involves authenticating the SMS authentication request using an authentication policy that matches the node location of the authentication node. This includes:

[0106] Step S501: Obtain the number of times the account's IP address accesses the target resource;

[0107] Step S503: If the number of accesses is less than the access threshold corresponding to the target resource, the authentication result is determined to be successful.

[0108] In this embodiment of the disclosure, when the authentication node includes an application server, the authentication policy includes an authentication policy for the number of times the account is authenticated. Step S203, which uses an authentication policy that matches the node location of the authentication node to authenticate the SMS authentication request, includes the following steps:

[0109] Step S301: Count the number of first authentications of the account within a first time period and the number of second authentications of the account within a second time period, wherein the first time period is shorter than the second time period.

[0110] Step S303: If the first number of authentication attempts is less than the first threshold and the second number of authentication attempts is less than the second threshold, the authentication result is determined to be successful.

[0111] For details regarding the specific steps in this embodiment, please refer to the above description of the account authentication method; these details will not be repeated here.

[0112] In this embodiment of the disclosure, authentication policies matching the node locations are set in multiple authentication nodes of the communication system, and SMS authentication requests are authenticated layer by layer according to the corresponding authentication policies. This makes network traffic like passing through a "funnel," intercepting malicious SMS authentication requests layer by layer, leaving only genuine SMS authentication requests.

[0113] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0114] Based on the same inventive concept, this application also provides an account authentication system for implementing the account authentication method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more account authentication system embodiments provided below can be found in the limitations of the account authentication method described above, and will not be repeated here.

[0115] In one embodiment, such as Figure 8 As shown, an account authentication system is provided, including multiple authentication nodes between the client and the application server for SMS authentication requests. The authentication nodes include:

[0116] The receiving module 801 is used to receive the short message authentication request for the account sent by the previous authentication node of the authentication node;

[0117] The authentication module 803 is used to authenticate the SMS authentication request using an authentication strategy that matches the node location of the authentication node.

[0118] The sending module 805 is used to send the authentication request to the next authentication node of the authentication node if the short message authentication request is successfully authenticated.

[0119] In one possible implementation, the authentication node includes an application server, the authentication policy includes an authentication policy for the number of times the account is authenticated, and the authentication module includes:

[0120] The statistics submodule is used to count the number of first authentications of the account within a first time period and the number of second authentications of the account within a second time period, wherein the first time period is shorter than the second time period;

[0121] The first authentication submodule is used to determine the authentication result as successful when the first authentication count is less than a first threshold and the second authentication count is less than a second threshold.

[0122] In one possible implementation, the number of times the account is authenticated includes the number of times the account's IP address is accessed and the number of times the account's terminal identification number for receiving SMS messages is entered.

[0123] In one possible implementation, the statistics submodule includes:

[0124] The first acquisition unit is used to acquire the identification information of the account;

[0125] The second acquisition unit is used to acquire the first number of times the account is authenticated within the first time period and the second number of times the account is authenticated within the second time period.

[0126] The storage unit is used to store the identification information, the first authentication count, and the second authentication count in a cached database in the form of key-value pairs.

[0127] In one possible implementation, the authentication node includes a site server, the authentication policy includes an authentication policy based on the IP address of the account and the frequency of access to the target resource, and the authentication module includes:

[0128] The first submodule is used to obtain the number of times an account's IP address accesses the target resource;

[0129] The second authentication submodule is used to determine the authentication result as successful when the number of accesses is less than the access threshold corresponding to the target resource.

[0130] In one possible implementation, the authentication node includes a site server, the authentication policy includes an authentication policy based on the IP address of an account and the frequency of access to a target access path, and the authentication module includes:

[0131] The second acquisition submodule is used to acquire the number of times the account's IP address accesses the target access path within a preset time period before the SMS authentication request enters the site server;

[0132] The third authentication submodule is used to determine the authentication result as successful if the number of accesses is less than a preset frequency.

[0133] In one possible implementation, the authentication node includes a client, and the authentication strategy includes an authentication strategy for the format of the terminal identification number corresponding to the account and an authentication strategy for the sending time interval of the SMS verification code.

[0134] Each module in the aforementioned account authentication system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of the computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0135] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements an account authentication method.

[0136] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0137] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0138] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0139] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. An account authentication method, characterized in that, An authentication node is applied in a communication system, which includes multiple authentication nodes between a client and an application server for SMS authentication requests. These authentication nodes have a preset node position order, and authentication strategies ranging from simple to complex are set according to the node positions from front to back. The multiple authentication nodes include several of the following communication network hardware components: a client, a CDN content delivery network, a front-end security component, a web server, a gateway distribution server, and an application server. The method includes: Receive an SMS authentication request for an account sent by the previous authentication node of the authentication node; wherein the SMS authentication request does not include a graphic verification code; The authentication process for the SMS authentication request is performed using an authentication strategy that matches the node location of the authentication node. When the authentication node includes an application server, the authentication process includes: counting the number of first authentications of the account within a first duration and the number of second authentications of the account within a second duration, wherein the first duration is less than the second duration; if the number of first authentications is less than a first threshold and the number of second authentications is less than a second threshold, the authentication result is determined to be successful. When the authentication node includes a client, the authentication strategy includes an authentication strategy based on the format of the terminal identification number corresponding to the account and an authentication strategy based on the sending time interval of the SMS verification code. When the authentication node includes a site server, the authentication strategy includes an authentication strategy based on the IP address of the account for the frequency of access to the target resource, wherein the terminal identification number includes a mobile phone number. If the SMS authentication request is successfully authenticated, the authentication request will be sent to the next authentication node of the authentication node.

2. The method according to claim 1, characterized in that, The number of times an account is authenticated includes the number of times the account's IP address is accessed and the number of times the terminal identification number for receiving SMS messages is entered.

3. The method according to claim 1, characterized in that, The statistics on the number of first authentications of the account within the first time period and the number of second authentications of the account within the second time period include: Obtain the identification information of the account; Obtain the first number of authentications of the account within the first time period and the second number of authentications of the account within the second time period; The identification information, the first authentication count, and the second authentication count are stored in a cached database as key-value pairs.

4. The method according to claim 1, characterized in that, The authentication process for the SMS authentication request, which utilizes an authentication strategy matching the node location of the authentication node, includes: Get the number of times an account's IP address accessed the target resource; If the number of accesses is less than the access threshold corresponding to the target resource, the authentication result is determined to be successful.

5. The method according to claim 1, characterized in that, The authentication node includes a site server, and the authentication policy includes an authentication policy based on the account's IP address and the frequency of access to the target access path. The authentication process for the SMS authentication request using an authentication policy that matches the node location of the authentication node includes: Before the SMS authentication request enters the site server, obtain the number of times the account's IP address accesses the target access path within a preset time period; If the number of accesses is less than the preset frequency, the authentication result is determined to be successful.

6. An account authentication system, characterized in that, The system includes multiple authentication nodes between the client and the application server for SMS authentication requests. These nodes have a preset node position order, and authentication strategies ranging from simple to complex are set according to their position from front to back. The multiple authentication nodes include several of the following communication network hardware components: client, CDN content delivery network, front-end security component, web server, gateway distribution server, and application server. The receiving module is used to receive an SMS authentication request for an account sent by the previous authentication node of the authentication node; wherein the SMS authentication request does not include a graphic verification code; An authentication module is used to authenticate the SMS authentication request using an authentication strategy that matches the node location of the authentication node. The authentication node includes an application server, and the authentication strategy includes an authentication strategy for the number of times the account is authenticated. The authentication module includes: a statistics submodule, used to count the first number of times the account is authenticated within a first time period and the second number of times the account is authenticated within a second time period, wherein the first time period is less than the second time period; and a first authentication submodule, used to determine that the authentication result is successful when the first number of authentications is less than a first threshold and the second number of authentications is less than a second threshold. The authentication node includes a client, and the authentication strategy includes an authentication strategy for the format of the terminal identification number corresponding to the account and an authentication strategy for the sending time interval of the SMS verification code. When the authentication node includes a site server, the authentication strategy includes an authentication strategy for the IP address of the account based on the frequency of access to the target resource, wherein the terminal identification number includes a mobile phone number. The sending module is used to send the authentication request to the next authentication node of the authentication node if the short message authentication request is successfully authenticated.

7. The system according to claim 6, characterized in that, The number of times an account is authenticated includes the number of times the account's IP address is accessed and the number of times the terminal identification number for receiving SMS messages is entered.

8. The system according to claim 6, characterized in that, The statistics submodule includes: The first acquisition unit is used to acquire the identification information of the account; The second acquisition unit is used to acquire the first number of times the account is authenticated within the first time period and the second number of times the account is authenticated within the second time period. The storage unit is used to store the identification information, the first authentication count, and the second authentication count in a cached database in the form of key-value pairs.

9. The system according to claim 6, characterized in that, The authentication module includes: The first submodule is used to obtain the number of times an account's IP address accesses the target resource; The second authentication submodule is used to determine the authentication result as successful when the number of accesses is less than the access threshold corresponding to the target resource.

10. The system according to claim 6, characterized in that, The authentication node includes a site server, the authentication policy includes an authentication policy based on the IP address of the account and the frequency of access to the target access path, and the authentication module includes: The second acquisition submodule is used to acquire the number of times the account's IP address accesses the target access path within a preset time period before the SMS authentication request enters the site server; The third authentication submodule is used to determine the authentication result as successful if the number of accesses is less than a preset frequency.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images