Dynamic two-way authentication method, device and medium based on trust

Abstract

The present disclosure relates to a dynamic two-way authentication method, device and medium based on trust. A dynamic two-way authentication method based on trust includes: after the platform passes the one-way authentication of the user's user terminal, generating a secondary authentication string, the secondary authentication string contains the user's trust and the platform identity information of the platform, the trust represents the trustworthiness of the user within the most recent first predetermined period; sending the secondary authentication string to the user terminal; in the case of receiving the authentication credential from the user terminal, verifying the authentication credential; and in the case of determining that the authentication credential passes the verification, determining that the two-way authentication between the platform and the user terminal has passed.

Description

Technical Field

[0001] The present disclosure generally relates to a trust-based dynamic two-way authentication method, apparatus, and medium. Background Art

[0002] Nowadays, with the increase of network security threats and hacker attacks, traditional one-way authentication (i.e., the platform authenticates the user's terminal device) can no longer guarantee the security of the entire communication process. Summary of the invention

[0003] A brief overview of the disclosure is given below in order to provide a basic understanding of some aspects of the disclosure. However, it should be understood that this overview is not an exhaustive overview of the disclosure. It is not intended to identify the key or important parts of the disclosure, nor is it intended to limit the scope of the disclosure. Its purpose is simply to give some concepts of the disclosure in a simplified form as a prelude to a more detailed description given later.

[0004] According to one aspect of the present disclosure, a dynamic two-way authentication method based on trust is provided, comprising: generating a secondary authentication string after a one-way authentication of a user terminal by a platform is passed, the secondary authentication string including the trust of the user and platform identity information of the platform, the trust indicating the trustworthiness of the user within a recent first predetermined period of time; sending the secondary authentication string to the user terminal; upon receiving an authentication credential from the user terminal, verifying the authentication credential; and upon determining that the authentication credential has passed the verification, determining that the two-way authentication between the platform and the user terminal has passed.

[0005] According to another aspect of the present disclosure, a dynamic two-way authentication device based on trust is provided, comprising: a memory on which instructions are stored; and a processor configured to execute the instructions stored in the memory to perform the method as described above.

[0006] According to another aspect of the present disclosure, a computer-readable storage medium is provided, which includes computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors execute the method according to the above aspects of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0008] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0009] Figure 1The schematic flow of a dynamic two-way authentication method between a user terminal and a platform according to an embodiment of the present disclosure is shown.

[0010] Figure 2 is a diagram showing a possible composition structure of a secondary authentication string.

[0011] Figure 3 The present invention is a schematic flowchart showing a dynamic two-way authentication method between a user terminal and a platform according to an embodiment of the present invention.

[0012] Figure 4 is a diagram showing an example composition structure of a secondary authentication string according to one embodiment of the present disclosure.

[0013] Figure 5 An exemplary configuration of a computing device that can implement an embodiment according to the present disclosure is shown. DETAILED DESCRIPTION

[0014] The following detailed description is made with reference to the accompanying drawings, and the following detailed description is provided to assist in a comprehensive understanding of the various exemplary embodiments of the present disclosure. The following description includes various details to assist in understanding, but these details are considered to be examples only and not to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of well-known structures, functions, and configurations may be omitted. Those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0015] In order to solve one or more technical problems existing in the prior art, two-way authentication is proposed. In two-way authentication, before the device receives information sent by the platform, the terminal device should also verify the identity of the platform to ensure the security of the source of information.

[0016] The disclosed method proposes a dynamic two-way authentication method based on a highly complex secondary authentication string, which has a strong correlation with time, avoids the risk of being caught and breached, and improves security. It has good applicability in scenarios with two-way authentication and high security requirements.

[0017] The embodiments of the method disclosed herein use concepts related to zero trust and take into account the applicability in zero trust scenarios.

[0018] Zero trust is a concept that means that devices and users are untrustworthy by default, and each user, device, and even each behavior must be authenticated, authorized, and evaluated before they can be operated or take effect. All modules in this method are based on the zero trust concept.

[0019] The method proposed in the present disclosure increases the complexity of the authentication process based on trust and / or user grouping, constructs a dynamic secondary authentication string, and thus improves the strength of two-way authentication. It is more secure and has stronger security capabilities than conventional two-way authentication.

[0020] Figure 1 The schematic flow of a dynamic two-way authentication method between a user terminal and a platform according to an embodiment of the present disclosure is shown, wherein the platform includes an authentication module and a resource pool (ie, a resource module).

[0021] like Figure 1 As shown, in one embodiment, optionally, the platform forms a user group with users who initiate connection and authentication (S1) at the same time and pass (i.e., after passing the one-way authentication of the platform to the user terminal), and the authentication module unpacks (e.g., reads) the resource request information from the user terminal of the user, and requests the corresponding resource module (i.e., resource pool) to obtain (S2) the preset resource code. Then, the authentication module receives the resource code returned (S3) from the resource module.

[0022] Then, the platform generates (S4) and sends a unique secondary authentication string to each user for two-way authentication.

[0023] In one embodiment, the secondary authentication string may optionally include the trust of the authentication subject (i.e., the user to be authenticated) (e.g., input by a trust assessment module), user group credentials, platform identity information, resource code, timestamp and / or other information. Therefore, the secondary authentication string is dynamic, unique and highly complex. It should be emphasized that the trust, user group credentials, resource code and timestamp are all optional, that is, the secondary authentication string may only include platform identity information and trust, or only include platform identity information and user group credentials.

[0024] Due to the dynamic, unique and high complexity of the secondary authentication string, it is difficult to forge, and the two-way authentication using this authentication string has strong security.

[0025] The secondary authentication string has strong anti-counterfeiting properties to ensure the security strength of the secondary authentication. Figure 2 2 is a diagram showing a possible composition structure of a secondary authentication string (for each information field in the secondary authentication string, a corresponding identifier can be set).

[0026] More specifically, if Figure 2 As shown, the secondary authentication string can include:

[0027] Trust A of the authenticated user: In one embodiment, trust A can be generated by the platform. In one embodiment, trust A comes from a trust evaluation system outside the platform. Trust A reflects the trustworthiness of the authenticated user in the previous period of time (i.e., the most recent first predetermined period of time), contains time information, and has strong anti-counterfeiting properties. The previous period of time described here can be, for example, any recent period of time, such as the most recent day, week, month, year, etc.;

[0028] User group credential B: The user group that initiated connection and authentication at the most recent same time (i.e., the most recent second predetermined time period) is time-related, the credential algorithm can be customized, and it has strong anti-counterfeiting properties. As mentioned above, the platform groups users who initiated connection and authentication at the same time and passed (i.e., after passing the platform's one-way authentication of the user terminal). User group credential B is generated based on the user members in the user group. The most recent same time (the most recent second predetermined time period) mentioned here can be a time period of any length, for example, it can be the most recent 5 seconds, 10 seconds, one minute, one hour, one day, etc.;

[0029] Platform identity information C: key information for two-way authentication, used to verify the platform identity;

[0030] Resource code: A dynamic authentication code constructed by the resource side based on this request, which is strongly correlated with the time and content of this request;

[0031] Other parameters such as timestamp are used to increase the complexity of the secondary authentication string to improve security strength.

[0032] After receiving the secondary authentication string sent from the platform, the user terminal extracts and verifies the parameters in the secondary authentication string according to preset rules, and generates and sends the authentication certificate.

[0033] Finally, the platform receives the authentication credentials sent from the user terminal and checks the information therein (whether the verification is passed, whether it is in the expected format and result). If it meets expectations, the two-way authentication is successfully completed and the connection channel between the platform and the terminal is allowed to be established.

[0034] Figure 3 The present invention is a schematic flowchart showing a dynamic two-way authentication method between a user terminal and a platform according to an embodiment of the present invention. Figure 4 is a diagram showing an example composition structure of a secondary authentication string according to an embodiment of the present disclosure. Figure 4 A specific secondary authentication string example Figure 3 The two-way authentication method shown in the figure is described. It should be emphasized that Figure 3 The method flow shown is not limited to a specific secondary authentication string, but can be applied to any secondary authentication string.

[0035] Now assume that at the same nearest time, five users, namely A, B, C, D, and E (sorted by time), initiate connections and authentications, and user A passes the platform's authentication. Then, a secondary authentication string as shown in Figure 4 is generated for user A. Among them, the user group credential B can be, for example, the operation result based on the user IDs of two of the users (e.g., B and C). On the other hand, if user A fails to pass the platform's authentication, then the connection request of user A is rejected, and the two-way authentication method ends.

[0036] Then, the platform sends the secondary authentication string to the terminal of user A for the terminal to perform secondary authentication (i.e., verification) on the secondary authentication string. After the terminal passes the secondary authentication of the secondary authentication string, the terminal generates an authentication credential and sends the authentication credential to the platform. If the terminal fails to pass the secondary authentication of the secondary authentication string, then the two-way authentication method ends.

[0037] For different secondary authentication string composition structures, corresponding different targeted authentication methods are established. In one embodiment, this method can be pre-stored in the user terminal.

[0038] In one embodiment, for the secondary authentication string example as shown in Figure 4 , the user terminal of user A performs the following authentication:

[0039] Extract the trust level A according to the identifier and parse out the time information S therein, and extract the timestamp E, and verify that S < E. Since the trust level A is generated before the timestamp E, the time represented by the time information S included in the trust level A should be before the time represented by the timestamp E. Therefore, if S < E, then it is determined that the verification passes; otherwise, the verification fails;

[0040] Extract the platform identity information C according to the identifier and verify the legality of the platform identity;

[0041] Extract the resource code D according to the identifier and check whether it is the resource code corresponding to the resource currently requested by user A, thereby verifying the resource legality;

[0042] Extract the user group credential B (e.g., the operation result of the B and C IDs) according to the identifier, repackage it together with the verification results of each item as the two-way authentication result credential and return it to the platform.

[0043] After the platform receives the authentication credential returned from the user terminal, it verifies the authentication credential to check the information therein (whether the verification passes, whether it is in the expected format and result). If it meets the expectations, the two-way authentication is successfully completed, and the connection channel between the platform and the terminal is allowed to be established.

[0044] According to an embodiment of the present disclosure, a dynamic two-way authentication method based on trust level is provided, including: after passing the one-way authentication of the user's user terminal by the platform, generating a secondary authentication string, where the secondary authentication string includes the trust level of the user and the platform identity information of the platform, and the trust level represents the trustworthiness of the user within a recent first predetermined time period; sending the secondary authentication string to the user terminal; in the case of receiving an authentication credential from the user terminal, verifying the authentication credential; and in the case of determining that the authentication credential passes the verification, determining that the two-way authentication between the platform and the user terminal is passed.

[0045] In one embodiment, a list of platform identity information C can be pre-set in the terminal when the terminal leaves the factory. Thus, the terminal can determine whether the platform is a legal platform by querying this list. In another embodiment, the terminal can also query the platform identity information C from the server or a third-party trusted institution to determine whether the platform is a legal platform.

[0046] In the present disclosure, since the secondary authentication string is generated and the platform is secondarily authenticated using the secondary authentication string, even when the platform identity information C is forged by a hacker, the legitimacy of the platform can be reliably authenticated.

[0047] In one embodiment, before generating the secondary authentication string, the method further includes: forming a user group by the user and one or more other users who have passed the one-way authentication of the user by the platform within a recent second predetermined time period (i.e., the same time as前述), where the secondary authentication string further includes a user group credential, and the user group credential is generated based on the user members in the user group. In one embodiment, the user group credential can be generated based on one or more user members in the user group. In one embodiment, the user group credential can be generated by any operation based on the user ID of the user member.

[0048] Users who initiate within the same time form a user group. Based on the randomness of the user group, the user group is unique and difficult to be counterfeited. For example, operations can be performed within user group 1 (A, B, C, D, E), and operations can also be performed within user group 2 (F, G, H, I, J). The operation results of both group 1 and group 2 are unique results B1 and B2 for each group, and are not easy to be counterfeited. Since the user group credential B has a dynamic characteristic (different groups have different B values), different from the traditional secondary authentication using a fixed authentication string, the secondary authentication method is related to the B value, that is, related to the user group. This improves the complexity of the secondary authentication. In addition, the specific algorithm of the user group credential B can be customized according to the business security requirements to increase the complexity.

[0049] The time length of the second predetermined time period can be determined according to the device performance and security requirements.

[0050] In the case that there are insufficient users connected and authenticated in the most recent second predetermined period, an empty user 0 can generally be introduced for filling. For example, it can be stipulated that each user group is composed of 10 users: 1. In a certain period of time, there are only 3 users a, b, c, then the group is {a, b, c, 0, 0, 0, 0, 0, 0}; 2. In a certain period of time, there are 15 users ao, then group 1 {a, b, c, d, e, f, g, h, i, j} and group 2 {k, l, m, n, o, 0, 0, 0, 0} are established. (How to calculate the empty users in the system can be customized by the business side).

[0051] All users in the user group are users who have passed the one-way authentication. For example, if 5 users, a, b, c, d, and e, initiate a connection within a certain period of time, but only 3 users, a, b, and c, have passed the one-way identity authentication, then the user group {a, b, c, 0, 0, 0, 0, 0, 0, 0} is established, and d and e do not participate in the establishment of the user group. (The existence of the user group serves the reverse authentication in the secondary authentication, and the one-way authentication can remain unchanged).

[0052] In one embodiment, the user group credential is generated based on user identifications (ie, IDs) of at least two users in the user group, for example.

[0053] In one embodiment, the secondary authentication string may also include a resource code corresponding to the current resource request information from the user terminal.

[0054] Different services have different resource request information, corresponding to different resource codes. The resource code can be preset in the resource pool for the authentication module to call. The generation of the resource code can be custom designed. In one embodiment, the resource code can be generated by salting and encrypting the service type, and a resource code pool can be formed. The resource pool can include a resource code pool and a calling module, and the calling module can be used to call the corresponding resource code.

[0055] In one embodiment, the confidence level of the user may include time information indicating a first time when the confidence level is generated.

[0056] In one embodiment, the secondary authentication string may further include a timestamp indicating a second time when the secondary authentication string is generated.

[0057] In one embodiment, after receiving the secondary authentication string, the user terminal may compare the first time with the second time, and reject the secondary authentication of the platform if it is determined that the first time is not before the second time.

[0058] In one embodiment, after receiving the secondary authentication string, the user terminal may verify the resource code in the secondary authentication string, and reject the secondary authentication of the platform if it is determined that the resource code does not match the current resource request information of the user terminal.

[0059] Therefore, the resource side can be taken into consideration in the authentication process. In general authentication processes, it is assumed that the authentication platform and the resource side are mutually trusted, so the resource side does not need to participate. However, the present disclosure adopts the concept of zero trust, and all components are assumed to be non-mutually trusted, so the resource side is also involved in the authentication process, further improving the complexity and security of the entire authentication process. The resource code D is provided by the resource side and verified by the user side, which is equivalent to an authentication method that also includes resources and users in the authentication process. The entire authentication process can be completed by users, user groups, authentication modules, resource sides, and external information sources (such as trust assessment modules).

[0060] In one embodiment, after receiving the secondary authentication string, the user terminal may verify the platform identity information in the secondary authentication string, and reject the secondary authentication of the platform if it is determined that the platform is illegal.

[0061] In one embodiment, the authentication credential may include the user group credential, and the step of verifying the authentication credential may include: determining whether the user group credential in the authentication credential is the same as the user group credential in the secondary authentication string, and only when the two are the same, determining that the authentication credential has passed the verification.

[0062] In the zero-trust concept, each user is evaluated for trust and given a trust level A. This work can be completed by a trust evaluation module, for example. The generation of trust level A can include elements such as user access time, location, behavior, frequency, and previous evaluation value A.

[0063] Introducing the trust value A can increase the complexity of the secondary authentication string. In addition, since each secondary authentication has a corresponding A value, the A value can be used as one of the authentication elements provided by the platform to authenticate the platform (whether the A value generated by the platform has the correct format, whether it is too different from the previous A value, whether the A value is provided, etc. can all be used as a reference for subsequent terminal authentication platforms). For example: a hacker impersonates a platform, but because the A value cannot be correctly given in the secondary authentication, it is impossible to generate a compliant secondary authentication string, which will cause the authentication of the platform to fail.

[0064] Trust A can be the trust evaluation result of the trust evaluation module on the trust of the user at the current time, so the A value can directly include the time information S, which can be used for subsequent timestamp comparison. Since the trust A is generated during one-way authentication, and the timestamp E is generated during the subsequent secondary authentication, it is easy to know that S <E。

[0065] How to parse S from A can be designed by the business. An example is as follows: trust value A{202010201800:80 / 100}({time information S: current trust value / full trust value}). The design and parsing of A can be decided by the business.

[0066] The authentication certificate returned by the terminal to the platform can provide the platform with information on whether the authentication is passed or not. The content of the authentication certificate is derived from the secondary authentication string and is therefore highly credible, thereby preventing hackers from forging feedback information.

[0067] The existing technologies for implementing dynamic two-way authentication mostly use random codes, which are not very complex. In addition, the existing technologies for user group authentication mostly focus on how to reduce the cost of authentication, rather than focusing on security requirements. An embodiment of the present disclosure uses user grouping and highly complex authentication strings for two-way authentication, which has a high security strength.

[0068] The present disclosure solves the problem that the existing two-way authentication can be breached.

[0069] Under certain conditions, the complexity of the authentication string generation and verification method can be increased or decreased according to business needs. This capability can be flexibly configured.

[0070] Figure 5 An exemplary configuration of a computing device 1200 capable of implementing embodiments according to the present disclosure is shown.

[0071] The computing device 1200 is an example of a hardware device to which the above aspects of the present disclosure can be applied. The computing device 1200 can be any machine configured to perform processing and / or computing. The computing device 1200 can be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant (PDA), a smart phone, a vehicle-mounted computer, or a combination thereof.

[0072] like Figure 5As shown, the computing device 1200 may include one or more elements that can be connected or communicated with the bus 1202 via one or more interfaces. The bus 1202 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus, etc. The computing device 1200 may include, for example, one or more processors 1204, one or more input devices 1206, and one or more output devices 1208. The one or more processors 1204 may be any kind of processor, and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). The processor 1204 may be configured to implement a dynamic two-way authentication method based on trust as described above, for example. The input device 1206 may be any type of input device capable of inputting information to the computing device, and may include, but is not limited to, a mouse, a keyboard, a touch screen, a microphone, and / or a remote controller. The output device 1208 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer.

[0073] The computing device 1200 may also include or be connected to a non-transitory storage device 1214, which may be any non-transitory storage device that can implement data storage, and may include, but is not limited to, a disk drive, an optical storage device, a solid-state memory, a floppy disk, a flexible disk, a hard disk, a tape, or any other magnetic medium, a compressed disk or any other optical medium, a cache memory, and / or any other storage chip or module, and / or any other medium from which a computer can read data, instructions, and / or code. The computing device 1200 may also include a random access memory (RAM) 1210 and a read-only memory (ROM) 1212. The ROM 1212 may store programs, utilities, or processes to be executed in a non-volatile manner. The RAM 1210 may provide volatile data storage and store instructions related to the operation of the computing device 1200. The computing device 1200 may also include a network / bus interface 1216 coupled to a data link 1218. The network / bus interface 1216 may be any type of device or system capable of enabling communication with an external device and / or a network, and may include but is not limited to a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as a Bluetooth TM equipment, 802.11 equipment, WiFi equipment, WiMax equipment, cellular communication facilities, etc.).

[0074] The present disclosure may be implemented as any combination of an apparatus, a system, an integrated circuit, and a computer program on a non-transitory computer-readable medium. One or more processors may be implemented as an integrated circuit (IC), an application specific integrated circuit (ASIC), or a large scale integrated circuit (LSI), a system LSI, a super LSI, or a super LSI component that performs some or all of the functions described in the present disclosure.

[0075] The present disclosure includes the use of software, applications, computer programs, or algorithms. The software, applications, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to enable a computer such as one or more processors to perform the above steps and the steps described in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors may associate a set of instructions to execute the software or algorithm to provide various functions according to the embodiments described in the present disclosure.

[0076] Software and computer programs (which may also be referred to as programs, software applications, applications, components or code) include machine instructions for a programmable processor and may be implemented in a high-level procedural language, an object-oriented programming language, a functional programming language, a logic programming language, or an assembly language or a machine language. The term "computer-readable medium" refers to any computer program product, apparatus or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0077] For example, computer readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer readable program code in the form of instructions or data structures and can be accessed by a general or special purpose computer or a general or special purpose processor. As used herein, disk or disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically by laser. Combinations of the above are also included in the scope of computer readable media.

[0078] The subject matter of the present disclosure is provided as an example of devices, systems, methods, and programs for performing the features described in the present disclosure. However, in addition to the above-mentioned features, other features or variations may also be expected. It is expected that the implementation of the components and functions of the present disclosure may be accomplished with any emerging technology that may replace any of the above-mentioned implementation technologies.

[0079] In addition, the above description provides examples without limiting the scope, applicability or configuration set forth in the claims. Without departing from the spirit and scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various embodiments may appropriately omit, replace or add various processes or components. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0080] In addition, in the description of the present disclosure, the terms “first”, “second”, “third”, etc. are used for descriptive purposes only and cannot be understood as indicating or implying relative importance and order.

[0081] Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed to achieve desired results. In certain circumstances, multitasking and parallel processing can be advantageous.

Claims

1. A dynamic two-way authentication method based on trust, comprising: After the user terminal of the user has passed the one-way authentication of the platform, the user and one or more other users who have passed the one-way authentication of the user by the platform within the most recent second predetermined period are grouped into a user group, and a secondary authentication string is generated, wherein the secondary authentication string includes the trustworthiness of the user, the platform identity information of the platform, and the user group credential, wherein the trustworthiness indicates the trustworthiness of the user within the most recent first predetermined period, and the user group credential is generated based on the user identifications of at least two users in the user group; Sending the secondary authentication string to the user terminal; Upon receiving the authentication credential from the user terminal, verifying the authentication credential; as well as When it is determined that the authentication credential has passed the verification, it is determined that the two-way authentication between the platform and the user terminal has passed.

2. The method according to claim 1, wherein: The secondary authentication string also includes a resource code corresponding to the current resource request information from the user terminal.

3. The method according to claim 1, wherein: The confidence level of the user includes time information indicating a first time when the confidence level is generated.

4. The method according to claim 3, wherein: The secondary authentication string further includes a timestamp indicating a second time when the secondary authentication string is generated.

5. The method according to claim 4, wherein: After receiving the secondary authentication string, the user terminal compares the first time with the second time, and if it is determined that the first time is not before the second time, the secondary authentication of the platform is rejected.

6. The method according to claim 2, wherein: After receiving the secondary authentication string, the user terminal verifies the resource code in the secondary authentication string, and rejects the secondary authentication of the platform if it is determined that the resource code does not match the current resource request information of the user terminal.

7. The method according to claim 1, wherein: After receiving the secondary authentication string, the user terminal verifies the platform identity information in the secondary authentication string, and rejects the secondary authentication of the platform if it is determined that the platform is illegal.

8. The method according to claim 1, wherein: The authentication credentials include the user group credentials, and The step of verifying the authentication credential includes: It is determined whether the user group credential in the authentication credential is the same as the user group credential in the secondary authentication string, and only when the two are the same, it is determined that the authentication credential has passed the verification.

9. A dynamic two-way authentication device based on trust, comprising: a memory having instructions stored therein; as well as A processor configured to execute instructions stored on the memory to perform the method according to any one of claims 1 to 8.

10. A computer-readable storage medium comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 8.

Images