Authentication method and device, gateway device and computer readable storage medium

Abstract

This invention relates to the field of network security technology and discloses an authentication method, apparatus, gateway device, and computer-readable storage medium. The method, applied to a gateway device, includes: receiving a first authentication request sent by a client, the first authentication request being generated by the client based on an authentication interface containing encrypted data; sending the first authentication request to an authentication server to enable the authentication server to verify the first authentication request; after the authentication server verifies the first authentication request, receiving a second authentication request sent by the client, the second authentication request including the client's user information and the encrypted data; and verifying the client's user information and the encrypted data to determine that the client's authentication is successful when the verification of the client's user information and the encrypted data is successful. Applying the technical solution of this invention can improve the reliability of user authentication and ensure network security.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, specifically to an authentication method, apparatus, gateway device, and computer-readable storage medium. Background Technology

[0002] To prevent the leakage of user information and ensure the network security of enterprises, it is essential to authenticate the identity of users during their online activities.

[0003] Passive authentication, which utilizes authentication servers located in the cloud or other locations, is a widely used method due to its low equipment cost and simple deployment. However, because passive authentication sends user authentication information to the authentication server, it is vulnerable to forged authentication messages, leading to a large number of fake users logging in. This poses a significant security threat to device performance and network security. Summary of the Invention

[0004] In view of the above problems, embodiments of the present invention provide an authentication method, apparatus, gateway device, and computer-readable storage medium to solve the problem of rampant fake users caused by existing authentication methods.

[0005] According to one aspect of the present invention, an authentication method is provided, applied to a gateway device, the method comprising: receiving a first authentication request sent by a client, the first authentication request being generated by the client based on an authentication interface containing encrypted data, and the first authentication request containing the encrypted data; sending the first authentication request to an authentication server to enable the authentication server to verify the first authentication request; after the authentication server passes the verification of the first authentication request, receiving a second authentication request sent by the client, the second authentication request including the client's user information and the encrypted data; and verifying the client's user information and the encrypted data to determine that the client authentication is successful when the client's user information and the encrypted data pass the verification.

[0006] In an alternative approach, before receiving the first authentication request sent by the client, the method further includes: upon receiving the access request sent by the client, encrypting a random number using the Argon2id algorithm to generate the encrypted data; and sending an authentication interface containing the encrypted data to the client, so that the client generates the first authentication request based on the authentication interface.

[0007] In an optional embodiment, the method further includes: obtaining first verification information corresponding to the access request; comparing the first verification information with the blocking information in the blacklist; and determining that the client authentication is unsuccessful when it is determined that the first verification information is the same as the corresponding blocking information in the blacklist.

[0008] In an optional embodiment, the method further includes: sending the client's second verification information to a cloud server, so that the cloud server compares the second verification information with the blocking information in the database and generates a comparison result; receiving the comparison result sent by the cloud server, and determining that the client authentication is unsuccessful when the comparison result determines that the second verification information is the same as the corresponding blocking information in the database.

[0009] In an optional embodiment, the method further includes: upon receiving the access request, counting the cumulative frequency of the access request received by the gateway device within a preset time period; and determining that the client authentication is unsuccessful when the cumulative frequency is greater than a frequency threshold.

[0010] In an optional manner, after the authentication server verifies the first authentication request, the method further includes: receiving result information sent by the authentication server and sending the result information to the client, so that the client sends the second authentication request to the gateway device; wherein the result information includes information that the client has passed verification and the client's identity information.

[0011] In one optional manner, the encrypted data is generated and stored by the gateway device, and the verification of the client's user information and the encrypted data includes: parsing the client's user information and the encrypted data according to the second authentication request; determining that the client's user information verification is successful when the specifications of the client's user information meet the user information specifications; comparing the encrypted data with the encrypted data stored locally by the gateway device, and determining that the encrypted data verification is successful when it is determined that the encrypted data is the same as the encrypted data stored locally by the gateway device.

[0012] In an alternative approach, the method further includes: determining whether the format of the request message and / or the URL string of the second authentication request is compliant.

[0013] In an alternative approach, the method further includes: after determining whether the client authentication is successful or unsuccessful, clearing the encrypted data stored in the gateway device.

[0014] According to another aspect of the present invention, an authentication apparatus is provided, applied to a gateway device. The apparatus includes: a first receiving module, configured to receive a first authentication request sent by a client, the first authentication request being generated by the client based on an authentication interface containing encrypted data, and the first authentication request containing the encrypted data; a sending module, configured to send the first authentication request to an authentication server, so that the authentication server verifies the first authentication request; a second receiving module, configured to receive a second authentication request sent by the client after the authentication server has verified the first authentication request, the second authentication request including the client's user information and the encrypted data; and a determining module, configured to verify the client's user information and the encrypted data, so as to determine that the client's authentication is successful when the client's user information and the encrypted data have passed verification.

[0015] In one alternative approach, before receiving the first authentication request sent by the client, the first receiving module is further configured to encrypt a random number using the Argon2id algorithm to generate the encrypted data upon receiving the access request sent by the client; the sending module is further configured to send an authentication interface containing the encrypted data to the client, so that the client generates the first authentication request based on the authentication interface.

[0016] In an optional manner, the first receiving module is further configured to obtain first verification information corresponding to the access request, compare the first verification information with the blocking information in the blacklist; and determine that the client authentication is unsuccessful when it is determined that the first verification information is the same as the corresponding blocking information in the blacklist.

[0017] In an optional manner, the first receiving module is further configured to send the client's second verification information to the cloud server, so that the cloud server compares the second verification information with the blocking information in the database, generates a comparison result, receives the comparison result sent by the cloud server, and determines that the client authentication is unsuccessful when it is determined from the comparison result that the second verification information is the same as the corresponding blocking information in the database.

[0018] In an optional embodiment, the first receiving module is further configured to, upon receiving the access request, count the cumulative frequency of the access request received by the gateway device within a preset time period, and determine that the client authentication is unsuccessful when the cumulative frequency is greater than a frequency threshold.

[0019] In one optional manner, after the authentication server verifies the first authentication request, the second receiving module is further configured to receive result information sent by the authentication server and send the result information to the client, so that the client sends the second authentication request to the gateway device; wherein, the result information includes information that the client has passed the verification and the client's identity information.

[0020] In one optional approach, the encrypted data is generated and stored by the gateway device. The determining module is used to parse the client's user information and the encrypted data according to the second authentication request. When the specifications of the client's user information meet the user information specifications, the client's user information is determined to be verified. The encrypted data is compared with the encrypted data stored locally by the gateway device. When it is determined that the encrypted data is the same as the encrypted data stored locally by the gateway device, the encrypted data is determined to be verified.

[0021] In an alternative approach, the determining module is further configured to determine whether the format of the request message and / or the URL string of the second authentication request is compliant.

[0022] In an alternative approach, the determining module is further configured to clear the encrypted data stored in the gateway device after determining whether the client authentication is successful or unsuccessful.

[0023] According to another aspect of the present invention, a gateway device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform operations of the authentication method described in any one of the preceding embodiments by executing the executable instructions.

[0024] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing at least one executable instruction, which, when executed on a gateway device, causes the gateway device to perform the operation of any of the authentication methods described above.

[0025] According to the authentication method, apparatus, gateway device, and computer-readable storage medium proposed in embodiments of the present invention, the gateway device can receive a first authentication request sent by a client. The first authentication request is generated by the client based on an authentication interface containing encrypted data, and the first authentication request contains encrypted data. The client then sends the first authentication request to an authentication server for verification. After the authentication server verifies the first authentication request, the gateway device receives a second authentication request sent by the client and verifies the client's user information and encrypted data. If the client's user information and encrypted data are verified successfully, the client's authentication is considered successful. Because the authentication interface contains encrypted data, the request generated based on the authentication interface carries encrypted data, preventing the request from being cracked or tampered with, thus solving the security problems caused by user proliferation. Furthermore, this method does not require any additional hardware costs, is easy to configure, and has strong adaptability.

[0026] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0027] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0028] Figure 1 An interactive schematic diagram of an authentication method provided by the present invention is shown;

[0029] Figure 2 A flowchart of an authentication method provided by the present invention is shown;

[0030] Figure 3 A flowchart of the authentication interface provided by the present invention is shown;

[0031] Figure 4 A flowchart of a verification method for a gateway device provided by the present invention is shown;

[0032] Figure 5 A flowchart of another verification method for a gateway device provided by the present invention is shown;

[0033] Figure 6 A flowchart of another verification method for a gateway device provided by the present invention is shown;

[0034] Figure 7 The interactive flowchart of an authentication method provided by the present invention is shown;

[0035] Figure 8 An interactive schematic diagram of another authentication method provided by the present invention is shown;

[0036] Figure 9 A schematic diagram of the structure of an authentication device provided by the present invention is shown;

[0037] Figure 10 A schematic diagram of the structure of a gateway device provided by the present invention is shown. Detailed Implementation

[0038] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0039] The development of internet technology has enabled users to access various online services, such as accessing internal office automation (OA) systems, transferring money, connecting to hotel Wi-Fi, online visa applications, and using social media platforms, bringing great convenience to people's lives and work. At the same time, to ensure user security online, internet service providers often implement authentication processes when users use applications or websites. This requires users to complete authentication in a prescribed manner before using online services, such as entering a username and password, entering a verification code, or using facial recognition, to ensure the authenticity and legitimacy of users logging into the network.

[0040] In one related technical solution, the gateway device acts as a bridge and portal connecting the internal and external networks. It receives response messages or Uniform Resource Locator (URL) strings from the authentication server to obtain user information. After successful verification, traffic is allowed to pass, enabling users to access the network services provided by the manufacturer. While this method can verify user reliability, the interface between the gateway device and the authentication server is often public, making it easy for response messages or URL strings to be tampered with. This can lead to a large number of fake users coming online, impacting the device's processing performance and hindering legitimate users' access to services.

[0041] In view of the above problems, Figure 1 First, an interactive schematic diagram of an authentication method provided by an embodiment of the present invention is shown. For example... Figure 1As shown, users can access and use network services through client 110 to obtain relevant content. During authentication, users can send authentication requests to gateway device 120 through client 110. Gateway device 120 uses its own security mechanism to verify the authentication request. After successful verification, it forwards the authentication request to authentication server 130 to ensure user security.

[0042] The client 110 can be a mobile terminal, tablet computer, computer, laptop computer, vehicle terminal, or other smart device. The gateway device 120 is a computer system or device that provides data conversion services between the client 110 and the authentication server 130, and it is compatible with various external bandwidth network access methods. The authentication server 130 is a server provided by the network service provider, which can be used to process authentication requests sent by clients, as well as other business processing requests sent by clients. The authentication server 130 can be a cluster or multiple clusters, and can include one or more types of servers.

[0043] Users can initiate authentication requests to access network services provided by the manufacturer to the authentication server 130 through client 110. For example, users can enter their username, account, and password through the authentication interface displayed on client 110, or perform facial recognition. Client 110 can generate an authentication request based on the username, account, and password, or the result of facial recognition, and send it to the authentication server 130 through gateway device 120.

[0044] In an alternative approach, the user can use other smart devices to send an authentication request from client 110 to authentication server 130. For example, during authentication, the authentication interface displayed on client 110 can provide a QR code. The user can use other smart devices, such as an application on a smartphone, to scan the QR code, allowing client 110 to obtain the user information authorized by the application on the other smart device and send an authentication request to authentication server 130.

[0045] After successfully verifying the authentication request, authentication server 130 can return a successful verification result to gateway device 120, which then forwards it to client 110 to complete the verification process. Afterward, client 110 can use the services provided by authentication server 130 for a specified period.

[0046] In one alternative approach, client 110's authentication has an expiration period. After a period of time following successful authentication, such as 6 hours later, if the user still needs to access the network service, the authentication process can be re-initiated.

[0047] Figure 2The flowchart shown is an embodiment of an authentication method provided by the present invention. This method can be performed by, for example... Figure 1 The gateway device 120 shown is executed. For example... Figure 2 As shown, the method includes the following steps:

[0048] Step S210: Receive the first authentication request sent by the client.

[0049] The first authentication request is generated by the client based on the authentication interface containing encrypted data. The first authentication request contains encrypted data, meaning that the user can initiate the authentication operation through the authentication interface displayed on the client to send the first authentication request to the gateway device.

[0050] The authentication interface is the visual interface sent by the authentication server when a user initiates authentication through the client. The authentication interface includes encrypted data, which is used to characterize the security of the authentication interface and prevent the initial authentication request sent by the user through the authentication interface from being cracked or tampered with.

[0051] When a user sends the first authentication request through the authentication interface displayed on the client, the gateway device temporarily allows the traffic required for authentication, enabling the user to perform the authentication operation by manipulating the authentication interface. For example, the user can enter their username and password through the authentication interface displayed on the client, or they can use other smart devices to scan the QR code on the authentication interface to authorize personal information to the client.

[0052] After receiving the user's account and password, or other personal information authorized by other smart devices, the client can generate a first authentication request and send it to the gateway device.

[0053] Since the first authentication request is generated by the client based on the authentication interface containing encrypted data, the first authentication request generated during the authentication process through the authentication interface will carry encrypted data, thus preventing the first authentication request from being tampered with and avoiding the problem of user proliferation.

[0054] Encrypted data can be statically encrypted or dynamically encrypted. Dynamically encrypted data can prevent it from being cracked to a certain extent.

[0055] In one alternative approach, the gateway device can generate dynamically encrypted data using random numbers. That is, the gateway device can generate random numbers, encrypt these random numbers using an encryption algorithm, generate dynamically encrypted data, and embed this encrypted data into the authentication interface. When a user connects to the network and triggers an access request, the gateway device can redirect the user to send the authentication interface containing the encrypted data to the client, allowing the user to send an initial authentication request to the gateway device based on the authentication interface displayed on the client.

[0056] When generating encrypted data using encryption algorithms, the gateway device can employ any one or more encryption algorithms. For example, upon receiving an access request from a client, the gateway device can encrypt the generated random number using any of the algorithms shown in Table 1 below to generate encrypted data.

[0057] Table 1

[0058]

[0059] After generating encrypted data, the gateway device can send an authentication interface containing the encrypted data to the client, so that the client can generate a first authentication request based on the authentication interface.

[0060] The applicant of this invention discovered through research that encrypted data generated by different encryption algorithms exhibits varying cracking capabilities within the authentication interface. Specifically, symmetric encryption algorithms, such as 3DES and AES, can be decrypted into plaintext data using the key, making them easily cracked. While one-way hash algorithms and special hash algorithms are irreversible, they can be cracked using collision techniques, dictionary-based methods, or rainbow table-based methods, thus their cracking difficulty is not high. Pbkdf2, BCrypt, and SCrypt algorithms require the setting of appropriate parameters.

[0061] In comparison, the Argon2 algorithm is characterized by its difficulty to crack and ease of operation. This algorithm includes three sub-algorithms: Argon2i, Argon2d, and Argon2id. Argon2i and Argon2d are variations of the Argon cryptographic hash function. Argon2i is suitable for data-dependent memory access, offering both speed and high resistance to GPU attacks. Argon2d uses data-independent memory access; although slower, it prevents tradeoff attacks and is suitable for cryptographic encryption. Argon2id is a hybrid of Argon2i and Argon2d, combining data-dependent and data-independent memory access.

[0062] Therefore, to improve the reliability of encrypted data, the Argon2 algorithm can be used to encrypt random numbers, generating encrypted data. The authentication interface containing this encrypted data is then sent to the client. The Argon2id algorithm is fast and resistant to malicious attacks. Figure 3 The diagram illustrates a processing flowchart of an authentication interface provided by the present invention, as follows: Figure 3 As shown, the gateway device can perform the following methods:

[0063] Step S310: Upon receiving an access request from the client, the random number is encrypted using the Argon2id algorithm to generate encrypted data.

[0064] An access request refers to a request initiated by a client to access an external network. For example, when a user opens a browser or enters an application requiring authentication through a client, the client can generate an access request and send it to the gateway device. Furthermore, considering security, to reduce message size, the number of bits in the random number can be set to 8 bits, 16 bits, 24 bits, etc., thus achieving a balance between network security and data transmission efficiency and bandwidth usage.

[0065] Upon receiving an access request from a client, the gateway device can generate a random number and encrypt it using the Argon2id algorithm to obtain encrypted data. The encrypted data generated by the Argon2id algorithm combines the advantages of Argon2d and Argon2i, exhibiting characteristics such as difficulty in cracking, resistance to side-channel attacks and Graphics Processing Unit (GPU) attacks, and effective resistance to attacks based on x86 hardware.

[0066] In one alternative approach, the encrypted data can have an expiration date. After the encrypted data expires, the gateway device can generate new encrypted data.

[0067] Step S320: Send an authentication interface containing the above-mentioned encrypted data to the client so that the client can generate a first authentication request based on the authentication interface.

[0068] To facilitate user authentication, the gateway device can receive and intercept access requests, embed the generated encrypted data into the authentication interface, and send the authentication interface to the client via redirection. This encrypted data is not visible in the authentication interface displayed on the client, but is embedded as part of the interface data of the authentication interface. The first authentication request generated through the authentication interface will carry encrypted data, thus providing the ability to resist network attacks.

[0069] In this embodiment, in order to improve the reliability of user authentication, the gateway device can use its own security mechanism to verify the client. Figure 4 A flowchart of a verification method for a gateway device provided by the present invention is shown, as follows: Figure 4 As shown, the following steps may be included:

[0070] Step S410: Obtain the first verification information corresponding to the access request.

[0071] The first piece of information to be verified may include any one or more of the client's Internet Protocol Address (IP) address, port number, and Media Access Control (MAC) address. This first piece of information may be carried in the access request or obtained by the gateway device when it receives the access request sent by the client.

[0072] Step S420: Compare the first information to be verified with the blocking information in the blacklist.

[0073] A blacklist is a list of blocked clients that are restricted from accessing the external network, stored by the gateway device. This list may include the IP address, port number, and MAC address of the restricted client.

[0074] The gateway device compares the first information to be verified with the blocking information in the blacklist to determine whether the first information to be verified is the same as the corresponding blocking information in the blacklist, such as whether the IP address, port number and MAC address in the first information to be verified are the same as the IP address, port number and MAC address in the blacklist.

[0075] Step S430: If the first information to be verified is the same as the corresponding blocking information in the blacklist, the client authentication is determined to be unsuccessful.

[0076] For example, if the gateway device determines that any one or more items in the first piece of information to be verified are the same as the corresponding blocking information in the blacklist, it can determine that the client authentication is unsuccessful.

[0077] Using the above method, the blacklist stored in the gateway device can be used to perform security verification on the client's access request, thereby achieving proactive blocking based on the gateway device and ensuring the reliability and security of the accessing client.

[0078] Figure 5 A flowchart of another authentication method for a gateway device provided by the present invention is shown, such as... Figure 5 As shown, the following steps may be included:

[0079] Step S510: The client sends the second verification information to the cloud server so that the cloud server compares the second verification information with the blocking information in the database and generates a comparison result.

[0080] The second piece of information to be verified can be the same as or different from the first piece of information. For example, in addition to the client's IP address, port number, and MAC address, the second piece of information can also include request information from the client's historical access requests, such as request time, request frequency, and request format. The database is a blocking information repository for clients that restrict access to external networks, generated by the cloud server through self-learning. It can include the client's IP address, port number, MAC address, and the characteristics of illegal access request formats.

[0081] The gateway device sends the client's second verification information to the cloud server, enabling the cloud server to use the blocking information in the database to determine whether the second verification information is compliant. For example, the cloud server can search for comparison features in the second verification information in the blocking information in the database, such as IP address, port number, MAC address, and illegal access request format features, and determine whether the comparison features in the second verification information are the same as the corresponding blocking information in the database, generating a comparison result.

[0082] Step S520: Receive the comparison result sent by the cloud server. If, based on the comparison result, any one or more items in the second information to be verified are the same as the corresponding blocking information in the database, the client authentication is determined to be unsuccessful.

[0083] Upon receiving the comparison results from the cloud server, the gateway device can determine whether there are any comparison features in the second information to be verified that are the same as the blocking information in the database. If any one or more comparison features in the second information to be verified are the same as the corresponding blocking information in the database, then the client authentication is determined to be unsuccessful.

[0084] In the above method, the gateway device can use the cloud server's database to perform security verification on the client's access request. Since the cloud server has a fast processing speed and the database can be updated through self-learning, it can be configured as an integrated platform that includes multiple verification databases. Therefore, it can take advantage of the cloud server to further improve the verification accuracy of the client, effectively block unauthorized access, and achieve the purpose of passive defense.

[0085] In an alternative approach, the gateway device may also perform the following methods:

[0086] When an access request is received, the gateway device counts the cumulative frequency of access requests received within a preset time period. If the cumulative frequency exceeds a frequency threshold, the client authentication is deemed unsuccessful.

[0087] Both the preset time period and frequency threshold can be customized as needed, such as setting the preset time period to 30 seconds, 1 minute, etc., and the frequency threshold to 10 times, 30 times, 50 times, etc. When the gateway device receives an access request, it will count whether the cumulative frequency of the source address corresponding to the access request exceeds the limit within the preset time period, such as how many requests were sent per unit time. If the cumulative frequency exceeds the frequency threshold, the client authentication is deemed unsuccessful.

[0088] In this scenario, assuming the device can only handle 100 concurrent authentication requests per second, if a client sends 50 access requests per second, it can be considered a malicious access. The client's source address can be set as a blocked address, preventing it from sending authentication requests again for a period of time.

[0089] Using the methods described above, gateway devices can block frequent access from the same client, which not only solves the problem of user overload but also reduces the processing pressure on the system.

[0090] In an alternative approach, when the source address of the client is determined to be a blocked address, the blocked address can also be added to the blacklist of the aforementioned gateway device and / or the database of the cloud server to complete the update of the blacklist and / or database.

[0091] After the gateway device verifies the first information to be verified and the cloud server verifies the second information to be verified, the authentication process can prioritize the security mechanism of the gateway device itself. This achieves proactive blocking and passive defense based on the gateway device, fundamentally solving the problems of user proliferation and device performance degradation. Furthermore, the blocking function will block the message in the first step of message processing, maximizing the conservation of device performance and ensuring the normal use of device functions.

[0092] Step S220: Send a first authentication request to the authentication server so that the authentication server can verify the first authentication request.

[0093] When the gateway device receives the first authentication request and completes the verification of the first authentication request, it can forward the first authentication request to the authentication server, so that the authentication server can verify the first authentication request.

[0094] In one alternative approach, the first authentication request may include the client's user information. Therefore, in step S220, the authentication server can verify the first authentication request by verifying the user information within it.

[0095] For example, the authentication server can parse the client's user information from the first authentication request, such as username, account, password, user level and permissions, and determine whether this information meets the verification standards, such as whether the user account is a mobile phone number, whether the mobile phone number is 11 digits, and whether the user level and permissions match the user account, in order to determine whether the user information in the first authentication request has been verified.

[0096] In an alternative approach, the authentication server's verification of the first authentication request may further include verifying the request information of the first authentication request. The request information may include the client identifier of the first authentication request, the program identifier requested for access, or the page identifier.

[0097] Once the authentication server verifies the client's first authentication request, it indicates that the client is a legitimate user and can access the content provided by the network service.

[0098] Step S230: After the authentication server verifies the first authentication request, it receives the second authentication request sent by the client.

[0099] The second authentication request includes the client's user information and encrypted data. The client's user information may include username, account, client IP address, port number, etc.

[0100] The authentication server verifies the first authentication request to authorize the client to obtain network services, while the gateway device verifies the second authentication request to ensure the client's secure connection to the external network. The user information of the client included in the second authentication request may differ from the user information parsed by the authentication server from the first authentication request.

[0101] After the authentication server verifies the first authentication request, the gateway device can receive the second authentication request sent by the client. This second authentication request can be a request for accessing network services triggered by the user through the client after the authentication server has completed the client's authentication. For example, the user can click on an information link displayed on the client to send the second authentication request. In this case, in addition to the client's user information and encrypted data, the second authentication request can also include information about the network service content that the client requests to access.

[0102] It should be noted that when a user triggers a second authentication request to use network services through a client, this authentication process is invisible to the user; that is, the user is not aware of the security verification performed by the gateway device.

[0103] In an alternative approach, the second authentication request can also be a second authentication request sent by the client obtained by the gateway device through a callback address after the authentication server has completed the client's authentication. In this case, the second authentication request can only include the client's user information and encrypted data.

[0104] In step S230, in order to synchronize the authentication information completed by the authentication server to the client, in an optional manner, after the authentication server verifies the first authentication request, the gateway device can also receive the result information sent by the authentication server and send the result information to the client, so that the client can send a second authentication request to the gateway device.

[0105] The result information may include confirmation that the client has passed verification and the client's identity information. Identity information refers to the client's username, account name (such as mobile phone number, email address, and nickname), IP address, and other information that identifies the client.

[0106] After receiving the result information, the client can display prompts to remind the user to take the next step.

[0107] For example, if the authentication server fails to verify the first authentication request based on the result information, the prompt message can be used to prompt the user to perform the authentication operation again; if the authentication server succeeds in verifying the first authentication request, the prompt message can be used to prompt the user to perform the next operation, such as initiating a request to use network services.

[0108] In this way, the client can obtain the authentication result from the authentication server, allowing the user to choose to repeat the authentication or proceed to the next step based on the authentication result.

[0109] Step S240: Verify the client's user information and encrypted data. If the client's user information and encrypted data pass the verification, the client authentication is confirmed to be successful.

[0110] To ensure secure connection to external networks for clients, gateway devices can verify client user information and encrypted data. For example, a gateway device can read the user's name, account, password, and authentication information from the authentication server to determine if the user information is compliant.

[0111] Meanwhile, the gateway device can also verify encrypted data. For example, the gateway device can generate encrypted data using the same encryption method, compare the generated encrypted data with the encrypted data in the second authentication request sent by the client, and determine whether the two are consistent. If they are consistent, it means that the encrypted data verification is successful.

[0112] If both user information and encrypted data are verified successfully, the client authentication is complete. At this point, the client can log in and access external networks to obtain content provided by network services.

[0113] By using the methods described above, after the authentication server completes client authentication, the gateway device can verify the legitimacy of the client, thus improving the security and reliability of the client's access to the external network.

[0114] In one alternative approach, encrypted data can be generated and stored by the gateway device, thereby... Figure 6 A flowchart of another verification method for a gateway device provided by the present invention is shown, as follows: Figure 6 As shown, the verification of the client's user information and encrypted data in step S240 can be achieved through the following methods:

[0115] Step S610: Parse the client's user information and encrypted data according to the second authentication request.

[0116] The client's user information may include the username, IP address, and authentication server completion information.

[0117] Step S620: If the specifications of the user information on the client side meet the user information specifications, then the user information verification on the client side is confirmed to be successful.

[0118] The user information specification refers to the format of the user information, which may include the length of the username, the number of digits in the mobile phone number, and the account format. For example, the gateway device can obtain the corresponding user information based on the format of the fields, such as the username and mobile phone number, to verify whether the format meets the requirements. Only when the format is correct can the user information be successfully extracted. If the extraction is successful, it means that the client's user information verification has passed.

[0119] Step S630: Compare the encrypted data with the encrypted data stored locally on the gateway device. If the encrypted data is found to be the same as the encrypted data stored locally on the gateway device, the encrypted data verification is confirmed to be successful.

[0120] Since the encrypted data is generated by the gateway device, the gateway device can store the encrypted data at the same time. When a second authentication request is received, the gateway device can determine whether the encrypted data has been cracked by comparing the received encrypted data with the locally stored encrypted data, thereby determining the security of the authentication.

[0121] In an alternative approach, the gateway device may also determine whether the format of the request message and / or URL string of the second authentication request is compliant. The client's authentication will only succeed if the format of the request message and / or URL string of the second authentication request is compliant.

[0122] To ensure the processing performance of the gateway device, in one optional approach, the gateway device can also clear the encrypted data stored in the gateway device after determining whether the client authentication is successful or unsuccessful. Alternatively, the gateway device can also clear expired encrypted data.

[0123] By clearing the encrypted data stored in the gateway device, the encrypted data is automatically recycled, preventing the unlimited expansion of the encrypted data volume. Therefore, it does not affect the memory of the gateway device and can guarantee the processing performance of the gateway device.

[0124] Figure 7 The following is an interactive flowchart of another authentication method provided by an embodiment of the present invention, as shown in the figure. Figure 7 As shown, the method includes the following steps:

[0125] Step 701: Client 110 sends an access request to gateway device 120.

[0126] In this context, an access request refers to a request initiated by client 110 to access an external network. For example, when a user opens a browser or enters an application requiring authentication through client 110, client 110 can generate an access request and send it to gateway device 120.

[0127] Figure 8 An interactive schematic diagram of another authentication method provided by an embodiment of the present invention is shown. For example... Figure 8 As shown, data transmission between client 110 and gateway device 120 is conducted through a router, meaning that client 110 can send access requests to gateway device 120 through the router.

[0128] Step 702: The gateway device 120 encrypts the random number using the Argon2id algorithm to generate encrypted data, and embeds the encrypted data into the authentication interface.

[0129] When the gateway device 120 receives an access request sent by the client 110, the gateway device 120 can generate a random number, encrypt the random number using the Argon2id algorithm to obtain encrypted data, and embed the encrypted data into the authentication interface.

[0130] Step 703: Gateway device 120 sends the authentication interface containing encrypted data to client 110.

[0131] For example, gateway device 120 can be accessed via, for example... Figure 8 The router shown sends the authentication interface to client 110.

[0132] Step 704: Gateway device 120 obtains the first verification information from client 110 and verifies the first verification information.

[0133] The first piece of information to be verified may include the client's IP address, port number, and MAC address.

[0134] While the gateway device 120 receives the access request sent by the client 110, the gateway device 120 can obtain the first verification information of the client 110 and verify the first verification information using its own security mechanism.

[0135] If the verification passes, proceed to step S705 for the next verification step. If the verification fails, the client's 110 authentication is deemed unsuccessful, and the process ends.

[0136] In step S705, the gateway device 120 sends the second verification information of the client 110 to the cloud server 140.

[0137] The second piece of information to be verified may include the client 110's IP address, port number, and MAC address, as well as the client 110's historical access request information, such as request time, request frequency, and request format.

[0138] In one alternative approach, such as Figure 8 As shown, the cloud server 140 can obtain the second verification information through a wired or wireless connection with the gateway device 120.

[0139] In step S706, the cloud server 140 verifies the second information to be verified.

[0140] In one alternative approach, such as Figure 8 As shown, the cloud server 140 may include multiple servers or server groups, each of which can be used to verify different information content. For example, one server can be used to verify whether the user information of client 110 is valid, while another server can be used to verify the information format of client 110.

[0141] Specifically, when verifying the second piece of information to be verified, the cloud server 140 can use a database to determine whether the second piece of information to be verified is compliant. This database may include blocking information such as IP addresses and MAC addresses. For example, the cloud server 140 can search for matching features in the second piece of information to be verified, such as IP address, port number, and MAC address, within the blocking information in the database. Based on whether there is corresponding blocking information in the database that matches the matching features in the second piece of information to be verified, a verification result is generated.

[0142] In step S707, the cloud server 140 sends the verification result to the client 110 through the gateway device 120.

[0143] If the gateway device 120 determines, based on the comparison results, that the corresponding blocking information in the database of the cloud server 140 is identical to the comparison features in the second information to be verified, then the client 110's authentication is deemed to have failed and the process ends; otherwise, the authentication process continues.

[0144] In step S708, client 110 sends a first authentication request to gateway device 120.

[0145] The first authentication request is generated by client 110 based on an authentication interface containing encrypted data, and is used to enable authentication server 130 to perform user security verification. The first authentication request may include user information of client 110, such as username, account and password, user level and permissions, etc.

[0146] In step S709, the gateway device 120 sends the first authentication request to the authentication server 130.

[0147] like Figure 8 As shown, the gateway device 120 and the authentication server 130 can be connected through the service system of an Internet service provider. Therefore, when sending the first authentication request, the gateway device 120 can do so through, for example... Figure 8 The service system of the Internet service provider shown in the figure, such as the request receiving server receiving the first authentication request and sending it to the authentication server 130.

[0148] In step S710, the authentication server 130 verifies the first authentication request.

[0149] The authentication server 130 verifies the first authentication request as an authorization for the client 110 to obtain network services. For example, the authentication server 130 can determine whether the user information in the first authentication request, such as username, account, password, user level, and permissions, meets the verification standards. If it does, the first authentication request passes verification; otherwise, it fails verification.

[0150] Step S711: After the authentication server 130 verifies the first authentication request, the result information is sent to the client 110 through the gateway device 120.

[0151] When the gateway device 120 determines that the first authentication request has been successfully verified based on the result information, it can synchronize the result information to the client 110 so that the client can execute the next authentication process. Conversely, it can send back the information that the verification failed to the client 110 so that the client can re-initiate the authentication.

[0152] In step S712, client 110 sends a second authentication request to gateway device 120.

[0153] The gateway device 120's verification of the second authentication request is a security verification of the client 110's connection to the external network. The second authentication request may include the client 110's user information and encrypted data.

[0154] In step S713, the gateway device 120 verifies the user information and encrypted data in the second authentication request.

[0155] Gateway device 120 can verify the user information and encrypted data of client 110. For example, gateway device 120 can read the user name, account, password, etc., based on the user information to determine whether the user information is compliant. It can also compare the encrypted data with the encrypted data stored locally by gateway device 120. If the encrypted data is found to be the same as the encrypted data stored locally by gateway device 120, the encrypted data verification is deemed successful.

[0156] In step S714, when the gateway device 120 passes the verification, it determines that the client 110 has successfully authenticated.

[0157] If both user information and encrypted data are successfully verified, it indicates that client 110 has successfully authenticated. At this point, client 110 can log in and access external networks to obtain network services provided by internet service providers.

[0158] If both user information and encrypted data fail to be verified, client 110 will fail to authenticate. In this case, gateway device 120 can send a prompt message to client 110 to re-authenticate, so that the user can perform the authentication operation again according to the prompt message.

[0159] In summary, according to the authentication method in this embodiment, the gateway device receives a first authentication request sent by the client. This first authentication request is generated by the client based on an authentication interface containing encrypted data, and the client then sends the first authentication request to the authentication server for verification. After the authentication server verifies the first authentication request, the gateway device receives a second authentication request sent by the client and verifies the client's user information and encrypted data. If both the user information and encrypted data are verified successfully, the client's authentication is considered successful. Because the authentication interface contains encrypted data, the request generated based on the authentication interface carries encrypted data, preventing the request from being cracked or tampered with, thus solving the security problems caused by user proliferation. Furthermore, this method does not require any additional hardware costs, is easy to configure, and has strong adaptability.

[0160] Figure 9 This diagram illustrates the structure of an authentication device according to an embodiment of the present invention, which can be applied to... Figure 1 The gateway device 120 is shown. (Example) Figure 9 As shown, the authentication device 900 may include: a first receiving module 910, a sending module 920, a second receiving module 930, and a determining module 940. The first receiving module 910 is used to receive a first authentication request sent by a client, the first authentication request being generated by the client based on an authentication interface containing encrypted data, and the first authentication request containing encrypted data. The sending module 920 is used to send the first authentication request to an authentication server, so that the authentication server verifies the first authentication request. The second receiving module 930 is used to receive a second authentication request sent by the client after the authentication server has verified the first authentication request, the second authentication request including the client's user information and encrypted data. The determining module 940 is used to verify the client's user information and encrypted data, so that if the client's user information and encrypted data are verified successfully, the client's authentication is determined to be successful.

[0161] In an alternative approach, before receiving the first authentication request sent by the client, the first receiving module 910 may also be used to encrypt the random number using the Argon2id algorithm to generate encrypted data upon receiving the access request sent by the client; the sending module 920 may also be used to send an authentication interface containing the encrypted data to the client, so that the client generates the first authentication request based on the authentication interface.

[0162] In an alternative approach, the first receiving module 910 can also be used to obtain the first verification information corresponding to the access request, compare the first verification information with the blocking information in the blacklist, and determine that the client authentication is unsuccessful when it is determined that the first verification information is the same as the corresponding blocking information in the blacklist.

[0163] In an alternative approach, the first receiving module 910 can also be used to send the client's second verification information to the cloud server, so that the cloud server compares the second verification information with the blocking information in the database, generates a comparison result, receives the comparison result sent by the cloud server, and determines that the client authentication is unsuccessful when it is determined that the second verification information is the same as the corresponding blocking information in the database based on the comparison result.

[0164] In an alternative approach, the first receiving module 910 can also be used to count the cumulative frequency of access requests received by the gateway device within a preset time period when an access request is received, and determine that the client authentication is unsuccessful when the cumulative frequency is greater than the frequency threshold.

[0165] In one alternative approach, after the authentication server verifies the first authentication request, the second receiving module 930 can also be used to receive the result information sent by the authentication server and send the result information to the client, so that the client can send a second authentication request to the gateway device; wherein, the result information includes information that the client has passed the verification and the client's identity information.

[0166] In one alternative approach, the encrypted data is generated and stored by the gateway device. The determination module 940 can be used to parse the client's user information and encrypted data according to the second authentication request. When the specifications of the client's user information meet the user information specifications, the client's user information is determined to be verified. The encrypted data is compared with the encrypted data stored locally by the gateway device. When the encrypted data is determined to be the same as the encrypted data stored locally by the gateway device, the encrypted data is determined to be verified.

[0167] In an alternative approach, the determining module 940 may also be used to determine whether the format of the request message and / or URL string of the second authentication request is compliant.

[0168] In an alternative approach, the determination module 940 can also be used to clear the encrypted data stored in the gateway device after determining whether the client authentication is successful or unsuccessful.

[0169] The specific details of each module in the above-mentioned device have been described in detail in the method section of the implementation plan. For details of the undisclosed scheme, please refer to the implementation plan of the method section, and therefore will not be repeated here.

[0170] Figure 10 The diagram shows a schematic of a gateway device according to an embodiment of the present invention. The specific implementation of the gateway device is not limited by the specific embodiments of the present invention.

[0171] like Figure 10As shown, the gateway device may include: a processor 1002, a communications interface 1004, a memory 1006, and a communications bus 1008.

[0172] The processor 1002, communication interface 1004, and memory 1006 communicate with each other via communication bus 1008. Communication interface 1004 is used to communicate with other network elements such as clients or other servers. The processor 1002 executes program 1010, specifically performing the relevant steps described above in the authentication method embodiment.

[0173] Specifically, program 1010 may include program code, which includes computer-executable instructions.

[0174] The processor 1002 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The gateway device may include one or more processors of the same type, such as one or more CPUs; or it may include processors of different types, such as one or more CPUs and one or more ASICs.

[0175] Memory 1006 is used to store program 1010. Memory 1006 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0176] Specifically, program 1010 can be called by processor 1002 to cause the gateway device to perform the relevant steps described above in the authentication method embodiment.

[0177] This invention provides a computer-readable storage medium storing at least one executable instruction that, when executed on a gateway device / authentication device, causes the gateway device / authentication device to perform the authentication method in any of the above method embodiments.

[0178] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Furthermore, the embodiments of this invention are not directed to any particular programming language.

[0179] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. Similarly, for the sake of brevity and to aid in understanding one or more aspects of the invention, in the description of exemplary embodiments of the invention above, various features of the embodiments are sometimes grouped together in a single embodiment, figure, or description thereof. The claims, which follow the detailed description, are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of the invention.

[0180] Those skilled in the art will understand that the modules in the device of the embodiment can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiment can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components, except that at least some of such features and / or processes or units are mutually exclusive.

[0181] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. An authentication method, characterized in that, Applied to a gateway device, the method includes: Upon receiving an access request from a client, the random number is encrypted using the Argon2id algorithm to generate encrypted data and then stored. Obtain the first verification information corresponding to the access request; Compare the first piece of information to be verified with the blocked information in the blacklist; If it is determined that the first information to be verified is the same as the corresponding blocking information in the blacklist, it is determined that the client authentication is unsuccessful. After the first verification information is verified, the client sends the second verification information to the cloud server so that the cloud server compares the second verification information with the blocking information in the database and generates a comparison result. The system receives the comparison result sent by the cloud server. If the comparison result determines that the second information to be verified is the same as the corresponding blocking information in the database, the system determines that the client authentication is unsuccessful. After the second information to be verified is verified, an authentication interface containing the encrypted data is sent to the client, so that the client generates a first authentication request based on the authentication interface. The first authentication request contains the encrypted data and the client's first user information. Receive the first authentication request sent by the client; Send the first authentication request to the authentication server so that the authentication server verifies the first authentication request; After the authentication server verifies the first authentication request, it receives a second authentication request sent by the client. The second authentication request includes the client's second user information and the encrypted data, wherein the first user information is different from the second user information. Parse the second authentication request to obtain the client's second user information and the encrypted data; When the specifications of the second user information of the client conform to the user information specifications, it is determined that the verification of the second user information of the client is successful; The encrypted data is compared with the encrypted data stored locally on the gateway device. If the encrypted data is found to be the same as the encrypted data stored locally on the gateway device, the encrypted data is determined to have passed verification. When the client's second user information and the encrypted data are verified, the client authentication is determined to be successful.

2. The authentication method according to claim 1, characterized in that, The method further includes: Upon receiving the access request, the cumulative frequency of the access request received by the gateway device within a preset time period is counted; When the cumulative frequency exceeds the frequency threshold, the client authentication is determined to be unsuccessful.

3. The authentication method according to claim 1, characterized in that, After the authentication server verifies the first authentication request, the method further includes: The system receives the result information sent by the authentication server and sends the result information to the client, so that the client sends the second authentication request to the gateway device. The result information includes the client's verification information and the client's identity information.

4. The authentication method according to claim 1, characterized in that, The method further includes: Determine whether the format of the request message and / or the URL string of the second authentication request is compliant.

5. The authentication method according to claim 4, characterized in that, The method further includes: After determining whether the client authentication is successful or unsuccessful, the encrypted data stored in the gateway device is cleared.

6. An authentication device, characterized in that, Applied to a gateway device, the device includes: The first receiving module is configured to: upon receiving an access request from a client, encrypt a random number using the Argon2id algorithm to generate encrypted data and store it; obtain first verification information corresponding to the access request; compare the first verification information with blocking information in a blacklist; determine that the client authentication is unsuccessful if the first verification information matches the corresponding blocking information in the blacklist; after the first verification information passes verification, send the client's second verification information to the cloud server, so that the cloud server compares the second verification information with blocking information in the database and generates a comparison result; receive the comparison result sent by the cloud server, and determine that the client authentication is unsuccessful if the second verification information matches the corresponding blocking information in the database according to the comparison result; after the second verification information passes verification, send an authentication interface containing the encrypted data to the client, so that the client generates a first authentication request based on the authentication interface, the first authentication request containing the encrypted data and the client's first user information; and receive the first authentication request sent by the client. The sending module is used to send the first authentication request to the authentication server so that the authentication server can verify the first authentication request; The second receiving module is configured to receive a second authentication request sent by the client after the authentication server verifies the first authentication request. The second authentication request includes the client's second user information and the encrypted data, wherein the first user information is different from the second user information. The determination module is used to parse the second authentication request to obtain the client's second user information and the encrypted data; when the specifications of the client's second user information meet the user information specifications, it determines that the client's second user information has been verified; it compares the encrypted data with the encrypted data stored locally on the gateway device, and when it is determined that the encrypted data is the same as the encrypted data stored locally on the gateway device, it determines that the encrypted data has been verified; when the client's second user information and the encrypted data have been verified, it determines that the client authentication is successful.

7. A gateway device, characterized in that, include: processor; Memory for storing the executable instructions of the processor; The processor is configured to perform the authentication method as described in any one of claims 1 to 5 by executing the executable instructions.

8. A computer-readable storage medium, characterized in that, The storage medium stores at least one executable instruction, which, when executed on the gateway device, causes the gateway device to perform the operation of the authentication method as described in any one of claims 1 to 5.

Images