A method and system for terminal device access

Abstract

The application discloses a kind of method and system for terminal equipment access, belong to system security technical field.The method of the present application, including: the device information and login account are stored;According to the user information of the target terminal equipment user, the device account is issued to the target terminal equipment user, and the device account user accesses target terminal equipment's enhanced authentication;Real-time device information of the target terminal equipment is acquired in real time, and secret key is generated based on the real-time device information, and the secret key is issued to the target terminal equipment user, and the secret key is used for the initial authentication of access target terminal system;Allow the target terminal equipment user to access the target terminal equipment.The present application can be flexibly set for terminal equipment access authority, distinguish main high-risk control equipment and low-risk control equipment, and device security check is controllable.

Description

Technical Field

[0001] This invention relates to the field of system security technology, and more specifically, to a method and system for accessing terminal devices. Background Technology

[0002] With the widespread adoption of technologies such as artificial intelligence, big data, blockchain, and biometric authentication (face, fingerprint, iris, etc.), more and more terminal devices are being applied and popularized. These devices are being endowed with new intelligent services and combined business functionalities, providing unified online and offline, front-end and back-end services for more convenient service scenarios, laying the foundation for building an intelligent service ecosystem that offers 24 / 7, all-encompassing, and specialized services. However, with the promotion and application of terminal devices, their security and reliability urgently need to be improved.

[0003] The following is an introduction to the existing patents:

[0004] Invention 1:

[0005] A device login management method, apparatus, and storage medium are disclosed, applied to a server. The method includes: acquiring target login information of a user device; when the target login information is successfully verified, acquiring the target device type of the user device; when the target device type is a preset device type, acquiring a first number of logged-in devices and a target maximum number of logged-in devices; and when the first number of devices is less than or equal to the target maximum number of logged-in devices, allowing the user device to log in. The embodiments of this application can improve the intelligence of the login function.

[0006] Invention 2:

[0007] A device login method, apparatus, electronic device, system, and storage medium are disclosed. The device login method includes: sending a login request to a target device; receiving an encrypted string returned by the target device, wherein the encrypted string is obtained by the target device encrypting a first string using the public key of a management device stored in a passwordless service configuration table, the public key being written into the passwordless service configuration table by the target device after authenticating the management device using a digital certificate provided by the management device; decrypting the encrypted string using a private key to obtain a second string, and sending the second string to the target device; and receiving a login result returned by the target device, the login result being obtained by the target device comparing the first string and the second string. Embodiments of this invention can improve communication security.

[0008] Invention 1 describes a device login management method, which mainly verifies the control of multi-terminal login. Invention 1 describes a device login management method that improves the security of device access by using configuration to manage encrypted strings and perform encryption and decryption. The two inventions above are limited to (1) controlling a single factor, Invention 1 verifies multiple terminals, Invention 2 verifies login string comparison, and this invention verifies the terminal device's own information and access permissions, and supports enhanced authentication; (2) Inventions 1 and 2 verify the authentication process, while this invention collects and sets the terminal device's identity before the terminal device accesses the device, collects device information in real time when the terminal device initiates the access, verifies access permissions in real time during device authentication, and supports multi-factor authentication and additional authentication.

[0009] To enhance user convenience, more intelligent self-service devices are being deployed in unattended locations or automated service halls, providing 24 / 7 service and offering features such as self-service, all-day service, fast service, convenient service, and localized service. Therefore, the rapid promotion and use of these devices necessitates higher requirements for their security and reliability. Summary of the Invention

[0010] To address the above problems, this invention proposes a method for terminal device access, comprising:

[0011] Log in to the target terminal device, determine the device information of the target terminal device, and set the access permissions of the target terminal system to generate the permission information for the user of the target terminal device to access the target terminal device, and generate a device login account based on the permission information, and store the device information and login account;

[0012] Based on the user information of the target terminal device user, the device account is sent to the target terminal device user, and the device account user accesses the target terminal device with enhanced authentication;

[0013] The system acquires real-time device information of the target terminal device, generates a key based on the real-time device information, and distributes the key to the user of the target terminal device. The key is used for initial authentication to access the target terminal system.

[0014] When the target terminal device user initially accesses the target terminal device using a key, the key is transmitted to the target terminal device using a preset transmission protocol. The device information of the target terminal device is obtained through the key and compared with real-time device information. If the comparison result is consistent, the initial authentication is successful, and the target terminal device user is allowed to initially access the target terminal device. After the target terminal device user initially accesses the target terminal device and provides a device account, enhanced authentication is performed on the device account. If the enhanced authentication is successful, the target terminal device user is allowed to access the target terminal device.

[0015] Optionally, the device information includes at least one of the following: hardware information, software information, and IP information of the target terminal device.

[0016] Optionally, access permissions include at least one of the following: authentication level, authentication time, and authentication factor;

[0017] The authentication factors include at least one of the following: account password, SMS verification code, CA certificate, hardware key, and biometric information.

[0018] Optionally, the method also includes: updating the access permissions of the target terminal system in real time according to changes in the target terminal device user, so as to update the device account.

[0019] Furthermore, the present invention also provides a system for terminal device access, comprising:

[0020] An initial unit is used to log in to a target terminal device, determine the device information of the target terminal device, and set the access permissions of the target terminal system to generate permission information for the target terminal device user to access the target terminal device, and generate a device login account based on the permission information, and store the device information and login account;

[0021] The first transmission unit sends the device account to the target terminal device user based on the user information of the target terminal device user, and the device account user accesses the target terminal device with enhanced authentication.

[0022] The second transmission unit acquires real-time device information of the target terminal device in real time, generates a key based on the real-time device information, and sends the key to the user of the target terminal device. The key is used for initial authentication to access the target terminal system.

[0023] The access unit is configured to transmit the key to the target terminal device using a preset transmission protocol when the target terminal device user initially accesses the target terminal device using the key, obtain the device information of the target terminal device through the key, and compare the device information with real-time device information. If the comparison result is consistent, the initial authentication is successful, and the target terminal device user is allowed to initially access the target terminal device. After the target terminal device user initially accesses the target terminal device and provides a device account, the unit performs enhanced authentication on the device account. If the enhanced authentication is successful, the target terminal device user is allowed to access the target terminal device.

[0024] Optionally, the device information includes at least one of the following: hardware information, software information, and IP information of the target terminal device.

[0025] Optionally, access permissions include at least one of the following: authentication level, authentication time, and authentication factor;

[0026] The authentication factors include at least one of the following: account password, SMS verification code, CA certificate, hardware key, and biometric information.

[0027] Optionally, the initial unit is also used to: update the access permissions of the target terminal system in real time according to changes in the target terminal device user, so as to update the device account.

[0028] In another aspect, the present invention also provides a computing device, comprising: one or more processors;

[0029] A processor is used to execute one or more programs;

[0030] When the one or more programs are executed by the one or more processors, the method described above is implemented.

[0031] In another aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method described above.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] This invention provides a method for accessing a terminal device, comprising: logging into a target terminal device, determining the device information of the target terminal device, and setting access permissions for the target terminal system to generate access permission information for the target terminal device user, and generating a device login account based on the access permission information, and storing the device information and the login account; issuing the device account to the target terminal device user based on the user information of the target terminal device user, and enhancing authentication for the device account user to access the target terminal device; acquiring real-time device information of the target terminal device in real time, generating a key based on the real-time device information, and issuing the key. For the target terminal device user, the key is used for initial authentication to access the target terminal system. When the target terminal device user initially accesses the target terminal device using the key, the key is transmitted to the target terminal device using a preset transmission protocol. The device information of the target terminal device is obtained through the key, and the device information is compared with real-time device information. If the comparison result is consistent, the initial authentication is successful, and the target terminal device user is allowed to initially access the target terminal device. After the target terminal device user initially accesses the target terminal device and provides a device account, enhanced authentication is performed on the device account. If the enhanced authentication is successful, the target terminal device user is allowed to access the target terminal device.

[0034] The present invention has the following advantages:

[0035] Access to terminal devices is more secure and reliable. Device information is obtained in real time and a key is generated and verified with the access time to ensure that the current accessing device is a legitimate terminal device and to prevent unauthorized access to services by uncontrolled devices.

[0036] The system allows for flexible access control settings for terminal devices, distinguishing between high-risk and low-risk devices, and ensuring controllable device security verification. Attached Figure Description

[0037] Figure 1 This is a flowchart of a method for accessing terminal devices according to the present invention;

[0038] Figure 2 This is a structural diagram of a system for terminal device access according to the present invention. Detailed Implementation

[0039] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0040] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0041] Example 1:

[0042] This invention provides a method for terminal device access, such as... Figure 1 As shown, it includes:

[0043] Step 1: Log in to the target terminal device, determine the device information of the target terminal device, and set the access permissions of the target terminal system to generate the permission information for the target terminal device user to access the target terminal device, and generate a device login account based on the permission information, and store the device information and login account;

[0044] Step 2: Based on the user information of the target terminal device user, the device account is sent to the target terminal device user, and the device account user accesses the enhanced authentication of the target terminal device;

[0045] Step 3: Obtain the real-time device information of the target terminal device, generate a key based on the real-time device information, and send the key to the user of the target terminal device. The key is used for initial authentication to access the target terminal system.

[0046] Step 4: When the target terminal device user initially accesses the target terminal device using the key, the key is transmitted to the target terminal device using a preset transmission protocol. The device information of the target terminal device is obtained through the key, and the device information is compared with the real-time device information. If the comparison result is consistent, the initial authentication is successful, and the target terminal device user is allowed to initially access the target terminal device. After the target terminal device user initially accesses the target terminal device and provides a device account, enhanced authentication is performed on the device account. If the enhanced authentication is successful, the target terminal device user is allowed to access the target terminal device.

[0047] The device information includes at least one of the following: hardware information, software information, and IP information of the target terminal device.

[0048] Access permissions include at least one of the following: authentication level, authentication time, and authentication factor;

[0049] The authentication factors include at least one of the following: account password, SMS verification code, CA certificate, hardware key, and biometric information.

[0050] The method also includes: updating the access permissions of the target terminal system in real time according to changes in the target terminal device user, so as to update the device account.

[0051] The present invention will be further described below with reference to embodiments:

[0052] This invention improves the security and reliability of terminal device access by acquiring terminal device information (hardware information, software information, IP address, etc.) in real time and generating a key, transmitting it through an access protocol, verifying it against the set device information, and performing enhanced authentication based on access permissions (authentication level, authentication time, authentication factors (account password, SMS verification code, CA certificate, hardware key, biometrics, etc.)).

[0053] Set up terminal device access information: Enter terminal device information (hardware information, software information, IP address, etc.) and set access permission information (authentication level, authentication time, authentication factors (account password, SMS verification code, CA certificate, hardware key, biometric identification, etc.)) to generate device account.

[0054] Obtain terminal device access information: When a terminal device has a device information collection applet installed, it can obtain the device's current hardware and software information in real time when the device accesses the service system, generate a key, and transmit it to the backend server through the access protocol.

[0055] Dynamic access control: The system compares the terminal device information set with the device information obtained in real time and controls access based on the set access permissions. If the access permissions are insufficient, the system prompts the user to improve authentication (SMS verification code, CA certificate, hardware key, biometrics, etc.) to log in.

[0056] When the target terminal device user initially accesses the target terminal device using a key, the key is transmitted to the target terminal device using a preset transmission protocol. The device information of the target terminal device is obtained through the key and compared with real-time device information. If the comparison result is consistent, the initial authentication is successful, and the target terminal device user is allowed to initially access the target terminal device. After the target terminal device user initially accesses the target terminal device and provides a device account, enhanced authentication is performed on the device account. If the enhanced authentication is successful, the target terminal device user is allowed to access the target terminal device.

[0057] This invention sets different access information for different devices, and sets device information and access permission information separately, so as to achieve differentiated management of key devices, visitor devices, etc. with different permissions and risk control.

[0058] This invention acquires terminal device information in real time and generates real-time keys, increasing the dynamic security and controllability of the device.

[0059] This invention provides dynamic access control based on access permission information (authentication level, authentication time, authentication factors (account password, SMS verification code, CA certificate, hardware key, biometric identification, etc.). For non-normal access, it adds authentication methods for login, which is convenient for administrators to use in special circumstances.

[0060] Example 2:

[0061] The present invention also provides a system 200 for terminal device access, such as... Figure 2 As shown, it includes:

[0062] The initial unit 201 is used to log in to the target terminal device, determine the device information of the target terminal device, and set the access permissions of the target terminal system to generate the permission information for the target terminal device user to access the target terminal device, and generate a device login account according to the permission information, and store the device information and login account;

[0063] The first transmission unit 202 sends the device account to the target terminal device user based on the user information of the target terminal device user, and the device account user accesses the target terminal device with enhanced authentication.

[0064] The second transmission unit 203 acquires the real-time device information of the target terminal device in real time, generates a key based on the real-time device information, and sends the key to the user of the target terminal device. The key is used for initial authentication to access the target terminal system.

[0065] Access unit 204 is configured to transmit the key to the target terminal device using a preset transmission protocol when the target terminal device user initially accesses the target terminal device using the key, obtain the device information of the target terminal device through the key, and compare the device information with real-time device information. If the comparison result is consistent, the initial authentication is passed, and the target terminal device user is allowed to initially access the target terminal device. After the target terminal device user initially accesses the target terminal device and provides a device account, enhanced authentication is performed on the device account. If the enhanced authentication is passed, the target terminal device user is allowed to access the target terminal device.

[0066] The device information includes at least one of the following: hardware information, software information, and IP information of the target terminal device.

[0067] Access permissions include at least one of the following: authentication level, authentication time, and authentication factor;

[0068] The authentication factors include at least one of the following: account password, SMS verification code, CA certificate, hardware key, and biometric information.

[0069] The initial unit is also used to: update the access permissions of the target terminal system in real time according to changes in the target terminal device user, so as to update the device account.

[0070] The present invention has the following advantages:

[0071] Access to terminal devices is more secure and reliable. Device information is obtained in real time and a key is generated and verified with the access time to ensure that the current accessing device is a legitimate terminal device and to prevent unauthorized access to services by uncontrolled devices.

[0072] The system allows for flexible access control settings for terminal devices, distinguishing between high-risk and low-risk devices, and ensuring controllable device security verification.

[0073] Example 3:

[0074] Based on the same inventive concept, this invention also provides a computer device, which includes a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to implement corresponding method flows or corresponding functions, thereby implementing the steps of the methods in the above embodiments.

[0075] Example 4:

[0076] Based on the same inventive concept, this invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the steps of the method in the above embodiments.

[0077] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0078] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0079] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0080] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0081] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0082] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for accessing terminal devices, characterized in that, The method includes: Log in to the target terminal device, determine the device information of the target terminal device, and set the access permissions of the target terminal device to generate the permission information for the user of the target terminal device to access the target terminal device, and generate a device login account based on the permission information, and store the device information and the device login account; Based on the user information of the target terminal device user, the device login account is sent to the target terminal device user, and the device login account user accesses the target terminal device with enhanced authentication; The system acquires real-time device information of the target terminal device, generates a key based on the real-time device information, and distributes the key to the user of the target terminal device. The key is used for initial authentication to access the target terminal device. When the target terminal device user initially accesses the target terminal device using a key, the key is transmitted to the target terminal device using a preset transmission protocol. The device information of the target terminal device is obtained through the key and compared with real-time device information. If the comparison result is consistent, the initial authentication is successful, and the target terminal device user is allowed to initially access the target terminal device. After the target terminal device user initially accesses the target terminal device and provides a device login account, enhanced authentication is performed on the device login account. If the enhanced authentication is successful, the target terminal device user is allowed to access the target terminal device.

2. The method according to claim 1, characterized in that, The device information includes at least one of the following: hardware information, software information, and IP information of the target terminal device.

3. The method according to claim 1, characterized in that, The access permissions include at least one of the following: authentication level, authentication time, and authentication factor; The authentication factors include at least one of the following: account password, SMS verification code, CA certificate, hardware key, and biometric information.

4. The method according to claim 1, characterized in that, The method further includes: updating the access permissions of the target terminal device in real time according to changes in the target terminal device user, so as to update the device login account.

5. A system for accessing terminal devices, characterized in that, The system includes: An initial unit is used to log in to a target terminal device, determine the device information of the target terminal device, and set the access permissions of the target terminal device to generate permission information for the user of the target terminal device to access the target terminal device, and generate a device login account based on the permission information, and store the device information and the device login account; The first transmission unit sends the device login account to the target terminal device user based on the user information of the target terminal device user, and the device login account user accesses the target terminal device with enhanced authentication. The second transmission unit acquires real-time device information of the target terminal device in real time, generates a key based on the real-time device information, and sends the key to the user of the target terminal device. The key is used for initial authentication of accessing the target terminal device. The access unit is configured to transmit the key to the target terminal device using a preset transmission protocol when the target terminal device user initially accesses the target terminal device using the key, obtain the device information of the target terminal device through the key, and compare the device information with real-time device information. If the comparison result is consistent, the initial authentication is successful, and the target terminal device user is allowed to initially access the target terminal device. After the target terminal device user initially accesses the target terminal device and provides a device login account, the unit performs enhanced authentication on the device login account. If the enhanced authentication is successful, the target terminal device user is allowed to access the target terminal device.

6. The system according to claim 5, characterized in that, The device information includes at least one of the following: hardware information, software information, and IP information of the target terminal device.

7. The system according to claim 5, characterized in that, The access permissions include at least one of the following: authentication level, authentication time, and authentication factor; The authentication factors include at least one of the following: account password, SMS verification code, CA certificate, hardware key, and biometric information.

8. The system according to claim 5, characterized in that, The initial unit is also used to: update the access permissions of the target terminal device in real time according to changes in the target terminal device user, so as to update the device login account.

9. A computer device, characterized in that, include: One or more processors; A processor is used to execute one or more programs; When the one or more programs are executed by the one or more processors, the method described in any one of claims 1-4 is implemented.

10. A computer-readable storage medium, characterized in that, It contains a computer program, which, when executed, implements the method as described in any one of claims 1-4.

Images