An authentication method, apparatus, device and medium

Abstract

The application discloses an authentication method and device, equipment and medium, and applies to the technical field of authentication, which comprises the following steps: sending an authentication request to a device and obtaining response information returned by the device; judging whether authentication fails based on the response information; if authentication fails, judging whether misjudgment occurs based on current network conditions, log information in a first nearest preset time period and historical feature data; and if misjudgment occurs, sending an authentication request again. In this way, if authentication fails, whether misjudgment occurs is judged based on current network conditions, log information and historical feature data, if misjudgment occurs, an authentication request is sent again, and recovery is attempted, which can reduce authentication frequency, avoid account locking and improve the robustness of the system in the case of authentication failure.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of authentication, in particular to an authentication method, device, equipment and medium. BACKGROUND

[0002] At present, in order to facilitate production, learning and the like, a plurality of devices are usually needed, and in order to facilitate management of the plurality of devices, a management system usually needs to centrally manage the plurality of devices through interfaces provided by various devices. Before the management system uses the interfaces provided by the devices, identity authentication is usually needed, and if authentication fails multiple times, the account will be locked, some important tasks cannot be completed, and losses will be caused. SUMMARY

[0003] Therefore, the present application aims to provide an authentication method, device, equipment and medium, which can attempt to recover and reduce authentication frequency in the case of authentication failure, avoid account locking, and thus improve the robustness of the system. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses an authentication method, comprising:

[0005] sending an authentication request to a device and obtaining response information returned by the device;

[0006] determining whether authentication fails based on the response information;

[0007] if authentication fails, determining whether a misjudgment occurs based on current network conditions, log information of a first nearest preset time length and historical feature data;

[0008] if a misjudgment occurs, sending an authentication request again.

[0009] Optionally, the determination of whether a misjudgment occurs based on the current network conditions, the log information of the first nearest preset time length and the historical feature data comprises:

[0010] determining whether a misjudgment occurs based on current network latency, network packet loss rate, log information of a first nearest preset time length and historical feature data.

[0011] Optionally, the historical feature data comprises network condition data and historical log information in a historical misjudgment situation; correspondingly, the method further comprises:

[0012] when authentication fails, establishing a first linear regression model based on network condition data of a second nearest preset time length of authentication failure;

[0013] When the authentication succeeds, it is judged whether the user information used in the current authentication is changed compared with the user information used in the last authentication failure, if not changed, it is determined that a misjudgment occurs, and a second linear regression model is established based on the network condition data of the third nearest preset time length of the current authentication success, and the fourth nearest preset time length of the log information of the last authentication failure is obtained to obtain historical log information;

[0014] Correspondingly, the method for judging whether the misjudgment occurs based on the current network condition, the first nearest preset time length of the log information and the historical feature data comprises:

[0015] The method for judging whether the misjudgment occurs based on the current network condition, the first nearest preset time length of the log information, the first linear regression model, the second linear regression model and the historical log information.

[0016] Optionally, the method for judging whether the misjudgment occurs based on the current network condition, the first nearest preset time length of the log information, the first linear regression model, the second linear regression model and the historical log information comprises:

[0017] The distance from the current network condition to the first linear regression model and the second linear regression model is judged, if the distance to the second linear regression model is closer, it is determined that the current network condition is similar to the misjudgment condition;

[0018] The similarity analysis is performed on the first nearest preset time length of the log information and the historical log information.

[0019] If the current network condition is similar to the misjudgment condition, and the first nearest preset time length of the log information is similar to the historical log information, it is determined that the misjudgment occurs.

[0020] Optionally, the method for sending the authentication request to the device comprises:

[0021] If multiple authentication requests for the same device occur at the same time, the request merging is performed, and one authentication request is sent to the device.

[0022] Optionally, after the method for sending the authentication request to the device, the method further comprises:

[0023] If the response information corresponding to the authentication request is not obtained, and the authentication request for the device occurs again, the response information is waited.

[0024] Optionally, after the method for judging whether the authentication fails based on the response information, the method further comprises:

[0025] If the authentication succeeds, the network connection between the device and the device is cached.

[0026] In a second aspect, the present application discloses an authentication device, comprising:

[0027] An authentication request module is configured to send an authentication request to a device and acquire response information returned by the device;

[0028] An authentication judgment module is configured to judge whether authentication fails based on the response information;

[0029] A misjudgment judgment module is configured to, if the authentication judgment module determines that authentication fails, judge whether misjudgment occurs based on current network conditions, log information of a first nearest preset time length and historical feature data;

[0030] An authentication attempt module is configured to, if the misjudgment judgment module determines that misjudgment occurs, send the authentication request again.

[0031] In a third aspect, the present application discloses an electronic device, comprising a memory and a processor, wherein:

[0032] The memory is configured to save a computer program;

[0033] The processor is configured to execute the computer program to implement the authentication method.

[0034] In a fourth aspect, the present application discloses a computer readable storage medium configured to save a computer program, wherein the computer program is executed by a processor to implement the authentication method.

[0035] It can be seen that the present application sends an authentication request to a device and acquires response information returned by the device, and then judges whether authentication fails based on the response information; if authentication fails, judges whether misjudgment occurs based on current network conditions, log information of a first nearest preset time length and historical feature data, and if misjudgment occurs, sends the authentication request again. That is, the present application judges whether authentication fails based on response information of an authentication request, and if authentication fails, further judges whether misjudgment occurs based on current network conditions, log information of a first nearest preset time length and historical feature data, and if misjudgment occurs, sends the authentication request again to attempt recovery.

[0036] The present application has the beneficial effect that, if authentication fails, whether misjudgment occurs is judged based on current network conditions, log information and historical feature data, and if misjudgment occurs, the authentication request is sent again to attempt recovery, which can attempt recovery and reduce authentication frequency in the case of authentication failure, avoid account locking, and thus improve the robustness of the system. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced. Obviously, the accompanying drawings in the following description only need to be drawn for part of the embodiments of the present application, and for the ordinary skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0038] Figure 1 A multi-device management schematic diagram provided for the embodiments of the present application;

[0039] Figure 2 An account locking schematic diagram provided for the embodiments of the present application;

[0040] Figure 3 A flowchart of an authentication method in the prior art;

[0041] Figure 4 A specific user locking scene schematic diagram provided for the embodiments of the present application;

[0042] Figure 5 A flowchart of an authentication method provided for the embodiments of the present application;

[0043] Figure 6 An authentication request processing schematic diagram provided for the embodiments of the present application;

[0044] Figure 7 A misjudgment checking schematic diagram provided for the embodiments of the present application;

[0045] Figure 8 A management system authentication schematic diagram provided for the embodiments of the present application;

[0046] Figure 9 An authentication device structure schematic diagram provided for the embodiments of the present application;

[0047] Figure 10 An electronic device structure diagram provided for the embodiments of the present application. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present application will be described clearly and completely in the following description with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by the ordinary skilled in the art without creative labor are within the protection scope of the present application.

[0049] In a data center, a school laboratory or a large-scale enterprise, there are a large number of devices such as storage, servers, switches and the like, so in order to facilitate the management and monitoring of the devices, a number of management software are generated to centrally manage these devices to provide operation and maintenance support for operation and maintenance personnel, for example, see Figure 1 Figure 1 A multi-device management schematic diagram is provided for the embodiments of the present application. The management system manages devices A, B, C and D, device A is a server of manufacturer 1, device B is a storage of manufacturer 2, device C is a switch of manufacturer 3, and device D is a firewall of manufacturer 4. The managed devices not only have different types such as servers, switches, storages and firewalls, but also can come from different manufacturers. The management system manages different devices of different manufacturers through the interfaces provided by various devices, including: interfaces for extracting data such as performance data and alarms; and interfaces for issuing commands such as configuring IP (Internet Protocol) addresses and turning on / off. Before using the interfaces provided by the devices, the management system usually needs to perform identity authentication, which can use the account authentication mode of username and password. In order to prevent password brute force cracking, the device limits the number of password attempts, usually if the password fails more than a certain number of times within a certain time, the user will be locked for a period of time, for example: if the username and password authentication fails more than 3 times within 1 minute, the user will be locked within 1 hour, so the user cannot log in to the device within the next 1 hour.

[0050] As shown in Figure 2 Figure 2 A user account locking schematic diagram is provided for the embodiments of the present application. The management system can provide a UI page, and the user can set the account password of the device in the page. The management system saves the account password in the database, so that the username and password of the device actually exist in the management system and the device. Then, combined with the account locking mechanism of the managed device, the following two scenarios have occurred in the production environment: In the first scenario, during the operation and maintenance process, the operation and maintenance personnel change the account password of the device but do not change the password in the management system, and the management system still uses the expired password to access the device, resulting in user lock of the device. In the second scenario, the account system of some devices is relatively complex, which replaces the authentication system module of the operating system with its own authentication system, so that the device system and the user of the operating system are unified. For example, there is a user root in the device, whose password is 123, and the operating system also has a user root, whose password is 456. Before the authentication module of the device takes over the authentication module of the operating system, the password of root is 456, and after taking over, it is 123. If power failure or device restart occurs, the password of root will change from 456 to 123, and 123 is saved in the management system. Therefore, before the authentication system of the device takes effect, user lock will occur.​​

[0051] For organizations with high security levels, the first scenario is frequent because device passwords need to be changed regularly. The second scenario is a special case where the user passwords stored in the management system are actually correct, leading to a misjudgment. While it may seem like a problem with the device itself, in actual production environments, because devices and management systems are often from different manufacturers, problems sometimes cannot be detected before shipment. Alternatively, the device manufacturer may attribute the problem to the management system. Furthermore, there are no standardized guidelines for access control, and misjudgments are not limited to the second scenario. Therefore, how to enable the management system to flexibly handle these scenarios is a problem that needs to be solved. Moreover, device account locking is a security mechanism, but the impact of locking can be quite serious, such as causing significant trouble when urgently needing to operate the device to deal with an emergency.

[0052] Existing technical solutions for handling this type of situation are relatively simple: they record the result of the previous access (e.g., success or failure) in a database or file, initially setting the status to success. Before each authentication, the previous authentication result is checked; if it failed, authentication is not performed again; if it was successful, authentication is performed, and the result is updated in the database or file. See also Figure 3 As shown, Figure 3 This is a flowchart of an authentication method in the prior art. However, this approach has two drawbacks: First, management systems typically employ multi-threading in their implementation. If a single thread fails to register an authentication failure and marks it as such, other threads may not immediately acquire this mark, potentially leading to multiple failures occurring simultaneously and locking the device. See also... Figure 4 As shown, Figure 4 This illustration illustrates a specific user lockout scenario provided by an embodiment of this application. Secondly, it cannot handle the false alarm scenario in the second scenario. Such false alarms are insignificant for a system used only for monitoring, but if the management system has important scheduled tasks, such as periodically creating snapshots of storage units on storage devices or periodically backing up data from production equipment to disaster recovery equipment, and if, for some reason, the equipment restarts in the early morning, resulting in a false alarm as in the second scenario, the management system cannot complete the disaster recovery task due to account lockout. Therefore, this application provides an authentication scheme that can attempt recovery and reduce the authentication frequency in the event of authentication failure, avoiding account lockout and thus improving system robustness.

[0053] See Figure 5 As shown in the embodiment of this application, an authentication method is disclosed, including:

[0054] Step S11: Send an authentication request to the device and obtain the response information returned by the device.

[0055] In a specific embodiment, if multiple authentication requests for the same device occur simultaneously, the requests are merged and one authentication request is sent to the device. Further, after the authentication request is sent to the device, if the response information corresponding to the authentication request is not obtained and an authentication request for the device occurs again, the response information is waited for. Further, the authentication of different devices is allocated to different thread processing. The devices are distinguished by IP addresses or MAC (Media Access Control) addresses.

[0056] That is, in the embodiment of the application, if multiple authentication requests for the same device occur simultaneously, only one authentication request is sent to the device, and if an authentication request for the device occurs again before the response information of the request is obtained, the response information is waited for and no authentication request is sent. That is, multiple authentication requests share one response information. For example, as shown in Figure 6 Figure 6 An authentication request processing schematic diagram provided by the embodiment of the application. Different device authentications are allocated to different threads, so that different device authentications can be processed concurrently to improve efficiency. Further, the authentication requests for the same device can be processed in a wait-response mode, the same requests are merged and only one request is executed, so that all authentication requests of the device are only once, the requests are allocated to the corresponding device for execution, and finally the execution results are responded to each thread.

[0057] Step S12: determining whether the authentication fails based on the response information.

[0058] Step S13: if the authentication fails, determining whether a false positive occurs based on the current network condition, the log information of the first nearest preset time length and the historical feature data.

[0059] In an embodiment, whether a false positive occurs can be determined based on the current network delay, the network packet loss rate, the log information of the first nearest preset time length and the historical feature data. That is, the current network condition can include the network delay and the network packet loss rate. The first nearest preset time length can be the previous 5 minutes and the next 5 minutes when the authentication fails, or the previous 10 minutes and the next 10 minutes, and the first nearest preset time length can be determined according to the actual scene.

[0060] ​The historical feature data includes network condition data in a historical misjudgment situation and historical log information. Correspondingly, when authentication fails, a first linear regression model is established based on network condition data of a second nearest preset time period of the authentication failure. When authentication succeeds, it is determined whether user information used in the current authentication has changed relative to user information used in the last authentication failure. If the user information has not changed, it is determined that a misjudgment has occurred, and a second linear regression model is established based on network condition data of a third nearest preset time period of the current authentication success. Historical log information is obtained based on log information of a fourth nearest preset time period of the last authentication failure. It can be understood that the network condition data can include network delay and network packet loss rate. The second nearest preset time period, the third nearest preset time period, and the fourth nearest preset time period can be consistent with the first nearest preset time period. The user information can be a username and a password. The two adjacent authentications are the former authentication failure and the latter authentication success, and the user information is not modified in the latter authentication, indicating that a misjudgment has occurred.

[0061] Correspondingly, whether a misjudgment occurs is determined based on the current network condition, the log information of the first nearest preset time period, and the historical feature data, including: determining whether a misjudgment occurs based on the current network condition, the log information of the first nearest preset time period, the first linear regression model, the second linear regression model, and the historical log information.

[0062] Furthermore, the distance of the current network condition to the first linear regression model and the second linear regression model can be determined. If the distance to the second linear regression model is closer, it is determined that the current network condition is similar to the misjudgment condition. Similarity analysis is performed on the log information of the first nearest preset time period and the historical log information. If the current network condition is similar to the misjudgment condition, and the log information of the first nearest preset time period is similar to the historical log information, it is determined that a misjudgment has occurred. The words in the log information of the first nearest preset time period and the historical log information can be compared in order to obtain the same word / total word count. The letters are compared in order to obtain the same letter / total letter count. When both of these two ratios are greater than a preset threshold, such as 0.8, it is indicated that the logs are similar.

[0063] It should be noted that in the process of implementing the present application, the applicant found that misjudgment usually occurs in the scenarios of device restart or permission system restart in the device. The former case usually has obvious network anomalies for the IP of the device, such as a sharp decrease in network traffic, or high delay and packet loss rate for a period of time. For the latter case, the device often records the anomaly through logs. The embodiments of the present application can collect network performance indicators and logs in the managed device to establish a database. When a failure or success occurs, the network conditions and behaviors recorded in the logs near the failure or success are analyzed to establish a probability model. When the same situation occurs, the probability model can be used to determine whether it is a misjudgment, so as to decide whether to perform a recovery attempt. For example, see Figure 7 Figure 7 A misjudgment checking schematic diagram provided by the embodiments of the present application.

[0064] In a specific implementation, the learning process can include: collecting network delay Delay_S and network packet loss rate Loss_S according to different device IPs. When authentication failure occurs, a first linear regression model is established based on the collected network delay and network packet loss rate: 0 = β0 + β1*Delay_S + β2*Loss_S; β0 ~ β2 represent parameters to be solved, and β0 ~ β2 can be solved based on the network delay and network packet loss rate in the latest preset time length when authentication failure occurs. Network delay Delay_E and network packet loss rate Loss_E are continuously collected. When authentication succeeds, it is first determined whether the username and password of this authentication success have changed. If the username and password have changed, no operation is performed and data continues to be collected. If the username and password have not changed, it indicates that misjudgment has occurred, and a second linear regression model is established: 1 = β3 + β4*Delay_S + β5*Loss_S, where β3 ~ β5 represent parameters to be solved, which can be solved based on the network delay and network packet loss rate in the latest preset time length when authentication succeeds. The log texts occurring about 5 minutes before and after authentication failure are collected and put into a database.

[0065] Further, the use process can include: when authentication failure occurs, the network delay Delay and the network packet loss rate Loss at this time can be calculated (Delay, Loss) to the distance of the first linear regression model and the second linear regression model. If it is closer to the first linear regression model, it indicates that the network condition at this time is more similar to the situation when misjudgment occurs. At this time, the logs before and after 5 minutes are analyzed for text similarity with the historically accumulated logs, and the same words / total number of words are obtained by sequentially comparing the words, and the same letters / total number of letters are obtained by sequentially comparing the letters. When both of the two ratios are greater than 0.8, it indicates that similar log scenarios occur. When the network condition and the log scenario are similar, it is marked as misjudgment.

[0066] ​Step S14: If a false positive occurs, the authentication request is sent again.

[0067] It can be understood that sending the authentication request again can play a role of attempting to recover. If no false positive occurs, a preset operation is performed, such as generating a prompt message.

[0068] In addition, after determining whether the authentication fails based on the response information, if the authentication succeeds, the network connection with the device is cached. Specifically, the network connection can be cached according to the identifier or IP address of the device. When the network connection is interrupted by the device, such as when the network connection is in a closed state or a timeout exception occurs, the network connection in the cache is removed and an authentication request is reinitiated. Moreover, when the authentication fails, the network connection cache is also removed. For authenticated connections, the authentication step can be directly used, which improves efficiency and reduces the risk of locking the device.

[0069] Further, in a specific embodiment, three modules can be established in the management system, which are: an authority authentication module, mainly used for unified authority authentication and feedback of the authentication result, and the authentication task is processed by the authentication module; a false positive identification module, mainly used for identifying whether it is a false positive according to the feedback result of the authority authentication module and collecting various states of the managed devices; and a cache module, used to cache the authenticated network connection, which can reduce the risk of locking during concurrency and improve efficiency by caching the authenticated network connection in combination with the authentication module. Through the cooperation between the three modules and the proposed false positive algorithm, the locking problem caused by high-frequency authentication during concurrency can be solved. Through the false positive identification algorithm and the attempt mechanism after the false positive, the management system can attempt to recover from the false positive scenario, ensuring that the critical functions will not fail unexpectedly, and the cache module can further reduce the authentication frequency and resource consumption during authentication, improving the system performance.

[0070] For example, as shown in FIG. 1, Figure 8 Figure 8 ​A management system authentication schematic diagram provided by an embodiment of the present application. A unified authentication module is established, and all operations requiring identity authentication are performed by the authentication module. The first authentication is processed by the authentication module, the authentication module allocates authentication tasks according to the characteristics of the device such as IP, and notifies the result of the authentication to the misjudgment identification module and the cache module. In addition to processing the management system automatic authentication request, the authentication module also processes the user password modification through the management system interface. This operation will be an important indicator of the misjudgment module. In addition to notifying the misjudgment identification module when the authentication is passed, the cache module also needs to be notified to cache the network connection. The cache module also caches the network connection according to the device identifier or IP. When the network connection is interrupted by the device, such as when the network connection is in a closed state or an overtime exception occurs, the cache module removes the cache and reinitiates the request to the authentication module. When the authentication module detects that the authentication fails, it also requests the cache module to remove the network connection cache. The cache module caches the authenticated connection. The purpose is to directly use the authenticated connection, save the authentication step, improve efficiency and reduce the risk of locking the device. Through the foregoing method, the misjudgment module is learned before being put into use. During use, further learning and adjustment are performed. The misjudgment module checks whether the authentication failure is a misjudgment and can initiate a trial, which plays a recovery role.

[0071] In this way, the unified authentication module can prevent device locking caused by a large number of instantaneous requests. The misjudgment identification module detects network performance and key process start-stop data in the device log to identify misjudgments, attempt recovery, and enable the management system to automatically recover from misjudgments, thereby enabling certain protection for functions such as scheduled backups. The diversity of devices from different manufacturers is solved, and the robustness of the efficient authentication enhancement system for diverse devices is achieved. The locking risk is reduced by caching authenticated network connections. Establishing a network link is a very time-consuming task. Caching authenticated network connections reduces authentication operations and improves system performance.

[0072] It can be seen that the embodiment of the present application sends an authentication request to the device and obtains response information returned by the device, and then determines whether authentication fails based on the response information. If authentication fails, it is determined whether misjudgment occurs based on the current network situation, log information of the first nearest preset time length, and historical feature data. If misjudgment occurs, the authentication request is sent again. That is, the embodiment of the present application determines whether authentication fails based on the response information of the authentication request. In the case of authentication failure, it is further determined whether misjudgment occurs based on the current network situation, log information of the first nearest preset time length, and historical feature data. If misjudgment occurs, the authentication request is sent again to attempt recovery. In this way, in the case of authentication failure, recovery is attempted and the authentication frequency is reduced, account locking is avoided, and the robustness of the system is improved.

[0073] Referring to Figure 9 As shown in the embodiments of the present application, an authentication device is disclosed, comprising:

[0074] An authentication request module 11 is configured to send an authentication request to a device and acquire response information returned by the device.

[0075] An authentication judgment module 12 is configured to judge whether authentication fails based on the response information.

[0076] A misjudgment judgment module 13 is configured to, if the authentication judgment module determines that authentication fails, judge whether misjudgment occurs based on current network condition, log information of a first nearest preset time length and historical feature data.

[0077] An authentication attempt module 14 is configured to, if the misjudgment judgment module determines that misjudgment occurs, send the authentication request again.

[0078] It can be seen that the embodiments of the present application send an authentication request to a device and acquire response information returned by the device, then judge whether authentication fails based on the response information, if authentication fails, judge whether misjudgment occurs based on current network condition, log information of a first nearest preset time length and historical feature data, if misjudgment occurs, send the authentication request again. That is, the embodiments of the present application judge whether authentication fails based on response information of an authentication request, if authentication fails, further judge whether misjudgment occurs based on current network condition, log information of a first nearest preset time length and historical feature data, if misjudgment occurs, send the authentication request again to attempt recovery. In this way, in the case of authentication failure, it can attempt recovery and reduce authentication frequency, avoid account locking, thereby improving the robustness of the system.

[0079] In an implementation, the misjudgment judgment module is specifically configured to judge whether misjudgment occurs based on current network delay, network packet loss rate, log information of a first nearest preset time length and historical feature data. That is, the current network condition can include network delay and network packet loss rate.

[0080] In an embodiment, the historical feature data comprises network condition data in historical misjudgment cases and historical log information; accordingly, the device is further configured to: when authentication fails, establish a first linear regression model based on network condition data in a second latest preset time period of authentication failure; when authentication succeeds, determine whether user information used in this authentication is changed relative to user information used in last authentication failure, if not changed, determine that misjudgment occurs, and establish a second linear regression model based on network condition data in a third latest preset time period of this authentication success, and obtain log information in a fourth latest preset time period of last authentication failure to obtain historical log information; the second latest preset time period, the third latest preset time period and the fourth latest preset time period can be consistent with the first latest preset time period.

[0081] Accordingly, the misjudgment determination module is specifically configured to determine whether misjudgment occurs based on the current network condition, the log information in the first latest preset time period, the first linear regression model, the second linear regression model and the historical log information.

[0082] Further, the misjudgment determination module specifically comprises:

[0083] The network condition determination submodule is configured to determine the distance from the current network condition to the first linear regression model and the second linear regression model, if the distance to the second linear regression model is closer, it is determined that the current network condition is similar to the misjudgment condition;

[0084] The log information determination submodule is configured to perform similarity analysis on the log information in the first latest preset time period and the historical log information.

[0085] The misjudgment determination submodule is configured to determine that misjudgment occurs if the current network condition is similar to the misjudgment condition, and the log information in the first latest preset time period is similar to the historical log information.

[0086] In an embodiment, the authentication request module 11 is specifically configured to, if multiple authentication requests for the same device occur at the same time, perform request merging, and send an authentication request to the device once. And, after the authentication request is sent to the device, if the response information corresponding to the authentication request is not obtained, and the authentication request for the device occurs again, the response information is waited for.

[0087] Further, the device further comprises a network connection caching module configured to, if authentication succeeds, cache the network connection between the device.

[0088] Referring to Figure 10As shown, the embodiment of the present application discloses an electronic device 20, comprising a processor 21 and a memory 22; wherein the memory 22 is used to save a computer program; the processor 21 is used to execute the computer program, and the authentication method disclosed in the foregoing embodiment.

[0089] It can be seen that the embodiment of the present application sends an authentication request to the device, and obtains response information returned by the device, and then judges whether the authentication fails based on the response information; if the authentication fails, it is judged whether a misjudgment occurs based on the current network condition, the log information of the first nearest preset time length and the historical feature data; if the misjudgment occurs, the authentication request is sent again. That is, the embodiment of the present application judges whether the authentication fails based on the response information of the authentication request, in the case of authentication failure, it is further judged whether a misjudgment occurs based on the current network condition, the log information of the first nearest preset time length and the historical feature data; if the misjudgment occurs, the authentication request is sent again to attempt to recover. In this way, in the case of authentication failure, the authentication frequency is reduced to attempt to recover and avoid account locking, thereby improving the robustness of the system.

[0090] The specific process of the authentication method can refer to the corresponding content disclosed in the foregoing embodiment, which will not be repeated here.

[0091] Moreover, the memory 22 as a carrier for storing resources can be a read-only memory, a random access memory, a magnetic disk or an optical disk, and the storage mode can be temporary storage or permanent storage.

[0092] In addition, the electronic device 20 further comprises a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26; wherein the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which will not be limited here; the input / output interface 25 is used to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which will not be limited here.

[0093] Further, the embodiment of the present application further discloses a computer readable storage medium for saving a computer program, wherein the computer program is executed by a processor to implement the authentication method disclosed in the foregoing embodiment.

[0094] It can be seen that the embodiment of the application sends an authentication request to the device, and obtains response information returned by the device, and then judges whether authentication fails based on the response information; if authentication fails, it is judged whether misjudgment occurs based on the current network condition, log information of the first nearest preset time length and historical feature data; if misjudgment occurs, the authentication request is sent again. That is, the embodiment of the application judges whether authentication fails based on the response information of the authentication request, and in the case of authentication failure, it is further judged whether misjudgment occurs based on the current network condition, log information of the first nearest preset time length and historical feature data; if misjudgment occurs, the authentication request is sent again to attempt recovery. In this way, in the case of authentication failure, recovery is attempted and the authentication frequency is reduced, account locking is avoided, and the robustness of the system is improved.

[0095] The specific process of the above authentication method can refer to the corresponding content disclosed in the foregoing embodiments, and will not be described here.

[0096] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the related parts can refer to the method part.

[0097] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0098] The above provides a detailed introduction to the authentication method, device, equipment and medium provided by the application. The principles and implementation modes of the application are described in this paper, and the above embodiment description is only used to help understand the method and core idea of the application; at the same time, for those skilled in the art, according to the idea of the application, the specific implementation mode and application range will be changed; in view of the above, the content of the specification should not be understood as a limitation of the application.

Claims

1. An authentication method characterized by, The method comprises the following steps: sending an authentication request to a device and obtaining response information returned by the device; judging whether authentication fails based on the response information; if authentication fails, judging whether misjudgment occurs based on current network condition, log information in a first preset time period and historical characteristic data; the historical characteristic data comprises network condition data and historical log information in a historical misjudgment condition; if misjudgment occurs, sending the authentication request again; wherein, the step of judging whether misjudgment occurs based on the current network condition, the log information in the first preset time period and the historical characteristic data comprises the following steps: judging distances from the current network condition to a first linear regression model and a second linear regression model; if the distance to the second linear regression model is closer, it is determined that the current network condition is similar to a misjudgment condition; performing similarity analysis on the log information in the first preset time period and the historical log information; if the current network condition is similar to the misjudgment condition and the log information in the first preset time period is similar to the historical log information, it is determined that misjudgment occurs; the learning process of the first linear regression model and the second linear regression model comprises the following steps: when authentication fails, establishing the first linear regression model based on network condition data in a second nearest preset time period of authentication failure; when authentication succeeds, judging whether user information used in this authentication is changed relative to user information used in last authentication failure; if the user information is not changed, it is determined that misjudgment occurs; a second linear regression model is established based on network condition data in a third nearest preset time period of this authentication success; and log information in a fourth nearest preset time period of last authentication failure is obtained to obtain historical log information; the second nearest preset time period, the third nearest preset time period, the fourth nearest preset time period and the first nearest preset time period are consistent.

2. The authentication method of claim 1, wherein, The current network condition comprises current network delay and network packet loss rate.

3. The authentication method of claim 1, wherein, The step of sending the authentication request to the device comprises the following steps: if multiple authentication requests for the same device occur at the same time, the requests are combined and one authentication request is sent to the device.

4. The authentication method of claim 1, wherein, After the step of sending the authentication request to the device, the method further comprises the following steps: if the response information corresponding to the authentication request is not obtained and an authentication request for the device occurs again, the response information is waited for.

5. The authentication method according to any one of claims 1 to 4, characterized in that, After the step of judging whether authentication fails based on the response information, the method further comprises the following steps: if authentication succeeds, the network connection between the device and the authentication request is cached.

6. An authentication apparatus characterized by comprising: The method comprises the following steps: an authentication request module, configured to send an authentication request to a device and obtain response information returned by the device; an authentication judgment module, configured to judge whether authentication fails based on the response information; a misjudgment judgment module, configured to, if the authentication judgment module determines that authentication fails, judge whether misjudgment occurs based on current network condition, log information in a first preset time period and historical characteristic data; the historical characteristic data comprises network condition data and historical log information in a historical misjudgment condition; an authentication attempt module, configured to, if the misjudgment judgment module determines that misjudgment occurs, send the authentication request again; wherein, the misjudgment judgment module specifically comprises the following steps: The network condition judgment submodule is configured to judge a distance of a current network condition to the first linear regression model and the second linear regression model, and determine that the current network condition is similar to a misjudgment condition if the distance to the second linear regression model is closer; The log information judgment submodule is configured to perform similarity analysis on the first nearest preset time length of log information and the historical log information. The misjudgment judgment submodule is configured to determine that a misjudgment occurs if the current network condition is similar to the misjudgment condition and the first nearest preset time length of log information is similar to the historical log information. The device is further configured to perform a learning process of the first linear regression model and the second linear regression model, including: when authentication fails, establishing the first linear regression model based on network condition data of a second nearest preset time length of authentication failures; when authentication succeeds, judging whether user information used in this authentication is changed relative to user information used in a last authentication failure, determining that a misjudgment occurs if the user information is not changed, establishing the second linear regression model based on network condition data of a third nearest preset time length of this authentication success, and obtaining log information of a fourth nearest preset time length of the last authentication failure to obtain historical log information; the second nearest preset time length, the third nearest preset time length, the fourth nearest preset time length, and the first nearest preset time length are consistent.

7. An electronic device, comprising: The device comprises a memory and a processor, wherein: The memory is configured to save a computer program. The processor is configured to execute the computer program to implement the authentication method in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The device is configured to save a computer program, and the computer program is executed by a processor to implement the authentication method in any one of claims 1 to 5.

Images