Cloud platform login method and device, computer device and storage medium

Abstract

The present application relates to the technical field of cloud platform management, and discloses a cloud platform login method and device, computer equipment and a storage medium. The cloud platform login method comprises: in response to receiving an authorized login request sent by a user, obtaining current environment information of the user's current login; based on the current environment information, performing security detection on the user's current login environment to determine a current login risk coefficient; if the current login risk coefficient is greater than a specified coefficient threshold, determining a target authentication mode from a plurality of to-be-executed identity authentication modes based on the current login risk coefficient; if the user passes the identity authentication corresponding to the target authentication mode, performing an authorization code authentication on the user to obtain an authentication result; and if the authentication result is passed, sending an access token to the user to enable the user to log in to the cloud platform through the access token. The combination of login environment detection and authorization code authentication can effectively prevent the unauthorized disclosure of the authorization code, thereby facilitating the protection of the user's account security.

Description

Technical Field

[0001] This invention relates to the field of cloud platform management technology, specifically to cloud platform login methods, devices, computer equipment, and storage media. Background Technology

[0002] A cloud computing platform (also known as a cloud platform) is a service platform that provides computing, networking, and storage capabilities based on hardware and software resources.

[0003] When users access cloud platforms, they are authenticated using their username and password. However, if the same user uses the same password as the authentication code on multiple cloud platforms, and the password for one platform is leaked, the security of their accounts on the other platforms will be compromised. Furthermore, setting too many passwords can lead to problems that users find difficult to remember.

[0004] In related technologies, cloud platforms can perform security authentication through authorized login to solve the above problems. However, if the authorization code is leaked, it will affect the security of the user's account. Summary of the Invention

[0005] In view of this, the present invention provides a cloud platform login method, apparatus, computer equipment and storage medium to solve the problem of authorization codes being easily leaked.

[0006] In a first aspect, the present invention provides a cloud platform login method, the method comprising:

[0007] Upon receiving an authorization login request from the user, obtain the user's current environment information.

[0008] Based on the current environment information, a security check is performed on the user's current login environment to determine the current login risk coefficient;

[0009] If the current login risk coefficient is greater than the specified coefficient threshold, then the target authentication method is determined from multiple pending authentication methods based on the current login risk coefficient.

[0010] If the user authenticates their identity through the target authentication method, then the user will be authenticated using an authorization code to obtain the authentication result.

[0011] If the authentication result is successful, an access token will be sent to the user so that the user can log in to the cloud platform using the access token.

[0012] In one optional implementation, based on current environment information, a security check is performed on the user's current login environment to determine the current login risk coefficient, including:

[0013] Based on the user's historical login log data, determine the user's preferred login environment information;

[0014] Based on the comparison between the current environment information and the habitual login environment information, a security check is performed on the user's current login environment to determine the current login risk coefficient.

[0015] In one optional implementation, the current environment information includes: current login time, current login region, current Internet Protocol address, and the current device model used by the user for login;

[0016] The habitual login environment information includes: habitual login time period, historical login area, historical Internet protocol address, historical device model, and historical login method;

[0017] Based on the comparison between the current environment information and the habitual login environment information, a security check is performed on the user's current login environment to determine the current login risk coefficient, including:

[0018] The first detection value is determined based on the first comparison result between the current login time and the usual login time period;

[0019] The second comparison result between the current login zone and the historical login zone is determined, and the third comparison result between the current Internet Protocol address and the historical Internet Protocol address is determined.

[0020] The second detection value is determined based on the second and third comparison results;

[0021] Based on the fourth comparison result between the current equipment model and the historical equipment model, the third detection value is determined;

[0022] Based on the fifth comparison result between historical login methods and target login methods, the fourth detection value is determined;

[0023] The first, second, third, and fourth detection values ​​are input into a preset security risk model to perform security checks on the user's current login environment, and the output of the security risk model is used as the current login risk coefficient.

[0024] In one optional implementation, based on the current login risk coefficient, a target authentication method is determined from multiple pending authentication methods, including:

[0025] The current login risk coefficient is matched with multiple preset login risk coefficient ranges to determine the target login risk coefficient range. The target login risk coefficient range is the login risk coefficient range that includes the current login risk coefficient among the multiple login risk coefficient ranges. Different login risk coefficient ranges correspond to different identity authentication methods.

[0026] The authentication method corresponding to the target login risk coefficient range is determined as the target authentication method.

[0027] In one alternative implementation, the method further includes:

[0028] If the current login risk coefficient is less than or equal to the specified threshold, the user is prohibited from logging in.

[0029] In one optional implementation, the authorized login request includes: a first domain name addressing for the resource to be accessed, a target encryption method, and a target exchange code parameter; the user is authenticated using an authorization code to obtain an authentication result, including:

[0030] Send the first authorization code corresponding to the first domain name redirection to the user;

[0031] Receive a token access request sent by the user. The token access request includes: a second authorization code, a random verification string, and the first domain name address of the resource to be accessed.

[0032] The random verification string is encrypted using the target encryption method to generate the exchange code parameters for this operation.

[0033] If the parameters of this exchange code are the same as the parameters of the target exchange code, and the second authorization code is the same as the first authorization code, then the authentication result is determined to be successful.

[0034] If the parameters of this exchange code are different from the target exchange code parameters, and / or the second authorization code is different from the first authorization code, the authentication result is determined to be unsuccessful.

[0035] In one alternative implementation, the method further includes:

[0036] Upon receiving a resource access request sent by a user via an access token, the system determines the target resource that the user wishes to access.

[0037] Obtain user information;

[0038] Based on the pre-set permission management configuration file and user information, determine the resource access permissions corresponding to the user;

[0039] If the user's corresponding resource access permissions allow access to the target resource, then the user is allowed to log in to the cloud platform;

[0040] If a user's access permissions do not allow them to access the target resource, then the user's login to the cloud platform will be denied.

[0041] In one alternative implementation, the method further includes:

[0042] If a user successfully logs into the cloud platform, the current login risk level is saved.

[0043] In one alternative implementation, the method further includes:

[0044] The current environment information is stored in the user's historical login log data to update the historical login log data.

[0045] Secondly, the present invention provides a cloud platform login device, the device comprising:

[0046] The acquisition module is used to respond to the authorization login request sent by the user and obtain the current environment information of the user's current login.

[0047] The environmental monitoring module is used to perform security checks on the user's current login environment based on current environmental information and determine the current login risk coefficient;

[0048] The filtering module is used to determine the target authentication method from multiple pending authentication methods based on the current login risk coefficient if the current login risk coefficient is greater than a specified coefficient threshold.

[0049] The first authentication execution module is used to perform authorization code authentication on the user if the user passes the identity authentication corresponding to the target authentication method, and obtain the authentication result.

[0050] The sending module is used to send an access token to the user if the authentication result is successful, so that the user can log in to the cloud platform with the access token.

[0051] Thirdly, the present invention provides a computer device, including: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the cloud platform login method of the first aspect or any corresponding embodiment described above.

[0052] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the cloud platform login method of the first aspect or any corresponding embodiment thereof.

[0053] In the cloud platform login method provided by this invention, a security check can be performed on the user's current login environment before authorization code authentication, so that authorization code authentication is performed in a relatively secure state, thereby ensuring the legitimacy of the logged-in user's identity and effectively preventing the illegal disclosure of authorization codes, thus helping to protect the user's account security. Attached Figure Description

[0054] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0055] Figure 1 This is a flowchart illustrating the cloud platform login method provided according to an embodiment of the present invention;

[0056] Figure 2 This is a flowchart illustrating another cloud platform login method provided according to an embodiment of the present invention;

[0057] Figure 3 This is a flowchart illustrating another cloud platform login method provided according to an embodiment of the present invention;

[0058] Figure 4 This is a flowchart illustrating another cloud platform login method provided according to an embodiment of the present invention;

[0059] Figure 5 This is an authorization code authentication timing interaction diagram provided according to an embodiment of the present invention;

[0060] Figure 6 This is a structural block diagram of a cloud platform login device provided according to an embodiment of the present invention;

[0061] Figure 7 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] In practice, the same user may use the same password as an authentication code across multiple cloud platforms. However, if the password for one cloud platform is leaked, the security of accounts on other cloud platforms will be compromised. Conversely, if users set different passwords for different cloud platforms, it can make it difficult for them to remember multiple passwords.

[0064] In related technologies, to address the aforementioned issues, cloud platforms can implement secure authentication through authorized login to facilitate quick user access. However, if the authorization code is leaked, it will jeopardize the user's account security.

[0065] In view of this, the present invention provides a cloud platform login method, the method comprising: responding to receiving an authorization login request sent by a user and obtaining the user's current login environment information; based on the current environment information, performing security detection on the user's current login environment to determine the current login risk coefficient; if the current login risk coefficient is greater than a specified coefficient threshold, determining a target authentication method from multiple pending authentication methods based on the current login risk coefficient; if the user passes the authentication corresponding to the target authentication method, performing authorization code authentication on the user to obtain an authentication result; if the authentication result is successful, sending an access token to the user to enable the user to log in to the cloud platform using the access token. The cloud platform login method provided by the present invention enables security detection of the user's current login environment information before the user logs in to the cloud platform, and then uses the corresponding authentication method to verify the user's identity, thereby preventing the user's access token from being illegally obtained, reducing the risk of authorization code leakage, and helping to protect the user's account security.

[0066] According to an embodiment of the present invention, a cloud platform login method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0067] This embodiment provides a cloud platform login method, which can be used on the aforementioned mobile terminals, such as mobile phones, tablets, etc. (the execution subject is described in conjunction with the actual situation). Figure 1 This is a flowchart of a cloud platform login method provided according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps:

[0068] Step S101: Respond to the received authorization login request sent by the user and obtain the current environment information of the user's current login.

[0069] In this embodiment of the invention, when an authorization login request is received from a user, it indicates that the current user needs to log in to the cloud platform. To prevent user impersonation, the current environment information of the user's current login is obtained to verify the security of the user's current login.

[0070] Step S102: Based on the current environment information, perform a security check on the user's current login environment to determine the current login risk coefficient.

[0071] In this embodiment of the invention, the current login risk coefficient is used to characterize the risk status of the current login environment. A higher current login risk coefficient indicates a more secure current login environment; conversely, a lower current login risk coefficient indicates a more dangerous current login environment.

[0072] Step S103: If the current login risk coefficient is greater than the specified coefficient threshold, then based on the current login risk coefficient, determine the target authentication method from multiple pending authentication methods.

[0073] In this embodiment of the invention, the specified coefficient threshold is the maximum warning value for determining that the current login environment is risky. If the current login risk coefficient is greater than the specified coefficient threshold, it indicates that the current login environment is relatively secure and identity verification can be performed through authentication. However, if the current login risk coefficient is less than or equal to the specified coefficient threshold, it indicates that the current login environment is insecure.

[0074] Therefore, when the current login risk coefficient is determined to be greater than a specified threshold, a target authentication method is determined from multiple pending authentication methods based on the current login risk coefficient. That is, in this invention, multiple authentication methods are pre-set for use, such as biometric authentication and SMS authentication. Biometric authentication can include face authentication, fingerprint authentication, iris authentication, and voice authentication. Different authentication methods can be used for different current login risk coefficients, and thus, after determining the current login risk coefficient, a target authentication method can be determined from multiple pending authentication methods. The target authentication method is the authentication method corresponding to the current login risk coefficient among the multiple pending authentication methods.

[0075] Step S104: If the user authenticates their identity through the target authentication method, then the user is authenticated using an authorization code to obtain the authentication result.

[0076] In this embodiment of the invention, if a user authenticates their identity through the target authentication method, it indicates that the user currently requesting login is a legitimate user. Therefore, authorization code authentication is performed on the user to determine whether the authorization code can be sent to the user, thereby obtaining the authentication result.

[0077] In step S105, if the authentication result is successful, an access token is sent to the user so that the user can log in to the cloud platform using the access token.

[0078] In this embodiment of the invention, if the authentication result is successful, it indicates that the user can access the cloud platform. Therefore, an access token is sent to the user so that the user can log in to the cloud platform to access resources through the access token.

[0079] The cloud platform login method provided in this embodiment can perform security checks on the user's current login environment before authorization code authentication, so as to perform authorization code authentication in a relatively secure state, thereby ensuring the legitimacy of the logged-in user's identity and effectively preventing the illegal disclosure of authorization codes, thus helping to protect the user's account security.

[0080] This embodiment provides a cloud platform login method, which can be used on the aforementioned mobile terminals, such as mobile phones and tablets. Figure 2 This is a flowchart of a cloud platform login method provided according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0081] Step S201: Upon receiving the authorization login request from the user, obtain the user's current environment information. For details, please refer to [link to relevant documentation]. Figure 1 Step S101 of the illustrated embodiment will not be described again here.

[0082] Step S202: Based on the current environment information, perform a security check on the user's current login environment to determine the current login risk coefficient.

[0083] Specifically, step S202 includes:

[0084] Step S2021: Based on the user's historical login log data, determine the user's preferred login environment information.

[0085] In this embodiment of the invention, based on the user's historical login log data, the user's login habits on the cloud platform can be characterized, thereby determining the user's preferred login environment information.

[0086] Step S2022: Based on the comparison results between the current environment information and the habitual login environment information, perform security checks on the user's current login environment and determine the current login risk coefficient.

[0087] In this embodiment of the invention, by comparing the current environment information with the habitual login environment information, the difference between the user's current login environment and the user's historical login environment can be clearly identified. Then, based on the comparison results, security detection is performed to verify whether the current login environment is secure, thereby obtaining the current login risk coefficient.

[0088] In some optional implementations, the current environment information includes: the current login time, the current login region, the current Internet Protocol address, and the current device model used by the user for login; the habitual login environment information includes: the habitual login time period, historical login region, historical Internet Protocol address, historical device model, and historical login method. Step S2022 above includes:

[0089] Step a1: Determine the first detection value based on the first comparison result between the current login time and the usual login time period.

[0090] In this method, to detect whether the current user is a legitimate user, the current login time is first verified against the user's usual login time. Specifically, based on the user's historical login log data, the user's usual login time can be determined. The current login time is then compared with this usual login time to determine whether the current login time belongs to the usual login time, thus obtaining a first comparison result. Different first detection values ​​are pre-assigned to different first comparison results. Then, based on the obtained first comparison results, the first detection value corresponding to the current login time is determined from multiple first detection values.

[0091] In one example, the duration of a habitual login period can be determined based on the habitual login period. Based on the habitual login period, its duration, and a specified time interval, the specified time interval is divided into multiple matching periods, each corresponding to a different first detection value. The shorter the time difference between a matching period and the habitual login period, the higher the corresponding first detection value; conversely, the longer the time difference, the lower the corresponding first detection value. The first detection value corresponding to the habitual login period and the differences between the first detection values ​​of each matching period are arranged in descending order of an arithmetic sequence. The first detection value corresponding to the habitual login period is the largest, and the matching period with the longest time difference has the smallest first detection value. The first detection value corresponding to the habitual login period can be preset.

[0092] For example, in one implementation scenario, the duration of a typical login period is 3 hours, and the specified time interval is 24 hours. Combining the typical login period, its duration, and the specified time interval, the specified time interval is divided into 7 matching periods, one of which is the typical login period. Taking the typical login period [A, B) as an example, the 7 matching periods are: [A-9, B-9), [A-6, B-6), [A-3, B-3), [A, B), [A+3, B+3), [A+6, B+6), [A+9, B+9), [A-12, B-12) / [A+12, B+12). Since [A-12, B-12) and [A+12, B+12) are the same period, [A-12, B-12) will be used consistently below. The time difference between [A-3,B-3) and [A+3,B+3) and [A,B) ​​is within 3 hours; the time difference between [A-6,B-6) and [A+6,B+6) and [A,B) ​​is within 3-6 hours; the time difference between [A-9,B-9) and [A+9,B+9) and [A,B) ​​is within 6-9 hours; and the time difference between [A-12,B-12) and [A,B) ​​is within 9-12 hours. If the first detection value assigned to [A,B) ​​is 5, then the first detection value corresponding to [A-3,B-3) and [A+3,B+3) is 4; the first detection value corresponding to [A-6,B-6) and [A+6,B+6) is 3; the first detection value corresponding to [A-9,B-9) and [A+9,B+9) is 2; and the first detection value corresponding to [A-12,B-12) is 1.

[0093] If the current login time falls between [A, B), the first detection value is set to 5. If the current login time falls between [A-3, B-3) or [A+3, B+3), the first detection value is set to 4. If the current login time falls between [A-6, B-6) or [A+6, B+6), the first detection value is set to 3. If the current login time falls between [A-9, B-9) or [A+9, B+9), the first detection value is set to 2. If the current login time falls between [A-12, B-12), the first detection value is set to 1.

[0094] Step a2: Determine the second comparison result between the current login area and the historical login area, and determine the third comparison result between the current Internet Protocol address and the historical Internet Protocol address.

[0095] In this method, to detect whether a user's current login is a login from a different location, a joint verification is performed based on a second comparison result between the current login region and the historical login region, and a third comparison result between the current Internet Protocol Address (IP address) and the historical IP address, to determine whether the user has logged in from different regions and / or network environments within a short period of time. The historical login region includes multiple sub-historical login regions, each corresponding to a different login time.

[0096] By comparing the current login region with the historical login regions, the second comparison result can determine whether the current login region of the user's current login cloud platform is different from the historical login region, as well as the first time interval between logging into the cloud platform under different login regions.

[0097] The third comparison result, obtained by comparing the current Internet Protocol address with the historical Internet Protocol address, can determine whether the current IP address of the user logging into the cloud platform is different from the historical IP address, and the second time interval when logging into the cloud platform with a different IP address.

[0098] Step a3: Determine the second detection value based on the second comparison result and the third comparison result.

[0099] In this method, if the login region changes, the IP address will inevitably change. Therefore, if the second comparison result determines that the user's login region to the cloud platform has changed, and the user logs into the cloud platform from different login regions within a short period (e.g., within 1 hour), the user's current login environment can be determined to be dangerous, and the second detection value can be set to 0. If the time interval between IP addresses from different login regions falls within the first interval, the second detection value can be set to 1. If the time interval between IP addresses from different login regions falls within the second interval, the second detection value can be set to 3. If the time interval between IP addresses from different login regions falls within the third interval, the second detection value can be set to 5. If, based on the second and third comparison results, it is determined that neither the user's login region nor their IP address has changed, the second detection value can be directly set to 5. The time length within the second interval is greater than the time length within the first interval, and the time length within the third interval is greater than the time length within the second interval. For example, the first interval could be within 24 hours, the second interval could be between 24 and 72 hours, and the third interval could be greater than 72 hours.

[0100] Step a4: Based on the fourth comparison result between the current equipment model and the historical equipment model, determine the third detection value.

[0101] In this method, comparing the current device model with historical device models can determine whether the user used different devices to log in to the cloud platform, thus obtaining the fourth comparison result. Historical login log data can determine the historical login times of users using different historical device models. Therefore, even if the current device model differs from the historical device model, the third detection value can be determined based on the time difference between the current login time and the historical login time.

[0102] For example: If three or more different device models log into the cloud platform within a short period (e.g., within one hour), the user's current login environment is determined to be dangerous, and the third detection value is set to 0. If the time difference between three or more different device models is less than the first time threshold, the third detection value is set to 1. If the time difference between three or more different device models is greater than or equal to the first time threshold and less than the second time threshold, the third detection value is set to 3. If the time difference between three or more different device models is greater than or equal to the second time threshold, the third detection value is set to 5. In one example, the first time threshold could be 24 hours or 72 hours.

[0103] Step a5: Based on the fifth comparison result between the historical login method and the target login method, determine the fourth detection value.

[0104] In this method, the user's current login method on the cloud platform depends on their historical login methods. If the historical login method was the target login method, then the user's current login method on the cloud platform is the target login method; otherwise, the current login method is another login method. Different fourth detection values ​​are pre-configured for different login methods. If the login method is the target login method, the corresponding fourth detection value is 1; if the login method is another login method, the corresponding fourth detection value is 0. For example, taking authorization code login as the target login method: If the historical login method was authorization code login, the corresponding fourth detection value is 1; if the historical login method was another login method, the corresponding fourth detection value is 0.

[0105] Step a6: Input the first detection value, the second detection value, the third detection value, and the fourth detection value into the preset security risk model to perform security detection on the user's current login environment, and use the output of the security risk model as the current login risk coefficient.

[0106] In this approach, a security risk model is pre-built to perform targeted detection on the current login environment, thereby ensuring that the obtained current login risk coefficient is more objective and reasonable. The objective function corresponding to the security risk model can be determined using the following formula:

[0107] B1 = (A1 * A2 * A3 * A4) / 3;

[0108] A1 represents the first detection value, A2 represents the second detection value, A3 represents the third detection value, A4 represents the fourth detection value, and B1 represents the current login risk coefficient.

[0109] The above methods enable multi-dimensional data analysis of the current login environment based on current environmental information and habitual login environment information, allowing for thorough detection and thus helping to ensure the effectiveness and reliability of security detection. It should be noted that the data in the above embodiments are merely examples and can be customized according to needs; they are not limited in this invention.

[0110] Step S203: If the current login risk coefficient is greater than the specified coefficient threshold, then based on the current login risk coefficient, determine the target authentication method from multiple pending authentication methods.

[0111] In some optional implementations, step S203 above includes:

[0112] Step b1: Match the current login risk coefficient with multiple preset login risk coefficient ranges to determine the target login risk coefficient range;

[0113] Step b2: Determine the authentication method corresponding to the target login risk coefficient range as the target authentication method.

[0114] Specifically, a mapping between multiple login risk coefficient ranges and authentication methods is pre-established. Once the current login risk coefficient is determined, it is matched against the pre-defined ranges to identify the login risk coefficient range that includes the current risk coefficient, and this range is designated as the target login risk coefficient range. Since different login risk coefficient ranges correspond to different authentication methods, the authentication method corresponding to the target range is designated as the target authentication method, ensuring that subsequent authentication is performed using this target method.

[0115] For example, the login risk coefficient ranges are (0,3), [3,5), and [5]. (0,3) corresponds to facial recognition or SMS authentication. [3,5) corresponds to a pop-up verification code for the authenticator. [5] indicates that no authentication is required.

[0116] In other alternative implementations, multiple mappings between login risk coefficients and authentication methods can be pre-established, and the target authentication method can be determined based on the current login risk coefficient. Alternatively, the current login environment security level can be determined based on the current login risk coefficient, and then an authentication method matching that security level can be selected as the target authentication method. For example, the higher the security level, the simpler the authentication method.

[0117] Step S204: If the user authenticates their identity using the target authentication method, then the user is authenticated using an authorization code to obtain the authentication result. For details, please refer to [link to relevant documentation]. Figure 1 Step S104 of the illustrated embodiment will not be described again here.

[0118] Step S205: If the authentication result is successful, an access token is sent to the user, allowing the user to log in to the cloud platform using the access token. For details, please refer to [link to relevant documentation]. Figure 1 Step S105 of the illustrated embodiment will not be described again here.

[0119] The cloud platform login method provided in this embodiment can determine the target authentication method to be authenticated from multiple identity authentication methods based on the detected current login risk coefficient. Then, when the identity authentication corresponding to the target authentication method is successful, the user is authenticated with an authorization code. This helps reduce the risk of authorization code leakage, enhances the security of the login process, and effectively protects the user's login security.

[0120] In some optional implementations, the above cloud platform login method further includes:

[0121] Step S206: If the current login risk coefficient is less than or equal to a specified threshold, then the user is prohibited from logging in. The specified threshold can be 0. That is, if the current login risk coefficient is 0, it indicates that the current login environment is dangerous; therefore, to protect the user's account security, the user is prohibited from logging in.

[0122] This embodiment provides a cloud platform login method, which can be used on the aforementioned mobile terminals, such as mobile phones and tablets. Figure 3 This is a flowchart of a cloud platform login method provided according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0123] Step S301: In response to the received authorization login request from the user, obtain the user's current environment information. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0124] Step S302: Based on the current environment information, perform a security check on the user's current login environment to determine the current login risk coefficient. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0125] Step S303: If the current login risk coefficient is greater than a specified threshold, then based on the current login risk coefficient, determine the target authentication method from multiple pending authentication methods. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0126] Step S304: If the user authenticates their identity through the target authentication method, then the user is authenticated using an authorization code to obtain the authentication result.

[0127] Specifically, the authorized login request includes: the first domain name address to be accessed, the target encryption method, and the target exchange code parameters. Step S304 includes:

[0128] Step S3041: Send the first authorization code corresponding to the first domain name redirection to the user.

[0129] In this embodiment of the invention, when a user passes the identity authentication corresponding to the target authentication method, it indicates that the user is a legitimate user. Therefore, a first authorization code corresponding to the first domain name transfer is sent to the user so that the user can access the resources on the first domain name transfer through the first authorization code.

[0130] Step S3042: Receive the token access request sent by the user.

[0131] In this embodiment of the invention, the token access request includes, but is not limited to: a second authorization code, a random verification string (code_verifier), and a first domain name redirection for the resource to be accessed. The second authorization code is an authorization code sent by the user for accessing the first domain name redirection. The random verification string is verification data used to verify whether this authorization has been leaked.

[0132] In one example, the authorized login request also includes connection state parameters (state). The token access request also includes connection state parameters and current device credentials.

[0133] Step S3043: Encrypt the random verification string using the target encryption method to generate the exchange code parameters for this operation.

[0134] Step S3044: If the current exchange code parameters are the same as the pre-stored target exchange code parameters, and the second authorization code is the same as the first authorization code, then the authentication result is determined to be successful.

[0135] In this embodiment of the invention, the target exchange code parameter can be understood as the exchange code parameter generated by a legitimate user after encrypting a random verification string using the target encryption method. If the current exchange code parameter is the same as the target exchange code parameter, it indicates that the user currently interacting with the cloud platform is a legitimate user and has not been impersonated. If the second authorization code is the same as the first authorization code, it indicates that the authorization code was not replaced during the user's interaction with the cloud platform; therefore, the authentication result can be determined as successful.

[0136] Step S3045: If the current exchange code parameters are different from the target exchange code parameters, and / or the second authorization code is different from the first authorization code, then the authentication result is determined to be unsuccessful.

[0137] In this embodiment of the invention, if the current exchange code parameter differs from the target exchange code parameter, it indicates that the random verification string is abnormal and the authorization code may have been leaked. If the second authorization code differs from the first authorization code, it indicates that the user may be an imposter. Therefore, when any one or a combination of the following occurs, the authentication result can be determined as failed: the current exchange code parameter differs from the target exchange code parameter, and the second authorization code differs from the first authorization code.

[0138] Step S305: If the authentication result is successful, an access token is sent to the user, enabling the user to log in to the cloud platform using the access token. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0139] The cloud platform login method provided in this embodiment can effectively intercept attacks by performing dual verification of the exchange code parameter and the authorization code, thereby helping to improve the security of the authorization process.

[0140] This embodiment provides a cloud platform login method, which can be used on the aforementioned mobile terminals, such as mobile phones and tablets. Figure 4 This is a flowchart of a cloud platform login method provided according to an embodiment of the present invention, such as... Figure 4 As shown, the process includes the following steps:

[0141] Step S401: In response to the received authorization login request from the user, obtain the user's current environment information. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0142] Step S402: Based on the current environment information, perform a security check on the user's current login environment to determine the current login risk coefficient. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0143] Step S403: If the current login risk coefficient is greater than a specified threshold, then based on the current login risk coefficient, determine the target authentication method from multiple pending authentication methods. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0144] Step S404: If the user authenticates their identity through the target authentication method, then the user is authenticated using an authorization code to obtain the authentication result. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0145] Step S405: If the authentication result is successful, an access token is sent to the user, enabling the user to log in to the cloud platform using the access token. For detailed explanations, please refer to the relevant descriptions of the corresponding steps in the above embodiments; they will not be repeated here.

[0146] Step S406: Upon receiving a resource access request sent by the user via an access token, determine the target resource that the user wants to access.

[0147] Step S407: Obtain the user's user information.

[0148] In this embodiment of the invention, the same user can correspond to multiple roles, and the resource access permissions corresponding to different roles can be different, which leads to the user being able to access multiple resources when interacting with the cloud platform.

[0149] Therefore, to determine whether a current user can access the target resource, the user's user information is obtained, and the user's resource access permissions are determined based on the user information.

[0150] Step S408: Determine the resource access permissions corresponding to the user based on the preset permission management configuration file and user information.

[0151] In this embodiment of the invention, the preset permission management configuration file includes multiple correspondences between users, roles, and resource access permissions. User information can be used to identify users, and then, given the current user, the user currently logged into the cloud platform is matched with multiple users in the preset permission management configuration file to determine the user's corresponding resource access permissions.

[0152] Step S409: If the user's corresponding resource access permissions allow access to the target resource, then allow the user to log in to the cloud platform.

[0153] In step S410, if the user's corresponding resource access permissions do not allow access to the target resource, then the user is denied access to the cloud platform.

[0154] The cloud platform login method provided in this embodiment controls whether a user can log in to the cloud platform based on the user's corresponding resource access permissions. This helps to ensure the isolation between different resource access permissions, making it easier to expand and maintain, thereby helping to ensure the security of resources within the cloud platform.

[0155] In some optional embodiments, if a user successfully logs into the cloud platform, the current login risk coefficient is saved so that the cloud platform administrator can clearly understand the login environment of the current user when logging into the cloud platform, thereby better managing the system.

[0156] In some alternative embodiments, the current environment information is stored in the user's historical login log data to update the historical login log data, thereby ensuring the effectiveness and accuracy of security detection of the login environment.

[0157] In some optional implementation scenarios, the authorization code authentication process can be as follows: Figure 5 As shown. Figure 5 This is an authorization code authentication timing interaction diagram provided according to an embodiment of the present invention, including: the current device used by the user for login and the server where the cloud platform is located.

[0158] The user sends an authorization login request to the cloud platform server through the current device. The authorization login request includes: the first domain name address of the resource to be accessed, the target encryption method, the target exchange code parameter, and the access status parameter.

[0159] The cloud platform server performs a security check on the user's current login environment to determine the current login risk level. If the current login risk level exceeds a specified threshold, the user is authenticated using a targeted authentication method. Once authentication is successful, authorization is granted to the user, and a first authorization code corresponding to the first domain name address is sent to the current device.

[0160] The current device sends a token access request to the server where the cloud platform is located using the second authorization code, a random verification string, the first domain name address, access status parameters, and the current device credentials.

[0161] The cloud platform server verifies the validity of the second authorization code and the random verification string. If the verification is successful, the authentication result is passed, and an access token is sent to the current device.

[0162] The device currently sends a resource access request to the server hosting the cloud platform using an access token.

[0163] When the server hosting the cloud platform determines that a user's corresponding resource access permissions allow access to the target resource, it allows the user to log in to the cloud platform and sends the resource the user needs to access to the current device.

[0164] The cloud platform login method provided by this invention combines login environment detection with authorization codes, enhancing security while providing users with a more convenient authorization method for login. Specifically, the unique login environment detection algorithm models and analyzes the user environment, improving login security. Furthermore, the use of PKCE (Proof Key for Code Exchange) + authorization code to issue access tokens eliminates the token leakage risk inherent in traditional authorization codes, thereby enhancing login convenience.

[0165] This embodiment also provides a cloud platform login device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0166] This embodiment provides a cloud platform login device, such as... Figure 6 As shown, it includes:

[0167] The acquisition module 601 is used to respond to the authorization login request sent by the user and obtain the current environment information of the user's current login.

[0168] The environmental monitoring module 602 is used to perform security checks on the user's current login environment based on the current environmental information and determine the current login risk coefficient.

[0169] The filtering module 603 is used to determine the target authentication method from multiple pending authentication methods based on the current login risk coefficient if the current login risk coefficient is greater than a specified coefficient threshold.

[0170] The first authentication execution module 604 is used to perform authorization code authentication on the user if the user passes the identity authentication corresponding to the target authentication method, and obtain the authentication result.

[0171] The sending module 605 is used to send an access token to the user if the authentication result is successful, so that the user can log in to the cloud platform with the access token.

[0172] In some optional implementations, the environment monitoring module 602 includes: a first information determination unit, used to determine the user's preferred login environment information based on the user's historical login log data; and a detection unit, used to perform security detection on the user's current login environment based on the comparison result between the current environment information and the preferred login environment information, and determine the current login risk coefficient.

[0173] In some optional implementations, the current environment information includes: current login time, current login region, current Internet Protocol address, and the current device model used by the user for login; the habitual login environment information includes: habitual login time period, historical login region, historical Internet Protocol address, historical device model, and historical login method; the detection unit includes: a first determining unit, used to determine a first detection value based on a first comparison result between the current login time and the habitual login time period; a second determining unit, used to determine a second comparison result between the current login region and the historical login region, and a third comparison result between the current Internet Protocol address and the historical Internet Protocol address; a third determining unit, used to determine a second detection value based on the second and third comparison results; a fourth determining unit, used to determine a third detection value based on a fourth comparison result between the current device model and the historical device model; a fifth determining unit, used to determine a fourth detection value based on a fifth comparison result between the historical login method and the target login method; and a detection subunit, used to input the first detection value, the second detection value, the third detection value, and the fourth detection value into a preset security risk model to perform security detection on the user's current login environment, and use the output of the security risk model as the current login risk coefficient.

[0174] In some optional implementations, the filtering module 603 includes: a matching unit, used to match the current login risk coefficient with multiple preset login risk coefficient intervals to determine a target login risk coefficient interval, wherein the target login risk coefficient interval is a login risk coefficient interval that includes the current login risk coefficient among the multiple login risk coefficient intervals, and different login risk coefficient intervals correspond to different identity authentication methods; and a sixth determining unit, used to determine the identity authentication method corresponding to the target login risk coefficient interval as the target authentication method.

[0175] In some optional implementations, the apparatus further includes a second authentication execution module, configured to prohibit user login if the current login risk coefficient is less than or equal to a specified coefficient threshold.

[0176] In some optional implementations, the authorized login request includes: a first domain name address (DN) for the resource to be accessed, a target encryption method, and a target exchange code parameter; the first authentication execution module 604 includes: a first sending unit, used to send a first authorization code corresponding to the first DN name address to the user; a receiving unit, used to receive a token access request sent by the user, the token access request including: a second authorization code, a random verification string, and the first DN name address for the resource to be accessed; an encryption unit, used to encrypt the random verification string using the target encryption method to generate the current exchange code parameter; a seventh determining unit, used by the first execution unit, to determine that the authentication result is passed if the current exchange code parameter is the same as the target exchange code parameter and the second authorization code is the same as the first authorization code; and a second execution unit, used to determine that the authentication result is failed if the current exchange code parameter is different from the target exchange code parameter and / or the second authorization code is different from the first authorization code.

[0177] In some optional embodiments, the apparatus further includes: a resource determination module, configured to determine the target resource to be accessed by the user in response to a resource access request sent by the user via an access token; an information acquisition module, configured to acquire the user's user information; a permission determination unit, configured to determine the user's corresponding resource access permissions based on a preset permission management configuration file and the user information; a first login control module, configured to allow the user to log in to the cloud platform if the user's corresponding resource access permissions allow access to the target resource; and a second login control module, configured to refuse the user's login to the cloud platform if the user's corresponding resource access permissions do not allow access to the target resource.

[0178] In some alternative implementations, the apparatus further includes a first storage module for saving the current login risk coefficient if the user successfully logs into the cloud platform.

[0179] In some alternative implementations, the apparatus further includes a second storage module for storing current environment information into the user's historical login log data to update the historical login log data.

[0180] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0181] In this embodiment, the cloud platform login device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0182] This invention also provides a computer device having the above-described features. Figure 6The cloud platform login device shown.

[0183] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 7 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 7 Take a processor 10 as an example.

[0184] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0185] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0186] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0187] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0188] The computer device also includes an input device 30 and an output device 40. The processor 10, memory 20, input device 30, and output device 40 can be connected via a bus or other means. Figure 7 Taking the example of a connection between China and Israel via a bus.

[0189] Input device 30 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the computer device, such as a touchscreen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 40 may include display devices, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors). The aforementioned display devices include, but are not limited to, liquid crystal displays, light-emitting diodes, displays, and plasma displays. In some alternative embodiments, the display device may be a touchscreen.

[0190] This invention also provides a computer-readable storage medium. The methods provided in the embodiments of the present invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that a computer, processor, microprocessor controller, or programmable hardware includes storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the embodiments above.

[0191] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A cloud platform login method, characterized by, The method comprises: in response to receiving an authorization login request sent by a user, obtaining current environment information of the user currently logged in; based on the current environment information, performing security detection on the current login environment of the user to determine a current login risk coefficient; if the current login risk coefficient is greater than a specified coefficient threshold, determining a target authentication mode from a plurality of to-be-executed identity authentication modes based on the current login risk coefficient; if the user passes the identity authentication corresponding to the target authentication mode, performing authorization code authentication on the user to obtain an authentication result; if the authentication result is passed, sending an access token to the user to enable the user to log in to the cloud platform through the access token; the security detection on the current login environment of the user based on the current environment information to determine a current login risk coefficient comprises: based on historical login log data of the user, determining habitual login environment information of the user; based on a comparison result between the current environment information and the habitual login environment information, performing security detection on the current login environment of the user to determine a current login risk coefficient; the current environment information comprises: current login time, current login region, current internet protocol address and current device model used by the user currently logged in; the habitual login environment information comprises: habitual login period, historical login region, historical internet protocol address, historical device model and historical login mode; the security detection on the current login environment of the user based on the comparison result between the current environment information and the habitual login environment information comprises: based on a first comparison result between the current login time and the habitual login period, determining a first detection value; respectively determining a second comparison result between the current login region and the historical login region, and determining a third comparison result between the current internet protocol address and the historical internet protocol address; determining a second detection value according to the second comparison result and the third comparison result; based on a fourth comparison result between the current device model and the historical device model, determining a third detection value; based on a fifth comparison result between the historical login mode and a target login mode, determining a fourth detection value; inputting the first detection value, the second detection value, the third detection value and the fourth detection into a preset security risk model to perform security detection on the current login environment of the user, and taking an output result of the security risk model as the current login risk coefficient; wherein a target function corresponding to the security risk model is determined by the following formula: ； A1 represents the first detection value, A2 represents the second detection value, A3 represents the third detection value, A4 represents the fourth detection value, and B1 represents the current login risk coefficient.

2. The method of claim 1, wherein, the determination of the target authentication mode from the plurality of to-be-executed identity authentication modes based on the current login risk coefficient comprises: match the current login risk coefficient with preset login risk coefficient intervals to determine a target login risk coefficient interval, wherein the target login risk coefficient interval is a login risk coefficient interval in the login risk coefficient intervals that includes the current login risk coefficient, and different login risk coefficient intervals correspond to different identity authentication manners; determine an identity authentication manner corresponding to the target login risk coefficient interval as a target authentication manner.

3. The method of claim 2, wherein, The method further includes: if the current login risk coefficient is less than or equal to the specified coefficient threshold, then the user is prohibited from logging in.

4. The method of claim 1, wherein the authorized login request includes a first domain name address to be accessed, a target encryption manner, and a target exchange code parameter; the authorization code authentication of the user includes: sending a first authorization code corresponding to the first domain name address to the user; receiving a token access request sent by the user, the token access request including a second authorization code, a random check string, and the first domain name address to be accessed; encrypting the random check string using the target encryption manner to generate a current exchange code parameter; if the current exchange code parameter is the same as the target exchange code parameter and the second authorization code is the same as the first authorization code, then the authentication result is determined to be passed; if the current exchange code parameter is different from the target exchange code parameter and / or the second authorization code is different from the first authorization code, then the authentication result is determined to be failed.

5. The method of claim 1, wherein, The method further includes: in response to receiving a resource access request sent by the user through the access token, determining a target resource to be accessed by the user; obtaining user information of the user; based on a preset permission management configuration file and the user information, determining a resource access permission corresponding to the user; if the resource access permission corresponding to the user can access the target resource, then the user is allowed to log in to the cloud platform; if the resource access permission corresponding to the user cannot access the target resource, then the user is denied to log in to the cloud platform.

6. The method of claim 5, wherein, The method further includes: if the user successfully logs in to the cloud platform, then the current login risk coefficient is saved.

7. The method according to claim 5 or 6, characterized in that, The method further includes: storing the current environment information in historical login log data of the user to update the historical login log data.

8. A cloud platform login apparatus characterized by comprising: The apparatus includes: an obtaining module configured to obtain current environment information of a user currently logging in, in response to receiving an authorized login request sent by the user; an environment monitoring module configured to perform security detection on a current login environment of the user based on the current environment information, and determine a current login risk coefficient; a screening module configured to, if the current login risk coefficient is greater than a specified coefficient threshold, determine a target authentication manner from a plurality of to-be-executed identity authentication manners based on the current login risk coefficient; a first authentication execution module configured to, if the user passes an identity authentication corresponding to the target authentication manner, perform authorization code authentication on the user, and obtain an authentication result. The sending module is configured to send an access token to the user if the authentication result is passed, so that the user logs in the cloud platform through the access token. The environment monitoring module comprises: a first information determination unit configured to determine habitual login environment information of the user based on historical login log data of the user; and a detection unit configured to perform security detection on a current login environment of the user based on a comparison result between current environment information and the habitual login environment information, and determine a current login risk coefficient. The current environment information comprises: a current login time, a current login region, a current Internet Protocol address, and a current device model used by the user for current login; the habitual login environment information comprises: a habitual login time period, a historical login region, a historical Internet Protocol address, a historical device model, and a historical login manner; the detection unit comprises: a first determination unit configured to determine a first detection value based on a first comparison result between the current login time and the habitual login time period; a second determination unit configured to determine a second comparison result between the current login region and the historical login region, and determine a third comparison result between the current Internet Protocol address and the historical Internet Protocol address; a third determination unit configured to determine a second detection value according to the second comparison result and the third comparison result; a fourth determination unit configured to determine a third detection value based on a fourth comparison result between the current device model and the historical device model; a fifth determination unit configured to determine a fourth detection value based on a fifth comparison result between the historical login manner and a target login manner; and a detection subunit configured to input the first detection value, the second detection value, the third detection value, and the fourth detection value into a preset security risk model to perform security detection on the current login environment of the user, and take an output result of the security risk model as the current login risk coefficient. The target function corresponding to the security risk model is determined by using the following formula: ； A1 represents the first detection value, A2 represents the second detection value, A3 represents the third detection value, A4 represents the fourth detection value, and B1 represents the current login risk coefficient.

9. A computer device, comprising: The cloud platform login method comprises: A memory and a processor in communication connection with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the cloud platform login method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to make a computer execute the cloud platform login method according to any one of claims 1 to 7.

Images