Login authentication method and device, computer device, and storage medium

Abstract

The application relates to a login authentication method and device, computer equipment and a storage medium. The method comprises the following steps: in response to an authentication request sent by a client, obtaining authentication information and historical interaction information of the client; determining a direct trust value for the client according to the historical interaction information, and determining an indirect trust value for the client according to the authentication information; performing fusion processing on the direct trust value and the indirect trust value to obtain a comprehensive trust value for the client; in the case that the comprehensive trust value is greater than a threshold value, adjusting a data access permission value corresponding to the client to obtain an adjusted data access permission value; determining an authentication mode for the client based on the adjusted data access permission value, and performing login authentication on the client based on the authentication mode. The method can improve the security and reliability of login authentication.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a login authentication method and device, a computer device, a storage medium, and a computer program product. BACKGROUND

[0002] At present, the main security risks for enterprises are data leakage from the internal network and attacks from the external network. In existing networks, the internal network environment is more secure than the external network by default, so the internal network environment, devices, and identities are trusted by default. Therefore, existing network systems provide security protection for clients / systems in the same authentication manner.

[0003] However, the login authentication method in the same authentication manner is easy to crack and has low security. SUMMARY

[0004] Therefore, it is necessary to provide a login authentication method, device, computer device, computer readable storage medium, and computer program product to solve the technical problem that the above method is easy to crack and has low security.

[0005] In a first aspect, the present application provides a login authentication method. The method comprises:

[0006] In response to an authentication request sent by a client, obtaining authentication information and historical interaction information of the client; the historical interaction information represents historical interaction information between the client and an authentication gateway;

[0007] According to the historical interaction information, determining a direct trust value for the client, and according to the authentication information, determining an indirect trust value for the client;

[0008] Fusing the direct trust value and the indirect trust value to obtain a comprehensive trust value for the client;

[0009] If the comprehensive trust value is greater than a threshold value, adjusting a data access permission value corresponding to the client to obtain an adjusted data access permission value;

[0010] Based on the adjusted data access permission value, determining an authentication manner for the client, and performing login authentication on the client based on the authentication manner.

[0011] In one embodiment, the historical interaction information includes the number of successful logins and the number of failed logins of the client in the past; and the direct trust value for the client is determined according to the historical interaction information, comprising:

[0012] obtaining an expected model, a reward model, a decay model and a time decay factor of the client login success;

[0013] constructing a direct trust degree calculation model according to the expected model, the reward model, the decay model and the time decay factor;

[0014] processing the success times and the failure times in the historical interaction information through the direct trust degree calculation model to obtain the direct trust degree value.

[0015] In one of the embodiments, the authentication information includes information of multiple authentication factors; and the determining the indirect trust degree value of the client according to the authentication information includes:

[0016] obtaining an indirect trust value of each authentication factor, and determining a first weight of each authentication factor based on the indirect trust value; the indirect trust value and the first weight are in a positive correlation relationship;

[0017] performing weighted sum processing on the indirect trust values of the authentication factors according to the first weights of the authentication factors to obtain the indirect trust degree value.

[0018] In one of the embodiments, the obtaining the indirect trust value of each authentication factor includes:

[0019] obtaining reference information of each authentication factor when the client logs in successfully in the past;

[0020] obtaining a similarity between the information of each authentication factor and the corresponding reference information, and determining the indirect trust value of each authentication factor based on the similarity.

[0021] In one of the embodiments, the data access permission value corresponding to the client is determined in the following manner:

[0022] obtaining permission information of the client;

[0023] querying a preset mapping table of permission information and data access permission values according to the permission information to obtain the data access permission value corresponding to the client.

[0024] In one of the embodiments, the historical interaction information includes success times and failure times of the client historical login; and the adjusting the data access permission value corresponding to the client to obtain an adjusted data access permission value when the comprehensive trust degree value is greater than a threshold value includes:

[0025] obtaining an average value of the success times and the failure times when the comprehensive trust degree value is greater than the threshold value;

[0026] if the success times are greater than the average value, obtaining a permission attenuation factor;

[0027] performing reduction processing on the data access permission value by using the permission attenuation factor, to obtain an adjusted data access permission value.

[0028] In one of the embodiments, the authentication mode for the client is determined based on the adjusted data access permission value, including:

[0029] The authentication mode for the client is determined based on the adjusted data access permission value, in a positive correlation relationship between the adjusted data access permission value and the complexity of the authentication mode.

[0030] In one of the embodiments, the direct trust value and the indirect trust value are fused to obtain a comprehensive trust value for the client, including:

[0031] A second weight preset for the direct trust value and the indirect trust value is obtained.

[0032] The direct trust value and the indirect trust value are weighted and summed according to the second weight, to obtain a comprehensive trust value for the client.

[0033] In a second aspect, the application further provides a login authentication device. The device includes:

[0034] An information obtaining module is configured to obtain authentication information and historical interaction information of a client in response to an authentication request sent by the client, wherein the historical interaction information represents historical interaction information between the client and an authentication gateway.

[0035] A trust degree determining module is configured to determine a direct trust value for the client according to the historical interaction information, and determine an indirect trust value for the client according to the authentication information.

[0036] A trust degree fusing module is configured to fuse the direct trust value and the indirect trust value to obtain a comprehensive trust value for the client.

[0037] A permission value adjusting module is configured to adjust a data access permission value corresponding to the client to obtain an adjusted data access permission value, if the comprehensive trust value is greater than a threshold value.

[0038] A mode determining module is configured to determine an authentication mode for the client based on the adjusted data access permission value, and perform login authentication on the client based on the authentication mode.

[0039] In a third aspect, the present application also provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0040] In response to an authentication request sent by a client, obtaining authentication information and historical interaction information of the client; the historical interaction information represents historical interaction information between the client and an authentication gateway;

[0041] According to the historical interaction information, determining a direct trust value for the client, and according to the authentication information, determining an indirect trust value for the client;

[0042] Fusing the direct trust value and the indirect trust value to obtain a comprehensive trust value for the client;

[0043] In the case where the comprehensive trust value is greater than a threshold value, adjusting a data access permission value corresponding to the client to obtain an adjusted data access permission value;

[0044] Based on the adjusted data access permission value, determining an authentication mode for the client, and performing login authentication on the client based on the authentication mode.

[0045] In a fourth aspect, the present application also provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0046] In response to an authentication request sent by a client, obtaining authentication information and historical interaction information of the client; the historical interaction information represents historical interaction information between the client and an authentication gateway;

[0047] According to the historical interaction information, determining a direct trust value for the client, and according to the authentication information, determining an indirect trust value for the client;

[0048] Fusing the direct trust value and the indirect trust value to obtain a comprehensive trust value for the client;

[0049] In the case where the comprehensive trust value is greater than a threshold value, adjusting a data access permission value corresponding to the client to obtain an adjusted data access permission value;

[0050] Based on the adjusted data access permission value, determining an authentication mode for the client, and performing login authentication on the client based on the authentication mode.

[0051] In a fifth aspect, the present application also provides a computer program product. The computer program product comprises a computer program which, when executed by a processor, implements the following steps:

[0052] In response to an authentication request sent by a client, obtaining authentication information and historical interaction information of the client; the historical interaction information represents historical interaction information between the client and an authentication gateway;

[0053] According to the historical interaction information, determining a direct trust value for the client, and according to the authentication information, determining an indirect trust value for the client;

[0054] Fusing the direct trust value and the indirect trust value to obtain a comprehensive trust value for the client;

[0055] In the case where the comprehensive trust value is greater than a threshold value, adjusting a data access permission value corresponding to the client to obtain an adjusted data access permission value;

[0056] Based on the adjusted data access permission value, determining an authentication mode for the client, and performing login authentication on the client based on the authentication mode.

[0057] The above login authentication method, device, computer device, storage medium and computer program product, in response to an authentication request sent by a client, obtain authentication information and historical interaction information of the client; according to the historical interaction information, determine a direct trust value for the client, and according to the authentication information, determine an indirect trust value for the client; further fuse the direct trust value and the indirect trust value to obtain a comprehensive trust value for the client; in the case where the comprehensive trust value is greater than a threshold value, adjust a data access permission value corresponding to the client to obtain an adjusted data access permission value; based on the adjusted data access permission value, determine an authentication mode for the client, and perform login authentication on the client based on the authentication mode. The method determines a comprehensive trust value, adjusts a data access permission value corresponding to the client in the case where the comprehensive trust value is greater than a threshold value, so that the login mode can be dynamically determined based on the dynamically changing data access permission value, thereby improving the security and reliability of login authentication. BRIEF DESCRIPTION OF DRAWINGS

[0058] Figure 1 An application environment diagram of the login authentication method in an embodiment;

[0059] Figure 2 A flowchart of the login authentication method in an embodiment;

[0060] Figure 3A schematic diagram of an architecture of a login authentication method in an embodiment;

[0061] Figure 4 A schematic diagram of a flow of a login authentication method in another embodiment;

[0062] Figure 5 A schematic diagram of an interaction process between a client, an authentication gateway and an operator authentication gateway in an embodiment;

[0063] Figure 6 A block diagram of a login authentication apparatus in an embodiment;

[0064] Figure 7 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0065] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application.

[0066] It should be noted that the terms "first", "second" and the like in the description and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0067] The login authentication method provided by the embodiments of the present application can be applied to, for example, Figure 1The application environment shown. Among them, the client 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. In the application scenario of the present application, the client 102 sends an authentication request to the server 104 based on the user's operation, and the server 104 obtains the authentication information and historical interaction information of the client 102 based on the authentication request; the historical interaction information represents the historical interaction information between the client 102 and the authentication gateway; according to the historical interaction information, the direct trust value for the client 102 is determined, and according to the authentication information, the indirect trust value for the client 102 is determined; the direct trust value and the indirect trust value are fused to obtain the comprehensive trust value for the client 102; in the case where the comprehensive trust value is greater than the threshold value, the data access permission value corresponding to the client 102 is adjusted to obtain the adjusted data access permission value; based on the adjusted data access permission value, the authentication method for the client 102 is determined, and the client 102 is logged in based on the authentication method. Among them, the client 102 can be installed in various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart televisions, smart air conditioners, smart vehicle devices, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be realized by an independent server or a server cluster composed of multiple servers.

[0068] In one embodiment, as shown in Figure 2 , a login authentication method is provided, and the method is applied to Figure 1 104 for example, including the following steps:

[0069] Step S210, in response to the authentication request sent by the client, the authentication information and the historical interaction information of the client are obtained; the historical interaction information represents the historical interaction information between the client and the authentication gateway.

[0070] Among them, the authentication information can include the information of the authentication factors such as the device information of the login client, the network environment, the authentication protocol and the network access method. Among them, the device information further includes login account information (such as mobile phone number) or password, port and device hardware identification, etc. Among them, the network access method can include dial-up network, ISDN (Integrated Service Digital Network, Integrated Service Digital Network) network, broadband network, optical fiber broadband network and wireless network, etc.

[0071] Among them, historical interaction information represents the client's login status when accessing resources in the past, which may include the number of successful logins and the number of failed logins in the past.

[0072] In practice, when an authentication request is received from a user through a client, the client's authentication information and historical interaction information can be obtained. Based on the authentication information and historical interaction information, the trustworthiness of the client can be determined, thereby determining the authentication method for the client.

[0073] Step S220: Determine the direct trust value for the client based on historical interaction information, and determine the indirect trust value for the client based on authentication information.

[0074] The direct trust score can be understood as the satisfaction rating of the authentication gateway directly associated with the client with the successful data of historical interactions between the access subject (i.e., the client) and the accessed resource.

[0075] The indirect trust value can be understood as the satisfaction assessment value of other authentication gateways associated with the client (such as the operator's authentication gateway) regarding the information of the access subject device (the device logging in to the client), the network environment, the authentication protocol, and the network access method.

[0076] In practice, the calculation of the direct trust value for the client can be achieved by first constructing a direct trust calculation model, and then processing historical interaction information through this model to obtain the direct trust value. More specifically, historical interaction information includes the number of successful and failed login attempts by the client. These numbers can be input into the direct trust calculation model to obtain the direct trust value for the client.

[0077] The indirect trust value of the client can be calculated by first obtaining the indirect trust values ​​of factors such as device information, network environment, authentication protocol and network access method, and then fusing the indirect trust values ​​corresponding to each factor.

[0078] Step S230: The direct trust value and the indirect trust value are fused to obtain the comprehensive trust value for the client.

[0079] In practice, since the direct trust value and the indirect trust value have different degrees of influence on the client's trust level, different weights can be assigned to the direct trust value and the indirect trust value. Furthermore, the direct trust value and the indirect trust value are weighted and fused together to obtain the comprehensive trust value for the client.

[0080] Step S240: If the overall trust value is greater than the threshold, adjust the data access permission value corresponding to the client to obtain the adjusted data access permission value.

[0081] The data access permission value represents the difficulty of accessing the data resource. Specifically, the lower the data access permission value, the simpler the access to the data resource; the higher the data access permission value, the more difficult the access to the data resource.

[0082] In a specific implementation, to ensure the security and convenient management of the data resource, the range or level of the resources accessible by different users is generally set to be different in the existing network system. For example, the resources accessible by the administrator and the ordinary user are different, that is, different users have different permission levels. Therefore, the login user corresponding to the client itself has permission information, and according to the permission information, the fixed data access permission value corresponding to the client can be determined.

[0083] It can be understood that if the fixed data access permission value is used to determine the login mode, the determined login mode will be exactly the same every time, which is difficult to ensure the security of login. Therefore, the application dynamically adjusts the fixed data access permission value in combination with the comprehensive trust value, so that the authentication mode can be dynamically determined according to the adjusted data access permission value, to improve the security and reliability of authentication.

[0084] In a specific implementation, before the fixed data access permission value is dynamically adjusted based on the comprehensive trust value, it is necessary to determine the size relationship between the comprehensive trust value and the preset threshold value. If the comprehensive trust value is less than or equal to the threshold value, it indicates that the trustworthiness or security of the client is low, and the data access permission value cannot be adjusted, but the fixed data access permission value is directly used to determine the authentication mode for the client. If the comprehensive trust value is greater than the threshold value, it indicates that the trustworthiness of the client is high, and the data access permission value can be adjusted, and the authentication mode for the client is determined through the adjusted data access permission value.

[0085] In step S250, the authentication mode for the client is determined based on the adjusted data access permission value, and the client is logged in and authenticated based on the authentication mode.

[0086] The authentication mode can include password authentication, token authentication, and biometric authentication (such as face authentication and fingerprint authentication).

[0087] In a specific implementation, a relationship between the adjusted data access permission value and the authentication manner can be determined first, and the authentication manner is determined based on the relationship. More specifically, the adjusted data access permission value is positively correlated with the complexity of the authentication manner. Based on the positive correlation, a plurality of data access permission value intervals can be preset, each data access permission value interval has a corresponding authentication manner. After obtaining the adjusted data access permission value, a target data access permission value interval corresponding to the adjusted data access permission value in the plurality of preset data access permission value intervals is determined, and the authentication manner corresponding to the target data access permission value interval is taken as the authentication manner for the client.

[0088] For example, the adjusted data access permission value is 6, which corresponds to the data access permission value interval of 6-10, and the data access permission value interval of 6-10 corresponds to the two-factor authentication manner, i.e., the authentication manner including two authentication manners. Therefore, based on the adjusted data access permission value 6, it can be determined that the authentication manner corresponding to the client is the two-factor authentication manner.

[0089] For another example, the adjusted data access permission value is 3, which corresponds to the data access permission value interval of 1-5, and the data access permission value interval of 1-5 corresponds to the single-factor authentication manner. Therefore, based on the adjusted data access permission value 3, it can be determined that the authentication manner corresponding to the client is the single-factor authentication manner.

[0090] In the above login authentication method, in response to the authentication request sent by the client, the authentication information and the historical interaction information of the client are obtained. The direct trust degree value for the client is determined according to the historical interaction information, and the indirect trust degree value for the client is determined according to the authentication information. The direct trust degree value and the indirect trust degree value are further fused to obtain a comprehensive trust degree value for the client. In the case where the comprehensive trust degree value is greater than a threshold value, the data access permission value corresponding to the client is adjusted to obtain an adjusted data access permission value. The authentication manner for the client is determined based on the adjusted data access permission value, and the client is authenticated based on the authentication manner. This method determines the comprehensive trust degree value, adjusts the data access permission value corresponding to the client in the case where the comprehensive trust degree value is greater than the threshold value, so that the login manner can be dynamically determined based on the dynamically changing data access permission value, thereby improving the security and reliability of the login authentication.

[0091] In an exemplary embodiment, the historical interaction information includes the number of successful logins and the number of failed logins of the client in the past; and in step S220, the direct trust degree value for the client is determined according to the historical interaction information, including:

[0092] In step S221, an expected model, a reward model, a decay model, and a time decay factor for the successful login of the client are obtained.

[0093] In this step, both the reward model and the decay model can use the tanh function, where x is the number of successful historical access resources / login of the client, y is the number of failed historical access resources / login of the client, and x+y represents the total number of accesses, wherein x and y are integers. The reward model and the decay model can be represented as follows, respectively:

[0094] Reward model:

[0095] Decay model:

[0096] The expectation model can use the Beta distribution function, which better fits the reputation distribution, and the expected value is obtained as formula (3):

[0097]

[0098] The time decay factor can be represented as formula (4):

[0099] t0 is the time of the last successful authentication.

[0100] Step S222, according to the expectation model, the reward model, the decay model and the time decay factor, a direct trust degree calculation model is constructed.

[0101] The time decay factor is used to adjust the reward degree of the reward model.

[0102] In this step, considering that the reward model changes dynamically over time, a time decay factor is introduced to act on it. The decay model takes into account the interactive time gap factor, so there is no need to repeatedly consider the time decay factor of the decay model. Obviously, the reward degree of the reward model is not as strong as the decay degree, and it will decrease to different degrees with the length of the interaction gap, so according to the expectation model, the reward model, the decay model and the time decay factor, the direct trust degree calculation model can be represented as formula (5) as follows:

[0103]

[0104] Where C direct represents the direct trust degree value, x and y are the number of successful and failed historical access resources / login of the client, respectively, and k is the time decay factor of the reward model.

[0105] Step S223, the number of successes and failures is processed by the direct trust degree calculation model to obtain the direct trust degree value.

[0106] Specifically, after obtaining the direct trust degree calculation model, the success times x and the failure times y can be input into the direct trust degree calculation model for calculation processing to obtain the direct trust degree value.

[0107] The direct trust degree value calculation method provided by the embodiment is based on the success times and the failure times in the historical interaction information, establishes an incentive feedback mechanism, constructs a reward model according to the success times and a decay model according to the failure times, and simultaneously introduces a time decay factor to dynamically change the incentive strength of the reward model with time, so that the trust degree value obtained can be dynamically adjusted with time, and the accuracy of the determined direct trust degree value is improved.

[0108] In an example embodiment, the authentication information includes information of a plurality of authentication factors; and in the step S220, the indirect trust degree value for the client is determined according to the authentication information, including:

[0109] In step S224, the indirect trust values of the authentication factors are obtained, and the first weights of the authentication factors are determined based on the indirect trust values; the indirect trust values and the first weights are in a positive correlation relationship.

[0110] In step S225, the indirect trust values of the authentication factors are weighted and summed according to the first weights of the authentication factors to obtain the indirect trust degree value.

[0111] The first weight can represent the influence degree of each authentication factor on the indirect trust degree value.

[0112] The sum of the first weights of the authentication factors is 1.

[0113] In a specific implementation, the authentication factors can include a network environment, device information, an authentication protocol, and a network access mode, etc. After obtaining the indirect trust values of the authentication factors, the first weights of the authentication factors can be determined according to the positive correlation relationship between the indirect trust values and the first weights. That is, the greater the indirect trust value of a certain authentication factor, the greater the influence degree of the authentication factor on the indirect trust degree value, and the higher the first weight of the authentication factor; on the contrary, the smaller the indirect trust value, the smaller the influence degree of the authentication factor on the indirect trust degree value, and the lower the first weight of the authentication factor. After determining the first weights of the authentication factors, the indirect trust values of the authentication factors can be weighted and summed according to the first weights of the authentication factors to obtain the indirect trust degree value. The specific weighted sum process can be represented as follows:

[0114]

[0115] wherein C indirect represents the indirect trust degree value, i, j, k, and l respectively represent the network environment, the device information, the authentication protocol, and the network access mode, w i, w j , w k , w l respectively represent the first weights of the four authentication factors of network environment, device information, authentication protocol and network access mode, w i , w j , w k , w l respectively represent the indirect trust values of the four authentication factors of network environment, device information, authentication protocol and network access mode.

[0116] The indirect trust degree value calculation method provided in the embodiment adopts multiple authentication factors to participate in the calculation and evaluation of the indirect trust degree value, overcomes the defect in the traditional method that only the behavior interaction factor is involved in the trust degree evaluation and no environmental device factor is considered, and determines the first weight of each authentication factor based on the indirect trust value of each authentication factor, instead of setting the weight proportion based on subjective consciousness, so that the accuracy of the determined first weight can be improved, and thus the accuracy of the determined indirect trust degree value can be improved.

[0117] Further, in an exemplary embodiment, in step S224, the indirect trust value of each authentication factor is obtained, including: obtaining the reference information of each authentication factor when the client successfully logs in; obtaining the similarity between the information of each authentication factor and the corresponding reference information, and determining the indirect trust value of each authentication factor based on the similarity.

[0118] In a specific implementation, the indirect trust value of each authentication factor can be determined by comparing the information of each authentication factor with the reference information of each authentication factor that can successfully log in, obtaining the similarity between the information of each authentication factor and the corresponding reference information, and determining the indirect trust value of each authentication factor based on the similarity.

[0119] More specifically, the reference information of each authentication factor can be obtained from the historical interaction information when the client successfully logs in, and the information of each authentication factor when successfully logging in is taken as the reference information. The indirect trust value of each authentication factor can be determined based on the corresponding similarity of each authentication factor, which can be directly taken as the indirect trust value of each authentication factor, or can be converted into the indirect trust value of each authentication factor through a preset conversion relationship between the similarity and the indirect trust value.

[0120] In the embodiment, the indirect trust value of each authentication factor is determined based on the similarity between the information of each authentication factor and the reference information of each authentication factor when the client successfully logs in, which can ensure the credibility of the determined indirect trust value, and thus improve the accuracy of the indirect trust degree value determined based on the indirect trust value of each authentication factor.

[0121] In an example embodiment, the data access permission value corresponding to the client can be determined by: obtaining the permission information of the client; querying a preset mapping table of permission information and data access permission values according to the permission information to obtain the data access permission value corresponding to the client.

[0122] In a specific implementation, since different users have different permission levels, the login user corresponding to the client itself has permission information, and the permission information corresponding to the client can be obtained. According to the permission information, a preset mapping table of permission information and data access permission values is queried to obtain a fixed data access permission value corresponding to the client.

[0123] More specifically, the permission information corresponding to the client can be a permission level, for example, level one and level two. In the mapping table, the data access permission values corresponding to different permission levels are recorded. The higher the permission level, the simpler the data access, and the lower the data access permission value.

[0124] In this embodiment, the mapping table of permission information and data access permission values is preset, so that after obtaining the permission information of the client, the mapping table can be directly queried, thereby improving the efficiency of determining the data access permission value corresponding to the client.

[0125] In an example embodiment, the historical interaction information includes the number of successful logins and the number of failed logins of the client in the past; and the data access permission value corresponding to the client is adjusted to obtain an adjusted data access permission value in the case where the comprehensive trust value is greater than the threshold in step S240, which can be achieved by the following steps:

[0126] Step S241, in the case where the comprehensive trust value is greater than the threshold, obtaining the average value of the number of successful logins and the number of failed logins;

[0127] Step S242, if the number of successful logins is greater than the average value, obtaining a permission attenuation factor;

[0128] Step S243, reducing the data access permission value by the permission attenuation factor to obtain the adjusted data access permission value.

[0129] In a specific implementation, the purpose of the present application in adjusting the data access permission value by combining the comprehensive trust value is to simplify the authentication method for the client when the trustworthiness of the client is high, reduce the waste of time, and improve the authentication efficiency. Therefore, the adjustment of the data access permission value is specifically reducing the data access permission value.

[0130] Further, in addition to the comprehensive trust value, the evaluation of the credibility of the client can also be combined with the success of the historical interaction of the client. Specifically, in the case where the comprehensive trust value is greater than the threshold value, the average value of the number of successful logins and the number of failed logins of the client can be obtained, and the number of successful logins is compared with the average value. If the number of successful logins is less than or equal to the average value, it indicates that the credibility of the client is low, and the data access permission value cannot be adjusted, but the fixed data access permission value is directly used to determine the authentication mode for the client. If the number of successful logins is greater than the average value, it indicates that the credibility of the client is high, and the data access permission value can be reduced. The specific reduction method is to reduce the data access permission value by the permission attenuation factor to obtain the adjusted data access permission value, and the adjusted data access permission value is used to determine the authentication mode for the client.

[0131] More specifically, the method of reducing the data access permission value by the permission attenuation factor is to multiply the permission attenuation factor and the data access permission value. The product is equivalent to the permission calculation model constructed according to the permission attenuation factor, the comprehensive trust value, and the metric value of the preset multiple authentication modes. For example, the permission attenuation factor can be represented as x>threshold value, and the data access permission value corresponding to the client is ACL. The calculation formula of the adjusted data access permission value can be represented as:

[0132]

[0133] wherein, represents the adjusted data access permission value, x represents the number of successful logins of the client, C represents the comprehensive trust value for the client, and MFA represents the metric value of the preset multiple authentication modes. For example, it is assumed that the preset multiple authentication modes include password authentication, token authentication, and biometric authentication, and the authentication modes have certain level ratings according to the difficulty level, such as password authentication being low, token authentication being medium, and biometric authentication being high. It is assumed that: password authentication is X=0.4, token authentication is Y=0.7, and biometric authentication is Z=1. Then MFA=X+Y+Z=2.1.

[0134] In this embodiment, on the basis of the comprehensive trust value, the number of successful logins of the client, and the size relationship between the average value of the number of successful logins and the number of failed logins, it is determined whether to adjust the data access permission value corresponding to the client, which further ensures the accuracy of the adjustment result. When the comprehensive trust value and the number of successful logins meet the preset conditions, the data access permission value is reduced to achieve the purpose of dynamically converging the data access permission value, which can reduce the level of the authentication mode, simplify the authentication mode for the client, reduce the waste of time, and improve the authentication efficiency.

[0135] In an example embodiment, in step S250, the authentication manner for the client is determined based on the adjusted data access permission value, including: determining the authentication manner for the client based on the adjusted data access permission value according to a positive correlation between the adjusted data access permission value and the complexity of the authentication manner.

[0136] In a specific implementation, the complexity of the authentication manner can be represented by the type or number of the authentication manner, and the positive correlation between the adjusted data access permission value and the complexity of the authentication manner can be understood as: the greater the adjusted data access permission value, the more complex the authentication manner, i.e., the more types of authentication manner; otherwise, the smaller the adjusted data access permission value, the simpler the authentication manner, i.e., the fewer types of authentication manner. For example, the adjusted data access permission value is 3, and the authentication manner is a single-factor authentication manner; when the adjusted data access permission value is increased to 7, the authentication manner is a two-factor authentication manner; when the adjusted data access permission value is further increased to 14, the authentication manner can be a three-factor authentication manner. After determining the positive correlation between the adjusted data access permission value and the complexity of the authentication manner, the authentication manner for the client can be determined based on the adjusted data access permission value based on the relationship.

[0137] In this embodiment, the authentication manner for the client is determined based on the adjusted data access permission value according to the positive correlation between the adjusted data access permission value and the complexity of the authentication manner, so that the authentication manner can be dynamically adjusted based on the actual situation, overcoming the singleness of using the same authentication manner every time.

[0138] In an example embodiment, in step S230, the direct trust degree value and the indirect trust degree value are fused to obtain the comprehensive trust degree value for the client, including:

[0139] In step S231, a second weight preset for the direct trust degree value and the indirect trust degree value is obtained.

[0140] In step S232, the direct trust degree value and the indirect trust degree value are weighted and summed according to the second weight to obtain the comprehensive trust degree value for the client.

[0141] In a specific implementation, because the direct trust degree value and the indirect trust degree value have different degrees of influence on the trust degree of the client, different weights can be assigned to the direct trust degree value and the indirect trust degree value. Generally, the degree of influence of the direct trust degree value on the trust degree of the client is greater than the degree of influence of the indirect trust degree value on the trust degree of the client. Therefore, a second weight preset for the direct trust degree value is greater than a second weight preset for the indirect trust degree value. Further, the direct trust degree value can be weighted according to the second weight of the direct trust degree value to obtain a weighted direct trust degree value, and the indirect trust degree value can be weighted according to the second weight of the indirect trust degree value to obtain a weighted indirect trust degree value. The weighted direct trust degree value and the weighted indirect trust degree value are added to obtain a comprehensive trust degree value for the client.

[0142] For example, it is assumed that the direct trust degree value C direct The second weight preset for the indirect trust degree value C indirect is w2, and the comprehensive trust degree value C for the client can be represented as:

[0143] C = w1C direct + w2C indirect

[0144] In this embodiment, considering that the direct trust degree value and the indirect trust degree value have different degrees of influence on the trust degree of the client, different second weights are set for the direct trust degree value and the indirect trust degree value, respectively, to weight and fuse the direct trust degree value and the indirect trust degree value through the second weights, so that the obtained comprehensive trust degree value can more accurately represent the trust degree of the client.

[0145] In another embodiment, in order to facilitate those skilled in the art to understand the embodiments of the present application, the following will be described in combination with specific examples of the accompanying drawings. Referring to Figure 3 , the architecture schematic diagram of the login authentication method shown in an embodiment, after obtaining the authentication information of the network environment, device information and the like of the client and the historical interaction information including the number of failures and the number of successes, the direct trust degree value is calculated through a direct trust degree calculation model, and the indirect trust degree value is calculated through an indirect trust degree calculation model, wherein the direct trust degree calculation model is constructed based on a reward model constructed according to the number of successes, a decay model constructed according to the number of failures, an expectation model, and a time decay factor. The comprehensive trust degree value is determined according to the direct trust degree value output by the direct trust degree calculation model and the indirect trust degree value output by the indirect trust degree calculation model. The comprehensive trust degree value, the data access permission value, and the permission decay factor are input into a multi-factor authentication model, and the multi-factor authentication model is used to make a decision on the authentication mode.

[0146] More specifically, as Figure 4As shown, it is a complete flow diagram of the login authentication method shown in an embodiment, and the method includes the following steps:

[0147] In step S401, in response to the authentication request sent by the client, the authentication information and the historical interaction information of the client are obtained; the authentication information includes the information of multiple authentication factors, and the historical interaction information includes the success number and the failure number of the historical login of the client;

[0148] In step S402a, the expected model, the reward model, the decay model and the time decay factor of the successful login of the client are obtained;

[0149] In step S402b, the direct trust degree calculation model is constructed according to the expected model, the reward model, the decay model and the time decay factor;

[0150] In step S402c, the success number and the failure number in the historical interaction information are processed by the direct trust degree calculation model to obtain the direct trust degree value;

[0151] In step S403a, the reference information of each authentication factor when the client logs in successfully is obtained;

[0152] In step S403b, the similarity between the information of each authentication factor and the corresponding reference information is obtained, and the indirect trust value of each authentication factor is determined based on the similarity;

[0153] In step S403c, the first weight of each authentication factor is determined based on the indirect trust value; the indirect trust value and the first weight are in a positive correlation relationship;

[0154] In step S403d, the indirect trust values of the authentication factors are weighted and summed according to the first weights of the authentication factors to obtain the indirect trust degree value;

[0155] In step S404, the second weight preset for the direct trust degree value and the indirect trust degree value is obtained; the direct trust degree value and the indirect trust degree value are weighted and summed according to the second weight to obtain the comprehensive trust degree value of the client;

[0156] In step S405, in the case that the comprehensive trust degree value is greater than a threshold value, the average value of the success number and the failure number is obtained;

[0157] In step S406, if the success number is greater than the average value, the permission decay factor is obtained; the data access permission value is reduced by the permission decay factor to obtain the adjusted data access permission value;

[0158] Step S407, according to the adjusted data access permission value and the complexity of the authentication mode is positively related, based on the adjusted data access permission value, determine the authentication mode for the client.

[0159] In this embodiment, by determining the comprehensive trust value, in the case of the comprehensive trust value being greater than the threshold value, the data access permission value corresponding to the client is adjusted, so that the dynamic determination of the login mode can be performed based on the dynamically changing data access permission value, thereby improving the security and reliability of the login authentication.

[0160] In one embodiment, in order to facilitate those skilled in the art to understand the embodiments of the present application, the following will be described in combination with specific examples of the accompanying drawings. Referring to Figure 5 , the interaction process between the client, the authentication gateway and the operator authentication gateway is shown, wherein the authentication gateway and the operator authentication gateway can be deployed on the server shown in Figure 1 The interaction process between the client, the authentication gateway and the operator authentication gateway is as follows:

[0161] On the client:

[0162] The client sends an authentication request to the authentication gateway.

[0163] On the authentication gateway:

[0164] (1) The authentication gateway acquires the authentication information and the historical interaction information of the client in response to the authentication request sent by the client; wherein the authentication information includes the information of multiple authentication factors, and the historical interaction information includes the number of successful login and the number of failed login of the client.

[0165] (2) A direct trust value calculation model is constructed, and the number of successful login and the number of failed login in the historical interaction information are processed through the direct trust value calculation model to obtain a direct trust value.

[0166] (3) The authentication information is sent to the operator authentication gateway, and the indirect trust value returned by the operator authentication gateway is received.

[0167] (4) According to the second weight preset for the direct trust value and the indirect trust value, the direct trust value and the indirect trust value are weighted and summed to obtain a comprehensive trust value for the client.

[0168] (5) In the case that the comprehensive trust value is greater than the threshold value, and the number of successful login is greater than the average value of the number of successful login and the number of failed login, the data access permission value is reduced by a permission decay factor to obtain an adjusted data access permission value.

[0169] (6) Based on the adjusted data access permission value, the authentication mode for the client is determined.

[0170] On the operator authentication gateway:

[0171] (1) receiving the authentication information sent by the authentication gateway, obtaining the reference information of each authentication factor when the client successfully logs in history;

[0172] (2) determining the indirect trust value of each authentication factor based on the similarity between the information of each authentication factor and the corresponding reference information based on the similarity;

[0173] (3) determining the first weight of each authentication factor based on the indirect trust value, and performing weighted sum processing on the indirect trust value of each authentication factor according to the first weight to obtain the indirect trust value.

[0174] (4) returning the indirect trust value to the authentication gateway.

[0175] It should be understood that although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least part of other steps or steps or stages in other steps.

[0176] Based on the same inventive concept, the embodiments of the present application also provide a login authentication device for implementing the above-mentioned login authentication method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more login authentication device embodiments provided below can refer to the limitations of the login authentication method in the above text, which will not be repeated here.

[0177] In one embodiment, as shown in Figure 6 A login authentication device is provided, comprising: an information acquisition module 610, a trust degree determination module 620, a trust degree fusion module 630, a permission value adjustment module 640 and a mode determination module 650, wherein:

[0178] The information acquisition module 610 is configured to acquire the authentication information and the historical interaction information of the client in response to the authentication request sent by the client; the historical interaction information represents the historical interaction information between the client and the authentication gateway;

[0179] The trust degree determination module 620 is configured to determine a direct trust degree value for the client according to the historical interaction information, and determine an indirect trust degree value for the client according to the authentication information.

[0180] The trust degree fusion module 630 is configured to perform fusion processing on the direct trust degree value and the indirect trust degree value to obtain a comprehensive trust degree value for the client.

[0181] The permission value adjustment module 640 is configured to, in a case where the comprehensive trust degree value is greater than a threshold value, adjust a data access permission value corresponding to the client to obtain an adjusted data access permission value.

[0182] The manner determination module 650 is configured to determine an authentication manner for the client based on the adjusted data access permission value, and perform login authentication on the client based on the authentication manner.

[0183] In one of the embodiments, the historical interaction information includes a number of successful logins and a number of failed logins of the client in the past; the trust degree determination module 620 is further configured to obtain an expectation model, a reward model, a decay model and a time decay factor of the successful logins of the client; construct a direct trust degree calculation model according to the expectation model, the reward model, the decay model and the time decay factor; and process the number of successful logins and the number of failed logins in the historical interaction information through the direct trust degree calculation model to obtain the direct trust degree value.

[0184] In one of the embodiments, the authentication information includes information of a plurality of authentication factors; the trust degree determination module 620 is further configured to obtain an indirect trust value of each authentication factor, determine a first weight of each authentication factor based on the indirect trust value, and perform weighted sum processing on the indirect trust values of the authentication factors according to the first weights to obtain the indirect trust degree value.

[0185] In one of the embodiments, the trust degree determination module 620 is further configured to obtain reference information of each authentication factor when the client successfully logs in in the past, obtain a similarity between the information of each authentication factor and the corresponding reference information, and determine an indirect trust value of each authentication factor based on the similarity.

[0186] In one of the embodiments, the apparatus further includes a permission value determination module configured to obtain permission information of the client, and query a preset mapping table of permission information and data access permission values according to the permission information to obtain a data access permission value corresponding to the client.

[0187] In one of the embodiments, the historical interaction information includes a number of successful logins and a number of failed logins of the client; the authority value adjustment module 640 is further configured to, in a case where the comprehensive trust degree value is greater than a threshold value, obtain an average value of the number of successful logins and the number of failed logins; obtain an authority attenuation factor if the number of successful logins is greater than the average value; and perform a reduction process on the data access authority value by using the authority attenuation factor to obtain an adjusted data access authority value.

[0188] In one of the embodiments, the mode determination module 650 is further configured to determine an authentication mode for the client according to the adjusted data access authority value and a positive correlation between the adjusted data access authority value and a complexity of the authentication mode.

[0189] In one of the embodiments, the trust degree fusion module 630 is further configured to obtain a second weight preset for the direct trust degree value and the indirect trust degree value; and perform a weighted summation process on the direct trust degree value and the indirect trust degree value according to the second weight to obtain a comprehensive trust degree value for the client.

[0190] The modules in the login authentication apparatus can be implemented by software, hardware, or a combination thereof, in whole or in part. The modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in a computer device in software form, so as to be called and executed by a processor to perform operations corresponding to the modules.

[0191] In one embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in Figure 7 The computer device includes a processor, a memory, and a network interface connected by a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store data in a login authentication process. The network interface of the computer device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement a login authentication method.

[0192] Those skilled in the art can understand that Figure 7 The structure shown in the above-mentioned embodiments is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0193] In an embodiment, a computer device is also provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0194] In an embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the steps in the above method embodiments.

[0195] In an embodiment, a computer program product is provided, which comprises a computer program, and the computer program is executed by a processor to implement the steps in the above method embodiments.

[0196] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0197] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0198] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0199] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A login authentication method characterized by, The method comprises: in response to an authentication request sent by a client, obtaining authentication information and historical interaction information of the client; the historical interaction information represents historical interaction information between the client and an authentication gateway, and comprises a number of successful logins and a number of failed logins of the client in the past; the authentication information comprises information of a plurality of authentication factors, and the plurality of authentication factors comprise device information, network environment, authentication protocol and network access mode of the client; determining a direct trust degree value for the client according to the historical interaction information; specifically comprising: obtaining an expectation model, a reward model, a decay model and a time decay factor of successful logins of the client, constructing a direct trust degree calculation model according to the expectation model, the reward model, the decay model and the time decay factor; processing the number of successful logins and the number of failed logins in the historical interaction information through the direct trust degree calculation model to obtain the direct trust degree value; wherein the reward model takes the product of the time decay factor and the number of successful logins as an input variable, the decay model takes the number of failed logins as an input variable, and the expectation model takes the number of successful logins and the number of failed logins as input variables; and obtaining an indirect trust value of each authentication factor in the authentication information, determining a first weight of each authentication factor based on the indirect trust value, and performing weighted sum processing on the indirect trust value of each authentication factor according to the first weight of each authentication factor to obtain an indirect trust degree value for the client; the indirect trust value and the first weight are in a positive correlation relationship; performing fusion processing on the direct trust degree value and the indirect trust degree value to obtain a comprehensive trust degree value for the client; in the case where the comprehensive trust degree value is greater than a threshold value, adjusting a data access permission value corresponding to the client to obtain an adjusted data access permission value; determining an authentication mode for the client based on the adjusted data access permission value, and performing login authentication on the client based on the authentication mode.

2. The method of claim 1, wherein, The method comprises: obtaining baseline information of each authentication factor when the client successfully logs in in the past; obtaining a similarity between the information of each authentication factor and the corresponding baseline information, and determining an indirect trust value of each authentication factor based on the similarity.

3. The method of claim 1, wherein, The data access permission value corresponding to the client is determined by the following method: obtaining permission information of the client; querying a preset mapping table of permission information and data access permission values according to the permission information to obtain the data access permission value corresponding to the client.

4. The method of claim 1, wherein, The historical interaction information comprises a number of successful logins and a number of failed logins of the client in the past; and in the case where the comprehensive trust degree value is greater than a threshold value, adjusting a data access permission value corresponding to the client to obtain an adjusted data access permission value, comprising: in the case where the comprehensive trust degree value is greater than a threshold value, obtaining an average value of the number of successful logins and the number of failed logins; if the number of successful logins is greater than the average value, obtaining a permission decay factor; The data access permission value is reduced by the permission decay factor to obtain an adjusted data access permission value.

5. The method of claim 1, wherein, The authentication mode for the client is determined based on the adjusted data access permission value, including: The authentication mode for the client is determined based on the adjusted data access permission value in a positive correlation relationship between the adjusted data access permission value and the complexity of the authentication mode.

6. The method of claim 1, wherein, The fusion processing of the direct trust degree value and the indirect trust degree value includes: A second weight preset for the direct trust degree value and the indirect trust degree value is obtained. The direct trust degree value and the indirect trust degree value are weighted and summed according to the second weight to obtain a comprehensive trust degree value for the client.

7. A login authentication apparatus characterized by comprising: The device includes: An information acquisition module is configured to acquire authentication information and historical interaction information of a client in response to an authentication request sent by the client, wherein the historical interaction information represents historical interaction information between the client and an authentication gateway, including a number of successful login times and a number of failed login times of the client in the past, and the authentication information includes information of a plurality of authentication factors, including device information, network environment, authentication protocol and network access mode of the client; A trust degree determination module is configured to determine a direct trust degree value for the client according to the historical interaction information, and obtain an indirect trust value of each authentication factor in the authentication information, determine a first weight of each authentication factor based on the indirect trust value, and perform weighted sum processing on the indirect trust value of each authentication factor according to the first weight of each authentication factor to obtain an indirect trust degree value for the client, wherein the indirect trust value is in a positive correlation relationship with the first weight. The trust degree determination module is further configured to obtain an expected model, a reward model, a decay model and a time decay factor of the client login success, construct a direct trust degree calculation model according to the expected model, the reward model, the decay model and the time decay factor, and process the number of successful times and the number of failed times in the historical interaction information by using the direct trust degree calculation model to obtain the direct trust degree value, wherein the reward model takes the product of the time decay factor and the number of successful times as an input variable, the decay model takes the number of failed times as an input variable, and the expected model takes the number of successful times and the number of failed times as input variables. A trust degree fusion module is configured to perform fusion processing on the direct trust degree value and the indirect trust degree value to obtain a comprehensive trust degree value for the client. A permission value adjustment module is configured to adjust a data access permission value corresponding to the client to obtain an adjusted data access permission value when the comprehensive trust degree value is greater than a threshold value. A mode determination module is configured to determine an authentication mode for the client based on the adjusted data access permission value, and perform login authentication on the client based on the authentication mode.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the login authentication method in any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the login authentication method in any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the login authentication method in any one of claims 1 to 6.

Images