An access authentication method, device, storage medium and network management platform

Abstract

Embodiments of the present application provide an access authentication method and device, a storage medium and a network management platform. The method comprises: receiving an access request sent by a user terminal, the access request comprising a network type and a network function interface; in response to the access request, determining a plurality of fog computing nodes based on the network type; and performing access authentication based on the plurality of fog computing nodes and in combination with a network function interface set in which the network function interface is located. In the technical solution provided by the embodiments of the present application, the network function interface set can be authenticated based on the plurality of fog computing nodes, so that the user does not need to frequently authenticate the same type of network function interface when accessing a certain type of network function interface, thereby improving the security and efficiency of access authentication.

Description

[Technical Field]

[0001] This invention relates to the field of fog computing technology, and in particular to an access authentication method, apparatus, storage medium, and network management platform. [Background Technology]

[0002] Before a user can access a network, they need to undergo access authentication for their permissions and security. Once the authentication is successful, the user can only access one network. For the system, frequently obtaining the user's critical information may have a certain impact on the user's information security. On the other hand, frequent access authentication results in a poor user experience, making both the security and efficiency of access authentication low. [Summary of the Invention]

[0003] In view of this, embodiments of the present invention provide an access authentication method, apparatus, storage medium, and network management platform to improve the security and efficiency of access authentication.

[0004] On one hand, embodiments of the present invention provide an access authentication method, including:

[0005] Receive an access request sent by a user terminal, the access request including network type and network function interface;

[0006] In response to the access request, multiple fog computing nodes are determined based on the network type;

[0007] Access authentication is performed based on multiple fog computing nodes and the set of network function interfaces to which the network function interface is located.

[0008] Optionally, before receiving the access request sent by the user terminal, the process includes:

[0009] Based on the obtained user access content, determine the network type accessed by the user;

[0010] Based on the network type and the network function interfaces of the obtained user access objects, a set of network function interfaces is generated.

[0011] Optionally, determining multiple fog computing nodes based on the network type includes:

[0012] Based on the user distance, computing power, and security of the network type, multiple fog computing nodes corresponding to the network type are selected.

[0013] Optionally, the set of network function interfaces includes: a set of communication application interfaces, a set of video application interfaces, a set of financial application interfaces, or a set of shopping application interfaces.

[0014] Optionally, when the network function interface set includes the communication application interface set, the access authentication based on multiple fog computing nodes and the network function interface set to which the network function interface is located includes:

[0015] When a user terminal accesses the first communication interface in the set of communication application interfaces, a first authentication request is sent, the first authentication request including an authentication public key;

[0016] The first fog computing node among the plurality of fog computing nodes is selected to verify the authentication public key;

[0017] If the authentication public key stored in the first fog computing node is the same as the authentication public key, the verification is successful, and a second fog computing node among the multiple fog computing nodes is selected to generate a temporary access token.

[0018] Send the temporary access token to the user terminal;

[0019] If, within a preset time period, a second authentication request is received when a user terminal accesses the second communication interface in the set of communication application interfaces, the second authentication request includes an authentication private key, and the authentication private key is verified based on the first fog computing node and the second fog computing node;

[0020] If the authentication private key is verified, a long-term access token with a verification signature is issued to the user terminal.

[0021] Optionally, the verification of the authentication private key based on the first fog computing node and the second fog computing node includes:

[0022] The authentication private key is decrypted based on the first fog computing node and the second fog computing node to generate decryption information;

[0023] If the decrypted information is the same as the registration information stored during user registration, then the authentication private key passes verification.

[0024] Optionally, it also includes:

[0025] When the set of network function interfaces includes the set of video application interfaces, access authentication is performed using the BLowfish encryption algorithm based on multiple fog computing nodes, combined with the set of network function interfaces to which the network function interface belongs; or...

[0026] When the set of network function interfaces includes the set of financial application interfaces or the set of shopping application interfaces, access authentication is performed using the RSA encryption algorithm based on multiple fog computing nodes, combined with the set of network function interfaces to which the network function interface is located.

[0027] On the other hand, embodiments of the present invention provide an access authentication device, including:

[0028] The receiving module is used to receive access requests sent by user terminals, the access requests including network type and network function interface;

[0029] The first determining module is used to determine multiple fog computing nodes based on the network type in response to the access request;

[0030] The authentication module is used to perform access authentication based on multiple fog computing nodes and the set of network function interfaces to which the network function interface is located.

[0031] On the other hand, embodiments of the present invention provide a storage medium, comprising: the storage medium including a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the above-described access authentication method.

[0032] On the other hand, embodiments of the present invention provide a network management platform, including a memory and a processor. The memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions. When the program instructions are loaded and executed by the processor, the steps of the above-described access authentication method are implemented.

[0033] The technical solution of the access authentication method provided in this embodiment of the invention involves receiving an access request sent by a user terminal, the access request including a network type and a network function interface; responding to the access request, determining multiple fog computing nodes based on the network type; and performing access authentication based on the multiple fog computing nodes and the set of network function interfaces to which the network function interface is located. The technical solution provided in this embodiment of the invention enables access authentication of a set of network function interfaces based on multiple fog computing nodes, so that when a user accesses a certain type of network function interface, they do not need to frequently authenticate the same type of network function interface, thus improving the security and efficiency of access authentication. [Attached Image Description]

[0034] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 A flowchart illustrating an access authentication method provided in related technologies;

[0036] Figure 2 A flowchart illustrating an access authentication method according to an embodiment of the present invention;

[0037] Figure 3 A flowchart illustrating another access authentication method provided in an embodiment of the present invention;

[0038] Figure 4 This is a schematic diagram illustrating the determination of multiple fog computing nodes based on network type according to an embodiment of the present invention;

[0039] Figure 5 This is a flowchart provided by an embodiment of the present invention, which describes how, when the set of network function interfaces includes a set of communication application interfaces, access authentication is performed based on multiple fog computing nodes and in combination with the set of network function interfaces to which the network function interfaces are located.

[0040] Figure 6 This is a schematic diagram of an access authentication device according to an embodiment of the present invention;

[0041] Figure 7 This is a schematic diagram of the structure of an authentication module provided in an embodiment of the present invention;

[0042] Figure 8 This is a schematic diagram of a network management platform provided in an embodiment of the present invention.

Detailed Implementation Methods

[0043] To better understand the technical solution of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0044] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0045] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0046] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0047] A method for access authentication is provided in related technologies. Figure 1 This is a flowchart illustrating an access authentication method provided in related technologies, such as... Figure 1As shown, server 1 stores the username and password corresponding to each user terminal. First user terminal 2 sends its username and password to Network Attached Storage (NAS). NAS 2 then sends the username and password to server 1. Server 1 compares the username and password of first user terminal 2 with those stored in the network. If they match, authentication is successful, and the user is granted access to network 4. If they do not match, authentication fails, and access to network 4 is denied.

[0048] In the technical solutions of related technologies, every time a user accesses the network, access authentication is required. Frequent acquisition of the user's username and password may have a certain impact on the user's information security. On the other hand, frequent access authentication results in a poor user experience, making both the security and efficiency of access authentication low.

[0049] To address the technical problems in related technologies, one embodiment of the present invention provides an access authentication method. Figure 2 A flowchart of an access authentication method provided in an embodiment of the present invention is shown below. Figure 2 As shown, the method includes:

[0050] Step 102: Receive the access request sent by the user terminal. The access request includes the network type and network function interface.

[0051] Step 104: In response to the access request, multiple fog computing nodes are identified based on the network type.

[0052] Specifically, multiple fog computing nodes corresponding to the network type are selected based on user distance, computing power, and security.

[0053] Step 106: Based on multiple fog computing nodes, perform access authentication by combining the set of network function interfaces where the network function interface is located.

[0054] Once access authentication is successful, a long-term access token will be obtained, allowing access to all network function interfaces under the network function interface set without secondary authentication for a period of time.

[0055] In the technical solution provided by this invention, an access request sent by a user terminal is received, the access request including a network type and a network function interface; in response to the access request, multiple fog computing nodes are determined based on the network type; and access authentication is performed based on the multiple fog computing nodes and the set of network function interfaces to which the network function interface is located. The technical solution provided by this invention enables access authentication of the set of network function interfaces based on multiple fog computing nodes, so that when a user accesses a certain type of network function interface, they do not need to frequently authenticate the same type of network function interface, thus improving the security and efficiency of access authentication.

[0056] To address the technical problems in related technologies, one embodiment of the present invention provides another access authentication method. Figure 3 A flowchart of another access authentication method provided in an embodiment of the present invention is shown below. Figure 3 As shown, the method includes:

[0057] Step 202: Determine the network type accessed by the user based on the obtained user access content.

[0058] In one embodiment of the present invention, each step can be performed by a network management platform.

[0059] In one embodiment of the present invention, the network management platform can obtain the content accessed by the user with the user's permission. At the same time, the network management platform will collect and store the existing network types and the network function interfaces of different access objects.

[0060] In one embodiment of the present invention, the network type includes a mobile cellular network, a wireless local area network, or a wired local area network.

[0061] Step 204: Generate a set of network function interfaces based on the network type and the network function interfaces of the obtained user access objects.

[0062] In one embodiment of the present invention, the network function interface includes: communication application interface, video application interface, financial application interface, or shopping application interface, etc.

[0063] In one embodiment of the present invention, the network function interface set includes: a communication application interface set, a video application interface set, a financial application interface set, or a shopping application interface set, etc.

[0064] In one embodiment of the present invention, network function interfaces of different network types can be grouped based on the network function interfaces of user access objects, thereby obtaining different sets of network function interfaces.

[0065] Table 1 is a collection of network function interfaces, as shown in Table 1 below:

[0066] Table 1

[0067] Mobile cellular network Wireless LAN Wired local area network Collection of communication application interfaces Collection of communication application interfaces Collection of communication application interfaces Video application interface collection Video application interface collection Video application interface collection Collection of financial application interfaces Collection of financial application interfaces Collection of financial application interfaces Shopping application API collection Shopping application API collection Shopping application API collection …… …… ……

[0068] As shown in Table 1 above, each network type corresponds to multiple sets of network function interfaces. Mobile cellular networks correspond to sets of communication application interfaces, video application interfaces, financial application interfaces, and shopping application interfaces; wireless LANs correspond to sets of communication application interfaces, video application interfaces, financial application interfaces, and shopping application interfaces; and wired LANs correspond to sets of communication application interfaces, video application interfaces, financial application interfaces, and shopping application interfaces.

[0069] Step 206: Receive the access request sent by the user terminal. The access request includes the network type and network function interface.

[0070] Step 208: In response to the access request, multiple fog computing nodes are identified based on the network type.

[0071] Specifically, multiple fog computing nodes corresponding to the network type are selected based on user distance, computing power, and security.

[0072] In one embodiment of the present invention, multiple fog computing nodes form a decentralized architecture without a centralized server to manage resources and services. Therefore, multiple fog computing nodes can collaboratively provide real-time services to users. Since multiple fog computing nodes provide unified access authentication for a set of access objects, the performance of different fog computing nodes can better assist the set of access objects in access authentication. At the same time, the joint participation of multiple fog computing nodes in the access authentication of a set of access objects makes the access authentication conclusion more credible.

[0073] Figure 4 This is a schematic diagram illustrating the determination of multiple fog computing nodes based on network type according to an embodiment of the present invention, as shown below. Figure 4 As shown, the network types include mobile cellular network 41, wireless local area network 42, and wired local area network 43. Taking four fog computing nodes as an example, the fog computing nodes include fog computing node A 401, fog computing node B 402, fog computing node C 403, and fog computing node D 404. Among them, fog computing node A 401 has high security, fog computing node B 402 is close to the user, fog computing node C 403 has strong computing power, and fog computing node D 404 has fewer tasks assigned.

[0074] When the network type is mobile cellular network 41, mobile cellular network 41 provides the Internet access channel for the user terminal's own Subscriber Identification Module (SIM). Therefore, for the user, this channel has high credibility and the network environment has relatively good security. Therefore, two fog computing nodes, fog computing node B 402 and fog computing node C 403, can be selected to provide authentication computing power for the user.

[0075] When the network type is wireless LAN 42, wireless LAN 42 may be a public network with low trust level. Therefore, the authentication process is complicated and time-consuming for users. Thus, the fog computing node providing authentication needs to be highly secure and have high computing power. Therefore, two fog computing nodes, fog computing node A 401 and fog computing node C 403, can be selected to provide authentication computing power for the user.

[0076] When the network type is wired LAN 43, the network environment of wired LAN 43 is relatively secure. At this time, two fog computing nodes, fog computing node C 403 and fog computing node D 404, can be selected to provide authentication computing power for the user.

[0077] In one embodiment of the present invention, when the network type of the user terminal is matched with the corresponding fog computing node, a dedicated communication link with unified authentication for access between the user terminal and the fog computing node can be established.

[0078] Step 210: Based on multiple fog computing nodes, perform access authentication by combining the set of network function interfaces where the network function interface is located.

[0079] Figure 5 A flowchart illustrating access authentication based on multiple fog computing nodes and the network function interface set where the network function interface resides, provided in one embodiment of the present invention, illustrates this process. Figure 5 As shown, step 210 includes:

[0080] S1. When a user terminal accesses the first communication interface in the set of communication application interfaces, it sends a first authentication request, which includes an authentication public key.

[0081] In one embodiment of the present invention, communication application interfaces require high levels of information security and immediacy; therefore, it is necessary to reduce the time required for access authentication. Thus, S1-S6 simplify the cumbersome access authentication process in related technologies, reducing the access authentication time. Furthermore, to better understand this embodiment, the example given is a user located in a mobile cellular network, with authentication computing power provided by two fog computing nodes, fog computing node B and fog computing node C.

[0082] In one embodiment of the present invention, when a user registers with this network management platform, the network management platform sends an authentication public key to the user's terminal.

[0083] In one embodiment of the present invention, the user terminal initiates a first authentication request to the first communication interface (communication application interface 1) under the communication network function interface set.

[0084] S2. Select the first fog computing node among multiple fog computing nodes to verify the authentication public key.

[0085] For example, fog computing node B can be selected from fog computing node B and fog computing node C to verify the authentication public key.

[0086] S3. If the authentication public key stored in the first fog computing node is the same as the authentication public key, the verification is successful, and the second fog computing node among multiple fog computing nodes is selected to generate a temporary access token.

[0087] For example, if the authentication public key stored in fog computing node B is the same as the authentication public key sent by the user terminal, the verification is successful, and fog computing node C is selected from fog computing nodes B and C to generate a temporary access token.

[0088] In one embodiment of the present invention, the temporary access token is generated as follows:

[0089] Token 临 =[Si; Fog Computation Node] C KEY C访问秘钥 (|(W1, W2)|Time 时间戳 )]

[0090] Wherein, Si represents the network function interface that the user needs to access. Taking this embodiment of the invention as an example, Si is a communication application interface 1, Token. 临 This is a temporary access token.

[0091] Token issued by fog computing node C 临 Users can access the corresponding communication application interface 1, due to the token issued by fog computing node C. 临Each interface in the interface set of the network management platform has reserved the generation rules for this access key, so that the network function interfaces of each network included in the platform can respond to the access key. That is, users can use the access key to access each network function interface included in the platform.

[0092] Among them, fog computing nodes C KEY C访问秘钥 In the code, (W1, W2) are the encryption keys, where W1 is the address information of fog computing node C, and W2 is the authentication key of fog computing node C. Where H1 and H2 are both cryptographic hash functions, H1: {0,1}*: G1, H2: {0,1} P P is a security parameter. GID is the UID group for fog computing nodes B and C; m is any metadata used to identify identity information under fog computing node C; UID c This serves as the identity verification identifier for fog computing node C; H1 is a cryptographic hash function, H1: {0,1}*→G1; For a bilinear mapping, G1×G1→G2, where G1 and G2 are two multiplicative groups; β is the coefficient.

[0093] S4. Send a temporary access token to the user terminal.

[0094] For example, sending the aforementioned Token to the user terminal 临 .

[0095] S5. If, within a preset time period, a second authentication request is received when a user terminal accesses the second communication interface in the set of communication application interfaces, the second authentication request includes an authentication private key, and the authentication private key is verified based on the first fog computing node and the second fog computing node.

[0096] In one embodiment of the present invention, a preset time period can be set according to the actual situation.

[0097] For example, if within a preset time period T1, the user terminal initiates a second authentication request to the second communication interface (communication application interface 2) under the communication network function interface set, then either fog computing node B or fog computing node C will request the user to register, and the platform will issue the authentication private key with user identity security attributes to the user.

[0098] Among them, the authentication private key contains user identity security attributes. 安全私 The authentication private key is issued to the user after registration, based on the user's modifications and after platform verification. Specifically, it is represented as key. 安全私= [User registration platform timestamp, user private key, user UID].

[0099] Specifically, S5 includes:

[0100] S51. Based on the first fog computing node and the second fog computing node, the authentication private key is decrypted to generate decryption information.

[0101] For example, fog computing node B and fog computing node C request a key from the platform. 安全私 The decryption method, and the key according to the decryption method. 安全私 Decryption is performed, and decryption information is generated.

[0102] S52. If the decrypted information is the same as the registration information stored during user registration, then the authentication private key is verified.

[0103] In one embodiment of the present invention, the decrypted information is compared with the registration information when the user registers to determine the authenticity of the authentication private key. If the results are consistent, the verification is successful.

[0104] S6. If the authentication private key is verified, a long-term access token with a verification signature is issued to the user terminal.

[0105] In one embodiment of the present invention, the long-term access token is represented as: Token 长期 = [Q, Ts, JK], where Q is the access token of fog computing node B and the access token of fog computing node C, Ts is the validity period of the long-term access token, and JK is the interface address that the user can actually access.

[0106] For example, a user receives a long-term access token issued by fog computing node B. The token contains "Ts" for 48hr and "JK" for all addresses in the communication application interface set collected by the platform. This means the user can access all addresses in the communication application interface set (e.g., communication application interface 3, communication application interface 4, etc.) without re-authentication for 48 hours.

[0107] In one embodiment of the present invention, if the authentication private key fails verification, a long-term access token with a verification signature is not issued to the user terminal. In this case, the user can access communication application interface 2, but cannot obtain a long-term access token. That is, the user cannot access all addresses under the communication application interface set without verification for a period of time.

[0108] In one embodiment of the present invention, when the network function interface set includes a video application interface set, access authentication is performed using the BLowfish encryption algorithm based on multiple fog computing nodes, combined with the network function interface set to which the network function interface belongs. As an optional solution, access authentication can be performed using the above S1-S6 steps based on the BLowfish encryption algorithm.

[0109] Because video application APIs require higher compatibility and stability compared to other API sets, the Blowfish encryption algorithm is used in conjunction with existing conventional authentication processes to authenticate user permissions.

[0110] Once access authentication is successful, a long-term access token will be obtained, allowing access to all network function interfaces under the video application interface set without secondary authentication for a period of time.

[0111] In one embodiment of the present invention, when the network function interface set includes a financial application interface set or a shopping application interface set, access authentication is performed using the RSA encryption algorithm based on multiple fog computing nodes, combined with the network function interface set to which the network function interface belongs. As an optional solution, access authentication can be performed using the above S1-S6 steps based on the RSA encryption algorithm.

[0112] Because financial application API sets or shopping application API sets have the highest security requirements compared to other API sets, the RSA encryption algorithm is adopted. Since this encryption algorithm has high compatibility and security attributes, it is combined with existing conventional authentication processes to authenticate user permissions.

[0113] Once access authentication is successful, a long-term access token will be obtained, allowing access to all network function interfaces under the financial application interface set or the shopping application interface set without secondary authentication for a period of time.

[0114] In the technical solution provided by this invention, an access request sent by a user terminal is received, the access request including a network type and a network function interface; in response to the access request, multiple fog computing nodes are determined based on the network type; and access authentication is performed based on the multiple fog computing nodes and the set of network function interfaces to which the network function interface is located. The technical solution provided by this invention enables access authentication of the set of network function interfaces based on multiple fog computing nodes, so that when a user accesses a certain type of network function interface, they do not need to frequently authenticate the same type of network function interface, thus improving the security and efficiency of access authentication.

[0115] The technical solutions provided in this embodiment of the invention have no technical application obstacles and can be applied to any network management platform, improving the user experience on the platform, increasing the efficiency of access authentication, and ensuring the user's information security.

[0116] In the technical solution provided by the embodiments of the present invention, users can access multiple networks with commonalities through a single authentication, thereby improving the user experience. At the same time, because the embodiments of the present invention adopt fog computing, the data storage center is avoided. Instead, the user's personal data is distributed to various fog computing nodes, and each node has a different method for encrypting and storing data, avoiding the problem of data being "wiped out all at once" and improving the security of user data.

[0117] In the technical solution provided by this invention, network types and different network function interfaces are classified, and matching fog computing nodes are assigned. The fog computing nodes then verify user access requests and distribute temporary and long-term access tokens. Once a user obtains a long-term access token, they can directly access various network function interfaces within the set of different network function interfaces for the corresponding network type within the valid time period, without needing to request network access using a "one interface, one authentication" approach. This achieves the goal of unified network authentication access and improves the user experience. Furthermore, since the authentication method for access requests to network function interfaces under the communication application interface set in this embodiment is designed based on this scenario, this method can effectively improve user security when accessing the network and also avoid the possibility of malicious access to network function interfaces.

[0118] One embodiment of the present invention provides an access authentication device. Figure 6 This is a schematic diagram of an access authentication device according to an embodiment of the present invention, as shown below. Figure 6 As shown, the device includes: a receiving module 11, a first determining module 12, and an authentication module 13.

[0119] The receiving module 11 is used to receive access requests sent by user terminals. The access requests include network type and network function interface.

[0120] The first determining module 12 is used to determine multiple fog computing nodes based on the network type in response to the access request.

[0121] The authentication module 13 is used to perform access authentication based on multiple fog computing nodes and the set of network function interfaces where the network function interface is located.

[0122] In one embodiment of the present invention, the device further includes a second determining module 14 and a generating module 15.

[0123] The second determining module 14 is used to determine the network type accessed by the user based on the obtained user access content.

[0124] The generation module 15 is used to generate a set of network function interfaces based on the network type and the network function interfaces of the obtained user access objects.

[0125] In one embodiment of the present invention, the first determining module 12 is specifically used to select multiple fog computing nodes corresponding to the network type based on the user distance, computing power and security of the network type.

[0126] In one embodiment of the present invention, the network function interface set includes: a communication application interface set, a video application interface set, a financial application interface set, or a shopping application interface set.

[0127] In one embodiment of the present invention, when the network function interface set includes the communication application interface set, Figure 7 This is a schematic diagram of the structure of an authentication module provided in an embodiment of the present invention, as shown below. Figure 7 As shown, the authentication module 13 includes: a receiving submodule 131, a first selection submodule 132, a second selection submodule 133, a sending submodule 134, and a verification submodule 135.

[0128] The receiving submodule 131 is used to receive a first authentication request sent by a user terminal when accessing the first communication interface in the set of communication application interfaces. The first authentication request includes an authentication public key.

[0129] The first selection submodule 132 is used to select the first fog computing node among multiple fog computing nodes to verify the authentication public key.

[0130] The second selection submodule 133 is used to verify if the authentication public key stored in the first fog computing node is the same as the authentication public key, and to select the second fog computing node among multiple fog computing nodes to generate a temporary access token.

[0131] The sending submodule 134 is used to send temporary access tokens to user terminals.

[0132] The verification submodule 135 is used to send a second authentication request when a user terminal accesses the second communication interface in the set of communication application interfaces within a preset time period. The second authentication request includes an authentication private key, which is verified based on the first fog computing node and the second fog computing node.

[0133] The sending submodule 134 is also used to send a long-term access token with a verification signature to the user terminal if the authentication private key is verified.

[0134] In one embodiment of the present invention, the verification submodule 135 is specifically used to decrypt the authentication private key based on the first fog computing node and the second fog computing node to generate decryption information; if the decryption information is the same as the registration information stored during user registration, the authentication private key passes verification.

[0135] In one embodiment of the present invention, when the network function interface set includes a video application interface set, the authentication module 13 is further configured to perform access authentication based on multiple fog computing nodes using the BLowfish encryption algorithm, combined with the network function interface set where the network function interface is located.

[0136] In one embodiment of the present invention, when the network function interface set includes a financial application interface set or a shopping application interface set, the authentication module 13 is further used to perform access authentication based on multiple fog computing nodes using the RSA encryption algorithm, combined with the network function interface set where the network function interface is located.

[0137] In the technical solution provided by this invention, an access request sent by a user terminal is received, the access request including a network type and a network function interface; in response to the access request, multiple fog computing nodes are determined based on the network type; and access authentication is performed based on the multiple fog computing nodes and the set of network function interfaces to which the network function interface is located. The technical solution provided by this invention enables access authentication of the set of network function interfaces based on multiple fog computing nodes, so that when a user accesses a certain type of network function interface, they do not need to frequently authenticate the same type of network function interface, thus improving the security and efficiency of access authentication.

[0138] The access authentication device provided in this embodiment can be used to implement the above. Figure 2 or Figure 3 For a detailed description of the access authentication method, please refer to the embodiments of the access authentication method described above, which will not be repeated here.

[0139] This invention provides a storage medium that includes a stored program. When the program runs, it controls the device where the storage medium is located to execute the steps of the above-described access authentication method. For a detailed description, please refer to the embodiments of the above-described access authentication method.

[0140] This invention provides a network management platform, including a memory and a processor. The memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions. When the program instructions are loaded and executed by the processor, they implement the steps of the above-described access authentication method. For a detailed description, please refer to the above-described access authentication method embodiments.

[0141] Figure 8 This is a schematic diagram of a network management platform provided in an embodiment of the present invention. Figure 8As shown, the network management platform 20 of this embodiment includes: a processor 21, a memory 22, and a computer program 23 stored in the memory 22 and executable on the processor 21. When the computer program 23 is executed by the processor 21, it implements the access authentication method described in the embodiment. To avoid repetition, these details are not elaborated here. Alternatively, when the computer program is executed by the processor 21, it implements the functions of each model / unit in the access authentication device described in the embodiment. To avoid repetition, these details are not elaborated here.

[0142] The network management platform 20 includes, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that... Figure 8 This is merely an example of network management platform 20 and does not constitute a limitation on network management platform 20. It may include more or fewer components than shown, or combine certain components, or different components. For example, network management platform may also include input / output devices, network access devices, buses, etc.

[0143] The processor 21 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0144] The memory 22 can be an internal storage unit of the network management platform 20, such as the hard drive or RAM of the network management platform 20. The memory 22 can also be an external storage device of the network management platform 20, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the network management platform 20. Furthermore, the memory 22 can include both internal storage units and external storage devices of the network management platform 20. The memory 22 is used to store computer programs and other programs and data required by the network management platform. The memory 22 can also be used to temporarily store data that has been output or will be output.

[0145] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0146] In the embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units through some interfaces, and may be electrical, mechanical, or other forms.

[0147] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0148] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0149] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0150] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An access authentication method, characterized in that, include: Receive an access request sent by a user terminal, the access request including network type and network function interface; In response to the access request, multiple fog computing nodes are determined based on the network type; Access authentication is performed based on multiple fog computing nodes and the set of network function interfaces where the network function interface is located. The network function interface set includes: a communication application interface set, a video application interface set, a financial application interface set, or a shopping application interface set; When the network function interface set includes the communication application interface set, the access authentication based on multiple fog computing nodes and the network function interface set to which the network function interface belongs includes: S1. When a user terminal accesses the first communication interface in the set of communication application interfaces, a first authentication request is sent, the first authentication request including an authentication public key; S2. Select the first fog computing node among the multiple fog computing nodes to verify the authentication public key; S3. If the authentication public key stored in the first fog computing node is the same as the authentication public key, the verification is successful, and a second fog computing node among the multiple fog computing nodes is selected to generate a temporary access token. S4. Send the temporary access token to the user terminal; S5. If a second authentication request is received when a user terminal accesses the second communication interface in the set of communication application interfaces within a preset time period, the second authentication request includes an authentication private key, and the authentication private key is verified based on the first fog computing node and the second fog computing node. S6. If the authentication private key is verified, a long-term access token with a verification signature is issued to the user terminal. When the network function interface set includes a video application interface set, access authentication is performed based on multiple fog computing nodes using the BLowfish encryption algorithm, combined with the network function interface set where the network function interface is located. Access authentication is performed by executing S1-S6 based on the BLowfish encryption algorithm. When the network function interface set includes a financial application interface set or a shopping application interface set, access authentication is performed based on multiple fog computing nodes using the RSA encryption algorithm, combined with the network function interface set to which the network function interface is located. Access authentication is performed by executing S1-S6 based on the RSA encryption algorithm.

2. The method according to claim 1, characterized in that, Before receiving the access request sent by the user terminal, the process includes: Based on the obtained user access content, determine the network type accessed by the user; Based on the network type and the network function interfaces of the obtained user access objects, a set of network function interfaces is generated.

3. The method according to claim 1, characterized in that, The determination of multiple fog computing nodes based on the network type includes: Based on the user distance, computing power, and security of the network type, multiple fog computing nodes corresponding to the network type are selected.

4. The method according to claim 1, characterized in that, The verification of the authentication private key based on the first fog computing node and the second fog computing node includes: The authentication private key is decrypted based on the first fog computing node and the second fog computing node to generate decryption information; If the decrypted information is the same as the registration information stored during user registration, then the authentication private key passes verification.

5. An access authentication device, characterized in that, include: The receiving module is used to receive access requests sent by user terminals, the access requests including network type and network function interface; The first determining module is used to determine multiple fog computing nodes based on the network type in response to the access request; The authentication module is used to perform access authentication based on multiple fog computing nodes and the set of network function interfaces where the network function interface is located; The network function interface set includes: a communication application interface set, a video application interface set, a financial application interface set, or a shopping application interface set; When the network function interface set includes the communication application interface set, the authentication module includes: The receiving submodule is used for S1, receiving a first authentication request sent by a user terminal when accessing the first communication interface in the set of communication application interfaces, wherein the first authentication request includes an authentication public key; The first selection submodule is used for S2, selecting a first fog computing node among the plurality of fog computing nodes to verify the authentication public key; The second selection submodule is used in S3 to verify that if the authentication public key stored in the first fog computing node is the same as the authentication public key, the verification is successful, and a second fog computing node among the multiple fog computing nodes is selected to generate a temporary access token. The sending submodule is used in S4 to send the temporary access token to the user terminal; The verification submodule is used by S5 to send a second authentication request when it receives a user terminal accessing the second communication interface in the set of communication application interfaces within a preset time period. The second authentication request includes an authentication private key, and the authentication private key is verified based on the first fog computing node and the second fog computing node. The sending submodule is also used in S6, if the authentication private key passes verification, to send a long-term access token with a verification signature to the user terminal; When the network function interface set includes a video application interface set, access authentication is performed based on multiple fog computing nodes using the BLowfish encryption algorithm, combined with the network function interface set where the network function interface is located. Access authentication is performed by executing S1-S6 based on the BLowfish encryption algorithm. When the network function interface set includes a financial application interface set or a shopping application interface set, access authentication is performed based on multiple fog computing nodes using the RSA encryption algorithm, combined with the network function interface set to which the network function interface is located. Access authentication is performed by executing S1-S6 based on the RSA encryption algorithm.

6. A storage medium, characterized in that, include: The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to perform the access authentication method according to any one of claims 1 to 4.

7. A network management platform, comprising a memory and a processor, wherein the memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions, characterized in that, When the program instructions are loaded and executed by the processor, they implement the steps of the access authentication method according to any one of claims 1 to 4.

Images