Security authentication method, device, apparatus and storage medium

Abstract

Embodiments of the present application provide a security authentication method, device and equipment and a storage medium, wherein the method comprises: receiving a service request sent by a terminal, the service request comprising service data; in response to the service request, obtaining gateway information of a security authentication gateway and device information of the terminal; performing encryption processing on the service data, the device information and the gateway information to obtain encrypted service data, encrypted device information and encrypted gateway information; performing identity authentication on the terminal based on the encrypted service data, the encrypted device information and the encrypted gateway information to obtain an identity authentication result; and in response to the identity authentication result being authentication passed, sending the service data to a server.

Claims

1. A security authentication method, characterized in that, Applied to a security authentication gateway, the security authentication gateway including: an end-side gateway, an access gateway, and a security control gateway, the method includes: The receiving terminal sends a service request, which includes service data; In response to the service request, obtain the gateway information of the security authentication gateway and the device information of the terminal; The service data, device information, and gateway information are encrypted using a preset encryption algorithm through the terminal gateway to obtain encrypted service data, encrypted device information, and encrypted gateway information. The access gateway obtains the preset decryption algorithm corresponding to the preset encryption algorithm. Obtain the encrypted business data and the encrypted device information; The encrypted business data and the encrypted device information are decrypted using the preset decryption algorithm to obtain the decrypted business data and the decrypted device information respectively. The decrypted business data and the decrypted device information are sent to the security control gateway. The security control gateway performs identity authentication on the terminal based on the decrypted business data and the decrypted device information to obtain the identity authentication result. In response to the authentication result being successful, the business data is sent to the server.

2. The method according to claim 1, characterized in that, The step of authenticating the terminal through the security control gateway, based on the decrypted business data and the decrypted device information, to obtain the authentication result includes: Obtain the policy identifier of the access control policy corresponding to the security control gateway; The security control gateway invokes the policy engine corresponding to the policy identifier, and performs identity authentication on the terminal based on the decrypted business data and the decrypted device information to obtain the identity authentication result.

3. The method according to claim 1, characterized in that, The method further includes: After the access gateway receives the encrypted gateway information, it uses the preset decryption algorithm to decrypt the encrypted gateway information to obtain the decrypted gateway information. Based on the decrypted gateway information, gateway authentication is performed on the end-side gateway; Correspondingly, when the gateway authentication is successful, the decrypted business data and the decrypted device information are sent to the security control gateway.

4. The method according to claim 2, characterized in that, The method further includes: Acquire operation timing data, which includes at least one timing data related to user operation collected by the terminal within a preset historical time period; Determine the data state of the operation timing data under at least one specific function; Based on the data state, a target model matching the data state is selected from a preset model library; The access policy corresponding to the target model is determined as the access control policy corresponding to the security control gateway.

5. The method according to claim 2, characterized in that, The method further includes: While the security control gateway authenticates the terminal, it also obtains risk assessment information. The risk assessment information is transformed into decision-making reference information to form decision parameter information; Based on the decision parameter information, risk assessments are performed on the terminal, the end-side gateway and access gateway in the security authentication gateway, and the service request, respectively, to obtain risk assessment results; Correspondingly, when the risk assessment result is "risk assessment passed" and the identity authentication result is "authentication passed", the business data is sent to the server.

6. A security authentication device, characterized in that, The device includes: The receiving module is used to receive service requests sent by the terminal, wherein the service requests include service data; The acquisition module is used to acquire the gateway information of the security authentication gateway and the device information of the terminal; the security authentication gateway includes: an end-side gateway, an access gateway, and a security control gateway; The encryption module is used to encrypt the service data, the device information, and the gateway information through the terminal gateway using a preset encryption algorithm, so as to obtain encrypted service data, encrypted device information, and encrypted gateway information. The authentication module is configured to: obtain a preset decryption algorithm corresponding to the preset encryption algorithm through the access gateway; obtain the encrypted service data and the encrypted device information; use the preset decryption algorithm to decrypt the encrypted service data and the encrypted device information respectively, thereby obtaining the decrypted service data and the decrypted device information; send the decrypted service data and the decrypted device information to the security control gateway; and, through the security control gateway, perform identity authentication on the terminal based on the decrypted service data and the decrypted device information to obtain the identity authentication result. The sending module is used to send the business data to the server in response to the authentication result being successful.

7. A security authentication device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the security authentication method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The device stores executable instructions for causing a processor to execute the executable instructions to implement the security authentication method according to any one of claims 1 to 5.

Images