An identity authentication method, product, device and medium

Abstract

The present application relates to the field of identity authentication technology, and in particular to an identity authentication method, product, device and medium. The method includes: obtaining the user's historical access data, which includes the access time and access content corresponding to multiple access requests; determining the target access request closest to the current time from the historical access data, and determining the time difference between the current time and the access time corresponding to the target access request; determining the user's access habits based on the access content corresponding to multiple access requests in the historical access data, and determining the difference between the access content corresponding to the target access request and the access habits; obtaining an identity token, and updating the identity token based on the time difference and the difference, so as to authenticate the user's access requests after the current time through the updated identity token. The present application can improve the flexibility and security of identity authentication.

Description

Technical Field

[0001] The present application relates to the field of identity authentication technology, and in particular to an identity authentication method, product, device and medium. Background Art

[0002] With the development of information technology, identity authentication, as the first line of defense to protect the security of information systems, has become increasingly important. Traditional identity authentication methods, such as usernames and passwords, are simple but not secure enough and are vulnerable to various attacks. Therefore, multi-factor identity authentication has gradually become mainstream. Multi-factor identity authentication combines multiple authentication methods, such as passwords, biometrics, identity tokens, etc., to improve the security of authentication.

[0003] Existing identity authentication methods rely on static identity information or preset rules to identify user behavior patterns, but are unable to effectively identify users' abnormal behavior or access patterns. This allows attackers to disguise themselves as legitimate users and access illegally after stealing identity information, posing serious security risks to information systems. Summary of the invention

[0004] In order to solve the problem of potential security risks in identity authentication in the prior art, the present application provides an identity authentication method, product, device and medium.

[0005] In the first aspect, the present application provides an identity authentication method, which adopts the following technical solution:

[0006] An identity authentication method, comprising:

[0007] Acquire the user's historical access data, wherein the historical access data includes access times and access contents corresponding to multiple access requests;

[0008] Determine the target access request closest to the current time from the historical access data, and determine the time difference between the current time and the access time corresponding to the target access request;

[0009] Determine the access habits of the user according to the access contents corresponding to the multiple access requests in the historical access data, and determine the difference between the access contents corresponding to the target access request and the access habits;

[0010] An identity token is obtained, and the identity token is updated according to the time difference and the degree of difference, so as to authenticate the access request of the user after the current moment through the updated identity token.

[0011] By adopting the above technical solution, the user's historical access data is obtained. By analyzing the historical access data, the user's normal access mode can be identified, the nearest target access request can be determined from the historical access data, and the time difference between the current moment and the access moment corresponding to the target access request can be determined. The frequency of access can be judged, which is helpful to identify abnormal access behavior. According to the access content corresponding to multiple access requests in the historical access data, the user's access habits can be determined. By comparing the difference between the access content corresponding to the target request and the access habits, it can be accurately determined whether the target access request is in line with the daily access habits. The identity token is updated according to the time difference and the difference, thereby realizing real-time analysis and dynamic verification of user access behavior and improving the flexibility and security of identity authentication.

[0012] In a preferred example, the present application can be further configured as follows: the access content corresponding to each access request includes a number of access sub-items,

[0013] The determining the access habits of the user according to the access contents respectively corresponding to the multiple access requests in the historical access data includes:

[0014] Determine the number of accesses corresponding to each access sub-item in the historical access data according to the access contents corresponding to each of the multiple access requests in the historical access data, and obtain the number of accesses corresponding to each of the multiple access sub-items;

[0015] An access habit index of each access sub-item is determined according to the number of accesses corresponding to each of the plurality of access sub-items, and the access habit indexes corresponding to each of the plurality of access sub-items constitute the access habit of the user.

[0016] By adopting the above technical solution, the number of visits and the access habit index corresponding to each access sub-item in the historical access data are determined, which can accurately reflect the user's preference and usage frequency for each access sub-item, and help improve the accuracy of access habits.

[0017] In a preferred example, the present application may be further configured to: determine the difference between the access content corresponding to the target access request and the access habit, including:

[0018] Determining a plurality of access sub-items included in the historical access data as a first access sub-item set;

[0019] Determining a plurality of access sub-items included in the access content corresponding to the target access request as a second access sub-item set;

[0020] Determine an association relationship between the first access sub-item set and the second access sub-item set;

[0021] If the association relationship is an intersection relationship, the intersection of the first access sub-item set and the second access sub-item set is taken as a first subset, and the part of the second access sub-item set that is not included in the first access sub-item set is taken as a second subset;

[0022] The difference between the access content corresponding to the target access request and the access habit is determined according to the access habit index corresponding to each access sub-item in the first subset and the number of access sub-items in the second subset.

[0023] By adopting the above technical solution, the first access sub-item set and the second access sub-item set are determined, and the access sub-items in the target access request and the historical access data can be clearly compared, which provides a clear comparison object for the calculation of the difference degree. The judgment of the association relationship is helpful to understand the similarities and differences between the target access request and the historical access data. If the association relationship is an intersection relationship, the first subset and the second subset are further determined. The first subset reflects the user's continuous behavior pattern, and the second subset reflects the user's new behavior or abnormal behavior. Using the access habit index as the basis for calculating the difference degree can more accurately reflect the user's habituation to each access sub-item. Considering the number of access sub-items in the second subset, the newly added or different behavior parts in the target access request can be quantified, which further enriches the calculation dimension of the difference degree, improves the accuracy of authentication, and helps to detect abnormal user behavior in a timely manner.

[0024] In a preferred example, the present application may be further configured to: update the identity token according to the time difference and the difference, including:

[0025] Acquire, from the historical access data, identity verification information corresponding to the target access request, the identity verification information including the number of incorrect inputs and the input content of each incorrect input;

[0026] Determining an error index of the target access request according to the number of incorrect inputs corresponding to the target access request and the input content of each incorrect input;

[0027] The identity token is updated according to the error index, the time difference and the degree of difference.

[0028] By adopting the above technical solution, the calculation of the error index provides a quantitative indicator for evaluating the degree of error and risk level of users in the identity authentication process. By comprehensively considering the number of errors and the input content, the user's true identity can be judged more accurately, thereby improving the accuracy and security of identity authentication. The identity token is updated in combination with the error index, time difference and difference, and can be dynamically adjusted according to the user's real-time behavior and habits, thereby improving the flexibility and adaptability of authentication.

[0029] In a preferred example, the present application may be further configured to: update the identity token according to the error index, the time difference and the difference, including:

[0030] respectively determining whether the error index, the time difference and the degree of difference meet respective corresponding preset conditions;

[0031] If the error index, the time difference and the difference degree do not meet their respective corresponding preset conditions, an update time is generated according to the difference degree, so as to update the identity token according to the update time;

[0032] If any one of the error index, the time difference and the degree of difference reaches a corresponding preset condition, the identity token is updated.

[0033] By adopting the above technical solution and setting preset conditions, it is possible to clearly define the circumstances under which the identity token needs to be updated, thereby ensuring the accuracy and effectiveness of the update, and generating the update time based on the difference, making the update of the identity token more flexible and personalized. When there is a small difference between the user's access behavior and habits, the system will not trigger the update immediately, but will decide the appropriate update time based on the size of the difference. This ensures security and improves the user experience. When any factor meets the preset conditions, the system can respond quickly and take corresponding security measures to ensure the security of the user's identity and the stability of the system.

[0034] In a preferred example, the present application can be further configured as follows: the method further includes:

[0035] When an access request is detected from a user, receiving identity authentication information input by the user;

[0036] Generate a request instruction based on the identity authentication information, and authenticate the request instruction to obtain an identity authentication result;

[0037] If the identity authentication result is successful, an identity token corresponding to the identity authentication information is generated.

[0038] By adopting the above technical solution, by receiving the authentication information input by the user, generating a request instruction and performing identity authentication, and finally generating an identity token, a safe and convenient access experience is provided for the user, ensuring that only users with legitimate identities can access specific resources, thereby improving security and user experience.

[0039] In a preferred example, the present application may be further configured as follows: the identity authentication of the request instruction to obtain the identity authentication result includes:

[0040] Send the request instruction to the API gateway, and receive the preliminary identity authentication result of the API gateway for the request instruction, where the preliminary identity authentication result is the result of the API performing format verification on the request instruction;

[0041] If the preliminary identity authentication result is that the authentication is passed, the API gateway is controlled to send the request instruction to the CAS, and receive the identity authentication result of the request instruction by the CAS, where the identity authentication result is the result of the CAS performing content verification on the request instruction.

[0042] By adopting the above technical solution, combined with the preliminary identity verification of the API gateway and the content verification of CAS, it is possible to quickly filter out malformed requests and ensure that only users with legitimate identities can continue to access, thereby improving the security, stability and processing efficiency of the system.

[0043] In a second aspect, the present application provides a computer program product, which adopts the following technical solution:

[0044] A computer program product includes a computer program. When the computer program is executed by a processor, the identity authentication method as described in any one of the first aspects is implemented.

[0045] In a third aspect, the present application provides an electronic device, which adopts the following technical solution:

[0046] one or more processors;

[0047] Memory;

[0048] At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the identity authentication method as described in any one of the first aspects.

[0049] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0050] A computer-readable storage medium stores a computer program, which, when executed in a computer, causes the computer to execute the identity authentication method as described in any one of the first aspects.

[0051] In summary, this application includes the following beneficial technical effects:

[0052] The present application obtains the user's historical access data, and by analyzing the historical access data, it is able to identify the user's normal access pattern, determine the nearest target access request from the historical access data, and determine the time difference between the current moment and the access moment corresponding to the target access request, thereby judging the frequency of access and helping to identify abnormal access behavior. The present application can determine the user's access habits based on the access contents corresponding to multiple access requests in the historical access data, and compare the difference between the access contents corresponding to the target request and the access habits, thereby accurately determining whether the target access request is consistent with daily access habits. The identity token is updated based on the time difference and the difference, thereby realizing real-time analysis and dynamic verification of user access behavior and improving the flexibility and security of identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flowchart of an identity authentication method provided in an embodiment of the present application;

[0054] Figure 2 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The following is combined with Figure 1 -Attached Figure 2 This application is described in further detail.

[0056] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, those skilled in the art may make modifications to the present embodiment without any creative contribution as needed, but such modifications are protected by the patent law as long as they are within the scope of the claims of the present application.

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0058] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0059] This application embodiment provides an identity authentication method, such as Figure 1As shown, the method provided in the embodiment of the present application is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application. The method includes steps S101 to S104, wherein:

[0060] S101. Obtain historical access data of a user, where the historical access data includes access times and access contents corresponding to multiple access requests.

[0061] In this embodiment, a database and a preset number can be set up. The database is used to store access data corresponding to each access request of each user. For any user who needs to access, the access data of multiple access requests made by the user before the current moment can be extracted from the database. The number of access requests is the preset number, thereby obtaining the historical access data of the user, wherein the preset number can be set according to actual needs.

[0062] S102: Determine the target access request closest to the current time from the historical access data, and determine the time difference between the current time and the access time corresponding to the target access request.

[0063] In this embodiment, multiple access requests in the historical access data may be arranged from earliest to latest according to access time, and then the one with the latest access time is selected as the target access request.

[0064] S103: Determine the user's access habits according to the access contents corresponding to the multiple access requests in the historical access data, and determine the difference between the access contents corresponding to the target access request and the access habits.

[0065] In this embodiment, the access content corresponding to any access request in the historical access data includes several access sub-items, and each access sub-item can be specific information performed by a user in one operation, such as form fields in the URL, the type of button clicked, etc. Specifically, the number of accesses corresponding to each access sub-item in the historical access data can be determined according to the access content corresponding to each of the multiple access requests in the historical access data, thereby obtaining the number of accesses corresponding to each of the multiple access sub-items. Furthermore, the access habit index of each access sub-item can be determined according to the number of accesses corresponding to each of the multiple access sub-items. The access habit index is used to characterize the access preference for the corresponding access sub-item. The larger the access habit index, the more frequently the user accesses the corresponding access sub-item. The access habit index corresponding to each of the multiple access sub-items constitutes the access habit of the user.

[0066] S104: Obtain an identity token, and update the identity token according to the time difference and the difference degree, so as to authenticate the user's access request after the current moment through the updated identity token.

[0067] In this embodiment, a listener can be set at the system entrance to monitor the user's access request in real time. When the user's access request is monitored, the identity authentication information entered by the user is received. The identity authentication information can be an account number and password, biometric information, etc. Then, a request instruction is generated according to the user's identity authentication information. The request instruction can contain the user's identity authentication information, the target resource requested, etc. The identity authentication information in the request instruction is compared with the user information stored in the database to determine whether the identity authentication is successful. If the database stores user information corresponding to the identity authentication information in the request instruction, it indicates that the identity authentication result is successful. An identity token related to the identity authentication information can be generated. The identity token can be a randomly generated string, a digital signature or a JWT. Necessary attributes can also be set for the identity token, such as the associated user ID, user access rights, etc. The attributes can be used for the user's subsequent access control and identity authentication. Then, the generated identity token can be stored in the database so that it can be called at any time when the subsequent user accesses.

[0068] The embodiments of the present application obtain the user's historical access data, analyze the historical access data, and identify the user's normal access pattern. The nearest target access request is determined from the historical access data, and the time difference between the current moment and the access moment corresponding to the target access request is determined. The frequency of access can be judged, which is helpful to identify abnormal access behavior. The user's access habits can be determined based on the access contents corresponding to multiple access requests in the historical access data. By comparing the difference between the access content corresponding to the target request and the access habits, it can be accurately determined whether the target access request is in line with daily access habits. The identity token is updated according to the time difference and the difference, thereby realizing real-time analysis and dynamic verification of user access behavior and improving the flexibility and security of identity authentication.

[0069] In a possible implementation of the embodiment of the present application, the access content corresponding to each access request includes a plurality of access sub-items.

[0070] Determine the user's access habits based on the access contents corresponding to multiple access requests in the historical access data, including:

[0071] Determine the number of accesses corresponding to each access sub-item in the historical access data according to the access contents corresponding to each of the multiple access requests in the historical access data, and obtain the number of accesses corresponding to each of the multiple access sub-items;

[0072] The access habit index of each access sub-item is determined according to the number of accesses corresponding to each of the multiple access sub-items, and the access habit indexes corresponding to each of the multiple access sub-items constitute the access habit of the user.

[0073] In this embodiment, the access content corresponding to each access request includes a plurality of access sub-items. According to the access content corresponding to each of the plurality of access requests in the historical access data, the number of times each access sub-item has been accessed in the historical access data can be determined, and the number of accesses corresponding to each of the plurality of access sub-items can be obtained. Then, the number of accesses corresponding to each of the plurality of access sub-items obtained can be arranged from small to large to obtain an access number sequence, and the maximum number of accesses can be determined therefrom. The adjustment ratio can be determined according to the maximum number of accesses, so that each value in the adjusted access number sequence is within a preset range, and the preset range can be 0-10.

[0074] Among them, the method for determining the adjustment ratio based on the maximum number of visits can be: taking the ratio of the maximum number of visits to the maximum value of the preset range as the adjustment ratio, and then, each value in the access number sequence can be adjusted according to the adjustment ratio. For any value in the access number sequence, the adjustment method is: taking the ratio of the value to the adjustment ratio as the access habit index corresponding to the value, and performing the above adjustment operation on each value in the access number sequence, it is possible to obtain an access habit index sequence in which each adjusted value is within the preset range.

[0075] The embodiment of the present application can accurately reflect the user's preference and usage frequency for each access sub-item by determining the number of visits and access habit index corresponding to each access sub-item in the historical access data, which helps to improve the accuracy of access habits.

[0076] A possible implementation of the embodiment of the present application is to determine the difference between the access content corresponding to the target access request and the access habit, including:

[0077] Determine a plurality of access sub-items included in the historical access data as a first access sub-item set;

[0078] Determine a plurality of access sub-items included in the access content corresponding to the target access request as a second access sub-item set;

[0079] Determine an association relationship between a first access sub-item set and a second access sub-item set;

[0080] If the association relationship is an intersection relationship, the intersection of the first access sub-item set and the second access sub-item set is taken as the first subset, and the part of the second access sub-item set that is not included in the first access sub-item set is taken as the second subset;

[0081] The difference between the access content and the access habit corresponding to the target access request is determined according to the access habit index corresponding to each access sub-item in the first subset and the number of access sub-items in the second subset.

[0082] In one possible scenario, the association relationship between the first access sub-item set and the second access sub-item set is that the first access sub-item set contains the second access sub-item set. Then, the difference between the access content and the access habit corresponding to the target access request can be determined based on the access habit index corresponding to each access sub-item in the second access sub-item set.

[0083] Specifically, the first index threshold and the second index threshold can be determined based on the access habit index of each access sub-item in the first access sub-item set, that is, the access habit index sequence. Optionally, the first average value of the access habit index sequence can be calculated as the first index threshold. When the access habit index corresponding to a certain access sub-item exceeds the first index threshold, it indicates that the access is frequent. When the access habit index corresponding to a certain access sub-item does not exceed the first index threshold, it indicates that the access is infrequent. The second index threshold can be set according to actual needs, and the second index threshold can be equal to or less than the first index threshold.

[0084] Furthermore, the access habit index corresponding to each access sub-item in the second access sub-item set can be counted, and the average value of the access habit index corresponding to each access sub-item in the second access sub-item set can be calculated to obtain a second average value. The second average value is compared with the first index threshold to obtain a first determination result. Then, the number of access sub-items whose access habit index does not exceed the second index threshold is determined from the second access sub-item set to obtain a first number, the total number of access sub-items in the second access sub-item set is taken as the second number, the ratio of the first number to the second number is calculated to obtain a first ratio, and the first ratio is compared with the first preset ratio to obtain a second determination result, wherein the first preset ratio can be flexibly set according to actual experience.

[0085] Furthermore, the difference between the target access request and the access habit can be determined based on the first determination result and the second determination result. Wherein, the first determination result is that the second average value is not greater than the first index threshold, indicating that the overall access of each access sub-item in the second access sub-item set is not frequent, and the first determination result is that the second average value is greater than the first index threshold, indicating that the overall access of each access sub-item in the second access sub-item set is relatively frequent; the second determination result is that the first ratio is greater than the first preset ratio, indicating that the proportion of the number of infrequently accessed access sub-items in the second access sub-item set to the total number exceeds the standard, and the second determination result is that the first ratio is not greater than the first preset ratio, indicating that the proportion of the number of infrequently accessed access sub-items in the second access sub-item set to the total number does not exceed the standard. In a possible situation, the first determination result is that the second average value is not greater than the first index threshold, and the second determination result is that the first ratio is not greater than the first preset ratio. At this time, the difference between the target access request and the access habit can be determined as the first difference level. In another possible scenario, the first determination result is that the second average value is greater than the first index threshold, and the second determination result is that the first ratio is not greater than the first preset ratio. In this case, the difference between the target access request and the access habit can be determined as the second difference level. In another possible scenario, the first determination result is that the second average value is not greater than the first index threshold, and the second determination result is that the first ratio is greater than the first preset ratio. In this case, the difference between the target access request and the access habit can be determined as the second difference level. In another possible scenario, the first determination result is that the second average value is greater than the first index threshold, and the second determination result is that the first ratio is greater than the first preset ratio. In this case, the difference between the target access request and the access habit can be determined as the third difference level.

[0086] In another possible case, the association relationship between the first access sub-item set and the second access sub-item set is an intersection relationship, and the intersection of the first access sub-item set and the second access sub-item set can be used as the first subset, and the part of the second access sub-item set that is not included in the first access sub-item set can be used as the second subset. Furthermore, the difference between the access content and the access habit corresponding to the target access request can be determined based on the access habit index corresponding to each access sub-item in the first subset and the number of access sub-items in the second subset.

[0087] Specifically, the average value of the access habit index corresponding to each access sub-item in the second access sub-item set can be calculated to obtain a third average value, and the third average value is compared with the first index threshold to obtain a third determination result. Then, the number of access sub-items included in the second subset is taken as the third number, and the total number of access sub-items in the second access sub-item combination is taken as the second number, and the ratio of the third number to the second number is calculated to obtain a second ratio, and the second ratio is compared with a second preset ratio to obtain a fourth determination result. The second preset ratio can be flexibly set according to actual experience, and the second preset ratio is smaller than the first preset ratio.

[0088] Further, the difference between the target access request and the access habit can be determined according to the third determination result and the fourth determination result. Wherein, the third determination result is that the third average value is not greater than the first index threshold, indicating that the overall access of each access sub-item in the second access sub-item is not frequent, and the third determination result is that the third average value is greater than the first index threshold, indicating that the overall access of each access sub-item in the second access sub-item is relatively frequent; the fourth determination result is that the second ratio is greater than the second preset ratio, indicating that the proportion of the number of unfamiliar access sub-items in the second access sub-item set to the total number exceeds the standard, and the fourth determination result is that the second ratio is not greater than the second preset ratio, indicating that the proportion of the number of unfamiliar access sub-items in the second access sub-item set to the total number does not exceed the standard. In one possible case, the third determination result is that the third average value is not greater than the first index threshold, and the fourth determination result is that the second ratio is not greater than the second preset ratio. At this time, the difference between the target access request and the access habit can be determined as the first difference level. In another possible case, the third determination result is that the third average value is greater than the first index threshold, and the fourth determination result is that the second ratio is not greater than the second preset ratio. At this time, the difference between the target access request and the access habit can be determined as the second difference level. In a possible case, the third determination result is that the third average value is not greater than the first index threshold value, and the fourth determination result is that the second ratio is greater than the second preset ratio, in which case the difference between the target access request and the access habit can be determined as the second difference level. In a possible case, the third determination result is that the third average value is greater than the first index threshold value, and the fourth determination result is that the second ratio is greater than the second preset ratio, in which case the difference between the target access request and the access habit can be determined as the third difference level.

[0089] In another possible case, the association relationship between the first access sub-item set and the second access sub-item set is disjoint, indicating that all the target access requests are unfamiliar access sub-items. In this case, the difference between the target access request and the access habit can be determined as the third difference level.

[0090] The embodiment of the present application can clearly compare the access sub-items in the target access request and the historical access data by determining the first access sub-item set and the second access sub-item set, thereby providing a clear comparison object for the calculation of the difference degree. The determination of the association relationship helps to understand the similarities and differences between the target access request and the historical access data. If the association relationship is an intersection relationship, the first subset and the second subset are further determined. The first subset reflects the user's continuous behavior pattern, and the second subset reflects the user's new behavior or abnormal behavior. Using the access habit index as the basis for calculating the difference degree can more accurately reflect the user's habituation to each access sub-item. Considering the number of access sub-items in the second subset, it is possible to quantify the newly added or different behavior parts in the target access request, further enriching the calculation dimension of the difference degree, improving the accuracy of authentication, and facilitating timely detection of abnormal user behavior.

[0091] A possible implementation of the embodiment of the present application is to update the identity token according to the time difference and the difference, including:

[0092] Obtaining identity authentication information corresponding to the target access request from the historical access data, the identity authentication information including the number of incorrect inputs and the input content of each incorrect input;

[0093] Determine an error index of the target access request according to the number of incorrect inputs corresponding to the target access request and the input content of each incorrect input;

[0094] Update the identity token based on the error index, time difference, and difference.

[0095] In this embodiment, the input content of the incorrect input may include multiple types, such as an account error, a password error, or a verification code error. A corresponding weight may be set for each type based on actual experience. Optionally, a weight setting method may be password weight>account weight>verification code weight. The error index of the target access request is calculated by calculating the product of the weight of each type and the number of errors, and then calculating the sum of the products of each error type, and the sum is used as the error index.

[0096] The calculation of the error index in the embodiment of the present application provides a quantitative indicator for evaluating the degree of error and risk level of the user in the identity authentication process. By comprehensively considering the number of errors and the input content, the user's true identity can be judged more accurately, thereby improving the accuracy and security of identity authentication. The identity token is updated in combination with the error index, time difference and difference, and can be dynamically adjusted according to the user's real-time behavior and habits, thereby improving the flexibility and adaptability of authentication.

[0097] A possible implementation of the embodiment of the present application is to update the identity token according to the error index, the time difference and the difference, including:

[0098] Determine whether the error index, time difference and difference degree meet the corresponding preset conditions respectively;

[0099] If the error index, time difference and difference degree do not meet their respective corresponding preset conditions, an update time is generated according to the difference degree to update the identity token according to the update time;

[0100] If any of the error index, time difference and difference degree reaches the corresponding preset condition, the identity token is updated.

[0101] In this embodiment, the error index threshold can be set according to the type and weight of the input content, and the error index corresponding to the case where the number of errors of each type is 1 is used as the error index threshold. For example, if the type of input content includes an account, a password, and a verification code, the sum of the weights corresponding to the account, the password, and the verification code is used as the error index threshold. When the error index of the target access request exceeds the error index threshold, it indicates that the error index of the target access request exceeds the standard. When the error index of the target access request does not exceed the error index threshold, it indicates that the error index of the target access request does not exceed the standard.

[0102] Specifically, for the error index, if the error index of the target access request exceeds the error index threshold, it is determined that the error index has reached the corresponding preset condition; if the error index of the target access request does not exceed the error index threshold, it is determined that the error index has not reached the corresponding preset condition. For the time difference, if the time difference corresponding to the target access request reaches the preset time difference, it is determined that the time difference has reached the corresponding preset condition; if the time difference corresponding to the target access request does not reach the preset time difference, it is determined that the time difference has not reached the corresponding preset condition, wherein the preset time difference can be set according to actual needs, and optionally, the preset time difference can be one week. For the difference degree, if the difference degree corresponding to the target access request is the first difference level or the second difference level, it is determined that the difference degree has not reached the corresponding preset condition; if the difference degree corresponding to the target access request is the third difference level, it is determined that the difference degree has reached the corresponding preset condition.

[0103] In one possible scenario, the error index, time difference and difference degree all fail to reach their respective corresponding preset conditions. At this time, there are two situations for the difference degree, one is that the difference degree is the first difference level, and the other is that the difference degree is the second difference level. When the difference degree is the first difference level, the update time is determined according to the preset time difference, and the moment when the time difference reaches the preset time difference is determined as the update time; when the difference degree level is the second difference level, the update time can be determined according to the preset time difference, and the moment when the time difference reaches half of the preset time difference is used as the update time. For example, the current time difference is 1 day, and the preset time difference is 7 days, and 2.5 days later can be used as the update time.

[0104] In another possible situation, if any one of the error index, time difference and difference degree reaches the corresponding preset condition, the identity token is updated immediately.

[0105] By setting preset conditions, the embodiments of the present application can clearly define the circumstances under which the identity token needs to be updated, thereby ensuring the accuracy and effectiveness of the update, and generating the update time based on the difference, making the update of the identity token more flexible and personalized. When there is a small difference between the user's access behavior and habits, the system will not trigger the update immediately, but will decide the appropriate update time based on the size of the difference. This ensures security and improves the user experience. When any factor meets the preset conditions, the system can respond quickly and take corresponding security measures to ensure the security of the user's identity and the stability of the system.

[0106] In a possible implementation manner of the embodiment of the present application, the method further includes:

[0107] When a user's access request is detected, the authentication information entered by the user is received;

[0108] Generate a request instruction based on the identity authentication information, and authenticate the request instruction to obtain an identity authentication result;

[0109] If the identity authentication result is successful, an identity token corresponding to the identity authentication information is generated.

[0110] In this embodiment, the electronic device will monitor the user's access request in real time. When it monitors the user's access request, the interactive interface of the electronic device will prompt the user to enter identity authentication information. After receiving the identity authentication information entered by the user, a request instruction will be generated based on the identity authentication information. The request instruction can be an HTTP request, which includes the target URL (that is, the address of the web page or service that the user wants to access) and the identity authentication information entered by the user as part of the request body or request header.

[0111] Further, the request instruction will be sent to the API gateway for preliminary verification. The API gateway will perform format verification on the authentication information in the request instruction to check whether the authentication information in the request instruction meets the expected format specification. If it does, it means the verification is successful. If the API gateway's preliminary authentication result for the authentication information in the request instruction is that the authentication fails, the API gateway will return an error message to prompt the user to re-enter the correct authentication information; if the API gateway's preliminary authentication result for the authentication information in the request instruction is that the authentication passes, the API gateway will be controlled to send the request instruction to CAS. CAS will perform content verification on the authentication information in the request instruction, that is, check whether the username and password match, whether the verification code is correct, etc. If the content verification passes, CAS will return a successful authentication result. If there is incorrect content, CAS will return an error message to prompt the user to re-enter the correct authentication information.

[0112] Furthermore, if the authentication result is successful, a corresponding identity token can be generated based on the user's authentication information. The identity token can be an encrypted string or hash value that identifies the user's identity and access rights. The generated identity token will be stored in the database and associated with the user's authentication information. In subsequent visits, the user can use the identity token to prove his or her identity and access rights. The identity token needs to be checked at each visit. If it is detected that the identity token has been updated compared to the last visit, the user will be required to re-authenticate.

[0113] The embodiment of the present application receives the identity authentication information input by the user, generates a request instruction and performs identity authentication, and finally generates an identity token, thereby providing the user with a safe and convenient access experience, ensuring that only users with legitimate identities can access specific resources, and improving security and user experience.

[0114] A possible implementation of the embodiment of the present application is to authenticate the request instruction and obtain an authentication result, including:

[0115] Send the request instruction to the API gateway and receive the preliminary identity authentication result of the API gateway for the request instruction. The preliminary identity authentication result is the result of the API verifying the format of the request instruction.

[0116] If the preliminary identity authentication result is passed, the API gateway is controlled to send the request instruction to CAS and receive the identity authentication result of the request instruction from CAS. The identity authentication result is the result of CAS verifying the content of the request instruction.

[0117] The embodiment of the present application combines the preliminary identity verification of the API gateway and the content verification of CAS, which can not only quickly filter out malformed requests, but also ensure that only users with legitimate identities can continue to access, thereby improving the security, stability and processing efficiency of the system.

[0118] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the contents shown in the aforementioned identity authentication method embodiment are implemented.

[0119] An electronic device is provided in an embodiment of the present application, such as Figure 2 As shown, Figure 2 The electronic device 200 shown includes: a processor 201 and a memory 203. The processor 201 and the memory 203 are connected, such as through a bus 202. Optionally, the electronic device 200 may also include a transceiver 204. It should be noted that in actual applications, the transceiver 204 is not limited to one, and the structure of the electronic device 200 does not constitute a limitation on the embodiments of the present application.

[0120] The processor 201 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 201 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0121] The bus 202 may include a path to transmit information between the above components. The bus 202 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 202 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 Only one thick line is used in the diagram, but it does not mean that there is only one bus or only one type of bus.

[0122] The memory 203 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0123] The memory 203 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 201. The processor 201 is used to execute the application code stored in the memory 203 to implement the content shown in the above-mentioned identity authentication method embodiment.

[0124] Figure 2 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0125] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the contents shown in the aforementioned XX method embodiment.

[0126] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0127] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An identity authentication method, characterized in that: include: Acquire the user's historical access data, wherein the historical access data includes access times and access contents corresponding to multiple access requests; Determine the target access request closest to the current time from the historical access data, and determine the time difference between the current time and the access time corresponding to the target access request; Determine the access habits of the user according to the access contents corresponding to the multiple access requests in the historical access data, and determine the difference between the access contents corresponding to the target access request and the access habits; Obtaining an identity token, and updating the identity token according to the time difference and the degree of difference, so as to authenticate the access request of the user after the current moment through the updated identity token; The access content corresponding to each access request includes a plurality of access sub-items, and determining the access habits of the user according to the access content corresponding to each of the plurality of access requests in the historical access data includes: Determine the number of accesses corresponding to each access sub-item in the historical access data according to the access contents corresponding to each of the multiple access requests in the historical access data, and obtain the number of accesses corresponding to each of the multiple access sub-items; Determine an access habit index of each access sub-item according to the number of accesses corresponding to each of the plurality of access sub-items, wherein the access habit indexes corresponding to each of the plurality of access sub-items constitute the access habit of the user; Determining the difference between the access content corresponding to the target access request and the access habit includes: Determining a plurality of access sub-items included in the historical access data as a first access sub-item set; Determining a plurality of access sub-items included in the access content corresponding to the target access request as a second access sub-item set; Determine an association relationship between the first access sub-item set and the second access sub-item set; If the association relationship is an intersection relationship, the intersection of the first access sub-item set and the second access sub-item set is taken as a first subset, and the part of the second access sub-item set that is not included in the first access sub-item set is taken as a second subset; The difference between the access content corresponding to the target access request and the access habit is determined according to the access habit index corresponding to each access sub-item in the first subset and the number of access sub-items in the second subset.

2. The identity authentication method according to claim 1, characterized in that: Updating the identity token according to the time difference and the difference degree includes: Acquire, from the historical access data, identity verification information corresponding to the target access request, the identity verification information including the number of incorrect inputs and the input content of each incorrect input; Determining an error index of the target access request according to the number of incorrect inputs corresponding to the target access request and the input content of each incorrect input; The identity token is updated according to the error index, the time difference and the degree of difference.

3. The identity authentication method according to claim 2, characterized in that: Updating the identity token according to the error index, the time difference and the difference degree includes: respectively determining whether the error index, the time difference and the degree of difference meet respective corresponding preset conditions; If the error index, the time difference and the difference degree do not meet their respective corresponding preset conditions, an update time is generated according to the difference degree, so as to update the identity token according to the update time; If any one of the error index, the time difference and the degree of difference reaches a corresponding preset condition, the identity token is updated.

4. The identity authentication method according to claim 1, characterized in that: The method further comprises: When an access request is detected from a user, receiving identity authentication information input by the user; Generate a request instruction based on the identity authentication information, and authenticate the request instruction to obtain an identity authentication result; If the identity authentication result is successful, an identity token corresponding to the identity authentication information is generated.

5. The identity authentication method according to claim 4, characterized in that: The step of authenticating the request instruction to obtain an authentication result includes: Send the request instruction to the API gateway, and receive the preliminary identity authentication result of the API gateway for the request instruction, where the preliminary identity authentication result is the result of the API gateway performing format verification on the request instruction; If the preliminary identity authentication result is that the authentication is passed, the API gateway is controlled to send the request instruction to the CAS, and receive the identity authentication result of the request instruction by the CAS, where the identity authentication result is the result of the CAS performing content verification on the request instruction.

6. A computer program product, characterized in that The invention comprises a computer program, which implements the steps of the identity authentication method according to any one of claims 1 to 5 when executed by a processor.

7. An electronic device, characterized in that: include: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the identity authentication method described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed in a computer, the computer is caused to execute the identity authentication method described in any one of claims 1 to 5.

Images