A terminal identity security authentication method based on WIFI network

Abstract

The present application relates to the field of terminal security technology, and specifically to a terminal identity security authentication method based on a WIFI network, the method comprising: obtaining the WIFI network data and sensor data of the terminal, determining the unreliability of the WIFI; determining the terminal verification coefficient based on the difference between the password input by the user in the terminal and the various passwords and correct passwords saved by the terminal, and combining the terminal use frequency and the unreliability of the WIFI; determining the user feature offset coefficient based on the difference between the sensor data of the terminal when the user uses the terminal and the historical sensor data; determining forward security based on the difference between the terminal verification coefficient when the terminal is used this time and the maximum value of the terminal verification coefficient when it is used historically, and the difference between the maximum value of the user feature offset coefficient when the user feature offset coefficient is used historically; performing terminal identity security authentication with different degrees of strictness. The present application can improve the security and efficiency of terminal identity authentication.

Description

Technical Field

[0001] The present application relates to the field of terminal security technology, and in particular to a terminal identity security authentication method based on a WIFI network. Background Art

[0002] With the popularity of mobile smart devices and WIFI networks, any mobile smart device can now be used as a terminal to interact with the server in a WIFI network environment. Although this technology has brought great convenience, the question that comes with it is how to ensure the security of this interaction. Identity authentication is the first line of defense to protect network information assets and network interactions, and has high requirements for security and efficiency.

[0003] In the existing terminal identity security authentication based on WIFI network, the security of WIFI network is often not considered. In all WIFI networks, the terminal is used by using the password set by the user. However, this method has extremely high requirements for the security of the password, and when the terminal is illegally controlled, a higher or even all terminal usage permissions can be obtained by simply cracking the password, which is undoubtedly unsafe. In order to solve this problem, an attempt is made to use identity authentication based on the RSA encryption algorithm in the security verification of the terminal, but the verification time of the RSA encryption algorithm is relatively long. If identity authentication is frequently performed at the terminal, it will undoubtedly affect the efficiency of use, which conflicts with the convenience advantage of the terminal. Therefore, a safe and efficient terminal identity authentication method is urgently needed. Summary of the invention

[0004] In order to solve the above technical problems, the present application provides a terminal identity security authentication method based on a WIFI network to solve the existing problems.

[0005] The present invention provides a terminal identity security authentication method based on WIFI network using the following technical solutions:

[0006] An embodiment of the present application provides a terminal identity security authentication method based on a WIFI network, the method comprising the following steps:

[0007] Get the terminal's WIFI network data and sensor data;

[0008] Analyze the relationship between the usage interval of WIFI and the preset sleep time in the WIFI network data of the WIFI terminal to determine the unreliability of WIFI;

[0009] The terminal verification coefficient is determined based on the minimum value of the difference between the password entered by the user at the terminal and various passwords saved in the terminal, the degree of difference between the password entered by the user at the terminal and the correct password, and the frequency of terminal use and the unreliability of WIFI;

[0010] Determine a user feature shift coefficient based on the difference between the sensor data of the terminal when the user uses the terminal and the historical sensor data;

[0011] Determine forward security based on the difference between the terminal authentication coefficient when the terminal is used this time and the maximum value of the terminal authentication coefficient when the terminal is used in history, and the difference between the maximum value of the user feature deviation coefficient when the user feature deviation coefficient is used in history;

[0012] Assess the security level of the terminal environment based on forward security and perform terminal identity security authentication with different levels of strictness.

[0013] Optionally, the acquisition of the WIFI network data and sensor data of the terminal further includes:

[0014] The WIFI network data at least includes the WIFI network address, connection time, disconnection time, the time of each terminal identity authentication, and the password information stored in the terminal, and obtains the terminal's trusted WIFI through the terminal's WLAN function;

[0015] A variety of sensors are installed in the terminal, and the sensor data includes at least the angular velocity and angular displacement of the terminal, the distance between the terminal and the user, the gravity acceleration of the terminal, the acceleration of the terminal when in use, and the pressure of the user touching the terminal screen.

[0016] Optionally, the method for determining the unreliability of the WIFI is:

[0017] According to the relationship between the usage interval of the WIFI and the preset sleep time and whether the WIFI belongs to the trusted WIFI of the terminal, the untrusted coefficient of the WIFI is set;

[0018] The ratio of the interval between the current use and the last use of WIFI to the preset sleep time is obtained, the sum of the unreliable coefficient and a preset value greater than zero is obtained, and the ratio and the sum are merged to obtain the unreliability of WIFI.

[0019] Optionally, the setting of the untrustworthy coefficient of WIFI further includes:

[0020] When the interval between the current use and the last use of the WIFI is less than or equal to the preset sleep time and the WIFI is a trusted WIFI of the terminal, the untrustworthy coefficient of the WIFI is set to the first preset value;

[0021] When the interval between the current use and the last use of the WIFI is less than or equal to the preset sleep time and the WIFI is not a trusted WIFI of the terminal, the untrustworthy coefficient of the WIFI is set to a second preset value;

[0022] When the interval between the current use and the last use of WIFI is greater than the preset sleep time, the unreliable coefficient of WIFI is set to a second preset value, wherein the second preset value is greater than the first preset value. When WIFI has not been used, the interval time of WIFI is the preset sleep time plus a value greater than zero.

[0023] Optionally, the terminal verification coefficient is determined by:

[0024] The usage frequency of the WIFI terminal in the recent preset years is counted, the minimum value of the difference between the password input by the user and various passwords saved in the terminal and the sum of the differences between the correct password when the user uses the WIFI terminal this time are analyzed, the division result of the summation result and the usage frequency is obtained, and the product of the unreliability of WIFI and the division result is determined as the terminal verification coefficient.

[0025] Optionally, the method for determining the user characteristic shift coefficient is:

[0026] The data of all sensors in the terminal at each moment are combined into the sensor sequence at each moment, and all sensor sequences of the WIFI terminal before this use are used as each historical sensor sequence; when the user attempts to enter the password when using the terminal this time, the sensor sequence corresponding to the terminal constitutes the sensor set of the terminal used this time;

[0027] Based on the differences between each sensor sequence in the sensor set of the terminal used this time and each historical sensor sequence, a user characteristic shift coefficient of the terminal used this time is determined.

[0028] Optionally, the determining of the user characteristic shift coefficient of the terminal used this time based on the difference between each sensor sequence in the sensor set of the terminal used this time and each historical sensor sequence includes:

[0029] When the number of sensor sequences in the sensor set of the terminal used this time is 1, the user characteristic shift coefficient is the sum of the differences between the sensor sequence in the sensor set of the terminal used this time and all historical sensor sequences;

[0030] When the number of sensor sequences in the sensor set of the terminal used this time is greater than 1, the user characteristic shift coefficient is the average of the sum of the differences between each sensor sequence in the sensor set of the terminal used this time and all historical sensor sequences.

[0031] Optionally, the forward security is determined by:

[0032] The maximum value A of the terminal verification coefficient obtained when using the terminal in the statistical historical data max , the maximum value B of the user characteristic offset coefficient max, the forward security calculation formula is: Where Q is forward security, A and B are the terminal verification coefficient and user feature offset coefficient when using the terminal this time, respectively, and p is a preset value between (0,1).

[0033] Optionally, evaluating the terminal environment security level according to forward security further includes: the terminal environment security level is positively correlated with forward security.

[0034] Optionally, performing terminal identity security authentication with different degrees of strictness includes: the degree of strictness of the terminal identity authentication is negatively correlated with forward security.

[0035] This application has at least the following beneficial effects:

[0036] The present application calculates the terminal verification coefficient according to the WIFI network environment in which the terminal is located, the similarity between the input terminal password and the correct password, and the frequency of terminal use, quantifies the security of the WIFI network environment in which the terminal is located and the correctness of the input password, and helps to relatively accurately judge the strictness of terminal identity authentication; then, according to the physiological habit characteristics of the user using the terminal, the feature shift coefficient is calculated through the sensor data built into the terminal. This physiological habit characteristic is difficult to be stolen, so the feature shift coefficient is used to judge the strictness of terminal identity authentication, which can further enhance the security of the terminal; finally, the forward security of the terminal is determined by combining the terminal verification coefficient and the feature shift coefficient, and terminal identity authentication with different degrees of strictness is performed according to the forward security. In this way, the security of the terminal environment is judged according to the user's WIFI network environment, whether the password is entered correctly, and the changes in physiological characteristics when using the terminal. Forward security is combined with RSA identity authentication. Different identity authentication measures are taken according to the different environments where the terminal is located. Under the premise of ensuring the security of terminal identity authentication based on the WIFI network, the RSA digital certificate update and RSA encryption and decryption verification process are minimized to the greatest extent, providing a safe and efficient terminal identity authentication method. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 A flowchart of the steps of a terminal identity security authentication method based on a WIFI network provided by this application;

[0039] Figure 2 A schematic diagram of the terminal verification coefficient determination process provided for this application. DETAILED DESCRIPTION

[0040] In order to further explain the technical means and effects adopted by the present application to achieve the predetermined invention purpose, the following is a detailed description of the terminal identity security authentication method based on the WIFI network proposed in the present application, its specific implementation method, structure, features and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0041] Unless otherwise defined, terms such as "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a circuit structure, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such articles or devices. In the absence of further restrictions, an element defined by the statement "comprising a ..." does not exclude the presence of other identical elements in the article or device comprising the element. In addition, the term "and\or" used herein includes any and all combinations of one or more related listed items. All technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present application belongs.

[0042] The following is a detailed description of a specific scheme of a terminal identity security authentication method based on a WIFI network provided by the present application in conjunction with the accompanying drawings.

[0043] An embodiment of the present application provides a terminal identity security authentication method based on a WIFI network. For details, please refer to Figure 1 , the method comprises the following steps:

[0044] Step 1: Get the terminal's WIFI network data and sensor data.

[0045] Through the terminal's log and usage data, the data of the terminal connecting to the WIFI network is obtained, including the WIFI network address, connection time, disconnection time, the time of each terminal identity authentication, and the password information stored in the terminal, and the terminal's trusted WIFI network list is obtained through the terminal's WLAN function; sensor data is obtained through various sensors installed in the terminal (including gyroscopes, distance sensors, gravity sensors, acceleration sensors, and pressure sensors in this embodiment), wherein the gyroscope collects the angular velocity and angular displacement data of the terminal, the distance sensor collects the distance between the terminal and the user, the gravity sensor collects the gravity acceleration of the terminal (gravity acceleration can reflect the user's habitual holding direction when using the terminal), the acceleration sensor collects acceleration data when the terminal is used (acceleration data can reflect the shaking and vibration of the user when using the terminal, that is, the stability of the terminal), and the pressure sensor collects the pressure of the user touching or clicking the terminal screen, and the data of all sensor data at the same time constitute a sensor sequence at that time.

[0046] Step 2: Analyze the relationship between the WIFI usage interval and the preset sleep time in the WIFI network data of the WIFI terminal to determine the unreliability of the WIFI. According to the minimum difference between the password entered by the user at the terminal and the various passwords saved in the terminal, and the difference between the password entered by the user at the terminal and the correct password, the terminal verification coefficient is determined in combination with the terminal usage frequency and the unreliability of the WIFI.

[0047] When a user uses a terminal in a fixed WIFI network area for a long time, the WIFI network is often a trusted WIFI network for the user, and the user will use the terminal more frequently in this WIFI network area. Therefore, a simple and efficient identity security authentication method is needed to improve the convenience of using the terminal. On the contrary, when the user is in an unfamiliar WIFI network environment, a more stringent identity security authentication is required to ensure the security of the terminal and the privacy of the user's data.

[0048] In the WIFI network area trusted by the terminal, only the terminal password needs to be entered for identity authentication. When the legitimate user of the terminal enters the password, when the terminal is used less frequently, the user's memory of the password may not be deep enough, and the user will try the password, but the password tried is the password that the user has used before, and these passwords are stored inside the terminal, that is, the password entered by the user and the password stored inside the terminal should have a greater similarity; when the terminal is used more frequently, the probability of the user forgetting the password is small, but the user may make mistakes when entering, resulting in a password error, but the error at this time should only occur in one or a few bits, that is, there is a greater similarity between the input password and the correct password. When the user frequently enters a password that has no association with the terminal, it is considered that the security of the terminal is low, and no association means that the password entered has a low similarity with the password stored inside the terminal and a low similarity with the correct password. In this embodiment, each time the terminal is used, the upper limit of the number of attempts to enter the password is set to 10 times.

[0049] Specifically, the ratio of the interval between the current use and the last use of WIFI to the preset sleep time is obtained, the sum of the unreliable coefficient and a preset value greater than zero is obtained, and the ratio and the sum are combined to obtain the unreliability of WIFI. In this embodiment, W is the unreliability of WIFI, t is the WIFI usage interval, which is used to measure the interval between the last use of the same WIFI and the current time, in days, and rounded up if it is less than 1 day, t0 is the sleep time of WIFI, the longest trust time that a terminal trusts WIFI when it is not used at all, and the implementer can set it by himself. In this embodiment, t0 is 365 (days), and x is the unreliable coefficient of WIFI. It should be noted that when WIFI has not been used, the interval time of WIFI is the preset sleep time plus a value greater than zero. Preferably, in this embodiment, for unfamiliar WIFI that the terminal has never used, its WIFI usage interval is set to t0+1.

[0050] For the untrusted coefficient of the WIFI, the untrusted coefficient of the WIFI is set according to the relationship between the usage interval of the WIFI and the preset sleep time and whether the WIFI belongs to the trusted WIFI of the terminal. When the interval between the current usage and the last usage of the WIFI is less than or equal to the preset sleep time and the WIFI belongs to the trusted WIFI of the terminal, the untrusted coefficient of the WIFI is set to the first preset value;

[0051] When the interval between the current use and the last use of the WIFI is less than or equal to the preset sleep time and the WIFI is not a trusted WIFI of the terminal, the untrustworthy coefficient of the WIFI is set to a second preset value;

[0052] When the interval between the current use of WIFI and the last use is longer than the preset sleep time, the unreliable coefficient of WIFI is set to a second preset value, wherein the second preset value is greater than the first preset value. Preferably, in this embodiment, the expression of the unreliable coefficient of WIFI is:

[0053] Among them, x0 takes values ​​of 0 and 365, wherein the first preset value 0 is the untrustworthy coefficient of the WIFI trusted by the terminal, that is, the untrustworthy coefficient of the WIFI saved in the WIFI trust list of the terminal, and the second preset value 365 is the untrustworthy coefficient of the WIFI not trusted by the terminal.

[0054] It is understandable that when a WIFI is not trusted by the terminal, and the WIFI has not been used for a long time or is used for the first time, the untrustworthiness of the WIFI network is high, that is, the usage interval and untrustworthiness coefficient of the WIFI are both large, so the untrustworthiness of the WIFI is large. When a WIFI is a WIFI trusted by the terminal, but its usage interval exceeds the WIFI sleep time, it is also considered that the untrustworthiness of the WIFI network is high, that is, the usage interval and untrustworthiness coefficient of the WIFI are also large, so the untrustworthiness of the WIFI is also large. On the contrary, for other situations, the untrustworthiness of the WIFI is relatively small.

[0055] The usage frequency of the WIFI terminal in the recent preset years is counted, the minimum value of the difference between the password input by the user and various passwords saved in the terminal when the user uses the WIFI terminal this time and the sum of the differences between the password input and the correct password are analyzed, the division result of the summation result and the usage frequency is obtained, the unreliability of WIFI and the division result are merged to obtain the terminal verification coefficient.

[0056] Preferably, in this embodiment, the calculation formula of the terminal verification coefficient is: The fusion in this embodiment is to combine the unreliability of WIFI and Multiplication, the specific fusion can also be an additive relationship, aiming to ensure that the two are positively correlated with the terminal verification coefficient. The specific fusion implementer sets it according to the actual application scenario, and this embodiment does not impose special restrictions on this. In the formula, A is the terminal verification coefficient, W is the unreliability of WIFI, and "frequency" in this embodiment refers to the frequency of use of the WIFI terminal in the past year. A1 is the difference between the user's input password and the correct password when using the WIFI terminal this time, and A2 is the difference between the user's input password and the password saved by the terminal when using the WIFI terminal this time. In this embodiment, the differences referred to by A1 and A2 are measured by the Hamming distance, A1 is the Hamming distance between the input password and the correct password, and A2 is the minimum value of the Hamming distance between the input password and all the passwords saved in the terminal, where the maximum number of times the password is entered is 10.

[0057] It is understandable that when a terminal is in the hands of a legitimate user, that is, when the user is allowed to use the WIFI terminal, there is a high similarity between the input password and the correct password, so A1 and A2 are both small, and the terminal verification coefficient A is low; even if the user has not used the terminal for a long time and needs to try the password, the password the user attempts to enter will have a high similarity with the password stored inside the terminal, that is, A2 is small, so the terminal verification coefficient A is lower. On the contrary, when the terminal is controlled by an illegal user, strict authentication is required. Since the user does not know any information about the terminal password, attempting to crack the password will result in a low similarity between the input password and the correct password, as well as the password stored inside the terminal, that is, A1 and A2 are both large, so the terminal verification coefficient A is correspondingly higher. Finally, when the terminal is in a non-terminal trusted WIFI network area, a relatively strict identity security authentication is required. At this time, W is large, which makes the terminal verification coefficient A larger.

[0058] See also Figure 2 , Figure 2 Schematic diagram of the process for determining the terminal verification coefficient.

[0059] However, with the advancement of technology, adversaries can predict passwords based on users' life experiences, preferences or other information, and these auxiliary information greatly enhance the adversary's ability to crack passwords. Therefore, relying solely on a terminal password for security authentication is far from enough.

[0060] Step 3: Determine the user feature shift coefficient based on the difference between the sensor data of the terminal when the user uses the terminal and the historical sensor data.

[0061] In addition to traditional security authentication methods based on terminal passwords, modern technology also uses some biometric features (such as fingerprints and irises) as a means of verification. However, these biometric features may be stolen, and when performing iris verification, professional sensors are required, which requires redesigning the components inside the terminal. This undoubtedly increases the cost and difficulty of biometric-based verification.

[0062] However, when a user uses a terminal, due to the user's own physiological characteristics, including but not limited to palm size and fingertip pressure, these data can be obtained through the sensor inside the terminal. Moreover, these data are the comprehensive results of the user's usage habits and physiological characteristics. Even for the same user, it is impossible to be completely consistent every time, making it difficult to be stolen. By measuring the similarity between the sensor data when the user enters the password and the historical sensor data, the degree of deviation of the user's physiological characteristics can be determined.

[0063] When the user uses the terminal this time, the sensor sequences corresponding to all attempts to enter the password constitute the sensor set of the terminal used this time. In this embodiment, all sensor sequences of the terminal before this use are used as the historical sensor sequences of the terminal. Further, based on the difference between the sensor data of the terminal when the user uses the terminal and the historical sensor data, the user feature shift coefficient is determined:

[0064] When the number of sensor sequences in the sensor set of the terminal used this time is 1, the user characteristic shift coefficient is the sum of the differences between the sensor sequence in the sensor set of the terminal used this time and all historical sensor sequences;

[0065] When the number of sensor sequences in the sensor set of the terminal used this time is greater than 1, the user feature offset coefficient is the average of the sum of the differences between each sensor sequence in the sensor set of the terminal used this time and all historical sensor sequences, that is, In the formula, C i is the sum of the differences between the ith sensor sequence in the sensor set of the terminal used this time and all historical sensor sequences, b is the number of sensor sequences in the sensor set of the terminal used this time, where b is greater than 1. In this embodiment, the difference between two sensor sequences is calculated using the Euclidean distance.

[0066] It is understandable that when a legitimate user uses a terminal, due to their inherent usage habits and physiological characteristics, the sensor sequence when the terminal is used this time will have a high similarity with the historical sensor sequence, so that the characteristic shift coefficient B is small. On the contrary, when an illegal user uses the terminal, the characteristics and usage habits during the use process are inconsistent with those of the legitimate user, resulting in a low similarity between the sensor sequence when the terminal is used this time and the historical sensor sequence, and a high similarity between the sensor sequences when the terminal is used this time, but inconsistent with the historical sensor sequence, so that the characteristic shift coefficient is large.

[0067] Step 4: Determine forward security based on the difference between the terminal verification coefficient when the terminal is used this time and the maximum value of the terminal verification coefficient when it is used historically, and the difference between the maximum value of the user feature shift coefficient when the user feature shift coefficient is used historically.

[0068] Finally, the terminal verification coefficient and feature shift coefficient are used to determine the WIFI network environment in which the terminal is located and whether the terminal is illegally controlled, and then forward security is used to determine whether identity authentication can be performed based on the RSA digital certificate in the historical data. Forward security is determined based on the difference between the terminal verification coefficient when the terminal is used this time and the maximum value of the terminal verification coefficient when it is used historically, and the difference between the maximum value of the user feature shift coefficient when the user feature shift coefficient is used historically. The corresponding expression is:

[0069]

[0070] Where Q is the forward security, A and B are the terminal verification coefficient and user feature offset coefficient when using the terminal this time, respectively. max , B max is the maximum value of the terminal verification coefficient and the maximum value of the user characteristic deviation coefficient obtained when the terminal is used in the historical data, and p is a value between (0, 1), and in this embodiment, the value is 0.5.

[0071] It can be understood that when the terminal is in a trusted WIFI network environment, the input password is the correct password, and there is no signal of illegal control on the terminal, that is, the terminal verification coefficient when the terminal is used this time is 0, and the user feature offset coefficient is less than the maximum value of the user feature offset coefficient when the terminal identity is authenticated in the historical data, thereby assigning forward security of 1, indicating that the terminal is in a safe environment. When the terminal is in an untrusted WIFI network environment, the input password is an incorrect password or an irrelevant password, and there is a signal of illegal control, that is, the terminal verification coefficient when the terminal is used this time is greater than the terminal verification coefficient when the terminal identity is authenticated in the historical data, and the user feature offset coefficient is greater than the maximum value of the user feature offset coefficient when the terminal identity is authenticated in the historical data, thereby assigning forward security of 0, indicating that the terminal is in a completely untrusted environment. In other cases, the forward security is assigned to 0.5, indicating that the terminal is in an environment that is not completely trusted.

[0072] Step 5: Evaluate the security level of the terminal environment based on forward security and perform terminal identity security authentication with different levels of strictness.

[0073] According to the forward security obtained, the terminal determines whether the RSA digital certificate in the historical data can be used for identity authentication according to the requirements of forward security, evaluates the terminal environment security according to the forward security, and performs terminal identity security authentication with different degrees of strictness. Among them, the terminal environment security is positively correlated with the forward security, that is, the greater the forward security, the higher the terminal environment security, and the safer the terminal environment; the smaller the forward security, the lower the corresponding terminal environment security, and the less safe the terminal environment. At the same time, the strictness of terminal identity authentication is negatively correlated with forward security. The specific terminal identity authentication method is set by the implementer according to the actual application scenario, but it needs to be guaranteed that the greater the forward security, the lower the strictness of terminal identity authentication, that is, the less strict identity authentication is required; the smaller the forward security, the higher the strictness of terminal identity authentication, that is, the more strict identity authentication is required for identity authentication.

[0074] Preferably, in this embodiment, the historical data of the terminal includes the RSA digital certificate used for terminal identity security verification, and the identity authentication process is set according to the forward security requirements. In this embodiment, when the forward security is 1, the corresponding terminal environment is safe, and the RSA digital certificate in the historical data can be used to directly perform identity authentication without the user entering any verification code; when the forward security is 0.5, the corresponding terminal is in an incompletely trusted environment, and the terminal password may be leaked or the WIFI network environment may be unsafe. At this time, the user is required to manually enter the public key in the RSA digital certificate for verification. The terminal will compare the public key entered by the user with the public key of the RSA digital certificate in the historical data. If they are consistent, the verification is passed and the user can enter the terminal.

[0075] When the forward security is 0, the corresponding terminal environment is unsafe. To avoid leakage and impact of terminal historical data, the terminal will directly delete the RSA digital certificate in the historical data and send an RSA digital certificate expiration request to the relevant authoritative management center. The relevant authoritative management center will directly delete the private key of the terminal. At this time, the terminal is completely in a state where it cannot be logged in; the relevant authoritative management center sends an RSA digital certificate expiration notification to legitimate users through a secure channel. Legitimate users need to initiate a new RSA digital certificate update request to the authoritative center based on the notification. After the authoritative center updates the RSA digital certificate, it sets the corresponding updated private key as the terminal private key and sends the updated RSA digital certificate to the user. The user needs to use the public key in the updated RSA digital certificate to log in to the terminal. After successful login, the terminal will save the updated RSA digital certificate to the terminal's historical data again.

[0076] Through the above process of this embodiment, identity authentication measures of different strictness are adopted according to the different environments in which the terminal is located. Under the premise of ensuring the security of terminal identity authentication based on the WIFI network, the number of RSA digital certificate updates and the RSA encryption and decryption verification process are minimized, thereby providing safe and efficient terminal identity authentication.

[0077] It is understood that references to "one embodiment" or "some embodiments" etc. described in the specification of the present application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, if "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. appear in different places in this specification, they do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0078] It should be noted that the sequence of the above-mentioned embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-tasking and parallel processing are also possible or may be advantageous. At the same time, the size of the sequence number of each step in the embodiment does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments in this specification.

[0079] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A terminal identity security authentication method based on WIFI network, characterized in that: The method comprises the following steps: Get the terminal's WIFI network data and sensor data; Analyze the relationship between the usage interval of WIFI and the preset sleep time in the WIFI network data of the WIFI terminal to determine the unreliability of WIFI; The terminal verification coefficient is determined based on the minimum value of the difference between the password entered by the user at the terminal and various passwords saved in the terminal, the degree of difference between the password entered by the user at the terminal and the correct password, and the frequency of terminal use and the unreliability of WIFI; Determine a user feature shift coefficient based on the difference between the sensor data of the terminal when the user uses the terminal and the historical sensor data; Determine forward security based on the difference between the terminal verification coefficient when the terminal is used this time and the maximum value of the terminal verification coefficient when the terminal is used in the past, and the difference between the user feature deviation coefficient when the terminal is used this time and the maximum value of the user feature deviation coefficient when the terminal is used in the past; Assess the security level of the terminal environment based on forward security and perform terminal identity security authentication with different levels of strictness.

2. A terminal identity security authentication method based on a WIFI network as claimed in claim 1, characterized in that: The acquisition of the WIFI network data and sensor data of the terminal further includes: The WIFI network data at least includes the WIFI network address, connection time, disconnection time, the time of each terminal identity authentication, and the password information stored in the terminal, and obtains the terminal's trusted WIFI through the terminal's WLAN function; A variety of sensors are installed in the terminal, and the sensor data includes at least the angular velocity and angular displacement of the terminal, the distance between the terminal and the user, the gravity acceleration of the terminal, the acceleration of the terminal when in use, and the pressure of the user touching the terminal screen.

3. A terminal identity security authentication method based on a WIFI network as claimed in claim 2, characterized in that: The method for determining the unreliability of the WIFI is: According to the relationship between the usage interval of the WIFI and the preset sleep time and whether the WIFI belongs to the trusted WIFI of the terminal, the untrusted coefficient of the WIFI is set; The ratio of the interval between the current use and the last use of WIFI to the preset sleep time is obtained, the sum of the unreliable coefficient and a preset value greater than zero is obtained, and the ratio and the sum are merged to obtain the unreliability of WIFI.

4. A terminal identity security authentication method based on a WIFI network as claimed in claim 3, characterized in that: The setting of the untrustworthy coefficient of WIFI further includes: When the interval between the current use and the last use of the WIFI is less than or equal to the preset sleep time and the WIFI is a trusted WIFI of the terminal, the untrustworthy coefficient of the WIFI is set to the first preset value; When the interval between the current use and the last use of the WIFI is less than or equal to the preset sleep time and the WIFI is not a trusted WIFI of the terminal, the untrustworthy coefficient of the WIFI is set to a second preset value; When the interval between the current use and the last use of WIFI is greater than the preset sleep time, the unreliable coefficient of WIFI is set to a second preset value, wherein the second preset value is greater than the first preset value. When WIFI has not been used, the interval time of WIFI is the preset sleep time plus a value greater than zero.

5. A terminal identity security authentication method based on a WIFI network as claimed in claim 1, characterized in that: The method for determining the terminal verification coefficient is: The usage frequency of the WIFI terminal in the recent preset years is counted, the minimum value of the difference between the password input by the user and various passwords saved in the terminal and the sum of the differences between the correct password when the user uses the WIFI terminal this time are analyzed, the division result of the summation result and the usage frequency is obtained, and the product of the unreliability of WIFI and the division result is determined as the terminal verification coefficient.

6. A terminal identity security authentication method based on a WIFI network as claimed in claim 2, characterized in that: The method for determining the user characteristic shift coefficient is: The data of all sensors in the terminal at each moment are combined into the sensor sequence at each moment, and all sensor sequences of the WIFI terminal before this use are used as each historical sensor sequence; when the user attempts to enter the password when using the terminal this time, the sensor sequence corresponding to the terminal constitutes the sensor set of the terminal used this time; Based on the differences between each sensor sequence in the sensor set of the terminal used this time and each historical sensor sequence, a user characteristic shift coefficient of the terminal used this time is determined.

7. A terminal identity security authentication method based on a WIFI network as claimed in claim 6, characterized in that: The determining of the user characteristic shift coefficient of the terminal used this time based on the difference between each sensor sequence in the sensor set of the terminal used this time and each historical sensor sequence includes: When the number of sensor sequences in the sensor set of the terminal used this time is 1, the user characteristic shift coefficient is the sum of the differences between the sensor sequence in the sensor set of the terminal used this time and all historical sensor sequences; When the number of sensor sequences in the sensor set of the terminal used this time is greater than 1, the user characteristic shift coefficient is the average of the sum of the differences between each sensor sequence in the sensor set of the terminal used this time and all historical sensor sequences.

8. A terminal identity security authentication method based on a WIFI network as claimed in claim 1, characterized in that: The method for determining the forward security is: The maximum value A of the terminal verification coefficient obtained when using the terminal in the statistical historical data max , the maximum value B of the user characteristic offset coefficient max , the forward security calculation formula is: Where Q is forward security, A and B are the terminal verification coefficient and user feature offset coefficient when using the terminal this time, respectively, and p is a preset value between (0,1).

9. A terminal identity security authentication method based on a WIFI network as claimed in claim 8, characterized in that: The step of evaluating the terminal environment security level according to forward security further includes: the terminal environment security level is positively correlated with forward security.

10. A terminal identity security authentication method based on a WIFI network as claimed in claim 1, characterized in that: The performing terminal identity security authentication with different strictness levels includes: the strictness of the terminal identity authentication is negatively correlated with the forward security.

Images