Large-scale multi-terminal access authentication method, device, computer equipment and medium

Abstract

The present application relates to a large-scale multi-terminal access authentication method, device, computer equipment and medium, wherein the method includes: obtaining an authentication request sent by a terminal; parsing the authentication request, obtaining a communication protocol identifier, a terminal type identifier and user demand data corresponding to the authentication request; inputting the terminal type identifier and the user demand data into a preset machine learning model, combining the preset machine learning model output result and the communication protocol identifier, determining a target authentication protocol that matches the authentication request; converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data; and performing access authentication on the format conversion data based on an authentication source corresponding to the target authentication protocol. The entire solution can meet the access authentication requirements of different types of terminals and achieve efficient large-scale multi-terminal access authentication.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a large-scale multi-terminal access authentication method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the development of Internet technology, terminal device authentication is required in more and more application scenarios.

[0003] Traditional authentication methods (systems) usually require each terminal device to be authenticated separately, and usually rely on a single authentication protocol, such as SAML (Security Assertion Markup Language) or OAuth. These protocols each have their own specific application scenarios and scope of application. It is difficult for a single protocol to fully cover the diverse needs of different types of terminal devices and to achieve efficient multi-terminal authentication. For example, the SAML protocol performs well in enterprise-level single sign-on (SSO), but is not ideal in mobile devices and consumer applications. In contrast, OAuth is more suitable for these scenarios, but may lack the necessary flexibility and security when dealing with enterprise-level applications.

[0004] As the types and number of terminal devices increase, multiple authentication protocols need to be supported in actual application scenarios to ensure seamless access to various devices and applications. Summary of the invention

[0005] Based on this, it is necessary to provide an efficient large-scale multi-terminal access authentication method, device, computer equipment, storage medium and computer program product to address the above technical problems.

[0006] In a first aspect, the present application provides a large-scale multi-terminal access authentication method. The method comprises:

[0007] Get the authentication request sent by the terminal;

[0008] Parsing the authentication request to obtain a communication protocol identifier, a terminal type identifier, and user requirement data corresponding to the authentication request;

[0009] Input the terminal type identifier and the user requirement data into a preset machine learning model, and determine a target authentication protocol that matches the authentication request in combination with an output result of the preset machine learning model and the communication protocol identifier;

[0010] Converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data;

[0011] Access authentication is performed on the format conversion data based on an authentication source corresponding to the target authentication protocol.

[0012] In one embodiment, parsing the authentication request and obtaining the communication protocol identifier, terminal type identifier, and user requirement data corresponding to the authentication request includes:

[0013] Parsing the authentication request to obtain a communication protocol identifier, a terminal type identifier, and a user identity identifier carried in the authentication request;

[0014] Based on the user identity, query the user's historical access data and user role identification;

[0015] An application scenario corresponding to the authentication request is identified, and user demand data is generated according to the application scenario, the user historical access data and the user role identifier.

[0016] In one embodiment, the large-scale multi-terminal access authentication method further includes:

[0017] Detecting the format, signature and carried parameters of the authentication request;

[0018] Based on the format, signature and carried parameters of the authentication request, a preset automated verification tool is called to verify the legitimacy and integrity of the authentication request;

[0019] If the legality and integrity verification are passed, the process proceeds to the step of parsing the authentication request to obtain the communication protocol identifier, terminal type identifier, and user requirement data corresponding to the authentication request.

[0020] In one embodiment, converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data includes:

[0021] Acquire real-time environment status parameters, wherein the real-time environment status parameters include real-time network status parameters and real-time server load status parameters;

[0022] Based on the terminal type identifier and the real-time environment status parameter, searching for a matching conversion rule from a preset rule library;

[0023] According to the conversion rule, the authentication request is converted into a protocol format corresponding to the target authentication protocol to obtain format conversion data.

[0024] In one embodiment, the performing access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol includes:

[0025] Identifying a risk level corresponding to the authentication request;

[0026] Based on the risk level, determining an authentication method;

[0027] The format conversion data is access authenticated using a determined authentication method and based on an authentication source corresponding to the target authentication protocol.

[0028] In one embodiment, identifying the risk level corresponding to the authentication request includes:

[0029] Obtaining the authentication request object identity information carried in the authentication request;

[0030] Based on the authentication request object identity information, query the historical authentication request data in the historical records;

[0031] Extracting key features of the historical authentication request data, the key features including timestamp, request frequency, and geographic location;

[0032] Obtaining a risk assessment score corresponding to the authentication request according to the key features and a preset assessment algorithm, wherein the preset assessment algorithm is constructed based on an isolation forest and a local anomaly factor detection algorithm;

[0033] According to the risk assessment score, a risk level corresponding to the authentication request is identified.

[0034] In one embodiment, obtaining the risk assessment score corresponding to the authentication request according to the key feature and the preset assessment algorithm includes:

[0035] generating a plurality of feature matrices based on the key features;

[0036] Using isolation forest to perform preliminary anomaly detection on the multiple feature matrices to obtain an abnormal feature matrix and a preliminary anomaly detection score;

[0037] Based on the abnormal feature matrix and the key features, generating multiple abnormal point matrices;

[0038] Calculate the local anomaly factor based on the preset neighbor value and multiple anomaly point matrices to obtain the local anomaly detection score;

[0039] A risk assessment score corresponding to the authentication request is obtained according to the local anomaly detection score and the preliminary anomaly detection score.

[0040] In a second aspect, the present application also provides a large-scale multi-terminal access authentication device. The device includes:

[0041] A request acquisition module, used to acquire the authentication request sent by the terminal;

[0042] A parsing module, used to parse the authentication request and obtain a communication protocol identifier, a terminal type identifier, and user requirement data corresponding to the authentication request;

[0043] A protocol confirmation module, used to input the terminal type identifier and the user demand data into a preset machine learning model, and determine a target authentication protocol that matches the authentication request in combination with an output result of the preset machine learning model and the communication protocol identifier;

[0044] A format conversion module, used to convert the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data;

[0045] An authentication module is used to perform access authentication on the format conversion data based on an authentication source corresponding to the target authentication protocol.

[0046] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0047] Get the authentication request sent by the terminal;

[0048] Parsing the authentication request to obtain a communication protocol identifier, a terminal type identifier, and user requirement data corresponding to the authentication request;

[0049] Input the terminal type identifier and the user requirement data into a preset machine learning model, and determine a target authentication protocol that matches the authentication request in combination with an output result of the preset machine learning model and the communication protocol identifier;

[0050] Converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data;

[0051] Access authentication is performed on the format conversion data based on an authentication source corresponding to the target authentication protocol.

[0052] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0053] Get the authentication request sent by the terminal;

[0054] Parsing the authentication request to obtain a communication protocol identifier, a terminal type identifier, and user requirement data corresponding to the authentication request;

[0055] Input the terminal type identifier and the user requirement data into a preset machine learning model, and determine a target authentication protocol that matches the authentication request in combination with an output result of the preset machine learning model and the communication protocol identifier;

[0056] Converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data;

[0057] Access authentication is performed on the format conversion data based on an authentication source corresponding to the target authentication protocol.

[0058] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0059] Get the authentication request sent by the terminal;

[0060] Parsing the authentication request to obtain a communication protocol identifier, a terminal type identifier, and user requirement data corresponding to the authentication request;

[0061] Input the terminal type identifier and the user requirement data into a preset machine learning model, and determine a target authentication protocol that matches the authentication request in combination with an output result of the preset machine learning model and the communication protocol identifier;

[0062] Converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data;

[0063] Access authentication is performed on the format conversion data based on an authentication source corresponding to the target authentication protocol.

[0064] The above-mentioned large-scale multi-terminal access authentication method, device, computer equipment, storage medium and computer program product obtain the authentication request sent by the terminal; parse the authentication request to obtain the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request; input the terminal type identifier and user demand data into the preset machine learning model, and determine the target authentication protocol that matches the authentication request in combination with the preset machine learning model output result and the communication protocol identifier; convert the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data; perform access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol. In the whole process, the target authentication protocol that matches the current authentication request is determined based on the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request, and the data required for the target authentication protocol is obtained by format conversion, which can meet the access authentication requirements of different types of terminals and realize efficient large-scale multi-terminal access authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 This is an application environment diagram of a large-scale multi-terminal access authentication method in an embodiment;

[0066] Figure 2A schematic diagram of a large-scale multi-terminal access authentication method in one embodiment;

[0067] Figure 3 A schematic diagram of a flow chart of a large-scale multi-terminal access authentication method in another embodiment;

[0068] Figure 4 A schematic diagram of an application scenario of a large-scale multi-terminal access authentication method in an embodiment;

[0069] Figure 5 It is a structural block diagram of a large-scale multi-terminal access authentication device in an embodiment;

[0070] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0071] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0072] The large-scale multi-terminal access authentication method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. There can be multiple terminals 102, and these terminals send access serious requests to the server 104, and the server 104 obtains the authentication request sent by the terminal; parses the authentication request, obtains the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request; inputs the terminal type identifier and user demand data into the preset machine learning model, and combines the preset machine learning model output result and the communication protocol identifier to determine the target authentication protocol that matches the authentication request; converts the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data; and performs access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol. Further, the server 104 can feedback the authentication results to multiple terminals, and the authentication results specifically include allowing access and not allowing access. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable device may be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0073] In one embodiment, Figure 2 As shown, a large-scale multi-terminal access authentication method is provided, which is applied to Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0074] S100: Obtain an authentication request sent by a terminal.

[0075] Here, authentication requests sent by multiple terminals can be received, and the authentication requests may carry terminal type identification, terminal identity identification (such as terminal MAC), and communication protocol identification corresponding to the authentication request sent by the terminal. Specifically, obtaining authentication requests sent by terminals (such as smartphones, computers, or any other devices that can connect to the network) usually involves network communication and identity authentication processes. These requests can occur when using various protocols.

[0076] S200: Parse the authentication request, and obtain the communication protocol identifier, terminal type identifier, and user requirement data corresponding to the authentication request.

[0077] When processing the authentication request sent by the terminal, several key steps are usually involved, including receiving the request, parsing the request content, identifying the communication protocol, determining the terminal type, and further analyzing and extracting user demand data. Specifically, it includes the following processing stages: 1) Receive the authentication request. First, the server needs to have a listening mechanism to receive the authentication request from the terminal (such as mobile devices, PCs, IoT devices, etc.). This is usually implemented through a network interface. 2) Parse the request content. Once the request is received, the next step is to parse the request content. This usually involves reading the request header (Headers) and the request body (Body). The request header may contain information about the request method, request path (URL), content type (Content-Type), and possible authentication tokens. The request body contains specific authentication data or other user data. 3) Identify the communication protocol identifier. The communication protocol identifier can usually be inferred from the request header or the port used. For example, HTTP (HyperText Transfer Protocol) and HTTPS usually use ports 80 and 443, while WebSocket may use other specific ports. 4) Determine the terminal type identifier. Determining the terminal type usually relies on specific header information in the request, such as the User-Agent field. The User-Agent string contains information about the browser, operating system, device model, etc. that initiated the request. By analyzing this string, the terminal type of the request (such as iPhone, Android phone, Windows PC, etc.) can be identified. 5) Extract user demand data. User demand data is usually included in the request body. Depending on the content type of the request, different parsing methods are used to extract this data. For example, if Content-Type is application / json, a JSON parser can be used to read and parse the data in the request body. This data may include user name, password, device ID, permission request, etc.

[0078] S300: Input the terminal type identification and user demand data into the preset machine learning model, and determine the target authentication protocol that matches the authentication request based on the output result of the preset machine learning model and the communication protocol identification.

[0079] The preset machine learning model is a pre-trained machine learning model, which is specifically used to analyze the matching authentication protocol according to the terminal type and user requirements. Specifically, the terminal type identifier and user requirement data can be input into the preset machine learning model, at which time the preset machine learning model can output a matching authentication protocol list, and then further determine the target authentication protocol that matches the authentication request from the authentication protocol list based on the communication protocol identifier.

[0080] S400: Convert the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data.

[0081] Converting an authentication request to a protocol format corresponding to the target authentication protocol usually involves several steps, including parsing the original request, building the request data in the target protocol format, and performing security processing such as data encryption or signing. Specifically, it includes the following stages: 1) Parsing the original authentication request. First, the received original authentication request needs to be parsed to obtain all necessary authentication information and user data. This usually involves reading the request header and request body, and extracting key information such as username, password, device ID, timestamp, token, etc. 2) Determine the target authentication protocol. Clearly define the target authentication protocol to convert the authentication request to. This may be OAuth 2.0, SAML (Security Assertion Markup Language), JWT (JSON Web Tokens), OAuth 1.0a, or any other custom or industry standard protocol. 3) Build the request data in the target protocol format. According to the requirements of the target authentication protocol, use the data extracted from the original request to build the new request data, including: Creating the necessary authentication tokens: If the target protocol uses tokens (such as JWT, OAuth access tokens), these tokens need to be generated according to the protocol specification. Assemble request parameters: Assemble user data and other necessary information according to the parameter format of the target protocol. Set request headers: Configure appropriate request headers, such as Authorization, Content-Type, etc., to meet the requirements of the target protocol. 4) Security processing. Data encryption: If the target protocol requires encrypted request data or tokens, corresponding encryption processing is required. Signature: In order to verify the integrity and authenticity of the request, it may be necessary to use algorithms such as HMAC (Hash-based Message Authentication Code, hash-based message authentication code), RSA (Rivest-Shamir-Adleman, asymmetric encryption algorithm) to sign the request data. 5) Get format conversion data After completing the above steps, you will have request data that conforms to the format of the target authentication protocol. This can be an encrypted token, an HTTP request body containing necessary parameters, or an HTTP request header containing authentication information.

[0082] Furthermore, in the process of protocol conversion, standardized interfaces are adopted: standardized protocol conversion interfaces are provided to simplify development and integration; dynamic adaptation: conversion rules are dynamically adjusted according to the real-time environment and device type; efficient conversion: conversion algorithms are optimized to improve protocol conversion efficiency and reduce latency; security assurance: data encryption and integrity verification are ensured during the conversion process.

[0083] S500: Perform access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol.

[0084] After the target authentication protocol is determined, the authentication source corresponding to the target authentication protocol is used to perform access authentication on the format conversion data. Specifically, according to different authentication protocols, standard protocol libraries or SDKs (Software Development Kits), such as OAuth 2.0 libraries, SAML libraries, etc., can be used to simplify the development and maintenance of the authentication process. Furthermore, during the authentication process, the user's identity can be further verified by sending SMS verification codes, email verification codes, or dynamic passwords. After the authentication is successful, the corresponding token or authentication credential is generated, and the authentication result is recorded. After the access authentication is passed, the authentication result is returned to the terminal device. After the authentication is completed, the authentication status, the generated token or authentication credential and other information are packaged into a response message and sent back to the terminal device. In the specific implementation, a standard HTTP response or other protocol format can be used to ensure that the authentication result can be correctly parsed and processed by the terminal device. In order to improve the user experience, detailed error information and solution suggestions can also be provided to help users quickly locate and solve problems when authentication fails. The server can also record detailed logs for each authentication, including request time, processing time, authentication results, etc., for subsequent auditing and analysis.

[0085] The above-mentioned large-scale multi-terminal access authentication method obtains the authentication request sent by the terminal; parses the authentication request to obtain the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request; inputs the terminal type identifier and user demand data into the preset machine learning model, and determines the target authentication protocol that matches the authentication request in combination with the preset machine learning model output result and the communication protocol identifier; converts the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data; and performs access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol. In the whole process, the target authentication protocol that matches the current authentication request is determined based on the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request, and the data required for the target authentication protocol is obtained by format conversion, which can meet the access authentication requirements of different types of terminals and realize efficient large-scale multi-terminal access authentication.

[0086] like Figure 3 As shown, in one embodiment, S200 includes:

[0087] S220: Parse the authentication request, and obtain the communication protocol identifier, terminal type identifier, and user identity identifier carried in the authentication request.

[0088] Communication protocol identification: Infer the communication protocol (such as HTTP, HTTPS, WebSocket, etc.) from the request header or the port used. Terminal type identification: Determine the terminal type (such as mobile device, desktop browser, IoT device, etc.) by analyzing the User-Agent field or other specific header information in the request. User identity identification: Extract information used to identify the user from the request, such as user name, user ID, token, etc.

[0089] S240: Based on the user identity identifier, query the user's historical access data and the user role identifier.

[0090] Based on the user identity, the user's historical access data and user role identification are queried from the preset database. The user's historical access data includes previously visited resources, access time, access frequency, etc. User role identification includes administrator, ordinary user, visitor, etc.

[0091] S260: Identify the application scenario corresponding to the authentication request, and generate user demand data according to the application scenario, user historical access data and user role identification.

[0092] Based on other information of the authentication request (such as the path, parameters, or specific fields in the request body) and the user's historical access pattern, the application scenario corresponding to the authentication request is identified. The application scenario can be a specific functional module, a stage of a business process, or a specific user operation. Combine the identified application scenario, user historical access data, and user role identification to generate user demand data. This data may include: Expected resources to access: Based on the user's historical access records and current requests, predict the resources that the user may want to access or the operations to perform. Permission verification information: Based on the user's role and the requested resource, generate the necessary permission verification information to determine whether the user has the right to access the resource. Personalized settings: Generate personalized settings or recommended information based on the user's preferences and historical behavior. Security verification requirements: Determine whether additional security verification steps (such as multi-factor authentication) are required based on the application scenario and user role.

[0093] In one embodiment, the large-scale multi-terminal access authentication method further includes:

[0094] Detect the format, signature and carried parameters of the authentication request; based on the format, signature and carried parameters of the authentication request, call the preset automated verification tool to verify the legitimacy and integrity of the authentication request; if the legitimacy and integrity verification pass, enter the step of parsing the authentication request to obtain the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request.

[0095] Before parsing the authentication request, the authentication request can also be verified for legitimacy and integrity. If the legitimacy and integrity verification pass, the authentication request will be parsed to obtain the communication protocol identifier, terminal type identifier, and user demand data corresponding to the authentication request; if the legitimacy and integrity verification fails, a message indicating an authentication request error will be fed back to the corresponding terminal. Specifically, in the authentication process, it is a key security step to check the format, signature, and parameters of the authentication request, and then use the preset automated verification tool to verify the legitimacy and integrity. This helps ensure that only valid, untampered requests are further processed.

[0096] The entire legitimacy and integrity verification includes the following steps: 1) Receiving the authentication request: The authentication server receives the authentication request from the terminal device. 2) Preliminary verification: Verify the legitimacy and integrity of the request, including checking the request format, signature, and necessary parameters. 3) Device information recording: Record device identifier, request time, IP address, and other information. 4) Transfer request: The request that passes the preliminary verification enters the next step of parsing and processing. Furthermore, in the above verification process, the preset automated verification tool and rule engine are called to verify the legitimacy and integrity of the authentication request to improve the efficiency and accuracy of the preliminary verification.

[0097] In one embodiment, converting the authentication request into a protocol format corresponding to a target authentication protocol to obtain format conversion data includes:

[0098] Step 1: Obtain real-time environment status parameters, which include real-time network status parameters and real-time server load status parameters.

[0099] In the process of converting the authentication request into the protocol format corresponding to the target authentication protocol, considering the real-time environment status parameters (such as real-time network status parameters and real-time server load status parameters) and the terminal type identification is an important step to optimize the user experience and system performance. Here, real-time network status parameters: These parameters describe the current network conditions, such as bandwidth, latency, packet loss rate, etc. They are crucial for making decisions such as whether to compress the authentication request and whether to use an algorithm with higher encryption strength. Real-time server load status parameters: These parameters reflect the current load of the server, such as CPU usage, memory occupancy, number of concurrent connections, etc. Understanding the server load helps to decide whether the complexity of the conversion process needs to be adjusted to avoid excessive consumption of server resources.

[0100] Step 2: Based on the terminal type identifier and real-time environment status parameters, search for matching conversion rules from the preset rule library.

[0101] Terminal type identification: As before, this is used to identify the type of terminal that initiated the authentication request (such as mobile devices, desktop browsers, etc.). Different terminal types may have different performance characteristics and network conditions, so targeted conversion rules are required. Preset rule base: This is a database or configuration file that stores a variety of conversion rules. Each rule defines how to convert the authentication request to a specific format of protocol under different conditions (such as specific terminal type, network status, server load, etc.). Find matching rules: Based on the current terminal type identification and real-time environmental status parameters, find the best matching conversion rule in the preset rule base. This requires comprehensive consideration of multiple factors and certain weight calculations or logical judgments.

[0102] Step 3: According to the conversion rule, the authentication request is converted into a protocol format corresponding to the target authentication protocol to obtain format conversion data.

[0103] Apply transformation rules: Once a matching transformation rule is found, the authentication request is transformed according to the rule. This may include modifying the request header, adjusting the request body format, adding or removing specific parameters, applying encryption or compression algorithms, etc. Generate format conversion data: After conversion, the authentication request data that conforms to the target authentication protocol format is obtained, which can be further processed for authentication.

[0104] In one embodiment, performing access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol includes:

[0105] Step 1: Identify the risk level corresponding to the authentication request.

[0106] In the process of access authentication of format conversion data based on the authentication source corresponding to the target authentication protocol, it is an important security strategy to consider the risk level of the authentication request. This helps the system select the appropriate authentication method according to the potential risk level, thereby improving the security and efficiency of the authentication process. Specifically, the following processing is required here: Analyze request features: First, analyze the authentication request and extract key features, such as the IP address of the request source, the request time, the request frequency, the parameters carried in the request, etc. Apply the risk assessment model: Use the preset risk assessment model or algorithm to score or classify the extracted features to determine the risk level of the authentication request. The risk assessment model may be built based on historical data, machine learning algorithms, or expert rule bases. Determine the risk level: According to the results of the risk assessment, the authentication request is divided into different risk levels, such as low risk, medium risk, high risk, etc.

[0107] Step 2: Determine the authentication method based on the risk level.

[0108] Low-risk authentication method: For authentication requests with low risk levels, a simpler authentication method can be used, such as only verifying the correctness of the username and password, or access control based on IP whitelists. Medium-risk authentication method: For authentication requests with medium risk levels, additional verification steps may need to be added, such as SMS verification code, email verification code, or secondary password verification. High-risk authentication method: For authentication requests with high risk levels, more stringent authentication methods should be used, such as multi-factor authentication (MFA), biometric authentication, or device fingerprint verification. These methods can significantly improve the security of the authentication process and prevent potential security threats.

[0109] Step 3: Use a determined authentication method and perform access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol.

[0110] Select the authentication source: According to the requirements of the target authentication protocol, select the appropriate authentication source for access authentication. The authentication source may be one or more authentication servers, databases, or third-party authentication services. Perform the authentication process: According to the determined authentication method, submit the format conversion data to the authentication source for access authentication. The authentication process may include steps such as verifying user identity, checking permissions, and generating session tokens. Process the authentication result: Perform corresponding processing based on the authentication result returned by the authentication source. If the authentication is successful, the user is allowed to access the corresponding resources or services; if the authentication fails, access is denied, and a corresponding error message may be returned or other security measures may be implemented.

[0111] In one embodiment, identifying the risk level corresponding to the authentication request includes:

[0112] Step 1: Obtain the authentication request object identity information carried in the authentication request.

[0113] Here, the identity information of the request object is extracted from the authentication request, such as the user name, user ID or other unique identifier.

[0114] Step 2: Based on the authentication request object identity information, query the historical authentication request data in the historical records.

[0115] Use the extracted identity information as the query condition to find all authentication request data previously issued by the request object in the history record.

[0116] Step 3: Extract key features of the historical authentication request data, including timestamp, request frequency, and geographic location.

[0117] Extract key features from historical authentication request data that are critical for subsequent risk assessment. Here, key features include timestamp (the time when the request occurred), request frequency (the frequency or number of times the request occurred), and geographic location (the geographic location from which the request was initiated).

[0118] Step 4: Obtain a risk assessment score corresponding to the authentication request based on the key features and a preset assessment algorithm, wherein the preset assessment algorithm is constructed based on an isolation forest and local anomaly factor detection algorithm.

[0119] A risk assessment score is calculated using the preset assessment algorithm combined with the extracted key features. This score reflects the risk level of the authentication request. Here, the preset assessment algorithm is built based on the Isolation Forest and Local Outlier Factor (LOF) detection algorithms. Specifically, the machine learning model can be trained and built based on the preset assessment algorithm. In subsequent processing, the key features only need to be input into the trained machine learning model to obtain the corresponding risk assessment score.

[0120] Step 5: Identify the risk level corresponding to the authentication request based on the risk assessment score.

[0121] According to the risk assessment score, authentication requests are divided into different risk levels. These levels may include "low risk", "medium risk" and "high risk". In actual applications, high risk: the risk score is higher than a certain threshold (for example, abnormal login time, sudden change in geographical location, login from a new device, abnormal user behavior, etc.). Medium risk: the risk score is in the middle range (for example, the login location is close to the usual location but slightly deviated, the device information is slightly changed, etc.). Low risk: the risk score is lower than a certain threshold (for example, the login time, location, device information is consistent with the historical records, and the user behavior is normal).

[0122] In one embodiment, obtaining the risk assessment score corresponding to the authentication request according to the key feature and the preset assessment algorithm includes:

[0123] Based on the key features, multiple feature matrices are generated; isolation forests are used to perform preliminary anomaly detection on the multiple feature matrices to obtain abnormal feature matrices and preliminary anomaly detection scores; based on the abnormal feature matrices and the key features, multiple abnormal point matrices are generated; local anomaly factors are calculated based on preset neighbor values ​​and multiple abnormal point matrices to obtain local anomaly detection scores; according to the local anomaly detection scores and the preliminary anomaly detection scores, a risk assessment score corresponding to the authentication request is obtained.

[0124] Based on the key features in the authentication request, multiple feature matrices are generated. These feature matrices are the basis for subsequent analysis. The isolation forest algorithm is used to perform preliminary anomaly detection on multiple feature matrices. Isolation forest is an effective anomaly detection method, especially suitable for high-dimensional data. Through preliminary anomaly detection, an abnormal feature matrix and a preliminary anomaly detection score can be obtained. Based on the abnormal feature matrix and the original key features, multiple anomaly point matrices are generated. These anomaly point matrices further highlight the anomalies in the data and provide more specific information for subsequent analysis. The local outlier factor (LOF) is calculated using the preset neighbor value and multiple anomaly point matrices. LOF is an algorithm for anomaly detection. It identifies anomalies by comparing the local density of a given data point with the local density of its neighbors. The local anomaly detection score can be obtained by calculating the local anomaly factor. Furthermore, the preset neighbor value here can be 20. Using 20 as the neighbor value can take into account both calculation accuracy and calculation efficiency (avoiding the need to process too much data due to a comprehensive search). Finally, the risk assessment score corresponding to the authentication request is calculated based on the local anomaly detection score and the preliminary anomaly detection score. This risk assessment score reflects the degree of abnormality or risk level of the authentication request and can be used for subsequent decision-making or further analysis.

[0125] To explain in detail the processing of the isolation forest and the local anomaly factor in the above embodiment, they will be introduced separately below.

[0126] 1. Isolated forest

[0127] Isolation forests consist of multiple isolated trees. Each isolated tree is constructed by randomly selecting features and split points. The entire process includes:

[0128] 1) Build an isolation forest

[0129] Randomly select features: randomly select a feature from the feature matrix; randomly select split points: randomly select a split point within the value range of the selected feature; split data: divide the data into two parts according to the split point, recursively until the data points corresponding to each feature matrix are isolated or the tree reaches the maximum height.

[0130] 2) Calculate the path length

[0131] For each data point corresponding to the feature matrix, calculate its average path length in all isolated trees. The shorter the path, the easier it is for the data point to be isolated.

[0132] 3) Abnormal scoring

[0133] The path length is used to calculate the anomaly score. The shorter the path, the higher the anomaly score.

[0134] In the above process, you can also set the parameters for building the isolation forest. Specifically, it includes: the number of trees (n_estimators): 200 trees are selected by default, which can balance the computational efficiency and detection accuracy. The more trees there are, the more stable the detection results are, but the computational overhead is also greater. The maximum depth of each tree (max_depth): The maximum depth determines the complexity of the tree. Usually a moderate depth (default 15) is selected to prevent overfitting and long calculation time. The number of sample splits (max_samples): specifies the number of samples used for each tree, which is usually set as a portion of the total number of samples (default 256 samples) to ensure the diversity and efficiency of the tree.

[0135] Furthermore, abnormal authentication requests detected based on preliminary anomalies can be marked as abnormal (-1), and normal authentication requests can be marked as normal (1). By adding the above abnormal and normal labels, the isolation forest model is trained. In subsequent processing, only the trained isolation forest model needs to be used for processing.

[0136] 2. Local detection (local abnormal factors)

[0137] The input of local detection is to regenerate multiple abnormal point matrices based on the key features marked as abnormal in the preliminary detection. Its specific implementation principle includes the following three parts:

[0138] 1) Calculate local density: The local outlier factor (LOF) identifies outliers by calculating the local density difference between a data point and its neighbors in the outlier matrix.

[0139] Neighbor selection: Select a certain number of nearest neighbors (k value) for each data point, preferably 20 neighbors to ensure the stability of the results. k value selection: It is very important to choose an appropriate k value. A k value that is too small will make the model sensitive to noise, and a k value that is too large will reduce the model's sensitivity to local anomalies. Select a value between 20, and you can select the optimal k value through cross-validation. Local reachable density: Calculate the local reachable density of each data point to reflect its density relationship with its neighbors. Local anomaly factor score: Compare the local reachable density of a data point with the local reachable density of its neighbors to obtain a local anomaly factor score. The higher the score, the more likely the data point is an anomaly.

[0140] 2) Time complexity analysis

[0141] Calculate neighbors: For each data point, calculate the distance to other data points, the time complexity is O(n 2), where n is the number of data points. Using data structures such as KD trees or ball trees can reduce the time complexity to O(nlogn). Calculate local reachability density and LOF score: For each data point, calculate its local reachability density and LOF score with k neighbors, with a time complexity of O(n * k).

[0142] 3) Applicability of large-scale data

[0143] Computational efficiency: For large-scale data, directly calculating the distance between all data points may result in a long computation time. By using data structures such as KD trees or ball trees, the computational complexity can be significantly reduced, making the LOF algorithm still efficient on large-scale data sets. Memory usage: Large-scale data sets may result in excessive memory consumption. By processing data in batches or using a distributed computing framework (such as Apache Spark), memory usage can be effectively managed to ensure the feasibility of the computing process. Parallel computing: The efficiency of large-scale data processing can be further improved by using parallel computing techniques, such as multi-threading or multi-processing. Multi-threaded parallel computing platforms (such as GPUs or distributed systems) can significantly accelerate the execution speed of the LOF algorithm.

[0144] In this embodiment, the identification of the risk level corresponding to the authentication request is completed by a preset risk assessment model. Specifically, the login feature corresponding to the authentication request can be obtained first, and then the login feature is input into the preset risk assessment model to obtain the risk level corresponding to the authentication request. Further, a dynamic risk assessment model is introduced here to analyze user behavior, device fingerprints, geographic location and other information through a machine learning algorithm to evaluate the risk level of each authentication request in real time. When performing a specific risk level assessment, the assessment score can be obtained by the preset risk assessment model first, and then based on the set threshold and assessment score, it is determined whether the current risk is high, medium, or low, wherein high risk means that the assessment score is higher than the danger threshold, which corresponds to abnormal login time, sudden change in geographic location, new device login, or abnormal user behavior; medium risk means that the assessment score is within the interval range of the danger threshold and the safety threshold, which corresponds to the login location close to the commonly used location but slightly deviated, or the device information is slightly changed; low risk means that the assessment score is lower than the safety threshold, which corresponds to the login time, location, device information and historical records are consistent, and the user behavior is normal.

[0145] like Figure 4As shown, the large-scale multi-terminal access authentication method of this application can realize the authentication process of different terminal devices in different application scenarios in actual application scenarios, such as corporate office, smart home and Internet of Things platform. Among them, corporate office: employees use mobile phones or PCs to perform security authentication for office applications. Smart home: family members control the access authentication of smart home devices through mobile phones. Internet of Things platform: various sensors and devices are securely accessed through a unified authentication platform.

[0146] In general, in the above embodiments, the large-scale multi-terminal access authentication method of the present application has the following significant technical advantages.

[0147] 1. Improved scalability

[0148] By supporting multiple authentication protocols (such as OAuth, SAML, OpenID Connect, etc.), this method can adapt to different types of terminal devices and achieve high scalability. For example, in an enterprise environment, employees can use the company's internal identity provider for authentication through the SAML protocol, while in consumer applications, users can use social media accounts to log in through the OAuth protocol. This multi-protocol support ensures that the system can seamlessly integrate a variety of different terminal devices and application scenarios to meet diverse business needs. In addition, developers can dynamically add new authentication protocols based on specific needs to further enhance the flexibility and adaptability of the system. Through modular design, different authentication protocols can be updated and maintained independently of other parts of the system without affecting the stability of the overall system.

[0149] 2. Simplified management

[0150] This approach simplifies the management of authentication information for a large number of terminal devices by adopting intelligent management strategies. Through a centralized management platform, administrators can uniformly configure and monitor the authentication status of all terminal devices, reducing the complexity of manual management. Intelligent strategies can dynamically adjust the authentication process based on the type of terminal device, geographic location, user behavior, etc., to improve management efficiency. For example, by analyzing user behavior through machine learning algorithms, the system can automatically identify abnormal activities and take corresponding measures, such as triggering multi-factor authentication or temporarily locking accounts. In addition, automated reporting and auditing functions can help administrators identify and resolve potential problems in a timely manner to ensure the security and compliance of the system. The integrated dashboard provides real-time data and analysis to help enterprises optimize the authentication process and improve the user experience.

[0151] 3. Security Enhancement

[0152] While ensuring efficient authentication, this method provides multi-level security measures, significantly enhancing the security of the system. End-to-end encryption ensures the security of data transmission throughout the authentication process, preventing sensitive information from being stolen or tampered with. Multi-factor authentication (MFA) improves the security of user identity authentication by adding additional verification steps (such as SMS verification codes, dynamic passwords, etc.), effectively preventing identity theft and unauthorized access. The zero-trust architecture ensures that each request is verified through strict authentication and access control policies, eliminating internal and external security threats. The architecture emphasizes continuous verification and the principle of least privilege to prevent potential security vulnerabilities. In addition, real-time monitoring and response mechanisms can quickly detect and respond to security incidents, reducing the impact of security risks on the system. By integrating threat intelligence and security event management platforms, the system can update security policies in a timely manner to respond to the latest security threats.

[0153] Comprehensive technical effects: Through the above improvements, this method significantly improves the scalability, management simplification and security of the system, enabling it to efficiently and securely handle the access authentication requirements of large-scale terminal devices. By comprehensively using a variety of technical means and intelligent strategies, the system can not only adapt to diverse business scenarios, but also provide reliable security guarantees to ensure the security of user data and system resources.

[0154] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0155] Based on the same inventive concept, the embodiment of the present application also provides a large-scale multi-terminal access authentication device for implementing the large-scale multi-terminal access authentication method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more large-scale multi-terminal access authentication device embodiments provided below can refer to the limitations of the large-scale multi-terminal access authentication method above, and will not be repeated here.

[0156] In one embodiment, Figure 5 As shown, a large-scale multi-terminal access authentication device is provided, comprising:

[0157] The request acquisition module 100 is used to acquire the authentication request sent by the terminal;

[0158] The parsing module 200 is used to parse the authentication request and obtain the communication protocol identifier, terminal type identifier and user requirement data corresponding to the authentication request;

[0159] The protocol confirmation module 300 is used to input the terminal type identification and the user demand data into the preset machine learning model, and determine the target authentication protocol that matches the authentication request in combination with the output result of the preset machine learning model and the communication protocol identification;

[0160] The format conversion module 400 is used to convert the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data;

[0161] The authentication module 500 is used to perform access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol.

[0162] The above-mentioned large-scale multi-terminal access authentication device obtains the authentication request sent by the terminal; parses the authentication request to obtain the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request; inputs the terminal type identifier and user demand data into the preset machine learning model, and determines the target authentication protocol that matches the authentication request in combination with the preset machine learning model output result and the communication protocol identifier; converts the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data; and performs access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol. During the whole process, the target authentication protocol that matches the current authentication request is determined based on the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request, and the data required for the target authentication protocol is obtained by format conversion, which can meet the access authentication requirements of different types of terminals and realize efficient large-scale multi-terminal access authentication.

[0163] In one of the embodiments, the parsing module 200 is also used to parse the authentication request, obtain the communication protocol identifier, terminal type identifier and user identity identifier carried in the authentication request; based on the user identity identifier, query the user's historical access data and user role identifier; identify the application scenario corresponding to the authentication request, and generate user demand data based on the application scenario, user's historical access data and user role identifier.

[0164] In one of the embodiments, the large-scale multi-terminal access authentication device further includes a verification module for detecting the format, signature, and carried parameters of the authentication request; based on the format, signature, and carried parameters of the authentication request, the authentication request is verified for legitimacy and integrity by calling a preset automated verification tool; if the legitimacy and integrity verification pass, the parsing module is controlled to parse the authentication request and obtain the communication protocol identifier, terminal type identifier, and user demand data corresponding to the authentication request.

[0165] In one of the embodiments, the format conversion module 400 is also used to obtain real-time environment status parameters, which include real-time network status parameters and real-time server load status parameters; based on the terminal type identification and the real-time environment status parameters, searching for matching conversion rules from a preset rule library; according to the conversion rules, converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data.

[0166] In one embodiment, the authentication module 500 is also used to identify the risk level corresponding to the authentication request; determine the authentication method based on the risk level; use the determined authentication method and perform access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol.

[0167] In one of the embodiments, the authentication module 500 is also used to obtain the authentication request object identity information carried by the authentication request; based on the authentication request object identity information, query the historical authentication request data in the historical records; extract the key features of the historical authentication request data, the key features include timestamp, request frequency and geographic location; according to the key features and a preset evaluation algorithm, obtain the risk assessment score corresponding to the authentication request, the preset evaluation algorithm is constructed based on an isolation forest and local anomaly factor detection algorithm; according to the risk assessment score, identify the risk level corresponding to the authentication request.

[0168] In one embodiment, the authentication module 500 is also used to generate multiple feature matrices based on the key features; use isolation forest to perform preliminary anomaly detection on the multiple feature matrices to obtain abnormal feature matrices and preliminary anomaly detection scores; generate multiple abnormal point matrices based on the abnormal feature matrix and the key features; calculate local anomaly factors based on preset neighbor values ​​and multiple abnormal point matrices to obtain local anomaly detection scores; and obtain a risk assessment score corresponding to the authentication request based on the local anomaly detection score and the preliminary anomaly detection score.

[0169] Each module in the above-mentioned large-scale multi-terminal access authentication device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0170] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store preset data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a large-scale multi-terminal access authentication method is implemented.

[0171] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0172] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above-mentioned large-scale multi-terminal access authentication method when executing the computer program.

[0173] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned large-scale multi-terminal access authentication method is implemented.

[0174] In one embodiment, a computer program product is provided, including a computer program, which implements the above-mentioned large-scale multi-terminal access authentication method when executed by a processor.

[0175] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0176] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0177] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0178] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A large-scale multi-terminal access authentication method, characterized in that: The method comprises: Get the authentication request sent by the terminal; Parsing the authentication request to obtain a communication protocol identifier, a terminal type identifier, and user requirement data corresponding to the authentication request; The terminal type identifier and the user demand data are input into a preset machine learning model, and a target authentication protocol matching the authentication request is determined in combination with an output result of the preset machine learning model and the communication protocol identifier; the preset machine learning model is used to analyze a matching authentication protocol according to the terminal type identifier and the user demand data, and the output result is a list of matching authentication protocols; Converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data; Performing access authentication on the format conversion data based on an authentication source corresponding to the target authentication protocol; The parsing of the authentication request to obtain the communication protocol identifier, terminal type identifier and user demand data corresponding to the authentication request includes: parsing the authentication request to obtain the communication protocol identifier, terminal type identifier and user identity identifier carried by the authentication request; based on the user identity identifier, querying the user's historical access data and user role identifier; identifying the application scenario corresponding to the authentication request, and generating user demand data according to the application scenario, the user's historical access data and the user role identifier.

2. The method according to claim 1, characterized in that Also includes: Detecting the format, signature and carried parameters of the authentication request; Based on the format, signature and carried parameters of the authentication request, a preset automated verification tool is called to verify the legitimacy and integrity of the authentication request; If the legality and integrity verification are passed, the process proceeds to the step of parsing the authentication request to obtain the communication protocol identifier, terminal type identifier, and user requirement data corresponding to the authentication request.

3. The method according to claim 1, characterized in that The converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data comprises: Acquire real-time environment status parameters, wherein the real-time environment status parameters include real-time network status parameters and real-time server load status parameters; Based on the terminal type identifier and the real-time environment status parameter, searching for a matching conversion rule from a preset rule library; According to the conversion rule, the authentication request is converted into a protocol format corresponding to the target authentication protocol to obtain format conversion data.

4. The method according to claim 1, characterized in that The performing access authentication on the format conversion data based on the authentication source corresponding to the target authentication protocol comprises: Identifying a risk level corresponding to the authentication request; Based on the risk level, determining an authentication method; The format conversion data is access authenticated using a determined authentication method and based on an authentication source corresponding to the target authentication protocol.

5. The method according to claim 4, characterized in that The identifying the risk level corresponding to the authentication request includes: Obtaining the authentication request object identity information carried in the authentication request; Based on the authentication request object identity information, query the historical authentication request data in the historical records; Extracting key features of the historical authentication request data, the key features including timestamp, request frequency, and geographic location; Obtaining a risk assessment score corresponding to the authentication request according to the key features and a preset assessment algorithm, wherein the preset assessment algorithm is constructed based on an isolation forest and a local anomaly factor detection algorithm; According to the risk assessment score, a risk level corresponding to the authentication request is identified.

6. The method according to claim 5, characterized in that Obtaining a risk assessment score corresponding to the authentication request according to the key features and a preset assessment algorithm includes: generating a plurality of feature matrices based on the key features; Using isolation forest to perform preliminary anomaly detection on the multiple feature matrices to obtain an abnormal feature matrix and a preliminary anomaly detection score; Based on the abnormal feature matrix and the key features, generating multiple abnormal point matrices; Calculate the local anomaly factor based on the preset neighbor value and multiple anomaly point matrices to obtain the local anomaly detection score; A risk assessment score corresponding to the authentication request is obtained according to the local anomaly detection score and the preliminary anomaly detection score.

7. A large-scale multi-terminal access authentication device, characterized in that: The device comprises: A request acquisition module, used to acquire the authentication request sent by the terminal; A parsing module, used to parse the authentication request and obtain a communication protocol identifier, a terminal type identifier, and user requirement data corresponding to the authentication request; A protocol confirmation module is used to input the terminal type identification and the user demand data into a preset machine learning model, and determine a target authentication protocol that matches the authentication request in combination with the preset machine learning model output result and the communication protocol identification; the preset machine learning model is used to analyze the matching authentication protocol according to the terminal type identification and the user demand data, and the output result is an output matching authentication protocol list; A format conversion module, used to convert the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data; An authentication module, configured to perform access authentication on the format conversion data based on an authentication source corresponding to the target authentication protocol; The parsing module is also used to parse the authentication request, obtain the communication protocol identifier, terminal type identifier and user identity identifier carried by the authentication request; based on the user identity identifier, query the user's historical access data and user role identifier; identify the application scenario corresponding to the authentication request, and generate user demand data based on the application scenario, the user's historical access data and the user role identifier.

8. The device according to claim 7, characterized in that The format conversion module is also used to obtain real-time environmental status parameters, which include real-time network status parameters and real-time server load status parameters; based on the terminal type identification and the real-time environmental status parameters, searching for matching conversion rules from a preset rule library; according to the conversion rules, converting the authentication request into a protocol format corresponding to the target authentication protocol to obtain format conversion data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images