Identity authentication method, device and equipment, and computer storage medium

Abstract

The application discloses an identity authentication method, device and equipment and a computer storage medium. The method is applied to a bastion host and comprises the following steps: obtaining a user account; sending a biological identification request to a server, so that the server randomly generates a user credential code, sends the user credential code to a terminal device, the terminal device collects first target biological information, compares the first target biological information with prestored biological information, obtains a first target biological identification result, marks a target mark corresponding to the first target biological identification result in the user credential code, obtains a target user credential code, encrypts the target user credential code, obtains an encrypted user credential code, sends the encrypted user credential code to the server, the server decrypts the encrypted user credential code, and obtains the target user credential code; and in the case that the target mark in the target user credential code is a first mark, receiving identity authentication passing information sent by the server. The security of server resources is improved.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to an identity authentication method, apparatus, device and computer storage medium. Background Technology

[0002] A bastion host, also known as an operations and maintenance security audit system, is a special type of network security device primarily used to manage and control access to network and server resources, thereby reducing operational risks. To ensure operational security, end devices typically need to access server resources through a bastion host. Authentication by the bastion host is required when accessing these resources.

[0003] In existing technologies, bastion hosts primarily use digital credentials or biometric identification technology to authenticate users. This requires uploading user accounts, biometric information, and passwords to the bastion host in advance, which carries the risk of credentials being obtained by others and results in low security for server resources. Summary of the Invention

[0004] This application provides an identity authentication method, apparatus, device, and computer storage medium. Upon receiving an access request, a biometric request is initiated to the server. The server randomly generates a user credential code and marks the user credential code with a target marker based on the biometric result of the terminal device. If the target marker matches a first marker, the server sends authentication success information to the bastion host, and the bastion host authentication is successful. This method eliminates the need to pre-upload user accounts, user biometric information, and user passwords to the bastion host, achieving bastion host authentication while avoiding the risk of credential leakage and improving the security of server resources.

[0005] In a first aspect, embodiments of this application provide an authentication method applied to a bastion host, comprising:

[0006] Obtain user account;

[0007] A biometric request is generated based on the user account, and the biometric request includes the user account.

[0008] A biometric request is sent to the server for the server to randomly generate a user credential code. The user credential code is then sent to the terminal device corresponding to the user account for the terminal device to collect the first target biometric information. The first target biometric information is compared with the pre-stored biometric information to obtain the first target biometric result. Based on the relationship information between the biometric result and the marker, the target marker corresponding to the first target biometric result is marked in the user credential code to obtain the target user credential code. The target user credential code is then encrypted to obtain the encrypted user credential code. The encrypted user credential code is then sent to the server for the server to decrypt the encrypted user credential code to obtain the target user credential code.

[0009] If the target token in the target user's credential code is the first token, the authentication pass information sent by the server is received.

[0010] In one possible implementation, obtaining a user account includes:

[0011] Receive user account information input by the user;

[0012] Based on the user account, a biometric request is generated, including:

[0013] Upon receiving a user's click input on the login control, a biometric request is generated based on the user's account.

[0014] In one possible implementation, the method further includes, before obtaining the user account:

[0015] Receive user account information input by the user;

[0016] Upon receiving a user's click input on the single sign-on control, retrieve the user's account.

[0017] In one possible implementation, the method further includes, before obtaining the user account:

[0018] Receive user account information input by the user;

[0019] Upon receiving a target command input by the user, obtain the first target tier level of the command executed by the bastion host or the data accessed, as well as the first target type information of the target command;

[0020] Based on the relationship between category information and command level, determine the target command level corresponding to the first target category information;

[0021] Based on the relationship between command level and ladder level, determine the second target ladder level of the target command level;

[0022] Obtain the user account if the first target ladder level and the second target ladder level are inconsistent.

[0023] In one possible implementation, the method further includes, before obtaining the user account:

[0024] Receive user account information input by the user;

[0025] Upon receiving a user's request to access target data, obtain the first target tier level of the command executed by the bastion host or the data accessed, as well as the second target type information of the target data;

[0026] Based on the relationship between category information and data level, determine the target data level corresponding to the second target category information;

[0027] Based on the relationship between data level and ladder level, determine the third target ladder level of the target data level;

[0028] Obtain the user account if the first target ladder level and the third target ladder level are inconsistent.

[0029] In one possible implementation embodiment, it further includes:

[0030] The system receives management inputs that show the relationship between data levels and ladder levels, as well as the relationship between command levels and ladder levels. These management inputs include at least one of the following: add input, modify input, and delete input.

[0031] Secondly, embodiments of this application provide an identity authentication method applied to a server, comprising:

[0032] Once the bastion host obtains the user account, it receives a biometric request sent by the bastion host, which includes the user account information.

[0033] Randomly generate user credential codes;

[0034] Send a user credential code to the terminal device corresponding to the user account so that the terminal device can collect the first target biometric information and compare the first target biometric information with the pre-stored biometric information to obtain the first target biometric identification result. According to the relationship information between the biometric identification result and the tag, mark the target tag corresponding to the first target biometric identification result in the user credential code to obtain the target user credential code. Then encrypt the target user credential code to obtain the encrypted user credential code.

[0035] Receive encrypted user credential code sent by the terminal device;

[0036] Decrypt the encrypted user credential code to obtain the target user credential code;

[0037] If the target token in the target user's credential code is the first token, send authentication success information to the bastion host.

[0038] In one possible implementation, the method further includes, before receiving the biometric request sent by the bastion host:

[0039] Receive a registration request sent by a terminal device. The registration request includes the user account and the device identifier of the terminal device.

[0040] Check whether the pre-stored registration information includes the device identifier registration information;

[0041] If no device identifier registration information is detected, obtain the public key of the key pair corresponding to the user account from the management center;

[0042] Send a public key to the terminal device so that the terminal device can use the public key to encrypt the target user's credential code and obtain the encrypted user credential code.

[0043] In one possible implementation, decrypting the encrypted user credential code to obtain the target user credential code includes:

[0044] Send the encrypted user credential code to the management center so that the management center can decrypt the encrypted user credential code using the private key of the key pair corresponding to the user account to obtain the target user credential code;

[0045] Receive the target user's credentials code sent by the management center.

[0046] In one possible implementation embodiment, it further includes:

[0047] When the second target biometric identification result of the terminal device is successfully identified and the terminal device receives the click input for the logout control, the terminal device receives the logout request sent by the terminal device. The logout request includes the user account and the device identifier of the terminal device. The second target biometric identification result is obtained by the terminal device collecting the second target biometric information and comparing the second target biometric information with the pre-stored biometric information when it receives the input of the user account and the click input for the login control.

[0048] Delete the registration information corresponding to the device identifier from the pre-stored registration information;

[0049] Notify the management center to delete the key pair corresponding to the user account;

[0050] Upon receiving a successful deletion message from the management center, the system sends target information to the terminal device for the terminal device to delete the public key and pre-stored biometric information. The target information indicates successful deregistration.

[0051] Thirdly, embodiments of this application provide an identity authentication method applied to a terminal device, including:

[0052] When the server receives a biometric request from the bastion host and randomly generates a user credential code, it receives the user credential code sent by the server.

[0053] Collect the first target's biometric information and compare it with the pre-stored biometric information to obtain the first target's biometric identification result;

[0054] Based on the relationship information between the biometric results and the marker, the target marker corresponding to the first target biometric result is marked in the user credential code to obtain the target user credential code;

[0055] Encrypt the target user's credential code to obtain an encrypted user credential code;

[0056] Send an encrypted user credential code to the server so that the server can decrypt the encrypted user credential code to obtain the target user credential code. If the target token in the target user credential code is the first token, send an authentication pass message to the bastion host.

[0057] In one possible implementation, before receiving the user credential code sent by the server, the method further includes:

[0058] Upon receiving input of a user account and password, and upon receiving a click input to the registration control, a registration request is generated based on the user account and the device identifier of the terminal device. The registration request includes the user account and the device identifier of the terminal device.

[0059] Send a registration request to the server so that the server can detect whether the pre-stored registration information includes the device identifier registration information. If no device identifier registration information is detected, obtain the public key of the key pair corresponding to the user account from the management center.

[0060] Receive the public key sent by the server;

[0061] Collect biological information and save the collected biological information as the biological information corresponding to the user account;

[0062] The target user's credential code is encrypted to obtain an encrypted user credential code, including:

[0063] The target user's credential code is encrypted using the public key to obtain the encrypted user credential code.

[0064] In one possible implementation embodiment, it further includes:

[0065] Upon receiving input of a user account and a click on the login control, the system collects biometric information of the second target and compares it with pre-stored biometric information to obtain the biometric identification result of the second target.

[0066] If the second target biometric identification result is successfully identified and a click input for the logout control is received, a logout request is generated based on the user account and the device identifier of the terminal device. The logout request includes the user account and the device identifier of the terminal device.

[0067] Send a deregistration request to the server so that the server can delete the registration information corresponding to the device identifier from the pre-stored registration information, notify the management center to delete the key pair corresponding to the user account, and send the target information to the terminal device after receiving the deletion success information from the management center. The target information indicates that the deregistration was successful.

[0068] Receive target information sent by the server;

[0069] Delete the public key and pre-stored biometric information.

[0070] Fourthly, embodiments of this application provide an identity authentication device applied to a bastion host, comprising:

[0071] The acquisition module is used to retrieve user accounts;

[0072] The generation module is used to generate biometric requests based on user accounts, and the biometric requests include user accounts;

[0073] The sending module is used to send a biometric request to the server so that the server can randomly generate a user credential code, send the user credential code to the terminal device corresponding to the user account so that the terminal device can collect the first target biometric information, compare the first target biometric information with the pre-stored biometric information to obtain the first target biometric result, mark the target tag corresponding to the first target biometric result in the user credential code according to the relationship information between the biometric result and the tag, obtain the target user credential code, encrypt the target user credential code to obtain the encrypted user credential code, and send the encrypted user credential code to the server so that the server can decrypt the encrypted user credential code to obtain the target user credential code;

[0074] The receiving module is used to receive authentication pass information sent by the server when the target marker in the target user's credential code is the first marker.

[0075] Fifthly, embodiments of this application provide an identity authentication device applied to a server, comprising:

[0076] The receiving module is used to receive biometric requests sent by the bastion host when the bastion host obtains the user account. The biometric requests include the user account.

[0077] The generation module is used to randomly generate user credential codes;

[0078] The sending module is used to send a user credential code to the terminal device corresponding to the user account, so that the terminal device can collect the first target biometric information, compare the first target biometric information with the pre-stored biometric information to obtain the first target biometric identification result, mark the target tag corresponding to the first target biometric identification result in the user credential code according to the relationship information between the biometric identification result and the tag, obtain the target user credential code, and encrypt the target user credential code to obtain the encrypted user credential code.

[0079] The receiving module is also used to receive encrypted user credential codes sent by the terminal device;

[0080] The decryption module is used to decrypt the encrypted user credential code to obtain the target user credential code;

[0081] The sending module is also used to send authentication pass information to the bastion host when the target marker in the target user's credential code is the first marker.

[0082] Sixthly, embodiments of this application provide an identity authentication device applied to a terminal device, comprising:

[0083] The receiving module is used to receive the user credential code sent by the server when the server receives a biometric request sent by the bastion host and randomly generates a user credential code;

[0084] The acquisition module is used to acquire the first target's biological information and compare it with the pre-stored biological information to obtain the first target's biological identification result;

[0085] The tagging module is used to tag the target tag corresponding to the first target biometric result in the user credential code based on the relationship information between the biometric result and the tag, so as to obtain the target user credential code;

[0086] The encryption module is used to encrypt the target user's credential code to obtain an encrypted user credential code.

[0087] The sending module is used to send encrypted user credential codes to the server, so that the server can decrypt the encrypted user credential codes to obtain the target user credential codes. If the target marker in the target user credential codes is the first marker, the module sends authentication success information to the bastion host.

[0088] Seventhly, embodiments of this application provide an electronic device, the device comprising:

[0089] Processor and memory storing computer program instructions;

[0090] The processor implements any of the above authentication methods when executing computer program instructions.

[0091] Eighthly, embodiments of this application provide a computer storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, they implement the authentication method described above.

[0092] Ninthly, embodiments of this application provide a computer program product, characterized in that, when the instructions in the computer program product are executed by the processor of an electronic device, the electronic device is able to execute any of the above-mentioned authentication methods.

[0093] The authentication method, apparatus, device, and computer storage medium of this application embodiment are applied to a bastion host, including: obtaining a user account; generating a biometric request based on the user account, the biometric request including the user account; sending the biometric request to a server for the server to randomly generate a user credential code; sending the user credential code to a terminal device corresponding to the user account for the terminal device to collect first target biometric information and compare the first target biometric information with pre-stored biometric information to obtain a first target biometric result; marking a target marker corresponding to the first target biometric result in the user credential code according to the relationship information between the biometric result and the marker, obtaining a target user credential code; encrypting the target user credential code to obtain an encrypted user credential code; sending the encrypted user credential code to a server for the server to decrypt the encrypted user credential code to obtain the target user credential code; and receiving authentication pass information sent by the server when the target marker in the target user credential code is a first marker.

[0094] Thus, upon receiving an access request, a biometric request is sent to the server. The server randomly generates a user credential code and marks the credential code with a target marker based on the biometric result of the terminal device. If the target marker matches the first marker, the server sends authentication success information to the bastion host, and the bastion host authentication is successful. This eliminates the need to pre-upload user accounts, biometric information, and passwords to the bastion host, achieving bastion host authentication while avoiding the risk of credential leakage and improving server resource security. Attached Figure Description

[0095] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0096] Figure 1 This is a flowchart illustrating an identity authentication method provided in one embodiment of this application;

[0097] Figure 2This is a schematic diagram of an electronic fence structure provided in another embodiment of this application;

[0098] Figure 3 This is a schematic diagram of an electronic fence structure provided in another embodiment of this application;

[0099] Figure 4 This is a flowchart illustrating an identity authentication method provided in another embodiment of this application;

[0100] Figure 5 This is a flowchart illustrating an identity authentication method provided in another embodiment of this application;

[0101] Figure 6 This is a flowchart illustrating an identity authentication method provided in another embodiment of this application;

[0102] Figure 7 This is a flowchart illustrating an identity authentication method provided in another embodiment of this application;

[0103] Figure 8 This is a flowchart illustrating an identity authentication method provided in another embodiment of this application;

[0104] Figure 9 This is a flowchart illustrating an identity authentication method provided in another embodiment of this application;

[0105] Figure 10 This is a schematic diagram of the structure of an identity authentication device applied to a bastion host according to another embodiment of this application;

[0106] Figure 11 This is a schematic diagram of the structure of an identity authentication device applied to a server provided in another embodiment of this application;

[0107] Figure 12 This is a schematic diagram of the structure of an identity authentication device applied to a terminal device according to another embodiment of this application;

[0108] Figure 13 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0109] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0110] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0111] A bastion host, also known as an operations and maintenance security audit system, is a special type of network security device primarily used to manage and control access to network and server resources, thereby reducing operational risks. To ensure operational security, end devices typically need to access server resources through a bastion host. Authentication by the bastion host is required when accessing these resources.

[0112] In existing technologies, bastion hosts primarily use digital credentials or biometric identification technology to authenticate users. This requires uploading user accounts, biometric information, and passwords to the bastion host in advance, which carries the risk of credentials being obtained by others and results in low security for server resources.

[0113] To address the problems of existing technologies, embodiments of this application provide an identity authentication method, apparatus, device, and computer storage medium. This embodiment of the application provides an identity authentication method, apparatus, device, and computer storage medium that, upon receiving an access request, initiates a biometric request to the server. The server randomly generates a user credential code and marks the user credential code with a target marker based on the biometric result of the terminal device. If the target marker is a first marker, the server sends authentication success information to the bastion host, and the bastion host identity authentication is successful. This method eliminates the need to pre-upload user accounts, user biometric information, and user passwords to the bastion host, achieving bastion host identity authentication, avoiding the risk of credential leakage, and improving the security of server resources.

[0114] The identity authentication method provided in the embodiments of this application will be introduced first below.

[0115] Figure 1 A flowchart illustrating an identity authentication method provided in one embodiment of this application is shown.

[0116] like Figure 1As shown in the embodiments of this application, the identity authentication method includes the following steps.

[0117] S101, Bastion host obtains user account.

[0118] Here, the user account is the account entered by the user.

[0119] In some embodiments, a user account serves as the user's identity credential. When a user logs in to the bastion host, they must manually enter their user account. After successful login, this user account is used as a global parameter, allowing the bastion host to automatically retrieve the user account when the user executes single sign-on or IT maintenance commands. Here, IT maintenance commands refer to executing target commands or accessing target data.

[0120] S102. The bastion host generates a biometric request based on the user account. The biometric request includes the user account.

[0121] In some embodiments, users execute bastion host login, single sign-on, or IT operations and maintenance commands on the bastion host. In the bastion host login scenario, the user needs to manually enter their username before triggering authentication on the terminal device, and then the username is set as a global parameter. After successful bastion host login, in single sign-on or IT operations and maintenance scenarios, the bastion host automatically retrieves the username from the global parameters. Here, authentication refers to passwordless authentication on the bastion host.

[0122] In some embodiments, after the bastion host obtains the user account, it generates a biometric request based on the user account to perform passwordless authentication of the terminal device.

[0123] S103, the bastion host sends a biometric request to the server.

[0124] Here, the server can be a passwordless authentication server.

[0125] In some embodiments, the bastion host's authentication requires the server to initiate the authentication of the terminal device. First, the bastion host sends a biometric request to the server.

[0126] S104. The server randomly generates user credential codes.

[0127] In some embodiments, after receiving a biometric request from the bastion host, the server randomly generates a user credential code corresponding to the user identifier.

[0128] S105. The server sends the user credential code to the terminal device corresponding to the user account.

[0129] In some embodiments, the server sends a user credential code to the terminal device corresponding to the user account, triggering the terminal device to initiate biometric identification.

[0130] S106. The terminal device collects the first target biometric information and compares the first target biometric information with the pre-stored biometric information to obtain the first target biometric identification result. Based on the relationship information between the biometric identification result and the marker, the target marker corresponding to the first target biometric identification result is marked in the user credential code to obtain the target user credential code.

[0131] In some embodiments, the terminal device includes an authentication application. Upon receiving a user credential code, the terminal device initiates the authentication application and requests biometric authentication from the user. The terminal device collects first target biometric information and compares it with pre-stored biometric information to obtain a first target biometric authentication result. If the first target biometric authentication result indicates that the first target biometric information matches the pre-stored biometric information, a first marker is added to the user credential code; if the first target biometric authentication result indicates that the first target biometric information does not match the pre-stored biometric information, a second marker is added to the user credential code. Here, the first marker indicates that the user's biometric authentication process is normal, and the second marker indicates that the biometric authentication process is abnormal.

[0132] S107. The terminal device encrypts the target user credential code to obtain the encrypted user credential code.

[0133] In some embodiments, the target user credential code after being marked needs to be encrypted before it can be transmitted to ensure that the user credential transmitted between the terminal device and the bastion host is not cracked during the identity association process.

[0134] S108. The terminal device sends the encrypted user credential code to the server.

[0135] S109. The server decrypts the encrypted user credential code to obtain the target user credential code.

[0136] In some embodiments, the encryption and decryption process of the user credential code is pre-negotiated between the terminal device and the server. Asymmetric key pairs can be used for encryption and decryption of the user credential code. Upon obtaining the target user credential code, the server detects whether the target token in the target user credential code is a first token or a second token.

[0137] S110. If the target marker in the target user's credential code is the first marker, the server sends authentication success information to the bastion host.

[0138] In some embodiments, the first marker is a marker indicating that the biometric identification process is normal, indicating that the first target biometric information collected during the biometric identification process matches the pre-stored biometric information, the identity authentication is successful, and the server sends an identity authentication success message to the bastion host, so that the bastion host allows the execution of bastion host login, single sign-on, or IT operations and maintenance. Otherwise, execution is refused.

[0139] In this way, upon receiving an access request, a biometric request is sent to the server. The server randomly generates a user credential code and marks the credential code with a target marker based on the biometric result of the terminal device. If the target marker matches the first marker, the server sends authentication success information to the bastion host, and the bastion host authentication is successful. This eliminates the need to upload user accounts, biometric information, and passwords to the bastion host beforehand, thus achieving bastion host authentication, avoiding the risk of credential leakage, and improving the security of server resources.

[0140] Based on this, in some embodiments, the above-mentioned S101 may specifically include:

[0141] The bastion host receives the user account entered by the user.

[0142] Specifically, S102 may include:

[0143] Upon receiving a user's click input on the login control, the bastion host generates a biometric request based on the user's account.

[0144] In some embodiments, the bastion host can perform user authentication in a bastion host login scenario. The bastion host receives the user's entered username and, upon receiving the user's click on the login control, triggers the authentication process. Based on the entered username, it generates a biometric request, enabling the server to initiate biometric authentication of the terminal device.

[0145] In this way, once a user logs in, it means that the user's behavior has "crossed the line." When "crossing the line" occurs, the identity authentication process is triggered, thus ensuring the security of server resources.

[0146] Based on this, in some embodiments, prior to S101 above, the method may further include:

[0147] The bastion host receives the user account entered by the user.

[0148] When the bastion host receives a user's click input on the single sign-on control, it obtains the user's account.

[0149] In some embodiments, after the bastion host receives the user's entered username, or in other words, after the bastion host performs authentication for the login scenario, the user can still choose to log in to a target business or system, i.e., a single sign-on scenario. Upon receiving the user's click input on the single sign-on control, the user's username is retrieved. Here, the username is the one entered by the user during the bastion host login process.

[0150] In this way, once a user performs a single sign-on to the target business or system, it indicates that the user's behavior has "crossed the boundary." When a "crossing the boundary" occurs, the identity authentication process is triggered, ensuring the security of server resources.

[0151] Based on this, in some embodiments, prior to S101 above, the method may further include:

[0152] The bastion host receives the user account entered by the user.

[0153] When the bastion host receives a target command input by the user, it obtains the first target tier level of the command executed by the bastion host or the data accessed, as well as the first target type information of the target command.

[0154] The bastion host determines the target command level corresponding to the first target type information based on the relationship between type information and command level.

[0155] The bastion host determines the second target ladder level of the target command level based on the relationship information between command level and ladder level;

[0156] The bastion host acquires the user account if the first target's ladder level and the second target's ladder level are inconsistent.

[0157] In some embodiments, after the bastion host receives the user's entered username, or in other words, after the bastion host performs authentication in a login scenario, the user can execute the target command. However, before execution, it is necessary to obtain the first target ladder level of the command being executed or the data being accessed by the bastion host, and determine whether the ladder level corresponding to the target command is different from the first target ladder level. If they are different, authentication is triggered.

[0158] As an example, the relationship between category information and command level is shown in Table 1. Based on Table 1, the target command level corresponding to the first target category information can be determined. The command level and ladder level are shown in Table 2. Based on Table 2, the second target ladder level of the target command level can be determined. If the first target ladder level and the second target ladder level are inconsistent, the user account is retrieved.

[0159] Table 1

[0160]

[0161]

[0162] The command level represents the confidentiality level of the command.

[0163] Table 2

[0164]

[0165] In this way, once a user wants to execute a target command, it is necessary to determine whether the hierarchical level of the target command has changed. If it has changed, it means that the user's behavior has "crossed the boundary". When "crossing the boundary" occurs, the identity authentication process is triggered, thus ensuring the security of server resources.

[0166] Based on this, in some embodiments, prior to S101 above, the method may further include:

[0167] The bastion host receives the user account entered by the user.

[0168] When a bastion host receives a user's request to access target data, it obtains the first target hierarchy level of the command executed by the bastion host or the data accessed, as well as the second target type information of the target data.

[0169] The bastion host determines the target data level corresponding to the second target type information based on the relationship between type information and data level.

[0170] The bastion host determines the third target ladder level of the target data level based on the relationship information between data level and ladder level;

[0171] The bastion host acquires the user account if the first target's ladder level and the third target's ladder level are inconsistent.

[0172] In some embodiments, after the bastion host receives the user's entered username, or in other words, after the bastion host performs authentication in a login scenario, the user can access the target data. However, before accessing the target data, it is necessary to obtain the first target ladder level of the command being executed by the bastion host or the data being accessed, and determine whether the ladder level corresponding to the target data is different from the first target ladder level. If they are different, authentication is triggered.

[0173] As an example, the relationship between category information and data level is shown in Table 3. Based on Table 3, the target data level corresponding to the first target category information can be determined. Command level and ladder level are shown in Table 2. Based on Table 2, the third target ladder level of the target data level can be determined. If the first target ladder level and the third target ladder level are inconsistent, the user account is retrieved.

[0174] Table 3

[0175]

[0176]

[0177] Among them, data level represents the confidentiality level of data.

[0178] It should be noted that Table 2 provided in this application is only an example. The command level and the data level can also be distinguished. That is, Table 2 can be split into two tables, one of which includes only the relationship information between the command level and the ladder level, and the other of which includes only the relationship information between the data level and the ladder level.

[0179] In this way, once a user wants to access the target data, it is necessary to determine whether the target data's hierarchical level has changed. If it has changed, it means that the user's behavior has "crossed the boundary." When "crossing the boundary" occurs, the identity authentication process is triggered, thus ensuring the security of server resources.

[0180] Based on this, in some embodiments, the following is also included:

[0181] The bastion host receives management inputs at the data level and ladder level, as well as command level and ladder level. Management inputs include at least one of the following: add input, modify input, and delete input.

[0182] In some embodiments, the bastion host provides a management interface for data levels and ladder levels, as well as command levels and ladder levels. Users can manage and input information about the relationship between data levels and ladder levels, and the relationship between command levels and ladder levels, through the management interface. This includes adding, modifying, and deleting inputs for command levels, data levels, and ladder levels, as well as adding, modifying, and deleting inputs regarding the correspondence between command levels, data levels, and ladder levels.

[0183] In this way, data levels and tier levels, as well as command levels and tier levels, can be set according to user needs, thereby enabling identity authentication of the bastion host in different IT operation and maintenance scenarios, which has a high degree of flexibility.

[0184] In the embodiments provided in this application, for ease of understanding, the "boundary crossing" behavior can be interpreted in conjunction with the stepped electronic fence structure. For example, as Figure 2As shown, the area is divided into four tiers based on the level of confidentiality: daily operations, low confidentiality, medium confidentiality, and high confidentiality. These tiers are arranged in a staircase pattern, from the outside in, with confidentiality increasing from low to high, forming tiers 1, 2, 3, and 4. Each tier contains corresponding data and commands. Electronic fences are set at the boundaries of each tier, creating virtual boundaries for each tier: tier 1, tier 2, tier 3, and tier 4. During boundary violation detection, the system first determines the tier containing the user's currently executed command or accessed data (the user is on tier 2 in the illustration). Then, based on the user's next command or accessed data, it determines whether the user's next action will move to another tier (the user is moving towards tier 3 in the illustration). Finally, it concludes that the user is about to commit a boundary violation.

[0185] In the embodiments provided in this application, if bastion host login and single sign-on are considered "boundary-crossing" behaviors, the tiered electronic fence structure can be further expanded. For example... Figure 3 As shown, in Figure 2 Based on the existing IT operations and maintenance scenarios, single sign-on (SSO) zones and geofences, as well as bastion host login zones and geofences, are added. For bastion host login scenario 221, i.e., bastion host login behavior detection, the trigger point for behavior exceeding boundaries is a user entering their account in the bastion host foreground and clicking the "Login" control. Once an out-of-bounds behavior is detected, passwordless authentication is triggered. For bastion host SSO scenario 222, i.e., single sign-on behavior detection, the trigger point for behavior exceeding boundaries is a user selecting a business or system in the bastion host foreground and clicking the "SSO" control. Once an out-of-bounds behavior is detected, passwordless authentication is triggered. For bastion host IT operations and maintenance scenario 223, i.e., operations and maintenance operation out-of-bounds behavior detection, the system uses the user's current behavior area as a reference to check whether the next command executed by the user or the data accessed is within the current behavior area. If not, it indicates an out-of-bounds behavior, and passwordless authentication should be invoked immediately. Figure 4 As shown, after triggering passwordless authentication due to boundary violations, the terminal device performs biometric identification. Upon successful biometric identification, the terminal device notifies the bastion host via the server that the boundary violation is permitted. Integrating biometric identification into the terminal device prevents the leakage of user privacy information, prevents impersonation or misuse of user identities, and enhances the bastion host's ability to detect and control users' boundary violations.

[0186] It is understandable that different levels of data and commands exist in different regions.

[0187] In some embodiments, setting up an electronic fence addresses the issue of passwordless authentication being invoked every time a user executes an operational command, thus impacting user experience. The embodiments provided in this application resolve the issue of frequent passwordless authentication calls through real-time user "boundary-crossing" behavior, while also preventing user identity theft or misuse.

[0188] In some embodiments, such as Figure 5 As shown, setting up an electronic fence includes:

[0189] Step 1: Setting up a tiered electronic fence: A tiered electronic fence structure is set up based on the level and type of commands and data. The level and type of commands and data are determined according to laws and regulations and actual business conditions. After the setting is completed, if a user accesses one level and then accesses another level, passwordless authentication will be triggered.

[0190] Step 2, Boundary Crossing Detection: Detect whether the user's current behavior is crossing the "boundary" of a certain electronic fence;

[0191] Step 3: If the process is "out of bounds", then passwordless authentication will be triggered.

[0192] Based on this, in some embodiments, such as Figure 6 As shown, prior to S101 above, the method further includes:

[0193] S210. Upon receiving input of user account and user password, and upon receiving input of click on the registration control, the terminal device generates a registration request based on the user account and the device identifier of the terminal device. The registration request includes the user account and the device identifier of the terminal device.

[0194] S220. The terminal device sends a registration request to the server.

[0195] S230. The server checks whether the pre-stored registration information includes the registration information of the device identifier. If no registration information of the device identifier is detected, the server obtains the public key of the key pair corresponding to the user account from the management center.

[0196] S240, The server sends the public key to the terminal device;

[0197] S250: The terminal device collects biological information and saves the collected biological information as the biological information corresponding to the user account.

[0198] Specifically, S107 mentioned above may include:

[0199] The terminal device uses the public key to encrypt the target user's credential code, thus obtaining the encrypted user credential code.

[0200] In some embodiments, before a user logs into the bastion host for the first time, the terminal device obtains an authentication application from the bastion side and installs it on the terminal device. The user logs into the authentication application using the user account and password opened by the bastion host. After successful login, the user can initiate registration. After registration, the terminal device has biometric recognition capabilities and does not need to upload the user's biometric information to the bastion host for verification, avoiding privacy leaks during biometric information transmission. After registration, the terminal device has passwordless authentication (biometric and identity combined (encryption and decryption)) capabilities, which can be applied in three scenarios: bastion host login, single sign-on, and IT operations and maintenance, ensuring that the user's identity is not impersonated or borrowed in these three scenarios.

[0201] In some embodiments, the authentication application includes a login module, a registration / deregistration module, a biometric information collection and retention module, an identity credential retention module, a biometric identification module, and a national cryptographic public key encryption / decryption module. The login module requires users to log in to the authentication application each time they run it. Before terminal device registration, users log in using their username and password. After terminal device registration, users can log in via biometric identification. The registration / deregistration module allows users to register or deregister their terminal devices with the bastion host. Only registered terminal devices have passwordless authentication capabilities. The biometric information collection and retention module collects and retains the biometric information of the user registering during the registration process. It should be noted that the biometric information is only stored on the terminal device and does not need to be uploaded to the bastion host. The identity credential retention module issues temporary user credentials to the terminal device when passwordless authentication is triggered in three scenarios: bastion host login, single sign-on, or IT operations and maintenance. These credentials are used during identity federation. The biometric identification module is used in three scenarios: bastion host login, single sign-on, and IT operations and maintenance. When passwordless authentication is triggered, the terminal device initiates biometric identification to the user and returns the identification result, including success or failure. The national cryptographic public key encryption / decryption module is used to encrypt user credentials using the national cryptographic public key after successful biometric identification by the terminal device. This ensures that the user credentials transmitted between the terminal device and the bastion host during identity association are not cracked. The public key on the terminal device is sent by the server during registration.

[0202] In some embodiments, before registering the terminal device, the user logs into the terminal device's authentication application using their bastion host user account and password. After initial login, the user clicks the registration control in the registration / logout module, and the terminal device initiates registration. During registration, the terminal device sends its device identifier (e.g., ID) and user account to the server. Upon receiving the registration request, the server first determines whether the device identifier has already been registered. If not, it requests a key pair from the management center (National Cryptography Management Center). After obtaining the key pair from the National Cryptography Management Center, the server sends the public key of the obtained key pair to the terminal device, while the private key is stored at the management center. The terminal device can use the public key to encrypt the target user's credential code, obtaining an encrypted user credential code.

[0203] In the embodiments provided in this application, the purpose of terminal device registration is divided into four parts: the first part is to ensure the legitimacy of the terminal device; the second part is to migrate biometrics to the terminal device; the third part is to upgrade the original user account and password verification of the bastion host to the biometrics of the terminal device; and the fourth part is to issue a national cryptographic public key to the terminal device to ensure the encrypted transmission of user credentials during the identity association process.

[0204] In this way, the terminal device is registered before identity authentication to ensure its legitimacy. During the identity authentication process, only the corresponding terminal device can perform the biometric identification process, which better protects the security of biometric information and the security of the identity authentication process.

[0205] Based on this, in some embodiments, the above-mentioned S109 may specifically include:

[0206] The server sends an encrypted user credential code to the management center, which then uses the private key of the key pair corresponding to the user account to decrypt the encrypted user credential code and obtain the target user credential code.

[0207] The server receives the target user's credential code sent by the management center.

[0208] In some embodiments, the public key of the key pair returned by the management center to the server after the registration process is used to decrypt the encrypted user credential code. During the decryption process, the encrypted user credential code needs to be sent to the management center. The management center uses the private key of the key pair corresponding to the user account to decrypt the encrypted user credential code, obtaining the target user credential code. The obtained target user credential code is then returned to the server.

[0209] In this way, the private key is kept only in the management center and not distributed to the public, which ensures the security of the key and thus the security of the authentication process.

[0210] Based on this, in some embodiments, such as Figure 7 As shown, the method may further include:

[0211] S310. Upon receiving input of a user account and a click on the login control, the terminal device collects the biometric information of the second target and compares the biometric information of the second target with the pre-stored biometric information to obtain the biometric identification result of the second target.

[0212] S320. If the biometric identification result of the second target is successfully identified and the click input for the cancellation control is received, the terminal device generates a cancellation request based on the user account and the device identifier of the terminal device. The cancellation request includes the user account and the device identifier of the terminal device.

[0213] S330, The terminal device sends a deregistration request to the server;

[0214] S340. The server deletes the registration information corresponding to the device identifier from the pre-stored registration information and notifies the management center to delete the key pair corresponding to the user account.

[0215] S350. Upon receiving the deletion success message from the management center, the server sends the target information to the terminal device, indicating that the deregistration was successful.

[0216] S360, terminal devices delete public keys and pre-stored biometric information.

[0217] In some embodiments, when a user changes positions or leaves the company, it is necessary to deregister the registered terminal device to ensure that the user cannot log in to the bastion host. When a user enters the terminal device via biometrics, the terminal device generates a deregistration request based on the user account and the terminal device's identifier, and sends the request to the server. The server first requests the management center to delete the corresponding private key. After deleting the corresponding private key, the management center returns a "deletion successful" message to the server. Upon receiving the deletion success message from the management center, the server sends the target information to the terminal device, and the terminal device deletes the stored public key and pre-stored biometric information.

[0218] In this way, the authentication of employees who have left the company or changed positions is cancelled through the cancellation process, preventing them from logging into the bastion host and obtaining server resources, thus ensuring resource security.

[0219] In the embodiments provided in this application, such as Figure 8 As shown, the design revolves around three scenarios: S120 (terminal device registration), S130 (passwordless authentication), and S140 (terminal device deregistration). This ensures that only registered terminal devices possess passwordless authentication capabilities. Passwordless authentication technology can only be applied to bastion host login, single sign-on, and IT operations and maintenance scenarios after terminal device registration. The significance of applying passwordless authentication technology in these three scenarios is to address the leakage of user privacy information and prevent user identity theft or misuse. As an example, such as... Figure 9 As shown, the authentication process includes:

[0220] 1. Obtain user identity credentials (user account): When a user logs in to the bastion host, the user needs to manually enter their account. After successful login, this account is used as a global parameter, allowing the bastion host to automatically obtain the user account when the user performs single sign-on or IT operations and maintenance.

[0221] 2. Generate user credentials and perform passwordless authentication: In three operation scenarios—bastion host login, single sign-on, and IT operations and maintenance—after obtaining a user account, the server randomly generates a user credential code and sends it to the terminal device. Upon receiving the user credential code, the terminal device initiates biometric authentication.

[0222] 3. Terminal device biometric identification: After obtaining the user's credential code, the terminal device initiates biometric identification with the user. If the identification is successful, the user's credential code is marked as the first mark; otherwise, it is marked as the second mark.

[0223] 4. Identity Association: The terminal device encrypts the marked user credential code and transmits it to the server. The server determines whether to "allow" or "deny" the operation in three scenarios: bastion host login, single sign-on, and IT operation and maintenance commands, based on whether the user credential code is "first mark / second mark".

[0224] It should be noted that the terminal device can be a mobile phone; the bastion host uses a client / server architecture. The purpose of passwordless authentication is to achieve passwordless authentication for the bastion host through two steps: biometric identification and identity verification. That is, users only need to enter their identity credentials (user account) and do not need to enter a static password to complete the bastion host login.

[0225] In the embodiments provided in this application, the present invention utilizes passwordless authentication technology, firstly applied to a bastion host in a C / S architecture, to ensure that user privacy information is not uploaded to the bastion host, thus preventing leakage of user privacy information. Secondly, the passwordless authentication technology is applied to three scenarios: bastion host login, single sign-on, and IT operations and maintenance, ensuring that user identities are not impersonated or borrowed in these scenarios. Finally, combined with a tiered electronic fence structure and behavior boundary detection, in the IT operations and maintenance scenario, it can both monitor whether user behavior has exceeded boundaries and avoid frequent calls to passwordless authentication during the operations and maintenance process. By applying passwordless authentication technology to the bastion host, it prevents the leakage of user biometric information and avoids the impersonation or borrowing of user identities, while also eliminating the need for users to enter passwords, thus improving the user experience.

[0226] In the embodiments provided in this application, focusing on three scenarios—bastion host login, single sign-on, and IT operations and maintenance—passwordless authentication technology and a tiered electronic fence structure with behavior boundary detection are used to extend passwordless authentication technology to the IT operations and maintenance scenario. This not only solves the problems of privacy information being stolen or hijacked, identity being impersonated or borrowed, and poor user experience that exist during access in different scenarios, but also prevents user identity from being impersonated or borrowed during the operations and maintenance process. Furthermore, it can monitor which "boundary-crossing" behaviors users exhibit during the operations and maintenance process and take action against such behaviors.

[0227] Based on the identity authentication method provided in the above embodiments, this application also provides specific implementations of the identity authentication device. Please refer to the following embodiments.

[0228] See Figure 10 The identity authentication device 400 provided in this application embodiment is applied to a bastion host and includes:

[0229] Module 410 is used to retrieve user accounts;

[0230] The generation module 420 is used to generate a biometric request based on the user account, wherein the biometric request includes the user account.

[0231] The sending module 430 is used to send a biometric request to the server for the server to randomly generate a user credential code, send the user credential code to the terminal device corresponding to the user account for the terminal device to collect the first target biometric information, compare the first target biometric information with the pre-stored biometric information to obtain the first target biometric result, mark the target tag corresponding to the first target biometric result in the user credential code according to the relationship information between the biometric result and the tag, obtain the target user credential code, encrypt the target user credential code to obtain the encrypted user credential code, and send the encrypted user credential code to the server for the server to decrypt the encrypted user credential code to obtain the target user credential code;

[0232] The receiving module 440 is used to receive authentication pass information sent by the server when the target marker in the target user's credential code is the first marker.

[0233] Based on this, in some embodiments, the acquisition module 410 can be specifically used for:

[0234] Receive user account information input by the user;

[0235] Module 420 can be specifically used for:

[0236] Upon receiving a user's click input on the login control, a biometric request is generated based on the user's account.

[0237] Based on this, in some embodiments, the device 400 may further include:

[0238] The receiving module 440 is also used to receive the user account entered by the user before obtaining the user account;

[0239] The acquisition module 410 is also used to acquire the user account when it receives the user's click input on the single sign-on control.

[0240] Based on this, in some embodiments, the device 400 may further include:

[0241] The receiving module 440 is also used to receive the user account entered by the user before obtaining the user account;

[0242] The acquisition module 410 is also used to acquire, upon receiving a target command input by the user, the first target ladder level of the command executed by the bastion host or the data accessed, and the first target type information of the target command;

[0243] The determination module is used to determine the target command level corresponding to the first target type information based on the relationship information between type information and command level.

[0244] The determination module is also used to determine the second target ladder level of the target command level based on the relationship information between command level and ladder level;

[0245] The acquisition module 410 is also used to acquire the user account when the first target ladder level and the second target ladder level are inconsistent.

[0246] Based on this, in some embodiments, the device 400 may further include:

[0247] The receiving module 440 is also used to receive the user account entered by the user before obtaining the user account;

[0248] The acquisition module 410 is also used to acquire, upon receiving a user's request to access target data, the first target ladder level of the command executed by the bastion host or the data accessed, and the second target type information of the target data.

[0249] The determination module is also used to determine the target data level corresponding to the second target category information based on the relationship information between category information and data level;

[0250] The determination module is also used to determine the third target ladder level of the target data level based on the relationship information between data level and ladder level;

[0251] The acquisition module 410 is also used to acquire the user account when the first target ladder level and the third target ladder level are inconsistent.

[0252] Based on this, in some embodiments, the device 400 may further include:

[0253] The receiving module 440 is also used to receive management inputs for the relationship information between data level and ladder level, as well as the relationship information between command level and ladder level. The management inputs include at least one of the following: add input, modify input, and delete input.

[0254] See Figure 11 The identity authentication device 500 provided in this application embodiment is applied to a server and includes:

[0255] The receiving module 510 is used to receive a biometric request sent by the bastion host when the bastion host obtains the user account. The biometric request includes the user account.

[0256] Generation module 520 is used to randomly generate user credential codes;

[0257] The sending module 530 is used to send a user credential code to the terminal device corresponding to the user account, so that the terminal device can collect the first target biometric information, compare the first target biometric information with the pre-stored biometric information to obtain the first target biometric identification result, mark the target tag corresponding to the first target biometric identification result in the user credential code according to the relationship information between the biometric identification result and the tag, obtain the target user credential code, and encrypt the target user credential code to obtain the encrypted user credential code.

[0258] The receiving module 510 is also used to receive the encrypted user credential code sent by the terminal device;

[0259] The decryption module 540 is used to decrypt the encrypted user credential code to obtain the target user credential code;

[0260] The sending module 530 is also used to send authentication pass information to the bastion host when the target marker in the target user credential code is the first marker.

[0261] Based on this, in some embodiments, the device 500 may further include:

[0262] The receiving module 510 is also used to receive a registration request sent by the terminal device before receiving the biometric request sent by the bastion host. The registration request includes the user account and the device identifier of the terminal device.

[0263] The detection module is used to detect whether the pre-stored registration information includes the device identifier registration information;

[0264] The acquisition module is used to obtain the public key of the key pair corresponding to the user account from the management center when no device identifier registration information is detected;

[0265] The sending module 530 is also used to send a public key to the terminal device, so that the terminal device can use the public key to encrypt the target user credential code to obtain an encrypted user credential code.

[0266] Based on this, in some embodiments, the decryption module 540 can specifically be used for:

[0267] Send the encrypted user credential code to the management center so that the management center can decrypt the encrypted user credential code using the private key of the key pair corresponding to the user account to obtain the target user credential code;

[0268] Receive the target user's credentials code sent by the management center.

[0269] In one possible implementation, the device 500 may further include:

[0270] The receiving module 510 is further configured to receive a logout request sent by the terminal device when the second target biometric result of the terminal device has passed the identification and the terminal device has received a click input to the logout control. The logout request includes the user account and the device identifier of the terminal device. The second target biometric result is obtained by the terminal device collecting the second target biometric information and comparing the second target biometric information with the pre-stored biometric information when it receives the input of the user account and the click input to the login control.

[0271] The deletion module is used to delete the registration information corresponding to the device identifier from the pre-stored registration information;

[0272] The notification module is used to notify the management center to delete the key pair corresponding to the user account;

[0273] The sending module 530 is also used to send target information to the terminal device after receiving the deletion success information sent by the management center, so that the terminal device can delete the public key and the pre-stored biometric information. The target information indicates that the deregistration was successful.

[0274] See Figure 12 The identity authentication device 600 provided in this application embodiment is applied to a terminal device and includes:

[0275] The receiving module 610 is used to receive the user credential code sent by the server when the server receives a biometric request sent by the bastion host and randomly generates a user credential code.

[0276] The acquisition module 620 is used to acquire the first target biological information and compare the first target biological information with the pre-stored biological information to obtain the first target biological identification result;

[0277] The tagging module 630 is used to tag the target tag corresponding to the first target biometric result in the user credential code according to the relationship information between the biometric result and the tag, so as to obtain the target user credential code;

[0278] The encryption module 640 is used to encrypt the target user's credential code to obtain an encrypted user credential code;

[0279] The sending module 650 is used to send an encrypted user credential code to the server, so that the server can decrypt the encrypted user credential code to obtain the target user credential code. If the target marker in the target user credential code is the first marker, the authentication pass information is sent to the bastion host.

[0280] Based on this, in some embodiments, the device 600 may further include:

[0281] The generation module is used to generate a registration request based on the user account and the device identifier of the terminal device before receiving the user credential code sent by the server, after receiving the input of the user account and user password, and after receiving the click input of the registration control. The registration request includes the user account and the device identifier of the terminal device.

[0282] The sending module 650 is also used to send a registration request to the server so that the server can detect whether the pre-stored registration information includes the registration information of the device identifier. If the registration information of the device identifier is not detected, the server can obtain the public key of the key pair corresponding to the user account from the management center.

[0283] The receiving module 610 is also used to receive the public key sent by the server;

[0284] The acquisition module 620 is also used to acquire biological information and save the acquired biological information as the biological information corresponding to the user account;

[0285] Encryption module 640 can be specifically used for:

[0286] The target user's credential code is encrypted using the public key to obtain the encrypted user credential code.

[0287] Based on this, in some embodiments, the device 600 may further include:

[0288] The acquisition module 620 is also used to acquire second target biometric information when it receives input of user account and click input of login control, and compare the second target biometric information with the pre-stored biometric information to obtain the second target biometric identification result;

[0289] The generation module is also used to generate a cancellation request based on the user account and the device identifier of the terminal device when the second target biometric result representation is passed and the click input for the cancellation control is received. The cancellation request includes the user account and the device identifier of the terminal device.

[0290] The sending module 650 is also used to send a deregistration request to the server so that the server can delete the registration information corresponding to the device identifier from the pre-stored registration information, notify the management center to delete the key pair corresponding to the user account, and send the target information to the terminal device after receiving the deletion success information sent by the management center. The target information indicates that the deregistration was successful.

[0291] The receiving module 610 is also used to receive target information sent by the server;

[0292] The deletion module is used to delete the public key and pre-stored biometric information.

[0293] Each module of the identity authentication device provided in this application embodiment can realize the functions of each step of the identity authentication method provided above, and can achieve its corresponding technical effects. For the sake of brevity, it will not be described in detail here.

[0294] Based on the same inventive concept, embodiments of this application also provide an electronic device.

[0295] Figure 13 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0296] An electronic device may include a processor 701 and a memory 702 storing computer program instructions.

[0297] Specifically, the processor 701 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0298] Memory 702 may include mass storage for data or instructions. For example, and not limitingly, memory 702 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 702 may include removable or non-removable (or fixed) media. Where appropriate, memory 702 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 702 is non-volatile solid-state memory.

[0299] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0300] The processor 701 implements any of the authentication methods described in the above embodiments by reading and executing computer program instructions stored in the memory 702.

[0301] In one example, the electronic device may also include a communication interface 703 and a bus 710. For example, Figure 13 As shown, the processor 701, memory 702, and communication interface 703 are connected through bus 710 and complete communication with each other.

[0302] The communication interface 703 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0303] Bus 710 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Linear Predictive Coding (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (Peripheral Component Interconnect-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VESA Local Bus, VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 710 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application contemplates any suitable bus or interconnection. The electronic device can execute the authentication method described in the embodiments of the present invention, thereby implementing the authentication method described above.

[0304] Furthermore, in conjunction with the authentication methods described in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the authentication methods described in the above embodiments.

[0305] This application also provides a computer program product, wherein the instructions in the computer program product, when executed by the processor of an electronic device, cause the electronic device to perform various processes implementing any of the above-described embodiments of the identity authentication method.

[0306] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0307] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable read-only memory (EROM), floppy disks, compact disc read-only memory (CD-ROM), optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0308] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0309] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0310] The above are merely specific embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. An identity authentication method, characterized in that, Applications to bastion hosts include: Obtain user account; Based on the user account, a biometric request is generated, the biometric request including the user account; The system sends a biometric request to the server to randomly generate a user credential code. The system then sends the user credential code to the terminal device corresponding to the user account to collect first target biometric information. The terminal device compares the first target biometric information with pre-stored biometric information to obtain a first target biometric result. Based on the relationship between the biometric result and the marker, a target marker corresponding to the first target biometric result is marked in the user credential code to obtain a target user credential code. The target user credential code is then encrypted to obtain an encrypted user credential code. Finally, the encrypted user credential code is sent to the server for the server to decrypt, thus obtaining the target user credential code. If the target marker in the target user credential code is the first marker, the authentication pass information sent by the server is received; Before obtaining the user account, the method further includes: Receive user account information input by the user; Upon receiving the target command input by the user, the first target tier level of the command executed by the bastion host or the data accessed, and the first target type information of the target command are obtained. Based on the relationship between the type information and the command level, determine the target command level corresponding to the first target type information; Based on the relationship information between command level and ladder level, determine the second target ladder level of the target command level; If the first target ladder level and the second target ladder level are inconsistent, obtain the user account; Before obtaining the user account, the method further includes: Receive user account information input by the user; Upon receiving a user's request to access target data, the system obtains the first target tier level of the command executed by the bastion host or the data accessed, as well as the second target category information of the target data. Based on the relationship between category information and data level, determine the target data level corresponding to the second target category information; Based on the relationship between data level and ladder level, determine the third target ladder level of the target data level; If the first target ladder level and the third target ladder level are inconsistent, obtain the user account.

2. The identity authentication method according to claim 1, characterized in that, The acquisition of user accounts includes: Receive user account information input by the user; The step of generating a biometric request based on the user account includes: Upon receiving the user's click input on the login control, a biometric request is generated based on the user's account.

3. The identity authentication method according to claim 1, characterized in that, Before obtaining the user account, the method further includes: Receive user account information input by the user; Upon receiving the user's click input on the single sign-on control, the user's account is obtained.

4. The identity authentication method according to claim 1, characterized in that, Also includes: The system receives management inputs that include information on the relationship between data levels and ladder levels, as well as information on the relationship between command levels and ladder levels. These management inputs include at least one of the following: add input, modify input, and delete input.

5. An identity authentication method, characterized in that, Applied to servers, including: When the bastion host obtains a user account, it receives a biometric authentication request sent by the bastion host, the biometric authentication request including the user account; Randomly generate user credential codes; The user credential code is sent to the terminal device corresponding to the user account so that the terminal device can collect the first target biometric information and compare the first target biometric information with the pre-stored biometric information to obtain the first target biometric identification result. According to the relationship information between the biometric identification result and the tag, the target tag corresponding to the first target biometric identification result is marked in the user credential code to obtain the target user credential code. The target user credential code is then encrypted to obtain the encrypted user credential code. Receive the encrypted user credential code sent by the terminal device; The encrypted user credential code is decrypted to obtain the target user credential code; If the target marker in the target user's credential code is the first marker, an authentication pass message is sent to the bastion host. The bastion host acquires user accounts only under the following conditions: Before acquiring a user account, the bastion host receives the user account input by the user; upon receiving the target command input by the user, it acquires the first target ladder level of the command executed by the bastion host or the data accessed, and the first target type information of the target command; based on the relationship between the type information and the command level, it determines the target command level corresponding to the first target type information; based on the relationship between the command level and the ladder level, it determines the second target ladder level of the target command level; if the first target ladder level and the second target ladder level are inconsistent, it acquires the user account. Before acquiring a user account, the bastion host receives the user account entered by the user; upon receiving the user's request to access target data, it acquires the first target ladder level of the command executed by the bastion host or the data accessed, and the second target category information of the target data; based on the relationship between the category information and the data level, it determines the target data level corresponding to the second target category information; based on the relationship between the data level and the ladder level, it determines the third target ladder level of the target data level; if the first target ladder level and the third target ladder level are inconsistent, it acquires the user account.

6. The identity authentication method according to claim 5, characterized in that, Before receiving the biometric request sent by the bastion host, the method further includes: Receive a registration request sent by the terminal device, the registration request including the user account and the device identifier of the terminal device; Check whether the pre-stored registration information includes the registration information of the device identifier; If no registration information for the device identifier is detected, obtain the public key of the key pair corresponding to the user account from the management center; The public key is sent to the terminal device so that the terminal device can use the public key to encrypt the target user credential code to obtain an encrypted user credential code.

7. The identity authentication method according to claim 6, characterized in that, The step of decrypting the encrypted user credential code to obtain the target user credential code includes: The encrypted user credential code is sent to the management center so that the management center can decrypt the encrypted user credential code using the private key of the key pair corresponding to the user account to obtain the target user credential code. Receive the target user credential code sent by the management center.

8. The identity authentication method according to claim 6, characterized in that, Also includes: When the second target biometric identification result of the terminal device is successfully identified and the terminal device receives a click input to the logout control, the terminal device receives a logout request sent by the terminal device. The logout request includes the user account and the device identifier of the terminal device. The second target biometric identification result is obtained by the terminal device collecting second target biometric information and comparing the second target biometric information with the pre-stored biometric information when it receives the input of the user account and the click input to the login control. Delete the registration information corresponding to the device identifier from the pre-stored registration information; The management center is notified to delete the key pair corresponding to the user account. Upon receiving a successful deletion message from the management center, target information is sent to the terminal device for the terminal device to delete the public key and the pre-stored biometric information. The target information indicates successful deregistration.

9. An identity authentication method, characterized in that, Applied to terminal devices, including: When the server receives a biometric request from the bastion host and randomly generates a user credential code, it receives the user credential code sent by the server. Collect the first target biometric information and compare it with the pre-stored biometric information to obtain the first target biometric identification result; Based on the relationship information between the biometric result and the tag, the target tag corresponding to the first target biometric result is marked in the user credential code to obtain the target user credential code; The target user credential code is encrypted to obtain an encrypted user credential code; The encrypted user credential code is sent to the server for the server to decrypt the encrypted user credential code to obtain the target user credential code. If the target marker in the target user credential code is the first marker, the authentication pass information is sent to the bastion host. The biometric request is a request generated by the bastion host based on the user account after obtaining the user account; The bastion host acquires user accounts only under the following conditions: Before acquiring a user account, the bastion host receives the user account input by the user; upon receiving the target command input by the user, it acquires the first target ladder level of the command executed by the bastion host or the data accessed, and the first target type information of the target command; based on the relationship between the type information and the command level, it determines the target command level corresponding to the first target type information; based on the relationship between the command level and the ladder level, it determines the second target ladder level of the target command level; if the first target ladder level and the second target ladder level are inconsistent, it acquires the user account. Before acquiring a user account, the bastion host receives the user account entered by the user; upon receiving the user's request to access target data, it acquires the first target ladder level of the command executed by the bastion host or the data accessed, and the second target category information of the target data; based on the relationship between the category information and the data level, it determines the target data level corresponding to the second target category information; based on the relationship between the data level and the ladder level, it determines the third target ladder level of the target data level; if the first target ladder level and the third target ladder level are inconsistent, it acquires the user account.

10. The identity authentication method according to claim 9, characterized in that, Before receiving the user credential code sent by the server, the method further includes: Upon receiving input of a user account and password, and upon receiving a click input to the registration control, a registration request is generated based on the user account and the device identifier of the terminal device. The registration request includes the user account and the device identifier of the terminal device. The registration request is sent to the server so that the server can detect whether the pre-stored registration information includes the registration information of the device identifier. If the registration information of the device identifier is not detected, the public key of the key pair corresponding to the user account is obtained from the management center. Receive the public key sent by the server; Collect biological information and save the collected biological information as the biological information corresponding to the user account; The step of encrypting the target user credential code to obtain an encrypted user credential code includes: The target user credential code is encrypted using the public key to obtain the encrypted user credential code.

11. The identity authentication method according to claim 10, characterized in that, Also includes: Upon receiving input of the user account and a click on the login control, the second target biometric information is collected and compared with pre-stored biometric information to obtain the second target biometric identification result. If the second target biometric identification result is successfully identified and a click input to the logout control is received, a logout request is generated based on the user account and the device identifier of the terminal device. The logout request includes the user account and the device identifier of the terminal device. The system sends the deregistration request to the server so that the server can delete the registration information corresponding to the device identifier from the pre-stored registration information, notify the management center to delete the key pair corresponding to the user account, and send target information to the terminal device upon receiving the deletion success information sent by the management center. The target information indicates that the deregistration was successful. Receive the target information sent by the server; Delete the public key and the pre-stored biometric information.

12. An identity authentication device, characterized in that, Applications to bastion hosts include: The acquisition module is used to retrieve user accounts; A generation module is used to generate a biometric request based on the user account, wherein the biometric request includes the user account; The sending module is configured to send the biometric request to the server, so that the server can randomly generate a user credential code, send the user credential code to the terminal device corresponding to the user account, so that the terminal device can collect first target biometric information, compare the first target biometric information with pre-stored biometric information to obtain a first target biometric result, mark the target tag corresponding to the first target biometric result in the user credential code according to the relationship information between the biometric result and the tag, obtain a target user credential code, encrypt the target user credential code to obtain an encrypted user credential code, and send the encrypted user credential code to the server, so that the server can decrypt the encrypted user credential code to obtain the target user credential code; The receiving module is configured to receive authentication pass information sent by the server when the target marker in the target user credential code is a first marker; The receiving module is also used to receive the user account entered by the user before obtaining the user account; The acquisition module is further configured to, upon receiving the target command input by the user, acquire the first target tier level of the command executed by the bastion host or the data accessed, and the first target type information of the target command; The device further includes: The determination module is used to determine the target command level corresponding to the first target type information based on the relationship information between the type information and the command level. The determining module is further configured to determine the second target ladder level of the target command level based on the relationship information between command level and ladder level; The acquisition module is also used to acquire the user account when the first target ladder level and the second target ladder level are inconsistent; The receiving module is also used to receive the user account entered by the user before obtaining the user account; The acquisition module is further configured to, upon receiving the user's request to access the target data, acquire the first target tier level of the command executed by the bastion host or the data accessed, and the second target type information of the target data; The determining module is further configured to determine the target data level corresponding to the second target category information based on the relationship information between the category information and the data level. The determining module is further configured to determine the third target ladder level of the target data level based on the relationship information between data level and ladder level; The acquisition module is also used to acquire the user account when the first target ladder level and the third target ladder level are inconsistent.

13. An identity authentication device, characterized in that, Applied to servers, including: The receiving module is used to receive a biometric request sent by the bastion host when the bastion host obtains the user account. The biometric request includes the user account. The generation module is used to randomly generate user credential codes; The sending module is used to send the user credential code to the terminal device corresponding to the user account, so that the terminal device can collect the first target biometric information, compare the first target biometric information with the pre-stored biometric information to obtain the first target biometric identification result, mark the target tag corresponding to the first target biometric identification result in the user credential code according to the relationship information between the biometric identification result and the tag, obtain the target user credential code, and encrypt the target user credential code to obtain the encrypted user credential code; The receiving module is also used to receive the encrypted user credential code sent by the terminal device; The decryption module is used to decrypt the encrypted user credential code to obtain the target user credential code; The sending module is also used to send authentication pass information to the bastion host when the target marker in the target user credential code is the first marker; The bastion host acquires user accounts only under the following conditions: Before acquiring a user account, the bastion host receives the user account input by the user; upon receiving the target command input by the user, it acquires the first target ladder level of the command executed by the bastion host or the data accessed, and the first target type information of the target command; based on the relationship between the type information and the command level, it determines the target command level corresponding to the first target type information; based on the relationship between the command level and the ladder level, it determines the second target ladder level of the target command level; if the first target ladder level and the second target ladder level are inconsistent, it acquires the user account. Before acquiring a user account, the bastion host receives the user account entered by the user; upon receiving the user's request to access target data, it acquires the first target ladder level of the command executed by the bastion host or the data accessed, and the second target category information of the target data; based on the relationship between the category information and the data level, it determines the target data level corresponding to the second target category information; based on the relationship between the data level and the ladder level, it determines the third target ladder level of the target data level; if the first target ladder level and the third target ladder level are inconsistent, it acquires the user account.

14. An identity authentication device, characterized in that, Applied to terminal devices, including: The receiving module is used to receive the user credential code sent by the server when the server receives a biometric request sent by the bastion host and randomly generates a user credential code; The acquisition module is used to acquire the first target biological information and compare the first target biological information with the pre-stored biological information to obtain the first target biological identification result; The tagging module is used to tag the target tag corresponding to the first target biometric result in the user credential code according to the relationship information between the biometric result and the tag, so as to obtain the target user credential code; An encryption module is used to encrypt the target user credential code to obtain an encrypted user credential code; The sending module is used to send the encrypted user credential code to the server so that the server can decrypt the encrypted user credential code to obtain the target user credential code. If the target marker in the target user credential code is a first marker, the module sends authentication pass information to the bastion host. The biometric request is a request generated by the bastion host based on the user account after obtaining the user account; The bastion host acquires user accounts only under the following conditions: Before acquiring a user account, the bastion host receives the user account input by the user; upon receiving the target command input by the user, it acquires the first target ladder level of the command executed by the bastion host or the data accessed, and the first target type information of the target command; based on the relationship between the type information and the command level, it determines the target command level corresponding to the first target type information; based on the relationship between the command level and the ladder level, it determines the second target ladder level of the target command level; if the first target ladder level and the second target ladder level are inconsistent, it acquires the user account. Before acquiring a user account, the bastion host receives the user account entered by the user; upon receiving the user's request to access target data, it acquires the first target ladder level of the command executed by the bastion host or the data accessed, and the second target category information of the target data; based on the relationship between the category information and the data level, it determines the target data level corresponding to the second target category information; based on the relationship between the data level and the ladder level, it determines the third target ladder level of the target data level; if the first target ladder level and the third target ladder level are inconsistent, it acquires the user account.

15. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the authentication method as described in any one of claims 1-4, or the authentication method as described in any one of claims 5-8, or the authentication method as described in any one of claims 9-11.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the authentication method as described in any one of claims 1-4, or the authentication method as described in any one of claims 5-8, or the authentication method as described in any one of claims 9-11.

17. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device is able to perform the authentication method as described in any one of claims 1-4, or the authentication method as described in any one of claims 5-8, or the authentication method as described in any one of claims 9-11.

Images