An identity authentication method and system, an electronic device, and a storage medium

Abstract

This application provides an identity authentication method, system, electronic device, and storage medium applied to a zero-trust controller. If the identity authentication information sent by the client during the zero-trust login process is initial identity authentication information, the client's identity authentication score is determined based on the authentication information of each second authentication item. If the identity authentication score is greater than or equal to a preset weighted average score, and the authentication information of the first authentication item among the target authentication items passes verification, the client is granted access to the zero-trust controller, and the identity authentication information is updated. If the identity authentication information is not initial identity authentication information, and the client is determined to meet the identity authentication conditions based on the identity authentication information, the client's identity authentication score is determined based on the authentication information of each target authentication item. If the identity authentication score is greater than or equal to a preset weighted average score, the client's access to the zero-trust controller is retained, and the identity authentication information is updated. The updated identity authentication information is then sent to the client.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to an authentication method, system, electronic device, and storage medium. Background Technology

[0002] With the continuous development of computer technology, in order to ensure the security of applications, user authentication is performed when users access the corresponding applications. That is, identity authentication technology is used to authenticate the identity of users accessing the applications, thereby protecting the security of the applications.

[0003] Current identity authentication generally includes static identity authentication, which includes password authentication, biometric authentication, and hardware authentication. However, static identity authentication can only verify identity before accessing an application and cannot authenticate during application access. In Zero Trust, every user, device, or system needs to be authenticated and authorized when accessing resources, regardless of whether they are inside or outside the network. Therefore, static identity authentication cannot guarantee the security of the Zero Trust model. Zero Trust is a network security model whose basic principle is to distrust any entity in the IT environment. This means that in Zero Trust, every user, device, or system needs to be authenticated and authorized when accessing resources, regardless of whether they are inside or outside the network.

[0004] Therefore, providing a continuous authentication method for a zero-trust model to ensure the security of zero-trust during access is a problem that this application urgently needs to solve. Summary of the Invention

[0005] In view of this, this application provides an identity authentication method, system, electronic device, and storage medium to achieve continuous identity authentication for clients logging into zero-trust accounts, ensuring the security of zero-trust accounts during the access period.

[0006] The first aspect of this application provides an authentication method applied to a zero-trust controller, the method comprising:

[0007] Receive identity authentication information sent by the client during the zero-trust login process; wherein, the identity authentication information includes a timestamp, a token, and authentication information for multiple target authentication items;

[0008] If the identity authentication information is initial identity authentication information, the client's identity authentication score is determined based on the authentication information of each second authentication item; the second authentication item is any one of the target authentication items other than the first authentication item and the third authentication item.

[0009] If the identity authentication score is greater than or equal to the preset weighted average score, the authentication information of the first authentication item in each of the target authentication items is verified;

[0010] If the authentication information of the first authentication item in each target authentication item passes the verification, the client is granted access to the zero-trust system, and the identity authentication information is updated.

[0011] If the identity authentication information is not the initial identity authentication information, determine whether the client meets the identity authentication conditions based on the identity authentication information;

[0012] If the client meets the authentication conditions, the client's authentication score is determined based on the authentication information of each of the target authentication items;

[0013] If the identity authentication score is greater than or equal to the preset weighted average score, the client's access permission to the zero-trust system is retained, and the identity authentication information is updated.

[0014] The updated identity authentication information is sent to the client, so that the client sends the updated identity authentication information to the zero trust controller during the login process.

[0015] Optionally, if the client meets the authentication conditions, determining the client's authentication score based on the authentication information of each of the target authentication items includes:

[0016] If the client meets the authentication conditions, determine whether there is a third authentication item among the target authentication items;

[0017] If the third authentication item is not present in any of the target authentication items, each target authentication item is scored based on its authentication information.

[0018] The client's authentication score is obtained by averaging and weighting the scores of each of the target authentication items.

[0019] Optionally, the method further includes:

[0020] If the third authentication item exists in each of the target authentication items, determine whether the authentication information of the third authentication item in each of the target authentication items is the same as the authentication information of the third authentication item in the initial identity authentication information;

[0021] If the authentication information of the third authentication item in each of the target authentication items is the same as the authentication information of the third authentication item in the initial identity authentication information, then the step of determining the client's identity authentication score based on the authentication information of each of the second authentication items is executed.

[0022] Optionally, the client's authentication score is determined based on the authentication information of each second authentication item, including:

[0023] Each second certification item is scored based on the certification information of each second certification item;

[0024] The client's identity authentication score is obtained by averaging and weighting the scores of each of the second authentication items.

[0025] Optionally, if the identity authentication information is initial identity authentication information, updating the identity authentication information includes:

[0026] Generate a unique token and access timestamp for the client, and randomly specify multiple authentication items from a pre-set set of authentication items;

[0027] The identity authentication information is updated by using multiple randomly specified authentication items to update multiple target authentication items, and the identity authentication information is updated by using the exclusive token and the access timestamp.

[0028] Optionally, if the identity authentication information is not the initial identity authentication information, updating the identity authentication information includes:

[0029] Randomly select multiple authentication items from the pre-set authentication items;

[0030] Multiple target authentication items in the identity authentication information are updated using multiple randomly specified authentication items.

[0031] Optionally, if the identity authentication information is not initial identity authentication information, determining whether the client meets the identity authentication conditions based on the identity authentication information includes:

[0032] If the identity authentication information is not the initial identity authentication information, obtain multiple authentication items randomly specified when the client's identity authentication was successfully passed in the last time;

[0033] If the multiple authentication items randomly specified when the client's identity authentication was successful last time are the same as the target authentication items in the identity authentication information, then the timestamp and the token are verified.

[0034] If the timestamp and the token pass the verification, it is determined that the client meets the identity authentication conditions;

[0035] If any of the target authentication items is different from at least one authentication item randomly specified when the client's identity authentication was successful last time, and / or, the timestamp verification fails, and / or, the token verification fails, it is determined that the client does not meet the identity authentication conditions.

[0036] A second aspect of this application provides an identity authentication system applied to a zero-trust controller, the system comprising:

[0037] The receiving unit is used to receive the identity authentication information sent by the client during the zero-trust login period; wherein, the identity authentication information includes a timestamp, a token, and authentication information for multiple target authentication items;

[0038] The first identity authentication score determination unit is used to determine the client's identity authentication score based on the authentication information of each second authentication item if the identity authentication information is initial identity authentication information; the second authentication item is any one of the target authentication items other than the first authentication item and the third authentication item.

[0039] The first verification unit is used to verify the authentication information of the first authentication item in each of the target authentication items if the identity authentication score is greater than or equal to the preset weighted average score.

[0040] The granting unit is used to grant the client access to the zero-trust system and update the identity authentication information if the authentication information of the first authentication item among the target authentication items passes the verification.

[0041] The first judgment unit is used to determine whether the client meets the identity authentication conditions based on the identity authentication information if the identity authentication information is not the first identity authentication information.

[0042] The second identity authentication score determination unit is used to determine the identity authentication score of the client based on the authentication information of each of the target authentication items if the client meets the identity authentication conditions.

[0043] An update unit is used to update the identity authentication information if the identity authentication score is greater than or equal to a preset weighted average score, retain the client's access permission to the zero-trust system.

[0044] The sending unit is used to send the updated identity authentication information to the client, so that the client sends the updated identity authentication information to the zero trust controller during the zero trust login process.

[0045] A third aspect of this application provides an electronic device, comprising: a processor and a memory, the processor and the memory being connected via a communication bus; wherein the processor is configured to call and execute a program stored in the memory; and the memory is configured to store the program, the program being configured to implement the authentication method provided in the first aspect of this application.

[0046] A fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions for performing the authentication method provided in the first aspect of this application.

[0047] This application provides an identity authentication method, system, electronic device, and storage medium, which receives identity authentication information sent by a client during a zero-trust login period. The identity authentication information includes a timestamp, a token, and authentication information for multiple target authentication items. If the identity authentication information is initial authentication information, the client's identity authentication score is determined based on the authentication information of each second authentication item. Each second authentication item is any target authentication item other than the first and third authentication items. If the identity authentication score is greater than or equal to a preset weighted average score, the authentication information of the first authentication item among the target authentication items is verified. If the authentication information of the authentication item passes verification, the client is granted access to Zero Trust and the authentication information is updated. If the authentication information is not the initial authentication information, the client's authentication conditions are determined based on the authentication information. If the client meets the authentication conditions, the client's authentication score is determined based on the authentication information of each target authentication item. If the authentication score is greater than or equal to a preset weighted average score, the client's access to Zero Trust is retained, and the authentication information is updated. The updated authentication information is sent to the client, enabling the client to send the updated authentication information to the Zero Trust controller during the Zero Trust login period. Therefore, the technical solution provided in this application can receive authentication information sent by the client during the client's access to Zero Trust, use the received authentication information to authenticate the client, and, if the client's authentication is successful, grant or retain the client's access to Zero Trust while updating the authentication information. This allows the client to send the updated authentication information to the Zero Trust controller during the Zero Trust login period, achieving continuous authentication of clients accessing Zero Trust and ensuring the security of Zero Trust during the access period. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0049] Figure 1 A flowchart illustrating an identity authentication method provided in an embodiment of this application;

[0050] Figure 2 A flowchart illustrating another authentication method provided in an embodiment of this application;

[0051] Figure 3 This is a schematic diagram of the structure of an identity authentication system provided in an embodiment of this application;

[0052] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] In this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0055] It should be noted that, regarding user-related data: in the technical solutions disclosed in this application, the acquisition, collection, storage, use, processing, transmission, provision, disclosure, and application of data all comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0056] As can be seen from the background technology above, static identity authentication can only verify the identity of the client accessing the application before accessing the application, and cannot perform identity authentication during the access to the application. Zero Trust, on the other hand, requires each user, device or system to be authenticated and authorized during the access period. Therefore, the static identity authentication method cannot guarantee the security of Zero Trust during the access period.

[0057] In existing technologies, dynamic authentication can be used to continuously authenticate clients accessing Zero Trust. However, existing dynamic authentication is difficult to deal with replay and man-in-the-middle attacks, and it also cannot guarantee the security of Zero Trust during access.

[0058] Therefore, this application provides an identity authentication method, system, electronic device, and storage medium. By receiving identity authentication information sent by a client during zero-trust login, and using the timestamp, token, and authentication information of each target authentication item in the identity authentication information to authenticate the client, the system grants or retains the client's access to zero-trust if the client's identity authentication is successful. This effectively prevents clients with security vulnerabilities from accessing zero-trust and also blocks attacked clients from accessing zero-trust. After retaining the client's access, to ensure that the authentication process is protected from replay attacks and man-in-the-middle attacks, the identity authentication information can be updated. Finally, the updated identity authentication information and access timestamp are sent to the client, enabling the client to send the updated identity authentication information to the zero-trust controller during zero-trust login.

[0059] See Figure 1 The diagram illustrates a flowchart of an authentication method provided in an embodiment of this application, applied to a zero-trust controller. The authentication method specifically includes the following steps:

[0060] S101: Receive the identity authentication information sent by the client during the zero-trust login period, and determine whether the identity authentication information is the first identity authentication information; wherein, the identity authentication information includes timestamp, token and authentication information of multiple target authentication items; if the identity authentication information is the first identity authentication information, execute step S102; if the identity authentication information is not the first identity authentication information, execute step S104.

[0061] During the specific execution of step S101, since Zero Trust requires clients to perform corresponding authentication and authorization when accessing the corresponding resources, after logging into Zero Trust, the client can obtain its own timestamp, token, and authentication information of multiple target authentication items. Based on the timestamp, token, multiple target authentication items, and authentication information, the client generates corresponding identity authentication information and sends this identity authentication information to Zero Trust control. Zero Trust control then uses the received identity authentication information to perform corresponding identity authentication on the client that logged into Zero Trust, thereby ensuring the security of Zero Trust during the access period.

[0062] In some embodiments, if the authentication information sent by the client is the first authentication information, then the token obtained by the client when generating the corresponding authentication information is a token pre-determined with Zero Trust, and the multiple target authentication items are multiple pre-set authentication items; if the authentication information sent by the client is not the first authentication information, then the token obtained by the client when generating the corresponding authentication information is a unique token generated by Zero Trust control when the client's authentication was successful last time, and the multiple target authentication items are multiple authentication items randomly specified by Zero Trust control from the pre-set authentication items when the client's authentication was successful last time.

[0063] It should be noted that the pre-set authentication items may include username and password authentication item AUTH_0, CPU, hard disk and network card authentication item AUTH_1, system security policy authentication item AUTH_2, patch installation authentication item AUTH_3, virus scanning authentication item AUTH_4, client sensitive behavior authentication item AUTH_5, and client peripheral device awareness authentication item AUTH_6, etc., which can be set according to the actual application, and are not limited in this embodiment of the application.

[0064] It is worth noting that if the authentication information sent by the client is the first authentication information, then the authentication information must include a token and authentication information for all pre-set authentication items. That is, the multiple target authentication items in the authentication information include username and password authentication items, CPU and network card authentication items, system security policy authentication items, patch installation authentication items, virus scanning authentication items, client sensitive behavior authentication items, and client peripheral device awareness authentication items. If the authentication information is not the first authentication information, then the multiple target authentication items in the authentication information are 3 or 4 authentication items randomly selected from the pre-set authentication items when the client's authentication was passed by zero trust control last time. The selection can be made according to the actual application, and this embodiment of the application does not limit it.

[0065] Optionally, the process of determining whether the identity authentication information is the first identity authentication information can be as follows: it can be determined whether the currently received identity authentication information is the first identity authentication information sent by the client during the zero-trust login period; if the identity authentication information is not the first identity authentication information sent by the client during the zero-trust login period, it is determined that the identity authentication information is not the first identity authentication information, and then step S104 can be executed; if the identity authentication information is the first identity authentication information sent by the client during the zero-trust login period, it is determined that the identity authentication information is the first identity authentication information, and then step S102 can be executed.

[0066] It should be noted that if the authentication information is the first authentication information, then the timestamp in the authentication information can be the current timestamp when the client sends the authentication information; if the authentication information is not the first authentication information, then the timestamp in the authentication information can be the timestamp generated by the zero trust controller when the client successfully authenticates the client using the first authentication information sent by the client.

[0067] S102: Determine the client's authentication score based on the authentication information of each second authentication item; the second authentication item is any one of the target authentication items other than the first authentication item and the third authentication item.

[0068] In the specific execution of step S103, if it is determined that the currently received identity authentication information is the initial identity authentication information, each authentication item other than the first authentication item and the third authentication item can be further determined from each target authentication item. For ease of distinction, the authentication items other than the first authentication item and the third authentication item are called second authentication items, and the authentication information of each second authentication item is used to determine the client's identity authentication score.

[0069] Optionally, the process of determining the client's identity authentication score based on the authentication information of each second authentication item is as follows: score each second authentication item based on the authentication information of each second authentication item; and calculate the client's identity authentication score by averaging and weighting the scores of each second authentication item.

[0070] In some embodiments, the weighting weight of each authentication item other than the first and third authentication items can be pre-configured so that after obtaining the score of each second authentication item, the score of each second authentication item can be multiplied by the corresponding weighting weight to obtain the weighted score of each second authentication item. Finally, the weighted scores of each second authentication item are summed to obtain the total weighted score, which is the client's authentication score.

[0071] For example, you can pre-set the weighting of system security policy authentication items to 15%, patch installation authentication items to 30%, virus scanning authentication items to 15%, client sensitive behavior authentication items to 20%, and client external device authentication items to 20%.

[0072] It should be noted that the second authentication item can be a system security policy authentication item, a patch installation authentication item, a virus scanning authentication item, a client sensitive behavior authentication item, and a client peripheral device awareness authentication item. It can be configured according to the actual application, and is not limited in this embodiment of the application.

[0073] As one implementation of this application, if the second authentication item is a system security policy authentication item, the process of scoring the second authentication item based on the authentication information of the second authentication item can specifically be as follows: determining each security policy related to the system security policy; determining at least one target security policy that has been applied in the client from each security policy based on the authentication information of the system security policy authentication item; and determining the score of the system security policy authentication item based on the pre-set danger level and scoring weight of each target security policy.

[0074] It should be noted that the target security policy item is a security policy item that is not applied in the client.

[0075] In this embodiment, a system security policy related to the system security policy authentication item can be preset. The system security policy may include multiple security policy items. The preset system security policy related to the system security policy authentication item may be a security policy for user and user group management, user login password configuration and login failure handling, system log auditing, sharing policy and remote access, power management, firewall configuration, etc. It can be set according to the actual application, and is not limited in this embodiment.

[0076] It should be noted that the risk level can be divided into: severe, high, medium, etc. Correspondingly, the pre-configured system security policy can include 9 security policies, namely: Severe risk level: 1.1: Disable the Guest account; 1.2: Password length must be at least 8 characters, containing any three types of characters: uppercase and lowercase letters, numbers, and symbols; 1.3: Disable Windows default sharing; High risk level: 2.1: Do not display the last logged-in username when logging into the operating system; 2.2: Restrict anonymous user connection permissions to prevent users from remotely enumerating local accounts; 2.3: Only allow specified authorized accounts to perform shutdown operations on the host; Medium risk level: 3.1: Remind users to change their passwords 10 days before password expiration to avoid account invalidation due to forgetting; 3.2: Set the Windows system log file size; 3.3: Set the Windows system log storage path. The specific content of the system security policy can be set according to actual application, and is not limited in this embodiment.

[0077] For example, the risk level corresponding to each security policy and the scoring weight corresponding to each risk level can be preset. Specifically, the scoring weight for a severe risk level is 20%, for a high risk level it is 10%, and for a medium risk level it is 5%. If the authentication information of the system security policy authentication items in the received identity authentication information indicates that 1.1 is applied, 1.2 is applied, 1.3 is not applied, 2.1 is not applied, 2.2 is applied, 2.3 is applied, 3.1 is applied, 3.2 is not applied, and 3.3 is not applied, then the target security policies can be classified as 1.3, 2.1, 3.2, and 3.3. If the total score of the system security policy authentication items is 100 points, then according to the preset risk level and scoring weight corresponding to each target security policy, the score of the system security policy authentication items can be calculated as 100 - (100*20% + 100*10% + 100*5% + 100*5%) = 60 points.

[0078] As one implementation of this application, if the second authentication item is a patch installation authentication item, the process of scoring the second authentication item based on the authentication information of the second authentication item can specifically be as follows: comparing the target patch indicated by the authentication information of the patch installation authentication item with a pre-configured patch library; if the comparison is successful, determining the score of the patch installation authentication item according to the scoring rules of the target patch and the patch installation authentication item; if the comparison fails, determining the score of the patch installation authentication item as 0.

[0079] In practical applications, corresponding patch libraries and scoring rules can be pre-set. For example, the patch library can include patches for vulnerabilities at the Common Vulnerability Scoring System (CVSS) level, high-risk vulnerabilities, medium-risk vulnerabilities, etc. The scoring rules can be as follows: if the client does not have a CVSS-level critical vulnerability patch installed, the total score for the patch installation certification item will be deducted directly to 0 points; if the client does not have a high-risk vulnerability patch installed, 20 points will be deducted from the total score for the patch installation certification item; if the client does not have a medium-risk vulnerability patch installed, 10 points will be deducted from the total score for the patch installation certification item.

[0080] For example, if it is determined that the patch installation authentication information in the currently received authentication information indicates two target patches, where the target patch is the patch currently installed on the client, each target patch is compared with the patch library. If the comparison is successful, meaning the comparison result indicates that one target patch is a CVSS-level vulnerability patch and the other is a medium-risk vulnerability patch, it can be concluded that a high-risk vulnerability patch is currently installed on the client. Therefore, 20 points can be deducted from the total score (100 points) of the patch installation authentication item, resulting in a score of 80 points for the patch installation authentication item. If the comparison fails, the target patch is not a patch in the patch library, and the score for the patch installation authentication item is determined to be 0.

[0081] As one implementation of this application, if the second authentication item is a virus scanning authentication item, the process of scoring the second authentication item based on the authentication information of the second authentication item can be as follows: determine the virus scanning tool indicated in the authentication information of the virus scanning authentication item, obtain the timestamp of the last full system virus scan performed by the virus scanning tool; determine the score of the virus scanning authentication based on the timestamp of the last full system virus scan and the timestamp in the identity authentication information.

[0082] In practice, the difference between the timestamp of the most recent full virus scan and the timestamp in the identity authentication information can be calculated, and the target time period to which the difference belongs in each pre-set time period can be determined. The score of the virus scan authentication item can then be calculated using the scoring weight corresponding to the target time period.

[0083] For example, multiple preset time periods can be set in advance, where the preset time periods are less than 60 days and greater than 30 days, and greater than 60 days. The scoring weight corresponding to less than 60 days and greater than 30 days is 95%, and the scoring weight corresponding to greater than 60 days is 90%. The total score for the virus detection certification item is 100 points. If the difference between the timestamp of the most recent full system virus scan and the timestamp in the identity authentication information is 40 days, then it can be determined that the target time period to which the difference between the timestamp of the most recent full system virus scan and the timestamp in the identity authentication information belongs is less than 60 days and greater than 30 days. Therefore, the score for the virus detection certification item can be determined to be 95 points.

[0084] As one implementation of this application, if the second authentication item is a client-side sensitive behavior, the process of scoring the second authentication item based on its authentication information can specifically be as follows: determine at least one client-side sensitive behavior indicated in the authentication information of the client-side sensitive behavior authentication item; for each client-side sensitive behavior, determine whether the client-side sensitive behavior belongs to a sensitive behavior in a pre-set zero-trust blacklist; if so, the score of the client-side sensitive behavior authentication item can be set to 0; if not, further determine whether the client-side sensitive behavior belongs to a sensitive behavior in a pre-set whitelist; if so, determine the scoring weight matching the client-side sensitive behavior; if not, remove the client-side sensitive behavior; calculate the score of the client-side sensitive behavior authentication item based on the scoring weight of each client-side sensitive behavior.

[0085] In practical applications, a zero-trust blacklist can be pre-set. Sensitive behaviors in the zero-trust blacklist can be blacklisted programs running on the client or clients communicating with blacklisted IPs. Accordingly, after determining at least one client sensitive behavior indicated in the authentication information of the client sensitive behavior authentication item, it can be determined whether the program running on the client indicated in the client sensitive behavior is a blacklisted program or whether the IP communicating with the client indicated in the client sensitive behavior is a blacklisted IP. If the program running on the client indicated in the client sensitive behavior is a blacklisted program or the IP communicating with the client indicated in the client sensitive behavior is a blacklisted IP, it can be determined that the client sensitive behavior belongs to the sensitive behavior in the zero-trust blacklist.

[0086] In practical applications, a whitelist is pre-set. Sensitive behaviors in the whitelist can include non-whitelisted programs running on the client or the client communicating with non-whitelisted IPs. In other words, it involves programs outside the whitelist running on the client or the client communicating with IPs outside the whitelist. Accordingly, it is determined whether the program running on the client indicated by the client's sensitive behavior is a whitelisted program or whether the IP communicating with the client indicated by the client's sensitive behavior is a whitelisted IP. If the program running on the client indicated by the client's sensitive behavior is not a whitelisted program or the IP communicating with the client indicated by the client's sensitive behavior is not a whitelisted IP, it can be determined that the client's sensitive behavior belongs to the whitelist, and thus the scoring weight of the client's sensitive behavior can be determined.

[0087] It should be noted that if a client-side sensitive behavior is included in the whitelist, the scoring weight of that client-side sensitive behavior can be set to 5%. In other words, if a client-side sensitive behavior is included in the whitelist, 5 points will be deducted from the total score of the client-side sensitive behavior authentication item.

[0088] It should also be noted that if even one client-side sensitive behavior falls under the zero-trust blacklist, the score for the client-side sensitive behavior authentication item can be set to 0. If five client-side sensitive behaviors fall under the whitelist, 25 points can be deducted from the total score for the client-side sensitive behavior authentication item, resulting in a score of 75 points.

[0089] As one implementation of this application, if the second authentication item is a client peripheral device awareness authentication item, the process of scoring the second authentication item based on the authentication information of the second authentication item can specifically be as follows: determine at least one external device behavior indicated in the authentication information of the client peripheral device awareness authentication item; for each external device behavior, determine whether the external device indicated in the external device behavior belongs to the whitelist of external devices; if it does not belong, determine the scoring weight corresponding to the external device behavior; if it belongs, remove the external device behavior; and determine the score of the client peripheral device awareness authentication item based on the scoring weight of each external device behavior.

[0090] It should be noted that the external device behavior refers to the behavior of an external device connecting to the client. The external device can be a USB, a camera, etc., which are not limited in this embodiment of the application.

[0091] In practical applications, the zero-trust architecture enables a peripheral whitelist, which includes multiple pre-configured external devices. The scoring weight for external devices not on the whitelist connecting to the client is set to 5%. This means that when an external device not on the whitelist connects to the client, 5 points are deducted from the client's total peripheral awareness authentication score. For example, if the client's peripheral awareness authentication information identifies 5 external devices whose behavior indicators are not on the whitelist, then 25 points can be deducted from the client's total peripheral awareness authentication score (out of 100), resulting in a score of 75.

[0092] It's worth noting that during client authentication, the Zero Trust controller collects authentication information for CPU and network card authentication, system security policy authentication, patch installation authentication, and virus scanning authentication. This information is then used in client authentication to effectively prevent potentially vulnerable clients from accessing protected resources within Zero Trust. Furthermore, the Zero Trust controller also collects authentication information for sensitive client behavior and external device authentication during client authentication. This information is then used to promptly block compromised clients from accessing Zero Trust, thereby protecting its security.

[0093] S103: Determine whether the client's authentication score is greater than or equal to the preset weighted average score; if the authentication score is greater than or equal to the preset weighted average score, proceed to step S104.

[0094] During the specific execution of step S103, a corresponding preset weighted average score can be set in advance. After determining the client's initial authentication score, it can be further determined whether the client's authentication score is greater than or equal to the preset weighted average score. If the authentication score is greater than or equal to the preset weighted average score, the client's initial authentication is confirmed to be successful, and step S104 is executed. If the authentication score is not greater than or equal to the preset weighted average score, the client's initial authentication is confirmed to be unsuccessful, and the client is not granted access to the zero-trust system. This prevents clients with security vulnerabilities from accessing the zero-trust system and ensures the security of the zero-trust system.

[0095] It should be noted that the preset weighted average score can be 80 points, 85 points, etc., and can be set according to the actual application. This application embodiment does not limit it.

[0096] S104: Verify the authentication information of the first authentication item in each target authentication item; if the authentication information of the first authentication item in each target authentication item passes the verification, proceed to step S105.

[0097] In this embodiment, when the zero-trust controller determines that the client's initial authentication has passed, it determines the first authentication item from the various target authentication items. The first authentication item is a username and password authentication item, and the authentication information of the first authentication item includes the corresponding username and password. The target password is obtained based on the username in the authentication information of the first authentication item, and the target password is compared with the password in the authentication information of the first authentication item. If they match, it is determined that the authentication information of the first authentication item has passed the verification, and step S105 can be executed. If they do not match, it is determined that the authentication information of the first authentication item has failed the verification. At this time, it can be determined that the client's initial authentication has failed, and the client is not granted access to the zero-trust access, thus preventing clients with security risks from accessing protected resources.

[0098] It should be noted that the target password is the password pre-agreed between the client corresponding to the username and Zero Trust, and can be configured according to the actual application. This embodiment of the application does not limit it.

[0099] Furthermore, in this embodiment of the application, the CPU and network card authentication items in the pre-set authentication items can be set as third authentication, so that when the authentication information of the first authentication item is verified as passed, the authentication information of the third authentication item is recorded, and the timestamp in the currently received identity authentication information is recorded and saved as T_Perv.

[0100] S105: Grant the client access to the zero-trust access and update the identity authentication information.

[0101] In the specific execution step S105, if the client's initial authentication is successful, the client can be granted access to Zero Trust, so that the client can access Zero Trust based on the access permission. At the same time, the currently received authentication information (initial authentication information) is blocked, so that the client can continue to send updated authentication information to the Zero Trust controller during the login to Zero Trust, thereby realizing continuous authentication of clients accessing Zero Trust and ensuring the security of Zero Trust during the access period.

[0102] As a preferred embodiment of this application, when the identity authentication information is the initial identity authentication information, the process of updating the identity authentication information can specifically be as follows: generating a client-specific token and an access timestamp, and randomly executing multiple authentication items from a pre-set set of authentication items; updating multiple target authentication items in the identity authentication information using the randomly specified multiple authentication items, and updating the token in the identity authentication information using the exclusive token, and then sending the access timestamp and the updated identity authentication information to the client, so that the client sends the updated identity authentication information to the zero-trust controller during the zero-trust login period based on the access timestamp.

[0103] In some embodiments, if the authentication information currently sent by the client is the initial authentication information, and the client's authentication is successful using this authentication information, in order to prevent replay attacks and man-in-the-middle attacks during subsequent continuous authentication processes, the client's exclusive token and access timestamp can be regenerated. At the same time, multiple authentication items can be randomly specified from a set of pre-defined authentication items as target authentication items for the client's next authentication. Finally, the multiple target authentication items in the authentication information are updated using the randomly specified multiple authentication items, and the token and timestamp in the authentication information are updated using the exclusive token and access timestamp.

[0104] Furthermore, in this embodiment of the application, the time interval T_Intv for the client to send the updated identity authentication information next time can also be specified, so that the client sends the updated identity authentication information to the zero trust controller when the time interval T_Intv is equal to the time interval of the current identity authentication.

[0105] It should be noted that this application implements a challenge-response mechanism by randomly specifying the authentication information (exclusive token, access timestamp, and multiple randomly specified authentication items) and time interval T_Intv required for the client's next authentication, thereby protecting the client from replay attacks and man-in-the-middle attacks during the authentication process.

[0106] S106: Based on the identity authentication information, determine whether the client meets the identity authentication conditions; if the client meets the identity authentication conditions, proceed to step S107.

[0107] During the specific execution of step S104, if it is determined that the identity authentication information is not the initial identity authentication information, multiple authentication items randomly specified when the client's identity authentication was successfully passed last time can be obtained. Based on the multiple authentication items randomly specified when the client's identity authentication was successfully passed last time, each target authentication item, the timestamp in the identity authentication information, and the Token in the identity authentication information, it is determined whether the client meets the identity authentication conditions. If the client meets the identity authentication conditions, step S105 is executed. If the client does not meet the identity authentication conditions, it is determined that the client's identity authentication has failed, and the client's access permission to Zero Trust is not retained, so as to prevent clients with security risks from accessing Zero Trust and ensure the security of Zero Trust.

[0108] Optionally, if the identity authentication information is not the initial identity authentication information, the process of determining whether the client meets the identity authentication conditions based on the identity authentication information may specifically be as follows: If the identity authentication information is not the initial identity authentication information, obtain multiple authentication items randomly specified when the client's identity authentication was passed last time; if the multiple authentication items randomly specified when the client's identity authentication was passed last time are the same as each target authentication item in the identity authentication information, verify the timestamp Token in the identity authentication information; if the timestamp and Token in the identity authentication information pass the verification, determine that the client meets the identity authentication conditions; if any target authentication item is different from at least one authentication item randomly specified when the client's identity authentication was passed last time, and / or, the timestamp verification in the identity authentication information fails, and / or, the Token verification in the identity authentication information fails, determine that the client does not meet the identity authentication conditions.

[0109] It should be noted that the multiple authentication items randomly assigned when the client's identity was successfully authenticated last time are the same multiple authentication items randomly assigned when the client's identity was successfully authenticated most recently.

[0110] Optionally, the process of verifying the timestamp and token in the identity authentication information can be as follows: obtain the timestamp of the last successful identity authentication of the client; verify the timestamp in the identity authentication information based on the timestamp of the last successful identity authentication of the client; and verify the token in the identity authentication information using the exclusive token generated when the client's first successful identity authentication.

[0111] In some embodiments, corresponding authentication conditions can be preset. These authentication conditions indicate that, when the currently received authentication information is not the initial authentication information, each target authentication item in the currently received authentication information is consistent with each authentication item randomly specified when the client's authentication was successful last time; the Token in the currently received authentication information is consistent with the exclusive Token generated when the client's initial authentication was successful; and the timestamp in the currently received authentication information satisfies the inequality T_Prev + T_Intv <= T <= T_Prev + 1.2 * T_Intv, where T_Prev is the timestamp used when the client's authentication was successful last time, T is the timestamp in the authentication information, and T_Intv is the time interval generated when the client's authentication was successful last time.

[0112] It should be noted that if the target authentication items in the currently received authentication information are inconsistent with the randomly specified authentication items during the previous successful client authentication, and / or if the token in the currently received authentication information is inconsistent with the token generated during the previous successful client authentication, it can be considered that the currently received authentication information is incomplete or contains more than the required information, and the client's current authentication can be considered to have failed. For example, if the Zero Trust controller randomly specified AUTH_2, AUTH_5, and AUTH_6 during the previous successful client authentication, but the target authentication items in the authentication information currently sent by the client only include AUTH_2 and AUTH_5, or include AUTH_1, AUTH_2, and AUTH_6, then the authentication information received this time does not match the authentication information required by the Zero Trust controller, and therefore the client's current authentication can be considered to have failed.

[0113] It should also be noted that if the timestamp in the currently received authentication information does not satisfy the inequality T_Prev+T_Intv<=T<=T_Prev+1.2*T_Intv with the timestamp used when the client's authentication was successful, the client's authentication can also be considered to have failed.

[0114] S107: Determine the client's authentication score based on the authentication information of each target authentication item.

[0115] In the specific execution of step S107, if it is determined that the client meets the authentication conditions, it can first be determined whether there is a third authentication item among the target authentication items in the currently received authentication information. If not, each target authentication item can be considered a second authentication item, and then each target authentication item can be scored based on its authentication information. The scores of each target authentication item are averaged and weighted to obtain the client's authentication score. If it exists, the authentication information of the third authentication item can be verified first. If the authentication information of the third authentication item passes the verification, the client's authentication score can be determined based on the authentication information of each second authentication item in each target authentication item. The process of determining the client's authentication score based on the authentication information of each second authentication item in each target authentication item can be referred to the corresponding process in step S102, which is not limited in this embodiment.

[0116] It should be noted that if there is no third authentication item among the target authentication items, each target authentication item can be considered as a second authentication item. Therefore, each target authentication item is scored based on its authentication information. The client's identity authentication score is obtained by averaging and weighting the scores of each target authentication item, which is equivalent to scoring each second authentication item based on its authentication information. The client's identity authentication score is obtained by averaging and weighting the scores of each second authentication item. Correspondingly, the process of scoring each second authentication item based on its authentication information and averaging and weighting the scores of each second authentication item to obtain the client's identity authentication score can be the same as the process in step S102, which is not limited in this embodiment.

[0117] Optionally, the process of verifying the authentication information of the third authentication item can be as follows: determine whether the authentication information of the third authentication item in each target authentication item is the same as the authentication information of the third authentication item in the initial identity authentication information; if the authentication information of the third authentication item in each target authentication item is the same as the authentication information of the third authentication item in the initial identity authentication information, determine that the authentication information of the third authentication item has passed the verification; if the authentication information of the third authentication item in each target authentication item is different from the authentication information of the third authentication item in the initial identity authentication information, determine that the authentication information of the third authentication item has failed the verification.

[0118] It should be noted that the third certification item is for CPU, hardware, and network card certification.

[0119] S108: Determine whether the client's authentication score is greater than or equal to the preset weighted average score; if the authentication score is greater than or equal to the preset weighted average score, proceed to step S109.

[0120] During the specific execution of step S108, a corresponding preset weighted average score can be set in advance. After determining the client's authentication score for this authentication, it can be further determined whether the client's authentication score is greater than or equal to the preset weighted average score. If the authentication score is greater than or equal to the preset weighted average score, step S109 is executed. If the authentication score is not greater than or equal to the preset weighted average score, it is determined that the client's authentication for this time has failed, and the client's access permission to Zero Trust is not retained, thus preventing clients with security risks from accessing Zero Trust and ensuring the security of Zero Trust.

[0121] It should be noted that the preset weighted average score can be 80 points, 85 points, etc., and can be set according to the actual application. This application embodiment does not limit it.

[0122] S109: Retain client access to zero-trust settings and update authentication information.

[0123] In the specific execution of step S109, if the client's authentication score is greater than or equal to the preset weighted average score, it can be determined that the client's authentication has passed this time. Thus, the client's access permission to Zero Trust can be retained, that is, the client is allowed to continue to access Zero Trust. At the same time, the client's authentication information is updated so that the client continues to send updated authentication information to the Zero Trust controller during the Zero Trust login period. This achieves continuous authentication of clients accessing Zero Trust and ensures the security of Zero Trust during the access period.

[0124] As a preferred embodiment of this application, when the identity authentication information is not the initial identity authentication information, the process of updating the identity authentication information can specifically be as follows: randomly executing multiple authentication items from a pre-set set of authentication items; updating multiple target authentication items in the identity authentication information using the randomly specified multiple authentication items; and then sending the access timestamp and the updated identity authentication information to the client, so that the client can send the updated identity authentication information to the zero trust controller during the zero trust login period based on the access timestamp.

[0125] In some embodiments, if the authentication information currently sent by the client is not the initial authentication information, and the client's authentication is successful using the authentication information, in order to ensure that replay attacks and man-in-the-middle attacks are avoided in the subsequent continuous authentication process, multiple authentication items can be randomly selected from the pre-set authentication items as the target authentication items for the client's next authentication while retaining the token and timestamp, so as to update the multiple target authentication items in the authentication information using the randomly selected multiple authentication items.

[0126] Furthermore, in this embodiment of the application, the time interval T_Intv for the client to send the updated identity authentication information next time can also be specified, so that the client sends the updated identity authentication information to the zero trust controller when the time interval T_Intv is equal to the time interval of the current identity authentication.

[0127] It should be noted that this application implements a challenge-response mechanism by randomly specifying the authentication information (and multiple randomly specified authentication items) required for the client's next authentication and the time interval T_Intv, thereby protecting the client from replay attacks and man-in-the-middle attacks during the authentication process.

[0128] S110: Send the updated authentication information to the client, so that the client can send the updated authentication information to the Zero Trust controller during the Zero Trust login process.

[0129] During the specific execution of step S110, after updating the currently received identity authentication information, the updated identity authentication information and time interval T_Intv can be sent to the client. This allows the client to send the updated identity authentication information to the Zero Trust controller when the time remaining until the current identity authentication is equal to the time interval T_Intv. This enables continuous authentication of clients accessing Zero Trust and ensures the security of Zero Trust during the access period.

[0130] This application provides an identity authentication method that receives identity authentication information sent by a client during a zero-trust login process. The identity authentication information includes a timestamp, a token, and authentication information for multiple target authentication items. If the identity authentication information is initial authentication information, the client's identity authentication score is determined based on the authentication information of each second authentication item. Each second authentication item is any one of the target authentication items other than the first and third authentication items. If the identity authentication score is greater than or equal to a preset weighted average score, the authentication information of the first authentication item among the target authentication items is verified. If the verification of the authentication information of the first authentication item among the target authentication items passes, the client is granted access to zero-trust, and the identity authentication information is updated. If the identity authentication information is not initial authentication information, the client's identity authentication condition is determined based on the identity authentication information. If the client meets the identity authentication condition, the client's identity authentication score is determined based on the authentication information of each target authentication item. If the identity authentication score is greater than or equal to a preset weighted average score, the client's access to zero-trust is retained, and the identity authentication information is updated. The updated identity authentication information is sent to the client, enabling the client to send the updated identity authentication information to the zero-trust controller during the zero-trust login process. Therefore, the technical solution provided in this application can receive authentication information sent by the client during the client's access to Zero Trust, use the received authentication information to authenticate the client, and grant or retain the client's access permission to Zero Trust if the client's authentication is successful. At the same time, the authentication information is updated so that the client sends the updated authentication information to the Zero Trust controller during the Zero Trust login period, thereby achieving continuous authentication of clients accessing Zero Trust and ensuring the security of Zero Trust during the access period.

[0131] To better understand the identity authentication method provided in the embodiments of this application, the following explanation uses examples, such as... Figure 2 As shown.

[0132] A1: The Zero Trust Controller receives authentication information sent by the client. This authentication information includes a timestamp, a token, and authentication information for multiple target authentication items.

[0133] A2: The Zero Trust controller determines whether the authentication information is the first authentication information sent by the client during the Zero Trust login process; if yes, execute A3; otherwise, execute A9.

[0134] A3: The zero-trust controller uses the authentication information of each secondary authentication item in each target authentication item to score each secondary authentication item, and uses the scores of each secondary authentication item to calculate a weighted average score to obtain the client's identity authentication score.

[0135] A4: The Zero Trust controller determines whether the client's authentication score is greater than or equal to the preset weighted average score; if it is, execute A5; if it is not, determine that the client's authentication has failed and do not retain the client's access permission to Zero Trust.

[0136] A5: The Zero Trust controller verifies the username and password in the authentication information of the first authentication item among the target authentication items; if the verification passes, proceed to A6; if the verification fails, it is determined that the client's identity authentication has failed, and the client's access rights to Zero Trust are not retained.

[0137] A6: Zero Trust Control confirms that the client's initial authentication is successful, grants the client access permissions, and generates the client's unique token and access timestamp.

[0138] A7: The Zero Trust Controller randomly selects multiple authentication items from the pre-set authentication items and updates the Token, timestamp, and target authentication items in the identity authentication information using the exclusive Token, access timestamp, and the randomly selected authentication items. It can also randomly specify a time interval T_Intv as the time interval between the client's next identity authentication and the current identity authentication.

[0139] A8: The zero-trust controller sends the time interval T_Intv and the updated authentication information to the client.

[0140] A9: The Zero Trust controller determines whether each target authentication item in the currently received authentication information is consistent with the multiple authentication items randomly specified when the client's authentication was successful last time; if they are consistent, execute A10; if they are inconsistent, determine that the client's authentication has failed and do not retain the client's access rights to Zero Trust.

[0141] A10: Zero Trust control determines whether the timestamp T in the currently received authentication information satisfies the inequality T_Prev + T_Intv <= T <= T_Prev + 1.2 * T_Intv. If satisfied, execute A11; otherwise, determine that the client's authentication has failed and do not retain the client's access rights to Zero Trust. Here, T_Prev is the timestamp used when the client's authentication was successful last time, T is the timestamp in the authentication information, and T_Intv is the time interval generated when the client's authentication was successful last time.

[0142] A11: Zero Trust control determines whether the Token in the currently received authentication information is consistent with the exclusive Token generated when the Zero Trust controller determines that the client's initial authentication is successful; if they are consistent, execute A12; if they are inconsistent, determine that the client's authentication has failed and do not retain the client's access permission to Zero Trust.

[0143] A12: The Zero Trust controller determines whether the authentication information of the third authentication item in each target authentication item matches the authentication information of the third authentication item in the client's initial identity authentication information. If they match, execute A13; otherwise, determine that the client's identity authentication has failed and do not retain the client's access rights to Zero Trust. Each target authentication item includes a third authentication item.

[0144] A13: The zero-trust controller uses the authentication information of each secondary authentication item in each target authentication item to score each secondary authentication item, and uses the scores of each secondary authentication item to calculate a weighted average score to obtain the client's identity authentication score.

[0145] A14: The Zero Trust controller determines whether the client's authentication score is greater than or equal to the preset weighted average score; if it is greater than or equal to, proceed to A15; if it is not greater than or equal to, the client's authentication is deemed to have failed, and the client's access permission to Zero Trust is not retained.

[0146] A15: Zero Trust Control ensures that the client's identity authentication is successful, and retains the client's access permissions.

[0147] A16: The Zero Trust Controller randomly assigns multiple authentication items from a set of pre-configured authentication items and updates each target authentication item in the identity authentication information. It can also randomly assign a time interval T_Intv as the time interval between the client's next authentication and the current authentication.

[0148] A17: The zero-trust controller sends the time interval T_Intv and the updated authentication information to the client.

[0149] Based on the identity authentication method provided in the above embodiments of this application, correspondingly, the embodiments of this application also provide an identity authentication system, such as... Figure 3 As shown, the identity authentication system, applied to a zero-trust controller, includes:

[0150] The receiving unit 31 is used to receive the identity authentication information sent by the client during the zero-trust login period; wherein, the identity authentication information includes a timestamp, a token, and authentication information for multiple target authentication items;

[0151] The first identity authentication score determination unit 32 is used to determine the client's identity authentication score based on the authentication information of each second authentication item if the identity authentication information is the initial identity authentication information; the second authentication item is any one of the target authentication items other than the first authentication item and the third authentication item.

[0152] The first verification unit 33 is used to verify the authentication information of the first authentication item in each target authentication item if the identity authentication score is greater than or equal to the preset weighted average score.

[0153] The granting unit 34 is used to grant the client access to zero-trust if the authentication information of the first authentication item in each target authentication item passes the verification, and to update the identity authentication information.

[0154] The first judgment unit 35 is used to determine whether the client meets the identity authentication conditions based on the identity authentication information if the identity authentication information is not the first identity authentication information.

[0155] The second identity authentication score determination unit 36 ​​is used to determine the client's identity authentication score based on the authentication information of each target authentication item if the client meets the identity authentication conditions.

[0156] Update unit 37 is used to update the identity authentication information if the identity authentication score is greater than or equal to the preset weighted average score, while retaining the client's access permission to access zero trust.

[0157] Sending unit 38 is used to send the updated identity authentication information to the client, so that the client sends the updated identity authentication information to the zero trust controller during the zero trust login process.

[0158] The specific principles and execution processes of each unit in the identity authentication system disclosed in the above embodiments of this application are the same as those of the identity authentication method disclosed in the above embodiments of this application. Please refer to the corresponding parts of the identity authentication method disclosed in the above embodiments of this application, and they will not be repeated here.

[0159] This application provides an identity authentication system that receives identity authentication information sent by a client during a zero-trust login process. The identity authentication information includes a timestamp, a token, and authentication information for multiple target authentication items. If the identity authentication information is initial authentication information, the client's identity authentication score is determined based on the authentication information of each second authentication item. Each second authentication item is any one of the target authentication items other than the first and third authentication items. If the identity authentication score is greater than or equal to a preset weighted average score, the authentication information of the first authentication item among the target authentication items is verified. If the verification of the first authentication item among the target authentication items passes, the client is granted access to zero-trust, and the identity authentication information is updated. If the identity authentication information is not initial authentication information, the system determines whether the client meets the identity authentication conditions based on the identity authentication information. If the client meets the identity authentication conditions, the client's identity authentication score is determined based on the authentication information of each target authentication item. If the identity authentication score is greater than or equal to a preset weighted average score, the client's access to zero-trust is retained, and the identity authentication information is updated. The updated identity authentication information is sent to the client, enabling the client to send the updated identity authentication information to the zero-trust controller during the zero-trust login process. Therefore, the technical solution provided in this application can receive authentication information sent by the client during the client's access to Zero Trust, use the received authentication information to authenticate the client, and grant or retain the client's access permission to Zero Trust if the client's authentication is successful. At the same time, the authentication information is updated so that the client sends the updated authentication information to the Zero Trust controller during the Zero Trust login period, thereby achieving continuous authentication of clients accessing Zero Trust and ensuring the security of Zero Trust during the access period.

[0160] Optionally, the second identity authentication score determination unit includes:

[0161] The second judgment unit is used to determine whether a third authentication item exists among the target authentication items if the client meets the identity authentication conditions.

[0162] The first scoring unit is used to score each target certification item based on its certification information if there is no third certification item among the target certification items.

[0163] The first calculation unit is used to perform an average weighted calculation on the scores of each target authentication item to obtain the client's identity authentication score.

[0164] Optionally, the identity authentication system provided in this application also includes:

[0165] The third judgment unit is used to determine whether the authentication information of the third authentication item in each target authentication item is the same as the authentication information of the third authentication item in the initial identity authentication information if there is a third authentication item in each target authentication item.

[0166] The execution unit is used to determine the client's identity authentication score based on the authentication information of each second authentication item if the authentication information of the third authentication item in each target authentication item is the same as the authentication information of the third authentication item in the initial identity authentication information.

[0167] Optionally, the first identity authentication score determination unit includes:

[0168] The second scoring unit is used to score each second certification item based on the certification information of each second certification item;

[0169] The second calculation unit is used to perform an average weighted calculation on the scores of each second authentication item to obtain the client's identity authentication score.

[0170] Optionally, if the authentication information is the initial authentication information, the update unit includes:

[0171] The first randomized unit is used to generate a client-specific token and access timestamp, and to randomly specify multiple authentication items from a set of pre-defined authentication items.

[0172] The first update subunit is used to update multiple target authentication items in the identity authentication information using multiple randomly specified authentication items, and to update the token and timestamp in the identity authentication information using a unique token and an access timestamp.

[0173] Optionally, if the authentication information is not the initial authentication information, the update unit includes:

[0174] The second random assignment unit is used to randomly assign multiple authentication items from a set of pre-defined authentication items;

[0175] The second update subunit is used to update multiple target authentication items in the identity authentication information using multiple randomly specified authentication items.

[0176] Optionally, the first judgment unit includes:

[0177] The acquisition unit is used to acquire multiple randomly specified authentication items when the client's identity authentication was successfully passed in the previous instance if the identity authentication information is not the initial identity authentication information.

[0178] The second verification unit is used to verify the timestamp and the token if multiple authentication items randomly specified when the client's identity authentication was passed in the last time are the same as the target authentication items in the identity authentication information.

[0179] The first determining unit is used to determine that the client meets the identity authentication conditions if the timestamp and token verification pass.

[0180] The second determining unit is used to determine that the client does not meet the identity authentication conditions if any target authentication item is different from at least one authentication item randomly specified when the client's identity authentication was successful last time, and / or, the timestamp verification fails, and / or, the token verification fails.

[0181] This application provides an electronic device, such as... Figure 4 As shown, the electronic device includes a processor 401 and a memory 402. The memory 402 is used to store program code and data for identity authentication, and the processor 401 is used to call the program instructions in the memory to execute the steps of the identity authentication method shown in the above embodiment.

[0182] This application provides a storage medium including a stored program, wherein, when the program runs, it controls the device where the storage medium is located to execute the physical location management method of the device shown in the above embodiments.

[0183] For the foregoing method embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0184] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0185] The steps in the methods of the various embodiments of this application can be adjusted, combined, or deleted according to actual needs.

[0186] The modules and sub-modules in the devices and terminals in the various embodiments of this application can be merged, divided, and deleted according to actual needs.

[0187] It should be understood that the disclosed terminals, devices, and methods can be implemented in other ways, given the several embodiments provided in this application. For example, the terminal embodiments described above are merely illustrative. For instance, the division of modules or sub-modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple sub-modules or modules may be combined or integrated into another module, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0188] The modules or submodules described as separate components may or may not be physically separate. The components that constitute a module or submodule may or may not be physical modules or submodules; that is, they may be located in one place or distributed across multiple network modules or submodules. Some or all of the modules or submodules can be selected to achieve the purpose of this embodiment's solution, depending on actual needs.

[0189] Furthermore, the functional modules or sub-modules in the various embodiments of this application can be integrated into one processing module, or each module or sub-module can exist physically separately, or two or more modules or sub-modules can be integrated into one module. The integrated modules or sub-modules described above can be implemented in hardware or in the form of software functional modules or sub-modules.

[0190] Finally, it should be noted that in this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0191] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0192] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An identity authentication method, characterized in that, Applied to a zero-trust controller, the method includes: The system receives authentication information sent by the client during the zero-trust login process. This authentication information includes a timestamp, a token, and authentication information for multiple target authentication items. The multiple target authentication items include a first authentication item, multiple second authentication items, and multiple third authentication items. The first authentication item is a username and password authentication item. The multiple second authentication items include system security policy authentication items, patch installation authentication items, virus scanning authentication items, client sensitive behavior authentication items, and client peripheral device awareness authentication items. The multiple third authentication items include CPU, hardware, and network card authentication items. If the identity authentication information is initial identity authentication information, the client's identity authentication score is determined based on the authentication information of each second authentication item; the second authentication item is any one of the target authentication items other than the first authentication item and the third authentication item. If the identity authentication score is greater than or equal to the preset weighted average score, the authentication information of the first authentication item in each of the target authentication items is verified; If the authentication information of the first authentication item in each target authentication item passes the verification, the client is granted access to the zero-trust access and the identity authentication information is updated. If the identity authentication information is not the initial identity authentication information, determine whether the client meets the identity authentication conditions based on the identity authentication information; If the client meets the authentication conditions, the client's authentication score is determined based on the authentication information of each of the target authentication items; If the identity authentication score is greater than or equal to the preset weighted average score, the client's access permission to the zero-trust system is retained, and the identity authentication information is updated. The updated identity authentication information is sent to the client, so that the client sends the updated identity authentication information to the zero trust controller during the zero trust login process.

2. The method according to claim 1, characterized in that, If the client meets the authentication conditions, the client's authentication score is determined based on the authentication information of each of the target authentication items, including: If the client meets the authentication conditions, determine whether there is a third authentication item among the target authentication items; If the third authentication item is not present in any of the target authentication items, each target authentication item is scored based on its authentication information. The client's authentication score is obtained by averaging and weighting the scores of each of the target authentication items.

3. The method according to claim 2, characterized in that, The method further includes: If the third authentication item exists in each of the target authentication items, determine whether the authentication information of the third authentication item in each of the target authentication items is the same as the authentication information of the third authentication item in the initial identity authentication information; If the authentication information of the third authentication item in each of the target authentication items is the same as the authentication information of the third authentication item in the initial identity authentication information, the client's identity authentication score is determined based on the authentication information of each of the second authentication items.

4. The method according to claim 1 or 3, characterized in that, Based on the authentication information of each second authentication item, the client's identity authentication score is determined, including: Each second certification item is scored based on the certification information of each second certification item; The client's identity authentication score is obtained by averaging and weighting the scores of each of the second authentication items.

5. The method according to claim 1, characterized in that, If the identity authentication information is initial authentication information, updating the identity authentication information includes: Generate a unique token and access timestamp for the client, and randomly specify multiple authentication items from a pre-set set of authentication items; The identity authentication information is updated by using multiple randomly specified authentication items to update multiple target authentication items, and the identity authentication information is updated by using the exclusive token and the access timestamp.

6. The method according to claim 1, characterized in that, If the identity authentication information is not the initial identity authentication information, updating the identity authentication information includes: Randomly select multiple authentication items from the pre-set authentication items; Multiple target authentication items in the identity authentication information are updated using multiple randomly specified authentication items.

7. The method according to claim 1, characterized in that, If the identity authentication information is not initial identity authentication information, determining whether the client meets the identity authentication conditions based on the identity authentication information includes: If the identity authentication information is not the initial identity authentication information, obtain multiple authentication items randomly specified when the client's identity authentication was successfully passed in the last time; If the multiple authentication items randomly specified when the client's identity authentication was successful last time are the same as the target authentication items in the identity authentication information, then the timestamp and the token are verified. If the timestamp and the token pass the verification, it is determined that the client meets the identity authentication conditions; If any of the target authentication items is different from at least one authentication item randomly specified when the client's identity authentication was successful last time, and / or the timestamp verification fails, and / or the token verification fails, it is determined that the client does not meet the identity authentication conditions.

8. An identity authentication system, characterized in that, The system, applied to a zero-trust controller, includes: The receiving unit is configured to receive authentication information sent by the client during the zero-trust login process; wherein the authentication information includes a timestamp, a token, and authentication information for multiple target authentication items; the multiple target authentication items include a first authentication item, multiple second authentication items, and multiple third authentication items; the first authentication item is a username and password authentication item; the multiple second authentication items include system security policy authentication items, patch installation authentication items, virus scanning authentication items, client sensitive behavior authentication items, and client peripheral device awareness authentication items; the multiple third authentication items include CPU, hardware, and network card authentication items; The first identity authentication score determination unit is used to determine the client's identity authentication score based on the authentication information of each second authentication item if the identity authentication information is initial identity authentication information; wherein the second authentication item is any one of the target authentication items other than the first authentication item and the third authentication item. The first verification unit is used to verify the authentication information of the first authentication item in each of the target authentication items if the identity authentication score is greater than or equal to the preset weighted average score. The granting unit is used to grant the client access to the zero-trust system and update the identity authentication information if the authentication information of the first authentication item among the target authentication items passes the verification. The first judgment unit is used to determine whether the client meets the identity authentication conditions based on the identity authentication information if the identity authentication information is not the first identity authentication information. The second identity authentication score determination unit is used to determine the identity authentication score of the client based on the authentication information of each of the target authentication items if the client meets the identity authentication conditions. An update unit is used to update the identity authentication information if the identity authentication score is greater than or equal to a preset weighted average score, retain the client's access permission to the zero-trust system. The sending unit is used to send the updated identity authentication information to the client, so that the client sends the updated identity authentication information to the zero trust controller during the zero trust login process.

9. An electronic device, characterized in that, include: A processor and a memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; The memory is used to store a program for implementing the authentication method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for performing the authentication method as described in any one of claims 1-7.

Images