Network resource access method and device

Abstract

The invention discloses a network resource access method and device. The method comprises the following steps: acquiring current position information of terminal equipment which sends an access request and historical access information of the terminal equipment; when a risk value of the access request is determined to be lower than a risk threshold value based on the current position information and the historical access information, acquiring a network resource use risk value of an initiating object of the access request; when the network resource use risk value is lower than a network resource use risk threshold value, acquiring biological characteristic information of the initiating object; performing identity recognition on the initiating object by using the biological characteristic information to obtain an identity recognition result; and under the condition that the identity recognition result shows that the identification of the initiating object is passed, generating a resource access permission of the initiating object, so that the initiating object accesses a target resource corresponding to the resource access permission according to the resource access permission. The technical problems that an existing information management mode is single, information leakage is easily caused, and potential safety hazards exist are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of information security processing, and in particular to a method and device for accessing network resources. Background Art

[0002] In existing software development projects, companies store internal data in computer-readable storage media. When internal developers need to access data, they usually enter a special password and complete identity verification to access it. If someone other than the company's staff sneaks in to access the data and forcibly cracks the password, the company's internal data will be easily stolen during the software development process, causing information leakage of the project and causing property losses to the company. In addition, outsiders can also steal data by cracking the wireless network and using viruses, resulting in the security of the company's internal information not being guaranteed.

[0003] For example, all smart devices will perform networking operations during use. Many companies generally use QR code scanning to connect to the Internet. However, this method has potential security risks because QR code scanning is an indiscriminate operation. Any user can obtain wifi information by scanning, and then enter the password and complete identity authentication to finally complete the connection.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiment of the present invention provides a method and device for accessing network resources, so as to at least solve the technical problem that the existing information management method is single, easily leads to information leakage, and has potential security risks.

[0006] According to one aspect of an embodiment of the present invention, a method for accessing network resources is provided, comprising: upon receiving an access request, obtaining current location information of a terminal device that sends the access request and historical access information of the terminal device; upon determining that the risk value of the access request is lower than a risk threshold based on the current location information and the historical access information, obtaining a network resource usage risk value of an initiating object of the access request; upon obtaining the network resource usage risk value lower than the network resource usage risk threshold, obtaining biometric information of the initiating object; performing identity identification on the initiating object using the biometric information to obtain an identity identification result; and when the identity identification result indicates that the initiating object has been identified successfully, generating a resource access permission for the initiating object so that the initiating object can access a target resource corresponding to the resource access permission in accordance with the resource access permission.

[0007] Optionally, obtaining the current location information of the terminal device that sends the access request and the historical access information of the terminal device includes: parsing the access request to obtain the Internet Protocol address and the media access control address of the terminal device; locating the terminal device according to the Internet Protocol address to obtain the current location information of the terminal device; and obtaining the historical access information of the terminal device according to the media access control address.

[0008] Optionally, the historical access information includes at least: a historical access location and a historical access time, and determining that the risk value of the access request is lower than a risk threshold based on the current location information and the historical access information includes: determining a secure access range of the terminal device according to the historical access location and the historical access time; obtaining an initiation time of the access request; obtaining a correspondence between the initiation time and the current location information; and when determining that the terminal device is within the secure access range according to the correspondence, determining that the risk value of the access request is lower than the risk threshold.

[0009] Optionally, obtaining the network resource usage risk value of the initiator object of the access request includes: when it is determined that the initiator object is a new user, obtaining the identity identifier of the new user; authenticating the identity identifier to obtain an authentication result; when the authentication result indicates that the new user is authenticated, obtaining the Internet Protocol address of the login device of the new user; when it is determined based on the Internet Protocol address that the location of the login device is consistent with that of the new user, obtaining the network resource usage risk value of the initiator object of the access request.

[0010] Optionally, obtaining the network resource usage risk value of the initiating object of the access request includes: generating question and answer information for evaluating the network resource usage risk value of the initiating object; obtaining the information access category of the initiating object based on the question and answer result of the question and answer information; generating evaluation information for evaluating the initiating object based on the information access category; obtaining the evaluation result of the evaluation information by the initiating object; and obtaining the network resource usage risk value of the initiating object of the access request based on the evaluation result.

[0011] Optionally, obtaining the biometric information of the initiating object includes: generating an access agreement when the network resource usage risk value is not lower than a network resource usage risk threshold; and obtaining the biometric information of the initiating object when receiving feedback information from the initiating object on the access agreement indicating agreement to sign.

[0012] Optionally, after using the biometric information to identify the initiating object and obtaining an identification result, the network resource access method also includes: when the initiating object is determined to be a high-risk object based on the identification result, generating an alarm message, wherein the high-risk object is an object whose matching degree with the information stored in the abnormal object database is higher than a matching degree threshold; and sending the alarm message.

[0013] Optionally, the biometric information is used to identify the initiating object to obtain an identity identification result, including: sending the biometric information to an identity identification model to process the biometric information using the identity identification model to obtain the identity identification result, wherein the identity identification model is obtained through machine learning training using multiple sets of training data, and each of the multiple sets of training data includes: sample biometric information and a sample identity identification result corresponding to the sample biometric information.

[0014] According to another aspect of an embodiment of the present invention, a network resource access device is also provided, including: a first acquisition unit, used to acquire the current location information of the terminal device that sends the access request and the historical access information of the terminal device when receiving an access request; a second acquisition unit, used to acquire the network resource usage risk value of the initiating object of the access request when it is determined that the risk value of the access request is lower than the risk threshold based on the current location information and the historical access information; a third acquisition unit, used to acquire the biometric information of the initiating object when the network resource usage risk value is lower than the network resource usage risk threshold; an identification unit, used to perform identity identification on the initiating object using the biometric information to obtain an identity identification result; and a processing unit, used to generate a resource access permission for the initiating object when the identity identification result indicates that the initiating object has been identified successfully, so that the initiating object accesses the target resource corresponding to the resource access permission according to the resource access permission.

[0015] Optionally, the first acquisition unit includes: a parsing module, used to parse the access request to obtain the Internet Protocol address and media access control address of the terminal device; a positioning module, used to locate the terminal device according to the Internet Protocol address to obtain the current location information of the terminal device; a first acquisition module, used to obtain the historical access information of the terminal device according to the media access control address.

[0016] Optionally, the historical access information includes at least: a historical access location and a historical access time, and the second acquisition unit includes: a first determination module, used to determine the security access range of the terminal device based on the historical access location and the historical access time; a second acquisition module, used to obtain the initiation time of the access request; a third acquisition module, used to obtain the correspondence between the initiation time and the current location information; and a second determination module, used to determine that the risk value of the access request is lower than the risk threshold when it is determined that the terminal device is within the security access range based on the correspondence.

[0017] Optionally, the second acquisition unit includes: a fourth acquisition module, used to acquire the identity identifier of the new user when it is determined that the initiating object is a new user; an authentication module, used to authenticate the identity identifier to obtain an authentication result; a fifth acquisition module, used to acquire the Internet Protocol address of the login device of the new user when the authentication result indicates that the new user is authenticated; and a sixth acquisition module, used to acquire the network resource usage risk value of the initiating object of the access request when it is determined that the location of the login device is consistent with that of the new user based on the Internet Protocol address.

[0018] Optionally, the third acquisition module is used to include: a first generation module, used to generate question and answer information for evaluating the network resource usage risk value of the initiating object; a seventh acquisition module, used to obtain the information access category of the initiating object according to the question and answer results of the question and answer information; a second generation module, used to generate evaluation information for evaluating the initiating object based on the information access category; an eighth acquisition module, used to obtain the evaluation result of the initiating object on the evaluation information; and a ninth acquisition module, used to obtain the network resource usage risk value of the initiating object of the access request according to the evaluation result.

[0019] Optionally, the third acquisition unit includes: a third generation module, used to generate an access agreement when the network resource usage risk value is not lower than the network resource usage risk threshold; a tenth acquisition module, used to obtain the biometric information of the initiating object when receiving feedback information from the initiating object on the access agreement indicating that the initiating object agrees to sign.

[0020] Optionally, the network resource access device also includes: a generating unit, which is used to generate an alarm message when the initiating object is determined to be a high-risk object based on the identity identification result after using the biometric information to identify the initiating object and obtaining the identity identification result, wherein the high-risk object is an object whose matching degree with the information stored in the abnormal object database is higher than a matching degree threshold; and a sending unit, which is used to send the alarm message.

[0021] Optionally, the identification unit includes: a processing module, used to send the biometric information to an identity recognition model, so as to process the biometric information using the identity recognition model to obtain the identity recognition result, wherein the identity recognition model is obtained through machine learning training using multiple sets of training data, and each of the multiple sets of training data includes: sample biometric information and a sample identity recognition result corresponding to the sample biometric information.

[0022] According to another aspect of an embodiment of the present invention, a zero-trust-based network device identity authentication system is also provided. The zero-trust-based network device identity authentication system uses any one of the network resource access methods described above.

[0023] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein the program executes any one of the above-mentioned methods for accessing network resources.

[0024] According to another aspect of an embodiment of the present invention, a processor is provided, and the processor is used to run a program, wherein the program executes any one of the above-mentioned methods for accessing network resources when running.

[0025] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, and when the computer instructions are executed by a processor, any one of the above-mentioned methods for accessing network resources is executed.

[0026] In an embodiment of the present invention, when an access request is received, the current location information of the terminal device that sends the access request and the historical access information of the terminal device are obtained; when the risk value of the access request is determined to be lower than the risk threshold based on the current location information and the historical access information, the network resource usage risk value of the initiating object of the access request is obtained; when the network resource usage risk value is lower than the network resource usage risk threshold, the biometric information of the initiating object is obtained; the initiating object is identified using the biometric information to obtain an identification result; when the identification result indicates that the initiating object has been identified, the resource access rights of the initiating object are generated so that the initiating object can access the target resource corresponding to the resource access rights according to the resource access rights. Through the above technical solution provided by the present invention, it is realized to authenticate the terminal device that initiates the access request based on the current location information of the terminal device and the historical access information of the terminal device, and the biometric information of the object that initiates the access request, and determine its access rights to network resources according to the identification result, thereby achieving the purpose of improving the security of network resource access, and thus solving the technical problem that the existing information management method is single, easy to cause information leakage, and has security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0028] Figure 1 It is a hardware structure block diagram of a mobile terminal of a method for accessing network resources according to an embodiment of the present invention;

[0029] Figure 2 is an architecture diagram of a network device identity authentication system based on the zero trust principle according to an embodiment of the present invention;

[0030] Figure 3 is a flow chart of a method for accessing network resources according to an embodiment of the present invention;

[0031] Figure 4 is a schematic diagram of a login detection system according to an embodiment of the present invention;

[0032] Figure 5 is a schematic diagram of an examination and certification system according to an embodiment of the present invention;

[0033] Figure 6 is a schematic diagram of a face recognition system according to an embodiment of the present invention;

[0034] Figure 7 is a schematic diagram of a fingerprint recognition system according to an embodiment of the present invention;

[0035] Figure 8is a schematic diagram of a learning system according to an embodiment of the present invention;

[0036] Fig. 9 is a schematic diagram of a user analysis system according to an embodiment of the present invention;

[0037] Fig.10 is a schematic diagram of a central processing system according to an embodiment of the present invention;

[0038] Fig.11 is a schematic diagram of a verification code login system according to an embodiment of the present invention;

[0039] Fig.12 is a schematic diagram of a device for accessing network resources according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0041] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0042] As introduced in the background technology, the existing information management method is single, which is easy to cause information leakage and pose security risks. In view of the above defects, in the embodiments of the present invention, a method and device for accessing network resources, a network device identity authentication system based on zero trust, a computer-readable storage medium, a processor and a computer program product are provided.

[0043] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0044] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure diagram of a mobile terminal of a method for accessing network resources according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0045] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for accessing network resources in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof. The transmission device 106 is used to receive or send data via a network. The specific examples of the above networks may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0046] It should be noted that the network resource access method provided in the embodiment of the present invention uses a network device identity authentication system based on the zero trust principle. The system mainly includes a network device authentication platform, which integrates multiple key subsystems. Figure 2is an architecture diagram of a network device identity authentication system based on the zero trust principle according to an embodiment of the present invention. Figure 2 As shown, the network device authentication platform may include: verification code login system, login detection system, certification examination system, face recognition system, fingerprint recognition system, learning system, user analysis system and central processing system. First, the verification code login system is responsible for generating QR codes and authenticating the visitor's network. This system ensures that only authorized users can access network resources; second, the login detection system is responsible for finding and verifying the visitor's location and historical access records; if an incorrect device or location is found to attempt to access, the system will automatically block it, further enhancing the security of the network; in addition, the certification examination system ensures that the visitor has the corresponding knowledge and ability to safely use network resources by conducting examinations and needs surveys on the visitor. In order to further improve the accuracy of identity authentication, the system also integrates a face recognition system and a fingerprint recognition system. These two systems can more accurately identify the identity of the visitor through biometric technology; at the same time, the learning system allows visitors to learn risk judgment capabilities and understand the latest intrusion virus cases online, thereby improving their network security awareness. The user analysis system is responsible for recording the visitor's access history and the device information used, and making risk assessments based on the time, frequency and location of the access, providing strong support for the company's network security. Finally, the central processing system is not only responsible for storing important internal company information, but can also quickly transfer information in the event of a network intrusion, ensuring the security of the company's information.

[0047] From the above, it can be seen that in this authentication platform, the verification code is used for login, and a QR code is generated for network authentication; the login detection finds and verifies the access location and history, and blocks incorrect devices and locations; the certification examination system conducts examination tests and demand surveys on visitors; the face recognition and fingerprint recognition systems perform face and fingerprint verification respectively; the learning system connects to the network to learn risk judgments and the latest virus cases; the user analysis system records access records and devices for risk judgment; and the central processing system handles various functions.

[0048] The authentication platform significantly improves the security and efficiency of network access authentication by introducing a verification code login system. The verification code login system works by generating a unique QR code for network authentication. Visitors must scan this QR code to access network resources, which ensures that only authorized users can access internal company information. This design not only prevents illegal access to sensitive information by outsiders, but also effectively improves the access efficiency of visitors. The system also effectively prevents virus intrusion and protects the security of the company's internal network by improving the security of network device authentication. This protection not only ensures the integrity of the company's internal information, but also prevents data loss, thereby protecting the company's property to the greatest extent.

[0049] In order to solve the problem that external personnel can steal corporate data by cracking the wireless network and using viruses, resulting in the security of internal company information not being guaranteed, in addition to adopting a zero-trust network architecture and continuously verifying user identities, device status and behavior patterns to ensure that only legitimate users and devices can access internal company data, artificial intelligence and machine learning can also be used for security monitoring, introducing artificial intelligence and machine learning technologies to monitor and analyze system logs, user behaviors, etc. in real time. By establishing models to identify abnormal behaviors and potential security threats, automated security warnings and responses can be achieved.

[0050] According to an embodiment of the present invention, a method embodiment of a method for accessing network resources is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0051] Figure 3 is a flow chart of a method for accessing network resources according to an embodiment of the present invention. Figure 3 As shown, the method for accessing the network resource includes the following steps:

[0052] Step S302: upon receiving an access request, obtaining the current location information of the terminal device that sends the access request and the historical access information of the terminal device.

[0053] In this embodiment, when the network device authentication platform receives an access request to a network resource, it can obtain the current location information of the terminal device that sends the access request and the historical access information of the terminal device.

[0054] Figure 4 is a schematic diagram of a login detection system according to an embodiment of the present invention. Figure 4As shown, the login detection system includes a historical access comparison module → a new user risk assessment module → an abnormal login detection module → a blocking module. The historical access comparison module is used to compare the visitor's historical access records to check whether there are too large differences in time and location. The new user risk assessment module is used to assess the risk of first-time users. It is necessary to enter the name, ID number and work number to see if the information is correct. The abnormal login detection module needs to query the IP address of the visitor's login device to see if it is correct. The blocking module is used to block the device that has repeatedly attempted to log in and failed the detection in a short period of time, and put it into the blacklist. That is, the historical access comparison module compares the visitor's records to check the time and location differences. If it is not in the company or working hours, the access is stopped. The new user risk assessment module requires the input of the name, ID number and work number, and the information can only be accessed after it is correct. The abnormal login detection module queries the visitor's IP address. If it is incorrect or a virtual location / IP is used, or if a device that has failed to pass the test is detected and tried multiple times in a short period of time, the blocking module will add it to the blacklist. After verification, the access requirement level question and answer module generates a questionnaire, asks the required information category, retrieves the information and closes other access. Then, you will enter the level test module, which will ask technical multiple-choice questions. If you answer correctly, you will pass. If you answer incorrectly, you will be required to sign a confidentiality contract and disclosure items.

[0055] Step S304: when it is determined based on the current location information and the historical access information that the risk value of the access request is lower than the risk threshold, the network resource usage risk value of the initiator of the access request is obtained.

[0056] In this embodiment, when it is determined that the risk value of the access request is lower than the risk threshold based on the current location information and historical access information, the network resource usage risk value of the initiator of the access request can be obtained, and then the next authentication process can be determined based on the network resource risk value.

[0057] Step S306: when the network resource usage risk value is lower than the network resource usage risk threshold, obtaining the biometric information of the initiating object.

[0058] Optionally, the above biometric information may include but is not limited to: facial information, fingerprint information, etc.

[0059] Here, when it is determined that the network resource usage risk value is lower than the network resource usage risk threshold, the biometric information of the initiating object may be obtained to perform identity authentication on the initiating object based on the biometric information.

[0060] Step S308: Use the biometric information to identify the initiating object and obtain an identification result.

[0061] Step S310: when the identity identification result indicates that the initiating object has been identified successfully, generate resource access rights for the initiating object so that the initiating object can access the target resource corresponding to the resource access rights according to the resource access rights.

[0062] As can be seen from the above, in an embodiment of the present invention, when an access request is received, the current location information of the terminal device that sends the access request and the historical access information of the terminal device are obtained; when it is determined that the risk value of the access request is lower than the risk threshold based on the current location information and the historical access information, the network resource usage risk value of the initiating object of the access request is obtained; when the network resource usage risk value is lower than the network resource usage risk threshold, the biometric information of the initiating object is obtained; the initiating object is identified using the biometric information to obtain an identification result; when the identification result indicates that the initiating object has been identified, a resource access permission for the initiating object is generated, so that the initiating object accesses the target resource corresponding to the resource access permission in accordance with the resource access permission, thereby achieving identity authentication of the terminal device that initiates the access request based on the current location information of the terminal device that initiates the access request and the historical access information of the terminal device, and the biometric information of the object that initiates the access request, and determining its access permission to network resources based on the identification result, thereby achieving the purpose of improving the security of network resource access.

[0063] Therefore, the technical solution provided by the embodiment of the present invention solves the technical problems that the existing information management method is single, easily leads to information leakage, and has security risks.

[0064] According to the above-mentioned embodiment of the present invention, the current location information of the terminal device that sends the access request and the historical access information of the terminal device are obtained, including: parsing the access request to obtain the Internet Protocol address and the media access control address of the terminal device; locating the terminal device according to the Internet Protocol address to obtain the current location information of the terminal device; and obtaining the historical access information of the terminal device according to the media access control address.

[0065] In this embodiment, the access request can be parsed to obtain the Internet Protocol IP address and Media Access Control MAC address of the terminal device, and then the current location information and historical access information of the terminal device can be obtained based on these addresses to facilitate the next authentication process.

[0066] According to the above embodiment of the present invention, the historical access information includes at least: historical access location and historical access time, and determining that the risk value of the access request is lower than the risk threshold based on the current location information and the historical access information includes: determining the secure access range of the terminal device according to the historical access location and the historical access time; obtaining the initiation time of the access request; obtaining the correspondence between the initiation time and the current location information; and when determining that the terminal device is within the secure access range according to the correspondence, determining that the risk value of the access request is lower than the risk threshold.

[0067] In this embodiment, you can use Figure 4 The historical visit comparison module in compares the visitor's historical visit records to see if there are large differences in time and location.

[0068] According to the above embodiment of the present invention, the network resource usage risk value of the initiator object of the access request is obtained, including: when it is determined that the initiator object is a new user, obtaining the identity identifier of the new user; authenticating the identity identifier to obtain an authentication result; when the authentication result indicates that the new user is authenticated, obtaining the Internet Protocol address of the login device of the new user; when it is determined based on the Internet Protocol address that the location of the login device is consistent with that of the new user, obtaining the network resource usage risk value of the initiator object of the access request.

[0069] In this embodiment, when it is determined that the initiating object is a new user, an identity identifier can be obtained, such as an ID number, work number, etc., and then the identity identifier is authenticated. When the authentication passes, the IP address of the new user's login device can be obtained; when it is determined that the login device is consistent with the location of the new user based on the IP address, the network resource usage risk value of the initiating object is obtained.

[0070] According to the above-mentioned embodiment of the present invention, the network resource usage risk value of the initiating object of the access request is obtained, including: generating question and answer information for evaluating the network resource usage risk value of the initiating object; obtaining the information access category of the initiating object according to the question and answer result of the question and answer information; generating evaluation information for evaluating the initiating object based on the information access category; obtaining the evaluation result of the initiating object on the evaluation information; and obtaining the network resource usage risk value of the initiating object of the access request according to the evaluation result.

[0071] Figure 5 is a schematic diagram of an examination and authentication system according to an embodiment of the present invention. Figure 5As shown, the examination and certification system includes an access requirement level question and answer module → an access level examination module → a contract signing module. The access requirement level question and answer module is used to generate a question and answer questionnaire to inquire about the type of information the visitor needs to access. The access level examination module is used to randomly ask several technical multiple-choice questions about the level of information the visitor needs to access. If the answers are correct, the verification is passed. If a question is answered incorrectly, the contract signing module is required to generate contract information and notification items, and sign the access contract before the visit can continue.

[0072] In this embodiment, the various modules in the above-mentioned examination and certification system can be used to evaluate the initiating object, and then obtain the network resource usage risk value of the initiating object.

[0073] According to the above embodiment of the present invention, obtaining the biometric information of the initiating object includes: generating an access agreement when the network resource usage risk value is not lower than the network resource usage risk threshold; and obtaining the biometric information of the initiating object when receiving feedback information from the initiating object on the access agreement indicating that the initiating object agrees to sign.

[0074] As mentioned above Figure 5 As shown, the contract signing module can be used for the initiating object to sign an access contract. Only when the access contract is signed can the access be continued.

[0075] According to the above embodiment of the present invention, after the initiating object is identified by using biometric information and an identification result is obtained, the method for accessing network resources also includes: when the initiating object is determined to be a high-risk object based on the identity identification result, an alarm message is generated, wherein the high-risk object is an object whose matching degree with the information stored in the abnormal object database is higher than the matching degree threshold; and an alarm message is sent.

[0076] In this embodiment, when the biometric information is authenticated, if the sender is a high-risk object, an alarm message may be generated and sent to a predetermined terminal device, such as a police alarm system.

[0077] Figure 6 is a schematic diagram of a face recognition system according to an embodiment of the present invention. Figure 6 As shown, the face recognition system includes a wanted criminal photo comparison module → a new user identification module → a system operation detection module. The wanted criminal photo comparison module is used to download the latest online wanted criminal photos from the Internet. If the same person is identified, an automatic alarm will be triggered. The new user identification module is used to identify the information of internal company personnel to compare unfamiliar faces and compare them with photos of recent job applicants. When the comparison shows the same face, the face recognition verification can be passed and entered into the system. The system operation detection is used to detect in real time whether the face recognition system is operating normally.

[0078] According to the above-mentioned embodiment of the present invention, the identity of the initiating object is identified by using biometric information to obtain an identity identification result, including: sending the biometric information to an identity identification model to process the biometric information by using the identity identification model to obtain an identity identification result, wherein the identity identification model is obtained by machine learning training using multiple sets of training data, and each set of the multiple sets of training data includes: sample biometric information and a sample identity identification result corresponding to the sample biometric information.

[0079] In this embodiment, when the biometric information is a fingerprint, it can be sent to an identity recognition model so as to use the identity recognition model to determine the identity of the initiating object based on the fingerprint.

[0080] Figure 7 is a schematic diagram of a fingerprint recognition system according to an embodiment of the present invention. Figure 7 As shown, the fingerprint recognition system includes a human body sensing module → fingerprint recognition module → system operation detection module → new user recognition module. The human body sensing module is used to sense whether the person being verified is a human body. The fingerprint recognition module is used to perform fingerprint recognition on non-first-time visitors. The system operation detection module is used to detect whether the fingerprint recognition system is operating normally. The new user recognition module is used to recognize the fingerprint of the first-time visitor and enter it into the system.

[0081] Here the visitor completes the final face and fingerprint recognition. The wanted criminal photo comparison module downloads the latest photos of wanted criminals on the Internet, and automatically alarms when the same person is recognized. For visitors who are recognized for the first time, the new user identification module downloads the information of the company's internal and recent applicants for comparison. If a match is found, the verification is passed and entered into the system. During fingerprint recognition, the human body sensing module confirms that the verifier is a human. If it is not a first-time visitor, it only needs to meet the human body and fingerprint module conditions to pass. For visitors who recognize fingerprints for the first time, the new user identification module recognizes and enters the system. The system runs a test to ensure that the face recognition and fingerprint recognition modules are normal. If they are not normal, the access is terminated.

[0082] also, Figure 8 is a schematic diagram of a learning system according to an embodiment of the present invention. Figure 8 As shown, the learning system includes a virus detection module → an AI learning module → an interconnection module. The virus detection module is used to detect whether there is virus interference and intrusion on the network device authentication platform. The AI ​​learning module is used to learn and record previous virus types online, learn new virus protection methods, and perform virus screening and detection on each system of the network device authentication platform through the interconnection module.

[0083] During the access, the virus detection module monitors the network device authentication platform in real time to prevent virus interference and intrusion. The AI ​​learning module improves protection capabilities by learning historical virus types and new protection methods. The interconnection module screens the authentication platform for viruses, and immediately terminates access if a virus intrusion is found.

[0084] Fig. 9 is a schematic diagram of a user analysis system according to an embodiment of the present invention. Fig. 9 As shown, the user analysis system includes an access record module → a device record module → a risk judgment module. The access record module is used to record the time, location and specific information of each visitor's visit. The device record module is used to record the device model and code used by the visitor each time. The risk judgment module is used to analyze and save each record, and judge the degree of leakage risk of each visitor's time, location, device model and code, and connect to the company's internal cameras to observe visitors in real time.

[0085] The access record module records the time, location and information of each visitor, and the device record module records the device model and code. The risk assessment module analyzes and saves records, assesses the risk of leakage, and connects to the company's cameras to observe visitors.

[0086] Fig.10 is a schematic diagram of a central processing system according to an embodiment of the present invention. Fig.10 As shown, the central processing system includes a data storage module → backup storage module → data transfer module → backup gateway module. The data storage module is used to store and view the company's internal data at any time. The backup storage module is used to perform a secondary backup of the data in the data storage module. The data transfer module is used to automatically transfer the backup storage module and the data storage module to the network disk set by the user when the network device authentication platform is forcibly viewed by a virus, and delete all the contents in the data storage module and the backup storage module. The backup gateway module is used to automatically shut down the company's internal wireless network when the company's internal wireless network is hacked by hackers, and start the backup gateway to prevent data loss or disconnection of the person who is accessing, and at the same time send a text message to all senior managers in the company. Here, the data storage module stores and views the company's internal data at any time, and the backup storage module backs up the data twice. The data transfer module automatically transfers data and deletes the original content when the network device authentication platform is forcibly viewed by a virus. When the company's internal wireless network is hacked, the backup gateway module automatically shuts down and starts the backup gateway to prevent data loss or disconnection, and notifies the senior manager.

[0087] in addition, Fig.11 is a schematic diagram of a verification code login system according to an embodiment of the present invention. Fig.11As shown, the verification code login platform includes a device authentication module → a regional network authentication module → a mobile operator authentication module → a dynamic QR code generation module. The device authentication module is used to verify the visitor's device. If the visitor's device is a computer or mobile phone outside the company, a dynamic QR code cannot be generated. The regional network authentication module is used to verify whether the visitor's network is the company's internal network. The mobile operator authentication is used to verify whether the visitor's mobile operator or computer code is normal. If the operator is virtual or the computer code is virtual, a dynamic QR code cannot be generated. The dynamic QR code generation module is used to generate a dynamic QR code link to access the central processing system. The QR code link automatically expires after a period of time. That is, the visitor opens the company information entrance, and the device authentication module verifies the device. If the device is not within the company, the regional network authentication is performed to verify whether the network is the company's internal network. The mobile operator authentication checks whether the mobile operator or computer code is normal. Virtual operators or virtual codes cannot generate dynamic QR code links, and the links expire after a certain period of time.

[0088] It can be seen from the above description that in the embodiment of the present invention, the verification code login and detection system verifies the visitor's device and network. A random QR code link is generated by a dynamic QR code generation system. At the same time, historical access comparison, new user risk assessment and abnormal login detection modules evaluate the time and location differences of visitors. Non-company or working hours access will be blocked. New users need to enter their name, ID number and work number for risk assessment, and can continue to access only after the information is correct. The abnormal login detection module queries the visitor's IP address. If it is incorrect or there is a virtual location, IP, or a visitor who has failed to pass multiple attempts in a short period of time, it will be blacklisted, thereby improving the security of access verification and preventing the company's internal information from being stolen. By setting up a certification examination system, visitors can access the demand level question and answer module after verification, generate a questionnaire, clarify the required information category, and the system retrieves the required information and blocks other information. The level examination module randomly asks technical multiple-choice questions to visitors. If they answer correctly, they can pass. If they answer incorrectly, they need to generate a contract and notification item through the contract signing module, and they can continue to access after reading and signing the confidentiality contract. Secondary verification improves access efficiency, popularizes knowledge of the importance of information, facilitates accountability and protects the security of other information, and prevents internal information leakage to the greatest extent. The third line of defense is provided by setting up face recognition and fingerprint recognition, and adding human body sensing to prevent fraud. The latest photos of wanted criminals on the Internet are downloaded using the wanted criminal photo comparison module. If a match is found between an intruder and an outsider, an alarm is automatically triggered. New employees are easily registered, and the system operation detection monitors the face recognition and fingerprint recognition modules in real time. If it is abnormal, access is terminated to improve the security of the company's internal data storage equipment. The data storage module stores and views the company's internal data at any time, and the backup storage module backs up data for the second time. When the network device authentication platform is forcibly viewed by a virus, the data transfer module automatically transfers data and deletes the original data to protect the integrity of the data. When the company's internal wireless network is cracked, the backup gateway module automatically shuts down and starts the backup gateway to prevent data loss and disconnection, and notifies senior managers to protect company property to the greatest extent.

[0089] The above technical solution provided by the embodiment of the present invention overcomes the following shortcomings of the prior art to a certain extent: 1). Security risks of networking methods: Existing smart devices usually use the method of scanning QR codes to connect to the Internet. This method is indiscriminate, which means that any user can scan and obtain WiFi information, which may further lead to the leakage of passwords and identity authentication information, so there are security risks; 2). Insufficient data security of software development: In software development projects, companies usually store internal data in computer-readable storage media and use dedicated passwords and identity authentication to protect these data. However, if non-company personnel sneak in and forcibly crack the password, or steal data by cracking the wireless network, then these internal data can be easily stolen, resulting in information leakage of the project and property loss of the company; 3). Insufficient prevention of virus attacks: If outsiders can crack the wireless network, they may steal data in the form of viruses. This shows that the existing technology is insufficient in preventing virus attacks and cannot effectively protect the security of internal company information. And it has the following beneficial effects: 1). Improve the security of networking methods: Develop a more secure networking method to reduce or eliminate the security risks brought by scanning QR codes, such as using higher-level encryption technology or introducing multi-factor authentication mechanisms; 2). Enhance the data security of software development projects: Design more stringent and efficient data access and protection mechanisms to prevent unauthorized personnel from obtaining or stealing internal company data. This may include using more powerful encryption technology, introducing more complex authentication processes, or implementing stricter physical security measures; 3). Improve the ability to prevent virus attacks: Improve the software's ability to prevent virus attacks by improving software design, adding security vulnerability detection and repair mechanisms, or adopting more advanced antivirus technology, thereby ensuring the security of the company's internal information.

[0090] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0091] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0092] According to an embodiment of the present invention, a network resource access device for implementing the above-mentioned network resource access method is also provided. Fig.12 is a schematic diagram of a network resource access device according to an embodiment of the present invention, such as Fig.12 As shown, the network resource access device includes: a first acquisition unit 1201, a second acquisition unit 1203, a third acquisition unit 1205, an identification unit 1207 and a processing unit 1209.

[0093] The first acquisition unit 1201 is used to acquire the current location information of the terminal device that sends the access request and the historical access information of the terminal device when receiving the access request.

[0094] The second acquisition unit 1203 is configured to acquire the network resource usage risk value of the initiator of the access request when it is determined that the risk value of the access request is lower than the risk threshold based on the current location information and the historical access information.

[0095] The third acquisition unit 1205 is used to acquire the biometric information of the initiating object when the network resource usage risk value is lower than the network resource usage risk threshold.

[0096] The identification unit 1207 is used to use the biometric information to identify the initiating object and obtain an identification result.

[0097] The processing unit 1209 is configured to generate a resource access permission for the initiating object when the identity identification result indicates that the initiating object has been identified successfully, so that the initiating object can access the target resource corresponding to the resource access permission according to the resource access permission.

[0098] It should be noted here that the above-mentioned first acquisition unit 1201, second acquisition unit 1203, third acquisition unit 1205, identification unit 1207 and processing unit 1209 correspond to steps S302 to S310 in the above-mentioned embodiments, and the five units are the same as the instances and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiments.

[0099] As can be seen from the above, in the scheme recorded in the above-mentioned embodiment of the present invention, the first acquisition unit can be used to obtain the current location information of the terminal device that sends the access request and the historical access information of the terminal device when receiving the access request; the second acquisition unit can be used to obtain the network resource usage risk value of the initiating object of the access request when the risk value of the access request is determined to be lower than the risk threshold based on the current location information and the historical access information; the third acquisition unit can be used to obtain the biometric information of the initiating object when the network resource usage risk value is lower than the network resource usage risk threshold; the identification unit can be used to perform identity identification on the initiating object using the biometric information to obtain an identity identification result; the processing unit can be used to generate the resource access rights of the initiating object when the identity identification result indicates that the initiating object has been identified, so that the initiating object can access the target resource corresponding to the resource access rights according to the resource access rights, thereby realizing identity authentication of the terminal device that initiates the access request based on the current location information and the historical access information of the terminal device and the biometric information of the object that initiates the access request, and determining its access rights to network resources according to the identity authentication result, thereby achieving the purpose of improving the security of network resource access.

[0100] Therefore, the technical solution provided by the embodiment of the present invention solves the technical problems that the existing information management method is single, easily leads to information leakage, and has security risks.

[0101] Optionally, the first acquisition unit includes: a parsing module, used to parse the access request to obtain the Internet Protocol address and media access control address of the terminal device; a positioning module, used to locate the terminal device according to the Internet Protocol address to obtain the current location information of the terminal device; a first acquisition module, used to obtain the historical access information of the terminal device according to the media access control address.

[0102] Optionally, the historical access information includes at least: historical access location and historical access time, and the second acquisition unit includes: a first determination module, used to determine the security access range of the terminal device based on the historical access location and the historical access time; a second acquisition module, used to obtain the initiation time of the access request; a third acquisition module, used to obtain the correspondence between the initiation time and the current location information; the second determination module is used to determine that the risk value of the access request is lower than the risk threshold when it is determined that the terminal device is within the security access range according to the correspondence.

[0103] Optionally, the second acquisition unit includes: a fourth acquisition module, used to obtain the identity identifier of the new user when it is determined that the initiating object is a new user; an authentication module, used to authenticate the identity identifier and obtain an authentication result; a fifth acquisition module, used to obtain the Internet Protocol address of the login device of the new user when the authentication result indicates that the new user is authenticated; a sixth acquisition module, used to obtain the network resource usage risk value of the initiating object of the access request when it is determined that the location of the login device is consistent with that of the new user based on the Internet Protocol address.

[0104] Optionally, the third acquisition module is used to include: a first generation module, used to generate question and answer information for evaluating the network resource usage risk value of the initiating object; a seventh acquisition module, used to obtain the information access category of the initiating object based on the question and answer results of the question and answer information; a second generation module, used to generate evaluation information for evaluating the initiating object based on the information access category; an eighth acquisition module, used to obtain the evaluation result of the initiating object on the evaluation information; and a ninth acquisition module, used to obtain the network resource usage risk value of the initiating object of the access request based on the evaluation result.

[0105] Optionally, the third acquisition unit includes: a third generation module, used to generate an access agreement when the network resource usage risk value is not lower than the network resource usage risk threshold; a tenth acquisition module, used to obtain the biometric information of the initiating object when the feedback information of the initiating object on the access agreement is received and it is indicative of the agreement to sign.

[0106] Optionally, the network resource access device also includes: a generating unit, which is used to generate alarm information after using biometric information to identify the initiating object and obtaining the identity identification result, when the initiating object is determined to be a high-risk object based on the identity identification result, wherein the high-risk object is an object whose matching degree with the information stored in the abnormal object database is higher than the matching degree threshold; a sending unit, which is used to send the alarm information.

[0107] Optionally, the identification unit includes: a processing module, used to send biometric information to an identity recognition model, so as to process the biometric information using the identity recognition model to obtain an identity recognition result, wherein the identity recognition model is obtained through machine learning training using multiple sets of training data, and each set of the multiple sets of training data includes: sample biometric information and a sample identity recognition result corresponding to the sample biometric information.

[0108] According to another aspect of an embodiment of the present invention, a zero-trust-based network device identity authentication system is also provided. The zero-trust-based network device identity authentication system uses any of the above-mentioned methods for accessing network resources.

[0109] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein the program executes any one of the above-mentioned methods for accessing network resources.

[0110] According to another aspect of an embodiment of the present invention, a processor is provided, and the processor is used to run a program, wherein when the program is run, any one of the above-mentioned methods for accessing network resources is executed.

[0111] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, and when the computer instructions are executed by a processor, any one of the above-mentioned methods for accessing network resources is executed.

[0112] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0113] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: when an access request is received, obtaining the current location information of the terminal device that sends the access request and the historical access information of the terminal device; when it is determined based on the current location information and the historical access information that the risk value of the access request is lower than the risk threshold, obtaining the network resource usage risk value of the initiating object of the access request; when the network resource usage risk value is lower than the network resource usage risk threshold, obtaining the biometric information of the initiating object; using the biometric information to identify the initiating object and obtain an identification result; when the identification result indicates that the initiating object has been identified successfully, generating a resource access right for the initiating object so that the initiating object can access the target resource corresponding to the resource access right in accordance with the resource access right.

[0114] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: parsing the access request to obtain the Internet Protocol address and media access control address of the terminal device; locating the terminal device according to the Internet Protocol address to obtain the current location information of the terminal device; and obtaining the historical access information of the terminal device according to the media access control address.

[0115] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: historical access location and historical access time, determining that the risk value of the access request is lower than the risk threshold based on the current location information and the historical access information, including: determining the secure access range of the terminal device according to the historical access location and the historical access time; obtaining the initiation time of the access request; obtaining the correspondence between the initiation time and the current location information; and when determining that the terminal device is within the secure access range according to the correspondence, determining that the risk value of the access request is lower than the risk threshold.

[0116] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: when it is determined that the initiating object is a new user, obtaining an identity identifier of the new user; authenticating the identity identifier to obtain an authentication result; when the authentication result indicates that the new user is authenticated, obtaining the Internet Protocol address of the login device of the new user; when it is determined based on the Internet Protocol address that the location of the login device is consistent with that of the new user, obtaining the network resource usage risk value of the initiating object of the access request.

[0117] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: generating question and answer information for evaluating the network resource usage risk value of the initiating object; obtaining the information access category of the initiating object based on the question and answer results of the question and answer information; generating evaluation information for evaluating the initiating object based on the information access category; obtaining the evaluation result of the initiating object on the evaluation information; and obtaining the network resource usage risk value of the initiating object of the access request based on the evaluation result.

[0118] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: generating an access agreement when the network resource usage risk value is not lower than the network resource usage risk threshold; and obtaining the biometric information of the initiating object when feedback information from the initiating object on the access agreement is received indicating that the initiating object agrees to sign.

[0119] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: after using biometric information to identify the initiating object and obtaining an identification result, when it is determined that the initiating object is a high-risk object based on the identification result, an alarm message is generated, wherein the high-risk object is an object whose matching degree with the information stored in the abnormal object database is higher than a matching degree threshold; and an alarm message is sent.

[0120] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: sending the biometric information to an identity recognition model to process the biometric information using the identity recognition model to obtain an identity recognition result, wherein the identity recognition model is obtained through machine learning training using multiple sets of training data, and each set of the multiple sets of training data includes: sample biometric information and a sample identity recognition result corresponding to the sample biometric information.

[0121] According to another aspect of an embodiment of the present invention, a network resource access device is also provided, including: a first acquisition unit, used to acquire the current location information of the terminal device that sends the access request and the historical access information of the terminal device when an access request is received; a second acquisition unit, used to acquire the network resource usage risk value of the initiating object of the access request when it is determined based on the current location information and the historical access information that the risk value of the access request is lower than the risk threshold; a third acquisition unit, used to acquire the biometric information of the initiating object when the network resource usage risk value is lower than the network resource usage risk threshold; an identification unit, used to perform identity identification on the initiating object using the biometric information to obtain an identity identification result; and a processing unit, used to generate a resource access permission for the initiating object when the identity identification result indicates that the initiating object has been identified successfully, so that the initiating object can access the target resource corresponding to the resource access permission according to the resource access permission.

[0122] Optionally, the first acquisition unit includes: a parsing module, used to parse the access request to obtain the Internet Protocol address and media access control address of the terminal device; a positioning module, used to locate the terminal device according to the Internet Protocol address to obtain the current location information of the terminal device; a first acquisition module, used to obtain the historical access information of the terminal device according to the media access control address.

[0123] Optionally, the historical access information includes at least: historical access location and historical access time, and the second acquisition unit includes: a first determination module, used to determine the security access range of the terminal device based on the historical access location and the historical access time; a second acquisition module, used to obtain the initiation time of the access request; a third acquisition module, used to obtain the correspondence between the initiation time and the current location information; the second determination module is used to determine that the risk value of the access request is lower than the risk threshold when it is determined that the terminal device is within the security access range according to the correspondence.

[0124] Optionally, the second acquisition unit includes: a fourth acquisition module, used to obtain the identity identifier of the new user when it is determined that the initiating object is a new user; an authentication module, used to authenticate the identity identifier and obtain an authentication result; a fifth acquisition module, used to obtain the Internet Protocol address of the login device of the new user when the authentication result indicates that the new user is authenticated; a sixth acquisition module, used to obtain the network resource usage risk value of the initiating object of the access request when it is determined that the location of the login device is consistent with that of the new user based on the Internet Protocol address.

[0125] Optionally, the third acquisition module is used to include: a first generation module, used to generate question and answer information for evaluating the network resource usage risk value of the initiating object; a seventh acquisition module, used to obtain the information access category of the initiating object based on the question and answer results of the question and answer information; a second generation module, used to generate evaluation information for evaluating the initiating object based on the information access category; an eighth acquisition module, used to obtain the evaluation result of the initiating object on the evaluation information; and a ninth acquisition module, used to obtain the network resource usage risk value of the initiating object of the access request based on the evaluation result.

[0126] Optionally, the third acquisition unit includes: a third generation module, used to generate an access agreement when the network resource usage risk value is not lower than the network resource usage risk threshold; a tenth acquisition module, used to obtain the biometric information of the initiating object when the feedback information of the initiating object on the access agreement is received and it is indicative of the agreement to sign.

[0127] Optionally, the network resource access device also includes: a generating unit, which is used to generate alarm information after using biometric information to identify the initiating object and obtaining the identity identification result, when the initiating object is determined to be a high-risk object based on the identity identification result, wherein the high-risk object is an object whose matching degree with the information stored in the abnormal object database is higher than the matching degree threshold; a sending unit, which is used to send the alarm information.

[0128] Optionally, the identification unit includes: a processing module, used to send biometric information to an identity recognition model, so as to process the biometric information using the identity recognition model to obtain an identity recognition result, wherein the identity recognition model is obtained through machine learning training using multiple sets of training data, and each set of the multiple sets of training data includes: sample biometric information and a sample identity recognition result corresponding to the sample biometric information.

[0129] According to another aspect of an embodiment of the present invention, a zero-trust-based network device identity authentication system is also provided. The zero-trust-based network device identity authentication system uses any of the above-mentioned methods for accessing network resources.

[0130] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein the program executes any one of the above-mentioned methods for accessing network resources.

[0131] According to another aspect of an embodiment of the present invention, a processor is provided, and the processor is used to run a program, wherein when the program is run, any one of the above-mentioned methods for accessing network resources is executed.

[0132] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, and when the computer instructions are executed by a processor, any one of the above-mentioned methods for accessing network resources is executed.

[0133] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0134] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0135] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0136] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0137] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0138] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-On lyMemory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0139] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for accessing network resources, characterized in that: include: Upon receiving an access request, obtaining current location information of the terminal device that sent the access request and historical access information of the terminal device; When it is determined based on the current location information and the historical access information that the risk value of the access request is lower than a risk threshold, obtaining a network resource usage risk value of an initiator of the access request; When the network resource usage risk value is lower than the network resource usage risk threshold, acquiring the biometric information of the initiating object; Using the biometric information to identify the initiating object, and obtaining an identification result; When the identity recognition result indicates that the initiating object is successfully identified, a resource access permission of the initiating object is generated so that the initiating object can access a target resource corresponding to the resource access permission according to the resource access permission.

2. The method for accessing network resources according to claim 1, characterized in that: Acquiring the current location information of the terminal device that sends the access request and the historical access information of the terminal device, including: Parsing the access request to obtain an Internet Protocol address and a media access control address of the terminal device; Positioning the terminal device according to the Internet Protocol address to obtain the current location information of the terminal device; The historical access information of the terminal device is acquired according to the media access control address.

3. The method for accessing network resources according to claim 1, characterized in that: The historical access information includes at least: a historical access location and a historical access time, and determining, based on the current location information and the historical access information, that the risk value of the access request is lower than a risk threshold includes: Determine the secure access range of the terminal device according to the historical access location and the historical access time; Obtaining the initiation time of the access request; Acquire the correspondence between the initiation time and the current location information; When it is determined that the terminal device is within the secure access range according to the corresponding relationship, it is determined that the risk value of the access request is lower than the risk threshold.

4. The method for accessing network resources according to claim 1, characterized in that: Obtaining the network resource usage risk value of the initiator of the access request, including: When it is determined that the initiating object is a new user, obtaining an identity identifier of the new user; authenticating the identity identifier to obtain an authentication result; When the authentication result indicates that the new user is authenticated, obtaining an Internet Protocol address of a login device of the new user; When it is determined based on the Internet Protocol address that the location of the login device is consistent with that of the new user, the network resource usage risk value of the initiator of the access request is obtained.

5. The method for accessing network resources according to claim 1, characterized in that: Obtaining the network resource usage risk value of the initiator of the access request, including: Generating question and answer information for evaluating the risk value of network resource use of the initiating object; Acquire the information access category of the initiating object according to the question and answer result of the question and answer information; Generating evaluation information for evaluating the initiating object based on the information access category; Obtaining the evaluation result of the evaluation information by the initiating object; The network resource usage risk value of the initiator of the access request is obtained according to the evaluation result.

6. The method for accessing network resources according to claim 1, characterized in that: Acquiring the biometric information of the initiating object includes: When the network resource usage risk value is not lower than the network resource usage risk threshold, generating an access agreement; When the feedback information received from the initiating object regarding the access agreement is that the initiating object agrees to sign, the biometric feature information of the initiating object is acquired.

7. The method for accessing network resources according to claim 1, characterized in that: After the biometric information is used to identify the initiating object and an identification result is obtained, the method further includes: When the initiating object is determined to be a high-risk object based on the identity recognition result, generating an alarm message, wherein the high-risk object is an object whose matching degree with the information stored in the abnormal object database is higher than a matching degree threshold; Send the alarm information.

8. The method for accessing network resources according to claim 1, characterized in that: Using the biometric information to identify the initiating object, and obtaining an identification result, includes: The biometric information is sent to an identity recognition model so as to process the biometric information using the identity recognition model to obtain the identity recognition result, wherein the identity recognition model is obtained by machine learning training using multiple sets of training data, and each of the multiple sets of training data includes: sample biometric information and a sample identity recognition result corresponding to the sample biometric information.

9. A device for accessing network resources, characterized in that: include: A first acquisition unit, configured to acquire, upon receiving an access request, current location information of a terminal device that sends the access request and historical access information of the terminal device; A second acquisition unit, configured to acquire a network resource usage risk value of an initiator of the access request when it is determined based on the current location information and the historical access information that the risk value of the access request is lower than a risk threshold; A third acquisition unit, configured to acquire the biometric information of the initiating object when the network resource usage risk value is lower than the network resource usage risk threshold; An identification unit, used to identify the initiating object using the biometric information to obtain an identification result; The processing unit is used to generate resource access rights of the initiating object when the identity recognition result indicates that the initiating object has been identified successfully, so that the initiating object can access the target resource corresponding to the resource access rights according to the resource access rights.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method for accessing network resources described in any one of claims 1 to 8 is performed.

Images