Login authentication method and device, electronic equipment and storage medium

Abstract

The invention discloses a login authentication method and device, electronic equipment and a storage medium, which are used for solving the problem that a login authentication mode of single identity authentication of network security equipment has higher security risk, and the method comprises the following steps: receiving a first login request which is sent by a client and carries identity authentication information of a user; performing preliminary login authentication on the user based on the identity authentication information of the user; receiving a second login request sent by the client, wherein the second login request carries account information of the user, identification information of the multi-factor identity verification equipment and first password information generated by the multi-factor identity verification equipment; acquiring second password information corresponding to the account information of the user and the identification information of the multi-factor identity authentication equipment from a database according to the account information of the user and the corresponding relationship between the identification information of the multi-factor identity authentication equipment and the password information; and performing secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a login authentication method, device, electronic device and storage medium. Background Art

[0002] In network security protection, identity authentication is usually set up on network security devices to ensure that only authorized users or entities can access important systems or information.

[0003] The next generation firewall (NGFW) device is an integrated network security device. The firewall is usually set between the company's internal network applications, websites, campuses and the Internet to filter and control data flows. If a firewall is not set up, any user can directly access the company's internal network through the Internet. Firewalls can create comprehensive and precise security policies to authorize access to all network traffic flowing through. In recent years, the application of next-generation firewall devices has become more and more widespread, but the vulnerabilities of network security devices themselves are often overlooked. For example, the Check Point security gateway's arbitrary file read vulnerability (CVE-2024-24919) has a greater impact. Attackers can exploit the vulnerability of the security network to read any file on the server, causing sensitive information leakage.

[0004] As a network security device, the login authentication method of the next-generation firewall is to perform a single identity authentication on the user. However, once an attacker steals the user's identity authentication information, he can impersonate the user for login authentication, which may cause leakage of user resources and pose a high security risk. Summary of the invention

[0005] In order to solve the problem that the single identity authentication login authentication method of network security equipment has a high security risk, the embodiments of the present application provide a login authentication method, device, electronic device and storage medium.

[0006] In a first aspect, an embodiment of the present application provides a login authentication method, which is applied to a network security device, and the method includes:

[0007] Receive a first login request sent by a client, where the first login request carries identity authentication information of a user, where the identity authentication information of the user includes account information of the user;

[0008] Performing a preliminary login authentication on the user based on the user's identity authentication information, and returning a preliminary login authentication success response message to the client after the preliminary login authentication passes;

[0009] receiving a second login request sent by the client, wherein the second login request carries the account information of the user, the identification information of the multi-factor identity authentication device, and the first password information generated by the multi-factor identity authentication device;

[0010] According to the correspondence between the user's account information, the identification information of the multi-factor identity authentication device and the password information, obtaining second password information corresponding to the user's account information and the identification information of the multi-factor identity authentication device from a database;

[0011] A secondary login authentication is performed on the user based on the first password information and the second password information to obtain an authentication result.

[0012] In one embodiment, before receiving the first login request sent by the client, the method further includes:

[0013] receiving a registration request for the multi-factor authentication device sent by the client, the registration request carrying the account information of the user, the identification information of the multi-factor authentication device, and password attribute information, wherein the password attribute information is description information of the password information generated by the multi-factor authentication device;

[0014] Registering the multi-factor identity authentication device, and storing the correspondence between the user's account information and the identification information of the multi-factor identity authentication device in the database;

[0015] Return registration result information to the client.

[0016] In one embodiment, after the multi-factor authentication device is successfully registered, the method further includes:

[0017] Receiving the user's account information, password information, and expiration time information of the password information sent by the multi-factor identity authentication device, wherein the password information is a one-time password generated by the multi-factor identity authentication device for the user, and the password information is used to perform secondary login authentication on the user;

[0018] The user's account information, the correspondence between the identification information of the multi-factor identity authentication device and the password information, and the expiration time information of the password information are stored in the database.

[0019] In one implementation, performing secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result specifically includes:

[0020] If it is determined that the first password information is the same as the second password information, and it is determined that the second password information has not expired according to the expiration time information of the second password information, then it is determined that the secondary login authentication is passed;

[0021] If it is determined that the first password information is the same as the second password information, and it is determined that the second password information has expired based on the expiration time information of the second password information, or if it is determined that the first password information is different from the second password information, it is determined that the secondary login authentication of the user has failed.

[0022] In a second aspect, an embodiment of the present application provides a login authentication device, which is applied to a network security device, and the device includes:

[0023] A first receiving module, configured to receive a first login request sent by a client, wherein the first login request carries the identity authentication information of the user, and the identity authentication information of the user includes the account information of the user;

[0024] A first authentication module, configured to perform a preliminary login authentication on the user based on the identity authentication information of the user, and return a preliminary login authentication success response message to the client after the preliminary login authentication passes;

[0025] A second receiving module is used to receive a second login request sent by the client, where the second login request carries the account information of the user, the identification information of the multi-factor identity authentication device, and the first password information generated by the multi-factor identity authentication device;

[0026] an acquisition module, configured to acquire, from a database, second password information corresponding to the user's account information and the identification information of the multi-factor identity authentication device according to a correspondence between the user's account information, the identification information of the multi-factor identity authentication device, and the password information;

[0027] The second authentication module is used to perform a secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result.

[0028] In one embodiment, the device further comprises:

[0029] A third receiving module is configured to receive, before receiving the first login request sent by the client, a registration request for the multi-factor authentication device sent by the client, the registration request carrying the account information of the user, the identification information of the multi-factor authentication device and password attribute information, the password attribute information being description information of the password information generated by the multi-factor authentication device;

[0030] A registration module, configured to register the multi-factor identity authentication device and store the corresponding relationship between the user's account information and the identification information of the multi-factor identity authentication device in the database;

[0031] The return module is used to return the registration result information to the client.

[0032] In one embodiment, the device further comprises:

[0033] a fourth receiving module, configured to receive, after the multi-factor identity authentication device is successfully registered, the account information, password information and expiration time information of the password information of the user sent by the multi-factor identity authentication device, wherein the password information is a one-time password generated by the multi-factor identity authentication device for the user, and the password information is used to perform secondary login authentication on the user;

[0034] The storage module is used to store the user's account information, the corresponding relationship between the identification information of the multi-factor identity authentication device and the password information, and the expiration time information of the password information in the database.

[0035] In one embodiment, the second authentication module is specifically used to determine that the second login authentication is passed if it is determined that the first password information is the same as the second password information, and it is determined that the second password information is not expired based on the expiration time information of the second password information; if it is determined that the first password information is the same as the second password information, and it is determined that the second password information is expired based on the expiration time information of the second password information, or if it is determined that the first password information is different from the second password information, then determine that the second login authentication of the user has failed.

[0036] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the login authentication method described in the present application when executing the program.

[0037] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps in the login authentication method described in the present application are implemented.

[0038] The beneficial effects of this application are as follows:

[0039] The login authentication method, apparatus, electronic device and storage medium provided by the embodiments of the present application are as follows: a network security device receives a first login request sent by a client, the first login request carries the identity authentication information of the user, the identity authentication information of the user includes the account information of the user, performs preliminary login authentication on the user based on the identity authentication information of the user, and returns a preliminary login authentication success response message to the client after the preliminary login authentication passes, receives a second login request sent by the client, the second login request carries the account information of the user, the identification information of the multi-factor identity authentication device and the first password information generated by the multi-factor identity authentication device, obtains the second password information corresponding to the account information of the user and the identification information of the multi-factor identity authentication device from a database according to the correspondence between the account information of the user, the identification information of the multi-factor identity authentication device and the password information, and then performs secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result. Compared with the prior art, in the embodiment of the present application, the network security device is based on multi-factor identity authentication. It adds a layer of identity authentication on the basis of the initial login authentication of the user based on the user's identity authentication information, and performs a secondary login authentication on the user through a dynamic password generated by the multi-factor identity authentication device. Thus, it provides a more secure and reliable identity security management for the network security device, effectively prevents attackers from making unauthorized access to the network security device, improves the security and robustness of the network security device, and effectively reduces security risks.

[0040] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0042] Figure 1 A schematic diagram of an application scenario of the login authentication method provided in an embodiment of the present application;

[0043] Figure 2 A flowchart of a login authentication method provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of a process for a network security device to register a multi-factor identity authentication device according to an embodiment of the present application;

[0045] Figure 4A schematic diagram of the structure of a login authentication device provided in an embodiment of the present application;

[0046] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to solve the problem that the single identity authentication login authentication method of network security equipment has a high security risk, the embodiments of the present application provide a login authentication method, device, electronic device and storage medium.

[0048] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0049] In this article, it is necessary to understand that the technical terms involved in this application are:

[0050] 1. Multi-factor authentication (MFA): An additional layer of authentication is added on top of single authentication, providing higher protection for user accounts and resources. MFA devices, also known as dynamic password cards, are devices that provide this security authentication method. They are a TOTP password (Time based One Time Password, time-based one-time password) generator. MFA devices are usually applications that generate dynamic passwords running on mobile terminal devices or other hardware devices. Commonly used ones include: Microsoft Authenticatior, Google Authenticatior, etc.

[0051] 2. Next-generation firewall equipment: It is evolved and expanded from traditional firewall equipment. It not only includes all the functions of traditional firewall equipment, such as packet filtering, state detection, NAT (Network Address Translation), VPN (Virtual Private Network), etc., but also inherits more advanced functions such as application and user identification and control, intrusion prevention system (IPS), etc.

[0052] 3. TOTP algorithm: a one-time password with a time window, which uses a cryptographic hash function to combine a key with the current timestamp to generate a one-time password.

[0053] First reference Figure 1 , which is a schematic diagram of an application scenario of the login authentication method provided in the embodiment of the present application, and may include a terminal 110 and a network security device 120, wherein a client 1101 and a multi-factor authentication device 1102 are installed on the terminal 110, and the multi-factor authentication device 1102 is a virtual device, which is an application program that generates a dynamic password and is used to generate a time-based one-time password according to a preset time interval. The network security device 120 includes a login module 1201, a first authentication module 1202, and a second authentication module 1203. The user can input the user's identity authentication information through the client 1101 on the terminal 110. The client 1101 carries the user's identity authentication information in the first login request and sends the first login request to the network security device 120. After receiving the first login request, the login module 1201 of the network security device 120 sends the user's identity authentication information to the first authentication module 1202. The first authentication module 1202 performs a preliminary login authentication on the user based on the user's identity authentication information, and returns a preliminary login authentication success response message to the client 1101 after the preliminary login authentication passes. After receiving the preliminary login authentication success response message returned by the network security device 120, the client 1101 obtains the first authentication information currently generated by the multi-factor authentication device 1102 from the multi-factor authentication device 1102. A password information, then, the client 110 carries the user's account information, the identification information of the multi-factor authentication device and the first password information in the second login request, and sends the second login request to the network security device 120. After receiving the second login request, the login module of the network security device 120 sends the user's account information, the identification information of the multi-factor authentication device and the first password information to the second authentication module 1203. The second authentication module 1203 obtains the second password information corresponding to the user's account information in the second login request and the identification information of the multi-factor authentication device from the database according to the corresponding relationship between the user's account information, the identification information of the multi-factor authentication device and the password information, and performs secondary login authentication on the user based on the first password information and the second password information to obtain the authentication result. Through the multi-factor authentication method, a more secure and reliable identity security management is provided for the network security device, which effectively prevents attackers from making unauthorized access to the network security device, improves the security and robustness of the network security device, and effectively reduces security risks.

[0054] The network security device 120 may be a next-generation firewall device, or may be a traditional firewall device, an IPS device, a security gateway, or any other network security device, which is not limited in the embodiments of the present application.

[0055] The terminal 110 may be, but is not limited to, a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., which is not limited in the present embodiment. The network security device 120 and the terminal 110 may be connected via a network.

[0056] Based on the above application scenarios, the following will refer to the attached Figures 2-3 The exemplary embodiments of the present application are described in more detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present application, and the implementation of the present application is not limited in any way. On the contrary, the implementation of the present application can be applied to any applicable scenario.

[0057] like Figure 2 As shown, it is a schematic diagram of the implementation process of the login authentication method provided in the embodiment of the present application. The login authentication method can be applied to the above-mentioned network security device 120, and specifically may include the following steps:

[0058] S21. The network security device receives a first login request sent by a client, where the first login request carries user identity authentication information.

[0059] During specific implementation, the user enters the user's identity authentication information in the client of his terminal. The user's identity authentication information includes the user's account information. The user's account information includes a user name and password. The user's account information is the user name and password provided by the user when registering with the network security device. After the network security device successfully registers the user, the user's account information, namely, the user name and password, is stored in the database.

[0060] In one embodiment, the user's identity authentication information may also include the user's ID number, social security number, security questions, etc. This embodiment of the application is not limited to this. This embodiment of the application only uses the user's account information as an example for illustration.

[0061] The client carries the user's identity authentication information input by the user in the first login request, and sends the first login request to the network security device. After receiving the first login request sent by the client, the network security device extracts the user's account information: user name and password.

[0062] S22. The network security device performs preliminary login authentication on the user based on the user's identity authentication information, and returns a preliminary login authentication success response message to the client after the preliminary login authentication passes.

[0063] During specific implementation, the network security device will match the username and password extracted from the second login request with the username and password stored in the database. If it is determined that the username and password in the second login request are matched from the database, it is determined that the initial login authentication of the user is passed, that is, the user is a registered and legitimate user; if it is determined that the username and password in the second login request are not matched from the database, it is determined that the initial login authentication of the user has failed, that is, the user is an unregistered user.

[0064] After the initial login authentication of the user passes, the network security device returns a preliminary login authentication success response message to the client. If the initial login authentication of the user fails, the network security device returns an authentication failure response message to the client.

[0065] S23. The network security device receives a second login request sent by the client, where the second login request carries the user's account information, identification information of the multi-factor identity authentication device, and first password information generated by the multi-factor identity authentication device.

[0066] During specific implementation, after the client receives the initial login authentication success response message of the user returned by the network security device, it obtains the first password information currently generated by the multi-factor authentication device from the multi-factor authentication device. During implementation, after the multi-factor authentication device runs on the user's terminal, it starts to generate a time-based one-time password at a set time interval. The multi-factor authentication device can use but is not limited to the following applications: Microsoft Authenticatior or Google Authenticatior, and can also be developed by itself using Python's pyotp library, which is not limited to the embodiments of the present application.

[0067] Here is an example of using Python's pyotp library to generate a time-based one-time password:

[0068] import pyotp

[0069] key="K7bR4EeW9zT1aXsQ"

[0070] totp=pyotp.TOTP(key,digits=8,interval=30,digest=hashlib.sha256,name="customer@damddos.com",issuer="CtCt")

[0071] Among them, key: "K7bR4EeW9zT1aXsQ" is a key randomly generated by the multi-factor authentication device. According to the key and the current timestamp, a password is generated based on the hash algorithm SHA-256, that is, a one-time password. Among them, digits represents the number of digits of the generated password. Digits=8 means that the number of digits of the generated password is 8; interval represents the time interval for generating passwords, that is, the password expiration time. Interval=30 means that the time interval for generating passwords is 30 seconds, that is, a new password is generated every 30 seconds, and each password expires after 30 seconds; digest represents the password encryption algorithm used. Digest=hashlib.sha256 means that the password encryption algorithm used is the hash algorithm SHA-256.

[0072] During implementation, any other dynamic password generation algorithm can also be used to generate a one-time password, such as HOTP (HMAC-based One-Time Password, a one-time password encrypted based on HMAC (Hash-based Message Authentication Code, key-related hash operation message authentication code)) algorithm, etc., which is not limited to the embodiments of the present application.

[0073] After the multi-factor authentication device is installed on the user's terminal and runs, it is necessary to register the multi-factor authentication device through the security network device to bind the user's identity information with the multi-factor authentication device for password verification. After the security network device binds the user's identity information with the multi-factor authentication device, dynamic password authentication can be performed.

[0074] Specifically, you can follow the following Figure 3 The process shown here is to enroll a multi-factor authentication device and includes the following steps:

[0075] S31. The network security device receives a registration request for a multi-factor identity authentication device sent by a client, where the registration request carries user account information, identification information of the multi-factor identity authentication device, and password attribute information.

[0076] During specific implementation, the client sends a registration request for a multi-factor authentication device to a network security device. The registration request carries the user's account information, the identification information of the multi-factor authentication device, and password attribute information. The password attribute information is the description information of the password information generated by the multi-factor authentication device, that is, the parameter object of identity authentication.

[0077] The registration request for a multi-factor authentication device may include the following information as shown in Table 1:

[0078]

[0079]

[0080] As shown in Table 1, UserName is the user name in the user's account information, and may also include UserAliasName, that is, the user alias, MFAID is the identifier of the multi-factor authentication device, and the remaining parameters are password attribute information.

[0081] S32: Register the multi-factor identity authentication device, and store the corresponding relationship between the user's account information and the identification information of the multi-factor identity authentication device in a database.

[0082] After receiving the registration request for the multi-factor authentication device sent by the client, the network security device registers the multi-factor authentication device, and after successfully registering the multi-factor authentication device, binds the user's account information with the identification information of the multi-factor authentication device, and stores the correspondence between the user's account information and the identification information of the multi-factor authentication device in a database.

[0083] Specifically, the network security device may bind the user name information with the identification information of the multi-factor identity authentication device, and store the corresponding relationship between the user name information and the identification information of the multi-factor identity authentication device in a database.

[0084] S33. Return registration result information to the client.

[0085] In specific implementation, the network security device returns registration result information to the client, and the registration result information includes whether the registration is successful, the user's account information, the identification information of the multi-factor identity authentication device, and confirmation information of the password attribute information.

[0086] The registration result information returned by the network security device to the client may include the content shown in Table 2:

[0087]

[0088] When the network security device successfully registers the multi-factor authentication device, the client sends instruction information to the multi-factor authentication device, instructing the multi-factor authentication device to send the password information, generation time information and expiration time information generated by the multi-factor authentication device to the network security device.

[0089] The network security device receives the user's account information, password information, password information generation time information and password information expiration time information sent by the multi-factor authentication device, wherein the password information is a one-time password generated by the multi-factor authentication device for the user, and the password information is used for secondary login authentication of the user. The network security device stores the user's account information (i.e., the user name in the user's account information) sent by the multi-factor authentication device, the correspondence between the identification information of the multi-factor authentication device and the password information, and the password information generation time information and expiration time information in a database.

[0090] After the client obtains the first password information currently generated by the multi-factor authentication device from the multi-factor authentication device, the client carries the user's account information, the identification information of the multi-factor authentication device, and the first password information generated by the multi-factor authentication device in the second login request, and sends the second login request to the network security device. After receiving the second login request sent by the client, the network security device extracts the user's account information (that is, extracts the user name in the user's account information), the identification information of the multi-factor authentication device, and the first password information from the second login request.

[0091] S24. The network security device obtains second password information corresponding to the user account information and the identification information of the multi-factor identity authentication device from a database according to the correspondence between the user account information, the identification information of the multi-factor identity authentication device, and the password information.

[0092] During specific implementation, the network security device queries the password information corresponding to the user account information and the identification information of the multi-factor authentication device in the second login request based on the correspondence between the user account information, the identification information of the multi-factor authentication device and the password information stored in the database, which can be recorded as the second password information.

[0093] Specifically, the network security device queries the password information corresponding to the username in the second login request and the identification information of the multi-factor authentication device according to the correspondence between the username, the identification information of the multi-factor authentication device and the password information stored in the database, which can be recorded as the second password information.

[0094] S25. The network security device performs secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result.

[0095] In specific implementation, if the network security device determines that the first password information is the same as the second password information, and determines that the second password information has not expired based on the expiration time information of the second password information, then it is determined that the second login authentication is passed; if it is determined that the first password information is the same as the second password information, and determines that the second password information has expired based on the expiration time information of the second password information, or if it is determined that the first password information is different from the second password information, then it is determined that the second login authentication of the user has failed.

[0096] Specifically, the network security device may determine whether the second password information is expired in the following manner:

[0097] The target time is obtained by adding the generation time of the second password information to the expiration time, and the current time is compared with the target time. If the current time does not exceed the target time, it is determined that the second password information has not expired. If the current time exceeds the target time, it is determined that the second password information has expired. For example, if the generation time of the second password information is 10 o'clock and the expiration time is less than 30 seconds, the target time for the expiration of the second password information is: 10:30 seconds. Assuming that the current time is 10:15 seconds and the current time does not exceed the target time, the second password information has not expired. If the current time is less than 10:31 seconds and the current time exceeds the target time, the second password information has expired.

[0098] In the login authentication method provided by the embodiment of the present application, a network security device receives a first login request sent by a client, the first login request carries the identity authentication information of the user, the identity authentication information of the user includes the account information of the user, performs preliminary login authentication on the user based on the identity authentication information of the user, and returns a preliminary login authentication success response message to the client after the preliminary login authentication passes, receives a second login request sent by the client, the second login request carries the account information of the user, the identification information of the multi-factor identity authentication device, and the first password information generated by the multi-factor identity authentication device, obtains the second password information corresponding to the account information of the user and the identification information of the multi-factor identity authentication device from a database according to the correspondence between the account information of the user, the identification information of the multi-factor identity authentication device, and the password information, and then performs secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result. Compared with the prior art, in the embodiment of the present application, the network security device is based on multi-factor identity authentication. It adds a layer of identity authentication on the basis of the initial login authentication of the user based on the user's identity authentication information, and performs a secondary login authentication on the user through a dynamic password generated by the multi-factor identity authentication device. Thus, it provides a more secure and reliable identity security management for the network security device, effectively prevents attackers from making unauthorized access to the network security device, improves the security and robustness of the network security device, and effectively reduces security risks.

[0099] Based on the same inventive concept, the embodiment of the present application also provides a login authentication device. Since the principle of solving the problem by the above-mentioned login authentication device is similar to that of the above-mentioned login authentication method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0100] like Figure 4 As shown, it is a schematic diagram of the structure of a login authentication device provided in an embodiment of the present application. The login authentication device is applied to a network security device and may include:

[0101] A first receiving module 41 is configured to receive a first login request sent by a client, wherein the first login request carries the user's identity authentication information, and the user's identity authentication information includes the user's account information;

[0102] The first authentication module 42 is used to perform a preliminary login authentication on the user based on the identity authentication information of the user, and return a preliminary login authentication success response message to the client after the preliminary login authentication passes;

[0103] A second receiving module 43 is used to receive a second login request sent by the client, where the second login request carries the account information of the user, the identification information of the multi-factor identity authentication device, and the first password information generated by the multi-factor identity authentication device;

[0104] The acquisition module 44 is used to acquire, from a database, second password information corresponding to the user's account information and the identification information of the multi-factor identity authentication device according to the correspondence between the user's account information, the identification information of the multi-factor identity authentication device and the password information;

[0105] The second authentication module 45 is used to perform secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result.

[0106] In one embodiment, the device further comprises:

[0107] A third receiving module is configured to receive, before receiving the first login request sent by the client, a registration request for the multi-factor authentication device sent by the client, the registration request carrying the account information of the user, the identification information of the multi-factor authentication device and password attribute information, the password attribute information being description information of the password information generated by the multi-factor authentication device;

[0108] A registration module, configured to register the multi-factor identity authentication device and store the corresponding relationship between the user's account information and the identification information of the multi-factor identity authentication device in the database;

[0109] The return module is used to return the registration result information to the client.

[0110] In one embodiment, the device further comprises:

[0111] a fourth receiving module, configured to receive, after the multi-factor identity authentication device is successfully registered, the account information, password information and expiration time information of the password information of the user sent by the multi-factor identity authentication device, wherein the password information is a one-time password generated by the multi-factor identity authentication device for the user, and the password information is used to perform secondary login authentication on the user;

[0112] The storage module is used to store the user's account information, the corresponding relationship between the identification information of the multi-factor identity authentication device and the password information, and the expiration time information of the password information in the database.

[0113] In one embodiment, the second authentication module 45 is specifically used to determine that the second login authentication is passed if it is determined that the first password information is the same as the second password information, and it is determined that the second password information is not expired based on the expiration time information of the second password information; if it is determined that the first password information is the same as the second password information, and it is determined that the second password information is expired based on the expiration time information of the second password information, or if it is determined that the first password information is different from the second password information, then determine that the second login authentication of the user has failed.

[0114] Based on the same technical concept, the embodiment of the present application also provides an electronic device 500, referring to Figure 5 As shown, the electronic device 500 is used to implement the login authentication method described in the above method embodiment. The electronic device 500 of this embodiment may include: a memory 501, a processor 502, and a computer program stored in the memory and executable on the processor, such as a login authentication program. When the processor executes the computer program, the steps in the above login authentication method embodiments are implemented.

[0115] The specific connection medium between the memory 501 and the processor 502 is not limited in the embodiment of the present application. Figure 5 In the embodiment, the memory 501 and the processor 502 are connected via a bus 503. The bus 503 is connected to the processor 502 via a bus 503. Figure 5 The connection between other components is shown by bold lines, which is only for schematic illustration and is not intended to be limiting. The bus 503 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0116] The memory 501 may be a volatile memory, such as a random-access memory (RAM); the memory 501 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 501 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 501 may be a combination of the above memories.

[0117] Processor 502 is used to implement the login authentication method provided in the embodiment of the present application.

[0118] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0119] In some possible implementations, various aspects of the login authentication method provided in the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the login authentication method described above in this specification according to various exemplary implementations of the present application.

[0120] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0121] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0122] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0123] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0124] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0125] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A login authentication method, characterized in that: Applied to network security equipment, including: Receive a first login request sent by a client, where the first login request carries identity authentication information of a user, where the identity authentication information of the user includes account information of the user; Performing a preliminary login authentication on the user based on the user's identity authentication information, and returning a preliminary login authentication success response message to the client after the preliminary login authentication passes; receiving a second login request sent by the client, wherein the second login request carries the account information of the user, the identification information of the multi-factor identity authentication device, and the first password information generated by the multi-factor identity authentication device; According to the correspondence between the user's account information, the identification information of the multi-factor identity authentication device and the password information, obtaining second password information corresponding to the user's account information and the identification information of the multi-factor identity authentication device from a database; A secondary login authentication is performed on the user based on the first password information and the second password information to obtain an authentication result.

2. The method according to claim 1, characterized in that Before receiving the first login request sent by the client, the method further includes: receiving a registration request for the multi-factor authentication device sent by the client, the registration request carrying the account information of the user, the identification information of the multi-factor authentication device, and password attribute information, wherein the password attribute information is description information of the password information generated by the multi-factor authentication device; Registering the multi-factor identity authentication device, and storing the correspondence between the user's account information and the identification information of the multi-factor identity authentication device in the database; Return registration result information to the client.

3. The method according to claim 2, characterized in that After the multi-factor authentication device is successfully registered, the method further includes: Receiving the user's account information, password information, and expiration time information of the password information sent by the multi-factor identity authentication device, wherein the password information is a one-time password generated by the multi-factor identity authentication device for the user, and the password information is used to perform secondary login authentication on the user; The user's account information, the correspondence between the identification information of the multi-factor identity authentication device and the password information, and the expiration time information of the password information are stored in the database.

4. The method according to claim 1 or 3, characterized in that Performing secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result specifically includes: If it is determined that the first password information is the same as the second password information, and it is determined that the second password information has not expired according to the expiration time information of the second password information, then it is determined that the secondary login authentication is passed; If it is determined that the first password information is the same as the second password information, and it is determined that the second password information has expired based on the expiration time information of the second password information, or if it is determined that the first password information is different from the second password information, it is determined that the secondary login authentication of the user has failed.

5. A login authentication device, characterized in that: Applied to network security equipment, including: A first receiving module, configured to receive a first login request sent by a client, wherein the first login request carries the identity authentication information of the user, and the identity authentication information of the user includes the account information of the user; A first authentication module, configured to perform a preliminary login authentication on the user based on the identity authentication information of the user, and return a preliminary login authentication success response message to the client after the preliminary login authentication passes; A second receiving module is used to receive a second login request sent by the client, where the second login request carries the account information of the user, the identification information of the multi-factor identity authentication device, and the first password information generated by the multi-factor identity authentication device; an acquisition module, configured to acquire, from a database, second password information corresponding to the user's account information and the identification information of the multi-factor identity authentication device according to a correspondence between the user's account information, the identification information of the multi-factor identity authentication device, and the password information; The second authentication module is used to perform a secondary login authentication on the user based on the first password information and the second password information to obtain an authentication result.

6. The device according to claim 5, characterized in that Also includes: A third receiving module is configured to receive, before receiving the first login request sent by the client, a registration request for the multi-factor authentication device sent by the client, the registration request carrying the account information of the user, the identification information of the multi-factor authentication device and password attribute information, the password attribute information being description information of the password information generated by the multi-factor authentication device; A registration module, configured to register the multi-factor identity authentication device and store the corresponding relationship between the user's account information and the identification information of the multi-factor identity authentication device in the database; The return module is used to return the registration result information to the client.

7. The device according to claim 6, characterized in that Also includes: a fourth receiving module, configured to receive, after the multi-factor identity authentication device is successfully registered, the account information, password information and expiration time information of the password information of the user sent by the multi-factor identity authentication device, wherein the password information is a one-time password generated by the multi-factor identity authentication device for the user, and the password information is used to perform secondary login authentication on the user; The storage module is used to store the user's account information, the corresponding relationship between the identification information of the multi-factor identity authentication device and the password information, and the expiration time information of the password information in the database.

8. The device according to claim 5 or 7, characterized in that The second authentication module is specifically configured to determine that the secondary login authentication is passed if it is determined that the first password information is the same as the second password information and that the second password information is not expired according to the expiration time information of the second password information; If it is determined that the first password information is the same as the second password information, and it is determined that the second password information has expired based on the expiration time information of the second password information, or if it is determined that the first password information is different from the second password information, it is determined that the secondary login authentication of the user has failed.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the login authentication method according to any one of claims 1 to 4 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the login authentication method according to any one of claims 1 to 4 are implemented.

Images