Enterprise user information security authentication system based on cloud service

Abstract

The embodiment of the invention discloses an enterprise user information security authentication system based on cloud service. The system comprises a key authentication unit and an IP authentication unit, wherein the key authentication unit comprises at least two of an account password authentication unit, a dynamic verification code authentication unit, a dynamic password authentication unit, a biological recognition authentication unit and an SSH authentication unit; and the user access authentication unit is used for verifying the access IP corresponding to the data access request, determining the risk level of the access IP according to the verification result, and selecting the authentication unit in the key authentication unit to authenticate the access terminal corresponding to the access IP according to the risk level of the access IP. According to the embodiment of the invention, the risk level of the access terminal is determined according to the IP authentication unit, different types and numbers of authentication units are selected from the key authentication unit according to different risk levels to authenticate the access terminal, and the access terminal can access the data stored in the cloud server only after the authentication is passed. Therefore, the security of the data is ensured.

Description

Technical Field

[0001] One or more embodiments of this specification relate to information security authentication technology, and in particular, to an enterprise user information security authentication system based on cloud services. Background Art

[0002] Cloud service is a way of providing computing, storage, network and other services through Internet technology, allowing users to manage their data and business more conveniently and efficiently. Its management method is simpler and more efficient than that of physical servers. Users can quickly create or release any number of cloud servers without having to purchase hardware in advance. With the rapid development and widespread application of cloud service technology, more and more companies choose to store their business data and applications in the cloud, which brings new challenges to information security. Cloud service providers need to ensure that users' data is fully protected, but there is currently no cloud service user information security authentication method with good data protection effect. Summary of the invention

[0003] In order to solve the above problems, one or more embodiments of this specification describe an enterprise user information security authentication system based on cloud services.

[0004] According to a first aspect, a cloud service-based enterprise user information security authentication system is provided, the system comprising a cloud server, the cloud server comprising a user access authentication unit, the user access authentication unit comprising a key authentication unit and an IP authentication unit, the key authentication unit comprising at least two of an account password authentication unit, a dynamic verification code authentication unit, a dynamic password authentication unit, a biometric authentication unit, and an SSH authentication unit; The user access authentication unit is used to receive a data access request for the cloud server, verify the access IP corresponding to the data access request according to the IP authentication unit, and determine the risk level of the access IP according to the verification result, and select an authentication unit in the key authentication unit to authenticate the access terminal corresponding to the access IP according to the risk level of the access IP.

[0005] Preferably, determining the risk level of the access IP according to the verification result includes: When the verification result indicates that the verification is successful, querying the risk level corresponding to the access IP in the mapping database of the cloud server; When the verification result indicates that the verification fails, the risk level of the access IP is determined to be the highest level.

[0006] Preferably, selecting an authentication unit in the key authentication unit to authenticate an access terminal corresponding to the access IP according to the risk level of the access IP includes: The selection information is determined according to the risk level of the access IP, and an authentication unit matching the selection information is randomly selected in the key authentication unit to authenticate the access terminal corresponding to the access IP. The selection information includes the number of units that need to be authenticated and / or the target unit that must be selected.

[0007] Preferably, the IP authentication unit includes an IP acquisition module, an IP identification module and an IP verification module, the IP acquisition module is used to obtain the access IP corresponding to the data access request, the IP identification module is used to identify the access terminal corresponding to the access IP, and the IP verification module is used to verify the legitimacy of the access terminal.

[0008] Preferably, the cloud server is also used to allocate data access rights to the access terminal according to the key authentication result of the access terminal.

[0009] Preferably, the account and password authentication unit includes a user name recognition module and a password recognition module, the user name recognition module is used to recognize the user name input by the access terminal, and the password recognition module is used to recognize the password input by the access terminal.

[0010] Preferably, the dynamic verification code authentication unit comprises a verification code sending module and a verification code receiving module, the verification code sending module is used to send the verification code to a preset terminal, and the verification code receiving module is used to receive the verification code input by the access terminal.

[0011] Preferably, the dynamic password authentication unit includes a password generation module and a password verification module, the password generation module is used to generate a new password after receiving a registration instruction sent by any legal terminal, and the password verification module is used to compare and verify the received password with each stored password.

[0012] Preferably, the biometric authentication unit includes at least one of a fingerprint recognition module, a facial recognition module and a voiceprint recognition module.

[0013] Preferably, the SSH authentication unit includes a public key identification module and a private key identification module, the public key identification module is used to receive the public key sent by any legitimate terminal and upload it to the cloud server, and the private key identification module is used to receive the private key and verify the private key according to the public key stored in the cloud server.

[0014] The system provided in the embodiments of this specification can determine the risk level of the access terminal based on the IP authentication unit after the cloud server receives a data access request, and select different types and numbers of authentication units in the key authentication unit to authenticate the access terminal according to different risk levels. Only after passing the authentication can the access terminal access the data stored in the cloud server, thereby ensuring the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 This is a schematic diagram of the architecture of an enterprise user information security authentication system based on cloud services in one embodiment of this specification.

[0017] Figure 2 It is a schematic diagram of the architecture of an account and password authentication unit in one embodiment of this specification.

[0018] Figure 3 It is a schematic diagram of the architecture of a dynamic verification code authentication unit in one embodiment of this specification.

[0019] Figure 4 It is a schematic diagram of the architecture of a dynamic password authentication unit in one embodiment of this specification.

[0020] Figure 5 It is a schematic diagram of the architecture of a biometric authentication unit in one embodiment of this specification.

[0021] Figure 6 It is a schematic diagram of the architecture of an SSH authentication unit in one embodiment of this specification. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0023] In the following introduction, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. The following introduction provides multiple embodiments of the present application, and different embodiments can be replaced or combined, so the present application can also be considered to include all possible combinations of the same and / or different embodiments recorded. Therefore, if one embodiment includes features A, B, and C, and another embodiment includes features B and D, then the present application should also be considered to include embodiments containing one or more of all other possible combinations of A, B, C, and D, although the embodiment may not be clearly recorded in the following text.

[0024] The following description provides examples and does not limit the scope, applicability or examples set forth in the claims. Changes may be made to the functions and arrangements of the elements described without departing from the scope of the present application. Various processes or components may be appropriately omitted, substituted or added to each example. For example, the described method may be performed in an order different from the order described, and various steps may be added, omitted or combined. In addition, features described in some examples may be combined in other examples.

[0025] See also Figure 1 , Figure 1 It is a schematic diagram of the architecture of a cloud service-based enterprise user information security authentication system provided in an embodiment of the present application. In the embodiment of the present application, the system includes: a cloud server 1, the cloud server 1 includes a user access authentication unit 2, the user access authentication unit 2 includes a key authentication unit 3 and an IP authentication unit 4, the key authentication unit 3 includes at least two of an account password authentication unit 5, a dynamic verification code authentication unit 6, a dynamic password authentication unit 7, a biometric authentication unit 8, and an SSH authentication unit 9; The user access authentication unit 2 is used to receive a data access request for the cloud server 1, verify the access IP corresponding to the data access request according to the IP authentication unit 4, and determine the risk level of the access IP according to the verification result, and select an authentication unit in the key authentication unit 3 according to the risk level of the access IP to authenticate the access terminal corresponding to the access IP.

[0026] In the embodiments of this specification, Figure 1, which shows a schematic diagram of the system architecture that is expanded step by step according to the direction of the arrow. In addition to the units that realize other functions such as data storage and data processing, the cloud server 1 will also be additionally provided with a user access authentication unit 2 specifically used for security authentication of the accessing user. The user access authentication unit 2 includes a key authentication unit 3 and an IP authentication unit 4, which are used for key authentication and IP authentication respectively. The key authentication unit 3 will specifically be provided with multiple authentication units, and different authentication units can perform authentication in different ways. When a user uses an access terminal to send a data access request to the cloud server 1, the request will be specifically received by the user access authentication unit 2 in the cloud server 1. After receiving the request, the user access authentication unit 2 will first determine the access IP of the access terminal through the IP authentication unit 4, and verify the access IP. The specific process of verification can be to compare the access IP with the stored IP to verify whether the access IP is a legitimate IP stored and authenticated in the cloud server 1. According to different verification results, the access IP will be assigned different risk levels. The higher the risk level, the more unreliable the access IP is, and the greater the risk caused by accessing the data. Therefore, for access IPs with higher risk levels, they will be authenticated in a more stringent manner, that is, access terminals with higher risk levels may need to pass more authentication units in the key authentication unit 3 before they can access the cloud server. Finally, the user access authentication unit 2 will select specific authentication units for the authentication process according to the determined risk level, and send authentication information to the access terminal through these authentication units to instruct the access terminal to perform authentication.

[0027] In one possible implementation, determining the risk level of the access IP according to the verification result includes: When the verification result indicates that the verification is successful, query the risk level corresponding to the access IP in the mapping database of the cloud server 1; When the verification result indicates that the verification fails, the risk level of the access IP is determined to be the highest level.

[0028] In the embodiment of the present specification, a mapping database is pre-set in the cloud server 1, which stores the mapping relationship between different terminal IPs and risk levels, and the mapping relationship can be pre-assigned and set by the staff according to experience. According to the mapping database, for each terminal IP stored in the cloud server 1 that has been authenticated as a legitimate terminal, different risk levels are assigned according to the importance or security requirements of the terminal IP. If the access IP passes the verification, it means that the terminal IP matching the access IP is queried in the cloud server 1, that is, the access IP is a legitimate IP, and the risk level corresponding to the access IP will be directly queried according to the mapping database. If the verification result is characterized as a verification failure, it means that the access IP has not passed the verification, that is, the access IP does not exist in the cloud server 1, that is, the terminal currently requesting access is a brand new terminal that has not been accessed before. At this time, in order to ensure data security, the risk level of the access IP is determined to be the highest level, and only after passing the highest level of authentication, the access IP can access the data.

[0029] In one possible implementation, selecting an authentication unit in the key authentication unit 3 according to the risk level of the access IP to authenticate the access terminal corresponding to the access IP includes: The selection information is determined according to the risk level of the access IP, and an authentication unit matching the selection information is randomly selected in the key authentication unit 3 to authenticate the access terminal corresponding to the access IP. The selection information includes the number of units that need to be authenticated and / or the target unit that must be selected.

[0030] In the embodiment of the present specification, different risk levels are pre-set with different selection information, and the selection information includes the number of authentication units that need to be selected for authentication, and the target unit that must be selected when selecting the authentication unit. After the risk level of the access IP is determined, the selection information corresponding to the risk level can be queried, and the key authentication unit 3 will randomly select each authentication unit that meets the selection information requirements from each authentication unit according to the selection information, and control these authentication units to send authentication information to the access terminal respectively, so as to perform different aspects of authentication at the same time.

[0031] In one possible implementation, the IP authentication unit 4 includes an IP acquisition module 10, an IP identification module 11 and an IP verification module 12, the IP acquisition module 10 is used to obtain the access IP corresponding to the data access request, the IP identification module 11 is used to identify the access terminal corresponding to the access IP, and the IP verification module 12 is used to verify the legitimacy of the access terminal.

[0032] In the embodiment of the present specification, the IP authentication unit 4 is specifically composed of an IP acquisition module 10, an IP identification module 11 and an IP verification module 12. Among them, the IP acquisition module 10 is mainly used to determine the access IP that sends the request according to the sending path of the data access request. The IP identification module 11 is mainly used to determine the specific identity or location of the access terminal corresponding to the device on the network through the address of the access IP by means of geographic positioning, domain name resolution, network scanning, etc. The IP verification module 12 is mainly used to query the access terminal in the legal terminal list of the database to verify the legitimacy of the access terminal.

[0033] In one possible implementation, the cloud server 1 is further configured to allocate data access rights to the access terminal according to a key authentication result of the access terminal.

[0034] In the embodiment of this specification, the cloud server 1 receives the key authentication results of each authentication unit and allocates data access rights to the access terminal according to the key authentication results. Specifically, only when all key authentication results indicate that the authentication is passed, the cloud server 1 will allocate data access rights to the access terminal to access the data, otherwise the access terminal will be prohibited from continuing to access.

[0035] In one possible implementation, the account and password authentication unit 5 includes a user name recognition module 501 and a password recognition module 502, wherein the user name recognition module 501 is used to recognize the user name input by the access terminal, and the password recognition module 502 is used to recognize the password input by the access terminal.

[0036] In the embodiments of the present specification, the account and password authentication unit 5 will respectively identify the user name and password input by the access terminal through the user name identification module 501 and the password identification module 502. That is to say, the user name and password are obtained from the access terminal respectively, and then matched and authenticated in the account and password authentication unit 5, which can further increase security.

[0037] In one possible implementation, the dynamic verification code authentication unit 6 includes a verification code sending module 601 and a verification code receiving module 602, wherein the verification code sending module 601 is used to send a verification code to a preset terminal, and the verification code receiving module 602 is used to receive a verification code input by the access terminal.

[0038] In the embodiment of the present specification, the dynamic verification code authentication unit 6 is composed of a verification code sending module 601 and a verification code receiving module 602. Among them, the verification code sending module 601 does not necessarily send the verification code to the access terminal, but sends the verification code to the preset terminal set corresponding to the risk level. In this way, if the user is a legitimate user and just changes a terminal for access, he can set his mobile phone as the preset terminal, obtain the verification code through the preset terminal, and then fill in the verification code through the access terminal for authentication. If the user is an illegal user, the user will not be able to obtain the verification code directly, and will not be able to pass the verification, thereby further ensuring the security of data access.

[0039] In one possible implementation, the dynamic password authentication unit 7 includes a password generation module 701 and a password verification module 702, wherein the password generation module 701 is used to generate a new password after receiving a registration instruction sent by any legitimate terminal, and the password verification module 702 is used to compare and verify the received password with the stored passwords.

[0040] In the embodiment of the present specification, the dynamic password authentication unit 7 is composed of a password generation module 701 and a password verification module 702. Any legal terminal can send a registration instruction to the dynamic password authentication unit 7 to register and generate a new password. When performing password verification, the user needs to send a password to the password verification module 702 through the access terminal, and only when the password is successfully matched with the stored password after verification, the password authentication is considered to be passed.

[0041] In one possible implementation, the biometric authentication unit 8 includes at least one of a fingerprint recognition module 801 , a facial recognition module 802 , and a voiceprint recognition module 803 .

[0042] In the embodiment of this specification, the biometric authentication unit 8 can be configured with different modules according to actual conditions, or can be configured as a combination of multiple modules, and the modules can specifically include a fingerprint recognition module 801, a facial recognition module 802, and a voiceprint recognition module 803. The user needs to send his or her fingerprint data, facial data, or voiceprint data under instruction, and only when the data matches the pre-stored legitimate data, the biometric authentication is considered to be passed.

[0043] In one possible implementation, the SSH authentication unit 9 includes a public key identification module 901 and a private key identification module 902, wherein the public key identification module 901 is used to receive a public key sent by any legitimate terminal and upload it to the cloud server 1, and the private key identification module 902 is used to receive a private key and verify the private key based on the public key stored in the cloud server 1.

[0044] In the embodiment of the present specification, a legitimate user will first generate an SSH key pair in the SSH authentication unit 9, and the SSH key pair consists of a public key and a private key, wherein the public key will be sent to the public key identification module 901, which will be sent to the cloud server 1 for storage, and the private key will be kept by the user himself. When the user needs to authenticate through the access terminal, the user will send the private key to the private key identification module 902 through the access terminal, and the private key identification module 902 will verify the private key according to the stored public key. If a public key matching the private key can be queried, the authentication is successful.

[0045] Those skilled in the art can clearly understand that the technical solutions of the embodiments of the present application can be implemented with the help of software and / or hardware. The "unit" and "module" in this specification refer to software and / or hardware that can independently complete or cooperate with other components to complete specific functions, where the hardware can be, for example, a field programmable gate array (FPGA), an integrated circuit (IC), etc.

[0046] Each processing unit and / or module of the embodiments of the present application may be implemented by an analog circuit that implements the functions described in the embodiments of the present application, or may be implemented by software that executes the functions described in the embodiments of the present application.

[0047] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0048] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A cloud service-based enterprise user information security authentication system, characterized in that: The system comprises a cloud server (1), the cloud server (1) comprises a user access authentication unit (2), the user access authentication unit (2) comprises a key authentication unit (3) and an IP authentication unit (4), the key authentication unit (3) comprises at least two of an account password authentication unit (5), a dynamic verification code authentication unit (6), a dynamic password authentication unit (7), a biometric authentication unit (8) and an SSH authentication unit (9); The user access authentication unit (2) is used to receive a data access request for the cloud server (1), verify the access IP corresponding to the data access request according to the IP authentication unit (4), determine the risk level of the access IP according to the verification result, and select an authentication unit in the key authentication unit (3) to authenticate the access terminal corresponding to the access IP according to the risk level of the access IP.

2. The system according to claim 1, characterized in that Determining the risk level of the access IP according to the verification result includes: When the verification result indicates that the verification is successful, querying the risk level corresponding to the access IP in the mapping database of the cloud server (1); When the verification result indicates that the verification fails, the risk level of the access IP is determined to be the highest level.

3. The system according to claim 1, characterized in that The step of selecting an authentication unit in the key authentication unit (3) according to the risk level of the access IP to authenticate the access terminal corresponding to the access IP comprises: The selection information is determined according to the risk level of the access IP, and an authentication unit matching the selection information is randomly selected in the key authentication unit (3) to authenticate the access terminal corresponding to the access IP, wherein the selection information includes the number of units that need to be authenticated and / or the target unit that must be selected.

4. The system according to claim 1, characterized in that The IP authentication unit (4) comprises an IP acquisition module (10), an IP identification module (11) and an IP verification module (12), wherein the IP acquisition module (10) is used to acquire the access IP corresponding to the data access request, the IP identification module (11) is used to identify the access terminal corresponding to the access IP, and the IP verification module (12) is used to verify the legitimacy of the access terminal.

5. The system according to claim 1, characterized in that The cloud server (1) is also used to allocate data access rights to the access terminal according to the key authentication result of the access terminal.

6. The system according to claim 1, characterized in that The account password authentication unit (5) comprises a user name recognition module (501) and a password recognition module (502), wherein the user name recognition module (501) is used to recognize a user name input by the access terminal, and the password recognition module (502) is used to recognize a password input by the access terminal.

7. The system according to claim 1, characterized in that The dynamic verification code authentication unit (6) comprises a verification code sending module (601) and a verification code receiving module (602), wherein the verification code sending module (601) is used to send a verification code to a preset terminal, and the verification code receiving module (602) is used to receive a verification code input by the access terminal.

8. The system according to claim 1, characterized in that The dynamic password authentication unit (7) comprises a password generation module (701) and a password verification module (702), wherein the password generation module (701) is used to generate a new password after receiving a registration instruction sent by any legal terminal, and the password verification module (702) is used to compare and verify the received password with each stored password.

9. The system according to claim 1, characterized in that The biometric authentication unit (8) comprises at least one of a fingerprint recognition module (801), a facial recognition module (802) and a voiceprint recognition module (803).

10. The system according to claim 1, characterized in that The SSH authentication unit (9) comprises a public key identification module (901) and a private key identification module (902), wherein the public key identification module (901) is used to receive a public key sent by any legal terminal and upload it to the cloud server (1), and the private key identification module (902) is used to receive a private key and verify the private key according to the public key stored in the cloud server (1).

Images