Authentication method, system and device capable of safely accessing internal private network and medium

Abstract

The invention discloses an authentication method, system and device capable of securely accessing an internal private network and a storage medium, and the method comprises the following steps: obtaining SIM card information and a device identification code of security access equipment when the security access equipment is inserted into mobile office equipment and requests network connection; according to the SIM card information and the equipment identification code, determining that the security access equipment is legal equipment, and detecting personal biological characteristics of a user; and based on the personal biological characteristics, authenticating the access authority of the security access device to obtain an authentication result. According to the method, the risk of data leakage can be reduced, and the security of private network access is improved. The method can be widely applied to the technical field of network communication.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to an authentication method, system, device and storage medium that can securely access an internal private network. Background Art

[0002] In the related art, in order to ensure data security and office convenience of enterprises and institutions, designers usually build a private network internally, and remote office personnel can access this private network through a dedicated VPN or VPDN. However, due to the data security risks in mobile office environments such as hotel networks and library networks, and the VPDN / VP N solution requires users to log in with their account and password during access authentication, the method of accessing a private network through a dedicated VPN or VPDN has the risk of password leakage, resulting in its poor security. Therefore, there are still technical problems that need to be solved in the related art. Summary of the invention

[0003] The purpose of this application is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0004] To this end, one purpose of an embodiment of the present application is to provide an authentication method, system, device and storage medium that can securely access an internal private network. This solution can reduce the risk of data leakage and improve the security of private network access.

[0005] In order to achieve the above technical objectives, the technical solution adopted by the embodiment of the present application includes: an authentication method for securely accessing an internal private network, comprising: when a secure access device is inserted into a mobile office device and requests a network connection, obtaining SIM card information and a device identification code of the secure access device;

[0006] Determine that the secure access device is a legitimate device based on the SIM card information and the device identification code, and detect the user's personal biometrics;

[0007] Based on the personal biometrics, the access authority of the security access device is authenticated to obtain an authentication result.

[0008] The embodiment of the present application can obtain the SIM card information and device identification code of the security access device when the security access device is inserted into the mobile office device and requests a network connection; determine that the security access device is a legal device based on the SIM card information and the device identification code, and detect the user's personal biometrics; based on the personal biometrics, authenticate the access rights of the security access device to obtain an authentication result. The present application identifies legal devices through SIM card information and device identification codes, and on the premise of legal devices, obtains authentication results by identifying the user's biometric information. The present application can reduce the risk of data leakage and improve the security of private network access through multiple authentications.

[0009] In addition, the authentication method for securely accessing an internal private network according to the above embodiment of the present invention may also have the following additional technical features:

[0010] Further, in the embodiment of the present application, determining that the secure access device is a legitimate device according to the SIM card information and the device identification code specifically includes:

[0011] According to the SIM card information, determining whether the SIM card of the secure access device is a legitimate SIM card;

[0012] If the SIM card is a legitimate SIM card, the secure access device is determined to be a legitimate device according to the device identification code.

[0013] Further, in the embodiment of the present application, determining that the secure access device is a legitimate device according to the device identification code specifically includes:

[0014] Configure an identification code set; the identification code set includes a plurality of preset device identification codes;

[0015] When the device identification code is identical to any one of the preset device identification codes in the identification code set, it is determined that the security access device corresponding to the device identification code is a legal device.

[0016] Further, in the embodiment of the present application, judging whether the SIM card of the secure access device is a legitimate SIM card according to the SIM card information specifically includes:

[0017] When the card number of the SIM card is the same as the preset card number, determining that the SIM card of the secure access device is a legitimate SIM card;

[0018] When the card number of the SIM card is different from the preset card number, it is determined that the SIM card of the security access device is an illegal SIM card.

[0019] Further, in the embodiment of the present application, authenticating the access authority of the secure access device based on the personal biometric feature to obtain the authentication result specifically includes:

[0020] Extracting a first similarity between the personal biometric feature and a preset feature;

[0021] authenticating the access authority of the security access device, and when the first similarity is less than a preset similarity threshold, determining that the authentication result is an access authority authentication failure;

[0022] The access authority of the secure access device is authenticated, and when the first similarity is greater than or equal to the preset similarity threshold, the authentication result is determined to be a successful access authority authentication.

[0023] Furthermore, in the embodiment of the present application, the method further includes:

[0024] When the authentication result is that the access authority authentication is successful, a prompt message is generated, and the prompt message is used to prompt the user that the authentication is successful.

[0025] On the other hand, the embodiment of the present application also provides an authentication system that can securely access an internal private network, including:

[0026] An acquisition unit, used to acquire SIM card information and a device identification code of the security access device when the security access device is inserted into the mobile office device and requests a network connection;

[0027] A first processing unit, configured to determine that the secure access device is a legitimate device according to the SIM card information and the device identification code, and detect a user's personal biometric characteristics;

[0028] The second processing unit is used to authenticate the access authority of the security access device based on the personal biometric feature to obtain an authentication result.

[0029] Furthermore, in the embodiment of the present application, the system also includes a third processing unit; the third processing unit is used to generate a prompt message when the authentication result is that the access authority authentication is successful, and the prompt message is used to prompt the user that the authentication is successful.

[0030] On the other hand, the present application also provides an authentication device that can securely access an internal private network, including:

[0031] at least one processor;

[0032] at least one memory for storing at least one program;

[0033] When the at least one program is executed by the at least one processor, the at least one processor implements an authentication method for securely accessing an internal private network as described in any one of the invention contents.

[0034] In addition, the present application also provides a computer-readable storage medium, which stores processor-executable instructions, and the processor-executable instructions are used to execute an authentication method for securely accessing an internal private network as described in any of the above items when executed by the processor.

[0035] The advantages and benefits of the present application will be partially given in the following description, and partially become apparent from the following description, or be understood through the practice of the present application:

[0036] This application can obtain the SIM card information and device identification code of the security access device when the security access device is inserted into the mobile office device and requests a network connection; determine that the security access device is a legal device based on the SIM card information and device identification code, and detect the user's personal biometrics; based on the personal biometrics, authenticate the access rights of the security access device to obtain an authentication result. This application identifies legal devices through SIM card information and device identification codes, and on the premise of legal devices, obtains authentication results by identifying the user's biometric information. This application can reduce the risk of data leakage and improve the security of private network access through multiple authentications. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A schematic diagram of the steps of an authentication method for securely accessing an internal private network in a specific embodiment of the present invention;

[0038] Figure 2 A schematic diagram of the steps of determining that a secure access device is a legitimate device according to SIM card information and a device identification code in a specific embodiment of the present invention;

[0039] Figure 3 A schematic diagram of the steps of determining that a secure access device is a legitimate device according to a device identification code in a specific embodiment of the present invention;

[0040] Figure 4 A schematic diagram of the steps of authenticating the access authority of a security access device based on personal biometrics and obtaining an authentication result in a specific embodiment of the present invention;

[0041] Figure 5 A schematic diagram of an overall architecture of secure access authentication in a specific embodiment of the present invention;

[0042] Figure 6 A schematic diagram of the structure of a secure access device in a specific embodiment of the present invention;

[0043] Figure 7 A schematic diagram of a functional module of a secure access authentication system in a specific embodiment of the present invention;

[0044] Figure 8 It is a flowchart of the main process of secure access authentication in another specific embodiment of the present invention;

[0045] Fig. 9 It is a structural schematic diagram of an authentication system capable of securely accessing an internal private network in a specific embodiment of the present invention;

[0046] Fig.10It is a structural schematic diagram of an authentication device capable of securely accessing an internal private network in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following describes in detail the embodiments of the present invention in conjunction with the accompanying drawings to illustrate the principles and processes of the authentication method, system, device and storage medium for securely accessing an internal private network in the embodiments of the present invention.

[0048] The following are necessary explanations of the nouns appearing in this application:

[0049] In the related technologies, in order to ensure data security and office convenience of enterprises and institutions, designers usually build a private network internally, and remote office personnel can access this private network through a dedicated VPN or VPDN. However, due to the data security risks in mobile office environments such as hotel networks and library networks, and the VPDN / VP N solution requires users to log in with their account and password during access authentication, the method of accessing a private network through a dedicated VPN or VPDN has the risk of password leakage, resulting in poor security. Therefore, there are still problems in the related technologies that need to be solved urgently.

[0050] In view of the above problems, this application provides an authentication method for securely accessing an internal private network. Figure 1 ,exist Figure 1 The authentication method for securely accessing an internal private network may include steps S101 to S103.

[0051] S101. When a security access device is inserted into a mobile office device and requests a network connection, SIM card information and a device identification code of the security access device are obtained.

[0052] S102: Determine that the secure access device is a legitimate device based on the SIM card information and the device identification code, and detect the user's personal biometrics.

[0053] S103: Authenticate the access authority of the security access device based on personal biometrics to obtain an authentication result.

[0054] It is understandable that each device may correspond to a device identification code. Each SIM card may correspond to a card number. Personal biometrics may be face information, fingerprint information, or iris information, etc. The authentication result may be authentication success or authentication failure.

[0055] In some feasible embodiments of the present application, when the security access device is inserted into the mobile office device and requests a network connection, the processor can establish a wired or wireless connection with the security access device. After the connection is established, the processor can obtain the SIM card information and the device identification code of the security access device. After obtaining the SIM card information and the device identification code, the processor can determine that the security access device is a legal device based on the SIM card information and the device identification code. After determining the legal device, the processor can detect the user's personal biometrics. Through the personal biometrics, the processor can authenticate the access rights of the security access device and obtain an authentication result.

[0056] It should be noted that the above-mentioned wired connection method may include a connection between a mobile device and a processing module, and may also include a connection between a processing module and a hardware device, as well as a wired connection between other devices currently known or to be developed in the future and the processing module; and the above-mentioned wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (Ultra Wide Band) connection, and other wireless connection methods currently known or to be developed in the future.

[0057] In summary, this application can obtain the SIM card information and device identification code of the security access device when the security access device is inserted into the mobile office device and requests a network connection; determine that the security access device is a legal device based on the SIM card information and the device identification code, and detect the user's personal biometrics; based on the personal biometrics, authenticate the access rights of the security access device to obtain an authentication result. This application identifies legal devices through SIM card information and device identification codes, and on the premise of legal devices, obtains authentication results by identifying the user's biometric information. This application can reduce the risk of data leakage and improve the security of private network access through multiple authentications.

[0058] Further, refer to Figure 2 , Figure 2 This is a schematic diagram of the steps of determining that a secure access device is a legitimate device based on SIM card information and device identification code in one embodiment of the present application. Figure 2 In the embodiment, the step may specifically include step S201-step S202.

[0059] S201. Determine whether the SIM card of the security access device is a legal SIM card according to the SIM card information.

[0060] S202: If the SIM card is a legitimate SIM card, determine that the secure access device is a legitimate device based on the device identification code.

[0061] In some feasible embodiments of the present application, the processor can determine whether the SIM card of the security access device is a legal SIM card according to the SIM card information. If the SIM card is a legal SIM card, the processor can determine that the security access device is a legal device according to the device identification code.

[0062] Further, refer to Figure 3 , Figure 3 FIG. 1 is a schematic diagram of a step of determining that a secure access device is a legitimate device according to a device identification code in an embodiment of the present application. Figure 3 This step may specifically include step S301-step S302.

[0063] S301, configuring an identification code set; the identification code set may include a number of preset device identification codes;

[0064] S302: When the device identification code is the same as any preset device identification code in the identification code set, determine that the security access device corresponding to the device identification code is a legitimate device.

[0065] In some feasible embodiments of the present application, the processor may first configure an identification code set. The identification code set may include several preset device identification codes. When the device identification code is the same as any one of the preset device identification codes in the identification code set, the processor may determine that the security access device corresponding to the device identification code is a legitimate device.

[0066] Furthermore, the step of determining whether the SIM card of the security access device is a legitimate SIM card according to the SIM card information may specifically include step S401 or step S402.

[0067] S401: When the card number of the SIM card is the same as the preset card number, determine that the SIM card of the security access device is a legitimate SIM card.

[0068] S402: When the card number of the SIM card is different from the preset card number, it is determined that the SIM card of the security access device is an illegal SIM card.

[0069] In some feasible embodiments of the present application, the processor may compare the SIM card number with the preset card number. When the card number of the SIM card is the same as the preset card number, the processor may determine that the SIM card of the security access device is a legal SIM card. When the card number of the SIM card is different from the preset card number, the processor may determine that the SIM card of the security access device is an illegal SIM card.

[0070] Further, refer to Figure 4 , Figure 4 This is a schematic diagram of the steps of authenticating the access rights of a secure access device based on personal biometrics and obtaining an authentication result in one embodiment of the present application. Figure 4In the process, the step may specifically include step S501-step S502, or step S501 and step S503.

[0071] S501: Extracting a first similarity between an individual's biological feature and a preset feature.

[0072] S502: Authenticate the access authority of the security access device, and when the first similarity is less than a preset similarity threshold, determine that the authentication result is access authority authentication failure.

[0073] S503: Authenticate the access authority of the security access device, and when the first similarity is greater than or equal to a preset similarity threshold, determine that the authentication result is successful access authority authentication.

[0074] In some feasible embodiments of the present application, the processor may first extract a first similarity between the personal biometric feature and the preset feature. Then, the access authority of the security access device is authenticated, and the first similarity may be compared with the preset similarity threshold during authentication. When the first similarity is less than the preset similarity threshold, the authentication result is determined to be a failure of the access authority authentication. When the first similarity is greater than or equal to the preset similarity threshold, the authentication result is determined to be a success of the access authority authentication.

[0075] Furthermore, in the embodiment of the present application, the method may also include step S104.

[0076] S104. When the authentication result is that the access authority authentication is successful, a prompt message is generated, and the prompt message is used to prompt the user that the authentication is successful.

[0077] In some feasible embodiments of the present application, when the security access device is inserted into the mobile office device and requests a network connection, the processor can establish a wired or wireless connection with the security access device. After the connection is established, the processor can obtain the SIM card information and the device identification code of the security access device. After obtaining the SIM card information and the device identification code, the processor can determine that the security access device is a legal device based on the SIM card information and the device identification code. After determining the legal device, the processor can detect the user's personal biometrics. Through the personal biometrics, the processor can authenticate the access authority of the security access device and obtain an authentication result. If the authentication result is that the access authority authentication is successful, the processor can generate a prompt message, and the prompt message is used to prompt the user that the authentication is successful.

[0078] The specific implementation principle of this application is described below with reference to the accompanying drawings:

[0079] Reference Figure 5The equipment used in the cellular network security access authentication solution of this embodiment is mainly composed of three main parts: the user mobile office side is mainly composed of mobile office equipment and security access equipment; the operator side is mainly composed of base stations, 4 / 5G core networks (PGW / UBF, etc.), VPDN or VPN tunnels, etc.; the organization side is composed of LNS servers, security access authentication systems, and other organizational intranet and resources.

[0080] Reference Figure 6 , the security access device used in this embodiment supports biometric technology (such as fingerprint verification). In addition to the common components of portable WIFI devices such as power supply module, Type-C or USB connection module and cellular communication module, the security access device is also equipped with an access indication module and a fingerprint recognition module. The steps of using the security access device may include steps S11 to S16.

[0081] S11. Device connection: Plug the device into the mobile office device via Type-C or USB interface.

[0082] S12. Initial indication: After the device is plugged in, if the red light flashes, it means that the connection is blocked or the device authentication has not been passed.

[0083] S13. Security management platform connection: The device attempts to automatically connect to the security management platform.

[0084] S14, device authentication: After the connection is successful, the platform first completes the device number authentication and machine card binding compliance check, and the yellow light flashes at this time.

[0085] S15. User fingerprint verification: The user presses the fingerprint in the designated area, and the fingerprint information is collected and sent to the security management platform for verification.

[0086] S16. Verification result indication: If the fingerprint verification is successful, the indicator light turns green and stays on, indicating that the secure access is complete and the user can access the intranet resources.

[0087] Reference Figure 7 The secure access authentication system of this embodiment adopts an enhanced AAA (authentication, authorization, accounting) framework. It is mainly composed of three core modules: access device authentication module, user identity authentication module and authorized access module. The access device authentication module maintains a whitelist database, which includes all SIM card information allowed to access the network and its binding relationship with the specific device EID (i.e., device identifier). The user identity authentication module is responsible for storing and managing the user's real-name registration information and personal biometric data (fingerprint information reserved by the user).

[0088] In actual operation, when a mobile office device attempts to access the network through a security device, the security authentication system will automatically start the verification process and strictly match the identity information submitted by the user with the pre-stored information. Only when all the verification information is completely consistent will the system authorization module grant the user access to the organization's internal network resources; otherwise, the connection will be denied.

[0089] Reference Figure 8 The main authentication process of the secure access solution of this embodiment may include steps S21 to S25.

[0090] S21. The device requests a connection. The user inserts the security device into a mobile office device, such as a laptop or a smartphone. The security device starts running and displays a red indicator light, indicating that it is preparing to connect to the network.

[0091] S22, device legitimacy authentication; the mobile office device initiates a network connection Radius authentication request to the secure access authentication service through the operator's cellular network. The request is forwarded to the secure access authentication system through the client-side LNS server for device authentication. The secure access authentication system begins to authenticate the device legitimacy of the request. First, it checks whether the binding relationship between the SIM card and the SIM card device is legal, and whether the card number is the same as the preset card number. Whether the device information IMER number is the same as the preset number, whether the binding relationship between the SIM card and the device is legal, and whether the relationship between the device and the fingerprint corresponds. If the device is legal, the security device displays a yellow indicator light to prompt the user to press the fingerprint. Otherwise, the authentication ends.

[0092] S23, user legitimacy authentication: the user presses the fingerprint, the device reads the fingerprint information and uploads it to the secure access authentication system for user authentication. The secure access authentication system obtains the user through the fingerprint and determines whether the device has been bound to the user. If so, it proceeds to the next step; if not or there is no such user, the authentication process ends.

[0093] S24. Authorized access: If the device has been bound to a user, the user can be authorized to access intranet resources.

[0094] S25, the authentication is completed; after the entire authentication process is completed, the security device displays a green indicator light, indicating that the authentication is successful.

[0095] In summary, the authentication method for securely accessing an internal private network of the present application has the following advantages:

[0096] 1. The solution of this application does not need to access an uncertain external network in the mobile office scenario. Data is transmitted directly between the mobile terminal and the intranet of a specific organization through a secure tunnel via a cellular network connection. The "device + card + biometrics" triple authentication method can ensure secure access to mobile offices and data security.

[0097] 2. This application uses biometric technology - fingerprint verification to replace the traditional VPN method of entering an account and password when accessing the network, bringing convenience.

[0098] 3. The security access device of this application not only plays the role of fingerprint security access key, but also plays the role of cellular network access. Currently, there is no such security access device and method on the market. The device can be managed by the enterprise and distributed to designated employees for use.

[0099] In addition, refer to Fig. 9 ,and Figure 1 Corresponding to the method, an authentication system that can securely access an internal private network is also provided in an embodiment of the present application. The system may include: an acquisition unit 1001, a first processing unit 1002, and a second processing unit 1003. The acquisition unit 1001 may be connected to the first processing unit 1002. The first processing unit 1002 may be connected to the second processing unit 1003. The acquisition unit 1001 may be used to obtain the SIM card information and device identification code of the security access device when the security access device is inserted into a mobile office device and requests a network connection; the first processing unit 1002 may be used to determine that the security access device is a legitimate device based on the SIM card information and the device identification code, and detect the user's personal biometrics; the second processing unit 1003 may be used to authenticate the access authority of the security access device based on the personal biometrics to obtain an authentication result.

[0100] It should be noted that the acquisition unit can be any integrated circuit unit or microprocessor unit obtained by integrating a chip with processing functions and its peripheral circuits through existing integration technology. The first processing unit and the second processing unit can also be any integrated circuit module or microprocessor module obtained by integrating a chip with processing functions and its peripheral circuits through existing integration technology. The first processing unit and the second processing unit can also include one or more memories. One or more memories can be used to store the specific algorithm used for authentication in this application.

[0101] In some embodiments of the present application, the acquisition unit 1001 can be set in the same gateway or device with a processor as the processing unit 1002. The acquisition unit 1001 can be any unit connected to the processor inside the gateway or device. The acquisition unit 1001 can transmit the acquired data to the processor through a wired or wireless connection with the processor of the processing unit 1002. The processor of the processing unit 1002 can process the data through an internal chip and finally obtain the authentication result. The specific device connection method and device setting of the acquisition unit 1001 and the first processing unit 1002 and the first processing unit 1002 and the second processing unit 1003 are not limited.

[0102] It should be noted that the contents of the above-mentioned authentication method embodiment for securely accessing an internal private network are all applicable to the present authentication system embodiment for securely accessing an internal private network, and the functions specifically implemented by the present authentication system embodiment for securely accessing an internal private network are the same as those of the above-mentioned authentication method embodiment for securely accessing an internal private network, and the beneficial effects achieved are also the same as those achieved by the above-mentioned authentication method embodiment for securely accessing an internal private network.

[0103] In some feasible embodiments of the present application, the authentication system for secure access to the internal private network may include: an acquisition unit 1001, a first processing unit 1002, a second processing unit 1003, and a third processing unit 1004. The acquisition unit 1001 may be connected to the first processing unit 1002. The first processing unit 1002 may be connected to the second processing unit 1003. The acquisition unit 1001 may be used to acquire the SIM card information and the device identification code of the security access device when the security access device is inserted into the mobile office device and requests a network connection; the first processing unit 1002 may be used to determine that the security access device is a legitimate device based on the SIM card information and the device identification code, and detect the user's personal biometrics; the second processing unit 1003 may be used to authenticate the access authority of the security access device based on the personal biometrics to obtain an authentication result. The third processing unit 1004 may be connected to the second processing unit 1003. The third processing unit 1004 may be used to generate a prompt message when the authentication result is that the access authority authentication is successful, and the prompt message is used to prompt the user that the authentication is successful.

[0104] and Figure 1 Corresponding to the method, the embodiment of the present application also provides an authentication device that can securely access the internal private network, and its specific structure can be referred to Fig.10 ,include:

[0105] at least one processor 1011;

[0106] At least one memory 1012, used to store at least one program;

[0107] When the at least one program is executed by the at least one processor, the at least one processor implements the authentication method for securely accessing an internal private network.

[0108] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0109] and Figure 1 Corresponding to the method, an embodiment of the present application further provides a computer-readable storage medium, which stores processor-executable instructions, and the processor-executable instructions are used to execute the authentication method for securely accessing an internal private network when executed by the processor.

[0110] The contents of the above-mentioned authentication method embodiment for securely accessing an internal private network are all applicable to the present storage medium embodiment. The functions specifically implemented by the present storage medium embodiment are the same as those of the above-mentioned authentication method embodiment for securely accessing an internal private network, and the beneficial effects achieved are also the same as those achieved by the above-mentioned authentication method embodiment for securely accessing an internal private network.

[0111] In some optional embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the application is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Optional embodiments are expected, wherein the order of various operations is changed and the sub-operation described as a part of a larger operation is performed independently.

[0112] In addition, although the present application is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present application. More specifically, in view of the properties, functions, and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional techniques of the engineer. Therefore, those skilled in the art can implement the present application set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present application, which is determined by the full scope of the attached claims and their equivalents.

[0113] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several programs to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0114] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable programs for implementing the logical functions, and may be embodied in any computer-readable medium for use by a program execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch and execute a program from a program execution system, device or apparatus), or in conjunction with such program execution systems, devices or apparatuses. For purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by a program execution system, device or apparatus, or in conjunction with such program execution systems, devices or apparatuses.

[0115] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0116] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable program execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0117] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0118] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

[0119] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the described embodiments. Technical personnel familiar with the field may make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. An authentication method for securely accessing an internal private network, characterized in that: The following steps are involved: When the security access device is inserted into the mobile office device and requests a network connection, obtaining the SIM card information and device identification code of the security access device; Determine that the secure access device is a legitimate device based on the SIM card information and the device identification code, and detect the user's personal biometrics; Based on the personal biometrics, the access authority of the security access device is authenticated to obtain an authentication result.

2. According to claim 1, an authentication method for securely accessing an internal private network is characterized in that: Determining, based on the SIM card information and the device identification code, that the secure access device is a legitimate device specifically includes: According to the SIM card information, determining whether the SIM card of the secure access device is a legitimate SIM card; If the SIM card is a legitimate SIM card, the secure access device is determined to be a legitimate device according to the device identification code.

3. According to claim 2, an authentication method for securely accessing an internal private network is characterized in that: Determining, according to the device identification code, that the secure access device is a legitimate device specifically includes: Configure an identification code set; the identification code set includes a plurality of preset device identification codes; When the device identification code is identical to any one of the preset device identification codes in the identification code set, it is determined that the security access device corresponding to the device identification code is a legal device.

4. According to claim 2, an authentication method for securely accessing an internal private network is characterized in that: The determining, according to the SIM card information, whether the SIM card of the secure access device is a legitimate SIM card specifically includes: When the card number of the SIM card is the same as the preset card number, determining that the SIM card of the secure access device is a legitimate SIM card; When the card number of the SIM card is different from the preset card number, it is determined that the SIM card of the security access device is an illegal SIM card.

5. The authentication method for securely accessing an internal private network according to claim 1, characterized in that: The authenticating the access right of the secure access device based on the personal biometric feature to obtain an authentication result specifically includes: Extracting a first similarity between the personal biometric feature and a preset feature; authenticating the access authority of the security access device, and when the first similarity is less than a preset similarity threshold, determining that the authentication result is an access authority authentication failure; The access authority of the security access device is authenticated, and when the first similarity is greater than or equal to the preset similarity threshold, the authentication result is determined to be a successful access authority authentication.

6. The authentication method for securely accessing an internal private network according to claim 1, characterized in that: The method further comprises: When the authentication result is that the access authority authentication is successful, a prompt message is generated, and the prompt message is used to prompt the user that the authentication is successful.

7. An authentication system capable of securely accessing an internal private network, characterized in that: include: An acquisition unit, used to acquire SIM card information and a device identification code of the security access device when the security access device is inserted into the mobile office device and requests a network connection; A first processing unit, configured to determine that the secure access device is a legitimate device according to the SIM card information and the device identification code, and detect a user's personal biometric characteristics; The second processing unit is used to authenticate the access authority of the security access device based on the personal biometric feature to obtain an authentication result.

8. The authentication system capable of securely accessing an internal private network according to claim 7, characterized in that: The system also includes a third processing unit; the third processing unit is used to generate prompt information when the authentication result is that the access authority authentication is successful, and the prompt information is used to prompt the user that the authentication is successful.

9. An authentication device capable of securely accessing an internal private network, characterized in that include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements an authentication method for securely accessing an internal private network as described in any one of claims 1 to 6.

10. A computer-readable storage medium storing instructions executable by a processor, characterized in that: The processor-executable instructions are used to execute an authentication method for securely accessing an internal private network as described in any one of claims 1-6 when executed by the processor.

Images