Access authentication method and device, computer program product and electronic equipment

Abstract

The invention discloses an access authentication method and device, a computer program product and electronic equipment. The method can be applied to the field of financial science and technology. The method comprises the steps of determining a data type of to-be-accessed data of a target user; matching an identity authentication mode according to the data type to obtain a target identity authentication mode; performing identity authentication on the target user according to the target identity authentication mode to obtain an identity authentication result; and under the condition that the identity authentication result indicates that the authentication is passed, providing access authority for the target user. Through the method and the device, the problem of data leakage caused by inaccurate identity authentication under a non-credible condition in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network information security and can be applied to the field of financial technology. Specifically, it relates to an access authentication method, device, computer program product and electronic device. Background Art

[0002] The Kerberos authentication system uses tickets and key distribution centers (KDC) to implement user authentication and single sign-on (SSO) functions. Specifically, Kerberos uses tickets to verify user identities. After the user passes the initial verification, he or she obtains a ticket granting ticket (TGT), which allows the user to request access to other services for a period of time. The Key Distribution Center (KDC) is the core of Kerberos authentication, including the authentication server (AS) and the ticket granting server (TGS). AS is used for initial authentication and issues TGT, and TGS is used to verify TGT and issue service tickets. Kerberos uses symmetric key encryption algorithms to protect the security of tickets and communication data. In addition, users only need to authenticate once to obtain TGT, implement single sign-on (SSO), and access multiple protected services without having to enter passwords multiple times.

[0003] However, the related technologies have the disadvantages that their security depends on the security of keys and they cannot handle untrusted environments. The security of Kerberos depends on the security of keys. If the keys are leaked or attacked, serious security issues may occur. At the same time, Kerberos assumes that all participants are trustworthy. If any participant is untrustworthy, security vulnerabilities may occur.

[0004] Currently, no effective solution has been proposed to address the problem of inaccurate identity authentication in untrusted situations in related technologies, which may lead to data leakage. Summary of the invention

[0005] The main purpose of this application is to provide an access authentication method to solve the problem of inaccurate identity authentication in untrusted situations in related technologies, which leads to data leakage.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an access authentication method is provided. The method includes: determining the data type of the data to be accessed by the target user; matching the identity authentication method according to the data type to obtain the target identity authentication method; authenticating the target user according to the target identity authentication method to obtain the identity authentication result; and providing the target user with access rights when the identity authentication result indicates that the authentication is passed.

[0007] Optionally, matching the authentication method according to the data type to obtain the target authentication method includes: when the data type is ordinary data, determining the first authentication method as the target authentication method, wherein the first authentication method indicates authentication based on a network identity authentication protocol; when the data type is data with confidentiality requirements, determining the second authentication method as the target authentication method, wherein the second authentication method indicates authentication based on a network identity authentication protocol and user information.

[0008] Optionally, when the data type is data with confidentiality requirements, determining the second identity authentication method as the target identity authentication method includes: when the data type is first category data, determining the second identity authentication method as the target identity authentication method; when the data type is second category data, determining the second identity authentication method and a method of spot checking the target user's biometrics as the target identity authentication method, wherein the confidentiality level of the second category data is higher than that of the first category data.

[0009] Optionally, determining the data type of the data to be accessed by the target user includes: obtaining an access request from the target user and identifying a code associated with the access request, wherein the code is used to indicate the data type of the data to be accessed; and determining the data type of the data to be accessed according to the code.

[0010] Optionally, when the identity authentication result indicates that the authentication is passed, providing the target user with access rights includes: determining the level and access requirements of the target user; and providing the target user with access rights according to the level and access requirements of the target user.

[0011] Optionally, the method further includes: detecting whether the access rights and access requirements of different users are compatible; and if the access rights and access requirements of a user are incompatible, adjusting the access rights of the user, wherein the adjusted access rights and access requirements are compatible.

[0012] Optionally, the method further includes: detecting whether access rights of different access requests meet access requirements; and adjusting the access rights if the access rights of the access requests do not meet the access requirements, wherein the adjusted access rights meet the access requirements.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an access authentication device is provided. The device includes: a data type determination module, used to determine the data type of the data to be accessed by the target user; a target identity authentication method module, used to match the identity authentication method according to the data type to obtain the target identity authentication method; an identity authentication module, used to authenticate the target user according to the target identity authentication method to obtain an identity authentication result; and an access permission providing module, used to provide access permission to the target user when the identity authentication result indicates that the authentication is passed.

[0014] Optionally, in the access authentication device provided in the embodiment of the present application, the target identity authentication module includes: a first target identity authentication module, which is used to determine a first identity authentication method as a target identity authentication method when the data type is ordinary data, wherein the first identity authentication method indicates identity authentication based on a network identity authentication protocol; a second target identity authentication module, which is used to determine a second identity authentication method as a target identity authentication method when the data type is data with confidentiality requirements, wherein the second identity authentication method indicates identity authentication based on a network identity authentication protocol and user information.

[0015] Optionally, in the access authentication device provided in the embodiment of the present application, the second target identity authentication module includes: a second target identity authentication sub-module one, used to determine the second identity authentication method as the target identity authentication method when the data type is the first category of data; a second target identity authentication sub-module two, used to determine the second identity authentication method and a method of spot checking the target user's biometrics as the target identity authentication method when the data type is the second category of data, wherein the confidentiality level of the second category of data is higher than that of the first category of data.

[0016] Optionally, in the access authentication device provided in the embodiment of the present application, the data type determination module includes: a request acquisition module, used to obtain the access request of the target user and identify the code associated with the access request, wherein the code is used to indicate the data type of the data to be accessed; a data type determination module, used to determine the data type of the data to be accessed according to the code.

[0017] Optionally, in the access authentication device provided in the embodiment of the present application, the access permission providing module includes: a user level and requirement determination module, used to determine the level and access requirements of the target user; and a permission providing module, used to provide access permissions for the target user according to the level and access requirements of the target user.

[0018] Optionally, in the access authentication device provided in the embodiment of the present application, the device also includes: a first adaptation detection module, used to detect whether the access rights and access requirements of different users are adapted; a first permission adjustment module, used to adjust the user's access rights when there is a mismatch between the user's access rights and access requirements, wherein the adjusted access rights and access requirements are adapted.

[0019] Optionally, in the access authentication device provided in the embodiment of the present application, the device also includes: a second adaptation detection module, used to detect whether the access rights of different access requests meet the access requirements; a second permission adjustment module, used to adjust the access rights when the access rights of the access request do not meet the access requirements, wherein the adjusted access rights meet the access requirements.

[0020] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is provided, which includes: a non-volatile computer-readable storage medium storing a computer program, and the computer program implements the access authentication method when executed by a processor.

[0021] In order to achieve the above object, according to another aspect of the present application, an electronic device is provided. The device includes: a computer program is stored in a memory, and a processor is configured to execute an access authentication method through the computer program.

[0022] In the embodiment of the present application, the data type of the data to be accessed by the target user is determined; the authentication method is matched according to the data type to obtain the target authentication method; the target user is authenticated according to the target authentication method to obtain the authentication result; when the authentication result indicates that the authentication is passed, the target user is provided with access rights. By determining the corresponding authentication method according to the accessed data type, the user is effectively prevented from accessing the background data beyond the authority, achieving the technical effect of improving the security and credibility of the system, thereby solving the problem of inaccurate authentication in non-trusted situations in the related technology, which leads to data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0024] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing an access authentication method;

[0025] Figure 2 is a flowchart of an access authentication method provided according to an embodiment of the present application;

[0026] Figure 3 This is the process of the access authentication method provided in the embodiment of the present application Figure 1 ;

[0027] Figure 4 This is the process of the access authentication method provided in the embodiment of the present application Figure 2 ;

[0028] Figure 5 is a schematic diagram of an access authentication device provided according to an embodiment of the present application;

[0029] Figure 6 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0033] Example 1

[0034] According to an embodiment of the present application, an access authentication method embodiment is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 It is a hardware structure block diagram of a computer terminal used to implement an access authentication method. Figure 1 As shown, the computer terminal 10 may include one or more ( Figure 1 The system includes a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor (MCU, Microcontroller Unit) or a programmable logic device (FPGA, Field-Programmable Gate Array)), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface, Input / Output interface), a universal serial bus (USB, Universal Serial Bus) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0036] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0037] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the access authentication method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned access authentication method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0038] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0039] The display may be, for example, a touch screen liquid crystal display (LCD), which may enable a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0040] Under the above operating environment, this application provides Figure 2 The access authentication method shown. Figure 2 It is a flowchart of an access authentication method provided according to an embodiment of the present application.

[0041] Step S201, determining the data type of the data to be accessed by the target user.

[0042] Specifically, the target user refers to the user who requests to access the data resources in the data lake, which can be an internal employee of the financial institution or an external service user. The data to be accessed can be the data in the data lake that is allowed to be queried or used by the target user. The data lake contains all the data of the financial institution, such as the operation record process of the customer on the financial institution's software, customer consumption details, senior management audit records and other information.

[0043] According to the sensitivity and importance of the data, the data in the data lake is divided into different categories, such as ordinary data, sensitive data and confidential data. Ordinary data includes ordinary business data, such as customers' operation records on financial institution software; sensitive data includes information involving customer privacy and sensitive information, such as customer consumption details, account balances, etc.; confidential data contains highly confidential information, such as senior executive audit records, regulatory agency review data, etc.

[0044] Step S202, matching the identity authentication method according to the data type to obtain the target identity authentication method.

[0045] Specifically, the authentication system will automatically select the corresponding authentication method based on the type of data to be accessed. The more sensitive and important the data type, the stricter the authentication required. The target authentication method refers to the specific authentication process and requirements selected by the authentication system based on the data type.

[0046] Step S203: Authenticate the target user according to the target authentication method to obtain an authentication result.

[0047] Specifically, the authentication methods can be divided into Kerberos authentication, multi-factor authentication and continuous authentication. Based on the authentication results, the authentication system will agree or deny the user to access the data in the data lake. Among them, Kerberos authentication requires the user to enter the account password or ticket as verification information. After the authentication system verifies that the information is correct, it issues a ticket to the customer; multi-factor authentication can require the user to enter user information (for example, work number) and perform biometric verification through a biometric device (such as a fingerprint reader). After the verification is passed, the user obtains access rights; continuous authentication is performed after the multi-factor authentication is passed, and the identity will be re-verified based on the user's information multiple times during the user's access to ensure that the access operation is always performed by users who meet the access conditions.

[0048] For example, when the authentication result meets the authentication result requirements of the corresponding data type, the result is passed, and the user can access the target data; when the authentication result does not meet the authentication result requirements of the corresponding data type, the result is failed, and the user cannot access the target data.

[0049] It should be noted that during identity authentication, identity authentication is performed according to the highest level of data type. Specifically, the authentication system will perform authentication based on the highest level of data among the data types requested by the target user during identity authentication. Even if a request contains multiple data types, the system will use the most sensitive or important data type as the benchmark. For example, if a request contains both ordinary data and sensitive data, the system will use sensitive data as the highest level of data type. After determining the highest level of data type, the authentication system will match the corresponding authentication method based on this type. For example, for sensitive data, the system can require users to perform multi-factor authentication.

[0050] Step S204: When the identity authentication result indicates that the authentication is successful, provide access rights to the target user.

[0051] Specifically, when the type of data accessed by the target user is ordinary data, Kerberos authentication will be performed on the target user. If the identity authentication passes, the user will be provided with corresponding access rights; when the type of data accessed by the target user is sensitive data, Kerberos authentication and multi-factor authentication will be performed on the target user. If the identity authentication passes, the user will be provided with corresponding access rights; when the type of data accessed by the target user is confidential data, Kerberos authentication, multi-factor authentication and continuous identity authentication will be performed on the target user. If the authentication fails at any stage of the continuous identity authentication, the authentication system will immediately interrupt the user's data access, effectively preventing unauthorized personnel from performing unauthorized operations after obtaining the initial access rights, thereby protecting the security of confidential data.

[0052] If the identity authentication result indicates that the authentication fails, the user's data access application is rejected.

[0053] In the embodiment of the present application, the data type of the data to be accessed by the target user is determined; the authentication method is matched according to the data type to obtain the target authentication method; the target user is authenticated according to the target authentication method to obtain the authentication result; when the authentication result indicates that the authentication is passed, the target user is provided with access rights. By determining the corresponding authentication method according to the accessed data type, the user is effectively prevented from accessing the background data beyond the authority, achieving the technical effect of improving the security and credibility of the system, thereby solving the problem of inaccurate authentication in non-trusted situations in the related technology, which leads to data leakage.

[0054] In order to determine a target authentication method that matches the data type, optionally, in the access authentication method provided in the embodiment of the present application, the authentication method is matched according to the data type to obtain the target authentication method, including: when the data type is ordinary data, determining a first authentication method as the target authentication method, wherein the first authentication method indicates authentication based on a network identity authentication protocol; when the data type is data with confidentiality requirements, determining a second authentication method as the target authentication method, wherein the second authentication method indicates authentication based on a network identity authentication protocol and user information.

[0055] Specifically, the first identity authentication method is based on the Kerberos network authentication protocol, and involves the following steps: the user initiates a data access request to the data lake through the network; the authentication system captures the request and parses the structured query statement (SQL, Structured Query Language) therein, and identifies that the target data of the request is a common data type; according to the preset authentication rules, the system automatically selects the first identity authentication method, that is, identity authentication through the Kerberos authentication process; the user needs to enter the account password or ticket as verification information, and after the system verifies that the information is correct, it issues a ticket credit ticket for subsequent service ticket requests; the user uses the ticket credit ticket to request a specific service ticket to access the requested common data resources.

[0056] The second authentication method is not only based on the Kerberos network authentication protocol, but also adds multi-factor authentication. The specific process is as follows: the user initiates an access request for sensitive or confidential data; the authentication system parses the request and identifies that the target data has confidentiality requirements; the authentication system selects the second authentication method, which adds work number verification and biometric identification on the basis of Kerberos authentication; the user first verifies the account and password through Kerberos authentication and obtains a bill credit ticket; after that, the system further requires the user to enter the work number and perform biometric verification through a biometric device (such as a fingerprint reader); after all information is verified, the user obtains the right to access sensitive or confidential data. The second authentication method can include multi-factor authentication.

[0057] Figure 3 This is the process of the access authentication method provided in the embodiment of the present application Figure 1 ,like Figure 3As shown, the steps of the access authentication method may be: a user requests access to a service resource, and the service resource may be data in a data lake; a Kerberos authentication server verifies the user's identity, which may be an account password or a ticket, wherein the Kerberos authentication server is part of the authentication system; if the user's identity authentication is successful, access rights are granted; multi-factor authentication is performed on users who access sensitive data and confidential data: verifying whether the user's work number is an authenticated user, verifying the user's fingerprint, and confirming that the user is operating in person; continuous identity authentication is performed on users who access confidential data, and the user's biometric features may be queried regularly or irregularly, which may include fingerprints and facial features, wherein regular or irregular means that the authentication system may select a fixed interval or a random time; dynamic access control is used to determine the access rights that the user can obtain; after the authentication is completed, the user obtains access rights; the user accesses service resources and interacts with data, including accessing data in a data lake, wherein continuous identity authentication may include spot checking the target user's biometric features.

[0058] The embodiment of the present application not only automatically matches the most appropriate authentication method according to the sensitivity and confidentiality level of the data, avoiding excessive security control of ordinary data, but also significantly improves the security of sensitive data and confidential data by adding multi-factor authentication.

[0059] In order to further subdivide the authentication methods for different data types, optionally, in the access authentication method provided in the embodiment of the present application, when the data type is data with confidentiality requirements, determining the second identity authentication method as the target identity authentication method includes: when the data type is the first category of data, determining the second identity authentication method as the target identity authentication method; when the data type is the second category of data, determining the second identity authentication method and a method of spot checking the target user's biometrics as the target identity authentication method, wherein the confidentiality level of the second category of data is higher than that of the first category of data.

[0060] Specifically, the first type of data may be sensitive data, that is, data types that have certain confidentiality requirements but are not as high as the second type of data confidentiality requirements, such as customer deposit details and transaction records in customer sensitive information. In the case where the data type is the first type of data, the second identity authentication method is performed.

[0061] The second type of data can be confidential data, such as the review data of some leaders in the financial industry by the regulatory authorities in the executive audit information. When the data type is the second type of data, the second identity authentication method and the method of spot-checking the biometrics of the target user are performed. Among them, the biometrics can be fingerprints and facial features. The user needs to enter his or her own biometrics through the biometric authentication device. If the supported biometrics meet the requirements in the data lake, the user is allowed to continue access; if it does not meet the requirements in the data lake, the user immediately exits the access status and revokes the access rights. Among them, the requirements in the data lake refer to the biometrics entered by the user being recorded in the list of people allowed to access the corresponding data; the spot check method can be a scheduled spot check, such as a spot check every 10 minutes, or a random time spot check.

[0062] Figure 4 This is the process of the access authentication method provided in the embodiment of the present application Figure 2 ,like Figure 4 As shown, the process for sensitive data and confidential data is as follows: the user requests access to data resources, and the type of data requested for access is checked; if it is sensitive data, a second identity authentication method is performed, including multi-factor authentication, to query whether the user's work number corresponds to the Kerberos authentication; if it is confidential data, continuous identity authentication is performed, including multi-factor authentication and spot checks of the target user's biometrics, and continuous identity authentication includes spot checks of multi-factor authentication and face recognition; dynamic access control is performed, and when the authentication passes, access rights are provided, and data resource access authorization is completed. When the authentication fails, the user's data access is immediately interrupted.

[0063] It should be noted that the requirement in the data lake is pre-entered biometric data. Each piece of biometric data has its corresponding access rights. When the accessed data is within the authority, the biometric spot check can be passed. When the accessed data is not within the authority or the input biometric data is not entered, the biometric spot check cannot be passed.

[0064] The embodiment of the present application effectively enhances the security and controllability of data access in the data lake by dynamically adjusting the authentication type and number of identity authentications.

[0065] In order to further determine the type of data requested by the user to access, optionally, in the access authentication method provided in the embodiment of the present application, determining the data type of the data to be accessed by the target user includes: obtaining an access request from the target user, and identifying a code associated with the access request, wherein the code is used to indicate the data type of the data to be accessed; and determining the data type of the data to be accessed according to the code.

[0066] Specifically, when the target user initiates a data access request, the authentication system first captures the request. The request can be made in the form of an SQL statement, which contains the data type that the target user requests to query or access. A database table is designed to map all libraries and data types in the data lake. Each query of data will pass through the database table, which defines all data types in the data lake. When the data type requested by the user corresponds to the data type in the database table, the query and access can be performed within the data lake scope of the data type.

[0067] It should be noted that the code corresponds to the header of the database table, and the database table can be queried based on the code. The code is a label attached to the SQL statement to indicate the confidentiality level of the data to be accessed, such as "00-" for ordinary data, "01-" for sensitive data, and "11-" for confidential data. The system determines the type of data requested by the user based on the identified code.

[0068] The embodiment of the present application specifies a process for identifying data types. By embedding codes in SQL statements, the authentication system can respond to different types of access requests.

[0069] In order to provide users with qualified access rights, optionally, in the access authentication method provided in the embodiment of the present application, when the identity authentication result indicates that the authentication is passed, providing access rights to the target user includes: determining the level and access requirements of the target user; and providing access rights to the target user based on the level and access requirements of the target user.

[0070] Specifically, after the user passes the identity authentication, the authentication system determines the user's level based on the user's preset access rights. For example, ordinary analysts are "level 1", senior analysts or team leaders are "level 2", and personnel involved in audit or compliance management have a higher "level 3" authority level, corresponding to the access rights of ordinary data, sensitive data and confidential data respectively. The authentication system automatically adjusts and assigns access rights based on the user level and access requirements.

[0071] The embodiments of the present application provide appropriate access rights by combining user levels and access requirements, which not only enhances the security of the data lake, but also effectively prevents data leakage and unauthorized access.

[0072] In order to dynamically adjust access rights to meet access requirements, optionally, in the access authentication method provided in the embodiment of the present application, the method also includes: detecting whether the access rights and access requirements of different users are compatible; if there is a mismatch between the user's access rights and access requirements, adjusting the user's access rights, wherein the adjusted access rights are compatible with the access requirements.

[0073] Specifically, check whether the data access rights requested by each user are consistent with their actual job responsibilities and current business needs. Access rights refer to the scope of specific data types or data sets that users are allowed to access, and access requirements reflect the specific requirements of the types of data that users need to access in order to complete their work tasks within a specific time. After the user passes the identity authentication, the authentication system parses their access request and identifies the data type of data access. Then compare the user's access rights to verify whether the rights are suitable for the data type, such as general data, sensitive data, or confidential data.

[0074] When verification shows that the user's access rights and access requirements do not match, if the access rights are too large, the access rights will be reduced until they match the access requirements; if the access rights are too small, the user will be prompted that the rights are insufficient, and the user can choose to apply for additional rights to match the access requirements.

[0075] The embodiments of the present application detect and adjust the user's access rights to adapt to access requirements, enhance the flexibility and security of the system, ensure dynamic adjustment of data access rights to adapt to changes in user needs, and prevent abuse of rights and data leakage, thereby improving the efficiency of data management and the overall compliance of the system.

[0076] In order to dynamically adjust access rights to meet access requirements, optionally, in the access authentication method provided in the embodiment of the present application, the method also includes: detecting whether the access rights of different access requests meet the access requirements; if the access rights of the access requests do not meet the access requirements, adjusting the access rights, wherein the adjusted access rights meet the access requirements.

[0077] Specifically, access rights refer to the range of specific data types or data sets that users are allowed to access, and access requests refer to data requests that users initiate to the authentication system in order to access specific data resources. They are performed through SQL statements and contain information such as the specific data and data type that the user requests to access.

[0078] Parse the access request, identify the type of data requested, and then compare the access rights of the access request to verify whether the rights are appropriate for the data type, such as normal data, sensitive data, or confidential data.

[0079] When verification shows that the access rights of the access request do not match the access requirements, if the access rights are too large, the access rights are reduced until they match the access requirements; if the access rights are too small, the user is prompted that the rights are insufficient, and the user can choose to apply for additional rights to match the access requirements or reissue the access request.

[0080] The embodiments of the present application detect and adjust the access rights of access requests to adapt to access requirements, thereby enhancing the flexibility and security of the system, ensuring dynamic adjustment of data access rights to adapt to changes in user needs, and preventing abuse of rights and data leakage, thereby improving the efficiency of data management and the overall compliance of the system.

[0081] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0082] Example 2

[0083] The embodiment of the present application also provides an access authentication device. It should be noted that the access authentication device of the embodiment of the present application can be used to execute the access authentication method provided by the embodiment of the present application. The access authentication device provided by the embodiment of the present application is introduced below.

[0084] Figure 5 is a schematic diagram of an access authentication device provided according to an embodiment of the present application, such as Figure 5 As shown, the device comprises:

[0085] The data type determination module 501 is used to determine the data type of the data to be accessed by the target user.

[0086] The target identity authentication module 502 is used to match the identity authentication method according to the data type to obtain the target identity authentication method.

[0087] The identity authentication module 503 is used to perform identity authentication on the target user according to the target identity authentication method to obtain an identity authentication result.

[0088] The access permission providing module 504 is used to provide access permission for the target user when the identity authentication result indicates that the authentication is passed.

[0089] The access authentication device provided in the embodiment of the present application includes a data type determination module 501, which is used to determine the data type of the data to be accessed by the target user; a target identity authentication method module 502, which is used to match the identity authentication method according to the data type to obtain the target identity authentication method; an identity authentication module 503, which is used to authenticate the target user according to the target identity authentication method to obtain the identity authentication result; and an access permission providing module 504, which is used to provide access permission to the target user when the identity authentication result indicates that the authentication is passed. By determining the corresponding identity authentication method according to the accessed data type, it is effectively prevented that the user exceeds the permission to access the background data, thereby achieving the technical effect of improving the security and credibility of the system, and further solving the problem of inaccurate identity authentication in non-trusted situations in related technologies, which leads to data leakage.

[0090] It should be noted that the above modules correspond to steps S201 to S204 in Example 1, and the examples and application scenarios implemented by the modules and corresponding steps are the same, but are not limited to the contents disclosed in the above Example 1. It should be noted that the above modules or units may be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above modules may also be part of the device and may be run in the computer terminal 10 provided in Example 1.

[0091] Optionally, in the access authentication device provided in the embodiment of the present application, the target identity authentication module 502 includes: a first target identity authentication module, used to determine a first identity authentication method as a target identity authentication method when the data type is ordinary data, wherein the first identity authentication method indicates identity authentication based on a network identity authentication protocol; a second target identity authentication module, used to determine a second identity authentication method as a target identity authentication method when the data type is data with confidentiality requirements, wherein the second identity authentication method indicates identity authentication based on a network identity authentication protocol and user information.

[0092] Optionally, in the access authentication device provided in the embodiment of the present application, the second target identity authentication module includes: a second target identity authentication sub-module one, used to determine the second identity authentication method as the target identity authentication method when the data type is the first category of data; a second target identity authentication sub-module two, used to determine the second identity authentication method and a method of spot checking the target user's biometrics as the target identity authentication method when the data type is the second category of data, wherein the confidentiality level of the second category of data is higher than that of the first category of data.

[0093] Optionally, in the access authentication device provided in the embodiment of the present application, the data type determination module 501 includes: a request acquisition module, used to obtain the access request of the target user and identify the code associated with the access request, wherein the code is used to indicate the data type of the data to be accessed; a data type determination module, used to determine the data type of the data to be accessed according to the code.

[0094] Optionally, in the access authentication device provided in the embodiment of the present application, the access permission providing module 504 includes: a user level and requirement determination module, used to determine the level and access requirements of the target user; and a permission providing module, used to provide access permissions for the target user according to the level and access requirements of the target user.

[0095] Optionally, in the access authentication device provided in the embodiment of the present application, the device also includes: a first adaptation detection module, used to detect whether the access rights and access requirements of different users are adapted; a first permission adjustment module, used to adjust the user's access rights when there is a mismatch between the user's access rights and access requirements, wherein the adjusted access rights and access requirements are adapted.

[0096] Optionally, in the access authentication device provided in the embodiment of the present application, the device also includes: a second adaptation detection module, used to detect whether the access rights of different access requests meet the access requirements; a second permission adjustment module, used to adjust the access rights when the access rights of the access request do not meet the access requirements, wherein the adjusted access rights meet the access requirements.

[0097] Example 3

[0098] An embodiment of the present application may provide an electronic device, Figure 6 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (only one is shown) processor 602, memory 604, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0099] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0100] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: determine the data type of the data to be accessed by the target user; match the identity authentication method according to the data type to obtain the target identity authentication method; authenticate the target user according to the target identity authentication method to obtain the identity authentication result; when the identity authentication result indicates that the authentication is passed, provide access rights to the target user.

[0101] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: when the data type is ordinary data, the first identity authentication method is determined as the target identity authentication method, wherein the first identity authentication method indicates identity authentication based on the network identity authentication protocol; when the data type is data with confidentiality requirements, the second identity authentication method is determined as the target identity authentication method, wherein the second identity authentication method indicates identity authentication based on the network identity authentication protocol and user information.

[0102] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: when the data type is the first category of data, the second identity authentication method is determined as the target identity authentication method; when the data type is the second category of data, the second identity authentication method and the method of spot checking the biometrics of the target user are determined as the target identity authentication method, wherein the confidentiality level of the second category of data is higher than that of the first category of data.

[0103] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: obtain the access request of the target user and identify the code associated with the access request, wherein the code is used to indicate the data type of the data to be accessed; determine the data type of the data to be accessed according to the code.

[0104] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: determine the level and access requirements of the target user; and provide access rights to the target user according to the level and access requirements of the target user.

[0105] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: detect whether the access rights and access requirements of different users are compatible; if the access rights and access requirements of the user are not compatible, adjust the access rights of the user, wherein the adjusted access rights and access requirements are compatible.

[0106] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: detecting whether the access rights of different access requests meet the access requirements; if the access rights of the access requests do not meet the access requirements, adjusting the access rights, wherein the adjusted access rights meet the access requirements.

[0107] In the embodiment of the present application, the data type of the data to be accessed by the target user is determined; the authentication method is matched according to the data type to obtain the target authentication method; the target user is authenticated according to the target authentication method to obtain the authentication result; when the authentication result indicates that the authentication is passed, the target user is provided with access rights. By determining the corresponding authentication method according to the accessed data type, the user is effectively prevented from accessing the background data beyond the authority, achieving the technical effect of improving the security and credibility of the system, thereby solving the problem of inaccurate authentication in non-trusted situations in the related technology, which leads to data leakage.

[0108] It can be understood by those skilled in the art that Figure 6 The structure shown is for illustration only, and the electronic device may also be a smart phone, a tablet computer, a PDA, a mobile Internet device (MID), a PAD or other terminal device. Figure 6 The structure of the electronic device is not limited. Figure 6 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 6 Different configurations shown.

[0109] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0110] Example 4

[0111] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the access authentication method provided in the first embodiment.

[0112] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0113] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program of the access authentication method steps.

[0114] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0115] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0116] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0117] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0118] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0119] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0120] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An access authentication method, characterized in that: The following steps are involved: Determine the data type of the data to be accessed by the target user; Match the identity authentication method according to the data type to obtain the target identity authentication method; Performing identity authentication on the target user according to the target identity authentication method to obtain an identity authentication result; When the identity authentication result indicates that the authentication is successful, access rights are provided to the target user.

2. The access authentication method according to claim 1, characterized in that: According to the data type, the identity authentication method is matched to obtain the target identity authentication method, including: In the case where the data type is common data, determining a first identity authentication method as the target identity authentication method, wherein the first identity authentication method indicates identity authentication based on a network identity authentication protocol; In a case where the data type is data with confidentiality requirements, a second identity authentication method is determined as the target identity authentication method, wherein the second identity authentication method indicates identity authentication based on the network identity authentication protocol and user information.

3. The access authentication method according to claim 2, characterized in that: When the data type is data with confidentiality requirements, determining the second identity authentication method as the target identity authentication method includes: When the data type is the first type of data, determining the second identity authentication method as the target identity authentication method; When the data type is second category data, the second identity authentication method and a method of spot-checking the biometrics of the target user are determined as the target identity authentication method, wherein the confidentiality level of the second category data is higher than that of the first category data.

4. The access authentication method according to claim 1, characterized in that: Determine the data types that the target user wants to access, including: Obtaining an access request from the target user, and identifying a code associated with the access request, wherein the code is used to indicate a data type of the data to be accessed; The data type of the data to be accessed is determined according to the encoding.

5. The access authentication method according to claim 1, characterized in that: When the identity authentication result indicates that the authentication is successful, providing the target user with access rights includes: Determine the level and access requirements of the target user; The target user is provided with access rights according to the level of the target user and the access requirement.

6. The access authentication method according to claim 1, characterized in that: The method further comprises: Check whether the access rights and access requirements of different users are compatible; In the case that the access rights of the user do not match the access requirements, the access rights of the user are adjusted, wherein the adjusted access rights match the access requirements.

7. The access authentication method according to claim 1, characterized in that: The method further comprises: Check whether the access rights of different access requests meet the access requirements; In the case that the access permission of the access request does not meet the access requirement, the access permission is adjusted, wherein the adjusted access permission meets the access requirement.

8. An access authentication device, characterized in that: include: A data type determination module, used to determine the data type of the data to be accessed by the target user; A target identity authentication method module, used to match the identity authentication method according to the data type to obtain a target identity authentication method; An identity authentication module, used to perform identity authentication on the target user according to the target identity authentication method to obtain an identity authentication result; The access permission providing module is used to provide the target user with access permission when the identity authentication result indicates that the authentication is passed.

9. A computer program product, characterized in that The invention comprises a non-volatile computer-readable storage medium storing a computer program, wherein the computer program implements the access authentication method according to any one of claims 1 to 7 when executed by a processor.

10. An electronic device comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor is configured to execute the access authentication method according to any one of claims 1 to 7 through the computer program.

Images