Dynamic authentication method, server, mobile terminal and readable medium

Abstract

The invention provides a dynamic authentication method applied to a server, and the method comprises the steps: receiving risk assessment data sent by a mobile terminal, determining a first authentication mode according to the risk assessment data, and sending the first authentication mode to the mobile terminal, so that the mobile terminal requests for authentication from the server according to the first authentication mode; according to the embodiment of the invention, the first authentication mode is determined according to the risk assessment data, so that dynamic authentication is realized, the first authentication mode is the authentication mode which is most matched with the mobile terminal at present, an advanced authentication mode does not need to be adopted, resource occupation is reduced, and the cost is reduced; the dynamic authentication can improve the network security, gives consideration to the convenience of authentication, and improves the user experience. The invention further provides a server, a mobile terminal and a readable medium.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a dynamic authentication method, a server, a mobile terminal and a readable medium. Background Art

[0002] With the rapid development of mobile Internet, mobile devices (such as smartphones, tablets, wearable devices, etc.) have become an indispensable part of people's daily life and work. These devices usually need to access various online services and resources, so authentication security and user experience have become key issues in this field.

[0003] Currently, this field faces diverse network environments and security threats, including but not limited to phishing, man-in-the-middle attacks, data leakage, etc. Therefore, how to provide stable and secure authentication services in different network environments without affecting user experience is an urgent problem to be solved in this field. Summary of the invention

[0004] The present disclosure provides a dynamic authentication method, a server, a mobile terminal and a readable medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a dynamic authentication method, applied to a server, the method comprising:

[0006] Receiving risk assessment data sent by a mobile terminal;

[0007] Determining a first authentication method according to the risk assessment data;

[0008] The first authentication method is sent to the mobile terminal, so that the mobile terminal requests authentication from the server according to the first authentication method.

[0009] In another aspect, the present disclosure also provides a dynamic authentication method using a mobile terminal, the method comprising:

[0010] Acquire risk assessment data, and send the risk assessment data to a server;

[0011] Receive a first authentication method sent by the server, and request the server for authentication according to the first authentication method.

[0012] On the other hand, an embodiment of the present disclosure also provides a server, comprising: one or more processors; a memory on which one or more programs are stored; when the one or more programs are executed by the one or more processors, the one or more processors implement the dynamic authentication method as described above; at least one I / O interface, connected between the processor and the memory, configured to implement information interaction between the processor and the memory.

[0013] On the other hand, the embodiments of the present disclosure also provide a mobile terminal, comprising: one or more processors; a memory on which one or more programs are stored; when the one or more programs are executed by the one or more processors, the one or more processors implement the dynamic authentication method as described above; at least one I / O interface, connected between the processor and the memory, configured to implement information interaction between the processor and the memory.

[0014] On the other hand, an embodiment of the present disclosure also provides a server, comprising: one or more processors; a memory on which one or more programs are stored; when the one or more programs are executed by the one or more processors, the one or more processors implement the dynamic authentication method as described above; at least one I / O interface, connected between the processor and the memory, configured to implement information interaction between the processor and the memory.

[0015] On the other hand, an embodiment of the present disclosure further provides a computer-readable medium having a computer program stored thereon, wherein the program, when executed, implements the dynamic authentication method as described above.

[0016] The dynamic authentication method provided by the embodiment of the present disclosure is applied to a server, and the method includes: receiving risk assessment data sent by a mobile terminal, determining a first authentication method according to the risk assessment data, and sending the first authentication method to the mobile terminal, so that the mobile terminal requests authentication from the server according to the first authentication method; the embodiment of the present disclosure determines the first authentication method according to the risk assessment data, thereby realizing dynamic authentication, and the first authentication method is the authentication method that best matches the mobile terminal at present, and there is no need to adopt advanced authentication methods, thereby reducing resource occupation and reducing costs; dynamic authentication can improve network security while taking into account the simplicity of authentication and improving user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram of the system architecture of an embodiment of the present disclosure;

[0018] Figure 2 A schematic diagram of a dynamic authentication process with a server as the execution subject provided in the embodiment of the present disclosure Figure 1 ;

[0019] Figure 3 A schematic diagram of a process for determining a first authentication method provided in an embodiment of the present disclosure;

[0020] Figure 4 A schematic diagram of a dynamic authentication process with a server as the execution subject provided in the embodiment of the present disclosure Figure 2 ;

[0021] Figure 5A schematic diagram of a dynamic authentication process with a mobile terminal as the execution subject provided in an embodiment of the present disclosure Figure 1 ;

[0022] Figure 6 A schematic diagram of a dynamic authentication process with a mobile terminal as the execution subject provided in an embodiment of the present disclosure Figure 2 ;

[0023] Figure 7 The present invention is a schematic diagram of the structure of a server and a mobile terminal provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] Example embodiments will be described more fully below with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete and to enable those skilled in the art to fully understand the scope of the present disclosure.

[0025] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0026] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "comprising" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded.

[0027] The embodiments described herein may be described with reference to plan views and / or cross-sectional views by means of idealized schematic diagrams of the present disclosure. Therefore, the example illustrations may be modified according to manufacturing techniques and / or tolerances. Therefore, the embodiments are not limited to the embodiments shown in the accompanying drawings, but include modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the accompanying drawings have schematic properties, and the shapes of the regions shown in the figures illustrate the specific shapes of the regions of the elements, but are not intended to be limiting.

[0028] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0029] Currently, the authentication scheme has the following defects or problems:

[0030] 1. Staticity: Most existing authentication methods are static, that is, they do not dynamically adjust according to the network environment or other external conditions, which may lead to authentication failures or security vulnerabilities in unstable or insecure network environments.

[0031] 2. Complexity and user experience: High-security authentication methods (such as multi-factor authentication) are usually more complex and may affect the user experience. For example, users may need to remember complex passwords or carry physical tokens.

[0032] 3. Cost and resources: Advanced authentication methods (such as adaptive authentication) usually require more computing resources and storage space, which may not be suitable for mobile devices with limited resources.

[0033] In order to solve the above problems, the present disclosure provides a dynamic authentication method, which is applied to Figure 1 The system shown, Figure 1 As shown, the system includes a server and a mobile terminal, and the mobile terminal can be a smart phone, a tablet computer or other portable device. The mobile terminal is used to obtain risk assessment data and report the risk assessment data to the server so that the server determines a matching authentication method based on the risk assessment data. The mobile terminal may include an environment sensing module, a time management module, a device management module, and a user behavior management module, etc. The above modules are used to obtain various risk assessment data, wherein the environment sensing module may include a GPS (Global Positioning System) module, a gyroscope, an ambient light sensor, a microphone, etc. The server is configured with a machine learning model and an authentication method determination module, which is used to determine the authentication method based on the risk assessment data, wherein the machine learning model is used to evaluate the risk level based on the risk assessment data, and the authentication method determination module is used to determine the authentication method corresponding to the risk level.

[0034] Figure 2 A schematic diagram of a dynamic authentication process with a server as the execution subject provided in the embodiment of the present disclosure Figure 1 ,like Figure 2 As shown, the dynamic authentication method is applied to the server, comprising the following steps:

[0035] Step S11, receiving risk assessment data sent by the mobile terminal.

[0036] The risk assessment data may include at least one of the following: environmental data, time data, terminal device data, and user behavior data. The environmental data may include at least one of the following: geographic location data, physical environment data, and network environment data.

[0037] Physical environment data is used to determine whether the user is in a public place and can include ambient noise and / or light intensity.

[0038] Geolocation data can be used to determine whether the user is in a safe area.

[0039] The network environment data may include access network and / or connection data with other terminals. The network environment data may indicate network stability (e.g., signal strength, packet loss rate, delay, etc.), security requirements (e.g., whether the currently connected network is a public Wi-Fi), and whether it is in a security-sensitive location (e.g., a bank, a government agency, etc.). When the network environment is unstable, an authentication method with less data transmission may be selected. The mobile terminal may detect the current network environment data through a built-in sensor or software tool. For example, the network environment data may be obtained using a Bluetooth function module or an NFC function module of the mobile terminal. The Bluetooth function module may identify nearby known devices, such as personal notebooks, smart watches, etc., as a factor for authentication. For example, the Bluetooth function module scans nearby Bluetooth devices and can roughly determine the environment in which the user is located, such as a home, office, or public place, to achieve network environment perception. In some cases, the Bluetooth function module may be used to securely exchange authentication data. In indoor environments, the Bluetooth function module may also be used for more accurate location positioning as a reference factor for authentication. The NFC function module can be used for contactless rapid authentication, which is particularly suitable for scenarios that require rapid security checks. It can also be used for short-distance secure data transmission, which is relatively more difficult to be intercepted or tampered with. Using NFC tags or other NFC devices, you can quickly pair and authenticate devices to achieve device pairing and authentication. NFC can also be used as part of multi-factor authentication, for example, using NFC tags as physical tokens for the second step of authentication.

[0040] A variety of environmental sensing modules can be used on the mobile terminal side to collect environmental data in real time to provide comprehensive environmental information. Through multi-dimensional environmental sensing, the server can more accurately determine the security of the current environment and provide more personalized options. It can also be set to automatically use a certain authentication method at a specific geographic location or at a specific time to increase the robustness and reliability of the system. Through the comprehensive analysis of multiple environmental sensors and data sources, various potential security threats and risks can be more accurately identified and responded to, thereby improving the robustness and reliability of the system. By collecting and analyzing a variety of environmental data in real time, the authentication method can be dynamically adjusted to adapt to different environments and situations. For example, in a safe home environment, you may choose to use biometrics for authentication; while in an unstable or unsafe public environment, you may choose to use multi-factor authentication.

[0041] The terminal device data may include but is not limited to the power, temperature, and CPU usage of the mobile terminal. When the mobile terminal is low on power, avoid using authentication methods that consume more power, such as GPS or Bluetooth; when the mobile terminal is overheated, avoid using computationally intensive authentication methods to reduce the burden on the device.

[0042] The time data is the current time, and a time window can be set. During this time window, the authentication method may be more relaxed. For example, during working hours, password and biometric dual authentication is used, and during non-working hours, only password authentication is required.

[0043] User behavior data refers to the historical usage behavior of a user on a mobile terminal, for example, the use of a certain application in a certain environment. Machine learning can be used to analyze user behavior patterns in different time periods and dynamically adjust the authentication method. For example, if a user logs in at 9 a.m. every day, a simpler authentication method can be used at this time. The disclosed embodiments can provide a more personalized authentication experience, for example, automatically selecting the user's preferred authentication method in a security environment commonly used by the user.

[0044] Step S12, determining a first authentication method according to the risk assessment data.

[0045] The server uses a machine learning algorithm to analyze the risk assessment data and selects the most appropriate first authentication method according to the analysis result. The first authentication method may include one or more authentication methods.

[0046] The authentication methods of related technologies usually only focus on a single aspect and lack a comprehensive and integrated authentication solution. The disclosed embodiments intelligently select authentication methods based on various risk assessment data, not only taking into account the network environment, but also factors such as device status, user behavior, time, geographic location, and physical environment. This can reduce the number of times users perform complex authentication operations in unnecessary situations, thereby improving user experience. For example, when the system recognizes that the user is in a safe environment, it can automatically skip some unnecessary authentication steps.

[0047] Step S13: sending the first authentication method to the mobile terminal, so that the mobile terminal requests authentication from the server according to the first authentication method.

[0048] The server can send the one or more first authentication methods to the mobile terminal. When there is only one first authentication method, the mobile terminal can request authentication from the server according to the first authentication method. When there are multiple first authentication methods, the mobile terminal can select one of the first authentication methods according to the user's choice and request authentication from the server.

[0049] After receiving the authentication request from the mobile terminal, the server completes the authentication and records the log. Once the authentication is successful, the user status is updated and access to resources is allowed. All operations and events during the authentication process are recorded for subsequent auditing and analysis.

[0050] The dynamic authentication method provided by the embodiment of the present disclosure is applied to a server, and the method includes: receiving risk assessment data sent by a mobile terminal, determining a first authentication method according to the risk assessment data, and sending the first authentication method to the mobile terminal, so that the mobile terminal requests authentication from the server according to the first authentication method; the embodiment of the present disclosure determines the first authentication method according to the risk assessment data, thereby realizing dynamic authentication, and the first authentication method is the authentication method that best matches the mobile terminal at present, and there is no need to adopt advanced authentication methods, thereby reducing resource occupation and reducing costs; dynamic authentication can improve network security while taking into account the simplicity of authentication and improving user experience.

[0051] In some embodiments, Figure 3 As shown, the step of determining the first authentication method according to the risk assessment data (step S12) includes the following steps:

[0052] Step S121, determining the risk level according to the risk assessment data.

[0053] The risk level can be set to two risk levels, high and low, or to three risk levels, high, medium and low. In the embodiment of the present disclosure, setting the three risk levels, high, medium and low, is taken as an example for explanation.

[0054] The server uses a machine learning model to evaluate the risk level, that is, risk assessment data is input into the machine learning model, and the machine learning model outputs an assessment label, which represents the risk level.

[0055] The server uses a machine learning model (such as a decision tree, a random forest, or a neural network) to analyze the risk assessment data. The machine learning model is trained to identify the risk level of the mobile terminal. For example, the machine learning model can use the scikit-learn algorithm for machine learning analysis.

[0056] Step S122: determining a first authentication method corresponding to a risk level according to a preset mapping relationship between risk levels and authentication methods.

[0057] The server uses an authentication method determination module to determine the authentication method corresponding to the risk level, wherein the authentication method determination module is pre-set with a mapping relationship between the risk level and the authentication method. It should be noted that one risk level can correspond to one or more authentication methods, that is, the first authentication method can include one or more authentication methods.

[0058] The server selects one or more authentication methods that are most suitable for the mobile terminal based on the risk level assessment result of the machine learning model, which may include password, biometrics, multi-factor authentication, etc. In other words, the first authentication method may include one or any combination of the following: password, biometrics, multi-factor authentication, etc.

[0059] On the back-end server, the machine learning model will evaluate the input risk assessment data and output an evaluation label, which represents the risk level of the current mobile terminal. It will also determine the corresponding first authentication method based on the risk level, and can provide more stable and secure authentication services in unpredictable and uncontrollable external environments.

[0060] The following describes various authentication methods respectively.

[0061] Multi-Factor Authentication (MFA) authentication method:

[0062] Description: Combines multiple authentication methods such as passwords, biometrics, hardware tokens, etc.

[0063] Speed: Slow because of the multiple steps and verification methods involved.

[0064] Security: High, as an attacker would need to break through multiple barriers.

[0065] Password authentication methods can include:

[0066] 1. Basic Authentication

[0067] Description: Username and password are sent via HTTP (Hypertext Transfer Protocol) header, usually encoded in Base64.

[0068] Speed: Very fast, as only simple encoding and string comparisons are involved.

[0069] Security: Low. If SSL / TLS is not used, credentials may be intercepted.

[0070] 2. Client certificate authentication

[0071] Description: The client provides a digital certificate to prove its identity.

[0072] Speed: Slower because it involves certificate verification and encryption operations.

[0073] Security: High, because digital certificates are generally difficult to forge.

[0074] 3. Kerberos authentication

[0075] Description: Uses symmetric key cryptography and third-party authorization to authenticate users.

[0076] Speed: Slower because it involves multiple steps and key exchanges.

[0077] Security: High, due to the use of strong encryption and timestamping.

[0078] 4. OAuth 2.0

[0079] Description: An authorization framework that allows third-party applications to access account information with user authorization without the user revealing the password.

[0080] Speed: Slower because it involves multiple steps and redirects.

[0081] Security: High, especially when combined with other security measures.

[0082] 5. Token Authentication

[0083] Description: The server generates a token, which the client stores and uses for subsequent requests.

[0084] Speed: Fast, as only token generation and verification are involved.

[0085] Security: Medium, depends on the complexity and transmission security of the token.

[0086] 6. One-Time Password (OTP)

[0087] Description: Use a one-time password for authentication.

[0088] Speed: Fast, because only a one-time password needs to be verified.

[0089] Security: Moderate, as the password can only be used once but can be subject to replay attacks.

[0090] When the environment is stable and secure, multi-factor authentication can be used to increase security, but in unstable or resource-limited situations, only single or two-factor authentication can be used to achieve selective application of multi-factor authentication (MFA).

[0091] When the environment is unstable, you can use a one-time password (OTP) or a short-term dynamic password; when the environment is stable, you can use a more secure but more computationally intensive password hash algorithm to combine dynamic passwords with static passwords.

[0092] In some embodiments, Figure 4 As shown, after determining the risk level according to the risk assessment data (i.e., step S121), the dynamic authentication method may further include the following steps:

[0093] Step 121', when the risk level is a low risk level, the risk level is sent to the mobile terminal, so that the mobile terminal requests authentication from the server according to a second authentication method, where the second authentication method is an authentication method determined by the mobile terminal and is different from the first authentication method.

[0094] In some low-risk scenarios, the disclosed embodiments also allow the mobile terminal to decide whether to change the authentication method, rather than relying on the server to decide the authentication method every time. It should be noted that during the authentication process, the mobile terminal continues to monitor the risk assessment data. If changes are detected in the environment, time, device parameters, etc., the data analysis is performed again and the authentication method is reselected.

[0095] In some embodiments, a high risk level is determined when one of the following conditions is met:

[0096] Determining based on geographic location data that the mobile terminal is not in a common location;

[0097] Determine the access network as a non-secure network based on network environment data;

[0098] The sum of the weights of the risk assessment data is greater than a preset first threshold.

[0099] In some embodiments, the medium risk level is determined when one of the following conditions is met:

[0100] Determining that the mobile terminal is located at a common location based on the geographic location data, determining that the accessed network is a secure network based on the network environment data, and determining that the mobile terminal is not a common device based on the terminal device data;

[0101] The sum of the weights of the risk assessment data is less than a preset first threshold and greater than a preset second threshold.

[0102] In some embodiments, a low risk level is determined when one of the following conditions is met:

[0103] Determining that the mobile terminal is located at a common location based on the geographic location data, determining that the access network is a secure network based on the network environment data, and determining that the mobile terminal is a common device based on the terminal device data;

[0104] The sum of the weights of the risk assessment data is less than a preset second threshold.

[0105] In some embodiments, the risk assessment data that must be obtained includes:

[0106] Geolocation data, i.e. GPS data, which is used to determine whether a user is in a common or safe geographic location;

[0107] Network environment data, namely Wi-Fi / 4G / 5G data, which is used to detect whether the network is secure or has been tampered with;

[0108] Terminal device data, namely device model, operating system version and other data, is used to identify whether it is a registered device.

[0109] Recommended risk assessment data include:

[0110] Physical environment data, including environmental noise and light intensity. Light intensity is used to determine whether the mobile terminal is in a dark or overly bright environment, which may affect biometric technologies such as facial recognition; environmental noise may affect voice recognition.

[0111] Network environment data, namely Bluetooth information, is used to detect whether there are any suspicious devices nearby.

[0112] The weights of various risk assessment data can be set as follows: the weight of GPS data is 0.4, the weight of network environment data is 0.3, the weight of terminal device data is 0.2, the weight of ambient light intensity is 0.05, the weight of ambient noise is 0.03, and the weight of Bluetooth data is 0.02. The first threshold can be 0.6, and the second threshold can be 0.4. Such settings can ensure that the most appropriate authentication method can be selected in different risk environments.

[0113] The present disclosure also provides a dynamic authentication method, which is applied to a mobile terminal. Figure 5 As shown, the dynamic authentication method includes the following steps:

[0114] Step S21, obtaining risk assessment data, and sending the risk assessment data to a server.

[0115] In some embodiments, the risk assessment data includes at least one of the following: environmental data, time data, terminal device data, and user behavior data; the environmental data includes at least one of the following: geographic location data, physical environment data, and network environment data.

[0116] In this step, the mobile terminal starts environmental sensing modules such as GPS, Wi-Fi, Bluetooth, NFC, light sensor, noise sensor, etc. GPS and Wi-Fi modules can be used for geographic location positioning. For example, the Android or iOS location service API (Application Programming Interface) can be used to obtain the current GPS and / or Wi-Fi location data, which are used to determine whether the mobile terminal is in a safe place; the noise sensor and / or light sensor built into the mobile terminal can be used to detect the noise level and light intensity of the surrounding environment, which are used to determine whether the mobile terminal is in a safe or public environment. Wi-Fi and Bluetooth modules can be used to scan devices and networks near the mobile terminal, and the security of the network environment can be determined by analyzing the devices and networks near the mobile terminal.

[0117] After obtaining the risk assessment data, the mobile terminal may package the risk assessment data into JSON or other formats and send the data to the server via an HTTPS request.

[0118] Step S22: receiving the first authentication method sent by the server, and requesting the server for authentication according to the first authentication method.

[0119] After the mobile terminal receives the first authentication method sent by the server, the user interface is updated, and the user interface provides the user with an option to select or confirm the authentication method. Exemplarily, multiple first authentication method options can be provided to the user by selecting a button or a drop-down menu. In the case of a higher risk level, the first authentication method may include but is not limited to biometrics or multi-factor authentication; in the case of a lower risk level, the first authentication method may include but is not limited to password or one-time password (OTP) authentication.

[0120] In the case where there are multiple first authentication methods and the user selects one of the first authentication methods, the mobile terminal performs the corresponding authentication request operation according to the first authentication method selected by the user, such as entering a password, biometrics, etc., encrypts the authentication data and sends it to the server, which verifies the authentication data and returns the verification result to the mobile terminal. During the authentication process, the mobile terminal can also provide real-time feedback information, such as displaying "detecting the environment" or "security authentication in progress". It should be noted that the mobile terminal can also display the stability and security of the environment. For example, a small icon or indicator can be added to the login or authentication page to identify the stability and security of the current environment by color. For example, green indicates safety, yellow indicates general, and red indicates unsafe. The mobile terminal provides real-time feedback information and displays the stability and security of the environment, which can enable users to understand the authentication process and the security of the current environment more clearly and enhance transparency.

[0121] The dynamic authentication method provided by the embodiment of the present disclosure is applied to a mobile terminal, and the method includes: obtaining risk assessment data, sending the risk assessment data to a server; receiving a first authentication method sent by the server, and requesting the server for authentication according to the first authentication method. The embodiment of the present disclosure determines the first authentication method according to the risk assessment data, thereby realizing dynamic authentication. The first authentication method is the authentication method that best matches the mobile terminal at present, and there is no need to adopt an advanced authentication method, thereby reducing resource occupation and cost. Dynamic authentication can improve network security, while taking into account the simplicity of authentication and improving user experience.

[0122] In some embodiments, the acquisition of risk assessment data (i.e., step S21) includes the following steps: periodically acquiring risk assessment data. That is, the mobile terminal continuously monitors risk assessment data such as environmental data and time data, and reports risk assessment data to the server once every period of time, so that the server can re-evaluate the current risk level and dynamically adjust the authentication method of the mobile terminal.

[0123] It should be noted that after completing the authentication, the mobile terminal can turn off each environment sensing module and device management module to save power consumption, and turn them on again when the next cycle arrives.

[0124] In order to reduce the power consumption of the mobile terminal and the overhead of the interaction between the mobile terminal and the server, the risk assessment data is not simply acquired and reported periodically. Instead, the current risk assessment data is re-reported to the server only when the risk assessment data changes significantly.

[0125] Therefore, in some embodiments, sending the risk assessment data to the server (i.e., step S21) includes the following steps:

[0126] Step S211, determining the change in the risk assessment data of the current period relative to the risk assessment data of the previous period.

[0127] The mobile terminal calculates, in each cycle, a change in the risk assessment data of the current cycle relative to the risk assessment data of the previous cycle, and the risk assessment data may be environmental data and / or terminal device data.

[0128] Step S212: When the change amount is greater than a preset third threshold, the risk assessment data is sent to the server.

[0129] If it is detected that the environment in which the mobile terminal is located and / or the parameters of the mobile terminal itself have changed significantly, for example, such as the signal strength of the mobile terminal is greatly reduced, the CPU usage rate is greatly increased, etc., the mobile terminal will send the risk assessment data of the current period to the server for the server to re-analyze the data and select the authentication method.

[0130] In some embodiments, the requesting the server for authentication according to the first authentication method (i.e., step S22) includes the following steps: when there are at least two first authentication methods, selecting a target authentication method corresponding to the first authentication request instruction from each first authentication method, and requesting the server for authentication according to the target authentication method. In other words, the server can return multiple first authentication methods to the mobile terminal for the user of the mobile terminal to select from, and the mobile terminal and the server can perform authentication according to the first authentication method selected by the user.

[0131] In some embodiments, Figure 6 As shown, after sending the risk assessment data to the server (i.e., step S21), the dynamic authentication method may further include the following steps:

[0132] Step S31, receiving the risk level sent by the server, the risk level is a low risk level.

[0133] Step S32: Obtain a second authentication request instruction, and determine a second authentication method corresponding to the second authentication request instruction.

[0134] Correspondingly, requesting the server for authentication according to the first authentication method (ie, step S22) includes the following steps: requesting the server for authentication according to the second authentication method when the second authentication method is different from the first authentication method.

[0135] In some low-risk scenarios, the embodiments of the present disclosure allow the mobile terminal to decide whether to change the authentication method on its own, rather than relying on the server to decide the authentication method every time, thereby improving flexibility and user experience.

[0136] The solution of the embodiment of the present disclosure is described below in conjunction with a specific application scenario.

[0137] Assume that a user is using a mobile banking application to transfer money. The built-in environmental sensing module of the mobile terminal detects the following risk assessment data: GPS data and Wi-Fi data, which reflect that the mobile terminal is currently in an unknown location, the environmental noise is high, and multiple unknown Wi-Fi networks and Bluetooth devices are scanned nearby. The mobile terminal sends the above risk assessment data to the backend server. After the server analyzes the risk assessment data through a machine learning model, it determines that the current environment is at a high risk level. In this case, the server will choose to use multi-factor authentication as the first authentication method. In addition to requiring the user to enter a password, a text message verification code will be sent to the mobile terminal, or fingerprint or facial recognition will be required. In this way, in a high-risk environment, an additional security layer can be added, thereby greatly reducing the risk of illegal access to the account. Even if an attacker can steal the user's password, it is still difficult to perform illegal operations due to the existence of multi-factor authentication. Through this method of dynamically selecting authentication methods, more secure and stable services can be provided in different environments, while also optimizing the user experience.

[0138] The disclosed embodiment provides a dynamic authentication scheme, which can obtain risk assessment data in real time through various environment sensing modules, time management modules, device management modules and user behavior management modules built into the mobile terminal, such as GPS, Wi-Fi, Bluetooth, ambient light sensor and noise sensor, etc. The server uses a machine learning algorithm to analyze the risk assessment data and dynamically selects an authentication method, which may include password verification, biometrics, multi-factor authentication, etc. The mobile terminal and the server can dynamically negotiate to determine the best authentication method and perform the corresponding authentication operation. During the authentication process, the mobile terminal will continuously monitor changes in the environment and terminal parameters, and dynamically adjust the authentication method as needed. The disclosed embodiment can dynamically adapt to various unforeseen and uncontrollable external environments to ensure that stable and secure authentication services can be provided in these environments, thereby providing a better user experience.

[0139] The embodiments of the present disclosure can achieve the following technical effects:

[0140] 1. The disclosed embodiment utilizes a multi-dimensional environment sensing module as well as a time management module, a device management module, and a user behavior management module to obtain comprehensive risk assessment data, including geographic location data, environmental noise, light intensity, access network, connection data with other terminals, time data, terminal device data, user behavior data, etc.

[0141] 2. The disclosed embodiments can dynamically select the most suitable authentication method based on risk assessment data using machine learning or other advanced algorithms, thus solving the static and limitation problems in the prior art and achieving dynamic authentication. In mobile scenarios, users may frequently switch network environments (for example, from Wi-Fi to mobile data). If each switch requires a slow authentication process, the user experience may be reduced. By dynamically adjusting the authentication method, it can be ensured that users can have a smooth experience in various network environments.

[0142] 3. During the authentication process, it can monitor changes in the environment, terminal parameters, time, user behavior, etc. in real time and dynamically and adaptively adjust the authentication method, providing a more stable and secure authentication service.

[0143] 4. Through the dynamic selection process, the user experience can be significantly improved without sacrificing security.

[0144] 5. Since the authentication method can be dynamically selected according to actual needs, the embodiment of the present disclosure can more effectively utilize device resources and reduce costs.

[0145] The embodiments of the present disclosure can be applied to the following scenarios:

[0146] 1. Mobile payment and e-commerce scenarios: When making online payments or shopping, highly secure and fast authentication is required.

[0147] 2. Enterprise internal system access scenario: When employees use mobile devices to access enterprise resources, it is necessary to ensure that only authorized users can access.

[0148] 3. Social media and communication application scenarios: Users need to log in and use applications securely under different environments and network conditions.

[0149] 4. Internet of Things scenarios: smart homes, industrial control systems, etc., require security authentication in various environments.

[0150] 5. Public transportation and navigation scenarios: Authentication is required in dynamic and unstable network environments, such as subways and airplanes

[0151] like Figure 7 As shown, the embodiment of the present disclosure further provides a server, the server comprising:

[0152] at least one processor 701;

[0153] A memory 702 storing at least one program, when the at least one program is executed by the at least one processor, the at least one processor implements the dynamic authentication method as described above;

[0154] At least one I / O interface 703 is connected between the processor and the memory and is configured to implement information exchange between the processor and the memory.

[0155] Among them, the processor 701 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 702 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 703 is connected between the processor 701 and the memory 702, and can realize information interaction between the processor 701 and the memory 702, including but not limited to a data bus (Bus), etc.

[0156] In some embodiments, the processor 701 , the memory 702 , and the I / O interface 703 are connected to each other through a bus, and further connected to other components of the computing device.

[0157] like Figure 7 As shown, the embodiment of the present disclosure further provides a mobile terminal, the mobile terminal comprising:

[0158] at least one processor 701;

[0159] A memory 702 storing at least one program, when the at least one program is executed by the at least one processor, the at least one processor implements the dynamic authentication method as described above;

[0160] At least one I / O interface 703 is connected between the processor and the memory and is configured to implement information exchange between the processor and the memory.

[0161] Among them, the processor 701 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 702 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 703 is connected between the processor 701 and the memory 702, and can realize information interaction between the processor 701 and the memory 702, including but not limited to a data bus (Bus), etc.

[0162] In some embodiments, the processor 701 , the memory 702 , and the I / O interface 703 are connected to each other through a bus, and further connected to other components of the computing device.

[0163] The embodiments of the present disclosure further provide a computer-readable medium on which a computer program is stored, wherein when the computer program is executed, the dynamic authentication method provided in the aforementioned embodiments is implemented.

[0164] It will be appreciated by those skilled in the art that all or some of the steps in the method disclosed above, the functional modules / units in the device may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0165] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly stated, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, it will be understood by those skilled in the art that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A dynamic authentication method, characterized in that: Applied to a server, the method comprises: Receiving risk assessment data sent by a mobile terminal; Determining a first authentication method according to the risk assessment data; The first authentication method is sent to the mobile terminal, so that the mobile terminal requests authentication from the server according to the first authentication method.

2. The method according to claim 1, characterized in that Determining the first authentication method according to the risk assessment data includes: determining a risk level based on the risk assessment data; A first authentication method corresponding to the risk level is determined according to a preset mapping relationship between the risk level and the authentication method.

3. The method according to claim 2, characterized in that After determining the risk level according to the risk assessment data, the method further includes: When the risk level is a low risk level, the risk level is sent to the mobile terminal so that the mobile terminal requests authentication from the server according to a second authentication method, where the second authentication method is an authentication method determined by the mobile terminal and is different from the first authentication method.

4. The method according to claim 2, characterized in that The risk assessment data includes at least one of the following: environmental data, time data, terminal device data, and user behavior data; The environmental data includes at least one of the following: geographic location data, physical environment data, and network environment data.

5. The method according to claim 4, characterized in that Determining the risk level according to the risk assessment data includes: A high risk level is determined when one of the following conditions is met: determining, according to the geographic location data, that the mobile terminal is not in a common location; Determining, based on the network environment data, that the access network is an insecure network; The sum of the weights of the risk assessment data is greater than a preset first threshold.

6. The method according to claim 4, characterized in that Determining the risk level according to the risk assessment data includes: The risk level is determined to be medium if one of the following conditions is met: Determining that the mobile terminal is located at a common location according to the geographic location data, determining that the accessed network is a secure network according to the network environment data, and determining that the mobile terminal is not a common device according to the terminal device data; The sum of the weights of the risk assessment data is less than a preset first threshold and greater than a preset second threshold.

7. The method according to claim 4, characterized in that Determining the risk level according to the risk assessment data includes: The risk level is determined to be low if one of the following conditions is met: Determining that the mobile terminal is located at a common location according to the geographic location data, determining that the access network is a secure network according to the network environment data, and determining that the mobile terminal is a common device according to the terminal device data; The sum of the weights of the risk assessment data is less than a preset second threshold.

8. A dynamic authentication method, characterized in that: Applied to a mobile terminal, the method comprises: Acquire risk assessment data, and send the risk assessment data to a server; Receive a first authentication method sent by the server, and request the server for authentication according to the first authentication method.

9. The method according to claim 8, characterized in that The obtaining of risk assessment data includes: periodically obtaining risk assessment data.

10. The method according to claim 9, characterized in that The sending the risk assessment data to a server comprises: Determine the amount by which the risk assessment data for the current period has changed relative to the risk assessment data for the previous period; When the change amount is greater than a preset third threshold, the risk assessment data is sent to a server.

11. The method according to claim 8, characterized in that The requesting the server for authentication according to the first authentication method includes: In the case that there are at least two first authentication methods, a target authentication method corresponding to the first authentication request instruction is selected from each of the first authentication methods, and the server is requested to authenticate according to the target authentication method.

12. The method according to claim 8, characterized in that After sending the risk assessment data to the server, the method further includes: receiving a risk level sent by the server, wherein the risk level is a low risk level; Obtaining a second authentication request instruction, and determining a second authentication method corresponding to the second authentication request instruction; The requesting the server for authentication according to the first authentication method includes: When the second authentication method is different from the first authentication method, requesting the server for authentication according to the second authentication method.

13. The method according to any one of claims 8 to 12, characterized in that: The risk assessment data includes at least one of the following: environmental data, time data, terminal device data, and user behavior data; The environmental data includes at least one of the following: geographic location data, physical environment data, and network environment data.

14. A server, wherein: include: one or more processors; a memory having one or more programs stored therein; When the one or more programs are executed by the one or more processors, the one or more processors implement the dynamic authentication method according to any one of claims 1 to 7; At least one I / O interface is connected between the processor and the memory and is configured to implement information interaction between the processor and the memory.

15. A mobile terminal, wherein: include: one or more processors; a memory having one or more programs stored therein; When the one or more programs are executed by the one or more processors, the one or more processors implement the dynamic authentication method according to any one of claims 8 to 13; At least one I / O interface is connected between the processor and the memory and is configured to implement information interaction between the processor and the memory.

16. A computer readable medium having a computer program stored thereon, wherein: When the program is executed, the dynamic authentication method as described in any one of claims 1-7 is implemented, or the dynamic authentication method as described in any one of claims 8-13 is implemented.

Images