User identity authentication method, computing device and storage medium

Abstract

The invention discloses a user identity authentication method, which is suitable for being executed in computing equipment, and comprises the following steps: setting one or more authentication factors according to the application type of each application, each authentication factor being suitable for realizing one authentication type; the authentication configuration module generates a configuration file corresponding to the application type according to the application type and the corresponding authentication factor; in response to an authentication initiation request of a target application received by the PAM interface library, the PAM module calls an authentication management service module to determine a corresponding configuration file according to the application type of the target application; the authentication management service module determines one or more authentication factors included in the configuration file, and simultaneously initiates one or more authentication according to the one or more authentication factors; and the authentication management service module responds to the received authentication result of the one or more authentication factors, generates an authentication message according to the authentication result and sends the authentication message to the target application.

Description

Technical Field

[0001] The present invention relates to the field of computer security authentication, and in particular to a method for authenticating a user's identity, a computing device and a storage medium. Background Art

[0002] In some operating systems, when an application calls a general pluggable authentication module to authenticate a user, it initiates a specified authentication method according to the configuration file of the pluggable authentication module. Such an authentication process specifies the execution order of multiple authentication factors, and each authentication factor is executed in turn to authenticate the user according to the execution order.

[0003] When only one of the authentication factors is required, the pluggable authentication module will still execute multiple execution factors set before the order of execution of the authentication factor according to the configuration file. When multiple execution factors are set to be executed, the pluggable authentication module will still execute all execution factors according to the execution order, and record the execution results when executing the set execution factors. Finally, the user authentication is completed based on the execution results of multiple execution factors. The execution logic of this user identity authentication method is relatively fixed, and the authentication efficiency is low.

[0004] Therefore, a new method of user authentication is needed. Summary of the invention

[0005] To this end, the present invention provides a method for authenticating a user's identity, in an effort to solve or at least alleviate the above problems.

[0006] According to a first aspect of the present invention, there is provided a method for authenticating a user, which is suitable for execution in a computing device, wherein an operating system and one or more applications running based on the operating system are running in the computing device, wherein the operating system includes a PAM interface library, a PAM module, an authentication management service module and an authentication configuration module, wherein the method includes: setting one or more authentication factors according to the application type of each application, each authentication factor being suitable for realizing a type of authentication; the authentication configuration module generating a configuration file corresponding to the application type according to the application type and the corresponding authentication factor; in response to the PAM interface library receiving an authentication request initiated by a target application, the PAM module calling the authentication management service module to determine a corresponding configuration file according to the application type of the target application; the authentication management service module determining one or more authentication factors included in the configuration file, and simultaneously initiating one or more authentications according to the one or more authentication factors; in response to receiving an authentication result of the one or more authentication factors, the authentication management service module generates an authentication message according to the authentication result and sends it to the target application.

[0007] Optionally, in the method according to the present invention, the application type of the application includes: one or more of: a login application, a lock screen application, and a privilege escalation application.

[0008] Optionally, in the method according to the present invention, the authentication factor includes: one or more of a password authentication factor, a fingerprint authentication factor, a face authentication factor, an iris authentication factor and a UKey authentication factor.

[0009] Optionally, in the method according to the present invention, the authentication management service module determines one or more authentication factors included in the configuration file, and simultaneously initiates one or more authentications based on the one or more authentication factors, including: the authentication management service module generates a corresponding authentication factor authentication request based on each authentication factor included in the configuration file to obtain one or more authentication factor authentication requests; and simultaneously sends one or more authentication factor authentication requests through the bus module to execute the authentication process corresponding to one or more authentication types.

[0010] Optionally, in the method according to the present invention, the authentication mode of the application type includes multi-factor authentication and single-factor authentication.

[0011] Optionally, in the method according to the present invention, generating an authentication message based on the authentication result and sending it to the target application includes: when the authentication method preset by the application type corresponding to the application is single-factor authentication, after the authentication management service module receives the authentication result of an authentication factor, if the authentication result of the authentication factor is successful authentication, a user authentication pass message is sent to the application.

[0012] Optionally, the method according to the present invention also includes: when the authentication method preset for the application type corresponding to the application is multi-factor authentication, after the authentication management service module receives the authentication results of multiple authentication factors, if the authentication result of one or more authentication factors is authentication failure, a user authentication failure message is sent to the user.

[0013] According to a second aspect of the present invention, there is provided a computing device, comprising: one or more processors; a memory; and one or more devices, wherein the one or more devices comprise instructions for a method for authenticating a user.

[0014] According to a third aspect of the present invention, there is provided a computer-readable storage medium storing one or more programs, wherein the one or more programs include instructions, which, when executed by a computing device, cause the computing device to perform an identity authentication method for a user.

[0015] According to a fourth aspect of the present invention, a computer program product is provided, comprising a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the method for authenticating a user of the present invention.

[0016] The present invention proposes a method for authenticating a user's identity, wherein one or more authentication factors are set according to the application type of the application, so as to perform differentiated authentication management on different types of applications; a corresponding configuration file is generated according to each application type, so as to simultaneously initiate authentication of one or more authentication factors according to the configuration file, thereby improving the authentication efficiency and flexibility of authenticating the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to achieve the above and related purposes, the present invention describes certain illustrative aspects in conjunction with the following description and the accompanying drawings, which indicate various ways in which the principles disclosed in the present invention can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. By reading the following detailed description in conjunction with the accompanying drawings, the above and other purposes, features and advantages disclosed by the present invention will become more apparent. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.

[0018] Figure 1 A schematic diagram of a computing device according to an exemplary embodiment of the present invention is shown;

[0019] Figure 2 A schematic diagram showing an application running in a computing device according to an exemplary embodiment of the present invention is shown;

[0020] Figure 3 A schematic diagram of a method 300 for authenticating a user according to an exemplary embodiment of the present invention is shown;

[0021] Figure 4 A schematic diagram of processing an authentication request according to an exemplary embodiment of the present invention is shown. DETAILED DESCRIPTION

[0022] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to enable the scope of the present disclosure to be fully conveyed to those skilled in the art. The same reference numerals generally refer to the same components or elements.

[0023] According to one embodiment of the present invention, a method for authenticating a user's identity of the present invention is suitable for being executed in a computing device. Figure 1 A schematic diagram of a computing device according to an exemplary embodiment of the present invention is shown.

[0024] Figure 11 shows a block diagram of a computing device according to an exemplary embodiment of the present invention. In a basic configuration, computing device 100 includes at least one processing unit 120 and system memory 110. According to one aspect, depending on the configuration and type of computing device, system memory 110 includes, but is not limited to, volatile storage (e.g., random access memory), non-volatile storage (e.g., read-only memory), flash memory, or any combination of such memories. According to one aspect, system memory 110 includes operating system 111.

[0025] According to one aspect, operating system 111, for example, is suitable for controlling the operation of computing device 100. Furthermore, examples may be practiced in conjunction with graphics libraries, other operating systems, or any other application programs, and are not limited to any particular application or system. Figure 1 This basic configuration is illustrated in FIG by those components within dashed line 115. According to one aspect, computing device 100 has additional features or functionality. For example, according to one aspect, computing device 100 includes additional data storage devices (removable and / or non-removable), such as magnetic disks, optical disks, or tapes.

[0026] As stated above, according to one aspect, the program module 112 is stored in the system memory 110. According to one aspect, the program module 112 can be implemented as one or more computer program products, and the present application does not limit the type of computer program products, for example, it can include: email, word processing application, spreadsheet application, database application, slide show application, painting or computer-aided application, web browser, etc. In some embodiments according to the present application, the computer program / instructions related to the user identity authentication method are packaged into a computer program product, and when these computer programs / instructions are executed by the processor (i.e., the processing unit 120), the user identity authentication method according to the present application is implemented.

[0027] According to one aspect, the examples may be practiced on a circuit comprising discrete electronic components, a packaged or integrated electronic chip containing logic gates, a circuit utilizing a microprocessor, or a single chip containing electronic components or a microprocessor. Figure 1Each or many components shown in can be integrated in a system on chip (SOC) on a single integrated circuit to practice examples. According to one aspect, such a SOC device may include one or more processing units, a graphics unit, a communication unit, a system virtualization unit, and various application functions, all of which are integrated (or "burned") into a chip substrate as a single integrated circuit. When operated via SOC, the functions described in this article can be operated via a dedicated logic integrated with other components of the computing device 800 on a single integrated circuit (chip). Embodiments of the present invention can also be practiced using other technologies capable of performing logical operations (such as AND, OR, and NOT), including but not limited to mechanical, optical, fluid, and quantum technologies. In addition, embodiments of the present invention can be practiced in a general-purpose computer or in any other circuit or system.

[0028] According to one aspect, the computing device 100 may also have one or more input devices 131, such as a keyboard, a mouse, a pen, a voice input device, a touch input device, etc. Output devices 132 may also be included, such as a display, a speaker, a printer, etc. The aforementioned devices are examples and other devices may also be used. The computing device 100 may include one or more communication connections 133 that allow communication with other computing devices 140. Examples of suitable communication connections 133 include, but are not limited to: RF transmitters, receivers, and / or transceiver circuits; Universal Serial Bus (USB), parallel and / or serial ports. The computing device 100 can be communicatively connected to other computing devices 140 via a communication connection 333.

[0029] The embodiment of the present invention also provides a non-transitory readable storage medium, which stores instructions, and the instructions are used to make the computing device perform a method according to an embodiment of the present invention. The readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. The information can be a computer-readable instruction, a data structure, a module of a program, or other data. Examples of readable storage media include, but are not limited to: phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, tape disk storage or other magnetic storage device or any other non-transitory readable storage medium.

[0030] According to one aspect, communication media is implemented by computer readable instructions, data structures, program modules, or other data in a modulated data signal (e.g., a carrier wave or other transport mechanism), and includes any information delivery media. According to one aspect, the term "modulated data signal" describes a signal that has one or more characteristics set or changed in a manner that encodes information in the signal. By way of example and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0031] It should be noted that, although the computing device shown above only includes the processing unit 120, the system memory 110, the input device 131, the output device 132, and the communication connection 133, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the device may only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0032] Figure 2 FIG. 2 shows a schematic diagram of running an application in a computing device according to an exemplary embodiment of the present invention. Figure 2 As shown, an operating system 111 is running in the computing device 100. The present invention does not limit the specific type of the operating system 111. The operating system 111 can be implemented as a Linux system or other Unix-like systems.

[0033] Based on the operating system, one or more applications can be run, and the present invention does not limit the specific number and type of the running applications. Figure 2 Application 231 , application 232 , and application 233 are shown.

[0034] The operating system 111 includes a PAM interface library 241, a PAM module 242, and an authentication management service module 243 and an authentication configuration module 244. The PAM interface library can be specifically implemented as a Linux-PAM interface library (Pluggable Authentication Modules for Linux), which is a set of identity sharing libraries suitable for the Linux operating system, which provides dynamic identity authentication module support for applications or services in the system. The PAM interface library provides a series of interfaces for applications. When an application needs to implement user authentication, it does not need to build authentication process-related codes within the application. It only needs to call the interface provided by the PAM interface library and use the authentication function provided by the PAM interface library to implement user authentication.

[0035] According to one embodiment of the present invention, the PAM module can be specifically implemented as a pluggable authentication module, which is a code library for performing identity authentication and authorization tasks. One or more PAM modules can be constructed in the operating system 111, and each PAM module implements corresponding functions. For example, it can be specifically implemented as an authentication management module, an account management module, a session management module, and a password management module, etc. The implemented functions may include checking user passwords, checking whether the user is within the allowed IP range, checking whether the user's account has expired, etc. The present invention does not limit the number of PAM modules constructed in the operating system and the corresponding functions implemented.

[0036] The PAM interface library can be implemented as an intermediate layer in the operating system to realize the interaction between the application and the PAM module, including: obtaining which PAM modules are built in the operating system according to the PAM-SPI, and providing the application with the call of these PAM modules according to the PAM-API. When the user's call request is obtained according to the PAM-API, the call request is forwarded to the PAM module so that the PAM module can process the call request. The PAM interface library provides an interactive platform for applications and PAM modules.

[0037] According to one embodiment of the present invention, an authentication management service module 243 and an authentication configuration module 244 are also constructed in the operating system 111. The authentication configuration module is suitable for constructing a configuration file. The authentication management service module is suitable for determining one or more authentication factors to be adopted in the PAM module according to the configuration file when the PAM module is called, and initiating authentication according to the determined multiple authentication factors, and returning the authentication result to the PAM module.

[0038] The following will be based on Figure 3 A more detailed description of the authentication management service module and the authentication configuration module. Figure 3 FIG. 3 is a schematic diagram showing a method 300 for authenticating a user according to an exemplary embodiment of the present invention. Figure 3 As shown, method 310 is first executed to set one or more authentication factors according to the application type of each application, and each authentication factor is suitable for implementing an authentication type.

[0039] According to one embodiment of the present invention, the application type (ApplicationTyp) of each application is divided according to the operation to be implemented by the application. The application types of the application include: login application (login), lock screen application (lock), and authorization application (authorization). Applications that do not belong to the above application types can also be divided into other applications. The present invention can also expand other application types as needed to enrich the authentication means or combination of authentication means for the application.

[0040] According to one embodiment of the present invention, when an application is to perform a login operation, the application type of the application is a login application; when an application is to perform a lock screen operation, the application type of the application is a lock screen application; when an application is to perform an elevated privilege operation, the application type of the application is an elevated privilege application.

[0041] According to one embodiment of the present invention, when an application needs to perform multiple types of operations, it can be determined that the application type of the application includes multiple types. For example, if an application needs to perform a login operation and a lock screen operation, it can be determined that the application type of the application includes a login application and a lock screen application.

[0042] According to one embodiment of the present invention, when one or more authentication factors are set according to the application type of each application, the setting can be performed according to the need of each application type to perform the corresponding application operation. If the application operation to be performed by the application type is more important and the required security level is higher, more authentication factors can be set, or authentication factors that are more difficult to authenticate can be set. The authentication factors include: one or more of a password authentication factor (password), a fingerprint authentication factor (fingerprint), a face authentication factor (face), an iris authentication factor (iris) and a UKey authentication factor (ukey). The present invention can also expand other authentication factors as needed.

[0043] Each authentication factor is suitable for implementing a type of authentication, for example, the password authentication factor is suitable for implementing the enable password authentication, and the fingerprint authentication factor is suitable for implementing the enable fingerprint authentication. Authentication factors are set for application types. For example, when the application type is a privilege escalation type, the corresponding authentication factors include password authentication factor, fingerprint authentication factor, and face authentication factor.

[0044] According to one embodiment of the present invention, the authentication methods corresponding to application types include single-factor authentication and multi-factor authentication; when an application type is set to correspond to one authentication factor, the authentication method of the application type is single-factor authentication; when an application type is set to correspond to multiple authentication factors, the authentication type of the application type is multi-factor authentication.

[0045] And when confirming the authentication result of the authentication factor, the application under the application type of single-factor authentication needs to successfully authenticate the user when the authentication result of a single authentication factor is successful; the application under the application type of multi-factor authentication needs to successfully authenticate the user when the authentication results of all factors are successful. As long as one of the authentication factors fails to return an authentication result or the authentication result is an authentication failure, the application fails to authenticate the user. Therefore, the security of the user authentication process can be improved by changing the authentication method of the application type from single-factor authentication to multi-factor authentication.

[0046] Then, step 320 is executed, and the authentication configuration module generates a configuration file corresponding to the application type according to the application type and the corresponding authentication factor. After the configuration file is generated, it is stored in a specific directory so that the authentication management service module can obtain the configuration file according to the specific directory.

[0047] According to an embodiment of the present invention, the configuration file includes application types and one or more authentication factors corresponding to each application type, so that the application factor corresponding to the application type is determined according to the configuration file, and authentication is initiated according to the application factor.

[0048] According to an embodiment of the present invention, when the application type is a privilege escalation type, the corresponding authentication factors include password authentication factor, fingerprint authentication factor and face authentication factor; when the authentication results returned according to the password authentication factor, fingerprint authentication factor and face authentication factor are all successful, the application is authenticated and can perform privilege escalation operations. The configuration file generated by the authentication configuration module according to the application type and the corresponding authentication factor is as follows:

[0049] {

[0050] "ApplicationType":"authorization",

[0051] "RequestVerificationType":[

[0052] {

[0053] "Type":"password",

[0054] "Service":"*"

[0055] },

[0056] {

[0057] "Type":"face",

[0058] "Service":""

[0059] },

[0060] {

[0061] "Type":"fingerprint",

[0062] "Service":""

[0063] }

[0064] Among them, ApplicationType indicates the application type of the application, which can be divided into the following types:

[0065] {

[0066] login, / / Login application type, mapped to 1 in the code

[0067] lock, / / Lock screen application type is mapped to 2 in the application code

[0068] authorization, / / The application code of the privilege escalation application type is mapped to 3

[0069] other, / / Other application types are mapped to 4 in the application code

[0070] }

[0071] Type indicates the authentication factor that needs to be authenticated. The following authentication factors are supported:

[0072] {

[0073] password, / / password authentication factor

[0074] fingerprint, / / Fingerprint authentication factor

[0075] face, / / face authentication factor

[0076] iris, / / iris authentication factor

[0077] ukey, / / UKey authentication factor

[0078] }

[0079] Then, step 330 is executed. In response to the PAM interface library receiving the authentication request initiated by the target application, the PAM module calls the authentication management service module to determine the corresponding configuration file according to the application type of the target application.

[0080] According to an embodiment of the present invention, when the target application needs to authenticate the user in order to perform the next operation (such as login operation, screen lock operation and privilege escalation operation), an authentication request is sent to the PAM interface library.

[0081] The PAM interface library is suitable for receiving and initiating authentication requests. The PAM interface library serves as a "middleware" between the application and the authentication management service module, including an interface provided by the PAM module for calling the PAM module, so that the PAM module is called when an authentication request is received.

[0082] The PAM module shields the interaction details between the application and the authentication management service module, and the PAM module takes the lead in completing the application authentication process. The PAM module then calls the authentication management service module, which determines the application type of the target application and obtains the configuration file from a specific directory based on the application type of the target application.

[0083] According to an embodiment of the present invention, a default configuration file is also preset. The default configuration file may include a default authentication factor, and the present invention does not limit the specific type of the default configuration factor. When the application type is not set for the application, the application type does not set the generated configuration file, and the configuration file is not obtained in a specific directory, the authentication management service module can obtain the default configuration file and initiate the authentication process for the user according to the default configuration factor.

[0084] Subsequently, step 340 is executed, and the authentication management service module determines one or more authentication factors included in the configuration file, and simultaneously initiates one or more authentications based on the one or more authentication factors. The authentication management service module parses the configuration file, determines one or more authentication factors therein, and generates corresponding authentication factor authentication requests based on each authentication factor included in the configuration file, and obtains one or more authentication factor authentication requests; and simultaneously sends one or more authentication factor authentication requests through the bus module to execute the authentication process corresponding to one or more authentication types. According to one embodiment of the present invention, the bus module can be specifically implemented as Dbus. Dbus is a message bus system for communication between applications, used for communication between processes, and allows multiple different processes to communicate simultaneously on the same computer.

[0085] Finally, step 350 is executed, and the authentication management service module generates an authentication message according to the authentication result in response to receiving the authentication result of one or more authentication factors and sends it to the target application. Specifically: when the authentication method preset by the application type corresponding to the application is single-factor authentication, after the authentication management service module receives the authentication result of an authentication factor, if the authentication result of the authentication factor is authentication success, a user authentication pass message is sent to the application.

[0086] According to one embodiment of the present invention, when the authentication method preset for the application type corresponding to the application is multi-factor authentication, after the authentication management service module receives the authentication results of multiple authentication factors, if the authentication result of one or more authentication factors is authentication failure, or one or more authentication factors fail to return authentication results, a user authentication failure message is sent to the user.

[0087] When the authentication management service module sends an authentication message to an application, it first sends the authentication message to the PAM module so that the PAM module forwards it to the PAM library, and finally the PAM library sends the authentication message to the target application.

[0088] Figure 4 FIG. 2 shows a schematic diagram of processing an authentication request according to an exemplary embodiment of the present invention. Figure 4As shown, first, the application executes step 410 to send an authentication request to the PAM interface library. Then, the PAM interface library executes step 420 to call the PAM module.

[0089] The PAM module will be called according to the interface set in the PAM library, take over the authentication, and then the PAM module executes step 430 to call the authentication management service module. The authentication management service module specifically initiates the actual authentication. The authentication management service module first executes step 440 to read the configuration file for application authentication; then executes step 450 to initiate authentication according to the authentication method and authentication factor specified in the configuration file; for example, the authentication method is multi-factor authentication, and the authentication factors include the first authentication factor, the second authentication factor, the third authentication factor, and the fourth authentication factor. Then the authentication results of these authentication factors are obtained, and the authentication management service module comprehensively processes the authentication results. If a single authentication factor is required, then the user authentication pass message will be returned if the single authentication factor authentication is successful. If multiple authentication factors are required, then the authentication management will obtain all authentication results. Only when all authentication results are successful will the authentication pass message be returned, and the final result will be returned to the PAM module to inform the PAM module whether the final authentication message is authentication pass or authentication failure. The PAM library will return this authentication message to the target application, and the entire authentication process ends.

[0090] The PAM library is called, and the code to implement the authentication process through the authentication management service module is as follows:

[0091]

[0092] Compile: gcc main.co main-lpam-lpam_misc

[0093] The present invention provides a DBus-based authentication configuration service, an authentication management service, and a PAM-based authentication module. The authentication management service module provides authentication management services. As the main controller of the entire authentication process, the authentication management service module can be accessed by the PAM module, or by other methods, such as DBus calling to access the authentication proxy service module. The authentication management service module then controls the main authentication process and obtains the final authentication result. With this design, the authentication management service module encapsulates system authentication details, and can shield authentication details from applications. It only needs to modify the application type, configuration information, etc. to provide multiple authentication methods for the application, and it is also convenient to expand other authentication factors; with this design, the authentication management service module manages multiple authentication factors, and can simultaneously enable authentication of multiple authentication factors, avoiding sequential execution under the PAM specification.

[0094] The present invention uses the PAM library as the authentication access method of the system, and can perform authentication extension based on the Linux-PAM method, thereby ensuring compatibility with the original applications on the system. It also provides a PAM plug-in to the outside world, and can adapt the authentication framework when the application does not need to be modified. It is convenient and easy to use. The authentication management service module provides authentication methods and authentication factors supported by the system. By modifying the service, other authentication methods and authentication factors required by the system can be easily expanded. It has good scalability. All authentications in the present invention are performed by the authentication management service module, which ensures the uniformity of authentication and eliminates the problem of applications obtaining permissions through other authentication methods. At the same time, the authentication management service module is independent of the application, and its authentication details are not related to any application, providing good security for the system.

[0095] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0096] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof.

[0097] In the case where the program code is executed on a programmable computer, the computing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the user identity authentication method of the present invention according to the instructions in the program code stored in the memory.

[0098] By way of example and not limitation, computer readable media include computer storage media and communication media. Computer readable media include computer storage media and communication media. Computer storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and includes any information delivery medium. Any combination of the above is also included within the scope of computer readable media.

[0099] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and instructional purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art. The disclosure of the present invention is illustrative, rather than restrictive, with respect to the scope of the present invention.

[0100] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved, and is not intended to imply that the objects so described must have a given order in time, space, order, or in any other manner.

[0101] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and instructional purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art. The disclosure of the present invention is illustrative, rather than restrictive, with respect to the scope of the present invention.

Claims

1. A method for authenticating a user, suitable for execution in a computing device, wherein an operating system and one or more applications running on the operating system are running in the computing device, wherein the operating system includes a PAM interface library, a PAM module, an authentication management service module and an authentication configuration module, and the method includes: One or more authentication factors are set according to the application type of each application, each authentication factor being suitable for implementing one authentication type; The authentication configuration module generates a configuration file corresponding to the application type according to the application type and the corresponding authentication factor; In response to the PAM interface library receiving an authentication request initiated by a target application, the PAM module calls the authentication management service module to determine a corresponding configuration file according to an application type of the target application; The authentication management service module determines one or more authentication factors included in the configuration file, and simultaneously initiates one or more authentications based on the one or more authentication factors; In response to receiving the authentication result of one or more authentication factors, the authentication management service module generates an authentication message according to the authentication result and sends the authentication message to the target application.

2. The method of claim 1, wherein: The application type of the application includes: one or more of a login application, a lock screen application, and an elevated privilege application.

3. The method according to claim 1 or 2, wherein: The authentication factors include: one or more of a password authentication factor, a fingerprint authentication factor, a face authentication factor, an iris authentication factor and a UKey authentication factor.

4. The method of claim 1, wherein: The authentication management service module determines one or more authentication factors included in the configuration file, and simultaneously initiates one or more authentications according to the one or more authentication factors, including: The authentication management service module generates a corresponding authentication factor authentication request according to each authentication factor included in the configuration file, and obtains one or more authentication factor authentication requests; One or more authentication factor authentication requests are sent simultaneously through the bus module to execute the authentication process corresponding to one or more authentication types.

5. The method of claim 1, wherein: The authentication methods of the application type include multi-factor authentication and single-factor authentication.

6. The method of claim 5, wherein: Generating an authentication message according to the authentication result and sending the message to the target application comprises: When the authentication method preset by the application type corresponding to the application is single-factor authentication, after the authentication management service module receives the authentication result of an authentication factor, if the authentication result of the authentication factor is successful authentication, a user authentication pass message is sent to the application.

7. The method of claim 5, further comprising: When the authentication method preset for the application type corresponding to the application is multi-factor authentication, after the authentication management service module receives the authentication results of multiple authentication factors, if the authentication result of one or more authentication factors is authentication failure, a user authentication failure message is sent to the user.

8. A computing device comprising: one or more processors; Memory; as well as One or more devices comprising instructions for executing the method according to any one of claims 1-7.

9. A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions which, when executed by a computing device, cause the computing device to perform the method according to any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions, wherein: When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images