Full-scene multi-factor authentication equipment scheduling method and system under Linux

Abstract

The invention discloses a Linux full-scene multi-factor authentication equipment scheduling method and system, and the method comprises the steps: when a multi-factor authentication service receives an authentication request initiated by an application to a PAM framework, distinguishing whether the current scene belongs to a graphic scene or a non-graphic scene through a service attribute value of the PAM framework; executing a corresponding authentication equipment interaction mode according to the distinguishing result of whether the scene belongs to the graphic scene or the non-graphic scene, including when the scene belongs to the non-graphic scene, performing man-machine interaction in a text interaction mode to guide a user to complete authentication of the multi-factor authentication equipment; and when the current scene belongs to the graphic scene, performing man-machine interaction in a special instruction interaction mode to guide a user to complete authentication of the multi-factor authentication equipment. The invention aims to realize full-scene multi-factor authentication equipment scheduling, has high compatibility for third-party applications with authentication requirements, does not need to be modified, and supports flexible configuration.

Description

Technical Field

[0001] The present invention relates to security authentication technology in the field of desktop operating systems, and in particular to a full-scenario multi-factor authentication device scheduling method and system under Linux. Background Art

[0002] With the acceleration of digital transformation, businesses and individuals are increasingly reliant on online services and digital tools for their daily lives. However, the increasing prevalence of cybercrime has led to increasingly severe security challenges. Traditional single-password authentication methods are no longer able to withstand complex and diverse cyberattacks. Hackers can easily steal sensitive information through brute force attacks and phishing scams, causing significant financial and reputational damage to businesses and individuals. In this context, multi-factor authentication (MFA) has become a key means of improving security. MFA effectively reduces the risk of unauthorized access by introducing additional authentication factors, typically including knowledge (such as a password), possession (such as a mobile phone or token), and biometrics (such as fingerprints or facial recognition). Even if a password is compromised, attackers still need to complete additional verification steps, significantly increasing the difficulty of intrusion. Linux systems are primarily used in servers and cloud computing. They typically use a non-graphical installation mode and utilize the PAM (Pluggable Authentication Module) authentication framework. The PAM framework's data communication is relatively simple, supporting only text-based interaction, making it difficult to use in operating systems installed in graphical mode. Linux systems can trigger authentication operations in a variety of scenarios, including login, lock screen, privilege escalation, third-party applications, and non-graphical scenarios. However, physical authentication devices cannot execute authentication requests concurrently, resulting in device preemption. Linux systems lack a unified protocol standard for multi-factor authentication. Hardware manufacturers of different authentication devices generally provide corresponding device drivers, and the operational interfaces provided by these device drivers vary. As a result, common products on the market only support two-factor authentication: the system's default password authentication and device-driven authentication, without the flexibility to add support for other authentication devices. Summary of the Invention

[0003] The technical problem to be solved by the present invention is as follows: In response to the above-mentioned problems of the prior art, a method and system for scheduling multi-factor authentication devices in all scenarios under Linux are provided. The present invention aims to realize multi-factor authentication device scheduling in all scenarios, has high compatibility with third-party applications with authentication requirements, does not require modification, and supports flexible configuration.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A full-scenario multi-factor authentication device scheduling method under Linux includes the following steps: when a multi-factor authentication service receives an authentication request initiated by an application to a PAM framework, distinguishing whether the current scene belongs to a graphical scene or a non-graphic scene by using the PAM_SERVICE attribute value of the PAM framework; and executing a corresponding authentication device interaction mode according to the distinction result, including adopting a text interaction mode for human-computer interaction to guide the user to complete the authentication of the multi-factor authentication device when the current scene belongs to a non-graphic scene; and adopting a special instruction interaction mode for human-computer interaction to guide the user to complete the authentication of the multi-factor authentication device when the current scene belongs to a graphical scene. In the special instruction interaction mode, data interaction between the PAM framework and the application that initiated the authentication request is achieved through instructions and data in a specified format.

[0006] Optionally, when the PAM framework and the application that initiates the authentication request are implemented to perform data interaction through instructions and data in a specified format, the instructions and data in the specified format include three instructions: "authentication mode", "whether to bind user" and "authentication type", where "authentication mode" is used to specify whether the logical relationship between multiple authentication types is "and" or "or", "whether to bind user" is used to determine whether it is necessary to select an account name first, and "authentication type" is used to specify the required authentication method, and the authentication method includes some or all of password, fingerprint, finger vein, face, UKey, and iris.

[0007] Optionally, in the special instruction interaction mode, data interaction between the PAM framework and the application that initiates the authentication request is achieved through instructions and data in a specified format, including: first determining whether "Whether to bind the user" requires selecting an account name first; if the account name needs to be selected first, displaying a selection user interface to obtain the account name selected by the user; then generating a corresponding authentication program according to the authentication method specified by the "Authentication type" to guide the user to perform authentication; then performing corresponding logical relationship operations on all authentication results according to the "Authentication mode" to obtain the final authentication result of pass or fail.

[0008] Optionally, when the multi-factor authentication service receives an authentication request initiated by an application to the PAM framework, it also includes creating a unique and prioritized session ID for the session of the application that initiated the authentication request, and avoiding the authentication device preemption problem by maintaining a request pool. Newly created authentication requests will be placed in the request pool for unified management.

[0009] Optionally, the newly created authentication request is put into the request pool for unified management. The strategy includes: comparing the priority of the newly created authentication request with the priority of the current request of the request pool; if the priority of the newly created authentication request is higher than the priority of the current request of the request pool, suspending the current request of the request pool and using the newly created authentication request as the new current request of the request pool to occupy the authentication device resources; and resuming the suspended authentication request after the new current request is served; if the current request of the request pool still does not complete the authentication operation within the set time, removing the current request of the request pool from the request pool and releasing the authentication device. resources and return an error message to the multi-factor authentication service; if the current request authentication is completed, the final authentication result is returned to the multi-factor authentication service, and the authentication device resources corresponding to the current request are released; if the multi-factor authentication service is detected to have exited abnormally, the corresponding session and authentication request are closed, and if the authentication request is currently in progress, the authentication device resources corresponding to the authentication request are released; if the application is detected to be suspended, the authentication request corresponding to the application is put back into the request pool and the authentication device resources are released; after the current request ends normally or exits abnormally, the authentication request that is not suspended and has the highest priority is selected from the request pool as the new current request.

[0010] Optionally, it also includes using a multi-factor authentication device service to provide an API abstraction layer for the multi-factor authentication service, and converting different authentication device driver interfaces into a unified interface through the API abstraction layer to achieve unified management of multiple authentication devices.

[0011] Optionally, when the different authentication device driver interfaces are converted into a unified interface through the API abstraction layer to achieve unified management of multiple authentication devices, the unified interface includes the following three interfaces: Start authentication: the input data of this interface is a json string, which is used to send customized data for different authentication devices to start authentication; Authentication status signal: the signal contains a feature ID, status and message, where the feature ID is the identifier of the feature data recognized by the authentication device. If the feature ID is the same as the feature ID recorded when the user enters the data, the authentication is passed, otherwise the authentication fails; the status includes device idle, device busy, device verifying, device identifying, device disabled, etc., and the message is a readable description of the status; Stop authentication: used to release authentication device resources.

[0012] In addition, the present invention also provides a multi-factor authentication device scheduling system for all scenarios under Linux, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the multi-factor authentication device scheduling method for all scenarios under Linux.

[0013] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the full-scenario multi-factor authentication device scheduling method under Linux through a processor.

[0014] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the full-scenario multi-factor authentication device scheduling method under Linux through a processor.

[0015] Compared with the prior art, the present invention mainly has the following advantages: the present invention includes distinguishing whether the current scene belongs to a graphic scene or a non-graphic scene through the service attribute value of the PAM framework when the multi-factor authentication service receives the authentication request initiated by the application to the PAM framework; executing the corresponding authentication device interaction method according to the distinction result of whether the current scene belongs to a graphic scene or a non-graphic scene, including using a text interaction mode for human-computer interaction to guide the user to complete the authentication of the multi-factor authentication device when the current scene belongs to a non-graphic scene; using a special instruction interaction mode for human-computer interaction to guide the user to complete the authentication of the multi-factor authentication device when the current scene belongs to a graphic scene. The present invention can improve the authentication requirements for multiple scenarios, various authentication devices, and the user experience under multi-session authentication in Linux, and the advantages are as follows: 1) Third-party applications with authentication requirements in Linux have high compatibility and do not need to be modified. 2) Flexible configuration can be supported for multiple types of authentication scenarios. 3) For the authentication scheduling processing of exclusive devices, scheduling can be performed according to the session to which the authentication request belongs and the authentication request type. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Schematic diagram of the basic process of the method of the embodiment of the present invention.

[0017] Figure 2 Schematic diagram of the scheduling strategy of the request pool in an embodiment of the present invention.

[0018] Figure 3 This is a schematic diagram of the working principle of the multi-factor authentication device service (MFA authentication device service) in an embodiment of the present invention.

[0019] Figure 4 Schematic diagram of the overall layered architecture in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention will be further described in detail below with reference to the accompanying drawings in the embodiments of the present invention.

[0021] like Figure 1As shown, the multi-factor authentication device scheduling method for all scenarios under Linux in this embodiment includes the following steps: when the multi-factor authentication service receives an authentication request initiated by an application to the PAM framework, the PAM_SERVICE attribute value of the PAM framework is used to distinguish whether the current scenario is a graphical scenario or a non-graphical scenario; according to the distinction result of whether the current scenario is a graphical scenario or a non-graphical scenario, the corresponding authentication device interaction mode is executed, including when the current scenario is a non-graphical scenario, using a text interaction mode for human-computer interaction to guide the user to complete the authentication of the multi-factor authentication device; when the current scenario is a graphical scenario, using a special instruction interaction mode for human-computer interaction to guide the user to complete the authentication of the multi-factor authentication device, wherein the special instruction interaction mode uses instructions and data in a specified format to realize data interaction between the PAM framework and the application that initiated the authentication request. Through the above steps, the multi-factor authentication device scheduling method for all scenarios under Linux in this embodiment can solve the problem of poor use of graphical scenarios and is compatible with non-graphical scenarios, wherein graphical scenarios include login, lock screen, privilege escalation, third-party graphical applications, etc., and non-graphical scenarios include sudo, login, etc.

[0022] This embodiment uses the multi-factor (MFA) authentication service, a PAM module, to address multiple scenarios. This is divided into three phases: scenario differentiation, request-response, and human-computer interaction. In the scenario differentiation phase, the PAM_SERVICE attribute value provided by the PAM framework is used to distinguish between the current graphical and non-graphical scenarios. Commonly used attribute values ​​are as follows:

[0023] lightdm: landing machine (graphics scene);

[0024] screensaver: lock screen interface (graphic scene);

[0025] polkit-1: privilege escalation interface (graphical scenario);

[0026] Sudo: switch to other users (non-graphical scenario);

[0027] login: login program (non-graphical scenario).

[0028] During the request and response phase, for non-graphic scenarios, the traditional text mode response is adopted. For example, for UKey device authentication, if it is detected that the UKey device is not inserted, the direct reply is "Please insert the UKey device"; if the UKey device has been detected to be inserted, the direct reply is "UKey is being authenticated, please enter the PIN code", and these text messages will be directly echoed on the screen as prompts for human-computer interaction. For graphic scenarios, human-computer interaction should be carried out in the form of icons, animations or texts. Text information cannot be directly echoed to the user. In order to allow the requester to better parse or understand the response data, the message header + JSON data method is adopted here. The message header is a special verification mark, which is mainly used to prompt the requester that the subsequent data is non-text data and needs to be parsed according to the JSON format. The JSON format mainly contains instructions and data. In this embodiment, when the PAM framework and the application that initiates the authentication request are implemented through instructions and data in a specified format, the instructions and data in the specified format include three instructions: "authentication mode", "whether to bind the user", and "authentication type". Among them, "authentication mode" REQ_CMD_NOTIFY_AUTH_MODE is used to specify whether the logical relationship between multiple authentication types is "AND" or "OR". In the AND mode, all authentication types need to pass, and in the OR mode, only one authentication method needs to be started; "whether to bind the user" REQ_CMD_AUTH_SWITCHABLE is used to determine whether it is necessary to select an account name first; "authentication type" REQ_CMD_NOTIFY_AUTH_TYPE is used to specify the required authentication method, which includes some or all of password, fingerprint, finger vein, face, UKey, and iris.

[0029] During the human-computer interaction phase, the recipient (graphics program) should present different human-computer interaction methods based on the response data. "Authentication Mode" REQ_CMD_NOTIFY_AUTH_MODE: In "AND" mode, only the interactive icon, image, or animation corresponding to the current authentication type should be displayed; in "OR" mode, the supported authentication types should be displayed in a certain order for the user to select. "Whether to bind the user" REQ_CMD_AUTH_SWITCHABLE: If not enabled, the authentication interface is displayed directly; if enabled, the selection user interface is displayed. "Authentication Type" REQ_CMD_NOTIFY_AUTH_TYPE: Different images or animations are displayed as prompts based on different authentication types. For example, when performing fingerprint authentication, the fingerprint icon can be displayed; when performing face authentication, the user's portrait can be captured and displayed dynamically in real time. In this embodiment, in a special instruction interaction mode, data interaction between a PAM framework and an application initiating an authentication request is implemented through instructions and data in a specified format, including: first, determining whether "Whether to bind user" requires selecting an account name first; if an account name needs to be selected first, displaying a selection user interface to obtain the account name selected by the user; then, generating a corresponding authentication program according to the authentication method specified in "Authentication type" to guide the user to perform authentication; then, performing corresponding logical relationship operations on all authentication results according to "Authentication mode" to obtain a final authentication result of pass or fail.

[0030] Linux is a multi-tasking scheduling system. In order to solve the problem of physical authentication devices being preempted when multiple authentication requests occur concurrently. In this embodiment, when the multi-factor authentication service receives an authentication request initiated by an application to the PAM framework, it also includes creating a unique and prioritized session ID for the session of the application that initiated the authentication request, and circumventing the authentication device preemption problem by maintaining a request pool. Newly created authentication requests are placed in the request pool for unified management. In this embodiment, a unique session ID is assigned for identification each time an authentication is started, and a system may run multiple sessions at the same time, and each session may need to temporarily use authentication device resources for authentication operations. This embodiment provides an MFA authentication service module, which receives authentication requests sent by the MFA PAM module and creates a unique session ID when the request is started.

[0031] like Figure 2As shown, in this embodiment, the newly created authentication request is put into the request pool for unified management. The strategy includes: comparing the priority of the newly created authentication request with the priority of the current request of the request pool; if the priority of the newly created authentication request is higher than the priority of the current request of the request pool, suspending the current request of the request pool and using the newly created authentication request as the new current request of the request pool to occupy the authentication device resources, and resuming the suspended authentication request after the new current request service is completed; if the current request of the request pool has not completed the authentication operation within the set time, the current request of the request pool is removed from the request pool, the authentication device resources are released, and an error message is returned to the multi-factor authentication service; if the authentication of the current request is completed, the final authentication result is returned to the multi-factor authentication service, and the authentication device resources corresponding to the current request are released; if it is detected that the multi-factor authentication service exits abnormally, the corresponding session and authentication request are closed, and if the authentication request is a currently ongoing request, the authentication device resources corresponding to the authentication request are released; if it is detected that the application is suspended (for example, the tty terminal is switched by ctrl+alt+Fn, resulting in the login session logind If the session is switched), the authentication request corresponding to the application is put back into the request pool and the authentication device resources are released; after the current request ends normally or exits abnormally, the authentication request that is not suspended and has the highest priority is selected from the request pool as the new current request.

[0032] The multi-factor (MFA) authentication service requires the authentication device driver to perform the final authentication operation, but the interfaces of different authentication device drivers are not consistent. In order to solve the problem that the inconsistent interfaces of different authentication device drivers make it impossible to use authentication devices from different hardware manufacturers at the same time, this embodiment also includes the use of a multi-factor authentication device service to provide an API abstraction layer for the multi-factor authentication service. Through the API abstraction layer, different authentication device driver interfaces are converted into a unified interface to achieve unified management of multiple authentication devices.

[0033] like Figure 3As shown, in this embodiment, when different authentication device driver interfaces are converted into a unified interface through the API abstraction layer to achieve unified management of multiple authentication devices, the unified interface includes the following three interfaces: Start authentication (IdentifyStart): The input data of this interface is a json string, which is used to send customized data for different authentication devices to start authentication; Authentication status signal (IdentifyStatus): This signal contains a feature ID, status and message, where the feature ID is the identifier of the feature data recognized by the authentication device. If the feature ID is the same as the feature ID recorded when the user enters the data, the authentication is passed, otherwise the authentication fails; The status (IdentifyStop) includes situations such as device idle, device busy, device verifying, device identifying, device disabled, etc. The message is a readable description of the status; Stop authentication: used to release authentication device resources.

[0034] The system architecture of the multi-factor authentication device scheduling method for all scenarios under Linux in this embodiment is as follows: Figure 4 As shown, the system architecture can be divided into four layers from bottom to top: device compatibility layer, authentication service, system PAM authentication framework and application. The authentication application performs authentication through the PAM framework, and the mfa_pam.so added to the system authentication process stack forwards the authentication request to the authentication service. The authentication service (including system applications and third-party applications) tracks the authentication request by creating an authentication session and sends it to the system PAM authentication framework; the system PAM authentication framework submits the request to the authentication service based on the authentication configuration made by the current system; the authentication service integrates the multi-factor authentication service and multi-factor authentication device service of the method of this embodiment. After processing the authentication service, it will be sent to the device adapter of the corresponding device type. The device adapter will queue all requests and queue and preempt them according to the activation status of the request session and the authentication application type. It can be seen that the multi-factor authentication device scheduling method for all scenarios under Linux in this embodiment can improve the user experience of authentication requirements in multiple scenarios, diverse authentication devices and multi-session authentication under Linux. The advantages are as follows: 1) Third-party applications with authentication requirements under Linux are highly compatible and do not need to be modified. 2) Flexible configuration is supported for various authentication scenarios. 3) For exclusive device authentication scheduling, scheduling can be performed based on the session to which the authentication request belongs and the authentication request type.

[0035] In addition, this embodiment also provides a multi-factor authentication device scheduling system for all scenarios under Linux, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the multi-factor authentication device scheduling method for all scenarios under Linux.

[0036] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program or instruction. The computer program or instruction is programmed or configured to execute the full-scenario multi-factor authentication device scheduling method under Linux through a processor.

[0037] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the full-scenario multi-factor authentication device scheduling method under Linux through a processor.

[0038] Those skilled in the art will appreciate that the embodiments of the present application may provide a technical solution in the form of a method, system, or computer program product. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0039] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A multi-factor authentication device scheduling method for all scenarios under Linux, characterized in that: The method comprises the following steps: when a multi-factor authentication service receives an authentication request initiated by an application to a PAM framework, distinguishing whether the current scene is a graphic scene or a non-graphic scene by using the PAM_SERVICE attribute value of the PAM framework; executing a corresponding authentication device interaction mode according to the distinction result of whether the current scene is a graphic scene or a non-graphic scene, including adopting a text interaction mode for human-computer interaction to guide a user to complete the authentication of a multi-factor authentication device when the current scene is a non-graphic scene; adopting a special instruction interaction mode for human-computer interaction to guide a user to complete the authentication of a multi-factor authentication device when the current scene is a graphic scene, wherein the special instruction interaction mode implements data interaction between the PAM framework and the application that initiates the authentication request by using instructions and data in a specified format.

2. The method for scheduling multi-factor authentication devices in all scenarios under Linux according to claim 1, characterized in that: When the PAM framework and the application initiating the authentication request are implemented to perform data interaction through the instructions and data in the specified format, the instructions and data in the specified format include three instructions: "authentication mode", "whether to bind user" and "authentication type", among which "authentication mode" is used to specify whether the logical relationship between multiple authentication types is "and" or "or", "whether to bind user" is used to determine whether it is necessary to select an account name first, and "authentication type" is used to specify the required authentication method, and the authentication method includes part or all of password, fingerprint, finger vein, face, UKey, and iris.

3. The method for scheduling multi-factor authentication devices in all scenarios under Linux according to claim 1, characterized in that: The special instruction interaction mode uses instructions and data in a specified format to implement data interaction between the PAM framework and the application that initiates the authentication request, including: first, determining whether "Whether to bind the user" requires selecting an account name first; if the account name needs to be selected first, displaying a selection user interface to obtain the account name selected by the user; then, generating a corresponding authentication program according to the authentication method specified by the "Authentication type" to guide the user to perform authentication; then, performing corresponding logical relationship operations on all authentication results according to the "Authentication mode" to obtain the final authentication result of passing or failing.

4. The method for scheduling multi-factor authentication devices in all scenarios under Linux according to claim 1, characterized in that: When the multi-factor authentication service receives an authentication request initiated by an application to the PAM framework, it also includes creating a unique and prioritized session ID for the session of the application that initiated the authentication request, and avoiding the authentication device preemption problem by maintaining a request pool. Newly created authentication requests are placed in the request pool for unified management.

5. The method for scheduling multi-factor authentication devices in all scenarios under Linux according to claim 4, characterized in that: The strategy of putting all newly created authentication requests into the request pool for unified management includes: comparing the priority of the newly created authentication request with the priority of the current request of the request pool; if the priority of the newly created authentication request is higher than the priority of the current request of the request pool, suspending the current request of the request pool and using the newly created authentication request as the new current request of the request pool to occupy the authentication device resources, and resuming the suspended authentication request after the new current request service is completed; if the current request of the request pool still fails to complete the authentication operation after the set time, the current request of the request pool is removed from the request pool, the authentication device resources are released, and an error message is returned to the multi-factor authentication service; if the authentication of the current request is completed, the final authentication result is returned to the multi-factor authentication service, and the authentication device resources corresponding to the current request are released; if the multi-factor authentication service is detected to exit abnormally, the corresponding session and authentication request are closed, and if the authentication request is a currently ongoing request, the authentication device resources corresponding to the authentication request are released; if the application is detected to be suspended, the authentication request corresponding to the application is put back into the request pool and the authentication device resources are released; after the current request ends normally or exits abnormally, the authentication request that is not suspended and has the highest priority is selected from the request pool as the new current request.

6. The method for scheduling multi-factor authentication devices in all scenarios under Linux according to claim 1, characterized in that: It also includes the use of multi-factor authentication device services to provide an API abstraction layer for multi-factor authentication services, and converting different authentication device driver interfaces into a unified interface through the API abstraction layer to achieve unified management of multiple authentication devices.

7. The method for scheduling multi-factor authentication devices in all scenarios under Linux according to claim 6, characterized in that: When different authentication device driver interfaces are converted into a unified interface through the API abstraction layer to achieve unified management of multiple authentication devices, the unified interface includes the following three interfaces: Start authentication: The input data of this interface is a json string, which is used to send customized data for different authentication devices to start authentication; Authentication status signal: This signal contains a feature ID, status and message, where the feature ID is the identifier of the feature data recognized by the authentication device. If the feature ID is the same as the feature ID recorded when the user enters the data, the authentication is successful, otherwise the authentication fails; the status includes device idle, device busy, device verifying, device identifying, device disabled, etc. The message is a readable description of the status; Stop authentication: used to release authentication device resources.

8. A multi-factor authentication device scheduling system for all scenarios under Linux, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the full-scenario multi-factor authentication device scheduling method under Linux as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the full-scenario multi-factor authentication device scheduling method under Linux as described in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the full-scenario multi-factor authentication device scheduling method under Linux as described in any one of claims 1 to 7 through a processor.

Images