Account login verification method and device, electronic equipment and storage medium

Abstract

This application discloses a login verification method, apparatus, electronic device, and storage medium for an account, relating to the field of computer technology. The method includes: obtaining requirement information of the account to be logged in; obtaining the login type of the account to be logged in based on the requirement information, wherein the login type characterizes the authentication method of the account to be logged in; determining the login credentials and initial session state of the account to be logged in based on the login type, wherein the initial session state characterizes that the account to be logged in has not performed any interactive operations on the management system; and authenticating the login credentials according to a zero-trust policy based on the initial session state to obtain a verification result for the account to be logged in, wherein the zero-trust policy characterizes the rules for authenticating the account to be logged in, and the verification result characterizes that the login behavior of the account to be logged in is in a normal state. This application solves the technical problem of low security in user authentication in related technologies.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to an account login verification method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the digitalization of financial services and the increasing prevalence of networks, the security and reliability of user authentication have become paramount. Traditional user authentication methods are based on usernames and passwords, but this approach has serious security vulnerabilities and is susceptible to cyberattacks and threats, resulting in low security for user authentication.

[0003] There is currently no effective solution to the technical problem of low security in user authentication in related technologies. Summary of the Invention

[0004] The main objective of this application is to provide an account login verification method, device, electronic device, and storage medium to solve the technical problem of low security in user authentication in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a login verification method for an account is provided. The method includes: obtaining requirement information for an account to be logged in, wherein the requirement information characterizes the authentication requirements of the account to be logged in; based on the requirement information, obtaining the login type of the account to be logged in, wherein the login type characterizes the authentication method of the account to be logged in; based on the login type, determining the login credentials and initial session state of the account to be logged in, wherein the initial session state characterizes that the account to be logged in has not performed any interactive operations on the management system of the account to be logged in; based on the initial session state, authenticating the login credentials according to a zero-trust policy to obtain a verification result for the account to be logged in, wherein the zero-trust policy characterizes the rules for authenticating the account to be logged in, and the verification result characterizes that the login behavior of the account to be logged in is in a normal behavior state.

[0006] Optionally, based on the initial session state, the login credentials are authenticated according to a zero-trust policy to obtain the verification result of the account to be logged in, including: entering the login credentials in the terminal editor of the account to be logged in to obtain the login result of the account to be logged in; wherein, the login result is used to indicate successful login of the account to be logged in; based on the login result, the initial session state is switched to the target session state of the account to be logged in, wherein, the target session state is used to indicate that the account to be logged in has not performed any interactive operations on the management system; based on the target session state, the login credentials are authenticated according to a zero-trust policy to obtain the verification result.

[0007] Optionally, based on the target session state, the login credentials are authenticated according to a zero-trust policy to obtain an authentication result, including: based on the target session state, obtaining the target login credentials for the account to be logged in using the management system; and obtaining an authentication result in response to the target login credentials being the same as the login credentials.

[0008] Optionally, after switching the initial session state to the target session state of the account to be logged in based on the login result, the method further includes: obtaining the permission level of the account to be logged in, wherein the permission level is used to characterize the permission level of the account to be logged in to access resources in the management system; and generating an access page for the account to be logged in based on the permission level.

[0009] Optionally, the method further includes: obtaining the initial location information of the account to be logged in; monitoring the initial location information to obtain the target location information of the account to be logged in, wherein the geographical location in the target location information is different from the geographical location in the initial location information; and triggering an alarm based on the target location information, wherein the alarm is used to indicate that the login credentials of the account to be logged in are abnormal.

[0010] Optionally, the login types include: a first login type, a second login type, and a third login type, wherein the first login type is used to represent login through the biometric information of the target object corresponding to the account to be logged in, the second login type is used to represent login through a preset key of the account to be logged in, and the third login type is used to represent login through a preset password of the terminal device of the account to be logged in.

[0011] To achieve the above objectives, according to another aspect of this application, an account login verification device is provided. The device includes: a first acquisition unit, configured to acquire requirement information of the account to be logged in, wherein the requirement information characterizes the authentication requirement of the account to be logged in; a second acquisition unit, configured to acquire the login type of the account to be logged in based on the requirement information, wherein the login type characterizes the authentication method of the account to be logged in; a determination unit, configured to determine the login credentials and initial session state of the account to be logged in based on the login type, wherein the initial session state characterizes that the account to be logged in has not performed any interactive operations on the management system of the account to be logged in; and a third acquisition unit, configured to authenticate the login credentials according to a zero-trust policy based on the initial session state, obtaining a verification result for the account to be logged in, wherein the zero-trust policy characterizes the rules for authenticating the account to be logged in, and the verification result characterizes that the login behavior of the account to be logged in is in a normal behavior state.

[0012] Optionally, the third acquisition unit may include: a first acquisition module, used to input login credentials in the terminal editor of the account to be logged in, and obtain the login result of the account to be logged in; wherein the login result is used to indicate successful login of the account to be logged in; a switching module, used to switch the initial session state to the target session state of the account to be logged in based on the login result, wherein the target session state is used to indicate that the account to be logged in has not performed any interactive operations on the management system; and a second acquisition module, used to authenticate the login credentials according to the zero-trust policy based on the target session state, and obtain the verification result.

[0013] Optionally, the second acquisition module may include: a first acquisition submodule, used to acquire the target login credentials of the account to be logged in using the management system based on the target session state; and a second acquisition submodule, used to obtain a verification result in response to the target login credentials being the same as the login credentials.

[0014] Optionally, after switching the initial session state to the target session state of the account to be logged in based on the login result, the third acquisition unit may further include: an acquisition module for acquiring the permission level of the account to be logged in, wherein the permission level is used to characterize the permission level of the account to be logged in to access resources in the management system; and a generation module for generating the access page of the account to be logged in based on the permission level.

[0015] Optionally, the device further includes: a fourth acquisition unit for acquiring initial location information of the account to be logged in; a monitoring unit for monitoring the initial location information to obtain target location information of the account to be logged in, wherein the geographical location in the target location information is different from the geographical location in the initial location information; and a triggering unit for triggering alarm information based on the target location information, wherein the alarm information is used to indicate that the login credentials of the account to be logged in are abnormal.

[0016] Optionally, the login types include: a first login type, a second login type, and a third login type, wherein the first login type is used to represent login through the biometric information of the target object corresponding to the account to be logged in, the second login type is used to represent login through a preset key of the account to be logged in, and the third login type is used to represent login through a preset password of the terminal device of the account to be logged in.

[0017] In this embodiment, the following steps are taken: 1) Obtain the requirement information of the account to be logged in, wherein the requirement information represents the authentication requirement of the account to be logged in; 2) Based on the requirement information, obtain the login type of the account to be logged in, wherein the login type represents the authentication method of the account to be logged in; 3) Based on the login type, determine the login credentials and initial session state of the account to be logged in, wherein the initial session state represents that the account to be logged in has not performed any interactive operations on the management system of the account to be logged in; 4) Based on the initial session state, authenticate the login credentials according to a zero-trust policy to obtain the verification result of the account to be logged in, wherein the zero-trust policy represents the rules for authenticating the account to be logged in, and the verification result represents that the login behavior of the account to be logged in is in a normal behavior state. In other words, this application can first obtain the requirement information of the account to be logged in, and then, based on the requirement information, obtain the login type of the account to be logged in. Then, based on the login type, it can determine the login credentials and initial session state of the account to be logged in. Finally, based on the initial session state obtained above, it verifies the login credentials according to a zero-trust policy to obtain the verification result of the account to be logged in. Considering that after obtaining the login type of the account to be logged in based on the requirement information, the login credentials and initial session state of the account to be logged in can be determined based on the login type, and then the login credentials can be verified according to a zero-trust policy to obtain the verification result of the account to be logged in, and the account to be logged in corresponds to the user who needs to log in, the above steps can be used to verify the user who needs to log in, thereby solving the technical problem of low security of user authentication and achieving the technical effect of improving the security of user authentication. Attached Figure Description

[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing an account login verification method is shown.

[0020] Figure 2 This is a flowchart of an account login verification method according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of an account login verification device according to an embodiment of this application;

[0022] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It is understood that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding operation entry points for them to choose to agree to or refuse automated decision results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0026] According to an embodiment of this application, a method embodiment for account login verification is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0027] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an account login verification method is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0028] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0029] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the account login verification method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned account login verification method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0030] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0031] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0032] Under the aforementioned operating environment, this application provides the following: Figure 2 The login verification method for the account shown. Figure 2 This is a flowchart of an account login verification method according to an embodiment of this application.

[0033] Step S201: Obtain the required information for the account to be logged in.

[0034] In step S201 of the application embodiment, the requirement information of the account to be logged in can be obtained, wherein the requirement information is used to characterize the identity verification requirement of the account to be logged in. The account to be logged in corresponds to a user to be logged in. The account to be logged in can be referred to as the user account to be logged in.

[0035] Optionally, the account to be logged in can be used to represent the account that the user registered on a specific website or application, such as a registered mobile phone number or email address. It should be noted that this is only an example of how the account to be logged in is represented, and no specific limitation is made on how the account to be logged in is represented.

[0036] For example, based on a user's unlogged-in account on a specific website or application, information about the user's login needs can be obtained so that the account can be successfully logged in.

[0037] Step S202: Based on the requirement information, obtain the login type of the account to be logged in;

[0038] In step S202 of the application embodiment, the login type of the account to be logged in can be obtained based on the obtained requirement information. The login type may include a variety of preset login methods.

[0039] Optionally, the login type is used to characterize the authentication method of the account to be logged in, such as biometric login, one-time password login, and password login. It should be noted that the login type is only given as an example here and is not specifically limited.

[0040] For example, based on the information regarding the user's login needs, the user can choose a login type that suits their needs, allowing them to log in to their account quickly and easily.

[0041] It is understood that this is only a preferred implementation of obtaining the login type of the account to be logged in, and the process and method of obtaining the login type of the account to be logged in are not specifically limited. As long as the process and method of obtaining the login type of the account to be logged in are based on the requirements, they are all within the protection scope of this application and will not be listed here.

[0042] Step S203: Based on the login type, determine the login credentials and initial session state of the account to be logged in.

[0043] In step S203 of the application embodiment, after obtaining the login type, the login credentials and initial session state of the account to be logged in can be determined, wherein the initial session state is used to indicate that the account to be logged in has not performed interactive operations on the management system of the account to be logged in.

[0044] Optionally, the management system is used to manage and control user accounts, including functions such as creating, editing, and deleting accounts, setting account permissions and access controls, and recording account operation logs. The management system can be simply referred to as the system. Through this system, administrators can effectively manage user accounts, thereby effectively ensuring the security and stability of the system.

[0045] Optionally, interactive operations are used to characterize the interaction process between the user corresponding to the account to be logged in and the system. That is, by interacting with the system, the user can send instructions, request information, or perform control operations to the management system. For example, interactive operations can include clicking, dragging, entering text, selecting menus, etc.

[0046] For example, after a user selects a login type that suits their needs, they can determine the login credentials of the account to be logged in and confirm that the session status is currently not interacting with the management system, thus indicating that the account to be logged in has not successfully logged in.

[0047] It should be noted that this is only a preferred implementation method for determining the login credentials and initial session state of the account to be logged in. The process and method for determining the login credentials and initial session state of the account to be logged in are not specifically limited. As long as it is based on the login type, the process and method for determining the login credentials and initial session state of the account to be logged in are within the protection scope of this application, and will not be listed here.

[0048] Step S204: Based on the initial session state, authenticate the login credentials according to the zero-trust policy to obtain the verification result of the account to be logged in.

[0049] In step S204 of the application embodiment, based on the initial session state obtained in the above steps, the login credentials can be authenticated according to the zero trust policy in order to obtain the verification result of the account to be logged in. The zero trust policy is used to characterize the rules for authenticating the account to be logged in, and the verification result is used to characterize the login behavior of the account to be logged in as being in a normal behavior state.

[0050] For example, when a user determines that their session is not interacting with the management system, the login credentials can be authenticated according to the rules for authenticating login accounts to obtain the verification result. This ensures that the user's identity is trustworthy and that no abnormal behavior has occurred after the user successfully logs in.

[0051] It should be noted that this is only a preferred implementation method for obtaining the verification result of the account to be logged in. The process and method of obtaining the verification result of the account to be logged in are not specifically limited. As long as the login credentials are authenticated according to the zero trust policy based on the initial session state, the process and method of obtaining the verification result of the account to be logged in are within the protection scope of this application, and will not be elaborated here.

[0052] In steps S201 to S204 of this application embodiment, the requirement information of the account to be logged in can be obtained first. Then, based on the requirement information, the login type of the account to be logged in can be obtained. Then, based on the login type, the login credentials and initial session state of the account to be logged in can be determined. Finally, based on the initial session state, the login credentials are authenticated according to the zero-trust policy to obtain the verification result of the account to be logged in. Considering that after obtaining the login type of the account to be logged in based on the requirement information, the login credentials and initial session state of the account to be logged in can be determined according to the login type, and then the login credentials are authenticated according to the zero-trust policy to obtain the verification result of the account to be logged in, and the account to be logged in corresponds to the user who needs to log in, the above steps are used to authenticate the user who needs to log in, so as to solve the technical problem of low security of user authentication and achieve the technical effect of improving the security of user authentication.

[0053] In the account login verification method provided in this application embodiment, based on the initial session state, the login credentials are authenticated according to the zero-trust policy to obtain the verification result of the account to be logged in, including: inputting the login credentials in the terminal editor of the account to be logged in to obtain the login result of the account to be logged in; wherein, the login result is used to indicate successful login of the account to be logged in; based on the login result, the initial session state is switched to the target session state of the account to be logged in, wherein, the target session state is used to indicate that the account to be logged in has not performed interactive operations on the management system; based on the target session state, the login credentials are authenticated according to the zero-trust policy to obtain the verification result.

[0054] In this embodiment, login credentials can be entered in the terminal editor of the account to be logged in in order to obtain the login result of the account to be logged in. Then, based on the login result obtained above, the initial session state is switched to the target session state of the account to be logged in. Thus, based on the target session state, the login credentials can be authenticated according to the zero trust policy to obtain the verification result.

[0055] Optionally, the terminal editor can be an editor displayed on the interface of the user's terminal. The editor can be called a property editor, and the terminal can be various devices with computing and communication functions, such as personal computers, smartphones, tablets, and smartwatches.

[0056] Optionally, users can select a suitable login authentication method in the terminal's authentication area. For example, the terminal screen may include a component in the center for users to select their login authentication method. After selecting the corresponding method, different editors will appear for users to provide authentication information. Following the selection of an authentication method, the terminal screen will display an input area for users to enter authentication information. For instance, if a user selects password authentication, an editor for entering the password will be displayed; if the user selects SMS authentication, an editor for entering the SMS verification code will be displayed. This allows users to choose the appropriate authentication method according to their needs, thereby improving the speed of user authentication.

[0057] In the account login verification method provided in this application embodiment, the login credentials are authenticated according to the zero trust policy based on the target session state to obtain the verification result, including: obtaining the target login credentials of the account to be logged in using the management system based on the target session state; and obtaining the verification result in response to the target login credentials being the same as the login credentials.

[0058] In this embodiment, after obtaining the target session state, the management system can be used to retrieve the target login credentials for the account to be logged in. If the target login credentials and the login credentials are the same, the verification result can be obtained. The zero-trust strategy can be referred to as the zero-trust verification principle.

[0059] Optionally, the login credentials may be referred to as login information, and may include authentication credentials and authorization credentials, wherein the authentication credentials may be referred to as authentication information and the authorization credentials may be referred to as authorization information.

[0060] Furthermore, the target login credential can be a preset login credential, also known as preset login information, which can include preset authentication credentials and preset authorization credentials. The preset authentication credentials can be referred to as preset authentication information, and the preset authorization credentials can be referred to as preset authorization information.

[0061] For example, the zero-trust authentication principle requires continuous authentication throughout a user session, not just at login. The management system uses real-time authentication and authorization information to verify the user's login information, ensuring the user's identity remains trustworthy. By introducing zero-trust authentication, even after a user logs in, the management system continues to monitor the user's behavior and identity to promptly detect abnormal behavior and prevent potential risks.

[0062] In the account login verification method provided in this application embodiment, after switching the initial session state to the target session state of the account to be logged in based on the login result, the method further includes: obtaining the permission level of the account to be logged in, wherein the permission level is used to characterize the permission level of the account to be logged in to access resources in the management system; and generating the access page of the account to be logged in based on the permission level.

[0063] In this embodiment, after obtaining the target session state, the permission level of the account to be logged in can be obtained, and then the access page of the account to be logged in can be generated based on the obtained permission level.

[0064] For example, after obtaining the target session status, it indicates that the user's identity authentication is successful. Once the user's identity authentication is successful, the user will be granted permissions based on the corresponding level of zero trust, thereby being redirected to the page to obtain the corresponding resources, thus achieving the effect of improving user experience and page access efficiency.

[0065] It should be noted that this is only a preferred implementation method for generating the access page for the account to be logged in. The process and method of generating the access page for the account to be logged in are not specifically limited. As long as the process and method of generating the access page for the account to be logged in are based on the permission level, they are all within the protection scope of this application and will not be described in detail here.

[0066] Optionally, when the account to be logged in is in the initial session state, it means that the user's identity has not been successfully verified. In this case, the login type of the account to be logged in can be selected again, and the login credentials of the account to be logged in can be re-verified based on the current login type. For example, if the user's identity verification fails, the user will remain on the current interface and can choose to re-authenticate or change to another identity verification method.

[0067] In the account login verification method provided in this application embodiment, the method further includes: obtaining the initial location information of the account to be logged in; monitoring the initial location information to obtain the target location information of the account to be logged in, wherein the geographical location in the target location information is different from the geographical location in the initial location information; triggering alarm information based on the target location information, wherein the alarm information is used to indicate that the login credentials of the account to be logged in are abnormal.

[0068] In this embodiment, the initial location information of the account to be logged in can be selected, and then the initial location information can be monitored to obtain the target location information of the account to be logged in. Based on the target location information obtained above, an alarm can be triggered.

[0069] Optionally, if the target location information is different from the initial location information, it indicates that the user has logged in from a different location or changed the login location. In this case, an alarm message will be triggered to indicate that the login credentials of the account to be logged in are abnormal.

[0070] Optionally, the management system can monitor user behavior patterns in real time using artificial intelligence and machine learning technologies. The system can learn users' normal behavioral habits and identify abnormal activities, such as logging in from different locations or frequently changing login locations.

[0071] Furthermore, based on the intelligent risk analysis of the management system, the system can automatically trigger alerts, require additional verification, or even temporarily suspend accounts to prevent potential security threats and improve the security of user identity authentication.

[0072] In the account login verification method provided in this application embodiment, the login types include: a first login type, a second login type, and a third login type. The first login type is used to represent login by means of the biometric information of the target object corresponding to the account to be logged in. The second login type is used to represent login by means of the preset key of the account to be logged in. The third login type is used to represent login by means of the preset password of the terminal device of the account to be logged in.

[0073] In this embodiment, the login types include: a first login type, a second login type, and a third login type. The first login type can be a type of login that uses the biometric information of the target object corresponding to the account to be logged in, such as logging in through fingerprint, facial recognition, or iris scanning.

[0074] Optionally, the second login type can be a type of login that uses a preset key or hardware token of the account to be logged in, such as logging in using a preset security token or hardware key.

[0075] Optionally, the third login type can be a type of login through a preset password of the terminal device of the account to be logged in. In this case, the account to be logged in sends authentication information to the terminal device. After receiving the authentication information, the terminal device generates a dynamic password and sends the dynamic password to the response page of the account to be logged in. For example, login can be performed through a one-time password generated by a mobile application.

[0076] In the account login verification method provided in this application embodiment, the requirement information of the account to be logged in can be obtained first. Then, based on the requirement information, the login type of the account to be logged in can be obtained. Then, based on the login type, the login credentials and initial session state of the account to be logged in can be determined. Finally, based on the initial session state, the login credentials are authenticated according to a zero-trust policy to obtain the verification result of the account to be logged in. Considering that after obtaining the login type of the account to be logged in based on the requirement information, the login credentials and initial session state of the account to be logged in can be determined according to the login type, and then the login credentials are authenticated according to a zero-trust policy to obtain the verification result of the account to be logged in, and the account to be logged in corresponds to the user who needs to log in, the above steps can be used to authenticate the user who needs to log in, so as to solve the technical problem of low security of user authentication and achieve the technical effect of improving the security of user authentication.

[0077] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0078] The technical solutions of the embodiments of this application will be illustrated below with reference to preferred embodiments.

[0079] As financial services become increasingly digital and network-based, the security and reliability of user authentication have become paramount. Furthermore, the massive influx of internet-connected devices presents significant challenges to authentication platforms. Traditional user authentication methods, based on usernames and passwords, suffer from serious security vulnerabilities and are susceptible to cyberattacks and threats such as phishing and password cracking, resulting in low-security user authentication.

[0080] To address the aforementioned issues, a login verification method for accounts is proposed. This method first obtains the requirement information of the account to be logged in. Then, based on the obtained requirement information, the login type of the account to be logged in can be obtained. Next, based on the login type, the login credentials and initial session state of the account to be logged in can be determined. Finally, based on the obtained initial session state, the login credentials are authenticated according to a zero-trust policy to obtain the verification result of the account to be logged in. Considering that after obtaining the login type of the account to be logged in based on the requirement information, the login credentials and initial session state of the account to be logged in can be determined according to the login type, and then the login credentials are authenticated according to a zero-trust policy to obtain the verification result of the account to be logged in, and considering that the account to be logged in corresponds to the user who needs to log in, the above steps can be used to authenticate the user who needs to log in, thereby solving the technical problem of low security in user authentication and achieving the technical effect of improving the security of user authentication.

[0081] In this embodiment, a graphical login authentication interface can be set up, meaning that users do not need to pay attention to the identity authentication logic; they only need to select the authentication login method on the graphical authentication interface and then perform the corresponding identity authentication. Implementing the above-mentioned graphical login authentication interface may include a graphical interface layout, security authentication technology, and cross-platform support technology.

[0082] In this embodiment, the graphical interface layout needs to lay out the main interface, which may include: an authentication area, an attribute editor, and a real-time feedback component. The authentication area is a component in the middle of the screen that contains the user's selection of the login authentication method. When the user selects the corresponding login authentication method, different editors will appear to provide the user with identity authentication information.

[0083] Optionally, the main function of the attribute editor is to display an input editor after the user selects an authentication method, allowing the user to enter authentication-related information. For example, if the user selects password authentication, an editor for entering the user's password will be displayed; if the user selects SMS authentication, an editor for entering the SMS verification code will be displayed.

[0084] Optionally, the main function of the real-time feedback component is to instantly display the identity authentication result on the interface after the user enters the corresponding authentication login information and clicks confirm.

[0085] Optionally, if user authentication fails, the user remains on the current screen and can choose to re-authenticate or use a different authentication method. If user authentication succeeds, the user will be granted the corresponding level of permissions based on zero trust and will be redirected to the page for obtaining the corresponding resources.

[0086] In this application embodiment, security authentication technologies may include: multi-factor authentication technology, zero-trust verification technology, blockchain technology, intelligent risk analysis technology, unified identity management technology, and end-to-end encryption technology. Among these, multi-factor authentication technology requires users to provide additional authentication factors beyond the traditional username and password when logging in. These factors may include biometrics (such as fingerprints, facial recognition, and iris scanning), hardware tokens, and dynamic passwords (one-time passwords generated via a mobile application). This multi-factor authentication method significantly increases the difficulty of identity verification; even if one factor is compromised, the others can still maintain the security of the user's identity.

[0087] Optionally, zero-trust authentication technology: The zero-trust authentication principle requires continuous authentication throughout a user session, not just at login. The management system uses real-time authentication and authorization information to verify the user's login information, ensuring the user's identity remains trustworthy. By introducing zero-trust authentication, even after a user logs in, the management system continues to monitor the user's behavior and identity to promptly detect abnormal behavior and prevent potential risks.

[0088] Alternatively, blockchain technology is used as the basis for identity authentication, where user identity information is stored on an immutable blockchain. This not only ensures the security of user identity information but also achieves decentralized identity management. Each participant can verify the authenticity of a user's identity, and all identity authentication events are stored in the form of a distributed ledger, preventing single points of failure or malicious tampering.

[0089] Optionally, intelligent risk analysis technology: Through artificial intelligence and machine learning, the management system can monitor user behavior patterns in real time. The system can learn normal user habits and identify abnormal activities, such as logins from different locations or frequent changes in login location. Based on the management system's intelligent risk analysis, the system can automatically trigger alerts, require additional verification, or even temporarily suspend accounts to prevent potential security threats and improve the security of user authentication.

[0090] Optionally, unified identity management technology can provide a unified identity management system, allowing users to authenticate themselves only once and achieve single-identity authentication across different financial institutions. This simplifies the user authentication process while enhancing the consistency of identity management. Financial institutions can share verified user identity information to ensure security while improving efficiency.

[0091] Optionally, end-to-end encryption technology: Employing end-to-end encryption technology ensures the security of user information during data transmission and storage. Even if data is intercepted during transmission, it cannot be maliciously exploited, thus effectively preventing man-in-the-middle attacks and data leaks.

[0092] In this application embodiment, cross-platform support technologies may include: network standard support technologies, mobile terminal support technologies, preset application programming interface support technologies, containerization support technologies, adaptive design support technologies, and open standard support technologies.

[0093] Optionally, network standard support technology: adopting network standard-compliant identity authentication protocols and interfaces to ensure cross-platform compatibility across various web browsers, ensuring smooth operation on different web browsers and operating systems.

[0094] Optionally, mobile technology support includes providing native mobile applications that support mainstream mobile operating systems such as macOS and Android. This involves optimizing the user interface to improve user experience and ensuring consistent and user-friendly identity authentication across mobile phones and tablets.

[0095] Optionally, a pre-defined application programming interface (API) support technology is adopted: This design principle ensures cross-platform and cross-device data interaction and communication. In this way, other platforms and applications can request communication with the user's authentication platform via a simple Hypertext Transfer Protocol (HTTP), thereby achieving integrated operation with various applications.

[0096] Optionally, containerization support technology: Containerization technology is used to ensure consistency across different operating systems and cloud platforms. Containerization allows applications and their dependencies to be encapsulated in a self-contained, portable container, thus exhibiting the same behavior in various environments.

[0097] Optionally, adaptive design support technology: User interface and interaction design emphasize adaptability to ensure good display performance on various screen sizes and resolutions. Responsive design and adaptive layout are employed to allow users to easily use the platform on different devices.

[0098] Optionally, open standards support technology: Employing open standards allows for integration with other identity providers and authentication systems. This allows users to log in using different identity providers without changing the authentication platform.

[0099] In this application embodiment, a zero-trust-based large-scale user secure identity authentication login platform for the financial industry can be provided. This platform integrates at the network, mobile application, and interface levels to ensure the security of user identity authentication across different channels. Users can log in using traditional username and password methods, while the system also requires users to perform multi-factor authentication, such as fingerprint recognition or mobile token verification. Zero-trust authentication guarantees user security throughout the entire session. An enterprise can monitor user activity in real time through a management interface, identify potential risks using intelligent risk analysis technology, and administrators can investigate abnormal activities, temporarily freeze accounts, or require users to perform additional identity verification.

[0100] Furthermore, this platform can be applied to e-commerce, known as an e-commerce platform, to integrate a zero-trust identity authentication platform into various websites and mobile applications to provide secure user identity authentication services. When users make payments, view orders, and perform other operations, they need to undergo multi-factor authentication. At the same time, blockchain technology is used to ensure the secure storage of user identity information. The e-commerce platform can use intelligent risk analysis to identify potential fraudulent activities and take timely measures to protect the security of users and the platform.

[0101] In addition, the enterprise's internal system can integrate the zero-trust identity authentication platform into the single sign-on system to achieve a high level of secure authentication of employee identities. After an employee logs in through the enterprise's internal system, the system will perform zero-trust verification to ensure the employee's identity security throughout the entire work session. For sensitive information and operations, additional identity verification is required. Enterprise administrators can monitor the identity authentication status of employees in real time through the unified identity management system, promptly detect abnormal behavior, and take corresponding measures.

[0102] This application also provides an account login verification device. It should be noted that the account login verification device of this application can be used to execute the account login verification method provided in this application. The following describes the account login verification device provided in this application.

[0103] According to an embodiment of this application, an apparatus for implementing the login verification method for the aforementioned account is also provided. Figure 3 This is a schematic diagram of an account login verification device according to an embodiment of this application, such as... Figure 3 As shown, the device includes:

[0104] The first acquisition unit 301 is used to acquire the requirement information of the account to be logged in, wherein the requirement information is used to characterize the identity verification requirements of the account to be logged in.

[0105] The second acquisition unit 302 is used to acquire the login type of the account to be logged in based on the requirement information, wherein the login type is used to characterize the authentication method of the account to be logged in.

[0106] The determining unit 303 is used to determine the login credentials and initial session state of the account to be logged in based on the login type, wherein the initial session state is used to indicate that the account to be logged in has not performed any interactive operations with the management system of the account to be logged in.

[0107] The third acquisition unit 304 is used to authenticate the login credentials according to the zero trust policy based on the initial session state, and obtain the verification result of the account to be logged in. The zero trust policy is used to characterize the rules for authenticating the account to be logged in, and the verification result is used to characterize the login behavior of the account to be logged in as being in a normal behavior state.

[0108] The account login verification device provided in this application embodiment acquires the requirement information of the account to be logged in through a first acquisition unit, wherein the requirement information is used to characterize the identity verification requirement of the account to be logged in; acquires the login type of the account to be logged in based on the requirement information through a second acquisition unit, wherein the login type is used to characterize the identity verification method of the account to be logged in; determines the login credentials and initial session state of the account to be logged in based on the login type through a determination unit, wherein the initial session state is used to characterize that the account to be logged in has not performed any interactive operations on the management system of the account to be logged in; and authenticates the login credentials according to a zero-trust policy based on the initial session state through a third acquisition unit, thereby obtaining the verification result of the account to be logged in, wherein the zero-trust policy is used to characterize the rules for authenticating the account to be logged in, and the verification result is used to characterize that the login behavior of the account to be logged in is in a normal behavior state. This solves the technical problem of low security of user identity verification in related technologies, thereby achieving the technical effect of improving the security of user identity verification.

[0109] Optionally, in the account login verification device provided in this application embodiment, the third acquisition unit 304 may include: a first acquisition module, used to input login credentials in the terminal editor of the account to be logged in, and obtain the login result of the account to be logged in; wherein, the login result is used to indicate successful login of the account to be logged in; a switching module, used to switch the initial session state to the target session state of the account to be logged in based on the login result, wherein, the target session state is used to indicate that the account to be logged in has not performed interactive operations on the management system; and a second acquisition module, used to authenticate the login credentials according to the zero trust policy based on the target session state, and obtain the verification result.

[0110] Optionally, in the account login verification device provided in this application embodiment, the second acquisition module may include: a first acquisition submodule, used to acquire the target login credentials of the account to be logged in using the management system based on the target session state; and a second acquisition submodule, used to obtain a verification result in response to the target login credentials being the same as the login credentials.

[0111] Optionally, in the account login verification device provided in this application embodiment, after switching the initial session state to the target session state of the account to be logged in based on the login result, the third acquisition unit 304 may further include: an acquisition module, used to acquire the permission level of the account to be logged in, wherein the permission level is used to characterize the permission level of the account to be logged in to access resources in the management system; and a generation module, used to generate an access page for the account to be logged in based on the permission level.

[0112] Optionally, in the account login verification device provided in this application embodiment, the device further includes: a fourth acquisition unit, used to acquire the initial location information of the account to be logged in; a monitoring unit, used to monitor the initial location information to obtain the target location information of the account to be logged in, wherein the geographical location in the target location information is different from the geographical location in the initial location information; and a triggering unit, used to trigger alarm information based on the target location information, wherein the alarm information is used to indicate that the login credentials of the account to be logged in are abnormal.

[0113] Optionally, in the account login verification device provided in this application embodiment, the login type includes: a first login type, a second login type and a third login type, wherein the first login type is used to represent login by means of the biometric information of the target object corresponding to the account to be logged in, the second login type is used to represent login by means of the preset key of the account to be logged in, and the third login type is used to represent login by means of the preset password of the terminal device of the account to be logged in.

[0114] It should be noted that the above-mentioned modules or units may be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above-mentioned modules may also be part of the device and may run in the computer terminal 10 provided in Embodiment 1.

[0115] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 Only one of the following is shown: processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0116] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0117] The processor can access information and applications stored in memory via a transmission device to perform the following steps: Based on the initial session state, authenticate the login credentials according to a zero-trust policy to obtain the verification result of the account to be logged in, including: entering the login credentials in the terminal editor of the account to be logged in to obtain the login result of the account to be logged in; wherein, the login result is used to indicate successful login of the account to be logged in; based on the login result, switch the initial session state to the target session state of the account to be logged in, wherein, the target session state is used to indicate that the account to be logged in has not performed any interactive operations on the management system; based on the target session state, authenticate the login credentials according to a zero-trust policy to obtain the verification result.

[0118] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: based on the target session state, authenticate the login credentials according to the zero-trust policy to obtain the authentication result, including: based on the target session state, using the management system to obtain the target login credentials for the account to be logged in; and in response to the target login credentials being the same as the login credentials, obtaining the authentication result.

[0119] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: after switching the initial session state to the target session state of the account to be logged in based on the login result, the processor is also used to obtain the permission level of the account to be logged in, wherein the permission level is used to characterize the permission level of the account to be logged in to access resources in the management system; and to generate an access page for the account to be logged in based on the permission level.

[0120] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: obtain the initial location information of the account to be logged in; monitor the initial location information to obtain the target location information of the account to be logged in, wherein the geographical location in the target location information is different from the geographical location in the initial location information; trigger alarm information based on the target location information, wherein the alarm information is used to indicate that the login credentials of the account to be logged in are abnormal.

[0121] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: The login types include: a first login type, a second login type and a third login type, wherein the first login type is used to represent login by means of the biometric information of the target object corresponding to the account to be logged in, the second login type is used to represent login by means of the preset key of the account to be logged in, and the third login type is used to represent login by means of the preset password of the terminal device of the account to be logged in.

[0122] This application provides a login verification method for an account. First, the requirement information of the account to be logged in is obtained. Then, based on the obtained requirement information, the login type of the account to be logged in can be obtained. Next, based on the login type, the login credentials and initial session state of the account to be logged in can be determined. Finally, based on the obtained initial session state, the login credentials are authenticated according to a zero-trust policy to obtain the verification result of the account to be logged in. Since the login type of the account to be logged in is obtained based on the requirement information, the login credentials and initial session state of the account to be logged in can be determined based on the login type, and the login credentials are then authenticated according to a zero-trust policy to obtain the verification result of the account to be logged in, and the account to be logged in corresponds to the user who needs to log in, the above steps can be used to authenticate the user who needs to log in, thus solving the technical problem of low security in user authentication and achieving the technical effect of improving the security of user authentication.

[0123] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones (such as Android phones, iOS phones, etc.), tablets, PDAs, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0124] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0125] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the account login verification method provided in Embodiment 1.

[0126] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0127] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing account login verification method steps.

[0128] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0129] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0130] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0131] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0132] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0133] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0134] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A login verification method for an account, characterized in that, include: Obtain the requirement information of the account to be logged in, wherein the requirement information is used to characterize the identity verification requirements of the account to be logged in; Based on the aforementioned requirement information, the login type of the account to be logged in is obtained, wherein the login type is used to characterize the authentication method of the account to be logged in; Based on the login type, the login credentials and initial session state of the account to be logged in are determined, wherein the initial session state is used to indicate that the account to be logged in has not performed any interactive operations on the management system of the account to be logged in. Based on the initial session state, the login credentials are authenticated according to the zero trust policy to obtain the verification result of the account to be logged in. The zero trust policy is used to characterize the rules for authenticating the account to be logged in, and the verification result is used to characterize the login behavior of the account to be logged in as being in a normal behavior state. The process includes: verifying the login credentials according to a zero-trust policy based on the initial session state to obtain a verification result for the account to be logged in; inputting the login credentials into the terminal editor of the account to be logged in to obtain a login result for the account to be logged in; wherein the login result indicates successful login to the account to be logged in; based on the login result, switching the initial session state to the target session state of the account to be logged in, wherein the target session state indicates that the account to be logged in has not performed the interactive operation on the management system; and verifying the login credentials according to the zero-trust policy based on the target session state to obtain the verification result. Based on the target session state, the login credentials are authenticated according to the zero-trust policy to obtain the verification result, including: based on the target session state, obtaining the target login credentials of the account to be logged in using the management system; and obtaining the verification result in response to the target login credentials being the same as the login credentials.

2. The method according to claim 1, characterized in that, After switching the initial session state to the target session state of the account to be logged in based on the login result, the method further includes: Obtain the permission level of the account to be logged in, wherein the permission level is used to characterize the permission level of the account to be logged in to access resources in the management system; Based on the permission level, an access page for the account to be logged in is generated.

3. The method according to claim 1, characterized in that, The method further includes: Obtain the initial location information of the account to be logged in; The initial location information is monitored to obtain the target location information of the account to be logged in, wherein the geographical location in the target location information is different from the geographical location in the initial location information; Based on the target location information, an alarm is triggered, wherein the alarm information is used to indicate that the login credentials of the account to be logged in are abnormal.

4. The method according to claim 1, characterized in that, The login types include: a first login type, a second login type, and a third login type. The first login type is used to represent login using the biometric information of the target object corresponding to the account to be logged in. The second login type is used to represent login using a preset key of the account to be logged in. The third login type is used to represent login using a preset password of the terminal device of the account to be logged in.

5. A login verification device for an account, characterized in that, include: The first acquisition unit is used to acquire the requirement information of the account to be logged in, wherein the requirement information is used to characterize the identity verification requirement of the account to be logged in; The second acquisition unit is used to acquire the login type of the account to be logged in based on the requirement information, wherein the login type is used to characterize the authentication method of the account to be logged in; The determining unit is configured to determine the login credentials and initial session state of the account to be logged in based on the login type, wherein the initial session state is used to indicate that the account to be logged in has not performed any interactive operations on the management system of the account to be logged in; The third acquisition unit is used to authenticate the login credentials according to the zero trust policy based on the initial session state, and obtain the verification result of the account to be logged in. The zero trust policy is used to characterize the rules for authenticating the account to be logged in, and the verification result is used to characterize the login behavior of the account to be logged in as being in a normal behavior state. The third acquisition unit is further configured to input the login credential into the terminal editor of the account to be logged in, and obtain the login result of the account to be logged in; wherein the login result is used to indicate successful login of the account to be logged in; based on the login result, the initial session state is switched to the target session state of the account to be logged in, wherein the target session state is used to indicate that the account to be logged in has not performed the interactive operation on the management system; based on the target session state, the login credential is authenticated according to the zero-trust policy to obtain the verification result; It is also used to obtain the target login credentials for the account to be logged in using the management system based on the target session state; and to obtain the verification result in response to the target login credentials being the same as the login credentials.

6. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the method of any one of claims 1 to 4.

8. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the method described in any one of claims 1 to 4.

Images