Method for determining factor items influencing authentication and related device

Abstract

The embodiment of the invention discloses a method for determining factor items influencing authentication and a related device, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic, auxiliary driving and the like. According to the method, other factor data are controlled to be unchanged in a variable control mode, and only the factor data corresponding to the to-be-verified factor item is changed, so that the front data which cannot fail in authentication and the back data which can fail in authentication in the theoretical authentication process are obtained. If the simulation authentication result identifies that both the front data and the back data pass the authentication, determining that the to-be-verified factor item is a factor item which does not affect the authentication for the target operation; and if the simulation authentication result identifies that the front data passes the authentication and the back data does not pass the authentication, determining that the to-be-verified factor item is a factor item influencing the authentication for the target operation. Therefore, through the simulated authentication result obtained through multiple times of authentication, whether the authentication for the target operation is influenced by the to-be-verified factor item under the combined action of the multiple factor items can be judged, so that the authentication process is transparent.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method for determining factors affecting authentication and a related device. Background Art

[0002] With the advancement of computer technology, various computer systems generally adopt authentication technology. Authentication verifies whether users have the required permissions to perform certain operations in the system, thereby protecting network resources from unauthorized users. For example, before user A updates table B, authentication is performed to determine whether user A is authorized to update the data in table B. Only after authentication is passed can user A update table B.

[0003] As computer systems become more functional, the number of authentication policies that different administrative users set for the same operation will also increase. For example, which users in which positions can update Table B, when can Table B be updated, and whether updating Table B requires approval from superiors, etc.

[0004] That is to say, due to the opacity of the authentication process, if the authentication process for the same operation is related to multiple factors such as position, time, etc., it will be difficult to determine which of the multiple factors will affect the authentication result. Therefore, if the authentication for the target operation fails, the user cannot know the reason for the authentication failure, and thus cannot quickly resolve the problem of authentication failure, resulting in a poor user experience. Summary of the Invention

[0005] In order to solve the above technical problems, the present application provides a method and related devices for determining factor items affecting authentication, which are used to determine whether the factor item to be verified is a factor item affecting the authentication of the target operation, thereby making the authentication process transparent and improving the user experience.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] In one aspect, an embodiment of the present application provides a method for determining factors affecting authentication, the method comprising:

[0008] For an authentication request for a target operation, obtaining a factor item to be verified, an authentication policy corresponding to the target operation, and a plurality of object factor data related to an object identifier included in the authentication request, wherein the authentication policy includes a plurality of standard factor data corresponding to when the target operation passes authentication;

[0009] If the factor item to be verified passes authentication, positive factor data is obtained, and positive data is obtained based on the positive factor data and the plurality of object factor data; if the factor item to be verified fails authentication, negative factor data is obtained, and negative data is obtained based on the negative factor data and the plurality of object factor data;

[0010] Authenticate the positive data and the negative data respectively according to the multiple standard factor data to obtain a simulated authentication result;

[0011] If the simulated authentication result indicates that both the positive data and the negative data pass the authentication, determine that the factor item to be verified is a factor item that does not affect the authentication for the target operation; if the simulated authentication result indicates that the positive data passes the authentication and the negative data fails the authentication, determine that the factor item to be verified is a factor item that affects the authentication for the target operation.

[0012] On the other hand, an embodiment of the present application provides a device for determining a factor item affecting authentication, and the device includes: an acquisition unit, a construction unit, a simulated authentication unit, and an analysis unit;

[0013] The acquisition unit is configured to, for an authentication request for a target operation, acquire a factor item to be verified, an authentication policy corresponding to the target operation, and multiple object factor data related to an object identifier included in the authentication request, where the authentication policy includes multiple standard factor data corresponding to when the target operation passes the authentication;

[0014] The construction unit is configured to make the factor item to be verified pass the authentication to obtain positive factor data, and obtain positive data according to the positive factor data and the multiple object factor data; make the factor item to be verified fail the authentication to obtain negative factor data, and obtain negative data according to the negative factor data and the multiple object factor data;

[0015] The simulated authentication unit is configured to authenticate the positive data and the negative data respectively according to the multiple standard factor data to obtain a simulated authentication result;

[0016] The analysis unit is configured to, if the simulated authentication result indicates that both the positive data and the negative data pass the authentication, determine that the factor item to be verified is a factor item that does not affect the authentication for the target operation; if the simulated authentication result indicates that the positive data passes the authentication and the negative data fails the authentication, determine that the factor item to be verified is a factor item that affects the authentication for the target operation.

[0017] On the other hand, an embodiment of the present application provides a computer device, and the computer device includes a processor and a memory:

[0018] The memory is used to store a computer program and transmit the computer program to the processor;

[0019] The processor is configured to execute the method described in the above aspect according to the instructions in the computer program.

[0020] On the other hand, an embodiment of the present application provides a computer-readable storage medium for storing a computer program for executing the method described in the above aspect.

[0021] On the other hand, an embodiment of the present application provides a computer program product or a computer program. The computer program product or the computer program includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method described in the above aspect.

[0022] It can be seen from the above technical solutions that a factor item to be verified, an authentication policy corresponding to a target operation, and a plurality of object factor data related to the object identifier included in the authentication request are obtained. Among them, the authentication policy includes a plurality of standard factor data corresponding to the case where the target operation passes authentication. If the plurality of object factor data is consistent with the plurality of standard factor data, the target operation from the object identifier can pass authentication. If it is determined whether the factor item to be verified affects the authentication process of the target operation, data for authentication needs to be constructed. Specifically, by controlling variables, other factor data is kept unchanged, and only the factor data corresponding to the factor item to be verified is changed, so as to obtain positive data that will not fail authentication due to the factor item to be verified and negative data that will fail authentication due to the factor item to be verified in the theoretical authentication process. Since the authentication process is opaque, in order to exclude authentication failures caused by other factor data in the positive data and negative data, authentication is performed based on the positive data and negative data respectively. That is, if the simulated authentication result indicates that the positive data passes authentication, it means that other factor data in the positive data does not affect authentication either. Moreover, the negative factor data theoretically causes authentication to fail. If the simulated authentication result indicates that the negative data also passes authentication, it means that the factor item to be verified is not used in the authentication process, so as to determine that the factor item to be verified is a factor item that does not affect the authentication of the target operation. Similarly, in the case where the simulated authentication result indicates that the positive data passes authentication, if the negative data fails authentication, it is determined that the factor item to be verified is a factor item that affects the authentication of the target operation. Thus, through the logical relationship between the simulated authentication results obtained by multiple authentications respectively, it can be judged whether the authentication of the target operation is affected by the factor item to be verified under the combined action of multiple factor items, thereby making the authentication process transparent and improving the user experience. Description of the Drawings

[0023] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0024] Figure 1 Schematic diagram of an application scenario of a method for determining factor items affecting authentication provided by an embodiment of the present application;

[0025] Figure 2 Schematic flowchart of a method for determining factor items affecting authentication provided by an embodiment of the present application;

[0026] Figure 3 Schematic diagram of an offline simulation authentication provided by an embodiment of the present application;

[0027] Figure 4 Schematic diagram of an online simulation authentication provided by an embodiment of the present application;

[0028] Figure 5 Schematic diagram of the structure of a device for determining factor items affecting authentication provided by an embodiment of the present application;

[0029] Figure 6 Schematic diagram of the structure of a server provided by an embodiment of the present application;

[0030] Figure 7 Schematic diagram of the structure of a terminal device provided by an embodiment of the present application. Detailed implementation manners

[0031] The following describes the embodiments of the present application with reference to the accompanying drawings.

[0032] The terms "first", "second", "third", "fourth", etc. (if any) in the specification, claims and accompanying drawings of the present application are used to distinguish similar objects and do not necessarily describe a specific order or sequence. It should be understood that such used data can be interchanged under appropriate circumstances so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "comprising" and "corresponding to" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units does not necessarily limit to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0033] In the related art, due to the lack of transparency in the authentication process, if the authentication process for the same operation is related to multiple factor items, it will be difficult to determine which factor item among the multiple factor items will affect the authentication result. Here, Attribute-Based Access Control (ABAC) is taken as an example for illustration.

[0034] ABAC is a very popular, powerful and flexible access control method in the industry at present. It can use any describable attribute item as a factor item, such as "the position of the operating user", "the department of the operating user", "the current time", "whether the operation requires approval", etc. By matching the factor items with logical relationships (such as logical AND, logical OR, etc.) to affect the authentication result, it provides more fine-grained access control and more flexibly handles complex access control.

[0035] However, with the increasing complexity of computer systems, a large number of different attribute items are required to achieve more refined permission control. When multiple management users grant thousands of attribute items to the same operating user, it leads to the judgment of multiple attribute items in the process of authenticating the target operation of the operating user. Moreover, the authentication process is not transparent, which makes it difficult for users such as management users or operating users to clearly know the specific reason for the success or failure of this authentication. That is to say, in the case of numerous combinations of attribute items, it is impossible to determine whether the satisfaction or dissatisfaction of a certain attribute item directly affects the authentication result. If the authentication for the target operation fails, the user cannot know the reason for the authentication failure, so the problem of authentication failure cannot be quickly solved, and the user experience is poor.

[0036] Based on this, the present application provides a method and related device for determining factor items affecting authentication. By controlling variables, other factor data is kept unchanged, and only the factor data corresponding to the factor item to be verified is changed, so as to obtain positive data that will not fail authentication due to the factor item to be verified and negative data that will fail authentication due to the factor item to be verified in the theoretical authentication process. Since the authentication process is not transparent, in order to exclude authentication failures caused by other factor items in the positive data and negative data, authentication is performed based on the positive data and negative data respectively. Thus, through the logical relationship between the simulated authentication results obtained by multiple authentications, it can be determined whether the authentication for the target operation is affected by the factor item to be verified under the combined action of multiple factor items, thereby making the authentication process transparent and improving the user experience.

[0037] The method for determining factor items affecting authentication provided by the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, intelligent transportation, assisted driving, Internet of Things, financial services, and medical services, etc. Here, four scenarios are taken as examples.

[0038] Scenario 1, in the cloud technology scenario, there may be a large number of resources and users, and they may come from different organizations. Through authentication technologies such as ABAC, it is possible to determine access permissions based on the attributes of users and resources (such as roles, locations, time, etc.), making access control more flexible and precise.

[0039] Scenario 2, in the Internet of Things scenario, there is a huge number of devices, and the interactions between devices are complex. Through authentication technologies such as ABAC, it is possible to determine access permissions between devices based on the attributes of devices (such as types, locations, status, etc.), improving security.

[0040] Scenario 3, in the financial service system, strict access control is required for sensitive financial information. Through authentication technologies such as ABAC, it is possible to determine who can access which information based on attributes such as the roles of employees and the sensitivity levels of information.

[0041] Scenario 4, in the medical service system, strict access control is required for patients' sensitive information. Through authentication technologies such as ABAC, it is possible to determine who can access which information based on attributes such as the roles of doctors, nurses, and other medical staff and the conditions of patients.

[0042] In the above scenarios, it is possible to determine whether the factor item to be verified is a factor item affecting authentication for the target operation through the method for determining factor items affecting authentication provided in this application, thereby making the authentication process transparent and improving the user experience.

[0043] The method for determining factor items affecting authentication provided in this application can be applied to computer devices with the ability to determine factor items affecting authentication, such as terminal devices and servers. Among them, the terminal device can specifically be a desktop computer, a laptop computer, a smart phone, a tablet computer, an aircraft, an Internet of Things device, and a portable wearable device. The Internet of Things device can be a smart speaker, a smart TV, a smart air conditioner, a smart vehicle-mounted device, etc. The smart vehicle-mounted device can be a vehicle-mounted navigation terminal and a vehicle-mounted computer, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc., but is not limited thereto; the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server or server cluster providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms. The terminal device and the server can be directly or indirectly connected through wired or wireless communication methods, and this application does not make any restrictions here.

[0044] To facilitate understanding of the method for determining factors affecting authentication provided by the embodiments of the present application, the following takes the execution entity of the method for determining factors affecting authentication as a server as an example to provide an exemplary introduction to the application scenario of the method for determining factors affecting authentication.

[0045] Refer to Figure 1 , which is a schematic diagram of an application scenario of a method for determining factors affecting authentication provided by the embodiments of the present application. As Figure 1 shown, this application scenario includes a terminal device 110 and a server 120, and the terminal device 110 and the server 120 can communicate through a communication network. Among them, the communication network uses standard communication technologies and / or protocols, usually the Internet, but can also be any network, including but not limited to any combination of Bluetooth, local area network (LAN), metropolitan area network (MAN), wide area network (WAN), mobile, private network or virtual private network). In some embodiments, customized or dedicated data communication technologies can be used to replace or supplement the above data communication technologies.

[0046] A client for providing a certain service is installed in the terminal device 110. The client is user-oriented and is used to provide operations for the services required by the user. In actual applications, the user can perform a target operation through the terminal device 110, such as updating Table B. The terminal device 110 sends an authentication request for the target operation to the server 120, and the authentication request includes an object identifier for identifying the user.

[0047] The server 120 provides at least an authentication function. After receiving the authentication request from the terminal device 110, it obtains the authentication policy corresponding to the target operation and the object factor data related to the object identifier. Among them, the authentication policy includes multiple standard factor data corresponding to when the target operation passes authentication. For example, the authentication policy can be that only employees with an organizational structure of a data security group and a network attribute of an office network can perform the operation of updating Table B. The object factor data is used to describe data related to the object, such as under which organizational structure the user is and what the network attribute he is currently using is, etc. Thus, if multiple object factor data are consistent with multiple standard factor data, the target operation from the object identifier can pass authentication.

[0048] In order to determine whether the factor item to be verified affects the authentication process of the target operation, data for authentication needs to be constructed. Specifically, by controlling variables, the object factor data is kept unchanged, and only the factor data corresponding to the factor item to be verified is changed, so as to obtain the positive factor data that will not result in authentication failure due to the factor item to be verified and the negative factor data that will result in authentication failure due to the factor item to be verified during the theoretical authentication process. Then, positive data is obtained based on the object factor data and the positive factor data, and negative data is obtained based on the object factor data and the negative factor data.

[0049] Since the authentication process is opaque, in order to exclude authentication failures caused by non-negative factor data in the positive data and the negative data, authentication is performed based on the positive data and the negative data respectively. That is, if the simulated authentication result indicates that the positive data passes the authentication, it means that other factor data in the positive data that is not positive factor data does not affect the authentication either. Moreover, the negative factor data theoretically should cause the authentication to fail. If the simulated authentication result indicates that the negative data also passes the authentication, it means that the factor item to be verified is not used in the authentication process, thereby determining that the factor item to be verified is a factor item that does not affect the authentication for the target operation. Similarly, in the case where the simulated authentication result indicates that the positive data passes the authentication, if the negative data fails the authentication, it is determined that the factor item to be verified is a factor item that affects the authentication for the target operation. Thus, through the logical relationship between the simulated authentication results obtained by multiple authentications respectively, it is possible to determine whether the authentication for the target operation is affected by the factor item to be verified under the combined action of multiple factor items, thereby making the authentication process transparent and improving the user experience.

[0050] The method for determining the factor item affecting authentication provided by the embodiments of the present application can be executed by the server. However, in other embodiments of the present application, the terminal device may also have a similar function to the server, so as to execute the method for determining the factor item affecting authentication provided by the embodiments of the present application, or the method for determining the factor item affecting authentication provided by the embodiments of the present application may be jointly executed by the terminal device and the server. This embodiment does not make any limitations in this regard.

[0051] The following provides a detailed introduction to a method for determining the factor item affecting authentication provided by the present application through method embodiments.

[0052] See Figure 2 , which is a schematic flowchart of the method for determining the factor item affecting authentication provided by the embodiments of the present application. For the convenience of description, the following embodiments still take the execution entity of the method for determining the factor item affecting authentication as the server as an example for introduction. As Figure 2 shown, the method for determining the factor item affecting authentication includes S201 - S204.

[0053] S201: For an authentication request for a target operation, obtain the factor items to be verified, the authentication policy corresponding to the target operation, and multiple object factor data related to the object identifier included in the authentication request.

[0054] In a computer system, some operations need to be authenticated, such as operations to update data, delete data, etc. The target operation is one of the multiple operations that need to be authenticated. After the object executes the target operation, the computer system generates an authentication request for the target operation to verify whether the target operation can be executed.

[0055] In the related art, although it is possible to authenticate the authentication request for the target operation, due to the lack of transparency in the authentication process, if multiple factor items are involved in the authentication process, it is impossible to determine which factor item affects the authentication result. Based on this, the embodiments of the present application provide a simulated authentication process to verify whether the factor items to be verified are the factor items that affect the authentication of the target operation.

[0056] Among them, the factor item is used to describe a characteristic of a certain aspect that needs to be verified in the authentication process. For example, the attribute item in ABAC. Another example is the policy in policy-based (Attribute-Based Access Control, PBAC) authentication, etc. The factor item generally corresponds to factor data, and the factor data is used to describe the factor item. Different factor items correspond to different factor data. For example, the organizational structure (factor item) is the data security group (factor data), and the network attribute (factor item) is the office network (factor data), etc. The factor item to be verified is the factor item waiting to be verified, that is, to determine whether it affects the authentication of the target operation.

[0057] The authentication policy for the target operation includes multiple standard factor data corresponding to the case where the target operation passes the authentication. The standard factor data is the factor data used as a standard, that is, to describe under what circumstances the factor data corresponding to the factor item can make the target operation pass the authentication. There is also a logical relationship between the factor data corresponding to different factor items, such as logical OR, logical AND, etc. It should be noted that in the embodiments of the present application, the authentication policy includes the standard factor data corresponding to multiple factor items respectively. For example, the authentication policy can include multiple sub-policies, and each sub-policy corresponds to the standard factor data of a factor item.

[0058] An authentication request generally includes an object identifier, and object factor data is obtained based on the object identifier. The object factor data is used to describe the factor data corresponding to an object in a certain factor item, and different factor items have different object factor data. For example, when the factor item is the organizational structure, the standard factor data can be a data security group, a technology center group, etc. Another example is that when the factor item is the network attribute, the object factor data can be an office network, an external network, etc. As a possible implementation, the object factor data can be obtained based on the factor item corresponding to the standard factor data, so that the object factor data and the standard factor data correspond to the same factor item.

[0059] It can be understood that in the specific implementation of this application, data related to object factor data, etc. is involved. When the above embodiments of this application are applied to specific products or technologies, the user's separate permission or separate consent is required, and the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of relevant countries and regions.

[0060] S202: Authenticate the factor item to be verified to obtain positive factor data, and obtain positive data based on the positive factor data and multiple object factor data; authenticate the factor item to be verified as not passing to obtain negative factor data, and obtain negative data based on the negative factor data and multiple object factor data.

[0061] The factor item to be verified can correspond to multiple factor data. Among the multiple factor data, the factor data that can make the factor item to be verified pass the authentication is positive factor data, and the factor data that can make the factor item to be verified not pass the authentication is negative factor data. For example, when the factor item to be verified is the organizational structure, when the organizational structure is a data security group, the factor item to be verified will pass the authentication, so the positive factor data is the data security group, and those such as the technology center group are all negative factor data.

[0062] Then, positive data is obtained based on the positive factor data and multiple object factor data, and negative data is obtained based on the negative factor data and multiple object factor data. Thus, the positive data is the collection of the positive factor data and multiple object factor data, and the negative data is the collection of the negative factor data and multiple object data.

[0063] It should be noted that in the above collections, the same factor item only corresponds to one factor data, and the priority of the positive factor data is higher than that of the object factor data, and the priority of the negative factor data is higher than that of the object factor data. The following will be specifically described.

[0064] For positive data, if the factor item to be verified is different from the factor items respectively corresponding to the n object factor data, that is, the factor item to be verified is different from the n factor items related to the object, then positive data is obtained according to the object factor data respectively corresponding to the n factor items and the positive factor data corresponding to the factor item to be verified, so that the positive data includes the factor data respectively corresponding to n + 1 factor items (the factor item to be verified and the n factor items related to the object); if the factor item to be verified is the same as the first target factor item among the factor items respectively corresponding to the n object factor data, that is, the factor item to be verified is the same as the first target factor item, and the priority of the positive factor data corresponding to the factor item to be verified is higher than the object factor data corresponding to the first target factor item, then the object factor data corresponding to the first target factor item is replaced with the positive factor data to obtain positive data, so that the positive data includes the factor data respectively corresponding to the n factor items.

[0065] For negative data, if the factor item to be verified is different from the factor items respectively corresponding to the n object factor data, that is, the factor item to be verified is different from the n factor items related to the object, then negative data is obtained according to the object factor data respectively corresponding to the n factor items and the negative factor data corresponding to the factor item to be verified, so that the negative data includes the factor data respectively corresponding to n + 1 factor items (the factor item to be verified and the n factor items related to the object); if the factor item to be verified is the same as the second target factor item among the factor items respectively corresponding to the n object factor data, that is, the factor item to be verified is the same as the second target factor item, and the priority of the negative factor data corresponding to the factor item to be verified is higher than the object factor data corresponding to the second target factor item, then the object factor data corresponding to the second target factor item is replaced with the negative factor data to obtain negative data, so that the negative data includes the factor data respectively corresponding to the n factor items.

[0066] That is to say, if the positive factor data and the object factor data correspond to the same factor item, then the object factor data is replaced with the positive factor data, and then positive data is obtained by combining other object factor data. If the positive factor data and multiple object factor data do not correspond to the same factor item, then the positive data includes the positive factor data and multiple object factor data. Similarly, if the negative factor data and the object factor data correspond to the same factor item, then the object factor data is replaced with the negative factor data to obtain negative data. If the negative factor data and multiple object factor data do not correspond to the same factor item, then the negative data includes the negative factor data and multiple object factor data.

[0067] Thus, according to whether the object factor data includes the factor item to be verified, other factor data is controlled to remain unchanged in different ways, and only the factor data corresponding to the factor item to be verified is controlled to change, which is simple and easy to implement. Subsequently, it is possible to determine whether the factor item to be verified affects the authentication for the target operation based on the simulated authentication result.

[0068] S203: Authenticate the positive data and negative data respectively according to multiple standard factor data to obtain a simulated authentication result.

[0069] It should be noted that since the positive data and negative data are not the real data for object authentication (i.e., object factor data), but data transformed on the basis of real data for the purpose of verifying whether the factor items to be verified affect the authentication of the target operation, the current authentication process belongs to a simulated authentication process. The obtained simulated authentication result can be displayed to the object corresponding to the object identifier to achieve visual display. It can also be only analyzed internally without being displayed to the object corresponding to the object identifier, so as to make the authentication process for the target operation transparent.

[0070] Authenticate the positive data and negative data respectively according to multiple standard factor data to obtain a simulated authentication result, that is, use multiple standard factor data as the standard answer, authenticate the positive data once to obtain a sub-simulated authentication result. Authenticate the negative data once to obtain a sub-simulated authentication result, and then obtain the final simulated authentication result based on the two sub-simulated authentication results. The following takes the positive data as an example.

[0071] During the authentication process, the standard factor data will be used as the correct answer to compare whether multiple standard factor data appear in the positive data. For example, if n standard factor data correspond to n factor items, obtain the factor data corresponding to the n factor items respectively from the positive data, and compare it with the corresponding standard factor data. If they are the same, the factor item included in the positive data passes the authentication, otherwise it fails the authentication. For example, the positive data is "Technical Center Group" and "External Network". The standard factor data is "Technical Center Group" and "Office Network". The factor item corresponding to the Technical Center Group passes the authentication, but the factor item corresponding to the External Network fails the authentication, so the positive data fails the authentication. Another example is that the positive data is "Technical Center Group", "Office Network" and "Female". The standard factor data is "Technical Center Group" and "Office Network", then the positive data passes the authentication. It can be understood that the above is only a theoretical analysis of the authentication process, and in the real authentication process, it is not transparent. It is equivalent to a black box process, and finally only the result that the positive data fails the authentication will be obtained.

[0072] S204: If the simulated authentication result indicates that both the positive data and the negative data pass the authentication, determine that the factor item to be verified is a factor item that does not affect the authentication of the target operation; if the simulated authentication result indicates that the positive data passes the authentication and the negative data fails the authentication, determine that the factor item to be verified is a factor item that affects the authentication of the target operation.

[0073] Although in the positive data, it can only be determined that among the multiple factor items it includes, only the factor item to be verified can pass the authentication, and it is not clear whether other factor items except the factor item to be verified can pass the authentication. If the positive data passes the authentication, it means that other factor items have also passed the authentication. If the positive data fails to pass the authentication, it can be obtained that the reason for the failure of this authentication has nothing to do with the factor item to be verified.

[0074] Similarly, in the negative data, it can only be determined that the factor item to be verified among the multiple factor items it includes cannot pass the authentication, and it is not clear whether other factor items except the factor item to be verified can pass the authentication. If the negative data passes the authentication, it means that the factor item to be verified is not used in this authentication. If the negative data fails to pass the authentication, it can be said that the reason for the failure of this authentication may be due to the factor item to be verified, and it is not certain whether other factor items also fail to pass.

[0075] Based on this, the results obtained from the two authentications can be combined to comprehensively determine whether the factor item to be verified is a factor item that affects the authentication for the target operation. Specifically, if the positive data passes the authentication, it means that other factor items will not cause the authentication to fail. In this case, if the negative data passes the authentication, it means that the factor item to be verified does not affect the authentication for the target operation; if the negative data fails to pass the authentication, it means that the factor item to be verified affects the authentication for the target operation.

[0076] As a possible implementation, in the related art, since it is impossible to identify which factor items will affect the authentication result during the authentication process, as the number of sub-strategies for the same operation increases, the authentication strategy becomes more and more complex, and the following problems may occur:

[0077] (1) The complexity of the authentication strategy is relatively high. For example, the implementation and management of ABAC may require defining and maintaining a large number of attributes and strategies, which requires a lot of time and resources. (2) It is difficult to audit. For example, as the authentication strategy for the same operation becomes more and more complex, it is relatively difficult to determine whether an account has no permission to a certain resource at all, and it is also impossible to know which attributes determine whether it has permission to this resource. (3) The authentication strategy may be set by multiple management users, which may lead to the increasing complexity of the authentication strategy for the same operation, and thus conflicts may occur between sub-strategies. For example, in ABAC, there may be a situation where multiple strategies are applicable to the same access request at the same time, which may lead to policy conflicts. Solving this conflict may require additional policies or rules, further increasing the complexity.

[0078] Based on this, the embodiments of the present application can identify the useless factor items in the authentication strategy. Specifically, if the factor items corresponding to multiple standard factor data include the same factor item as the factor item to be verified, and it is determined that the factor item to be verified is a factor item that does not affect the target operation, it means that the standard factor data corresponding to the factor item to be verified in the authentication strategy for the target operation is invalid data.

[0079] For example, the authentication policy is that only employees in the data security group can update Table B under the office network (sub-policy 1) or employees in the data security group can update Table B (sub-policy 2). The authentication policy in this example can be abstracted as (factor item x and factor item y) or factor item x, where factor item x is the organizational structure and factor item y is the network attribute. In fact, factor item y is invalid, that is, no matter what the standard factor data corresponding to the network attribute is, it will not affect the authentication result, that is, the standard data is invalid data.

[0080] Therefore, after identifying that the factor item to be verified does not affect the authentication for the target operation, the standard factor data corresponding to the factor item to be verified can be deleted from the authentication policy for the target operation, realizing the recycling of the discarded factor item. Moreover, through the method of the embodiments of the present application, each factor item can be used as the factor item to be verified, so as to find the invalid factor item and implement cleaning. Thereby reducing the complexity of the authentication policy for the target operation, and further reducing the complexity of auditing the authentication policy and the probability of conflicts between sub-policies. In addition, when a certain factor item needs to be taken offline, that is, the factor item is no longer used in the system to obtain the authentication policy, the method provided by the embodiments of the present application can be used to use the factor item to be taken offline as the factor item to be verified, so as to obtain the impact on the computer system after the factor item is taken offline.

[0081] As can be seen from the above technical solution, the factor item to be verified, the authentication policy corresponding to the target operation, and multiple object factor data related to the object identifier included in the authentication request are obtained. Among them, the authentication policy includes multiple standard factor data corresponding to when the target operation passes authentication. If the multiple object factor data is consistent with the multiple standard factor data, the target operation from the object identifier can pass authentication. If it is determined whether the factor item to be verified affects the authentication process of the target operation, data for authentication needs to be constructed. Specifically, by the method of controlling variables, other factor data is controlled to remain unchanged, and only the factor data corresponding to the factor item to be verified is changed, so as to obtain positive data that will not fail authentication due to the factor item to be verified and negative data that will fail authentication due to the factor item to be verified during the theoretical authentication process. Since the authentication process is opaque, in order to exclude authentication failures caused by other factor data in the positive data and negative data, authentication is performed based on the positive data and negative data respectively. That is, if the simulated authentication result indicates that the positive data passes authentication, it means that other factor data in the positive data does not affect authentication either. Moreover, theoretically, the negative factor data will cause authentication to fail. If the simulated authentication result indicates that the negative data also passes authentication, it means that the factor item to be verified is not used in the authentication process, and thus it is determined that the factor item to be verified is a factor item that does not affect the authentication for the target operation. Similarly, in the case where the simulated authentication result indicates that the positive data passes authentication, if the negative data fails authentication, it is determined that the factor item to be verified is a factor item that affects the authentication for the target operation. Thus, through the logical relationship between the simulated authentication results obtained by multiple authentications respectively, it can be judged whether the authentication for the target operation is affected by the factor item to be verified under the combined action of multiple factor items, thereby making the authentication process transparent and improving the user experience.

[0082] The embodiments of the present application do not specifically limit the specific implementation manner of S203, that is, do not specifically limit the specific implementation manner of performing authentication on the positive data and negative data respectively according to multiple standard factor data to obtain the simulated authentication result. The following takes two ways as examples to illustrate respectively.

[0083] Way 1: Authenticate the positive data first, and then authenticate the negative data.

[0084] Step A1: According to multiple standard factor data, authenticate the positive data to obtain the first simulated authentication result.

[0085] The simulated authentication result includes the first simulated authentication result and the second simulated authentication result. The first simulated authentication result is the authentication result obtained by authenticating based on the positive data, and the second simulated authentication result is the authentication result obtained by authenticating based on the negative data.

[0086] Step A2: If the first simulated authentication result indicates that the positive data fails the authentication, it is determined that the first simulated authentication result is not relevant to the factor item to be verified, and the current authentication process ends.

[0087] If the first simulated authentication result indicates that the positive data fails the authentication, but theoretically the factor item to be verified should pass the authentication. Therefore, the reason for the failure of this authentication is affected by other factor items rather than the factor item to be verified. Thus, it is determined that the first simulated authentication result is not relevant to the factor item to be verified. Since other factor items have caused the failure of this authentication, the relationship between the factor item to be verified and the simulated authentication result cannot be determined either, and the current authentication process can be ended, thereby reducing the pressure on the simulated authentication process.

[0088] Step A3: If the first simulated authentication result indicates that the positive data passes the authentication, the negative data is authenticated based on multiple standard factor data to obtain a second simulated authentication result.

[0089] Although the authentication process is a black-box process, if the first simulated authentication result indicates that the positive data passes the authentication, it means that other factor items except the factor item to be verified can ensure the success of authentication, which is equivalent to opening the black box. At this time, the negative data can be authenticated based on multiple standard factor data to obtain a second simulated authentication result.

[0090] Step A4: If the second simulated authentication result indicates that the negative data fails the authentication, it is determined that the factor item to be verified is the factor item affecting the authentication for the target operation.

[0091] Since it can be obtained from the first authentication result that other factor items can pass the authentication, and compared with the positive data, the factor data corresponding to other factor items in the negative data has not changed. If the second simulated authentication result indicates that the negative data fails the authentication, it means that the factor data corresponding to the factor item to be verified has caused the failure of this authentication, then it is determined that the factor item to be verified is the factor item affecting the authentication for the target operation.

[0092] Step A5: If the second simulated authentication result indicates that the negative data passes the authentication, it is determined that the factor item to be verified is the factor item that does not affect the authentication for the target operation.

[0093] Since it can be obtained from the first authentication result that other factor items can pass the authentication, and compared with the positive data, the factor data corresponding to other factor items in the negative data has not changed. The authentication will still pass, but theoretically the factor item to be verified will cause the authentication to fail. If the second simulated authentication result indicates that the negative data passes the authentication, it means that the factor item to be verified has not affected the authentication, then it is determined that the factor item to be verified is the factor item that does not affect the authentication for the target operation.

[0094] Taking ABAC as an example, the above authentication process can be abstracted into the following mathematical expression:

[0095] Y = F(f(a), f(b), f(c), f(d), f(x),...), determine whether f(x) can affect the value of Y.

[0096] Among them, Y is the simulated authentication result, f(a), f(b), f(c), and f(d) respectively correspond to a sub-strategy, which together constitute the authentication strategy. The sub-strategy includes an attribute item (i.e., a factor item) and the attribute value (i.e., factor data) corresponding to the attribute item. The logical relationship between sub-strategies can be logical AND, logical OR, etc.

[0097] The problem-solving process can be abstracted as follows:

[0098] Let f(x) = true. If Y == false, it means that f(x) cannot affect the value of Y; if Y == true, then let f(x) = false again. If Y == true at this time, it means that the positive and negative values of f(x) are irrelevant to the value of Y, and f(x) cannot affect the value of Y; if Y == false at this time, it means that the value of Y changes with the change of f(x), and f(x) can affect the value of Y.

[0099] Method 2: Authenticate the negative data first, and then authenticate the positive data.

[0100] Step B1: Authenticate the negative data according to multiple standard factor data to obtain the second simulated authentication result.

[0101] Step B2: If the second simulated authentication result indicates that the negative data passes the authentication, it is determined that the second simulated authentication result is not relevant to the factor item to be verified and the current authentication process ends.

[0102] Theoretically, the factor item to be verified in the negative data will cause the failure of this authentication. If the second simulated authentication result indicates that the negative data passes the authentication, it means that the factor item to be verified does not affect the authentication. Then it is determined that the second simulated authentication result is not relevant to the factor item to be verified, and the current authentication process ends.

[0103] Step B3: If the second simulated authentication result indicates that the negative data fails to pass the authentication, authenticate the positive data according to multiple standard factor data to obtain the first simulated authentication result.

[0104] If the second simulated authentication result indicates that the negative data fails to pass the authentication, it only means that the second simulated authentication result may be affected by the factor to be verified. It is also necessary to determine whether the current authentication result is caused by other factor items. Therefore, authenticate the positive data according to multiple standard factor data to obtain the first simulated authentication result.

[0105] Step B4: If the first simulated authentication result indicates that the positive data passes the authentication, determine that the factor item to be verified is the factor item affecting the authentication for the target operation.

[0106] If the first simulated authentication result indicates that the positive data passes the authentication, it means that other factor items will not cause the authentication to fail. Therefore, the authentication failure indicated by the second simulated authentication result is indeed caused by the factor item to be verified. Then determine that the factor item to be verified is the factor item affecting the authentication for the target operation.

[0107] Step B5: If the first simulated authentication result indicates that the positive data fails the authentication, it is impossible to determine whether the factor item to be verified is the factor item affecting the authentication for the target operation.

[0108] If the first simulated authentication result indicates that the positive data fails the authentication, it means that other factor items will also cause the authentication to fail. Then the two authentication failures may be caused by other factor items or by the factor item to be verified. At this time, it is impossible to determine whether the factor item to be verified is the factor item affecting the authentication for the target operation.

[0109] Thus, by performing two authentications successively and combining the simulated authentication results obtained from the two authentications, it is not only possible to determine whether the factor item to be verified is the factor item affecting the authentication for the target operation, but also possible to quickly end the authentication process and reduce the authentication pressure when it is determined that the simulated authentication result has nothing to do with the factor item to be verified, that is, the current object factor data is not suitable for determining whether the factor item to be verified is the factor item affecting the authentication for the target operation.

[0110] As a possible implementation, the embodiments of the present application provide two factor items to be verified. First: The factor item to be verified can be only a single factor item. For example, the factor item to be verified can be the organizational structure or the network attribute. Second: The factor item to be verified can also include a combination of multiple factor items. Each factor item in the combination is a sub-factor item to be verified. At this time, the factor item to be verified includes multiple sub-factor items to be verified and the logical relationship between the multiple sub-factor items to be verified. For example, the factor item to be verified can be the organizational structure and the network attribute, that is, the logical relationship between the organizational structure and the network attribute is logical AND.

[0111] Thus, if multiple factor items are respectively used as the factor items to be verified, it is determined whether each factor item is a factor item affecting the authentication of the target operation. Compared with the first type of factor item to be verified, the second type of factor item to be verified can achieve faster verification for each factor item to be verified, improving the determination speed. In addition, using the second type of factor item to be verified can be applicable to more complex application scenarios, such as the situation where the authentication result is affected only when multiple factor items are combined. For example, in a scenario where the authentication policy is relatively complex, the logical relationship between the factor items corresponding to multiple standard factor data included in the authentication policy is relatively complex. If it is desired to determine which one or which of the factor items corresponding to the standard factor data in the authentication policy affect the authentication result, the second type of factor item to be verified can be used.

[0112] The following uses the example where the factor item to be verified includes a first sub-factor item to be verified and a second sub-factor item to be verified for illustration.

[0113] Case 1: The factor item to be verified includes a first sub-factor item to be verified and a second sub-factor item to be verified, and the logical relationship between the first sub-factor item to be verified and the second sub-factor item to be verified is logical OR.

[0114] Abstracted as a mathematical expression, the above method can be expressed as a OR b. Where a is the first sub-factor item to be verified and b is the second sub-factor item to be verified.

[0115] Correspondingly, if the factor item to be verified is made to pass the authentication, then the first sub-factor item to be verified passes the authentication or the second sub-factor item to be verified passes the authentication. At this time, the positive factor data can be the following several types:

[0116] (1) The factor data corresponding to the first sub-factor item to be verified passing the authentication and the factor data corresponding to the second sub-factor item to be verified passing the authentication. Abstracting the factor items included in the positive factor data as a mathematical expression is a = 1, b = 1.

[0117] (2) The factor data corresponding to the first sub-factor item to be verified passing the authentication and the factor data corresponding to the second sub-factor item to be verified not passing the authentication. Abstracting the factor items included in the positive factor data as a mathematical expression is a = 1, b = 0.

[0118] (3) The factor data corresponding to the first sub-factor item to be verified not passing the authentication and the factor data corresponding to the second sub-factor item to be verified passing the authentication. Abstracting the factor items included in the positive factor data as a mathematical expression is a = 0, b = 1.

[0119] If the factor item to be verified fails the authentication, then the first sub-factor item to be verified fails the authentication and the second sub-factor item to be verified fails the authentication. At this time, the negative factor data includes the factor data corresponding to the first sub-factor item to be verified failing the authentication and the factor data corresponding to the second sub-factor item to be verified failing the authentication. The factor items included in the negative factor data are abstracted into a mathematical expression as a = 0, b = 0.

[0120] Case 2: If the factor item to be verified includes a first sub-factor item to be verified and a second sub-factor item to be verified, and the logical relationship between the first sub-factor item to be verified and the second sub-factor item to be verified is logical AND.

[0121] The above method can be abstracted into a mathematical expression as a AND b. Where a is the first sub-factor item to be verified and b is the second sub-factor item to be verified.

[0122] Correspondingly, if the factor item to be verified passes the authentication, then the first sub-factor item to be verified passes the authentication and the second sub-factor item to be verified passes the authentication. At this time, the positive factor data includes the factor data corresponding to the first sub-factor item to be verified passing the authentication and the factor data corresponding to the second sub-factor item to be verified passing the authentication. The factor items included in the positive factor data are abstracted into a mathematical expression as a = 1, b = 1.

[0123] If the factor item to be verified fails the authentication, then the first sub-factor item to be verified fails the authentication or the second sub-factor item to be verified fails the authentication. At this time, the negative factor data can be the following several types:

[0124] (1) The factor data corresponding to the first sub-factor item to be verified passing the authentication and the factor data corresponding to the second sub-factor item to be verified failing the authentication. The factor items included in the negative factor data are abstracted into a mathematical expression as a = 1, b = 0.

[0125] (2) The factor data corresponding to the first sub-factor item to be verified failing the authentication and the factor data corresponding to the second sub-factor item to be verified failing the authentication. The factor items included in the negative factor data are abstracted into a mathematical expression as a = 0, b = 0.

[0126] (3) The factor data corresponding to the first sub-factor item to be verified failing the authentication and the factor data corresponding to the second sub-factor item to be verified passing the authentication. The factor items included in the negative factor data are abstracted into a mathematical expression as a = 0, b = 1.

[0127] As a possible implementation method, not only can various authentication requests for the target operation be collected in advance, and then the method for determining the factor items affecting authentication provided in the embodiments of the present application be executed offline, that is, the simulation authentication and the real authentication are operated separately. It is also possible to perform the simulation authentication while performing the online simulation authentication operation. The following will be described separately.

[0128] Method 1: Simulated authentication and real authentication are executed separately.

[0129] See Figure 3 , which is a schematic diagram of an offline simulated authentication provided by an embodiment of this application. In Figure 3 , for the authentication request of the target operation, the authentication policy corresponding to the target operation and multiple object factor data related to the object identifier included in the authentication request have been obtained in advance.

[0130] A user who wants to determine whether the factor item to be verified is a factor item affecting the authentication for the target operation can first determine the factor item to be verified, such as whether approval is required. Then perform simulated authentication. During the simulated authentication, let the factor item to be verified pass the authentication to obtain positive factor data, and let the factor item to be verified fail the authentication to obtain negative factor data. For multiple object factor data from one object identifier, positive data is obtained based on the positive factor data and the multiple object factor data, and negative data is obtained based on the negative factor data and the multiple object factor data. Authenticate the positive data according to multiple standard factor data to obtain a first simulated authentication result, and authenticate the negative data according to multiple standard factor data to obtain a second simulated authentication result. The simulated authentication result includes the first simulated authentication result and the second simulated authentication result. Finally, determine whether the factor item to be verified is a factor item affecting the authentication for the target operation based on the simulated authentication result.

[0131] Specifically, if the simulated authentication result indicates that both the positive data and the negative data pass the authentication, it is determined that the factor item to be verified is not a factor item affecting the authentication for the target operation; if the simulated authentication result indicates that the positive data passes the authentication and the negative data fails the authentication, it is determined that the factor item to be verified is a factor item affecting the authentication for the target operation.

[0132] Method 2: Simulated authentication and real authentication are executed simultaneously.

[0133] Step C1: In response to obtaining an authentication request for a target operation, obtain the authentication policy according to the target operation, and obtain multiple object factor data related to the object identifier according to the object identifier included in the authentication request.

[0134] Step C2: Obtain the factor item to be verified.

[0135] The embodiments of the present application do not specifically limit the acquisition method of the factors to be verified. For example, it can be a preset factor to be verified, such as taking the factor items that are prone to authentication failure as the factors to be verified. Another example is to obtain the factors to be verified from the factor items corresponding to multiple standard factor data. One factor item can be arbitrarily selected from the factor items corresponding to multiple standard factor data as the factor to be verified. Each factor item corresponding to multiple standard factor data can also be used as the factor to be verified respectively, so as to verify whether each factor item is a factor affecting authentication.

[0136] Step C3: Let the factor to be verified pass authentication to obtain positive factor data, and obtain positive data based on the positive factor data and multiple object factor data; let the factor to be verified fail authentication to obtain negative factor data, and obtain negative data based on the negative factor data and multiple object factor data.

[0137] Step C4: Authenticate the positive data and the negative data respectively according to multiple standard factor data to obtain simulated authentication results.

[0138] Step C5: If the simulated authentication results indicate that both the positive data and the negative data pass authentication, it is determined that the factor to be verified is a factor that does not affect the authentication for the target operation; if the simulated authentication results indicate that the positive data passes authentication and the negative data fails authentication, it is determined that the factor to be verified is a factor that affects the authentication for the target operation.

[0139] Step C6: Authenticate the multiple object factor data according to multiple standard factor data to obtain the real authentication result.

[0140] The real authentication result is the result obtained through Step C6, that is, the authentication result obtained by authenticating based on the object factor data.

[0141] It should be noted that Step C6 can be executed after obtaining the authentication request for the target operation, without having to wait until the simulated authentication is completed, that is, Step C6 can be executed after Step C5 is completed.

[0142] As a possible implementation, in order to reduce the number of simulated authentications, after the real authentication result indicates that multiple object factor data fail authentication, the steps of obtaining the preset factors to be verified and subsequent steps can be executed, that is, Step C6 is executed after Step C5. Thus, after the real authentication result indicates that multiple object factor data fail authentication, the simulated authentication is performed to analyze the reasons for the real authentication failure for the operating user, so as to reduce the number of simulated authentications and the pressure of the simulated authentication process without affecting the user's clear understanding of the failure reasons.

[0143] Step C7: Send the real authentication result.

[0144] The embodiments of the present application do not specifically limit whether to send the simulated authentication result to the operating user. The following will be described by taking three methods as examples respectively.

[0145] (1) It is possible to send only the real authentication result to the operating user.

[0146] (2) It is also possible to send both the real authentication result and the result of whether the factor item to be verified determined in step C5 is a factor item affecting the authentication of the target operation to the operating user.

[0147] (3) It is also possible to send both the real authentication result and the result obtained in step C5 to the operating user only after the real authentication result fails. Specifically, if the real authentication result indicates that multiple object factor data fail the authentication, and it is determined that the factor item to be verified is a factor item affecting the authentication of the target operation, a response result to the authentication request is sent to the operating user. The response result includes the real authentication result and the reason for the authentication failure, that is, the authentication fails due to the factor item to be verified. Thus, the operating user can clearly know the reason for the failure of this real authentication, improving the user experience.

[0148] Therefore, during the real authentication process, the simulated authentication process is implemented, so that it is possible to determine that the factor item to be verified is a factor item affecting the authentication of the target operation without affecting the user authentication process, and there is no need to store a large amount of data, reducing the storage pressure.

[0149] See Figure 4 , which is a schematic diagram of an online simulated authentication provided by the embodiments of the present application. In Figure 4 , after the operating user executes the target operation, an authentication request for the target operation is generated. In response to obtaining the authentication request for the target operation, the authentication policy is obtained according to the target operation, and multiple object factor data are obtained according to the object identifier included in the authentication request. Then, the real authentication and the simulated authentication are performed, which will be described separately below.

[0150] The real authentication process is to authenticate the multiple object factor data according to multiple standard factor data to obtain the real authentication result. The real authentication result is either authentication passed or authentication failed, and thus it is first sent to the authentication result adapter.

[0151] The simulated authentication process will be described by taking the example of authenticating the positive data first and then the negative data. Authenticate the positive data according to multiple standard factor data to obtain the first simulated authentication result. If the first simulated authentication result indicates that the positive data fails the authentication, it is determined that the first simulated authentication result is not relevant to the factor item to be verified and the current authentication process is ended, and the conclusion that the first simulated authentication result is not relevant to the factor item to be verified is sent to the authentication result adapter.

[0152] If the first simulated authentication result indicates that the positive data passes the authentication, then authenticate the negative data based on multiple standard factor data to obtain a second simulated authentication result. If the second simulated authentication result indicates that the negative data fails the authentication, then determine that the factor item to be verified is the factor item that affects the authentication for the target operation; if the second simulated authentication result indicates that the negative data passes the authentication, then determine that the factor item to be verified is the factor item that does not affect the authentication for the target operation. And send the conclusion of whether the factor item to be verified is the factor item that does not affect the authentication for the target operation to the authentication result adapter.

[0153] Based on the real authentication result and the conclusion obtained from the simulated authentication, the authentication result adapter generates a response result, such as authentication failure, and the reason for the authentication failure is caused by the factor item to be verified. Another example is that the authentication is successful. Finally, send the response result to the user.

[0154] Thus, by controlling the positive and negative data of the factor item to be verified during the authentication process, performing multiple simulated authentications, and based on the logical relationship between the simulated authentication results, it is determined whether the user's real authentication result is directly affected by the factor item to be verified under the combined action of multiple factor items, so as to find out which factor item can directly affect the user's authentication result, and then solve the problems of the opacity of authentication and the inability to recycle discarded attribute variables.

[0155] To facilitate further understanding of the technical solution provided by the embodiments of the present application, the following takes user a (ordinary employee) in the platform data security group of the organizational structure performing an update operation on table t in the office network as an example, and wants to know whether the authentication result of user a's current operation is related to the factor item of "requiring approval from the superior", and continues to give an overall exemplary introduction to the Figure 4 method through three embodiments.

[0156] At this time, the target operation is to perform an update operation on table t, the multiple object factor data are respectively the data security group, ordinary employee, and office network, and the factor item to be verified is that approval from the superior is required.

[0157] Embodiment 1:

[0158] The authentication policy corresponding to the target operation includes sub-policy 1 and sub-policy 2.

[0159] Sub-policy 1, for the organizational structure attribute: To perform an update operation on table t, the user's organizational structure needs to be in the platform and content business group, technology and content platform, or data security group.

[0160] Sub-policy 2, for the network attribute: To perform an update operation on table t, it needs to be under the office network.

[0161] The first step is to obtain the authentication policy corresponding to the target operation and multiple object factor data.

[0162] In the second step, construct the positive data required for simulated authentication, that is, let the authentication that needs to pass the superior approval pass, obtain the positive factor data (that is, the superior approval has passed), and obtain the positive data according to the positive factor data and multiple object factor data.

[0163] In the third step, authenticate the positive data according to multiple standard factor data to obtain the first simulated authentication result.

[0164] In the fourth step, since user a meets the organizational structure in the Platform and Content Business Group, Technology and Content Platform, or Data Security Group, and meets the requirement that the execution of the update operation on table t needs to be under the office network, that is, meets sub-policy 1 and sub-policy 2, the first authentication result is that the authentication passes.

[0165] In the fifth step, construct the negative data required for simulated authentication, that is, let the authentication that needs to pass the superior approval fail the authentication, obtain the negative factor data (that is, the superior approval has not passed), and obtain the negative data according to the negative factor data and multiple object factor data.

[0166] In the sixth step, authenticate the negative data according to multiple standard factor data to obtain the second simulated authentication result.

[0167] In the seventh step, if the second simulated authentication result is that the authentication passes, it means that regardless of whether user a has passed the approval, the simulated authentication can pass.

[0168] In the eighth step, determine that the factor item of needing to pass the superior approval is a factor item that does not affect the authentication for the target operation.

[0169] Example 2:

[0170] The authentication policy corresponding to the target operation includes sub-policy 1, sub-policy 2, and sub-policy 3.

[0171] Sub-policy 1, for the organizational structure attribute: When performing an update operation on table t, the user's organizational structure needs to be in the Platform and Content Business Group, Technology and Content Platform, or Data Security Group.

[0172] Sub-policy 2, for the network attribute: When performing an update operation on table t, it needs to be under the office network.

[0173] Sub-policy 3, for the employee rank attribute: If an ordinary employee performs an update operation on table t, it needs to pass the superior approval.

[0174] In the first step, obtain the authentication policy corresponding to the target operation and multiple object factor data.

[0175] In the second step, construct the positive data required for simulated authentication, that is, let the authentication that needs to pass the superior approval pass, obtain the positive factor data (that is, the superior approval has passed), and obtain the positive data according to the positive factor data and multiple object factor data.

[0176] In the third step, authenticate the positive data based on multiple standard factor data to obtain the first simulated authentication result.

[0177] In the fourth step, since user a meets the organizational structure in the Platform and Content Business Group, Technology and Content Platform, or Data Security Group, and meets the requirement that the execution of the update operation for Table t needs to be under the office network, and user a is an ordinary employee, that is, meets Sub - policy 1, Sub - policy 2, and Sub - policy 3, the first authentication result is that the authentication is passed.

[0178] In the fifth step, construct the negative data required for simulated authentication, that is, make the authentication not pass by requiring approval from a superior, to obtain negative factor data (that is, not approved by a superior). Based on the negative factor data and multiple object factor data, obtain the negative data.

[0179] In the sixth step, authenticate the negative data based on multiple standard factor data to obtain the second simulated authentication result.

[0180] In the seventh step, since the approval from a superior has not been passed, the second simulated authentication result is that the authentication is not passed.

[0181] In the eighth step, determine that the factor item of requiring approval from a superior is the factor item affecting the authentication for the target operation.

[0182] Embodiment 3:

[0183] The authentication policy corresponding to the target operation includes Sub - policy 1, Sub - policy 2, and Sub - policy 3.

[0184] Sub - policy 1, for the organizational structure attribute: When performing the update operation for Table t, the organizational structure of the user needs to be in the Platform and Content Business Group, Technology and Content Platform, or Data Security Group.

[0185] Sub - policy 2, for the network attribute: When performing the update operation for Table t, it needs to be under the office network.

[0186] Sub - policy 3, for the employee rank attribute: Only management can perform the update operation for Table t.

[0187] In the first step, obtain the authentication policy corresponding to the target operation and multiple object factor data.

[0188] In the second step, construct the positive data required for simulated authentication, that is, make the authentication pass by requiring approval from a superior, to obtain positive factor data (that is, approved by a superior). Based on the positive factor data and multiple object factor data, obtain the positive data.

[0189] In the third step, authenticate the positive data based on multiple standard factor data to obtain the first simulated authentication result.

[0190] In the fourth step, since user a is an ordinary employee and does not meet sub-policy 3, the first authentication result is failed authentication.

[0191] In the fifth step, it is determined that the first simulated authentication result is not relevant to the factor item of requiring approval by a superior, and the current authentication process is ended.

[0192] For the method for determining factor items affecting authentication described above, the present application also provides a corresponding device for determining factor items affecting authentication, so that the method for determining factor items affecting authentication can be applied and implemented in practice.

[0193] See Figure 5 , which is a schematic structural diagram of a device for determining factor items affecting authentication provided by an embodiment of the present application. As Figure 5 shown, the device 500 for determining factor items affecting authentication includes: an acquisition unit 501, a construction unit 502, a simulated authentication unit 503, and an analysis unit 504;

[0194] The acquisition unit 501 is configured to obtain, for an authentication request for a target operation, factor items to be verified, the authentication policy corresponding to the target operation, and a plurality of object factor data related to the object identifier included in the authentication request, where the authentication policy includes a plurality of standard factor data corresponding to when the target operation passes authentication;

[0195] The construction unit 502 is configured to make the factor items to be verified pass authentication to obtain positive factor data, and obtain positive data according to the positive factor data and the plurality of object factor data; make the factor items to be verified fail authentication to obtain negative factor data, and obtain negative data according to the negative factor data and the plurality of object factor data;

[0196] The simulated authentication unit 503 is configured to perform authentication on the positive data and the negative data respectively according to the plurality of standard factor data to obtain simulated authentication results;

[0197] The analysis unit 504 is configured to, if the simulated authentication results indicate that both the positive data and the negative data pass authentication, determine that the factor items to be verified are factor items that do not affect the authentication for the target operation; if the simulated authentication results indicate that the positive data passes authentication and the negative data fails authentication, determine that the factor items to be verified are factor items that affect the authentication for the target operation.

[0198] As can be seen from the above technical solution, the factor item determination device for authentication includes: an acquisition unit, a construction unit, a simulated authentication unit, and an analysis unit. The acquisition unit acquires the factor items to be verified, the authentication policy corresponding to the target operation, and multiple object factor data related to the object identifier included in the authentication request. Among them, the authentication policy includes multiple standard factor data corresponding to the case where the target operation passes authentication. If the multiple object factor data is consistent with the multiple standard factor data, the target operation from the object identifier can pass authentication. If it is necessary to determine whether the factor item to be verified affects the authentication process of the target operation, data for authentication needs to be constructed. Specifically, the construction unit controls the other factor data to remain unchanged by the method of controlling variables, and only changes the factor data corresponding to the factor item to be verified, so as to obtain the positive data that will not fail authentication due to the factor item to be verified and the negative data that will fail authentication due to the factor item to be verified in the theoretical authentication process. Since the authentication process is opaque, in order to exclude the authentication failures caused by other factor data in the positive data and negative data, the simulated authentication unit performs authentication based on the positive data and negative data respectively for the analysis unit to analyze. That is, if the simulated authentication result indicates that the positive data passes authentication, it means that the other factor data in the positive data does not affect authentication either. Moreover, the negative factor data theoretically should cause authentication to fail. If the simulated authentication result indicates that the negative data also passes authentication, it means that the factor item to be verified is not used in the authentication process, thereby determining that the factor item to be verified is a factor item that does not affect the authentication for the target operation. Similarly, in the case where the simulated authentication result indicates that the positive data passes authentication, if the negative data fails authentication, it is determined that the factor item to be verified is a factor item that affects the authentication for the target operation. Thus, through the logical relationship between the simulated authentication results obtained by multiple authentications respectively, it is possible to determine whether the authentication for the target operation is affected by the factor item to be verified under the combined action of multiple factor items, thereby making the authentication process transparent and improving the user experience.

[0199] As a possible implementation manner, the simulated authentication result includes a first simulated authentication result and a second simulated authentication result. The simulated authentication unit 503 is specifically configured to:

[0200] Authenticate the positive data according to the multiple standard factor data to obtain the first simulated authentication result;

[0201] If the first simulated authentication result indicates that the positive data fails authentication, determine that the first simulated authentication result is not relevant to the factor item to be verified and end the current authentication process;

[0202] If the first simulated authentication result indicates that the positive data passes authentication, authenticate the negative data according to the multiple standard factor data to obtain the second simulated authentication result;

[0203] If the second simulated authentication result indicates that the negative data fails the authentication, determine that the factor item to be verified is a factor item affecting the authentication for the target operation;

[0204] If the second simulated authentication result indicates that the negative data passes the authentication, determine that the factor item to be verified is a factor item not affecting the authentication for the target operation.

[0205] As a possible implementation, the simulated authentication result includes a first simulated authentication result and a second simulated authentication result. The simulation authentication unit 503 is specifically configured to:

[0206] Authenticate the negative data according to multiple pieces of the standard factor data to obtain the second simulated authentication result;

[0207] If the second simulated authentication result indicates that the negative data passes the authentication, determine that the second simulated authentication result is not relevant to the factor item to be verified and end the current authentication process;

[0208] If the second simulated authentication result indicates that the negative data fails the authentication, authenticate the positive data according to multiple pieces of the standard factor data to obtain the first simulated authentication result;

[0209] If the first simulated authentication result indicates that the positive data passes the authentication, determine that the factor item to be verified is a factor item affecting the authentication for the target operation;

[0210] If the first simulated authentication result indicates that the positive data fails the authentication, it is impossible to determine whether the factor item to be verified is a factor item affecting the authentication for the target operation.

[0211] As a possible implementation, the factor item to be verified includes multiple sub-factor items to be verified and the logical relationship between the multiple sub-factor items to be verified.

[0212] As a possible implementation, if the factor item to be verified includes a first sub-factor item to be verified and a second sub-factor item to be verified, and the logical relationship between the first sub-factor item to be verified and the second sub-factor item to be verified is logical OR, the construction unit 502 is specifically configured to:

[0213] Make the first sub-factor item to be verified pass the authentication or the second sub-factor item to be verified pass the authentication to obtain the positive factor data;

[0214] Make the first sub-factor item to be verified fail the authentication and the second sub-factor item to be verified fail the authentication to obtain the negative factor data.

[0215] As a possible implementation, if the factor item to be verified includes a first sub-factor item to be verified and a second sub-factor item to be verified, and the logical relationship between the first sub-factor item to be verified and the second sub-factor item to be verified is logical AND, the construction unit 502 is specifically configured to:

[0216] Authorize the first sub-factor item to be verified and authorize the second sub-factor item to be verified to obtain the positive factor data;

[0217] Authorize the first sub-factor item to be verified not to pass or authorize the second sub-factor item to be verified not to pass to obtain the negative factor data.

[0218] As a possible implementation, the obtaining unit 501 is specifically configured to:

[0219] In response to obtaining an authentication request for the target operation, obtain an authentication policy according to the target operation, and obtain a plurality of object factor data related to the object identifier according to the object identifier included in the authentication request;

[0220] Obtain the factor item to be verified preset, or obtain the factor item to be verified from the factor items corresponding to the plurality of standard factor data respectively;

[0221] The factor item determination device 500 for influencing authentication further includes: a real authentication unit and a sending unit;

[0222] The real authentication unit is configured to authenticate the plurality of object factor data according to the plurality of standard factor data to obtain a real authentication result;

[0223] The sending unit is configured to send the real authentication result.

[0224] As a possible implementation, the sending unit is specifically configured to:

[0225] If the real authentication result indicates that the plurality of object factor data fails to pass authentication, and it is determined that the factor item to be verified is a factor item affecting the authentication of the target operation, send a response result for the authentication request, where the response result includes the real authentication result and a reason for authentication failure, and the reason for authentication failure is that the authentication fails due to the factor item to be verified.

[0226] As a possible implementation, the obtaining unit 501 is specifically configured to obtain the factor item to be verified if the real authentication result indicates that the plurality of object factor data fails to pass authentication.

[0227] As a possible implementation, if the data of the multiple object factor data is n, where n is a positive integer, the building unit 502 is specifically configured to:

[0228] If the factor item to be verified is different from the factor items respectively corresponding to the n object factor data, then according to the object factor data respectively corresponding to the n factor items and the positive factor data corresponding to the factor item to be verified, the positive data is obtained, and the positive data includes the factor data respectively corresponding to n + 1 factor items;

[0229] If the factor item to be verified is the same as the first target factor item among the factor items respectively corresponding to the n object factor data, then the object factor data corresponding to the first target factor item is replaced with the positive factor data to obtain the positive data, and the positive data includes the factor data respectively corresponding to n factor items;

[0230] If the factor item to be verified is different from the factor items respectively corresponding to the n object factor data, then according to the object factor data respectively corresponding to the n factor items and the negative factor data corresponding to the factor item to be verified, the negative data is obtained, and the negative data includes the factor data respectively corresponding to n + 1 factor items;

[0231] If the factor item to be verified is the same as the second target factor item among the factor items respectively corresponding to the n object factor data, then the object factor data corresponding to the second target factor item is replaced with the negative factor data to obtain the negative data, and the negative data includes the factor data respectively corresponding to n factor items.

[0232] As a possible implementation, the factor item determination device 500 for influencing authentication further includes: a deletion unit, configured to, if it is determined that the factor item to be verified is a factor item that does not affect the authentication for the target operation, and the factor items respectively corresponding to the multiple standard factor data include the factor item to be verified, then delete the standard factor data corresponding to the factor item to be verified from the authentication policy.

[0233] The embodiments of the present application further provide a computer device, which can be a server or a terminal device. Hereinafter, the computer device provided by the embodiments of the present application will be introduced from the perspective of hardware implementation. Among them, Figure 6 The structure diagram of the server is shown, Figure 7 The structure diagram of the terminal device is shown.

[0234] See Figure 6, This figure is a schematic diagram of a server structure provided by an embodiment of the present application. The server 1400 may vary significantly due to configuration or performance differences, and may include one or more processors 1422, such as Central Processing Units (CPUs), a memory 1432, and a storage medium 1430 (e.g., one or more mass storage devices) for storing one or more application programs 1442 or data 1444. Among them, the memory 1432 and the storage medium 1430 may be transient storage or persistent storage. The program stored in the storage medium 1430 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Further, the processor 1422 may be configured to communicate with the storage medium 1430 and execute a series of instruction operations in the storage medium 1430 on the server 1400.

[0235] The server 1400 may further include one or more power supplies 1426, one or more wired or wireless network interfaces 1450, one or more input / output interfaces 1458, and / or one or more operating systems 1441, such as Windows Server TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM and so on.

[0236] The steps performed by the server in the above embodiments may be based on the Figure 6 server structure shown.

[0237] Among them, the CPU 1422 is used to perform the following steps:

[0238] For an authentication request for a target operation, obtain the factors to be verified, the authentication policy corresponding to the target operation, and a plurality of object factor data related to the object identifier included in the authentication request. The authentication policy includes a plurality of standard factor data corresponding to when the target operation passes authentication;

[0239] Let the factors to be verified pass authentication to obtain positive factor data, and obtain positive data based on the positive factor data and the plurality of object factor data; let the factors to be verified fail authentication to obtain negative factor data, and obtain negative data based on the negative factor data and the plurality of object factor data;

[0240] Authenticate the positive data and the negative data respectively according to the plurality of standard factor data to obtain a simulated authentication result;

[0241] If the simulated authentication result indicates that both the positive data and the negative data pass the authentication, determine that the factor item to be verified is a factor item that does not affect the authentication for the target operation; if the simulated authentication result indicates that the positive data passes the authentication and the negative data fails the authentication, determine that the factor item to be verified is a factor item that affects the authentication for the target operation.

[0242] Optionally, the CPU 1422 may also execute the method steps of any specific implementation manner of the method for determining the factor item affecting authentication in the embodiments of the present application.

[0243] See Figure 7 , which is a schematic structural diagram of a terminal device provided in an embodiment of the present application. Taking this terminal device as a smart phone as an example for illustration, Figure 7 The block diagram shows a partial structure of the smart phone. The smart phone includes: a Radio Frequency (RF) circuit 1510, a memory 1520, an input unit 1530, a display unit 1540, a sensor 1550, an audio circuit 1560, a Wireless Fidelity (WiFi) module 1570, a processor 1580, and a power supply 1590 and other components. Those skilled in the art can understand that Figure 7 the structure of the smart phone shown in

[0244] does not limit the smart phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange different components. Figure 7 The following specifically introduces each component of the smart phone:

[0245] The RF circuit 1510 can be used to receive and send information or signals during a call. Specifically, after receiving the downlink information of the base station, it is given to the processor 1580 for processing; in addition, the designed uplink data is sent to the base station.

[0246] The memory 1520 can be used to store software programs and modules. The processor 1580 realizes various functional applications and data processing of the smart phone by running the software programs and modules stored in the memory 1520.

[0247] The input unit 1530 can be used to receive input digital or character information and generate key signal inputs related to the user settings and function controls of the smart phone. Specifically, the input unit 1530 can include a touch panel 1531 and other input devices 1532. The touch panel 1531, also known as a touch screen, can collect touch operations of the user thereon or nearby and drive corresponding connection devices according to a preset program. In addition to the touch panel 1531, the input unit 1530 can also include other input devices 1532. Specifically, the other input devices 1532 can include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, etc.

[0248] The display unit 1540 can be used to display information input by the user or information provided to the user and various menus of the smart phone. The display unit 1540 can include a display panel 1541. Optionally, the display panel 1541 can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc.

[0249] The smart phone can also include at least one sensor 1550, such as a light sensor, a motion sensor, and other sensors. As for other sensors that the smart phone can also be configured with, such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., they will not be elaborated here.

[0250] The audio circuit 1560, the speaker 1561, and the microphone 1562 can provide an audio interface between the user and the smart phone. The audio circuit 1560 can transmit the electrical signal converted from the received audio data to the speaker 1561, and the speaker 1561 converts it into a sound signal for output; on the other hand, the microphone 1562 converts the collected sound signal into an electrical signal, which is received by the audio circuit 1560 and converted into audio data. After the audio data is output to the processor 1580 for processing, it is sent through the RF circuit 1510 to, for example, another smart phone, or the audio data is output to the memory 1520 for further processing.

[0251] The processor 1580 is the control center of the smart phone. It connects various parts of the entire smart phone using various interfaces and lines. By running or executing software programs and / or modules stored in the memory 1520, and by calling data stored in the memory 1520, it executes various functions of the smart phone and processes data. Optionally, the processor 158 can include one or more processing units.

[0252] The smart phone further includes a power source 1590 (such as a battery) for supplying power to each component. Preferably, the power source can be logically connected to the processor 1580 through a power management system, so as to manage functions such as charging, discharging, and power consumption management through the power management system.

[0253] Although not shown, the smart phone may further include a camera, a Bluetooth module, etc., which will not be elaborated herein.

[0254] In the embodiment of the present application, the memory 1520 included in the smart phone can store a computer program and transmit the computer program to the processor.

[0255] The processor 1580 included in the smart phone can execute the method for determining the influencing authentication factor items provided in the above embodiment according to the instructions in the computer program.

[0256] The embodiment of the present application further provides a computer-readable storage medium for storing a computer program, and the computer program is used to execute the method for determining the influencing authentication factor items provided in the above embodiment.

[0257] The embodiment of the present application further provides a computer program product or a computer program. The computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method for determining the influencing authentication factor items provided in various optional implementation manners of the above aspects.

[0258] Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions. The foregoing program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above method embodiment; and the foregoing storage medium can be at least one of the following media: read-only memory (English: Read-Only Memory, abbreviation: ROM), RAM, magnetic disk, or optical disk, etc., which can store computer programs.

[0259] In the embodiment of the present application, the term "module" or "unit" refers to a computer program with a predetermined function or a part of a computer program, which works together with other related parts to achieve a predetermined goal, and can be fully or partially implemented by using software, hardware (such as a processing circuit or a memory), or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of the overall module or unit including the functions of the module or unit.

[0260] It should be noted that the embodiments in this specification are all described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other, and the key points of each embodiment are the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and reference can be made to the corresponding parts of the method embodiments for the relevant content. The device and system embodiments described above are only illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative work.

[0261] As described above, it is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present application should be covered by the protection scope of the present application. On the basis of the implementation manners provided in the above aspects, the present application can be further combined to provide more implementation manners. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for determining a factor item affecting authentication, characterized in that The method includes: For an authentication request for a target operation, obtaining items of factors to be verified, an authentication policy corresponding to the target operation, and a plurality of object factor data related to an object identifier included in the authentication request, where the authentication policy includes a plurality of standard factor data corresponding to when the target operation passes authentication; Making the items of factors to be verified pass authentication to obtain positive factor data, and obtaining positive data according to the positive factor data and the plurality of object factor data; making the items of factors to be verified not pass authentication to obtain negative factor data, and obtaining negative data according to the negative factor data and the plurality of object factor data; Authenticating the positive data and the negative data respectively according to the plurality of standard factor data to obtain a simulated authentication result; If the simulated authentication result indicates that both the positive data and the negative data pass authentication, determining that the items of factors to be verified are factors that do not affect the authentication for the target operation; if the simulated authentication result indicates that the positive data passes authentication and the negative data does not pass authentication, determining that the items of factors to be verified are factors that affect the authentication for the target operation.

2. The method according to claim 1, wherein The simulated authentication result includes a first simulated authentication result and a second simulated authentication result. The authenticating the positive data and the negative data respectively according to the plurality of standard factor data to obtain a simulated authentication result includes: Authenticating the positive data according to the plurality of standard factor data to obtain the first simulated authentication result; If the first simulated authentication result indicates that the positive data does not pass authentication, determining that the first simulated authentication result is not relevant to the items of factors to be verified and ending the current authentication process; If the first simulated authentication result indicates that the positive data passes authentication, authenticating the negative data according to the plurality of standard factor data to obtain the second simulated authentication result; If the second simulated authentication result indicates that the negative data does not pass authentication, determining that the items of factors to be verified are factors that affect the authentication for the target operation; If the second simulated authentication result indicates that the negative data passes authentication, determining that the items of factors to be verified are factors that do not affect the authentication for the target operation.

3. The method according to claim 1, characterized in that The simulated authentication result includes a first simulated authentication result and a second simulated authentication result. The authenticating the positive data and the negative data respectively according to the plurality of standard factor data to obtain a simulated authentication result includes: Authenticating the negative data according to the plurality of standard factor data to obtain the second simulated authentication result; If the second simulated authentication result indicates that the negative data passes authentication, determining that the second simulated authentication result is not relevant to the items of factors to be verified and ending the current authentication process; If the second simulated authentication result indicates that the negative data does not pass authentication, authenticating the positive data according to the plurality of standard factor data to obtain the first simulated authentication result; If the first simulated authentication result indicates that the positive data passes the authentication, determine that the factor item to be verified is a factor item that affects the authentication for the target operation; If the first simulated authentication result indicates that the positive data fails the authentication, it is impossible to determine whether the factor item to be verified is a factor item that affects the authentication for the target operation.

4. The method according to claim 1, characterized in that, The factor item to be verified includes a plurality of sub-factor items to be verified and the logical relationship between the plurality of sub-factor items to be verified.

5. The method according to claim 4, wherein If the factor item to be verified includes a first sub-factor item to be verified and a second sub-factor item to be verified, and the logical relationship between the first sub-factor item to be verified and the second sub-factor item to be verified is logical OR, then pass the authentication of the factor item to be verified to obtain positive factor data, including: Pass the authentication of the first sub-factor item to be verified or pass the authentication of the second sub-factor item to be verified to obtain the positive factor data; The step of making the factor item to be verified fail the authentication to obtain negative factor data includes: Make the first sub-factor item to be verified fail the authentication and the second sub-factor item to be verified fail the authentication to obtain the negative factor data.

6. The method according to claim 4, characterized in that If the factor item to be verified includes a first sub-factor item to be verified and a second sub-factor item to be verified, and the logical relationship between the first sub-factor item to be verified and the second sub-factor item to be verified is logical AND, then pass the authentication of the factor item to be verified to obtain positive factor data, including: Make the first sub-factor item to be verified pass the authentication and the second sub-factor item to be verified pass the authentication to obtain the positive factor data; The step of making the factor item to be verified fail the authentication to obtain negative factor data includes: Make the first sub-factor item to be verified fail the authentication or the second sub-factor item to be verified fail the authentication to obtain the negative factor data.

7. The method according to claim 1, wherein For the authentication request for the target operation, obtain the factor item to be verified, the authentication policy corresponding to the target operation, and a plurality of object factor data related to the object identifier included in the authentication request, including: In response to obtaining the authentication request for the target operation, obtain the authentication policy according to the target operation, and obtain a plurality of object factor data related to the object identifier according to the object identifier included in the authentication request; Obtain the preset factor item to be verified, or obtain the factor item to be verified from the factor items corresponding to the plurality of standard factor data respectively; The method further includes: Authenticate the plurality of object factor data according to the plurality of standard factor data to obtain a real authentication result; Send the real authentication result.

8. The method according to claim 7, wherein The step of sending the real authentication result includes: If the real authentication result indicates that the plurality of object factor data fails the authentication, and it is determined that the factor item to be verified is a factor item that affects the authentication for the target operation, send a response result for the authentication request, where the response result includes the real authentication result and the reason for authentication failure, and the reason for authentication failure is that the authentication fails due to the factor item to be verified.

9. The method according to claim 8, characterized in that The step of obtaining the factor item to be verified includes: If the real authentication result indicates that multiple pieces of the object factor data fail the authentication, then execute the step of obtaining the factor item to be verified and subsequent steps.

10. The method according to claim 1, characterized in that, If there are n pieces of the object factor data, where n is a positive integer, then obtaining the positive data according to the positive factor data and the multiple pieces of the object factor data includes: If the factor item corresponding to the factor item to be verified is different from each of the factor items corresponding to the n pieces of the object factor data, then obtain the positive data according to the object factor data corresponding to each of the n factor items and the positive factor data corresponding to the factor item to be verified, where the positive data includes the factor data corresponding to n + 1 factor items; If the factor item corresponding to the factor item to be verified is the same as the first target factor item among the factor items corresponding to the n pieces of the object factor data, then replace the object factor data corresponding to the first target factor item with the positive factor data to obtain the positive data, where the positive data includes the factor data corresponding to n factor items; Obtaining the negative data according to the negative factor data and the multiple pieces of the object factor data includes: If the factor item corresponding to the factor item to be verified is different from each of the factor items corresponding to the n pieces of the object factor data, then obtain the negative data according to the object factor data corresponding to each of the n factor items and the negative factor data corresponding to the factor item to be verified, where the negative data includes the factor data corresponding to n + 1 factor items; If the factor item corresponding to the factor item to be verified is the same as the second target factor item among the factor items corresponding to the n pieces of the object factor data, then replace the object factor data corresponding to the second target factor item with the negative factor data to obtain the negative data, where the negative data includes the factor data corresponding to n factor items.

11. The method according to any one of claims 1 to 10, characterized in that, The method further includes: If it is determined that the factor item to be verified is a factor item that does not affect the authentication for the target operation, and the factor items corresponding to the multiple pieces of the standard factor data include the factor item to be verified, then delete the standard factor data corresponding to the factor item to be verified from the authentication policy.

12. An apparatus for determining a factor item affecting authentication, characterized in that, The apparatus includes: an acquisition unit, a construction unit, a simulation authentication unit, and an analysis unit; The acquisition unit is configured to, for an authentication request for a target operation, obtain a factor item to be verified, the authentication policy corresponding to the target operation, and multiple pieces of object factor data related to the object identifier included in the authentication request, where the authentication policy includes multiple pieces of standard factor data when the target operation passes the authentication; The construction unit is configured to make the factor item to be verified pass the authentication to obtain positive factor data, and obtain positive data according to the positive factor data and the multiple pieces of object factor data; make the factor item to be verified fail the authentication to obtain negative factor data, and obtain negative data according to the negative factor data and the multiple pieces of object factor data; The simulation authentication unit is configured to perform authentication on the positive data and the negative data respectively according to the multiple pieces of standard factor data to obtain a simulation authentication result; The analysis unit is configured to, if the simulation authentication result indicates that both the positive data and the negative data pass the authentication, determine that the factor item to be verified is a factor item that does not affect the authentication for the target operation; if the simulation authentication result indicates that the positive data passes the authentication and the negative data does not pass the authentication, determine that the factor item to be verified is a factor item that affects the authentication for the target operation.

13. A computer device, characterized in that, The computer device includes a processor and a memory: The memory is configured to store a computer program and transmit the computer program to the processor; The processor is configured to execute the method according to any one of claims 1-11 based on the computer program.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium is configured to store a computer program, and the computer program is configured to execute the method according to any one of claims 1-11.

15. A computer program product comprising a computer program, characterized in that, When it runs on a computer device, it causes the computer device to execute the method according to any one of claims 1-11.

Images