Authentication method and device, communication equipment and storage medium

Abstract

The embodiment of the invention provides an authentication method and device, communication equipment and a storage medium, and the method applied to first equipment comprises the steps: obtaining first feature information of a first access behavior under the condition that a first access request of second equipment is received, the first access row comprises a behavior of calling the second service by the first service indicated by the first access request; according to the first feature information and predetermined security policy information, determining whether the first access behavior is abnormal, the security policy information being used for indicating feature information of mutual calling between different services; and under the condition that the first access behavior is abnormal, first indication information is sent to the second equipment, and the first indication information is used for indicating identity authentication of the second equipment. Therefore, according to the embodiment of the invention, the problem that in the prior art, a visitor needs to carry out authentication and authorization once in one request in a zero-trust architecture, so that the pressure of an authentication system is too large can be solved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an authentication method, apparatus, communication equipment and storage medium. Background Art

[0002] The software industry is increasingly prioritizing security. A "connect first, authenticate later" approach can be used to verify user identities at the network edge and determine whether they are trustworthy. However, if authentication at the network edge is breached, this approach could leave back-end services vulnerable to security threats. Therefore, to further enhance security, the Zero Trust architecture is being widely adopted.

[0003] Zero Trust Architecture (ZTA) is a modern network security model whose core concept is "Never Trust, Always Verify." It abandons the traditional network security assumption of "intranet is secure, extranet is dangerous" and instead considers all users, devices, applications, and traffic (whether internal or external) to be untrustworthy. Each resource access must undergo strict identity authentication, permission control, and continuous monitoring.

[0004] It can be seen that in a zero-trust architecture, visitors are required to authenticate and authorize every request, which will put too much pressure on the authentication system. Summary of the Invention

[0005] The embodiments of the present application provide an authentication method, apparatus, communication device, and storage medium to solve the problem in the prior art that, in a zero-trust architecture, visitors are required to perform authentication and authorization once for each request, thereby placing excessive pressure on the authentication system.

[0006] In a first aspect, an embodiment of the present application provides an authentication method, applied to a first device, the method comprising:

[0007] Upon receiving a first access request from a second device, obtaining first feature information of a first access behavior, wherein the first access behavior includes an behavior of the first service calling the second service indicated by the first access request;

[0008] determining whether the first access behavior is abnormal based on the first characteristic information and predetermined security policy information, wherein the security policy information is used to indicate characteristic information of mutual calls between different services;

[0009] When there is an abnormality in the first access behavior, first indication information is sent to the second device, wherein the first indication information is used to instruct identity authentication of the second device.

[0010] In a second aspect, an embodiment of the present application further provides an authentication method, applied to a second device, the method comprising:

[0011] Sending a first access request to the first device;

[0012] receiving first indication information sent by the first device when there is an abnormality in the first access behavior, wherein the first access behavior includes an action of the first service indicating by the first access request calling the second service, and the first indication information is used to instruct identity authentication of the second device;

[0013] Interact with a third device so that the third device performs identity authentication on the second device.

[0014] In a third aspect, an embodiment of the present application provides an authentication method, applied to a third device, the method comprising:

[0015] interacting with a second device and performing identity authentication on the second device;

[0016] When the second device passes identity authentication, the encrypted authentication information is sent to the second device, and the second information is sent to the first device, so that after the first device receives the second access request sent by the second device for the first service to call the second service, the encrypted authentication information carried in the second access request is verified according to the second information, wherein the second information includes the authentication information or the encrypted authentication information.

[0017] In a fourth aspect, an embodiment of the present application provides an authentication apparatus, applied to a first device, the apparatus comprising:

[0018] a first acquiring module, configured to acquire, upon receiving a first access request from a second device, first characteristic information of a first access behavior, wherein the first access behavior includes an behavior of the first service calling the second service indicated by the first access request;

[0019] a determination module, configured to determine whether the first access behavior is abnormal based on the first characteristic information and predetermined security policy information, wherein the security policy information is used to indicate characteristic information of mutual calls between different services;

[0020] The first sending module is configured to send first indication information to the second device when there is an abnormality in the first access behavior, wherein the first indication information is used to instruct identity authentication of the second device.

[0021] In a fifth aspect, an embodiment of the present application provides an authentication apparatus, applied to a second device, the apparatus comprising:

[0022] A second sending module, configured to send a first access request to the first device;

[0023] a first receiving module, configured to receive first indication information sent by the first device when a first access behavior is abnormal, wherein the first access behavior includes an action of the first service calling a second service indicated by the first access request, and the first indication information is used to instruct identity authentication of the second device;

[0024] The first authentication module is configured to interact with a third device so that the third device performs identity authentication on the second device.

[0025] In a sixth aspect, an embodiment of the present application provides an authentication apparatus, applied to a third device, the apparatus comprising:

[0026] A second authentication module, configured to interact with a second device and perform identity authentication on the second device;

[0027] The third sending module is used to send encrypted authentication information to the second device and send second information to the first device when the second device passes identity authentication, so that after the first device receives the second access request sent by the second device for the first service to call the second service, the encrypted authentication information carried in the second access request is verified according to the second information, wherein the second information includes the authentication information or the encrypted authentication information.

[0028] In a seventh aspect, an embodiment of the present application provides a communication device, including a memory, a transceiver, and a processor:

[0029] A memory for storing a computer program; a transceiver for sending and receiving data under the control of the processor; a processor for reading the computer program in the memory and executing the authentication method described in the first aspect, or executing the authentication method described in the second aspect, or executing the authentication method described in the third aspect.

[0030] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the authentication method described in the first aspect above, or execute the authentication method described in the second aspect above, or execute the authentication method described in the third aspect above.

[0031] In the ninth aspect, an embodiment of the present application provides an authentication system, comprising a first device, a second device, and a third device, wherein the first device is used to execute the authentication method described in the first aspect, the second device is used to execute the authentication method described in the second aspect, and the third device is used to execute the authentication method described in the third aspect.

[0032] In an embodiment of the present application, when the first device receives a first access request from the second device, it obtains first characteristic information of the first access behavior, and then determines whether the first access behavior is abnormal based on the first characteristic information and predetermined security policy information. Then, if the first access behavior is abnormal, it sends first indication information to the second device to instruct identity authentication of the second device, wherein the first access line includes the behavior of the first service calling the second service indicated by the first access request, and the security policy information is used to indicate characteristic information of mutual calls between different services.

[0033] It can be seen that in the embodiment of the present application, the characteristic information of the mutual calls between different services can be determined in advance, so that when the first service calls the second service, it can be determined whether there is an abnormality in the behavior of the first service calling the second service based on the determined characteristic information of the mutual calls between different services and the first characteristic information of the first service calling the second service, and then identity authentication is performed only when there is an abnormality. It can be seen that in the embodiment of the present application, when the first service needs to call the second service, it can be identified whether there is an abnormality in the behavior of the first service calling the second service, so that identity authentication is performed only when there is an abnormality, instead of requiring identity authentication for every call between services. In this way, the system pressure can be relieved and the request time when services call each other can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0035] Figure 1 One of the flow charts of the authentication method provided in the embodiment of the present application;

[0036] Figure 2 The second flowchart of the authentication method provided in the embodiment of the present application;

[0037] Figure 3 Flowchart 3 of the authentication method provided in the embodiment of the present application;

[0038] Figure 4A schematic diagram of a system architecture applicable to the authentication method according to an embodiment of the present application;

[0039] Figure 5 A flowchart of a specific implementation of the authentication method of an embodiment of the present application;

[0040] Figure 6 This is one of the structural block diagrams of the authentication device provided in the embodiment of the present application;

[0041] Figure 7 This is the second structural block diagram of the authentication device provided in the embodiment of the present application;

[0042] Figure 8 This is the third structural block diagram of the authentication device provided in the embodiment of the present application;

[0043] Figure 9 This is a structural block diagram of the communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In the embodiments of this application, the term "and / or" describes the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0045] In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0046] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0047] The embodiments of the present application provide an authentication method, apparatus, communication device, and storage medium to solve the problem in the prior art that, in a zero-trust architecture, visitors are required to perform authentication and authorization once for each request, thereby placing excessive pressure on the authentication system.

[0048] Among them, the method and the device are based on the same application concept. Since the principles of solving problems by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0049] Figure 1 A flow chart of an authentication method provided in an embodiment of the present application is shown, which can be applied to a first device; wherein the first device can be a security gateway device corresponding to a second service that needs to be called by a second device.

[0050] like Figure 1 As shown, the method may include the following steps 101 to 103:

[0051] Step 101: upon receiving a first access request from a second device, obtaining first characteristic information of a first access behavior.

[0052] The first access row includes an action of the first service calling the second service indicated by the first access request.

[0053] In addition, the second device can be understood as the device corresponding to the first service, that is, the device providing the first service, and can also be understood as the access terminal device that needs to call the second service; the second device can be a terminal, server or other device.

[0054] Step 102: Determine whether the first access behavior is abnormal based on the first feature information and predetermined security policy information.

[0055] The security policy information is used to indicate characteristic information of calls between different services, which can also be understood as: security policy information is used to indicate characteristic information of normal behavior of calls between different services. Optionally, the security policy information can be extracted from logs of calls between different services.

[0056] In addition, the first characteristic information of the first access behavior (ie, the first characteristic information of the behavior of the first service calling the second service) is used to indicate characteristic information of the historical process of the first service calling the second service.

[0057] From this, it can be seen that in an embodiment of the present application, when the current first service needs to call the second service, the characteristic information of the historical process of the first service calling the second service and the characteristic information of the normal behavior of mutual calls between different services can be combined to analyze whether there is any abnormality in the current behavior of the first service calling the second service (i.e., the above-mentioned first access behavior), so that the second device can be authenticated when there is an abnormality.

[0058] Step 103: When there is an abnormality in the first access behavior, send first indication information to the second device.

[0059] The first indication information is used to instruct identity authentication of the second device.

[0060] In addition, after receiving the first indication information, the second device interacts with the third device to perform identity authentication on the second device.

[0061] In addition, the third device can be understood as a device used for identity authentication, such as a device serving as a security center.

[0062] It should be noted that an asymmetric encryption algorithm can be used to authenticate the second device; for example: after the second device receives the above-mentioned first indication information, it sends an identity authentication request to the third device; in response to the identity authentication request, the third device sends a first random number to the second device, so that the second device uses the private key to sign the first random number, obtains a first signature value, and sends the first signature value to the third device; after the third device receives the first signature value, it uses the public key corresponding to the above-mentioned private key to verify the first signature value, wherein the first signature value passes the verification (that is, the random number obtained by decrypting the first signature value using the public key is the same as the first random number), the second device passes the identity authentication; otherwise, if the first signature value fails the verification (that is, the random number obtained by decrypting the first signature value using the public key is different from the first random number), the second device fails the identity authentication.

[0063] Alternatively, a symmetric encryption algorithm may be used to authenticate the identity of the second device; for example, the first device and the third device each generate a random number and exchange them, and both parties encrypt the other party's random number with a shared key and transmit it back, thereby decrypting and verifying the returned value respectively. If both match, the two-way authentication is completed, and the second device passes the identity authentication; otherwise, if at least one party does not match, the two-way authentication fails, and the second device fails the identity authentication.

[0064] It is understandable that the specific process of the second device interacting with the third device and authenticating the second device is not limited to the content described here.

[0065] It can be seen from the above steps 101 to 103 that in an embodiment of the present application, when the first device receives the first access request from the second device, it obtains the first characteristic information of the first access behavior, and then determines whether there is an abnormality in the first access behavior based on the first characteristic information and the predetermined security policy information. Then, when there is an abnormality in the first access behavior, the first indication information is sent to the second device to instruct the identity authentication of the second device, wherein the first access line includes the behavior of the first service calling the second service indicated by the first access request, and the security policy information is used to indicate the characteristic information of mutual calls between different services.

[0066] It can be seen that in the embodiment of the present application, the characteristic information of the mutual calls between different services can be determined in advance, so that when the first service calls the second service, it can be determined whether there is an abnormality in the behavior of the first service calling the second service based on the determined characteristic information of the mutual calls between different services and the first characteristic information of the first service calling the second service, and then identity authentication is performed only when there is an abnormality. It can be seen that in the embodiment of the present application, when the first service needs to call the second service, it can be identified whether there is an abnormality in the behavior of the first service calling the second service, so that identity authentication is performed only when there is an abnormality, instead of requiring identity authentication for every call between services. In this way, the system pressure can be relieved and the request time when services call each other can be reduced.

[0067] In some embodiments of the present application, the first feature information includes at least one of the following items A-1 to A-5:

[0068] Item A-1: first time information when the first device receives the first access request; the first time information may include at least one of a date and a time point (i.e., a moment, such as X hour, Y minute, and Z second); the first time information may also be understood as a timestamp when the first device receives the first access request;

[0069] Item A-2: historical frequency of the first service calling the second service; wherein the historical frequency can be understood as the frequency of the first service calling the second service within a historical time period, and the historical time period can be a time period corresponding to a predetermined duration;

[0070] Item A-3: first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service;

[0071] Item A-4: Interface information for providing the second service; wherein the interface information for providing the second service may include IP, port identifier, and interface identifier.

[0072] Item A-5: Identification information of the first service, wherein the identification information of the first service may include IP, port identifier, service name of the first service, and ID of the first service.

[0073] In some embodiments of the present application, the security policy information includes at least one of the following items B-1 to B-3:

[0074] Item B-1: Valid time information for mutual calls between different services;

[0075] Among them, a time interval can be determined based on the effective time information. For example, a time interval can be determined based on the effective time information of service A calling service B (that is, the effective time interval for service A to call service B). Then, the behavior of service A calling service B within this time interval is normal, otherwise it is abnormal behavior.

[0076] Optionally, the valid time information may include a duration, and the valid time interval for service A to call service B refers to the time interval starting from the last time the device corresponding to service A passed identity authentication and lasting for the duration.

[0077] Alternatively, optionally, the valid time information includes a start time and an end time, and the valid time interval for service A to call service B refers to: the time interval corresponding to the start time and the end time.

[0078] Item B-2: Frequency range of calls between different services;

[0079] For example, if the historical frequency of service A calling service B is within the frequency range of service A calling service B, then the behavior of service A calling service B is normal behavior; otherwise, if the historical frequency of service A calling service B is not within the frequency range of service A calling service B, then the behavior of service A calling service B is abnormal behavior.

[0080] Item B-3: The first correspondence between the request target information and the request source information, wherein the request target information is used to indicate the interface information of the called service, and the request source information is used to indicate the identification information of the service that needs to call other services.

[0081] It should be noted that the request target information is used to indicate the interface information of the called service, and the request source information is used to indicate the service that needs to call other services. The first correspondence between the request target information and the request source information can be used to indicate the calling relationship between the various services. For example, based on the calling relationship, it is known that service A and service B do not have a calling relationship, then the behavior of service A calling service B is an abnormal behavior.

[0082] In some embodiments of the present application, determining whether the first access behavior is abnormal based on the first feature information and predetermined security policy information includes:

[0083] If at least one of the following C-1 to C-4 is met, it is determined that the first access behavior is abnormal:

[0084] Item C-1: the security policy information includes first valid time information for the first service to call the second service, and the time indicated by the first time information is not within the time interval determined according to the first valid time information;

[0085] It can be seen from item C-1 that if the security policy information indicates the valid time interval for the first service to call the second service, then if the time indicated by the first time information of the current first service calling the second service is not within the time interval, it means that the current call is invalid, that is, the current behavior of the first service calling the second service (that is, the first access behavior) is abnormal.

[0086] Item C-2: The security policy information includes a first frequency range for the first service to call the second service, and the historical frequency of the first service calling the second service is not within the first frequency range;

[0087] As can be seen from item C-2, if the security policy information indicates a frequency range for a first service to call a second service, then if the frequency of the first service calling the second service currently is not within that frequency range, the current call is invalid, meaning that the first service's current behavior of calling the second service (i.e., the first access behavior) is abnormal. For example, if the security policy information indicates that it is normal for the first service to call the second service 10 times per minute, but the frequency of the first service calling the second service currently reaches 20 times per minute, then the first service's current behavior of calling the second service is considered abnormal.

[0088] Item C-3: The first information does not conform to the predetermined specifications;

[0089] It should be noted that if the first information carried in the first access request does not comply with the predetermined specifications, it means that there is information in the first information that does not comply with the specifications (for example, the first information includes characters that do not comply with the specifications). In this way, the behavior of the first service indicating that the first information does not comply with the specifications calling the second service is an abnormal behavior.

[0090] Item C-4: In the first correspondence, there is no correspondence between the interface information providing the second service and the identification information of the first service.

[0091] Among them, if there is no correspondence between the interface information providing the second service and the identification information of the first service in the first correspondence, it means that there is no calling relationship between the first service and the second service, and the current behavior of the first service calling the second service is abnormal.

[0092] In some embodiments of the present application, the method further includes the following steps D-1 to D-4:

[0093] Step D-1: Receiving second information sent by the third device when the second device passes identity authentication, wherein the second information includes authentication information or encrypted authentication information;

[0094] Step D-2: receiving a second access request from the second device for the first service to invoke the second service, wherein the second access request carries the encrypted authentication information;

[0095] Step D-3: Verifying the encrypted authentication information carried in the second access request according to the second information;

[0096] Step D-4: When the encrypted authentication information carried in the second access request passes verification, second indication information is sent to the device providing the second service, wherein the second indication information is used to instruct the second device to provide the second service.

[0097] It's important to note that in encrypted communications, authentication information is critical data used to verify the authenticity of both communicating parties, ensure the trustworthiness of data sources, and protect information integrity. It serves as the core mechanism for achieving both identity authentication and data integrity in encrypted communications, and is often used in conjunction with encryption technologies to ensure communication security.

[0098] It can be seen from steps D-1 to D-4 that when the second device passes the identity authentication, the third device can send encrypted authentication information to the second device and send authentication information or encrypted authentication information to the first device. In this way, after the second device receives the encrypted authentication information, it can send a second access request for the first service to call the second service to the first device (that is, resend an access request), wherein the second access request carries the encrypted authentication information. In this way, after the first device receives the second access request, it can verify the encrypted authentication information carried in the second access request based on the authentication information or encrypted authentication information it previously received, and then, after the verification is passed, notify the second service provider to provide the second service to the second device, thereby realizing the first service calling the second service.

[0099] It should be noted that in the above step D-3, when the first device verifies the encrypted authentication information carried in the second access request based on the second information, it is necessary to use the decryption key and decryption strategy corresponding to the process of encrypting the authentication information (that is, how to use the decryption key for decryption). The decryption key and decryption strategy can be pre-agreed or sent to the first device by a third device.

[0100] In addition, the first device uses the decryption key and decryption strategy to verify the encrypted authentication information carried in the second access request based on the second information. The specific process depends on the specific decryption strategy. For example, the decryption key may include an asymmetric encryption key (i.e., a private key and a public key), a symmetric encryption key, a national secret, a summary key, a signature key, etc. Accordingly, the decryption strategy may adopt an asymmetric encryption algorithm, a symmetric encryption algorithm, and other algorithms.

[0101] For example, when the decryption strategy adopts an asymmetric encryption algorithm, the encrypted authentication information carried in the second access request can be encrypted with a private key. In this case, the third device can send the public key and unencrypted authentication information to the first device. The first device can then use the public key to decrypt the encrypted authentication information carried in the second access request, and then compare the decrypted information with the authentication information sent by the third device to the first device. If the two are consistent, it means that the authentication information carried in the second access request has passed the verification.

[0102] It is understood that the specific process of the above step D-3 is not limited to that described here.

[0103] It should also be noted that the private key and public key used in the process of verifying the encrypted authentication information carried in the second access request may be the same as or different from the private key and public key used when authenticating the second device.

[0104] In some embodiments of the present application, the authentication information includes at least one of the following items A-1 to A-5:

[0105] Item A-1: first time information at which the first device receives the first access request;

[0106] Item A-2: the historical frequency of the first service calling the second service;

[0107] Item A-3: first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service;

[0108] Item A-4: providing interface information for the second service;

[0109] Item A-5: Identification information of the first service.

[0110] That is, it can be understood that: the authentication information includes the first characteristic information of the first access behavior.

[0111] Among them, when the authentication information includes at least one of the above items A-1 to A-5, the corresponding feature information will be different each time different services are called, and the authentication information will be different, thereby increasing communication security.

[0112] In some embodiments of the present application, the method further includes:

[0113] Sending a request to the third device to call the security policy information;

[0114] Receive the security policy information sent by the third device.

[0115] Therefore, it can be seen that the security policy information based on which the first device determines whether the first access behavior is abnormal can be called by the first device from the third device.

[0116] It is understandable that the security policy information may also be stored in the first device.

[0117] In which, when the security policy information is stored in the first device, the third device interacts with the second device to authenticate the second device, and after the verification is passed, the third device can also send third indication information to the first device to indicate that the second device has passed the authentication, so that the first device can update the security policy information according to the first feature information.

[0118] In addition, if the security policy information is stored in a third device, the third device may update the security policy information according to the first feature information.

[0119] It should be noted that, when security policy information is stored on a third device, at least a portion of the first characteristic information used by the third device to update the security policy information can be obtained through log analysis. If only a portion of the first characteristic information is obtained through log analysis, the remaining portion of the first characteristic information can be sent from the first device to the third device. Alternatively, the third device can directly send the first characteristic information to the first device without obtaining it through log analysis.

[0120] In addition, the first characteristic information is used to indicate the characteristic information of the historical process of the first service calling the second service, and can represent the actual situation of the first service calling the second service. Updating the security policy information based on the first characteristic information can make the security policy information change with the actual calling situation between the services, that is, the security policy information can change with the changes in the business, making the security policy information more usable.

[0121] See also Figure 2 , an embodiment of the present application provides an authentication method, which can be applied to a second device, wherein the second device can be understood as a device corresponding to the first service, that is, a device that provides the first service, and can also be understood as an access terminal device that needs to call the second service; the second device can be a terminal, server, or other device.

[0122] like Figure 2 As shown, the method may include the following steps 201 to 203:

[0123] Step 201: Send a first access request to a first device.

[0124] Step 202: Receive first indication information sent by the first device when there is an abnormality in the first access behavior.

[0125] The first access behavior includes an behavior in which the first service indicated by the first access request calls the second service, and the first indication information is used to instruct identity authentication of the second device.

[0126] In addition, after receiving the first access request, the first device can obtain the first characteristic information of the first access behavior, and thereby determine whether the first access behavior is abnormal based on the first characteristic information and predetermined security policy information; the security policy information is used to indicate the characteristic information of mutual calls between different services.

[0127] It is understandable that the specific process of the first device determining whether the first access behavior is abnormal based on the first feature information and the predetermined security policy information can be found in the above description and will not be repeated here.

[0128] In addition, the first device may be a security gateway device corresponding to the second service that the second device needs to call.

[0129] Step 203: interact with a third device so that the third device performs identity authentication on the second device.

[0130] The third device may be understood as a device used for identity authentication, such as a device serving as a security center.

[0131] It should be noted that an asymmetric encryption algorithm can be used to authenticate the second device; for example: after the second device receives the above-mentioned first indication information, it sends an identity authentication request to the third device; in response to the identity authentication request, the third device sends a first random number to the second device, so that the second device uses the private key to sign the first random number, obtains a first signature value, and sends the first signature value to the third device; after the third device receives the first signature value, it uses the public key corresponding to the above-mentioned private key to verify the first signature value, wherein the first signature value passes the verification (that is, the random number obtained by decrypting the first signature value using the public key is the same as the first random number), the second device passes the identity authentication; otherwise, if the first signature value fails the verification (that is, the random number obtained by decrypting the first signature value using the public key is different from the first random number), the second device fails the identity authentication.

[0132] Alternatively, a symmetric encryption algorithm may be used to authenticate the identity of the second device; for example, the first device and the third device each generate a random number and exchange them, and both parties encrypt the other party's random number with a shared key and transmit it back, thereby decrypting and verifying the returned value respectively. If both match, the two-way authentication is completed, and the second device passes the identity authentication; otherwise, if at least one party does not match, the two-way authentication fails, and the second device fails the identity authentication.

[0133] It is understandable that the specific process of the second device interacting with the third device and authenticating the second device is not limited to the content described here.

[0134] It can be seen from the above steps 201 to 203 that in an embodiment of the present application, the second device can send a first access request to the first device, so that the first device obtains the first characteristic information of the first access behavior, and determines whether there is an abnormality in the first access behavior based on the first characteristic information and the security policy information, and then sends the first indication information to the second device in the event of an abnormality. In this way, the second device can interact with the third device so that the third device can authenticate the second device; wherein, the first access line includes the behavior of the first service calling the second service indicated by the first access request, and the security policy information is used to indicate the characteristic information of mutual calls between different services.

[0135] It can be seen that in the embodiment of the present application, the characteristic information of the mutual calls between different services can be determined in advance, so that when the first service calls the second service, it can be determined whether there is an abnormality in the behavior of the first service calling the second service based on the determined characteristic information of the mutual calls between different services and the first characteristic information of the first service calling the second service, and then identity authentication is performed only when there is an abnormality. It can be seen that in the embodiment of the present application, when the first service needs to call the second service, it can be identified whether there is an abnormality in the behavior of the first service calling the second service, so that identity authentication is performed only when there is an abnormality, instead of requiring identity authentication for every call between services. In this way, the system pressure can be relieved and the request time when services call each other can be reduced.

[0136] In some embodiments of the present application, the method further includes the following steps E-1 to E-2:

[0137] Step E-1: When the second device passes identity authentication, receive encrypted authentication information sent by the third device;

[0138] Step E-2: Send a second access request for the first service to call the second service to the first device, so that the first device verifies the encrypted authentication information carried in the second access request, and after the verification is passed, sends a second indication information to the device providing the second service, wherein the second indication information is used to indicate the provision of the second service to the second device.

[0139] It can be seen from steps E-1 to E-2 that when the second device passes the identity authentication, the third device can send encrypted authentication information to the second device and send authentication information or encrypted authentication information to the first device. In this way, after the second device receives the encrypted authentication information, it can send a second access request for the first service to call the second service to the first device (that is, resend an access request), wherein the second access request carries the encrypted authentication information. In this way, after the first device receives the second access request, it can verify the encrypted authentication information carried in the second access request based on the authentication information or encrypted authentication information it previously received, and then, after the verification is passed, notify the second service provider to provide the second service to the first device, thereby realizing the first service calling the second service.

[0140] It should be noted that, in the process of the first device verifying the encrypted authentication information carried in the second access request based on the second information, it is necessary to use the decryption key and decryption strategy corresponding to the process of encrypting the authentication information (that is, how to use the decryption key for decryption). The decryption key and decryption strategy can be pre-agreed or sent to the first device by a third device.

[0141] In addition, the first device uses the decryption key and decryption strategy to verify the encrypted authentication information carried in the second access request based on the second information. The specific process depends on the specific decryption strategy. For example, the decryption key may include an asymmetric encryption key (i.e., a private key and a public key), a symmetric encryption key, a national secret, a summary key, a signature key, etc. Accordingly, the decryption strategy may adopt an asymmetric encryption algorithm, a symmetric encryption algorithm, and other algorithms.

[0142] For example, when the decryption strategy adopts an asymmetric encryption algorithm, the encrypted authentication information carried in the second access request can be encrypted with a private key. In this case, the third device can send the public key and unencrypted authentication information to the first device. The first device can then use the public key to decrypt the encrypted authentication information carried in the second access request, and then compare the decrypted information with the authentication information sent by the third device to the first device. If the two are consistent, it means that the authentication information carried in the second access request has passed the verification.

[0143] It is understandable that the specific process of the first device verifying the encrypted authentication information carried in the second access request according to the second information is not limited to that described herein.

[0144] It should also be noted that the private key and public key used in the process of verifying the encrypted authentication information carried in the second access request may be the same as or different from the private key and public key used when authenticating the second device.

[0145] In some embodiments of the present application, the authentication information includes at least one of the following items A-1 to A-5:

[0146] Item A-1: first time information at which the first device receives the first access request;

[0147] Item A-2: the historical frequency of the first service calling the second service;

[0148] Item A-3: first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service;

[0149] Item A-4: providing interface information for the second service;

[0150] Item A-5: Identification information of the first service.

[0151] That is, it can be understood that: the authentication information includes the first characteristic information of the first access behavior.

[0152] Among them, when the authentication information includes at least one of the above items A-1 to A-5, the corresponding feature information will be different each time different services are called, and the authentication information will be different, thereby increasing communication security.

[0153] See also Figure 3 , an embodiment of the present application provides an authentication method, which can be applied to a third device, wherein the third device can be understood as a device for identity authentication, such as a device serving as a security center.

[0154] like Figure 3 As shown, the method may include the following steps 301 to 302:

[0155] Step 301: interact with a second device and perform identity authentication on the second device.

[0156] Among them, the second device can send a first access request to the first device so that the first device can obtain the first characteristic information of the first access behavior, and thus determine whether the first access behavior is abnormal based on the first characteristic information and the predetermined security policy information; and then, if there is an abnormality in the first access behavior, a first indication information can be sent to the second device to instruct the second device to authenticate the identity, so that the second device can interact with the third device to authenticate the second device; wherein, the security policy information is used to indicate the characteristic information of mutual calls between different services; wherein, the first access line includes the behavior of the first service calling the second service indicated by the first access request.

[0157] In addition, the second device can be understood as the device corresponding to the first service, that is, the device providing the first service, or the access terminal device that needs to call the second service; the second device can be a terminal, server, etc. The first device can be the security gateway device corresponding to the second service that the second device needs to call.

[0158] Step 302: When the second device passes identity authentication, encrypted authentication information is sent to the second device, and second information is sent to the first device, so that after the first device receives the second access request sent by the second device for the first service to call the second service, the encrypted authentication information carried in the second access request is verified according to the second information, wherein the second information includes the authentication information or the encrypted authentication information.

[0159] It can be seen from step 302 that when the second device passes the identity authentication, the third device can send encrypted authentication information to the second device, and send authentication information or encrypted authentication information to the first device. In this way, after the second device receives the encrypted authentication information, it can send a second access request for the first service to call the second service to the first device (that is, resend an access request), wherein the second access request carries the encrypted authentication information. In this way, after the first device receives the second access request, it can verify the encrypted authentication information carried in the second access request based on the authentication information or encrypted authentication information it previously received, and then, after the verification is passed, notify the second service provider to provide the second service to the first device, thereby realizing the first service calling the second service.

[0160] It should be noted that, in the process of the first device verifying the encrypted authentication information carried in the second access request based on the second information, it is necessary to use the decryption key and decryption strategy corresponding to the process of encrypting the authentication information (that is, how to use the decryption key for decryption). The decryption key and decryption strategy can be pre-agreed or sent to the first device by a third device.

[0161] In addition, the first device uses the decryption key and decryption strategy to verify the encrypted authentication information carried in the second access request based on the second information. The specific process depends on the specific decryption strategy. For example, the decryption key may include an asymmetric encryption key (i.e., a private key and a public key), a symmetric encryption key, a national secret, a summary key, a signature key, etc. Accordingly, the decryption strategy may adopt an asymmetric encryption algorithm, a symmetric encryption algorithm, and other algorithms.

[0162] For example, when the decryption strategy adopts an asymmetric encryption algorithm, the encrypted authentication information carried in the second access request can be encrypted with a private key. In this case, the third device can send the public key and unencrypted authentication information to the first device. The first device can then use the public key to decrypt the encrypted authentication information carried in the second access request, and then compare the decrypted information with the authentication information sent by the third device to the first device. If the two are consistent, it means that the authentication information carried in the second access request has passed the verification.

[0163] It is understandable that the specific process of the first device verifying the encrypted authentication information carried in the second access request according to the second information is not limited to that described herein.

[0164] It should also be noted that the private key and public key used in the process of verifying the encrypted authentication information carried in the second access request may be the same as or different from the private key and public key used when authenticating the second device.

[0165] In some embodiments of the present application, the third device further stores security policy information, where the security policy information is used to indicate feature information of mutual calls between different services;

[0166] Before interacting with the second device and authenticating the second device, the method further includes the following steps F-1 to F-2:

[0167] Step F-1: receiving a request for invoking the security policy information sent by the first device;

[0168] Step F-2: In response to the call request, providing the security policy information to the first device, so that the first device determines whether the first access behavior is abnormal based on the security policy information and the first feature information;

[0169] The first access behavior includes an action of a first service calling a second service indicated by a first access request received by the first device; and the first characteristic information includes characteristic information of the first access behavior.

[0170] Therefore, it can be seen that the security policy information based on which the first device determines whether the first access behavior is abnormal can be called by the first device from the third device.

[0171] It is understandable that the security policy information may also be stored in the first device.

[0172] In which, when the security policy information is stored in the first device, the third device interacts with the second device to authenticate the second device, and after the verification is passed, the third device can also send third indication information to the first device to indicate that the second device has passed the authentication, so that the first device can update the security policy information according to the first feature information.

[0173] In addition, when the security policy information is stored in the third device, the method further includes:

[0174] Acquiring the first feature information;

[0175] When the second device passes identity authentication, the security policy information is updated according to the first feature information.

[0176] It can be seen from this that if the security policy information is stored in the third device, the third device can update the security policy information according to the first feature information.

[0177] It should be noted that, when security policy information is stored on a third device, at least a portion of the first characteristic information used by the third device to update the security policy information can be obtained through log analysis. If only a portion of the first characteristic information is obtained through log analysis, the remaining portion of the first characteristic information can be sent from the first device to the third device. Alternatively, the third device can directly send the first characteristic information to the first device without obtaining it through log analysis.

[0178] In addition, the first characteristic information is used to indicate the characteristic information of the historical process of the first service calling the second service, which can represent the actual situation of the first service calling the second service. Updating the security policy information based on the first characteristic information can enable the security policy information to change with the actual calling situation between services, that is, the security policy information can change with the changes in the business, making the security policy information more usable.

[0179] Optionally, when the first characteristic information includes at least one of A-1 to A-5 above, and the security policy information includes B-1 to B-3 above, updating the security policy information according to the first characteristic information may include at least one of the following:

[0180] updating, in the security policy information, the valid time information for the first service to call the second service based on the first time information when the first device receives the first access request (for example, if the first time information is t1, the valid time information for the first service to call the second service indicates a time interval between t2 and t3; if t1 is greater than t3 and the second device passes identity authentication, the time interval may be updated to t2 to t1);

[0181] Update the frequency range of the first service calling the second service in the security policy information based on the historical frequency of the first service calling the second service (for example, if the historical frequency is f1 and the frequency range of the first service calling the second service is f2 to f3, if f1 is greater than f3 and the second device passes identity authentication, the frequency range can be updated to f2 to f1);

[0182] According to the correspondence between the interface information providing the second service and the identification information of the first service, the first correspondence in the security policy information is updated (that is, if there is no correspondence between the interface information providing the second service and the identification information of the first service in the first correspondence, if the second device passes the identity authentication, the correspondence between the interface information of the second service and the identification information of the first service can be added to the first correspondence).

[0183] In summary, the authentication method of the embodiment of the present application can be applied to Figure 4 The system architecture shown includes an access terminal device, a security gateway device, a security center device, and a service providing device, wherein the security center device includes a policy engine module and an authentication center module.

[0184] The following is a detailed introduction based on Figure 4 The system architecture shown in FIG. 1 and the specific implementation process of the authentication method of the embodiment of the present application are as follows: Figure 5 As shown, it includes the following steps 1 to 9:

[0185] Step 1: The access end device sends a first access request to the security gateway device corresponding to the second service it needs to call; wherein the first access request is used to instruct the first service to call the second service.

[0186] Step 2: The security gateway device calls the security policy information in the policy engine module in the security center device and obtains the first characteristic information of the first service calling the second service, thereby determining whether the access behavior of the first service calling the second service is abnormal based on the security policy information and the first characteristic information;

[0187] Optionally, the first characteristic information includes at least one of the following:

[0188] First time information when the security gateway device receives the first access request;

[0189] The historical frequency of the first service calling the second service;

[0190] first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service;

[0191] Providing interface information for the second service;

[0192] Identification information of the first service.

[0193] Optionally, the security policy information includes at least one of the following:

[0194] Valid time information for mutual calls between different services;

[0195] The frequency range of calls between different services;

[0196] A first correspondence between request target information and request source information, wherein the request target information is used to indicate the interface information of the called service, and the request source information is used to indicate the identification information of the service that needs to call other services.

[0197] Optionally, the access behavior of the first service calling the second service is abnormal if at least one of the following conditions is met:

[0198] The security policy information includes first valid time information for the first service to call the second service, and the time indicated by the first time information is not within a time interval determined according to the first valid time information;

[0199] The security policy information includes a first frequency range for the first service to call the second service, and a historical frequency of the first service calling the second service is not within the first frequency range;

[0200] The first information does not conform to predetermined specifications;

[0201] In the first correspondence, there is no correspondence between the interface information providing the second service and the identification information of the first service.

[0202] Step 3: When the security gateway device determines that there is an abnormality in the access behavior of the first service calling the second service, it denies access to the access-end device and sends a first indication message to the access-end device, wherein the first indication message is used to instruct identity authentication of the access-end device; optionally, the security gateway device may also send a reason for denying access to the access-end device.

[0203] Step 4: The access terminal device carries the ciphertext for identity authentication and sends an identity authentication request to the authentication center module of the security center device.

[0204] Step 5: The authentication center module performs identity authentication on the access terminal device based on the ciphertext carried in the identity authentication request; wherein, a symmetric algorithm or an asymmetric algorithm can be used to authenticate the access terminal device.

[0205] Step 6: When the access end device passes the identity authentication, the authentication center module sends the encrypted authentication information to the access end device, sends the authentication information or encrypted authentication information, as well as the decryption key and decryption policy to the security gateway device; and notifies the policy engine module that the authentication is passed, so that the policy engine module updates the security policy information according to the first feature information.

[0206] It should be noted that the policy engine module can obtain at least part of the above-mentioned first characteristic information through log analysis; among them, the part of the first characteristic information that the policy engine module cannot obtain based on the log can be reported by the security gateway device; so that the policy engine module can update the security policy information based on the first characteristic information.

[0207] The specific process of updating the security policy information according to the first characteristic information can be found in the above description and will not be repeated here.

[0208] Optionally, the authentication information includes at least one of the following:

[0209] First time information when the security gateway device receives the first access request;

[0210] The historical frequency of the first service calling the second service;

[0211] first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service;

[0212] Providing interface information for the second service;

[0213] Identification information of the first service.

[0214] Step 7: The access end device replaces the original security token with the encrypted authentication information, thereby sending a second access request carrying the encrypted authentication information to the security gateway device;

[0215] The token is the information obtained after the identity authentication of the access terminal device was performed last time and passed the verification. The token is used to indicate that the access terminal device has passed the identity authentication.

[0216] Step 8: The security gateway device decrypts and verifies the encrypted authentication information carried in the second access request based on the received authentication information or the encrypted authentication information, the decryption key, and the decryption policy. After the verification is successful, the security gateway device sends second instruction information to the second service provider to instruct the access terminal device to provide the second service.

[0217] Step 9: The second service providing device provides the second service to the access terminal device.

[0218] To sum up, in the above implementation mode, identity authentication is performed only after abnormal access behavior is detected. After passing the authentication, the encrypted authentication information is used to replace the token, and the security gateway device performs decryption verification. While ensuring network security, it can take into account performance and has sufficient scalability, making this solution more versatile and universal.

[0219] Therefore, the embodiments of the present application have the following advantages:

[0220] 1. By analyzing log behavior, we can decide whether to block the first service from calling the second service, and then perform identity authentication when blocking. This can reduce the pressure on the authentication service while ensuring security requirements.

[0221] 2. Encrypt and decrypt authentication information to ensure reliable control of security authentication and reduce the time consumption of requests;

[0222] 3. After authentication is passed, the security policy information can be updated so that the security policy information can change with business changes, making the security policy information more usable.

[0223] The above describes the authentication method provided in the embodiment of the present application. The following will describe the authentication device provided in the embodiment of the present application with reference to the accompanying drawings.

[0224] See also Figure 6 , an embodiment of the present application further provides an authentication device, applied to a first device, the device comprising:

[0225] A first acquisition module 601 is configured to acquire, upon receiving a first access request from a second device, first characteristic information of a first access behavior, wherein the first access behavior includes an behavior of a first service calling a second service as indicated by the first access request;

[0226] A determination module 602 is configured to determine whether the first access behavior is abnormal based on the first characteristic information and predetermined security policy information, wherein the security policy information is used to indicate characteristic information of mutual calls between different services;

[0227] The first sending module 603 is configured to send first indication information to the second device when there is an abnormality in the first access behavior, wherein the first indication information is used to instruct identity authentication of the second device.

[0228] Optionally, the first characteristic information includes at least one of the following:

[0229] first time information at which the first device receives the first access request;

[0230] a historical frequency of the first service calling the second service;

[0231] first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service;

[0232] Providing interface information of the second service;

[0233] Identification information of the first service.

[0234] Optionally, the security policy information includes at least one of the following:

[0235] Valid time information for mutual calls between different services;

[0236] The frequency range of calls between different services;

[0237] A first correspondence between request target information and request source information, wherein the request target information is used to indicate interface information of the called service, and the request source information is used to indicate identification information of the service that needs to call other services.

[0238] Optionally, the determining module 602 is specifically configured to:

[0239] If at least one of the following conditions is met, it is determined that the first access behavior is abnormal:

[0240] The security policy information includes first valid time information for the first service to call the second service, and the time indicated by the first time information is not within a time interval determined according to the first valid time information;

[0241] The security policy information includes a first frequency range for the first service to call the second service, and a historical frequency of the first service calling the second service is not within the first frequency range;

[0242] The first information does not conform to a predetermined specification;

[0243] In the first correspondence, there is no correspondence between the interface information providing the second service and the identification information of the first service.

[0244] Optionally, the device further comprises:

[0245] The second receiving module is configured to:

[0246] receiving second information sent by a third device when the second device passes identity authentication, wherein the second information includes authentication information or encrypted authentication information;

[0247] receiving a second access request from the second device for the first service to invoke the second service, wherein the second access request carries the encrypted authentication information;

[0248] a verification module, configured to verify the encrypted authentication information carried in the second access request according to the second information;

[0249] The first sending module 603 is further used to: when the encrypted authentication information carried in the second access request passes verification, send second indication information to the device providing the second service, wherein the second indication information is used to instruct the second device to provide the second service.

[0250] Optionally, the authentication information includes at least one of the following:

[0251] first time information at which the first device receives the first access request;

[0252] a historical frequency of the first service calling the second service;

[0253] first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service;

[0254] Providing interface information of the second service;

[0255] Identification information of the first service.

[0256] See also Figure 7 , an embodiment of the present application further provides an authentication device, applied to a second device, the device comprising:

[0257] A second sending module 701 is configured to send a first access request to a first device;

[0258] A first receiving module 702 is configured to receive first indication information sent by the first device when a first access behavior is abnormal, wherein the first access behavior includes an action of the first service calling the second service indicated by the first access request, and the first indication information is used to instruct identity authentication of the second device;

[0259] The first authentication module 703 is configured to interact with a third device so that the third device performs identity authentication on the second device.

[0260] Optionally, the first receiving module 702 is further configured to: receive encrypted authentication information sent by the third device when the second device passes identity authentication;

[0261] The second sending module 701 is also used to: send a second access request for the first service to call the second service to the first device, so that the first device verifies the encrypted authentication information carried in the second access request, and after the verification is passed, sends second indication information to the device providing the second service, wherein the second indication information is used to indicate the provision of the second service to the second device.

[0262] Optionally, the authentication information includes at least one of the following:

[0263] first time information at which the first device receives the first access request;

[0264] a historical frequency of the first service calling the second service;

[0265] first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service;

[0266] Providing interface information of the second service;

[0267] Identification information of the first service.

[0268] See also Figure 8 , an embodiment of the present application further provides an authentication device, applied to a third device, the device comprising:

[0269] A second authentication module 801 is configured to interact with a second device and perform identity authentication on the second device;

[0270] The third sending module 802 is used to send encrypted authentication information to the second device and send second information to the first device when the second device passes identity authentication, so that after the first device receives the second access request sent by the second device for the first service to call the second service, the encrypted authentication information carried in the second access request is verified according to the second information, wherein the second information includes the authentication information or the encrypted authentication information.

[0271] Optionally, the third device further stores security policy information, where the security policy information is used to indicate feature information for mutual invocation between different services; and the apparatus further includes:

[0272] A third receiving module is configured to receive a request for calling the security policy information sent by the first device;

[0273] The third sending module 802 is further configured to: provide the security policy information to the first device in response to the call request, so that the first device determines whether the first access behavior is abnormal based on the security policy information and the first feature information;

[0274] The first access behavior includes an action of a first service calling a second service indicated by a first access request received by the first device; and the first characteristic information includes characteristic information of the first access behavior.

[0275] Optionally, the device further comprises:

[0276] A second acquisition module, configured to acquire the first feature information;

[0277] An updating module is used to update the security policy information according to the first feature information when the second device passes identity authentication.

[0278] It should be noted that the division of units in the embodiments of the present application is schematic and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0279] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0280] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0281] An embodiment of the present application also provides an authentication system, including a first device, a second device and a third device, wherein the first device is used to execute the authentication method described in the first aspect above, the second device is used to execute the authentication method described in the second aspect above, and the third device is used to execute the authentication method described in the third aspect above.

[0282] The embodiment of the present application also provides a communication device, such as Figure 9 As shown, the communication device includes a memory 920, a transceiver 910, and a processor 900;

[0283] Memory 920, for storing computer programs;

[0284] a transceiver 910 , configured to receive and send data under the control of the processor 900 ;

[0285] The processor 900 is configured to read the computer program in the memory 920 and execute the aforementioned authentication method.

[0286] Among them, Figure 9In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically various circuits of one or more processors represented by the processor 900 and the memory represented by the memory 920. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 910 may be a plurality of components, i.e., a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, such as a wireless channel, a wired channel, an optical cable, and the like. The processor 900 is responsible for managing the bus architecture and general processing, and the memory 920 may store data used by the processor 900 when performing operations.

[0287] The processor 900 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or a complex programmable logic device (CPLD). The processor 900 may also adopt a multi-core architecture.

[0288] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0289] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the above-mentioned authentication method.

[0290] The computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (Magnet-Optica, MO)), etc.), optical storage (such as Compact Disk (CD), Digital Versatile Disc (DVD), Blu-ray Disc (BD), Holographic Versatile Disc (HVD), etc.), and semiconductor memory (such as Read-Only Memory (ROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), non-volatile memory (NAND FLASH), solid-state drive (Solid State Disk or Solid State Drive, SSD)), etc.

[0291] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) that contain computer-usable program code.

[0292] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer-executable instructions. These computer-executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0293] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor-readable memory produce an article of manufacture comprising an instruction device that implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0294] These processor-executable instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0295] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. An authentication method, characterized in that: Applied to a first device, the method includes: Upon receiving a first access request from a second device, obtaining first feature information of a first access behavior, wherein the first access behavior includes an behavior of the first service calling the second service indicated by the first access request; determining whether the first access behavior is abnormal based on the first characteristic information and predetermined security policy information, wherein the security policy information is used to indicate characteristic information of mutual calls between different services; When there is an abnormality in the first access behavior, first indication information is sent to the second device, wherein the first indication information is used to instruct identity authentication of the second device.

2. The method according to claim 1, characterized in that The first characteristic information includes at least one of the following: first time information at which the first device receives the first access request; a historical frequency of the first service calling the second service; first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service; Providing interface information of the second service; Identification information of the first service.

3. The method according to claim 2, characterized in that The security policy information includes at least one of the following: Valid time information for mutual calls between different services; The frequency range of calls between different services; A first correspondence between request target information and request source information, wherein the request target information is used to indicate interface information of the called service, and the request source information is used to indicate identification information of the service that needs to call other services.

4. The method according to claim 3, characterized in that The determining, based on the first feature information and predetermined security policy information, whether the first access behavior is abnormal includes: If at least one of the following conditions is met, it is determined that the first access behavior is abnormal: The security policy information includes first valid time information for the first service to call the second service, and the time indicated by the first time information is not within a time interval determined according to the first valid time information; The security policy information includes a first frequency range for the first service to call the second service, and a historical frequency of the first service calling the second service is not within the first frequency range; The first information does not conform to a predetermined specification; In the first correspondence, there is no correspondence between the interface information providing the second service and the identification information of the first service.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: receiving second information sent by a third device when the second device passes identity authentication, wherein the second information includes authentication information or encrypted authentication information; receiving a second access request from the second device for the first service to invoke the second service, wherein the second access request carries the encrypted authentication information; verifying the encrypted authentication information carried in the second access request according to the second information; In a case where the encrypted authentication information carried in the second access request passes verification, second indication information is sent to the device providing the second service, wherein the second indication information is used to instruct the second device to provide the second service.

6. The method according to claim 5, characterized in that The authentication information includes at least one of the following: first time information at which the first device receives the first access request; a historical frequency of the first service calling the second service; first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service; Providing interface information of the second service; Identification information of the first service.

7. An authentication method, characterized in that: Applied to the second device, the method includes: Sending a first access request to the first device; receiving first indication information sent by the first device when there is an abnormality in the first access behavior, wherein the first access behavior includes an action of the first service indicating by the first access request calling the second service, and the first indication information is used to instruct identity authentication of the second device; Interact with a third device so that the third device performs identity authentication on the second device.

8. The method according to claim 7, characterized in that The method further comprises: When the second device passes identity authentication, receiving encrypted authentication information sent by the third device; A second access request for the first service to call the second service is sent to the first device, so that the first device verifies the encrypted authentication information carried in the second access request, and after the verification is passed, sends a second indication information to the device providing the second service, wherein the second indication information is used to indicate the provision of the second service to the second device.

9. The method according to claim 8, characterized in that The authentication information includes at least one of the following: first time information at which the first device receives the first access request; a historical frequency of the first service calling the second service; first information carried in the first access request, where the first information is used to indicate that the first service needs to call the second service; Providing interface information of the second service; Identification information of the first service.

10. An authentication method, characterized in that: Applied to a third device, the method includes: interacting with a second device and performing identity authentication on the second device; When the second device passes identity authentication, the encrypted authentication information is sent to the second device, and the second information is sent to the first device, so that after the first device receives the second access request sent by the second device for the first service to call the second service, the encrypted authentication information carried in the second access request is verified according to the second information, wherein the second information includes the authentication information or the encrypted authentication information.

11. The method according to claim 10, characterized in that The third device further stores security policy information, where the security policy information is used to indicate feature information of mutual calls between different services; Before interacting with the second device and authenticating the second device, the method further includes: receiving a request for invoking the security policy information sent by the first device; In response to the call request, providing the security policy information to the first device, so that the first device determines whether the first access behavior is abnormal based on the security policy information and the first feature information; The first access behavior includes an action of a first service calling a second service indicated by a first access request received by the first device; and the first characteristic information includes characteristic information of the first access behavior.

12. The method according to claim 11, characterized in that The method further comprises: Acquiring the first feature information; When the second device passes identity authentication, the security policy information is updated according to the first feature information.

13. An authentication device, characterized in that: Applied to a first device, the apparatus includes: a first acquiring module configured to acquire, upon receiving a first access request from a second device, first characteristic information of a first access behavior, wherein the first access behavior includes an behavior of the first service calling the second service indicated by the first access request; a determination module, configured to determine whether the first access behavior is abnormal based on the first characteristic information and predetermined security policy information, wherein the security policy information is used to indicate characteristic information of mutual calls between different services; The first sending module is configured to send first indication information to the second device when there is an abnormality in the first access behavior, wherein the first indication information is used to instruct identity authentication of the second device.

14. An authentication device, characterized in that: Applied to the second device, the apparatus includes: A second sending module, configured to send a first access request to the first device; a first receiving module, configured to receive first indication information sent by the first device when a first access behavior is abnormal, wherein the first access behavior includes an action of the first service calling a second service indicated by the first access request, and the first indication information is used to instruct identity authentication of the second device; The first authentication module is configured to interact with a third device so that the third device performs identity authentication on the second device.

15. An authentication device, characterized in that: Applied to a third device, the apparatus includes: A second authentication module, configured to interact with a second device and perform identity authentication on the second device; The third sending module is used to send encrypted authentication information to the second device and send second information to the first device when the second device passes identity authentication, so that after the first device receives the second access request sent by the second device for the first service to call the second service, the encrypted authentication information carried in the second access request is verified according to the second information, wherein the second information includes the authentication information or the encrypted authentication information.

16. A communication device, characterized in that: Including memory, transceiver, processor: Memory for storing computer programs; a transceiver, configured to transmit and receive data under the control of the processor; A processor, configured to read the computer program in the memory and execute the authentication method according to any one of claims 1 to 6, or execute the authentication method according to any one of claims 7 to 9, or execute the authentication method according to any one of claims 10 to 12.

17. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which is used to enable a processor to execute the authentication method according to any one of claims 1 to 6, or the authentication method according to any one of claims 7 to 9, or the authentication method according to any one of claims 10 to 12.

Images