Authentication method and device, equipment, storage medium and product

Abstract

According to the authentication method and device, the equipment, the storage medium and the product provided by the embodiment of the invention, firstly, real-time state information, including real-time network environment parameters, of a client is acquired; according to the embodiment of the invention, the method comprises the following steps of: acquiring real-time state information of a server, then determining a target authentication strategy based on a pre-constructed authentication strategy selection rule according to the real-time state information, and finally initiating authentication to the server based on the target authentication strategy. According to the technical scheme, the dynamic authentication strategy adaptive to the real-time scene is used for replacing mechanical sequential attempts, invalid authentication attempts and switching are effectively avoided, and therefore authentication time consumption is reduced, and user experience is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular to an authentication method, device, equipment, storage medium and product. BACKGROUND

[0002] The existing Identity as a Service (IDaaS) short chain platform adopts an authentication fallback mechanism, which has a preset fixed priority order: the number middle bit filling shortcut authentication mode is prior to the Subscriber Identity Module (SIM) card information verification mode, and the SIM card information verification mode is prior to the SMS verification code verification mode. The mechanism strictly follows the preset order to trigger the authentication mode switching, and only mechanically promotes the process according to the success or failure result of the previous mode, even if the high-priority authentication mode has a response delay or failure risk in the current scenario, the mechanism will still be forced to try first, and then fallback in turn. The multiple attempts and switching of this fixed process significantly increase the overall time consumption, and greatly reduce the user experience. SUMMARY

[0003] The embodiments of the present application provide an authentication method, device, equipment, storage medium and product, which can obtain real-time state information of a client including real-time network environment parameters, determine a target authentication strategy according to a pre-constructed authentication strategy selection rule, and initiate authentication to a server, thereby reducing the authentication time consumption and improving the user experience.

[0004] In a first aspect, the embodiments of the present application provide an authentication method, comprising:

[0005] obtaining real-time state information of a client; wherein the real-time state information at least includes real-time network environment parameters;

[0006] determining a target authentication strategy according to the real-time network environment parameters based on a pre-constructed authentication strategy selection rule;

[0007] initiating authentication to a server based on the target authentication strategy.

[0008] In a second aspect, the embodiments of the present application further provide an authentication device, comprising:

[0009] an information obtaining module, configured to obtain real-time state information of a client; wherein the real-time state information at least includes real-time network environment parameters;

[0010] a strategy selection module, configured to determine a target authentication strategy according to the real-time network environment parameters based on a pre-constructed authentication strategy selection rule;

[0011] An authentication module is configured to initiate authentication to a server based on the target authentication policy.

[0012] In a third aspect, an embodiment of the present application further provides an authentication device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the authentication method according to any one of the above embodiments when executing the computer program.

[0013] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium, comprising a stored computer program, wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the authentication method according to any one of the above embodiments when the computer program runs.

[0014] In a fifth aspect, an embodiment of the present application further provides a computer program product, comprising computer programs / instructions, and the computer programs / instructions implement the authentication method according to any one of the above embodiments when executed by a processor.

[0015] Compared with the prior art, the authentication method, device, equipment, storage medium and product provided by the embodiment of the present application firstly acquire real-time state information of the client including real-time network environment parameters; then determine a target authentication policy based on a pre-constructed authentication policy selection rule according to the real-time state information; and finally initiate authentication to a server based on the target authentication policy. The embodiment of the present application breaks through the mechanical limitation of the existing fixed priority authentication fallback mechanism, and replaces the mechanical sequential attempt with a dynamic authentication policy adapted to a real-time scenario, thereby effectively avoiding invalid authentication attempts and switching, reducing authentication time consumption, and improving user experience. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a flowchart of an authentication method provided by an embodiment of the present application;

[0017] Figure 2 is a structural schematic diagram of an authentication device provided by an embodiment of the present application;

[0018] Figure 3 is a structural schematic diagram of an authentication device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0020] An embodiment of the present application provides an authentication method, referring to Figure 1 The flow of the authentication method is shown in the figure, and the method comprises steps S11-S13:

[0021] S11, acquiring real-time state information of a client; wherein the real-time state information at least comprises real-time network environment parameters;

[0022] S12, determining a target authentication strategy based on a pre-constructed authentication strategy selection rule according to the real-time network environment parameters;

[0023] S13, initiating authentication to a server based on the target authentication strategy.

[0024] It is worth noting that the application scenario of the authentication method has duality: it is applicable to a client (such as a small program) directly facing users, and can also be integrated into an identity authentication and access management service system, and an Identity as a Service (IDaaS) short chain platform is a typical application carrier of the system. IDaaS is a core base of account permission management, identity security management and product integration in the “mobile authentication” product line of China Mobile Internet, supports unified identity governance of group business, and will further be built into a trusted identity infrastructure serving a digital society in the future. The meta-trust IDaaS trusted account capability base can provide user hosting, number consistency verification, multi-dimensional authentication and other capabilities in user use scenarios, and can also be used as a capability channel to synergize with other security products such as security gateways. After the short chain encapsulation integrates the related capabilities of IDaaS, many functions such as custom authentication login, network convergence and access control can be realized, and convenient, safe and trusted link encapsulation is provided.

[0025] In the existing authentication process of the IDaaS short chain platform, the current fixed priority fallback strategy is adopted to regulate the switching of authentication methods, and the priority order is the number middle position fast authentication method, the subscriber identity module (SIM) card information verification method, and the SMS verification code verification method. The judgment basis of this strategy is extremely single. First, whether the number is successfully taken is taken as the standard. Here, the "number taking" is a key pre-step in the authentication process, which refers to the process of obtaining the number middle position of the user to be authenticated when the IDaaS short chain platform performs the number middle position fast authentication method. If the number taking fails, the next level of authentication method is switched to, and the SIM card information verification method is used for authentication. If it cannot be authenticated successfully, the next level of authentication will continue. This rigid process leads to more than 30% of the login process requiring user manual intervention, the entire authentication process takes too long, the authentication efficiency is low, and the user experience is greatly affected. Based on this, the embodiments of the present application consider various factors (such as real-time network environment parameters) or historical authentication records that will affect the authentication efficiency, and generate a target authentication strategy based on the pre-constructed authentication strategy selection rule. The target authentication strategy is adapted to the real-time state of the client, or the target authentication strategy can avoid the authentication path with a long authentication time in the past. The target authentication strategy is applied to initiate authentication to the server, which can reduce the authentication time, improve the authentication efficiency, and improve the user experience.

[0026] For example, the real-time network environment parameters of the client are acquired, such as the WiFi signal strength, access point (AP) delay, channel interference rate and other feature data closely related to the WiFi environment collected by the wireless fidelity (WiFi) signal monitoring module in real time. When it is monitored that the WiFi signal strength is lower than the set strength threshold (such as -70 dBm) and the AP delay is greater than the set delay threshold (such as 300 ms), based on the pre-trained reinforcement learning decision mechanism, the priority of the "local SIM cache number taking" action is automatically improved, wherein the "local SIM cache number taking" is an optimized implementation of the SIM card information verification process, which uses the SIM card information cached locally by the client to take the number, which can effectively avoid the risk of remote interface call failure caused by weak network and greatly improve the authentication success rate.

[0027] Preferably, a lightweight neural network accelerator is deployed on the edge computing node to assist in executing the authentication method, such as preprocessing the WiFi signal strength and other features, which can improve the real-time processing efficiency of the WiFi signal strength by 50% and reduce the authentication delay.

[0028] Compared with the prior art, the authentication method provided by the embodiment of the application firstly acquires real-time state information of the client including real-time network environment parameters; then, according to the real-time state information, determines a target authentication strategy based on a pre-constructed authentication strategy selection rule, and finally initiates authentication to the server based on the target authentication strategy. The embodiment of the application breaks through the mechanical limitation of the existing fixed priority authentication fallback mechanism, replaces the mechanical sequential attempt with a dynamic authentication strategy adapted to a real-time scene, effectively avoids invalid authentication attempts and switching, thereby reducing authentication time consumption and improving user experience.

[0029] In a preferred embodiment, based on steps S11-S13, the real-time state information further includes at least one of a historical authentication path and user credibility. It can be understood that the target authentication strategy is generated according to the real-time network environment parameters, the historical authentication path and the user credibility, the historical authentication path is used to reduce the probability that an authentication strategy with long time consumption is selected in the target authentication strategy generation process, the target authentication strategy matches the real-time network environment parameters of the client, and the authentication strategy with long time consumption in the past is avoided. In addition, for the client with user credibility, an authentication strategy with higher security is selected, such as additional face recognition, fingerprint recognition and the like.

[0030] In a preferred embodiment, based on any of the above embodiments, the authentication strategy selection rule is an authentication strategy selection model, and the authentication strategy selection model is obtained by training in the following manner:

[0031] Constructing an initial network model;

[0032] Acquiring current state information of a sample client, and generating a current state based on the current state information;

[0033] Selecting an action based on an exploration-exploitation balance strategy to determine an optimal authentication strategy;

[0034] Executing the optimal authentication strategy, and recording an authentication fluency index corresponding to the optimal authentication strategy;

[0035] Calculating a current reward value according to the authentication fluency index corresponding to the optimal authentication strategy, and generating a next state;

[0036] Storing the current state, the optimal authentication strategy, the current reward value and the next state in an experience replay buffer;

[0037] When the data amount of the experience replay buffer exceeds a preset batch size, training the initial network model based on the experience replay buffer to obtain an authentication strategy selection model.

[0038] For example, the classical Deep Q-Network (DQN) architecture is used as a reference and modified as appropriate, and a five-tuple model is adopted:

[0039] State space S: All network quality-related parameters (i.e., network environment parameters) are comprehensively incorporated, such as network delay, packet loss rate, etc. Network environment parameters are obtained through real-time collection and analysis of network monitoring data; the user's trust level is set to 0-100 points, which is evaluated based on multi-dimensional information such as user historical behavior and credit record; historical authentication paths, such as the last three successful or failed authentication methods, are recorded for algorithm learning and decision-making reference; the current authentication stage is explicitly defined. These information form a rich and comprehensive state vector, which can accurately describe the real-time state in the authentication process.

[0040] Action space A: set to {priority number middle four-bit fill-in fast authentication, priority card information verification method, priority SMS verification code verification, mixed mode}. The mixed mode refers to dynamically combining different authentication methods according to the real-time state, for example, first trying the card information verification method, and if there is a delay, immediately switching to the SMS verification code verification method to improve authentication efficiency.

[0041] Transition function T: S t+1 = T(S t ,A t ,R t ), based on the current state S t , the action A t taken, and the reward R t obtained, the next state S t+1 is predicted. The transition function continuously optimizes the prediction accuracy of state transition through learning and model training on a large amount of historical data.

[0042] Reward function R: based on the authentication time (the score range of authentication time can be set to -10 to +10 points), the number of failures (5 points deducted for each failure), and the number of user interactions (2 points deducted for each interaction). The shorter the authentication time, the higher the reward, for example, 10 points of reward can be obtained within 1 second, and the reward decreases by 1 second. Each authentication failure deducts 5 points to encourage the algorithm to minimize failures; each additional user interaction step deducts 2 points to encourage the algorithm to achieve automation and less intervention in the authentication process.

[0043] Policy function π: A = π(S; θ), the policy function is constructed with the help of a deep neural network, which generates the optimal action A under the current state by continuously adjusting the parameters θ of the neural network. The neural network here can use an improved architecture, such as adding an attention mechanism, which can pay more attention to state parameters that have a greater impact on authentication decisions, improving the accuracy and efficiency of decision-making.

[0044] For example, the pseudocode for the core process of the above algorithm is as follows:

[0045] Python

[0046] #Initialize the reinforcement learning model

[0047] def RL_DAS_algorithm(): # Defines the main function of the entire Reinforcement Learning Dynamic Authentication Scheduling (RL-DAS) algorithm, used to encapsulate all initialization and execution logic. In RL-DAS, RL stands for Reinforcement Learning and DAS stands for Dynamic Authentication Scheduling.

[0048] #Network Architecture: Improved to a 3-layer fully connected neural network with attention mechanism (10-dimensional input layer, 64-dimensional hidden layer, and 4-dimensional output layer)

[0049] model = Improved_DQN(state_dim=10, action_dim=4, hidden_dim=64) # state_dim=10 indicates that the state vector is 10-dimensional, action_dim=4 corresponds to 4 authentication strategies, and hidden_dim=64 defines the size of the hidden layer.

[0050] `replay_buffer = ReplayBuffer(max_size = 10000)` # Initializes an experience replay buffer to store samples generated by the agent's interaction with the environment, including the current state, selected action, reward, and next state, in order to break data correlation and improve training stability.

[0051] optimizer = Adam(model.parameters(), lr = 0.001) # Select the Adam optimizer to update the weights of the neural network and set the initial learning rate (lr) to 0.001.

[0052] #State Feature Engineering (Taking WiFi Environment as an Example)

[0053] def get_state(network_env, user_credibility, history): # Defines a function to convert raw environment data, user information (such as user credibility), and historical records (i.e., historical authentication paths) into a numerical state vector acceptable to the model. This state vector can be a 12-dimensional state space (containing multi-dimensional features such as network quality (such as latency, packet loss rate, etc.) and user credibility).

[0054] #Network environment characteristics (i.e., normalization processing of network environment parameters, extracting latency, packet loss rate, and signal strength from the network environment, and performing normalization processing to eliminate the influence of differences in the numerical range of different characteristics)

[0055] delay = normalize(network_env.delay, max_delay = 1000) # Unit is ms

[0056] packet_loss=normalize(network_env.packet_loss,max_loss=1)

[0057] signal_strength = normalize(network_env.signal, max_signal = 70) # Unit is dBm

[0058] #User characteristics (normalizing user credibility as part of the state)

[0059] credibility=normalize(user_credibility,max_cred=100)

[0060] #History path encoding (one-hot encoding of the most recent authentication paths (actions), converting discrete historical information into a vector form that the model can understand)

[0061] history_encoding=one_hot(history,num_actions=4)

[0062] #Combined State Vector (Concatenates all processed features into a complete list of states and returns it as a NumPy array)

[0063] state=[delay,packet_loss,signal_strength,credibility]+history_encoding

[0064] return np.array(state)

[0065] #Reward Function Design (Define the reward function to calculate the immediate reward for this action based on the authentication results (authentication time, number of failures, number of user interactions) to guide the model in learning the objective)

[0066] def calculate_reward(login_time,fail_times,interaction_steps):

[0067] time_reward = 10 - min(login_time, 10) # The faster you log in, the higher the reward.

[0068] fail_reward = -5 * fail_times # 5 points are deducted for each failure.

[0069] interaction_reward = -2 * interaction_steps # 2 points are deducted for each interaction step.

[0070] return time_reward+fail_reward+interaction_reward

[0071] #Dynamically schedule the main loop

[0072] def scheduling_loop(): # Defines the main loop function of the algorithm, which runs continuously and processes each authentication request.

[0073] while True: # Starts an infinite loop to continuously receive and process new authentication tasks.

[0074] #1. Collect real-time status (obtain the current WiFi network environment, user trust level, and the last 3 authentication histories, and call the get_state function to generate the current state vector)

[0075] network_env = get_wifi_env()

[0076] user_credibility=get_user_cred()

[0077] history = get_last_3_paths()

[0078] state=get_state(network_env,user_credibility,history)

[0079] #2. Action selection based on ε-greedy strategy

[0080] if random.random() <epsi lon:

[0081] action = random.choice(action_space) # Explore

[0082] else:

[0083] action=model.predict(state)#Use

[0084] #3. Execute the authentication process and obtain the results (execute the selected authentication action, obtain the authentication time login_time, the number of failures fail_times, and the number of interaction steps, etc. Calculate the reward based on the results, and obtain the new state after executing the action).

[0085] login_time,fail_times,interaction_steps=execute_auth(action)

[0086] reward=calculate_reward(login_time,fail_times,interaction_steps)

[0087] next_state=get_state(get_wifi_env(),get_user_cred(),update_history(history,action))

[0088] #4. Store experience in the experience replay buffer

[0089] replay_buffer.add(state,action,reward,next_state)

[0090] #5. Batch training model (When there is enough empirical data in the buffer (exceeding a preset batch size), a batch of data is randomly sampled from it for training, the loss is calculated, and the weights of the neural network are updated through the optimizer)

[0091] if len(replay_buffer)>batch_size:

[0092] batch=replay_buffer.sample(batch_size)

[0093] loss = model.train(batch)

[0094] optimizer.step()

[0095] #Start the scheduling system (At the end of the main function, call the scheduling_loop function to start the entire dynamic authentication scheduling system)

[0096] scheduling_loop()

[0097] The above algorithm is used to train a model to obtain an authentication strategy selection model, and the model is then used to select an appropriate authentication strategy for login authentication.

[0098] Optionally, the exploration-exploitation balancing strategy can be an ε-greedy strategy, a softmax strategy, or a decaying exploration strategy, etc., and is not limited here.

[0099] Optionally, it can be further extended to a multi-agent reinforcement learning architecture: treating the network environment, user credibility, and authentication method as independent agents, and dynamically optimizing the authentication scheduling strategy through collaborative decision-making.

[0100] Furthermore, the initial network model is a reinforcement learning model based on an improved deep Q-network, the network architecture of which is a 3-layer fully connected neural network with an attention mechanism.

[0101] It is worth noting that this implementation focuses on innovative improvements to the classic DQN algorithm to construct an efficient dynamic scheduling algorithm suitable for H5-based authentication scenarios. DQN, as a classic algorithm combining reinforcement learning and deep learning, approximates the Q-value function through deep neural networks, solving the dilemma faced by traditional Q-learning in handling high-dimensional state spaces. It effectively addresses decision-making problems in complex environments and has demonstrated good application results in many fields. Furthermore, the Proximal Policy Optimization (PPO) algorithm can be used to replace DQN, improving convergence speed in complex scenarios through policy gradient methods, making it suitable for industrial IoT authentication scenarios with drastically fluctuating network environments. H5 stands for HyperText Markup Language 5.

[0102] In a preferred embodiment, the authentication fluency metric in the above embodiments includes at least one of authentication time, number of failures, and number of user interactions.

[0103] Understandably, the shorter the authentication time, the fewer the number of failures, and the fewer the number of user interactions, the smoother the authentication process and the greater the current reward value.

[0104] In a preferred embodiment, the real-time status information further includes user credibility; in the calculation of the current reward value, the higher the user credibility, the greater the weight of the corresponding authentication time.

[0105] For example, weights are dynamically adjusted based on user trustworthiness. For highly trustworthy users: In the reward function design, the weight of "authentication time" is significantly increased to 70% for users with a trust level greater than 80. This causes the algorithm to prioritize methods that enable fast authentication when selecting authentication actions for highly trustworthy users, such as priority number middle digit padding for quick authentication or optimized SIM card information verification methods, greatly improving the authentication efficiency for highly trustworthy users and achieving a fast login experience with no or minimal interaction.

[0106] In a preferred embodiment, the method further includes: recording a security risk index corresponding to the optimal authentication policy; the current reward value is calculated based on the authentication fluency index and the security risk index; the security risk index is used to enable the authentication policy selection model to prioritize the selection of a high-security-level authentication policy for clients with low user trust.

[0107] Understandably, for users with low trust levels, the system will dynamically increase the decision weight of the "security verification" dimension. For example, multi-factor authentication can be forcibly triggered in the authentication process. In addition to the usual SIM card information verification or SMS verification code verification, biometric identification steps such as facial recognition and fingerprint recognition can be added. This multi-level verification ensures the security of the authentication process, effectively mitigating potential security risks from low-trust users. Specifically, the security risk index of each authentication strategy can be added as a factor in the current reward value for the user. For highly trustworthy users, the security risk index of each authentication strategy is basically the same, while for low-trustworthy users, generally, the more information the authentication strategy needs to verify, the higher the security, and the larger the corresponding reward value.

[0108] In a preferred embodiment, the method further includes incorporating a failure path memory mechanism for the exploration-utilization balancing strategy to reduce the probability that the same authentication path that has repeatedly failed will be selected in action selection.

[0109] Specifically, existing fixed-priority authentication strategies lack the ability to learn from historical authentication data and cannot dynamically optimize decisions based on past results. For example, in the same network environment, even if a certain authentication path has failed multiple times, it will still mechanically repeat itself, unable to adjust the authentication method selection logic based on historical failure records. This implementation method employs an optimization mechanism to dynamically avoid failed paths. The specific optimization mechanism has two aspects: 1. Action probability decay: When the same authentication path fails a set number of times (e.g., 2 times) consecutively, the algorithm automatically reduces the action selection probability corresponding to that path by a preset probability (e.g., 50%). By dynamically adjusting the action probability, the possibility of selecting a verified invalid path again is significantly reduced. 2. Failure path taboo table: A "failure path taboo table" is constructed and maintained in real time in the state space. This table records in detail the path characteristics and information that are prone to authentication failure. In subsequent decision-making processes, the algorithm will prioritize searching the taboo table, actively avoiding recorded invalid strategies, achieving continuous optimization of the authentication path, and thus improving the overall authentication success rate.

[0110] In a preferred embodiment, the real-time network environment parameters include at least one of network latency, channel interference rate, packet loss rate, and signal strength.

[0111] It is understandable that real-time network environment parameters are not limited to the specific parameters mentioned above, but may also include other parameters that can reflect the network status, which are not limited here.

[0112] In a preferred embodiment, the target authentication strategy includes at least one authentication method, and the authentication methods in the target authentication strategy have dynamic execution priorities; the authentication method includes at least one of the following: mobile phone number fill-in quick authentication method, SIM card information verification method, and SMS verification code verification method.

[0113] It is understood that the authentication methods are not limited to the specific methods mentioned above, and may also include other methods such as facial recognition and fingerprint recognition, which are not limited here.

[0114] To better illustrate the differences between the embodiments of the present invention and the original fixed-priority authentication strategy, this implementation method is explained with two specific examples:

[0115] Scenario 1: User login in a weak WiFi network environment (failed number retrieval scenario)

[0116] Assume the user's state is as follows:

[0117] Network environment: WiFi signal strength -75dBm (weak network), AP latency 450ms (high latency);

[0118] User characteristics: Trust level 65 (medium trust), historical authentication path is "SMS verification → SIM card information verification failed";

[0119] Business scenario: Non-personalized workflow (without short link mobile phone number).

[0120] 1. Existing fixed-priority authentication process:

[0121] Number retrieval stage: The number retrieval interface of this website was called, but the number retrieval failed due to weak network conditions (takes 2 seconds);

[0122] Authentication method switching: SIM card information verification is attempted in a fixed order (priority 2), but fails after sending SIM authentication request due to network latency exceeding 500ms (takes 3 seconds);

[0123] Finally, SMS verification code verification (priority 3) was attempted, and the user entered the verification code to complete the login (takes 3 seconds).

[0124] Based on the above information, the total time is determined to be 8 seconds, and the user needs to manually wait for two failures before switching.

[0125] 2. The authentication process based on the RL-DAS algorithm described in this embodiment:

[0126] Status Acquisition and Decision Making: If a WiFi signal strength of less than -70dBm and a latency greater than 300ms are detected, combined with the user's historical SIM card information verification failure records, the system is determined to be "weak network + high-risk path". The system skips fixed priorities and directly selects a hybrid mode of "SMS verification code verification + local SIM cache backup".

[0127] Authentication execution: Directly display the 11-digit short verification authorization page, and the user enters the verification code (takes 1.5 seconds);

[0128] Meanwhile, the background process prefetches local SIM cache information (if it exists) for future optimization.

[0129] Based on the above information, the total time can be determined to be 2.8 seconds, without requiring manual switching by the user, reducing the failure rate from 30% to 4.2%.

[0130] Scenario 2: Personalized login for highly trusted users (inconsistent account numbers)

[0131] Assume the user's state is as follows:

[0132] Network environment: WiFi signal -50dBm (strong network), AP latency 100ms (low latency);

[0133] User characteristics: The user's trust level is 90 points (high trust), and the historical authentication path is "successful quick authentication with middle digit padding of number";

[0134] Business scenario: Personalized process for each user (carrying a short link mobile phone number, the number obtained is inconsistent with the short link number).

[0135] 1. Existing fixed-priority authentication process:

[0136] Number retrieval stage: Retrieve a number using the short link mobile phone number, but the returned number does not match the short link mobile phone number;

[0137] Authentication method switching: The middle four digits of the authorization page are displayed according to a fixed priority. After the user completes the number, they click to authorize (takes 2 seconds).

[0138] The SIM card information verification method was invoked, but failed because the user did not enter a PIN code (taking 2 seconds). Then, the SMS verification code verification method was switched (taking 2 seconds).

[0139] Based on the above information, the total time is determined to be 6 seconds, requiring the user to input information multiple times.

[0140] 2. The authentication process based on the RL-DAS algorithm described in this embodiment:

[0141] Status collection and decision-making: When a strong network environment and a highly trusted user are detected, combined with the historical "successful quick authentication with middle digit filling", the "time-priority" strategy is activated (70% of the reward function weight is biased towards time consumption), and the "quick authentication with middle digit filling + SIM authentication pre-caching" mode is selected.

[0142] Authentication execution: When displaying the authorization page with the middle four digits, the historical trusted number is automatically pre-filled (reducing user input), and the user clicks to authorize (takes 1 second);

[0143] For highly trusted users, the algorithm skips the SIM authentication delay detection and directly uses the pre-cached token for fast access.

[0144] Based on the above information, the total time taken can be determined to be 1.8 seconds. Interaction-free login (it can be roughly calculated that the interaction-free rate for highly trusted users is 92%), which significantly improves the user experience of high-quality users and enhances user satisfaction and loyalty to related services.

[0145] Compared with existing technologies, the authentication method disclosed in this invention focuses on constructing a reinforcement learning model based on an improved deep Q-network, using a quintuple model to describe the authentication process, and generating an optimal authentication strategy using a neural network with an attention mechanism. It optimizes state features and action priorities for WiFi environments to ensure high success rates in weak network conditions. The method adjusts action selection based on user trustworthiness, favoring highly trustworthy users and selecting authentication strategies that enable rapid authentication. Furthermore, it establishes a failure path memory mechanism to effectively avoid repeated invalid attempts. This improves authentication success rate and efficiency in complex and ever-changing H5 integrated authentication scenarios, significantly optimizes user experience, and brings multiple commercial benefits, including reduced page bounce rate, reduced operating costs, increased revenue from value-added services, and industry solution output. Specifically, preliminary evaluation shows that based on this authentication method, authentication time is reduced from 8 seconds to 3-5 seconds, resulting in a 40% reduction in page bounce rate. Assuming 1 million daily active users, the cost per user authentication decreases by 0.1 yuan, leading to annual cost savings of 36.5 million yuan. Furthermore, once the proportion of highly trusted users logging in without interaction reaches 92%, a "fast authentication membership service" can be launched, charged at 0.5 yuan per instance, with an estimated annual revenue increase of 50 million yuan (based on a 10% user payment rate). This method can also be packaged as an "intelligent authentication scheduling engine" and exported to industries such as finance and government, charging licensing fees based on the number of enterprise users (e.g., 100,000 yuan per 10,000 users per year), with an estimated annual revenue of 10 million yuan when covering 100 enterprises.

[0146] See Figure 2 An embodiment of the present invention also provides an authentication device, comprising:

[0147] The information acquisition module 21 is used to acquire the real-time status information of the client; wherein the real-time status information includes at least real-time network environment parameters;

[0148] The strategy selection module 22 is used to determine the target authentication strategy based on the real-time network environment parameters and pre-built authentication strategy selection rules;

[0149] The authentication module 23 is used to initiate authentication to the server based on the target authentication policy.

[0150] In one implementation, the real-time status information further includes at least one of historical authentication paths and user trustworthiness.

[0151] In one implementation, the authentication strategy selection rule is an authentication strategy selection model, which is trained in the following manner:

[0152] Construct the initial network model;

[0153] Obtain the current state information of the sample client, and generate the current state based on the current state information;

[0154] The optimal authentication strategy is determined by exploring and using a balanced strategy for action selection.

[0155] Execute the optimal authentication strategy and record the authentication fluency index corresponding to the optimal authentication strategy;

[0156] The current reward value is calculated based on the authentication fluency index corresponding to the optimal authentication strategy, and the next state is generated.

[0157] Store the current state, the optimal authentication strategy, the current reward value, and the next state into the experience replay buffer;

[0158] When the amount of data in the experience replay buffer exceeds the preset batch size, the initial network model is trained based on the experience replay buffer to obtain the authentication strategy selection model.

[0159] In one implementation, the initial network model is a reinforcement learning model based on an improved deep Q-network, the network architecture of which is a 3-layer fully connected neural network with an attention mechanism.

[0160] In one implementation, the authentication fluency metric includes at least one of authentication time, number of failures, and number of user interactions.

[0161] In one implementation, the real-time status information also includes user credibility; in the calculation of the current reward value, the higher the user credibility, the greater the weight of the corresponding authentication time.

[0162] In one implementation, the method further includes: recording a security risk index corresponding to the optimal authentication strategy; the current reward value is calculated based on the authentication fluency index and the security risk index; the security risk index is used to enable the authentication strategy selection model to prioritize the selection of a high-security-level authentication strategy for clients with low user trust.

[0163] In one implementation, the method further includes incorporating a failure path memory mechanism for the exploration-utilization balancing strategy to reduce the probability that the same authentication path that has repeatedly failed will be selected in action selection.

[0164] In one embodiment, the real-time network environment parameters include at least one of network latency, channel interference rate, packet loss rate, and signal strength.

[0165] In one implementation, the target authentication strategy includes at least one authentication method, and the authentication methods in the target authentication strategy have dynamic execution priorities; the authentication method includes at least one of the following: mobile phone number fill-in quick authentication method, SIM card information verification method, and SMS verification code verification method.

[0166] It is worth noting that the specific working process of the authentication device described in the embodiments of the present invention can refer to the working process of the authentication method described in any of the above embodiments, and will not be repeated here.

[0167] See Figure 3 This invention also provides an authentication device, including a processor 31, a memory 32, and a computer program stored in the memory 32 and configured to be executed by the processor 31. When the processor 31 executes the computer program, it implements the steps described in the above-described authentication method embodiments, for example... Figure 1 The steps S11 to S13 described above; or, when the processor 31 executes the computer program, it implements the functions of each module in the above-described device embodiments.

[0168] For example, the computer program can be divided into one or more modules, which are stored in the memory 32 and executed by the processor 31 to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the authentication device. For example, the computer program can be divided into multiple modules. The specific working process of each module can be referred to the working process of the authentication device described in the above embodiments, and will not be repeated here.

[0169] The authentication device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The authentication device may include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art will understand that the authentication device may also include input / output devices, network access devices, buses, etc.

[0170] The processor 31 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 31 is the control center of the authentication device, connecting various parts of the authentication device via various interfaces and lines.

[0171] The memory 32 can be used to store the computer program and / or modules. The processor 31 implements various functions of the authentication device by running or executing the computer program and / or modules stored in the memory 32 and calling the data stored in the memory 32. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as image playback function), etc.; the data storage area may store data created according to the use of the mobile phone, etc. In addition, the memory 32 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0172] If the modules integrated into the authentication device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 31, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0173] This invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the authentication method as described in any of the above embodiments.

[0174] Compared with existing technologies, the authentication method, apparatus, device, storage medium, and product provided in this invention first acquire real-time status information of the client, including real-time network environment parameters; then, based on the real-time status information, determine the target authentication strategy according to pre-built authentication strategy selection rules; and finally, initiate authentication to the server based on the target authentication strategy. This invention overcomes the mechanical limitations of existing fixed-priority authentication fallback mechanisms by replacing mechanical sequential attempts with dynamic authentication strategies adapted to real-time scenarios, effectively avoiding invalid authentication attempts and switching, thereby reducing authentication time and improving user experience.

[0175] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. An authentication method, characterized in that, include: Obtain the client's real-time status information; wherein the real-time status information includes at least real-time network environment parameters; Based on the real-time network environment parameters and pre-built authentication policy selection rules, the target authentication policy is determined. The authentication is initiated to the server based on the target authentication policy.

2. The authentication method as described in claim 1, characterized in that, The real-time status information also includes at least one of historical authentication paths and user trustworthiness.

3. The authentication method as described in claim 1 or 2, characterized in that, The authentication strategy selection rule is an authentication strategy selection model, which is trained in the following way: Construct the initial network model; Obtain the current state information of the sample client, and generate the current state based on the current state information; The optimal authentication strategy is determined by exploring and using a balanced strategy for action selection. Execute the optimal authentication strategy and record the authentication fluency index corresponding to the optimal authentication strategy; The current reward value is calculated based on the authentication fluency index corresponding to the optimal authentication strategy, and the next state is generated. Store the current state, the optimal authentication strategy, the current reward value, and the next state into the experience replay buffer; When the amount of data in the experience replay buffer exceeds the preset batch size, the initial network model is trained based on the experience replay buffer to obtain the authentication strategy selection model.

4. The authentication method as described in claim 3, characterized in that, The initial network model is a reinforcement learning model based on an improved deep Q-network, which has a network architecture of a 3-layer fully connected neural network with an attention mechanism.

5. The authentication method as described in claim 3, characterized in that, The authentication fluency metrics include at least one of authentication time, number of failures, and number of user interactions.

6. The authentication method as described in claim 3, characterized in that, The real-time status information also includes user credibility; in the calculation of the current reward value, the higher the user credibility, the greater the weight of the corresponding authentication time.

7. The authentication method as described in claim 3, characterized in that, Also includes: Record the security risk index corresponding to the optimal authentication strategy; the current reward value is calculated based on the authentication fluency index and the security risk index; The security risk index is used to make the authentication policy selection model prioritize the use of high-security authentication policies for clients with low user trust.

8. The authentication method as described in claim 3, characterized in that, Also includes: The exploration utilizes a balancing strategy to integrate a failure path memory mechanism to reduce the probability of the same authentication path that has repeatedly failed being selected in action selection.

9. The authentication method as described in claim 1, characterized in that, The real-time network environment parameters include at least one of network latency, channel interference rate, packet loss rate, and signal strength.

10. The authentication method as described in claim 1, characterized in that, The target authentication strategy includes at least one authentication method, and the authentication methods in the target authentication strategy have dynamic execution priorities; the authentication method includes at least one of the following: mobile phone number fill-in quick authentication method, SIM card information verification method, and SMS verification code verification method.

11. An authentication device, characterized in that, include: An information acquisition module is used to acquire real-time status information of the client; wherein, the real-time status information includes at least real-time network environment parameters; The strategy selection module is used to determine the target authentication strategy based on the real-time network environment parameters and pre-built authentication strategy selection rules; The authentication module is used to initiate authentication to the server based on the target authentication policy.

12. An authentication device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the authentication method as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the authentication method as described in any one of claims 1 to 10.

14. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the authentication method as described in any one of claims 1 to 10.

Images