Terminal verification method and system, electronic equipment and storage medium

Abstract

The invention provides a terminal verification method and system, electronic equipment and a storage medium, and the method comprises the steps: obtaining the environment information of a current client when the client responds to a user entering a target application; determining that environmental security exists based on the environmental information, responding to user identity information input by a user, and obtaining a target identifier and a client certificate; the user identity information, the target identifier, the client certificate and the environment information are packaged to generate a data packet, and the data packet is sent to credit processing equipment; the credit data device determines whether the user can access the target environment through the client based on the user identity information, the target identifier, the client certificate, the identity credential and the environment information in the data packet; and if it is determined that the client can access the target environment, determining that the client logs in successfully. According to the invention, bidirectional authentication is carried out on the user identity and the client identity through the client and the credit processing equipment, so that the network security problem in the industrial control network is solved by controlling the user permission and the terminal permission.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of verification technology, and in particular to a terminal verification method and system, an electronic device and a storage medium. BACKGROUND

[0002] With the acceleration of digital transformation, the enterprise network environment becomes more and more complex, and the traditional network security model has been unable to effectively cope with modern security threats, and more and more enterprises use a zero-trust security model for protection. However, in the industrial control network, access control is more stringent, and neither the traditional model nor the zero-trust model can fully meet the security requirements. Today, industrial control networks also begin to introduce mobile terminals, and the boundary network has been unable to cope. Zero trust focuses on verifying user identity, and as long as the identity is stolen, it is easy to have the authority of this identity, thereby affecting network security problems. SUMMARY

[0003] Therefore, the embodiments of the present application provide a terminal verification method and system, an electronic device and a storage medium to solve the problem that the user identity is easily stolen and affects network security in the prior art.

[0004] To achieve the above object, the embodiments of the present application provide the following technical solutions.

[0005] The first aspect shows a terminal verification method applied to a terminal verification system, the system comprising a client and a credit processing device, the method comprising:

[0006] The client acquires environment information in which the client is located in response to a user entering a target application;

[0007] The client determines that the environment is safe based on the environment information, and responds to user identity information input by the user, and acquires a target identifier and a client certificate, the client certificate being generated by the credit data device based on a device number, a device name and a device location of the client, and the target identifier being generated by the credit data device based on device information and the client certificate;

[0008] The client packs the user identity information, the target identifier, the client certificate and the environment information into a data packet, and sends the data packet to the credit processing device;

[0009] The credit data device determines whether the user can access the target environment through the client based on the user identity information, the target identifier, the client certificate, the identity credential and the environment information in the data packet;

[0010] If it is determined that the client accesses the target environment, it is determined that the client logs in successfully, and a display is performed.

[0011] Optionally, further comprising:

[0012] The credit data device acquires the device number, device name and device location of the client when detecting that the new client registration is completed;

[0013] The credit data device generates a client certificate based on the device number, device name and device location of the client, and sends it to the client for storage.

[0014] 3. The method of claim 2, wherein the credit data device generates a client certificate based on the device number, device name and device location of the client, comprising:

[0015] determining a corresponding device reference value based on the device name and device location;

[0016] encoding the device reference value and the device number respectively, and splicing the encoded device reference value and device number to obtain spliced data;

[0017] calling a preset processing model to process the spliced data to output a corresponding client certificate.

[0018] Optionally, further comprising:

[0019] The credit data device receives a trust access application initiated by the client, which carries a preset stored client certificate and device information;

[0020] If the credit data device determines that the client is allowed to access the trust center based on the device information carried in the trust access application, it generates a target identifier based on the device information and client certificate and returns it to the client.

[0021] Optionally, the credit data device determines whether the user can access the target environment through the client based on the user identity information, target identifier, client certificate, and identity credential in the data packet and environmental information, comprising:

[0022] The credit data device determines whether the target identifier in the data packet is a valid ID based on the target identifier in the data packet;

[0023] If so, the credit data device determines whether the target identifier and the client certificate in the data packet have a corresponding relationship;

[0024] If so, the credit data device determines whether the environmental information in the data packet meets the preset criteria;

[0025] The credit data device determines whether the user identity information in the data packet is correct;

[0026] If correct, the user can access the target environment through the client.

[0027] Optionally, further comprising:

[0028] Based on the device information and customer information of the client, configure the corresponding authentication strategy and access permission strategy.

[0029] The second aspect shows a terminal verification system, applied to a verification system, the system comprising a client and a credit processing device;

[0030] The client is configured to, in response to a user entering a target application, obtain environment information in which the client is currently located; based on the environment information, determine that there is environment security, respond to user-entered user identity information, and obtain a target identifier and a client certificate, the client certificate being generated by the credit data device based on a device number, a device name, and a device location of the client, the target identifier being generated by the credit data device based on the device information and the client certificate; package the user identity information, the target identifier, the client certificate, and the environment information into a data packet, and send the data packet to the credit processing device.

[0031] The credit data device is configured to, based on the user identity information, the target identifier, the client certificate, the identity credential, and the environment information in the data packet, determine whether the user can access the target environment through the client; if it is determined that the client can access the target environment, it is determined that the client has logged in successfully.

[0032] Optionally, the credit data device is further configured to:

[0033] Upon detecting that a new client registration is complete, obtain the device number, the device name, and the device location of the client.

[0034] Generate a client certificate based on the device number, the device name, and the device location of the client, and send the client certificate to the client for storage.

[0035] The third aspect shows an electronic device, comprising a processor and a memory, the memory being configured to store program codes and data for collaborative privacy protection of electrical loads, and the processor being configured to invoke program instructions in the memory to execute the terminal verification method of any one of the first aspect.

[0036] The fourth aspect shows a storage medium comprising a program, wherein when the program is running, the device in which the storage medium is located is controlled to execute the terminal verification method of any one of the first aspect.

[0037] Based on the above embodiments of the present invention, a terminal verification method, system, electronic device, and storage medium are provided. Applied to a terminal verification system, the system includes a client and a credit processing device. The method includes: when a user enters a target application, the client obtains the current environment information of the client; based on the environment information, the client determines that the environment is secure, responds to user-inputted identity information, and obtains a target identifier and a client certificate. The client certificate is generated by the credit data device based on the client's device number, device name, and device location; the target identifier is generated by the credit data device based on the device information and the client certificate; the client packages the user identity information, target identifier, client certificate, and environment information into a data packet and sends it to the credit processing device; the credit data device determines whether the user can access the target environment through the client based on the user identity information, target identifier, client certificate, identity credentials, and environment information in the data packet; if it is determined that the client can access the target environment, the client login is confirmed as successful. This application performs two-way authentication of user identity and client identity through the client and credit processing device to solve network security problems in industrial control networks by controlling user permissions and terminal permissions. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1 This is a schematic diagram of the verification system according to an embodiment of the present invention;

[0040] Figure 2 The present invention provides a schematic flowchart of a terminal verification method.

[0041] Figure 3 The following is a flowchart illustrating another terminal verification method according to an embodiment of the present invention;

[0042] Figure 4 The present invention provides a schematic flowchart of another terminal verification method. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0045] It should be noted that the descriptions involving "first," "second," etc., in this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of that feature. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0046] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0047] See Figure 1 The diagram below illustrates the structure of a verification system according to an embodiment of the present invention. The system includes:

[0048] Client 10 and credit processing device 20;

[0049] The number of clients refers to multiple terminals.

[0050] The credit processing device 20 can be connected to the client 10 through the target gateway 30, and the other end of the target gateway 30 is connected to the application service 40.

[0051] The credit processing device 20 is used to determine whether the client 10 can access the target environment, so that the client 10 can access application services through the target gateway under the credit processing device 20.

[0052] In this application, client 10 can only access authorized application services after confirming that the client has successfully logged in; otherwise, it will be blocked by the target gateway under credit processing device 20.

[0053] Zero-trust terminals can only access authorized application services after login authentication.

[0054] It should be noted that the target environment is a zero-trust access environment, and the target gateway is a zero-trust gateway.

[0055] Optionally, the credit processing device 20 includes a management center and an authentication center;

[0056] It should be noted that the client 10 shown in this application includes, but is not limited to, electronic devices such as personal computers and mobile terminals.

[0057] The client 10 is configured to, in response to a user entering a target application, obtain the current environment information of the client; determine the existence of environmental security based on the environment information, respond to the user's input of user identity information, and obtain the target identifier and client certificate. The client certificate is generated by the credit data device based on the client's device number, device name, and device location. The target identifier is generated by the credit data device based on the device information and client certificate. The client identity information, target identifier, client certificate, and environment information are packaged into a data packet and sent to the credit processing device.

[0058] The credit data device 20 is used to determine whether the user can access the target environment through the client based on the user identity information, target identifier, client certificate, identity credential, and environmental information in the data packet; if it is determined that the client can access the target environment, the client is confirmed to have successfully logged in.

[0059] This application uses a two-way authentication mechanism between the client and the credit processing device to verify the identity of the user and the client, thereby addressing network security issues in industrial control networks by controlling user and terminal permissions.

[0060] Optionally, based on the verification system shown in the above embodiments of the present invention, the credit data device 20 is further configured to:

[0061] Upon detecting that a new client has completed registration, obtain the client's device ID, device name, and device location;

[0062] A client certificate is generated based on the client's device ID, device name, and device location, and then sent to the client for storage.

[0063] Optionally, based on the verification system shown in the above embodiments of the present invention, the credit data device 20 that generates client certificates based on the client's device number, device name, and device location is specifically used for:

[0064] Determine the corresponding device reference value based on the device name and device location;

[0065] The device reference value and the device number are encoded separately, and the encoded device reference value and the device number are concatenated to obtain concatenated data;

[0066] The pre-defined processing model is invoked to process the certificate of the concatenated data, so as to output the corresponding client certificate.

[0067] Optionally, based on the verification system shown in the above embodiments of the present invention, the credit data device 20 is further configured to:

[0068] The credit data device receives a trust access request initiated by the client, and the trust access request carries a pre-stored client certificate and device information;

[0069] If the credit data device determines that the client is allowed to access the trust center based on the device information carried in the trust access application, it generates a target identifier based on the device information and the client certificate, and returns it to the client.

[0070] Optionally, based on the verification system shown in the above embodiments of the present invention, the system determines whether the user can access the credit data device 20 in the target environment through the client based on the user identity information, target identifier, client certificate, identity credentials, and environmental information in the data packet. Specifically, this is used for:

[0071] The credit data device determines whether the target identifier in the data packet is a valid ID;

[0072] If so, the credit data device determines whether there is a correspondence between the target identifier and the client certificate in the data packet;

[0073] If present, the credit data device determines whether the environmental information in the data packet conforms to preset criteria;

[0074] The credit data device determines whether the user identity information in the data packet is correct;

[0075] If correct, the user can access the target environment through the client.

[0076] Optionally, based on the verification system shown in the above embodiments of the present invention, the client 10 is further configured to:

[0077] Configure corresponding authentication and access control policies based on the client's device and customer information.

[0078] Based on the structure of the verification system shown above, the specific implementation of the new client access process is as follows: Figure 2 The diagram shown is a flowchart illustrating a verification method according to an embodiment of the present invention. The method includes:

[0079] Step S201: When the credit data device detects that a new client registration has been completed, it obtains the client's device number, device name, and device location;

[0080] Optionally, after the zero-trust terminal program is installed in the new client, the client responds to the user's registration of the new client;

[0081] In the specific implementation step S201, the management center of the credit data device detects in real time whether a client has completed registration. If a client is detected to have completed registration, the device number, device name and device location of the client are obtained.

[0082] It should be noted that the collection, use, storage, sharing and transfer of user personal information involved in the technical solution of the present invention all comply with the provisions of relevant laws and regulations, and require notification to users and obtaining their consent or authorization. When applicable, user personal information is subjected to de-identification and / or anonymization and / or encryption technical processing.

[0083] Step S202: The credit data device generates a client certificate based on the client's device number, device name, and device location, and sends it to the client for storage.

[0084] It should be noted that the specific implementation of step S202 includes the following steps.

[0085] Step S11: Determine the corresponding device reference value based on the device name and device location;

[0086] In one implementation, the management center of the credit data device directly uses the combination of the device name and device location as the device reference value;

[0087] In another implementation, the management center of the credit data device generates a corresponding device reference value in the device name and device location input parameter generation model.

[0088] It should be noted that the parameter generation model is pre-trained based on the historical device names, corresponding historical device locations, and labeled device parameter values.

[0089] Step S12: Encode the device reference value and the device number respectively, and concatenate the encoded device reference value and the device number to obtain concatenated data;

[0090] In the specific implementation step S12, the management center of the credit data device converts the device reference value into binary code to obtain the first code; at the same time, it converts the device number into binary code to obtain the second code; then the first code and the second code are concatenated to obtain concatenated data.

[0091] Step S13: Call the preset processing model to perform certificate processing on the spliced ​​data to output the corresponding client certificate.

[0092] It should be noted that the preset processing model is trained based on historical spliced ​​data and corresponding historical client certificates.

[0093] In the specific implementation of step S13, the management center of the credit data device inputs the spliced ​​data into a preset processing model so that the preset processing model processes the spliced ​​data and outputs the corresponding client certificate.

[0094] It should be noted that the client certificate serves as the client's unique credential and is therefore unique.

[0095] In this embodiment of the invention, when a newly connected client is detected to have completed registration, the credit data device obtains the client's device number, device name, and device location, and generates a client certificate based on the client's device number, device name, and device location, so that it can be used as a verification credential in the future.

[0096] Based on the structure of the verification system shown above, the specific implementation of the new client access process is as follows: Figure 3 The diagram shown is a flowchart illustrating another verification method according to an embodiment of the present invention. The method includes:

[0097] Step S301: The credit data device receives a trust access request initiated by the client, the trust access request carrying a pre-stored client certificate and device information;

[0098] In the specific implementation step S301, the management center of the credit data device checks the access device records of the authentication center to determine whether there is a trust access request initiated by the client. If so, the trust access request initiated by the client is obtained.

[0099] It should be noted that device information refers to information such as the client's device number, device name, and device location.

[0100] Step S302: Determine whether the device information carried in the trust access request already exists; if not, determine that the client is allowed to access the trust center and execute step S303; otherwise, it means that it already exists and there is no need to re-access the trust center, return to execute step S301, and continue to receive the next client's trust access request.

[0101] In the specific implementation of step S302, it is checked whether the device information of the connected client stored in the trust center is consistent with the device information carried in the trust access application. If they are inconsistent, it is determined that the client is allowed to access the trust center and step S303 is executed. Otherwise, it means that the client already exists and does not need to re-access the trust center. The process returns to step S301 and continues to receive the trust access request from the next client.

[0102] Optionally, after determining that the client is allowed to access the trust center, the device information of the new client is stored.

[0103] Step S303: Generate a target identifier based on the device information and client certificate, and return it to the client.

[0104] In the specific implementation step S303, the management center calls the identifier generation model to generate the corresponding target identifier based on the device information and the client certificate, and returns it to the client for storage.

[0105] It should be noted that the target identifier is a unique ID for the terminal.

[0106] The identifier generation model is generated in advance based on device information and client certificates of different historical clients, as well as the target identifier.

[0107] Besides the method shown in step S303, there are other ways to generate the target identifier.

[0108] In one implementation, a target identifier that uniquely identifies the client is randomly generated.

[0109] Optional, also includes:

[0110] Configure corresponding authentication and access control policies based on the client's device and customer information, so that the client can subsequently package the authentication and access control policies into the data packet.

[0111] Specifically, based on the client's device information and customer information, the system responds to the authentication policy and access permission policy set for the client; or, a preset permission generation model is invoked to generate the authentication policy and access permission policy based on the client's device information and customer information.

[0112] It should be noted that the preset permission generation model is trained and learned in advance based on the device information and customer information of historical clients, as well as the pre-labeled authentication policies and access permission policies.

[0113] The authentication policy includes which users can access the zero-trust network through this zero-trust terminal and is automatically sent to the authentication center for policy execution.

[0114] Access permission policies specify which application services a user can access through this terminal and are automatically sent to the target gateway for policy enforcement.

[0115] This application improves security by restricting terminal access permissions and assigning different access permission policies based on the physical location of the client.

[0116] In this embodiment of the invention, the credit data device receives a trust access request initiated by a client. The trust access request carries a pre-stored client certificate and device information. If the credit data device determines that the client is allowed to access the trust center based on the device information carried in the trust access request, it generates a target identifier based on the device information and the client certificate, and returns it to the client. This generates a unique target identifier that can identify the client using the device information and the client certificate.

[0117] Based on the structure of the verification system shown above, the specific implementation of the client login process is as follows: Figure 4 The diagram shown is a flowchart illustrating a verification method according to an embodiment of the present invention. The method includes:

[0118] Step S401: When the client responds to the user entering the target application, it obtains the current environment information of the client.

[0119] In the specific implementation step S401, when the client detects that the target application is in the open state, it obtains the environmental information of the current client.

[0120] It should be noted that the environmental information includes, but is not limited to, system security policies, patch installation status, virus scanning status, sensitive client behaviors, and client peripheral information.

[0121] Step S402: The client detects whether the environment of the device is safe based on the environmental information. If it is safe, then proceed to step S403; otherwise, return to step S401.

[0122] It should be noted that equipment environmental safety refers to whether the equipment is poisoned and whether there is any abnormal behavior.

[0123] In the specific implementation of step S402, the client determines whether the patch installation status and virus scanning status in the environment information are normal. If they are normal, it determines whether the client's sensitive behavior is empty. If it is empty, it determines whether there is an anomaly in the execution of the system security policy. If there is no anomaly, it indicates that the client has environmental security, and then step S403 is executed; otherwise, it returns to step S401.

[0124] Step S403: The client responds to the user's input user identity information and obtains the target identifier and client certificate.

[0125] The client certificate is generated by the credit data device based on the client's device number, device name, and device location, and the target identifier is generated by the credit data device based on the device information and the client certificate.

[0126] It should be noted that user identity information includes account and password, user identity information, etc.

[0127] In the specific implementation step S403, after receiving the user's identity information, the target identifier and client certificate stored on its own client are obtained.

[0128] Step S404: The client packages the user identity information, target identifier, client certificate, and environment information into a data packet and sends it to the credit processing device;

[0129] Step S405: The credit data device determines whether the user can access the target environment through the client based on the user identity information, target identifier, client certificate, identity credential, and environmental information in the data packet. If so, step S406 is executed; otherwise, it is determined that the client cannot access the target environment.

[0130] It should be noted that the specific implementation of step S405 includes the following steps.

[0131] Step S21: The credit data device determines whether the target identifier in the data packet is a valid ID. If it is, then proceed to step S22; otherwise, determine that the client cannot access the target environment.

[0132] In the specific implementation of step S21, the credit data device detects whether the target identifier generated by itself contains the target identifier in the data packet. If it does, it indicates that the target identifier is a valid ID and step S22 is executed. Otherwise, it determines that the client cannot access the target environment.

[0133] Step S22: The credit data device determines whether there is a correspondence between the target identifier and the client certificate in the data packet. If there is, then proceed to step S23; otherwise, determine that the client cannot access the target environment.

[0134] In the specific implementation of step S22, the credit data device detects whether the target identifier and client certificate corresponding to the device number of the client stored in the data packet are consistent with the target identifier and client certificate in the data packet. If they are consistent, it indicates that there is a corresponding relationship between the target identifier and the client certificate in the data packet, and step S23 is executed. Otherwise, it is determined that the client cannot access the target environment.

[0135] Step S23: The credit data device determines whether the environmental information in the data packet meets the preset criteria. If it does, then step S24 is executed; otherwise, it is determined that the client cannot access the target environment.

[0136] It should be noted that the preset criteria are standards set in advance based on the actual situation.

[0137] In the specific implementation of step S23, the credit data device determines whether the system security policy, patch installation status, virus scanning status, client sensitive behavior, and client peripheral information in the environment information of the data packet all meet the corresponding preset criteria. If they all meet the criteria, step S24 is executed; otherwise, it is determined that the client cannot access the target environment.

[0138] Step S24: The credit data device determines whether the user identity information in the data packet is correct. If it is correct, proceed to step S25. If it is incorrect, determine that the client cannot access the target environment.

[0139] In the specific implementation of step S24, the credit data device determines whether the user identity information in the data packet is consistent with the information during registration, such as whether the account and password are consistent. If they are consistent, it means that the user identity information is correct and step S25 is executed. Otherwise, it determines that the client cannot access the target environment.

[0140] Step S25: Determine that the user can access the target environment through the client.

[0141] It should be noted that the target environment is an environment in which multiple already connected clients and authorized application services are connected through a gateway.

[0142] Optionally, before performing step S25, the following may also be included:

[0143] Determine whether the authentication policy and access permission policy corresponding to the client allow the user to log in through the client. If so, determine that the client can access the target environment.

[0144] Step S406: Confirm that the client login was successful.

[0145] In the specific implementation of step S406, it is determined that the current user has successfully logged in through the client. Only then can the client access other authorized application services in the target environment; otherwise, it will be blocked by the gateway corresponding to the target environment.

[0146] It should be noted that authorized application services must satisfy both user permissions and terminal permissions.

[0147] In this embodiment of the invention, when a user enters the target application, the client obtains the current environment information of the client. Based on the environment information, the client determines that the environment is secure, responds to the user's input user identity information, and obtains the target identifier and client certificate. The client certificate is generated by the credit data device based on the client's device number, device name, and device location. The target identifier is generated by the credit data device based on the device information and client certificate. The client packages the user identity information, target identifier, client certificate, and environment information into a data packet and sends it to the credit processing device. The credit data device determines whether the user can access the target environment through the client based on the user identity information, target identifier, client certificate, identity credentials, and environment information in the data packet. This verifies the validity of the client entity, effectively prevents the access of counterfeit terminals, improves network security, and effectively prevents the use of other people's terminals by restricting the users who can log in to the terminal, thus improving security. If it is determined that the client can access the target environment, the client login is confirmed as successful. This application performs two-way authentication of user identity and client identity through the client and credit processing device to solve network security problems in industrial control networks by controlling user permissions and terminal permissions.

[0148] The specific principles and execution processes of each unit in the data flow control device disclosed in the above embodiments of the present invention are the same as the corresponding contents in the data flow control method provided in the above embodiments of the present invention. Please refer to the corresponding parts in the data flow control method disclosed in the above embodiments of the present invention, and they will not be repeated here.

[0149] This application provides an electronic device, which includes a processor and a memory. The memory is used to store data flow control program code and data, and the processor is used to call the program instructions in the memory to execute the steps shown in the data flow control method in the above embodiments.

[0150] This invention provides a storage medium, which includes the electronic device provided in the above-described embodiments of this application. The electronic device is used to execute the data flow control method disclosed in the embodiments of this application.

[0151] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0152] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0153] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A terminal authentication method characterized by comprising: The application is applied to a terminal verification system, the system comprises a client and a credit processing device, and the method comprises the following steps: The client acquires environment information in which the client is located in response to a user entering a target application; The client determines that the environment is safe based on the environment information, responds to user identity information input by the user, and acquires a target identifier and a client certificate, wherein the client certificate is generated by the credit data device based on a device number, a device name and a device location of the client, and the target identifier is generated by the credit data device based on the device information and the client certificate; The client packs the user identity information, the target identifier, the client certificate and the environment information to generate a data packet, and sends the data packet to the credit processing device; The credit data device determines whether the user can access the target environment through the client based on the user identity information, the target identifier, the client certificate, an identity credential and the environment information in the data packet; If it is determined that the client can access the target environment, it is determined that the client logs in successfully, and the client is displayed.

2. The method of claim 1, wherein, Further comprising: The credit data device acquires the device number, the device name and the device location of the client when detecting that a new client is registered; The credit data device generates the client certificate based on the device number, the device name and the device location of the client, and sends the client certificate to the client for storage.

3. The method of claim 2, wherein, The credit data device generates the client certificate based on the device number, the device name and the device location of the client, comprising: Determine a corresponding device reference value based on the device name and the device location; Encode the device reference value and the device number respectively, splice the encoded device reference value and the device number, and obtain spliced data; Call a preset processing model to process the spliced data to output the corresponding client certificate.

4. The method of claim 1, wherein, Further comprising: The credit data device receives a trust access application initiated by the client, wherein the trust access application carries a preset stored client certificate and device information; If the credit data device determines that the client is allowed to access a trust center based on the device information carried in the trust access application, the credit data device generates a target identifier based on the device information and the client certificate, and returns the target identifier to the client.

5. The method of claim 1, wherein, The credit data device determines whether the user can access the target environment through the client based on the user identity information, the target identifier, the client certificate, an identity credential and the environment information in the data packet, comprising: The credit data device determines whether the target identifier in the data packet is a valid ID based on the target identifier in the data packet; If yes, the credit data device determines whether the target identifier in the data packet and the client certificate have a corresponding relationship; If yes, the credit data device determines whether the environment information in the data packet meets a preset criterion; The credit data device determines whether the user identity information in the data packet is correct; If correct, the user can access the target environment through the client.

6. The method of claim 5, wherein, Further comprising: Configure corresponding authentication strategies and access permission strategies based on the device information and the client information of the client.

7. A terminal verification system characterized by comprising: The application is applied to a verification system, and the system comprises a client and a credit processing device; The client is used to acquire environment information of the current client when a user enters a target application; Based on the environment information, it is determined that the environment is safe, and user identity information input by the user is responded to, and a target identifier and a client certificate are acquired, the client certificate is generated by the credit data device based on a device number, a device name and a device location of the client, the target identifier is generated by the credit data device based on device information and the client certificate; the user identity information, the target identifier and the client certificate and the environment information are packaged to generate a data packet, and the data packet is sent to the credit processing device; The credit data device is used to determine whether the user can access a target environment through the client based on the user identity information, the target identifier, the client certificate and the identity certificate and the environment information in the data packet; if it is determined that the client accesses the target environment, it is determined that the client logs in successfully.

8. The system of claim 7, wherein, The credit data device is further used to: When a new client registration is detected to be completed, a device number, a device name and a device location of the client are acquired; A client certificate is generated based on the device number, the device name and the device location of the client, and the client certificate is sent to the client for storage.

9. An electronic device, comprising: The electronic device comprises a processor and a memory, the memory is used to store program codes and data of cooperative privacy protection of an electric load, and the processor is used to call program instructions in the memory to execute the terminal verification method in any one of claims 1-6.

10. A storage medium, characterized by The storage medium comprises a program, wherein when the program runs, the device where the storage medium is located is controlled to execute the terminal verification method in any one of claims 1-6.

Images