Terminal authentication strength adjustment method and device, storage medium and product

Abstract

The invention discloses a terminal authentication strength adjustment method and device, a storage medium and a product, and relates to the technical field of security certification, and the method comprises the steps: collecting operation state data of a user terminal, inputting the operation state data to a preset risk assessment model, and generating an operation risk score; extracting login information from the login process of the user terminal based on the target dimension, and generating a login risk assessment result based on the login information; and determining a login risk level of the user terminal based on the operation risk score and the login risk assessment result, and executing an authentication strategy with corresponding intensity on the user terminal according to the login risk level. The authentication strength is dynamically adjusted through the operation state data and the login risk assessment result, so that the user experience is improved by password-free login in a low-risk scene, the basic safety is guaranteed by adopting conventional authentication in a medium-risk scene, the system protection is enhanced by forcing multi-factor authentication in a high-risk scene, the self-adaptive adjustment of the authentication strength is realized, and the user experience is improved. And the security of the system and the user satisfaction are obviously improved.

Description

Technical Field

[0001] This application relates to the field of security authentication technology, and in particular to a method, device, storage medium and product for adjusting terminal authentication strength. Background Technology

[0002] In today's digital age, application systems have become deeply integrated into people's work and lives. Authentication, as the first line of defense for application system security, plays a crucial role in balancing security and user experience. A reliable authentication mechanism can effectively resist unauthorized access and ensure the security of system data and user information. Conversely, a convenient authentication experience directly impacts user acceptance and efficiency of application systems. The synergistic optimization of both is a core prerequisite for the stable operation and widespread adoption of application systems. In traditional technologies, application systems commonly use static passwords and SMS verification codes as the primary authentication methods. Users complete identity verification by entering a preset password or receiving and entering an SMS verification code. The system then compares and verifies the authentication information submitted by the user to determine whether access is permitted.

[0003] However, in traditional technologies, the authentication process is mechanically repetitive and rigid, failing to differentiate and evaluate key information that reflects the security level of access, such as the user's access terminal, login time, geographical location, and historical behavior. This results in the authentication strength being unable to be dynamically adjusted according to actual risk scenarios. Summary of the Invention

[0004] The main purpose of this application is to provide a method, device, storage medium and product for adjusting terminal authentication strength, which aims to solve the technical problem that the authentication strength cannot be dynamically adjusted according to the actual risk scenario due to the mechanical rigidity of the authentication process in traditional technical solutions.

[0005] To achieve the above objectives, this application proposes a method for adjusting terminal authentication strength, the method comprising: Collect the operating status data of the user terminal, input the operating status data into a preset risk assessment model, and generate the operating risk score of the user terminal; Login information is extracted from the user terminal login process based on the target dimension, and a login risk assessment result is generated based on the login information; Based on the operational risk score and the login risk assessment result, the login risk level of the user terminal is determined, and an authentication policy of corresponding strength is implemented on the user terminal according to the login risk level.

[0006] In one embodiment, the target dimension includes at least one of login time dimension, login address dimension, and login device dimension, and the login risk assessment result includes at least one of first assessment result, second assessment result, login address risk result, and login device risk result; The steps of extracting login information from the user terminal's login process based on the target dimension and generating a login risk assessment result based on the login information include: When the target dimension includes the login time dimension, login timestamp information is extracted from the login process of the user terminal based on the login time dimension, and the first evaluation result and the second evaluation result are generated based on the login timestamp information, wherein the login timestamp information is used to constitute the login information; When the target dimension includes the login address dimension, the Internet Protocol address is extracted from the login process of the user terminal based on the login address dimension, and the login address risk result is generated based on the Internet Protocol address, wherein the Internet Protocol address is used to constitute the login information; When the target dimension includes the login device dimension, device hardware feature information and device software feature information are extracted from the login process of the user terminal based on the login device dimension. The login device risk result is generated based on the device hardware feature information and the device software feature information. The device hardware feature information and the device software feature information are used to constitute the login information.

[0007] In one embodiment, the step of generating the first evaluation result and the second evaluation result based on the login timestamp information includes: The login timestamp information is matched with a preset normal login time period to obtain a time matching result, wherein the time matching result includes a successful match or a failed match. If the time matching result is a successful match, the first evaluation result is generated based on the time matching result; If the time matching result is a failure, calculate the time deviation between the login timestamp information and the preset normal login time period; The second evaluation result is generated based on the duration of the time deviation.

[0008] In one embodiment, the step of generating the login address risk result based on the Internet Protocol address includes: The Internet Protocol address is parsed to obtain the geographical location information and / or access network segment information of the user terminal; The geographic location information is matched with the preset historical frequently used login geographic locations, the spatial deviation is calculated and / or it is determined whether the access network segment information belongs to the preset trusted access network segment to obtain the access network segment trustworthiness; The login address risk result is generated based on the spatial deviation and / or the access network segment credibility.

[0009] In one embodiment, the step of generating the login device risk result based on the device hardware feature information and the device software feature information includes: The device hardware and software features are matched with preset security device information to obtain the login device matching result; Based on the login device matching results, a login device risk result is generated.

[0010] In one embodiment, the step of determining the login risk level of the user terminal based on the operational risk score and the login risk assessment result includes: When the operational risk score is in a preset low-risk range, and the first assessment result, the login address risk result, and the login device risk result all meet the preset low-risk conditions, the login risk level of the user terminal is determined to be low-risk. When the operational risk score is in the preset medium-risk range, or when any one of the second assessment result, the login address risk result, and the login device risk result meets the preset medium-risk condition, the login risk level of the user terminal is determined to be medium-risk. When the operational risk score is in a preset high-risk range, or when any one of the second assessment result, the login address risk result, and the login device risk result meets the preset high-risk condition, the login risk level of the user terminal is determined to be high-risk.

[0011] In one embodiment, the step of implementing an authentication policy of appropriate strength for the user terminal based on the login risk level includes: If the login risk level is low, a passwordless authentication policy will be implemented. If the login risk level is medium risk, a standard authentication strategy will be implemented. If the login risk level is high, a multi-factor authentication strategy will be implemented.

[0012] In addition, to achieve the above objectives, this application also proposes an electronic device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the terminal authentication strength adjustment method as described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the terminal authentication strength adjustment method described above.

[0014] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the terminal authentication strength adjustment method described above.

[0015] One or more technical solutions proposed in this application have at least the following technical effects: In this embodiment, by collecting the operating status data of the user terminal and inputting the operating status data into a preset risk assessment model, an operating risk score for the user terminal is generated. Login information is extracted from the user terminal's login process based on a target dimension, and a login risk assessment result is generated based on the login information. Based on the operating risk score and the login risk assessment result, the login risk level of the user terminal is determined, and an authentication strategy of corresponding strength is executed on the user terminal according to the login risk level. By inputting the operating status data into the preset risk assessment model to generate an operating risk score, a quantitative assessment of the user terminal's own security status is achieved, accurately reflecting whether the user terminal has security risks. Determining the user terminal's login risk level based on the operating risk score and the login risk assessment result integrates the user terminal's operating status and login context information, avoiding the limitations of relying solely on a single dimension for risk assessment. Executing an authentication strategy of corresponding strength on the user terminal according to the login risk level ensures accurate matching of authentication strength with actual risk scenarios, solving the problem that static authentication methods cannot dynamically adjust authentication strength. This allows the user terminal's authentication strength to be dynamically adjusted according to actual risk scenarios, significantly improving the system's security protection effect and user experience. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1This is a flowchart illustrating an embodiment of the terminal authentication strength adjustment method in this application. Figure 2 A flowchart illustrating the process for determining the login risk level of a user terminal, provided in this application; Figure 3 This is a flowchart illustrating Embodiment 2 of the terminal authentication strength adjustment method in this application. Figure 4 A flowchart illustrating the terminal authentication strength adjustment method provided in this application; Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the terminal authentication strength adjustment method in this application embodiment.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution of this application embodiment is as follows: collect the operating status data of the user terminal, input the operating status data into a preset risk assessment model, and generate the operating risk score of the user terminal; extract login information from the login process of the user terminal based on the target dimension, and generate a login risk assessment result based on the login information; determine the login risk level of the user terminal based on the operating risk score and the login risk assessment result, and implement an authentication policy of corresponding strength for the user terminal according to the login risk level.

[0023] In today's digital age, application systems have become deeply integrated into people's work and lives. Authentication, as the first line of defense for application system security, plays a crucial role in balancing security and user experience. A reliable authentication mechanism can effectively resist unauthorized access and ensure the security of system data and user information. Conversely, a convenient authentication experience directly impacts user acceptance and efficiency of application systems. The synergistic optimization of both is a core prerequisite for the stable operation and widespread adoption of application systems. In traditional technologies, application systems commonly use static passwords and SMS verification codes as the primary authentication methods. Users complete identity verification by entering a preset password or receiving and entering an SMS verification code. The system then compares and verifies the authentication information submitted by the user to determine whether access is permitted.

[0024] However, in traditional technologies, the authentication process is mechanically repetitive and rigid, failing to differentiate and evaluate key information that reflects the security level of access, such as the user's access terminal, login time, geographical location, and historical behavior. This results in the authentication strength being unable to be dynamically adjusted according to actual risk scenarios.

[0025] This application provides a solution that collects operational status data from user terminals, inputs this data into a preset risk assessment model to generate an operational risk score for the user terminal, extracts login information from the user terminal's login process based on a target dimension, and generates a login risk assessment result based on this information, determines the login risk level of the user terminal based on the operational risk score and the login risk assessment result, and then applies an authentication strategy of appropriate strength to the user terminal according to the login risk level. By inputting operational status data into a preset risk assessment model to generate an operational risk score, a quantitative assessment of the user terminal's own security status is achieved, accurately reflecting whether the user terminal has security risks. Determining the login risk level of the user terminal based on the operational risk score and the login risk assessment result integrates the user terminal's operational status and login context information, avoiding the limitations of relying on only a single dimension for risk assessment. Applying an authentication strategy of appropriate strength to the user terminal according to the login risk level ensures a precise match between authentication strength and actual risk scenarios, solving the problem that static authentication methods cannot dynamically adjust authentication strength. This allows the authentication strength of the user terminal to be dynamically adjusted according to actual risk scenarios, significantly improving the system's security protection effect and user experience.

[0026] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer or personal computer, or an electronic device capable of performing the above functions. The following description uses a computing service device as an example to illustrate this embodiment and the subsequent embodiments.

[0027] Based on this, embodiments of this application provide a method for adjusting terminal authentication strength, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the terminal authentication strength adjustment method of this application.

[0028] In this embodiment, the terminal authentication strength adjustment method includes steps S10~S30: Step S10: Collect the operating status data of the user terminal, input the operating status data into the preset risk assessment model, and generate the operating risk score of the user terminal; It should be noted that in traditional technical solutions, application systems generally use static passwords or SMS verification codes for user authentication, failing to differentiate based on contextual factors reflecting access trustworthiness, such as the user's terminal's real-time security status, login time, login location, and device information. For example, whether a user logs into the system using their regular office terminal during normal working hours and at a fixed location, or using an unfamiliar terminal outside of working hours and from a different location, the same authentication process is executed. This rigid authentication method results in redundant authentication processes for low-risk access, degrading user experience and inducing weak password behavior, while lacking strong protection against high-risk access and struggling to cope with dynamic threats such as terminal hijacking, phishing attacks, and password stuffing attacks.

[0029] Additionally, it should be noted that runtime status data refers to data reflecting the current security and health status of the user terminal, including process running status, system vulnerability patching status, malware detection results, and network connection security. Process running status indicates the presence of abnormal or suspicious background processes. System vulnerability patching status indicates the presence of unpatched high-risk system vulnerabilities. Malware detection results indicate whether viruses, Trojans, or other malicious programs have been detected. Network connection security indicates whether the current network is encrypted and whether there are abnormal port connections. The preset risk assessment model refers to a quantitative assessment model trained using machine learning. Its input is standardized runtime status feature data, and its output is a continuous score ranging from 0 to 100. This model can be built based on algorithms such as random forests and gradient boosting trees, and deployed and run on a backend risk assessment server. The runtime risk score is a quantitative representation of the user terminal's security status by this model, and its value range can be divided into low risk (0-30), medium risk (30-60), and high risk (60-100).

[0030] Additionally, it should be noted that a risk detection agent deployed on the user terminal collects the user terminal's operational status data. The risk detection agent is a lightweight software module deployed in the user terminal's operating system kernel or user space, possessing permissions for process monitoring, system call interception, network connection scanning, and log reading, used to acquire real-time user terminal operational status data. The operational status data is a raw data stream that is unaggregated, unweighted, and untime-normalized. A collection action is triggered at a fixed sampling period (e.g., every 30 seconds), and the data is uploaded to the backend server after encryption and encapsulation. After collecting the raw data stream, preprocessing is performed to obtain standard feature data. Preprocessing may involve cleaning, standardizing, and structuring the raw operational status data to eliminate noise interference, unify dimensions, and adapt to the model input format. Standard feature data refers to a numerical feature vector with fixed dimensions and clear semantics formed after preprocessing. The standard feature data is input into a preset risk assessment model, which evaluates and quantifies the standard feature data to obtain the user terminal's operational risk score. The pre-defined risk assessment model refers to a machine learning model that has completed offline training and validation. Its structure is a random forest classifier or a gradient boosting tree model. This model uses a labeled sample set for supervised learning during the training phase. Evaluation quantification refers to the model receiving standard feature data and outputting a continuous scalar score. This score reflects the model's probabilistic judgment of the overall operational risk level of the current user terminal, rather than a discrete category prediction. The operational risk score ranges from 0 to 100.

[0031] Understandably, a risk detection agent deployed on user terminals collects operational status data in real time and uploads it to a backend risk assessment server via an encrypted channel. The server cleans, extracts features, and standardizes the raw data to obtain standard feature data. This standard feature data is then input into a pre-trained risk assessment model, which performs quantitative assessment and outputs an operational risk score. By collecting multi-source, heterogeneous terminal operational status data and performing quantitative assessment based on the pre-defined risk assessment model, the operational risk score accurately represents the security status of the user terminal, providing reliable data for subsequent risk level determination.

[0032] Step S20: Extract login information from the user terminal login process based on the target dimension, and generate login risk assessment results based on the login information; It should be noted that target dimensions refer to the key contextual attributes used to characterize the credibility of user login behavior, including login time, login address, and login device dimensions. Login information under the login time dimension can be login timestamp information; login information under the login address dimension can be an Internet Protocol address; login information under the login device dimension can be device hardware characteristics and device software characteristics. Device hardware characteristics can be CPU model, hard drive serial number, network card MAC address, and motherboard serial number; device software characteristics can be operating system version and patch status, browser type and version, and installed security software information. The login risk assessment result refers to the risk representation output generated for each target dimension, reflecting the degree to which login behavior deviates from the normal pattern under that dimension.

[0033] Understandably, when a user initiates a login request, the system simultaneously captures the login timestamp, internet protocol address, and device hardware and software characteristics. The internet protocol address is geolocated and / or the intranet segment is identified to obtain geographical location information and / or access network segment information. The device hardware and software characteristics are hashed and compared with a historically bound device database to output device matching results. Finally, corresponding risk assessment results are generated for each dimension. By collecting and analyzing information covering the three typical risk dimensions of time, address, and device, the login risk assessment results can characterize the anomalies of access behavior from multiple angles and with fine granularity, providing input support for risk level determination.

[0034] In one feasible implementation, the target dimension includes at least one of the login time dimension, login address dimension, and login device dimension, and the login risk assessment result includes at least one of the first assessment result, second assessment result, login address risk result, and login device risk result; The steps for extracting login information from the user terminal login process based on the target dimension and generating login risk assessment results based on the login information include steps A11 to A13: Step A11: If the target dimension includes the login time dimension, extract the login timestamp information from the login process of the user terminal based on the login time dimension, and generate the first evaluation result and the second evaluation result based on the login timestamp information. The login timestamp information is used to constitute the login information. It should be noted that the login time dimension refers to the contextual risk dimension based on the absolute time point when the user initiates the login request. The login timestamp information refers to the precise time identifier automatically generated and recorded by the user's terminal operating system or application-layer authentication module at the moment the login request is triggered. This timestamp information is used to characterize the specific moment when this login behavior occurred. The first evaluation result is a login risk assessment sub-item generated when the time matching result is successful, used to characterize that this login conforms to the user's normal behavior pattern in the time dimension. The second evaluation result is a login risk assessment sub-item generated when the time matching result is unsuccessful, used to characterize that this login has an anomaly in the time dimension. Its value depends on the subsequently calculated time deviation duration and is not directly equal to the unsuccessful matching itself.

[0035] Step A12: If the target dimension includes the login address dimension, extract the Internet Protocol address from the login process of the user terminal based on the login address dimension, generate the login address risk result based on the Internet Protocol address, and use the Internet Protocol address to constitute the login information; It should be noted that the Internet Protocol address refers to the network layer identifier address presented to the outside world by the user terminal in this login session, which can be an IPv4 address or an IPv6 address.

[0036] Step A13: When the target dimension includes the login device dimension, extract device hardware feature information and device software feature information from the user terminal login process based on the login device dimension, generate login device risk results based on the device hardware feature information and device software feature information, and use the device hardware feature information and device software feature information to constitute login information.

[0037] It should be noted that device hardware characteristic information refers to hardware parameters that can identify or distinguish a physical device entity, and may include the CPU model, hard drive serial number, network interface card (NIC) media access control address, and motherboard serial number. Device software characteristic information refers to software parameters that reflect the current operating environment status of the device, and may include the operating system name and version number, operating system patch installation status, browser type and version number, and the name and running status of installed security software.

[0038] It is understandable that by simultaneously collecting both hardware and software features of a device to construct a device identity profile, not only can the inherent attributes of the device be covered, but also its current operating status, thus avoiding misjudgments of device identity caused by relying on only a single field.

[0039] In one feasible implementation, the steps of generating the first evaluation result and the second evaluation result based on the login timestamp information include steps A21 to A24: Step A21: Match the login timestamp information with the preset normal login time period to obtain the time matching result, which includes whether the match is successful or unsuccessful. It should be noted that the preset normal login time period refers to one or more continuous time intervals determined based on statistical analysis of the user's historical login behavior after registration or first successful login, or configured by the user themselves, such as "08:00–12:00" and "13:00–18:00". Its time granularity is at the hour or minute level, and it supports setting different time periods for weekdays and holidays. The time matching result refers to the output result after mapping the login timestamp information to the preset normal login time period. Its status condition is either successful matching or failed matching. Successful matching means that the login timestamp falls within any preset normal login time period, while failed matching means that the login timestamp does not fall within any preset normal login time period. Matching login timestamp information with preset normal login time periods means judging whether the time point corresponding to the login timestamp information falls within the preset normal login time period. This enables rapid screening of time risks and avoids performing complex calculations for all login requests.

[0040] Specifically, after parsing the login timestamp information into a standard time object, it iterates through the start and end times of each segment in the preset normal login time period, and determines whether the time point of the standard time object satisfies the logical relationship of being greater than or equal to the start time and less than or equal to the end time. If any segment satisfies this relationship, the system outputs a successful match.

[0041] Step A22: If the time matching result is successful, generate the first evaluation result based on the time matching result; It should be noted that when the time matching result is successful, that is, when the login timestamp of the user terminal falls within any preset normal login time period, the first evaluation result is directly generated based on the time matching result. In other words, the first evaluation result can indicate that the user performed the login operation under low risk.

[0042] Step A23: If the time matching result is a failure, calculate the time deviation between the login timestamp information and the preset normal login time period. It should be noted that the time deviation duration refers to the absolute value of the shortest time distance between the login timestamp and the preset normal login time period, used to characterize the severity of time anomalies. The calculation of this time deviation duration needs to consider cross-day scenarios (e.g., if the preset time period is "22:00–06:00" and the login time is "07:30", then the shortest deviation should be 1.5 hours, not 13.5 hours). This time deviation duration serves as the basis for generating the second assessment result and is a key intermediate variable for achieving time risk gradient classification.

[0043] Specifically, for each preset normal login time period, the difference between the login timestamp and the start time of that time period and the difference between the login timestamp and the end time of that time period are calculated, and the minimum of the two absolute values ​​is taken.

[0044] Step A24: Generate a second evaluation result based on the time deviation duration.

[0045] It should be noted that the duration of time deviation is taken as input and transformed into a second assessment result with risk level semantics through a preset mapping rule. This mapping rule can be a piecewise linear function (e.g., deviation less than or equal to 30 minutes maps to medium risk, greater than 30 minutes to high risk) or a lookup table method (e.g., deviation of 0 to 60 minutes corresponds to a risk coefficient of 1.2, 60 to 180 minutes to 1.8, and greater than 180 minutes to 3.0). The output is a numerical risk score (0 to 100). This second assessment result differs from the first assessment result and is specifically used to characterize the intensity of time-dimension anomalies.

[0046] Understandably, by assessing the risk of login time, a refined characterization of time anomalies is achieved. When the time matching result is successful, a first assessment result is directly generated, indicating low risk. When the matching fails, instead of directly classifying it as high risk, the duration of time deviation is introduced as a continuous intermediate variable, and a second assessment result with gradient discrimination is generated accordingly. This avoids directly classifying "working overtime until 8:00 PM" and "malicious login at 3:00 AM" into the same risk level. This makes the time-dimensional risk output highly efficient, significantly improving the accuracy and practicality of time-dimensional risk identification.

[0047] In one feasible implementation, the step of generating login address risk results based on Internet Protocol addresses includes steps A31-A33: Step A31: Resolve the Internet Protocol address to obtain the user terminal's geographical location information and / or access network segment information; It should be noted that resolving Internet Protocol addresses refers to performing address semantic restoration processing based on the IP address lookup service.

[0048] Specifically, this can be achieved by calling a locally deployed offline IP geospatial database to match the corresponding city-level administrative division, latitude and longitude coordinates, and geographical information based on the IP address prefix. Alternatively, it can be achieved by connecting to a third-party IP location service, submitting the IP address to the server in the form of an HTTPS request, receiving the returned structured response, and extracting the geographical location information and accuracy level identifier.

[0049] Step A32: Match the geographic location information with the preset historical frequently used login geographic locations, calculate the spatial deviation and / or determine whether the access network segment information belongs to the preset trusted access network segment, and obtain the access network segment trustworthiness. It should be noted that the preset historical frequently used login geographic locations refer to the cumulative set of geographic locations formed from a user's historical successful login behavior. Each geographic location is stored in the form of latitude and longitude coordinates or standard administrative division codes, and associated with a timestamp and the frequency of occurrence of that geographic location. Spatial deviation is a technical indicator that quantifies the difference between the current geographic location and historical frequently used locations. Its calculation method includes: if both are latitude and longitude coordinates, the spatial deviation can be the spherical distance between the two points, in kilometers. If one is an administrative division code, the spatial deviation can be the deviation value of the administrative level (different cities within the same province are recorded as level 1 deviation, and different provinces are recorded as level 2 deviation). The preset trusted access network segment refers to the whitelist of internal network address ranges that are pre-configured and maintained by the administrator and allowed to access low-risk networks. The access network segment trustworthiness is a numerical judgment result. Its generation logic includes: when the access network segment information completely matches any preset trusted access network segment, the trustworthiness is true (or assigned a value of 1); when the access network segment information does not completely match any preset trusted access network segment, the trustworthiness is false (or assigned a value of 0).

[0050] Step A33: Generate login address risk results based on spatial deviation and / or access network segment credibility.

[0051] It should be noted that the login address risk result is a structured output reflecting the security level of the current login address dimension. Its presentation can be a risk level label (e.g., "low risk," "medium risk," "high risk"), a risk score (a continuous value from 0 to 100), or a risk vector ([spatial deviation, access network segment credibility]). When only the geographic location path is enabled, the login address risk result can be mapped based on the spatial deviation: a spatial deviation less than or equal to 5km is mapped to low risk, greater than 5km and less than or equal to 50km is mapped to medium risk, and greater than 50km is mapped to high risk. When only the access network segment path is enabled, the login address risk result can be directly determined based on the access network segment credibility: a true credibility result indicates low risk, and a false credibility result indicates medium risk. When the geographic location path and access network segment path work together, the login address risk result is generated through a weighted combination, and the risk score equals α × normalized spatial deviation + β × (1 / 2)^2. The access network segment credibility), where α and β are non-negative weight coefficients and α+β=1, the normalized spatial deviation is the value of the deviation distance after linear scaling to the [0,1] interval, and the risk level is finally determined according to the threshold interval into which the risk score falls.

[0052] Understandably, by resolving Internet Protocol addresses into geographic location information and / or access network segment information, continuous quantitative assessment of geographic location risk is achieved through spatial deviation, and precise control of intranet access policies is realized based on preset trusted access network segments. It supports independent output or weighted fusion of risk results from the geographic and network segment dimensions, breaking through the limitations of traditional IP blacklist and whitelist mechanisms. This makes the risk determination at the login address dimension accurate, flexible, and configurable, thereby improving the overall login risk assessment's discriminative power and decision robustness.

[0053] In one feasible implementation, the step of generating a login device risk result based on device hardware characteristic information and device software characteristic information includes steps A41-A42: Step A41: Match the device hardware feature information and device software feature information with the preset security device information to obtain the login device matching result; It should be noted that the preset security device information refers to the set of device information historically authorized and bound by the user, stored in the device trust database of the authentication server. Each record includes a unique device identifier, associated user ID, and binding timestamp. The login device matching result is a structured output, including three states: complete match, partial match, and no match. A complete match means that all hardware characteristics are identical and key software characteristic fields (such as OS major version and browser major version) are identical. A partial match means that at least one key hardware characteristic field (such as MAC address or hard drive serial number) is identical, but there are non-critical differences in software characteristics (such as different patch numbers or minor browser version updates). A no match means that no key hardware characteristic fields are identical, or all key software characteristic fields are inconsistent.

[0054] Step A42: Generate login device risk results based on login device matching results.

[0055] It should be noted that the login device risk result refers to the risk level characterizing the trustworthiness of the currently logged-in device, including three levels: low risk, medium risk, and high risk. A complete match corresponds to low risk, indicating that the device is a frequently used and stable device in the user's history. A partial match corresponds to medium risk, indicating that the device entity is trustworthy but environmental changes have occurred (such as system upgrades or browser updates), requiring enhanced verification. A no-match corresponds to high risk, indicating that the device is not registered in the user's authorized list, or that critical hardware information has been tampered with, posing a risk of virtual machine spoofing, remote control, or device theft.

[0056] Understandably, by mapping the login device matching results to hierarchical risk outputs, device-level risks become interpretable and decision-making, providing accurate input basis for determining login risk levels.

[0057] Furthermore, by extracting device hardware and software features, comprehensive device identity information is constructed. Through hierarchical matching with preset security device information, the login device matching results are categorized into three states: complete match, partial match, and no match. Then, a graded risk assessment of the login device is generated based on the matching state. Without relying on external authentication facilities, this significantly enhances the granularity and robustness of device-level risk identification, effectively addressing typical attack scenarios such as virtual machine spoofing, remote desktop hijacking, and device sharing abuse. It also solves the problem of missed detection of device-level risks caused by the easy forgery of single device identity information, achieving accurate determination of login risk levels.

[0058] Step S30: Based on the operational risk score and login risk assessment results, determine the login risk level of the user terminal, and implement an authentication policy of corresponding strength for the user terminal according to the login risk level.

[0059] It should be noted that the login risk level refers to the classification result formed by integrating the operational risk score and the login risk assessment results of each target dimension, including low risk level, medium risk level, and high risk level. A low risk level indicates that the user terminal itself is secure and the login behavior is highly trustworthy; a medium risk level indicates a moderate anomaly in a single dimension, but the overall situation is still controllable; a high risk level indicates that the user terminal has serious security vulnerabilities or multiple dimensions are abnormal simultaneously, significantly increasing the threat level. The authentication strategy refers to the differentiated identity verification mechanism triggered based on the login risk level, including passwordless authentication strategy, regular authentication strategy, and multi-factor authentication strategy. A passwordless authentication strategy means that authentication can be completed without the user entering any credentials; a regular authentication strategy means that the user only needs to provide a static password; a multi-factor authentication strategy means that in addition to a static password, at least one independent authentication factor is required, which can include SMS verification code, dynamic token, biometrics, and hardware keys.

[0060] Understandably, the operational risk score is mapped to a preset risk range: 0-30 points indicate low risk, 30-60 points indicate medium risk, and 60-100 points indicate high risk. The login risk assessment results for each dimension are also mapped to corresponding risk conditions (e.g., successful time matching indicates low risk, and a time deviation greater than 2 hours indicates high risk). Then, a logical combination judgment is performed based on a preset matrix. When the operational risk score is in the low-risk range and all dimension risk assessment results meet the low-risk condition, it is judged as a low-risk level. When the operational risk score is in the medium-risk range, or any dimension meets the medium-risk condition, it is judged as a medium-risk level. When the operational risk score is in the high-risk range, or any dimension meets the high-risk condition, it is judged as a high-risk level. Finally, the corresponding authentication strategy is invoked to execute the authentication process based on the judgment result. By integrating the user terminal's operational risk score with the multi-dimensional login risk assessment results, the login risk level of the user terminal is determined, and three types of authentication strategies—passwordless, regular, and multi-factor—are accurately matched based on the login risk level, achieving a strict alignment between authentication strength and the actual risk level. By using a risk score to characterize the security status of the user terminal and a multi-dimensional login risk assessment result to characterize the trustworthiness of login access, the fundamental problem of incompatibility between security and usability caused by the rigidity of static authentication is solved through the synergy of the two. In low-risk scenarios, redundant authentication is eliminated to improve user experience; in medium-risk scenarios, basic passwords are retained to ensure basic security; and in high-risk scenarios, multi-factor authentication blocks potential attack paths.

[0061] In one feasible implementation, see Figure 2 , Figure 2 The flowchart for determining the login risk level of a user terminal provided in this application includes steps A51 to A53, based on the operational risk score and login risk assessment results: Step A51: When the operational risk score is in the preset low-risk range, and the first assessment result, login address risk result, and login device risk result all meet the preset low-risk conditions, the login risk level of the user terminal is determined to be low-risk. It should be noted that the operational risk score falling within the preset low-risk range means the operational risk score falls within the range of 0 to 30 points, which is determined by the quantitative results output by the preset risk assessment model. The first assessment result meeting the preset low-risk condition means that the first assessment result generated based on the time matching result in this application is a successful match, i.e., the login timestamp information is within the preset normal login time period, used to exclude interference from abnormal login behavior outside of working hours on the low-risk determination. The login address risk result meeting the preset low-risk condition means that the spatial deviation corresponding to the login address risk result generated in this application is below a threshold (e.g., less than or equal to 50 kilometers) and the access network segment credibility is true. Its purpose is to ensure that the geographical location is consistent with historically frequently used login locations and that the access network belongs to a trusted internal network segment. The login device risk result meeting the preset low-risk condition means that the login device risk result generated in this application is a successful match, i.e., the hardware and software characteristics of the current login device are completely consistent with the preset security device information, used to confirm that the current login terminal is a trusted device that the user has been using for a long time and has passed security verification. A low-risk determination is triggered only when all four conditions are met.

[0062] Specifically, the system sequentially reads four inputs: operational risk score, first assessment result, login address risk result, and login device risk result. First, it checks if the operational risk score is less than 30. If so, it further checks in parallel whether the first assessment result is a successful match, whether the login address risk result has a spatial deviation of less than or equal to 50 kilometers and the access network segment is trustworthy, and whether the login device risk result is a successful match. If all four conditions are met, a low-risk level indicator is output.

[0063] Step A52: When the operational risk score is in the preset medium risk range, or when any one of the second assessment result, login address risk result, and login device risk result meets the preset medium risk condition, the login risk level of the user terminal is determined to be medium risk level. It should be noted that an operational risk score within the preset medium-risk range means that the operational risk score falls within the range of 30 to 60 points, reflecting a moderate level of security risks on the terminal (such as unpatched medium-risk vulnerabilities or detected suspicious background processes). The second assessment result meeting the preset medium-risk condition means that the time deviation duration corresponding to the second assessment result generated in this application is within the preset medium-risk range (e.g., 1 hour greater than the time deviation duration but less than or equal to 4 hours). This indicates that although the login time deviates from the normal time period, it is still within a controllable range. Its purpose is to avoid being mistakenly judged as high-risk due to reasonable scenarios such as temporary overtime or cross-time zone travel. The login address risk result meeting the preset medium-risk condition means that the spatial deviation is within the medium-risk threshold range (e.g., 50 kilometers greater than the spatial deviation duration but less than or equal to 300 kilometers) or the access network segment's credibility is false but the geographical location is still in the same city. Its purpose is to identify medium-risk access behaviors such as remote work. The login device risk result meets the preset medium-risk condition when the device fails to match, but the similarity between the device's hardware and software characteristics and the preset security device information is higher than a threshold (e.g., greater than or equal to 85%). Its purpose is to distinguish between device replacement (such as upgrading a computer) and device impersonation (such as stealing someone else's device). Any of the above five inputs, if successful, will trigger the medium-risk determination.

[0064] Step A53: When the operational risk score is in the preset high-risk range, or when any one of the second assessment result, login address risk result, and login device risk result meets the preset high-risk condition, the login risk level of the user terminal is determined to be high-risk.

[0065] It should be noted that a high-risk operational score (over 60 points) indicates that the terminal has unpatched high-risk vulnerabilities, detected malicious programs, or is in an insecure network environment. A high-risk operational score (over 4 hours) indicates a time deviation from the normal operating hours (e.g., logging in at 2:00 AM, while the normal timeframe is 9:00 AM–6:00 PM), signifying a significant deviation from the user's regular routine and a high likelihood of account theft. A high-risk login address score (over 300 kilometers) indicates a spatial deviation from the normal network segment (public Wi-Fi without encryption), designed to identify high-risk access sources such as cross-regional attacks and phishing hotspots. A high-risk login device score (less than 70% similarity in hardware and software characteristics) indicates a failed device matching test or detection of a virtual machine / emulator environment, designed to block automated attacks or device spoofing. The highest level of protection response will be activated if any of these five high-risk signals are detected.

[0066] Understandably, by coordinating the operational risk score with the login risk assessment results, the output of the low-risk level must simultaneously meet four prerequisites: terminal operational security, time compliance, address trustworthiness, and device legitimacy, thus avoiding security degradation due to laxity at a single point. The medium-risk and high-risk levels, on the other hand, are configured with "OR" logic entry points for operational risk ranges and multi-dimensional anomaly conditions, ensuring that the protection strategy is upgraded promptly upon the occurrence of a substantial risk signal in any dimension. This constructs an interpretable, configurable, and robust risk decision matrix, providing a stable, reliable, and verifiable technical basis for the accurate execution of the differentiated authentication strategy in this application.

[0067] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 , Figure 3 This is a flowchart illustrating Embodiment 2 of the terminal authentication strength adjustment method of this application. The steps for implementing an authentication policy of corresponding strength for the user terminal based on the login risk level include steps A61 to A63: Step A61: If the login risk level is low, implement the passwordless authentication policy; It should be noted that a low-risk login level means the operational risk score is within a preset low-risk range, and the initial assessment result, login address risk result, and login device risk result all meet the preset low-risk conditions. Passwordless authentication strategy means that no authentication method is initiated for the user; the user does not need to provide a password, verification code, biometrics, or hardware key, and identity verification is completed directly, granting access permissions. It is suitable for high-confidence access scenarios where the terminal's operating status is trustworthy, the login time is reasonable, the geographical location matches, and the device information is consistent. It can eliminate redundant interactions in low-risk scenarios, reduce user operation complexity, and improve the smoothness of use.

[0068] Step A62: If the login risk level is medium risk, execute the standard authentication strategy. It should be noted that a login risk level of medium risk means that the operational risk score is within the preset medium risk range, or that any one of the second assessment result, login address risk result, and login device risk result meets the preset medium risk conditions. The standard authentication strategy refers to an authentication method that requires only the user to provide a single static identity credential. Authentication can be a combination of username and password, without additional dynamic factors or biometrics. This avoids over-authentication in low-risk scenarios and prevents unauthorized access due to missing authentication in medium-risk scenarios, achieving a balance between security and usability.

[0069] Step A63: If the login risk level is high, implement a multi-factor authentication strategy.

[0070] It should be noted that a high-risk login level means that the operational risk score is within the preset high-risk range, or that any one of the second assessment result, login address risk result, and login device risk result meets the preset high-risk conditions. Multi-factor authentication strategies refer to authentication methods that simultaneously verify at least two different categories of identity credential factors. Factor categories include knowledge factors (such as passwords), possession factors (such as SMS verification codes, dynamic tokens, and hardware keys), and biometric factors (such as fingerprints, facial recognition, and voiceprints). This significantly increases the cost and difficulty for attackers to impersonate individuals, forming an effective deterrent barrier against high-risk access behaviors.

[0071] Understandably, by strictly mapping login risk levels to three types of execution actions—passwordless authentication, regular authentication, and multi-factor authentication—authentication strength no longer relies on manual configuration or experience-based judgment, but is driven by both operational risk scores and login risk assessment results. Passwordless authentication eliminates interaction redundancy in low-risk scenarios, regular authentication ensures a minimum level of security in medium-risk scenarios, and multi-factor authentication safeguards high-risk scenarios. This achieves automation, differentiation, and adaptability in the authentication process, completely resolving the technical problem of the inability to dynamically adjust risk levels and authentication strategies based on actual risk scenarios.

[0072] For example, to help understand the implementation process of the terminal authentication strength adjustment method obtained by combining this embodiment with the above embodiment one, please refer to... Figure 4 , Figure 4 The flowchart below illustrates the overall process of the terminal authentication strength adjustment method provided in this application. When a user initiates a login request to a target application system via their terminal, a risk detection agent deployed on that terminal automatically starts and collects the terminal's operational status data. The collected operational status data is transmitted to the backend risk assessment server via an encrypted transmission channel. After preprocessing, the data is input into a preset risk assessment model to generate an operational risk score. The multi-dimensional context information collection module extracts login information from the target dimensions during the login process, including login time, login address, and login device dimensions. The corresponding login risk assessment results are obtained through evaluation of these three dimensions. The dynamic authentication strength decision engine receives the operational risk score and the login risk assessment results, determines the user terminal's login risk level (i.e., the comprehensive risk assessment range), and executes an authentication strategy of corresponding strength based on the determined login risk level. After verifying the corresponding authentication strategy, the login success result is returned to the user terminal; if authentication fails, a failure message is returned.

[0073] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the terminal authentication strength adjustment method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0074] This application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the terminal authentication strength adjustment method in Embodiment 1 above.

[0075] The following is for reference. Figure 5 The diagram illustrates a structural schematic of an electronic device suitable for implementing embodiments of this application. The electronic devices in these embodiments may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0076] like Figure 5 As shown, the electronic device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the electronic device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. While electronic devices with various systems are shown in the figures, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0077] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0078] The electronic device provided in this application, employing the terminal authentication strength adjustment method in the above embodiments, can solve the technical problem in traditional technical solutions where the authentication strength cannot be dynamically adjusted according to actual risk scenarios due to the mechanically fixed authentication process. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as those of the terminal authentication strength adjustment method provided in the above embodiments, and other technical features of this electronic device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0079] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0080] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0081] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the terminal authentication strength adjustment method in the above embodiments.

[0082] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0083] The aforementioned computer-readable storage medium may be included in an electronic device or may exist independently without being assembled into an electronic device.

[0084] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by an electronic device, the electronic device causes the electronic device to: collect operational status data of a user terminal, input the operational status data into a preset risk assessment model, and generate an operational risk score for the user terminal; extract login information from the login process of the user terminal based on a target dimension, and generate a login risk assessment result based on the login information; determine the login risk level of the user terminal based on the operational risk score and the login risk assessment result, and execute an authentication strategy of corresponding strength on the user terminal according to the login risk level.

[0085] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0086] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0087] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0088] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned terminal authentication strength adjustment method. This solves the technical problem in traditional solutions where the authentication process is mechanically fixed, preventing dynamic adjustment of authentication strength based on actual risk scenarios. Compared to existing technologies, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the terminal authentication strength adjustment method provided in the above embodiments, and will not be elaborated upon here.

[0089] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the terminal authentication strength adjustment method described above.

[0090] The computer program product provided in this application can solve the technical problem in traditional technical solutions where the authentication strength cannot be dynamically adjusted according to actual risk scenarios due to the mechanical rigidity of the authentication process. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the terminal authentication strength adjustment method provided in the above embodiments, and will not be repeated here.

[0091] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for adjusting terminal authentication strength, characterized in that, The terminal authentication strength adjustment method includes: Collect the operating status data of the user terminal, input the operating status data into a preset risk assessment model, and generate the operating risk score of the user terminal; Login information is extracted from the user terminal's login process based on the target dimension, and a login risk assessment result is generated based on the login information; Based on the operational risk score and the login risk assessment result, the login risk level of the user terminal is determined, and an authentication policy of corresponding strength is implemented on the user terminal according to the login risk level.

2. The terminal authentication strength adjustment method as described in claim 1, characterized in that, The target dimension includes at least one of login time dimension, login address dimension, and login device dimension, and the login risk assessment result includes at least one of first assessment result, second assessment result, login address risk result, and login device risk result; The steps of extracting login information from the user terminal's login process based on the target dimension and generating a login risk assessment result based on the login information include: When the target dimension includes the login time dimension, login timestamp information is extracted from the login process of the user terminal based on the login time dimension, and the first evaluation result and the second evaluation result are generated based on the login timestamp information, wherein the login timestamp information is used to constitute the login information; When the target dimension includes the login address dimension, the Internet Protocol address is extracted from the login process of the user terminal based on the login address dimension, and the login address risk result is generated based on the Internet Protocol address, wherein the Internet Protocol address is used to constitute the login information; When the target dimension includes the login device dimension, device hardware feature information and device software feature information are extracted from the login process of the user terminal based on the login device dimension. The login device risk result is generated based on the device hardware feature information and the device software feature information. The device hardware feature information and the device software feature information are used to constitute the login information.

3. The terminal authentication strength adjustment method as described in claim 2, characterized in that, The steps of generating the first evaluation result and the second evaluation result based on the login timestamp information include: The login timestamp information is matched with a preset normal login time period to obtain a time matching result, wherein the time matching result includes a successful match or a failed match. If the time matching result is a successful match, the first evaluation result is generated based on the time matching result; If the time matching result is a failure, calculate the time deviation between the login timestamp information and the preset normal login time period; The second evaluation result is generated based on the duration of the time deviation.

4. The terminal authentication strength adjustment method as described in claim 2, characterized in that, The step of generating the login address risk result based on the Internet Protocol address includes: The Internet Protocol address is parsed to obtain the geographical location information and / or access network segment information of the user terminal; The geographic location information is matched with the preset historical frequently used login geographic locations, the spatial deviation is calculated and / or it is determined whether the access network segment information belongs to the preset trusted access network segment to obtain the access network segment trustworthiness; The login address risk result is generated based on the spatial deviation and / or the access network segment credibility.

5. The terminal authentication strength adjustment method as described in claim 2, characterized in that, The step of generating the login device risk result based on the device hardware feature information and the device software feature information includes: The device hardware and software features are matched with preset security device information to obtain the login device matching result; Based on the login device matching results, a login device risk result is generated.

6. The terminal authentication strength adjustment method as described in claim 2, characterized in that, The step of determining the login risk level of the user terminal based on the operational risk score and the login risk assessment result includes: When the operational risk score is in a preset low-risk range, and the first assessment result, the login address risk result, and the login device risk result all meet the preset low-risk conditions, the login risk level of the user terminal is determined to be low-risk. When the operational risk score is in the preset medium-risk range, or when any one of the second assessment result, the login address risk result, and the login device risk result meets the preset medium-risk condition, the login risk level of the user terminal is determined to be medium-risk. When the operational risk score is in a preset high-risk range, or when any one of the second assessment result, the login address risk result, and the login device risk result meets the preset high-risk condition, the login risk level of the user terminal is determined to be high-risk.

7. The terminal authentication strength adjustment method as described in claim 6, characterized in that, The step of implementing an authentication policy of appropriate strength for the user terminal based on the login risk level includes: If the login risk level is low, a passwordless authentication policy will be implemented. If the login risk level is medium risk, a standard authentication strategy will be implemented. If the login risk level is high, a multi-factor authentication strategy will be implemented.

8. An electronic device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the terminal authentication strength adjustment method as described in any one of claims 1 to 7.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the terminal authentication strength adjustment method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the terminal authentication strength adjustment method as described in any one of claims 1 to 7.

Images