Device dynamic authentication method and device

Abstract

The application discloses a device dynamic authentication method and device, wherein, in the process that a gateway device authenticates a first terminal device based on a first authentication strategy set, authentication process information is acquired, wherein the first authentication strategy set comprises at least one authentication strategy; the security score of the first terminal device is determined based on the authentication process information; when the security score of the first terminal device is less than a first preset score, the authentication strategy in the first authentication strategy set is increased to obtain a second authentication strategy set; and the second authentication strategy set is sent, wherein the gateway device authenticates the gateway device based on the second authentication strategy set. In the process that the gateway device and the terminal device are authenticated, the authentication strategy is dynamically adjusted, the replay attack or the fraud is avoided, and thus the authentication security can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a method and apparatus for dynamic device authentication. Background Technology

[0002] In existing technologies, there are two main types of user authentication methods. One is based on scanning a QR code to confirm user check-in, requiring users to scan a specific QR code upon arrival at the merchant's location. The other is based on geolocation, using the location services on the user's mobile device to automatically detect whether the user has arrived at a specific merchant location. Existing authentication methods generally employ fixed authentication processes, and static authentication methods are susceptible to replay attacks or spoofing, resulting in low authentication security.

[0003] In other words, the authentication security of existing technologies is relatively low. Summary of the Invention

[0004] This application provides a device dynamic authentication method and apparatus, which can improve authentication security.

[0005] Firstly, the device dynamic authentication method provided in this application includes:

[0006] During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, authentication process information is obtained, wherein the first authentication policy set includes at least one authentication policy.

[0007] The security score of the first terminal device is determined based on the authentication process information.

[0008] When the security score of the first terminal device is less than the first preset score, the authentication strategy in the first authentication strategy set is added to obtain the second authentication strategy set.

[0009] Send the second authentication policy set, wherein the gateway device performs authentication with the gateway device based on the second authentication policy set.

[0010] In an optional embodiment, the authentication process information includes sub-dimensional information of multiple dimensions, and determining the security score of the first terminal device based on the authentication process information includes:

[0011] Obtain multiple pre-trained scoring models and their corresponding model weight coefficients, wherein the multiple scoring models are used to score sub-dimensional information of different dimensions;

[0012] The sub-dimensional information of multiple dimensions of the authentication process information is input into the corresponding decision number model to obtain the decision score corresponding to each sub-dimensional information.

[0013] The security score is obtained by weighting and summing the decision scores corresponding to each sub-dimension information based on the model weight coefficients corresponding to each scoring model.

[0014] In an optional embodiment, the device dynamic authentication method includes:

[0015] When the security score of the first terminal device is greater than the second preset score, the number of authentication strategies in the first authentication strategy set is reduced to obtain a third authentication strategy set, wherein the second preset score is higher than the first preset score.

[0016] The third authentication policy set is sent, wherein the gateway device authenticates the first terminal device based on the third authentication policy set.

[0017] In an optional embodiment, the device dynamic authentication method further includes:

[0018] Obtain the gateway type of the gateway device;

[0019] The gateway device determines a first authentication policy set based on its gateway type, wherein different gateway types correspond to different first authentication policy sets. When the first terminal device initiates an access request, the gateway device authenticates the first terminal device based on the first authentication policy set.

[0020] In an optional embodiment, the authentication process information includes real-time feature information of the first terminal device, offline feature information of the first terminal device, and gateway feature information of the gateway device.

[0021] Secondly, the device dynamic authentication method provided in this application includes:

[0022] Authentication is performed based on the first set of authentication strategies and the first terminal device;

[0023] When a second authentication policy is obtained, authentication is performed with the first terminal device based on the second authentication policy set. During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, the backend server obtains authentication process information. The first authentication policy set includes at least one authentication policy. A security score for the first terminal device is determined based on the authentication process information. When the security score is less than a first preset score, an authentication policy from the first authentication policy set is added to obtain a second authentication policy set. The second authentication policy set is then sent.

[0024] In an optional embodiment, the authentication with the first terminal device based on the second authentication strategy set includes:

[0025] Remove the completed authentication strategies from the second authentication strategy set to obtain the fourth authentication strategy set;

[0026] Authentication is performed on the first terminal device based on the fourth set of authentication strategies.

[0027] Thirdly, the device dynamic authentication device provided in this application includes:

[0028] The acquisition module is used to acquire authentication process information during the authentication process between the gateway device and the first terminal device based on the first authentication policy set, wherein the first authentication policy set includes at least one authentication policy.

[0029] The scoring module is used to determine the security score of the first terminal device based on the authentication process information.

[0030] The adjustment module is used to add authentication strategies from the first authentication strategy set to obtain a second authentication strategy set when the security score of the first terminal device is less than the first preset score.

[0031] The sending module is used to send the second authentication policy set, wherein the gateway device performs authentication with the gateway device based on the second authentication policy set.

[0032] In an optional embodiment, the authentication process information includes sub-dimensional information across multiple dimensions, and the scoring module is used for:

[0033] Obtain multiple pre-trained scoring models and their corresponding model weight coefficients, wherein the multiple scoring models are used to score sub-dimensional information of different dimensions;

[0034] The sub-dimensional information of multiple dimensions of the authentication process information is input into the corresponding decision number model to obtain the decision score corresponding to each sub-dimensional information.

[0035] The security score is obtained by weighting and summing the decision scores corresponding to each sub-dimension information based on the model weight coefficients corresponding to each scoring model.

[0036] In an optional embodiment, the adjustment module is configured to:

[0037] When the security score of the first terminal device is greater than the second preset score, the number of authentication strategies in the first authentication strategy set is reduced to obtain a third authentication strategy set, wherein the second preset score is higher than the first preset score.

[0038] The third authentication policy set is sent, wherein the gateway device authenticates the first terminal device based on the third authentication policy set.

[0039] In an optional embodiment, the acquisition module is configured to:

[0040] Obtain the gateway type of the gateway device;

[0041] The gateway device determines a first authentication policy set based on its gateway type, wherein different gateway types correspond to different first authentication policy sets. When the first terminal device initiates an access request, the gateway device authenticates the first terminal device based on the first authentication policy set.

[0042] In an optional embodiment, the authentication process information includes real-time feature information of the first terminal device, offline feature information of the first terminal device, and gateway feature information of the gateway device.

[0043] Fourthly, the device dynamic authentication device provided in this application includes:

[0044] The first authentication module is used to perform authentication with the first terminal device based on the first authentication strategy set.

[0045] The second authentication module is used to authenticate the first terminal device based on the second authentication policy set when a second authentication policy is obtained. During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, the backend server obtains authentication process information. The first authentication policy set includes at least one authentication policy. Based on the authentication process information, the backend server determines a security score for the first terminal device. When the security score is less than a first preset score, it adds an authentication policy from the first authentication policy set to obtain a second authentication policy set. Finally, it sends the second authentication policy set.

[0046] In an optional embodiment, the second authentication module is configured to:

[0047] Remove the completed authentication strategies from the second authentication strategy set to obtain the fourth authentication strategy set;

[0048] Authentication is performed on the first terminal device based on the fourth set of authentication strategies.

[0049] Fifthly, the backend server provided in this application includes a memory and a processor. The memory stores a computer program, and the processor runs the computer program in the memory to implement the steps in the device dynamic authentication method provided in this application.

[0050] Sixthly, the gateway device provided in this application includes a memory and a processor. The memory stores a computer program, and the processor runs the computer program in the memory to implement the steps in the device dynamic authentication method provided in this application.

[0051] Seventhly, the computer-readable storage medium provided in this application stores multiple instructions that are adapted for loading by a processor to implement the steps in the device dynamic authentication method provided in this application.

[0052] Eighthly, the computer program product provided in this application includes a computer program or instructions that, when executed by a processor, implement the steps in the device dynamic authentication method provided in this application.

[0053] In this application, compared to related technologies, during the authentication process between the gateway device and the first terminal device based on a first authentication policy set, authentication process information is obtained. The first authentication policy set includes at least one authentication policy. A security score for the first terminal device is determined based on the authentication process information. When the security score of the first terminal device is less than a first preset score, an authentication policy from the first authentication policy set is added to obtain a second authentication policy set. The second authentication policy set is then sent, and the gateway device performs authentication based on the second authentication policy set. This application dynamically adjusts the authentication policy during the authentication process between the gateway device and the terminal device, avoiding replay attacks or spoofing, thereby improving authentication security. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a schematic diagram of a scenario for the device dynamic authentication system provided in this application embodiment;

[0056] Figure 2 This is a schematic flowchart of an embodiment of the device dynamic authentication method provided in this application.

[0057] Figure 3 This is a schematic diagram of the authentication strategy set and authentication strategy in one embodiment of the device dynamic authentication method provided in this application;

[0058] Figure 4 This is a schematic diagram illustrating the authentication of a gateway device with a first terminal device based on a first authentication policy set in one embodiment of the device dynamic authentication method provided in this application.

[0059] Figure 5 This is a schematic diagram of an LBS decision tree in one embodiment of the device dynamic authentication method provided in this application.

[0060] Figure 6 This is a schematic diagram of a WiFi decision tree in one embodiment of the device dynamic authentication method provided in this application.

[0061] Figure 7 This is a schematic diagram of a real-name authentication decision tree in one embodiment of the device dynamic authentication method provided in this application.

[0062] Figure 8 This is a schematic diagram of a system information decision tree in one embodiment of the device dynamic authentication method provided in this application;

[0063] Figure 9 This is a schematic diagram of a gateway information decision tree in one embodiment of the device dynamic authentication method provided in this application.

[0064] Figure 10 This is a schematic diagram of an account risk decision tree in one embodiment of the device dynamic authentication method provided in this application.

[0065] Figure 11 This is a schematic flowchart of another embodiment of the device dynamic authentication method provided in this application;

[0066] Figure 12 This is a schematic flowchart of another embodiment of the device dynamic authentication method provided in this application;

[0067] Figure 13a This is a schematic diagram of the interface of the second terminal device when it enters the privileged platform in one embodiment of the device dynamic authentication method provided in this application.

[0068] Figure 13b This is a schematic diagram of the interface when the second terminal device fills in information in one embodiment of the device dynamic authentication method provided in this application;

[0069] Figure 13c This is a schematic diagram of the interface when the privileges of the second terminal device are successfully granted in one embodiment of the device dynamic authentication method provided in this application.

[0070] Figure 13d This is a schematic diagram of the interface when the privilege granting of the second terminal device is abnormal in one embodiment of the device dynamic authentication method provided in this application;

[0071] Figure 13e This is a schematic diagram of the interface where the granting of privileges to the second terminal device fails in one embodiment of the device dynamic authentication method provided in this application.

[0072] Figure 13fThis is a schematic diagram of the interface for displaying a QR code after successful granting of privileges to the second terminal device in one embodiment of the device dynamic authentication method provided in this application.

[0073] Figure 13g This is a schematic diagram of the interface after the first terminal device scans the QR code displayed by the second terminal device in one embodiment of the device dynamic authentication method provided in this application.

[0074] Figure 13h This is a schematic diagram of the interface for filling in information on the first terminal device in one embodiment of the device dynamic authentication method provided in this application.

[0075] Figure 13i This is a schematic diagram of the interface when the privileges of the first terminal device are successfully enabled in one embodiment of the device dynamic authentication method provided in this application.

[0076] Figure 13j This is a schematic diagram of the interface when the privilege activation of the first terminal device fails in one embodiment of the device dynamic authentication method provided in this application.

[0077] Figure 14a This is a schematic diagram of the interface of the second terminal device when it enters the privileged platform in another embodiment of the device dynamic authentication method provided in this application.

[0078] Figure 14b This is a schematic diagram of the interface when the second terminal device applies for privilege activation in another embodiment of the device dynamic authentication method provided in this application.

[0079] Figure 14c This is a schematic diagram of the interface after the second terminal device successfully applies for privileges in another embodiment of the device dynamic authentication method provided in this application;

[0080] Figure 14d This is a schematic diagram of the interface when the second terminal device displays a QR code in another embodiment of the device dynamic authentication method provided in this application.

[0081] Figure 14e This is a schematic diagram of the interface after the first terminal device scans the QR code displayed by the second terminal device in another embodiment of the device dynamic authentication method provided in this application.

[0082] Figure 14f This is a schematic diagram of the interface after immediately enabling privileges in another embodiment of the device dynamic authentication method provided in this application;

[0083] Figure 14g This is a schematic diagram of the interface when the first terminal device fails verification in another embodiment of the device dynamic authentication method provided in this application.

[0084] Figure 14h This is a schematic diagram of the interface during the privilege activation process of the first terminal device in another embodiment of the device dynamic authentication method provided in this application.

[0085] Figure 14i This is a schematic diagram of the interface after the first terminal device privileges are successfully enabled in another embodiment of the device dynamic authentication method provided in this application.

[0086] Figure 15 This is a schematic diagram of the structure of an embodiment of the device dynamic authentication device provided in this application.

[0087] Figure 16 This is a schematic diagram of another embodiment of the device dynamic authentication device provided in this application;

[0088] Figure 17 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0089] It should be noted that the principles of this application are illustrated by example in a suitable computing environment. The following description is based on the specific embodiments of this application that are illustrated, and should not be regarded as limiting other specific embodiments not detailed herein.

[0090] In the following description of this application, "some embodiments" are referred to, which describe a subset of all possible embodiments. However, it is understood that "some embodiments" may be the same subset or different subset of all possible embodiments, and may be combined with each other without conflict.

[0091] In the following description of this application, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0092] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0093] The following explains some of the terms used in this application:

[0094] PMS (Property Management System) is a computerized system for property management, designed to help property managers operate and manage properties more efficiently and provide high-quality customer service. A PMS system covers multiple aspects, including but not limited to room reservations, check-in, room status management, customer relationship management, financial management, and report generation. By automating and integrating various management functions, a PMS system simplifies operational processes, improves work efficiency, and automates daily operational tasks such as room inventory management and room rate strategy selection. Furthermore, a PMS system supports personalized customer service, enhancing customer satisfaction.

[0095] LBS: Location Based Services (LBS) uses various types of positioning technologies to obtain the current location of a positioning device and provides information resources and basic services to the positioning device through the mobile Internet.

[0096] SSID: SSID (Service Set Identifier) ​​is a general concept that includes Essid and BSSID. It is used to distinguish different networks and can have up to 32 characters. Wireless network cards can access different networks by setting different SSIDs. Simply put, SSID is the name of a local area network.

[0097] bssid: A special application of Ad-hoc LAN, also known as Basic Service Set (BSS). A group of computers that share the same BSS name can form a group. Each BSS is assigned a bssid, which is a 48-bit binary identifier used to identify different BSSs.

[0098] To improve the effectiveness of dynamic device authentication, embodiments of this application provide a dynamic device authentication method, a dynamic device authentication device, a backend server, a gateway device, a computer-readable storage medium, and a computer program product. The dynamic device authentication method can be executed by the dynamic device authentication device, or by a backend server and gateway device integrating the dynamic device authentication device.

[0099] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0100] This application also provides a dynamic device authentication system, which includes a backend server and a gateway device. The dynamic device authentication device provided in this application is integrated into the backend server and the gateway device.

[0101] To better understand the device dynamic authentication method, apparatus, backend server, gateway device, and storage medium provided in the embodiments of this application, the application environment applicable to the embodiments of this application is described below.

[0102] Please see Figure 1 , Figure 1 This illustration shows an application environment diagram of the device dynamic authentication method provided in an embodiment of this application. As one implementation, the device dynamic authentication method provided in this embodiment can be applied to a backend server 110 and a gateway device 130. The backend server 110 can be connected to a first terminal device 120 via a network. The network serves as a medium for providing a communication link between the backend server 110 and the first terminal device 120. The network can include various connection types, such as wired communication links, wireless communication links, etc., and this embodiment does not limit this. The backend server 110 can be connected to the gateway device 130 via a network. The gateway device 130 can be connected to the first terminal device 120 via a network. The gateway device 130 can be connected to the first terminal device 120 via a wired network or a wireless network.

[0103] It should be understood that Figure 1 The backend server 110, network, first terminal device 120, and gateway device 130 shown are merely illustrative. Depending on the implementation requirements, any number of servers, networks, and terminal devices can be included. For example, the backend server 110 can be a physical server or a server cluster composed of multiple servers, and the first terminal device 120 can be a mobile phone, tablet, desktop computer, laptop computer, etc. The gateway device 130 can also be a mobile phone, tablet, desktop computer, laptop computer, etc. It is understood that embodiments of this application can also allow multiple first terminal devices 120 to simultaneously access the backend server 110.

[0104] In addition, the device's dynamic authentication system may also include a memory for storing raw data, intermediate data, and result data during the data processing.

[0105] In this embodiment of the application, the storage device can be a cloud storage device. Cloud storage is a new concept that is extended and developed from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as a storage system) refers to a storage system that uses cluster applications, grid technology and distributed storage file system functions to bring together a large number of storage devices of various types in the network (storage devices are also called storage nodes) through application software or application interfaces to work together to provide data storage and business access functions to the outside world.

[0106] Currently, the storage method of storage systems is as follows: Logical volumes are created. During the creation of a logical volume, physical storage space is allocated to each logical volume. This physical storage space may consist of a single storage device or the disks of several storage devices. Clients store data on a logical volume, which means storing the data on the file system. The file system divides the data into many parts, each part being an object. Each object contains not only the data but also additional information such as a data identifier (ID entity, ID). The file system writes each object to the physical storage space of that logical volume and records the storage location information of each object. Therefore, when a client requests access to data, the file system can allow the client to access the data based on the storage location information of each object.

[0107] The process by which a storage system allocates physical storage space to a logical volume is as follows: the physical storage space is pre-divided into strips according to the capacity estimate of the objects stored in the logical volume (this estimate often has a large margin relative to the actual capacity of the objects to be stored) and the grouping of Redundant Array of Independent Disks (RAID). A logical volume can be understood as a strip, thus allocating physical storage space to the logical volume.

[0108] It should be noted that, Figure 1 The schematic diagram of the device dynamic authentication system shown is merely an example. The device dynamic authentication system and scenario described in this application are for the purpose of more clearly illustrating the technical solutions of this application, and do not constitute a limitation on the technical solutions provided in this application. As those skilled in the art will know, with the evolution of device dynamic authentication systems and the emergence of new business scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

[0109] The following sections provide detailed descriptions of each example. It should be noted that the sequence numbers of the following embodiments are not intended to limit the preferred order of the embodiments.

[0110] Please refer to Figure 2 , Figure 2This is a schematic flowchart of an embodiment of the device dynamic authentication method provided in this application, as shown below. Figure 2 As shown, the flow of the device dynamic authentication method provided in this application is as follows:

[0111] 201. During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, obtain authentication process information.

[0112] The first set of authentication strategies includes at least one authentication strategy. These authentication strategies can be real-name authentication matching strategies, mobile phone number matching strategies, dynamic QR code scanning strategies, location authentication strategies, hotel PMS authentication strategies, merchant WiFi authentication strategies, and whitelist authentication strategies.

[0113] The gateway device determines different sets of first authentication policies based on its gateway type. Gateway type 1 can include gateway devices for hotels with PMS system management. Gateway type 2 can include gateway devices for water bars, privileged lounges, and traditional hotels. Gateway type 3 can include gateway devices for stadiums and exhibition halls.

[0114] For example, if the gateway device is gateway type 1, the corresponding first authentication policy set includes a real-name authentication matching policy and a hotel PMS authentication policy. If the gateway device is gateway type 2, the corresponding first authentication policy set includes a location authentication policy, a merchant WiFi authentication policy, and a dynamic QR code scanning policy. The first authentication policy set corresponding to different gateway types can be pre-configured by the gateway device.

[0115] In this embodiment, the gateway type of the gateway device is obtained; a first authentication policy set for the gateway device is determined based on the gateway type, wherein different gateway types correspond to different first authentication policy sets. When the first terminal device initiates an access request, the gateway device authenticates with the first terminal device based on the first authentication policy set. Each gateway device pre-sets a first authentication policy set, thereby enabling the gateway device and the first terminal device to quickly authenticate each other.

[0116] In one specific embodiment, see Figure 3The first set of authentication strategies can include a whitelist authentication set, a hotel PMS authentication set, a manually entered authentication set, a dynamic QR code authentication set, and a pure WiFi authentication set. The whitelist authentication set includes location authentication strategies and whitelist authentication strategies. The hotel PMS authentication set includes real-name authentication matching strategies and hotel PMS authentication strategies. The manually entered authentication set includes real-name authentication matching strategies, mobile phone number matching strategies, location authentication strategies, and merchant WiFi authentication strategies. The dynamic QR code authentication set includes dynamic QR code scanning strategies, location authentication strategies, and merchant WiFi authentication strategies. The pure WiFi authentication set includes location authentication strategies and merchant WiFi authentication strategies.

[0117] In this embodiment, the authentication process information includes real-time feature information of the first terminal device, offline feature information of the first terminal device, and gateway feature information of the gateway device. The authentication process information includes multiple sub-dimensions. Specifically, the offline feature information of the first terminal device and the gateway feature information of the gateway device each constitute one sub-dimension, and the real-time feature information of the first terminal device includes multiple sub-dimensions.

[0118] In one specific embodiment, the real-time characteristic information of the first terminal device includes LBS information, network connection information, real-name information, and terminal system information. The offline characteristic information of the first terminal device is account risk information.

[0119] When the first authentication policy set includes a merchant WiFi authentication policy, the gateway device authenticates the first terminal device based on the first authentication policy set. This includes: the gateway device sending its gateway ID to the backend server; the backend server determining whether the gateway device is already bound based on the gateway ID; if the gateway device is bound, it sends the client key, merchant ID, and server key to the gateway device; the first terminal device initiating an access request to the gateway device; and the gateway device sending its network port, merchant ID, and merchant signature to the first terminal device; the first terminal device establishing a connection with the gateway device through the network port; the first terminal device using the merchant ID and merchant signature to obtain the client key from the backend server; after obtaining the client key, the first terminal device encrypts the authentication information based on the client key to obtain encrypted authentication information, and sends the encrypted authentication information to the backend server; when the backend server determines that the encrypted authentication information meets the pass conditions, the authentication is successful, completing the merchant WiFi authentication policy. The authentication information includes a QR code and LBS information.

[0120] When the first authentication strategy set includes a real-name authentication matching strategy, the gateway device authenticates the first terminal device based on the first authentication strategy set. This includes: the gateway device sending the current real-name information sent by the first terminal device to the backend server; the backend server determining whether the current real-name information matches the pre-stored real-name information; and if the current real-name information matches the pre-stored entered real-name information, then the authentication is confirmed to be successful, and the real-name authentication matching strategy is completed.

[0121] When the first authentication strategy set includes a mobile number matching strategy, the gateway device authenticates the first terminal device based on the first authentication strategy set, including: the gateway device sends the current mobile number sent by the first terminal device to the backend server, the backend server determines whether the current mobile number matches the pre-stored mobile number, and if the current mobile number matches the pre-stored mobile number, the authentication is confirmed to be successful and the mobile number matching strategy is completed.

[0122] In one specific embodiment, see Figure 4 The gateway device is gateway type 2, and its corresponding first authentication policy set is a dynamic QR code authentication set. This first authentication policy set includes location authentication, merchant WiFi authentication, and dynamic QR code scanning. The gateway device authenticates with the first terminal device based on this first authentication policy set, including:

[0123] (1) Device initialization.

[0124] Specifically, the gateway device sends its gateway ID to the backend server. The backend server uses the gateway ID to determine whether the gateway device is already bound. If the gateway device is already bound, it sends the client key, merchant ID, and server key to the gateway device.

[0125] Furthermore, the first terminal device needs to maintain a heartbeat with the backend server, and the first terminal device periodically sends signals to the backend server to indicate its online status.

[0126] Furthermore, the gateway device reports a list of online mobile devices and updates the keys regularly to ensure communication security.

[0127] (2) The first terminal device initiates an access request to the gateway device.

[0128] The first terminal device can be the user's mobile phone.

[0129] (3) The gateway device sends the network port, merchant ID, and merchant signature to the first terminal device. The first terminal device establishes a connection with the gateway device through the network port.

[0130] (4) The first terminal device uses the merchant ID and merchant signature to obtain the client key from the backend server.

[0131] (5) The backend server returns the client key to the first terminal device.

[0132] (6) The backend server returns the server key to the second terminal device.

[0133] (7) The second terminal device sends the device ID to the gateway device. The gateway device requests a QR code from the backend server using the device ID. The backend server returns the QR code to the gateway device based on the device ID.

[0134] Specifically, the backend server encrypts the QR code using the server-side key and then returns the encrypted QR code to the gateway device.

[0135] (8) The gateway device returns the QR code to the second terminal device.

[0136] The second terminal device displays the QR code and updates it periodically.

[0137] (9) The first terminal device sends the encrypted authentication information to the gateway device.

[0138] Once the first terminal device obtains the client key, it encrypts the authentication information based on the client key to obtain encrypted authentication information, and then sends the encrypted authentication information to the gateway device. The authentication information includes a QR code and LBS information.

[0139] (10) The gateway device sends the encrypted authentication information to the backend server.

[0140] (11) When the backend server determines that the encrypted authentication information meets the pass conditions, it confirms that the authentication is passed and notifies the program backend to issue the rights.

[0141] Furthermore, the backend server determines whether the first terminal device is running the rights distribution application. If the first terminal device is running the rights distribution application, the application distributes the rights in the background.

[0142] 202. Determine the security score of the first terminal device based on the authentication process information.

[0143] In this embodiment of the application, determining the security score of the first terminal device based on authentication process information includes:

[0144] (1) Obtain multiple pre-trained scoring models and their corresponding model weight coefficients, wherein the multiple scoring models are used to score sub-dimensional information of different dimensions.

[0145] Multiple scoring models and their corresponding weight coefficients are obtained through pre-training. The scoring models can be decision trees, random forests, neural networks, or deep learning models; the specific choice depends on the characteristics of the data and the specific requirements of the system.

[0146] In this embodiment, the multiple scoring models are multiple decision tree models. These multiple decision tree models are: LBS decision tree, WiFi decision tree, real-name authentication decision tree, system information decision tree, gateway information decision tree, and account risk decision tree.

[0147] In this embodiment, multi-dimensional data from multiple first terminal devices are acquired, including but not limited to user geographic location information, device characteristics, network environment, and interaction sequences, forming historical user data. Key features are extracted from the historical user data, and data cleaning is performed to obtain a training set. The training set includes historical sample information and corresponding labeled scores, which can be labeled manually or by engineers. Data cleaning includes handling missing values, outliers, and noisy data to ensure the quality of the input data. Multiple decision tree models are trained using the training set to obtain multiple decision tree models and their corresponding model weight coefficients. For example, the model weight coefficients for LBS decision tree, WiFi decision tree, real-name authentication decision tree, system information decision tree, gateway information decision tree, and account risk decision tree are 0.1, 0.15, 0.25, 0.05, 0.3, and 0.15, respectively.

[0148] Furthermore, multiple scoring models and their corresponding model weight coefficients are iteratively updated according to a first preset period. This first preset period can be one day, one week, etc., and can be set according to specific circumstances.

[0149] (2) Input the sub-dimensional information of multiple dimensions of the authentication process information into the corresponding decision number model to obtain the decision score corresponding to each sub-dimensional information.

[0150] Specifically, LBS information is input into the LBS decision tree to obtain an LBS decision score; network connection information is input into the WiFi decision tree to obtain a WiFi decision score; real-name information is input into the real-name authentication decision tree to obtain a real-name authentication decision score; terminal system information is input into the system information decision tree to obtain a system information decision score; gateway feature information is input into the gateway information decision tree to obtain a gateway information decision score; and account risk information is input into the account risk decision tree to obtain an account risk decision score. For example, the LBS decision score, WiFi decision score, real-name authentication decision score, system information decision score, gateway information decision score, and account risk decision score are 30, 20, 20, 30, 20, and 20, respectively.

[0151] In one specific embodiment, see Figure 5LBS information includes latitude, longitude, and IP address. The LBS information is input into the LBS decision tree, which determines whether the distance between the first terminal device's latitude and longitude and the merchant's latitude and longitude is less than a first preset distance. The merchant's latitude and longitude are the latitude and longitude of the nearest merchant with the relevant rights. If the distance between the first terminal device's latitude and longitude and the merchant's latitude and longitude is not less than the first preset distance, it is determined that the first terminal device is not in the store, and a first LBS decision score is output. If the distance between the first terminal device's latitude and longitude and the merchant's latitude and longitude is less than the first preset distance, it is determined whether the distance between the first terminal device's IP address and the merchant's IP address is less than a second preset distance. If the distance between the first terminal device's IP address and the merchant's IP address is not less than the first preset distance, it is determined that the first terminal device is not in the store, and a second LBS decision score is output; if the distance between the first terminal device's IP address and the merchant's IP address is less than the second preset distance, it is determined that the first terminal device is in the store, and a third LBS decision score is output. The LBS information is then input into the LBS decision tree, and the LBS decision tree outputs an LBS decision score. The first and second preset distances can be set according to specific requirements; for example, the first preset distance is 600 meters, and the second preset distance is 10 kilometers. The first, second, and third LBS decision scores can be set according to specific circumstances. For example, the first LBS decision score can be 30 points, the second LBS decision score can be 60 points, and the third LBS decision score can be 100 points.

[0152] In one specific embodiment, see Figure 6The network connection information includes the SSID, BSSID, and WiFi list of the WiFi network connected to the first terminal device, and the SSID, BSSID, and WiFi list of the gateway device. This network connection information is input into the WiFi decision tree, which determines if the SSIDs match. Specifically, the WiFi decision tree checks if the SSIDs of the first terminal device and the gateway device match. If they do not match, the first terminal device is determined to be out of the store, and a first WiFi decision score is output. If they match, the tree checks if their BSSIDs match. If they do not match, the first terminal device is determined to be out of the store, and a second WiFi decision score is output. If they match, the tree checks if their WiFi lists match. If they do not match, the first terminal device is determined to be out of the store, and a third WiFi decision score is output. If they match, the first terminal device is determined to be in the store, and a fourth WiFi decision score is output. Finally, the network connection information is input into the WiFi decision tree, and the WiFi decision tree outputs a WiFi decision score. The first, second, third, and fourth WiFi decision scores can be set according to specific circumstances. For example, the first WiFi decision score can be 20 points, the second WiFi decision score can be 50 points, the third WiFi decision score can be 70 points, and the fourth WiFi decision score can be 100 points.

[0153] In one specific embodiment, see Figure 7The system inputs real-name information into a real-name authentication decision tree. The tree determines whether the account is real-name authenticated. If the account is not real-name authenticated, the first terminal device is deemed untrustworthy, and a first real-name authentication decision score is output. If the account is real-name authenticated, the system checks if the real-name information on the first terminal device matches the entered information. If the real-name information on the first terminal device does not match the entered information, the first terminal device is deemed untrustworthy, and a second real-name authentication decision score is output. If the real-name information on the first terminal device matches the entered information, the system checks if the mobile phone number matches. Specifically, it checks if the current mobile phone number on the first terminal device matches the entered mobile phone number. If the current mobile phone number on the first terminal device does not match the entered mobile phone number, the first terminal device is deemed untrustworthy, and a third real-name authentication decision score is output. If the current mobile phone number on the first terminal device matches the entered mobile phone number, the first terminal device is deemed trustworthy, and a fourth real-name authentication decision score is output. The system then inputs real-name information into the real-name authentication decision tree, which outputs a real-name authentication decision score. The first, second, third, and fourth real-name authentication decision scores can be set according to specific circumstances. For example, the first real-name authentication decision score can be 20 points, the second real-name authentication decision score can be 50 points, the third real-name authentication decision score can be 70 points, and the fourth real-name authentication decision score can be 100 points.

[0154] In one specific embodiment, see Figure 8 The system inputs terminal system information into a system information decision tree. The system information decision tree determines whether the operating system of the first terminal device is rooted. If the operating system of the first terminal device is rooted, it is determined that the first terminal device is untrusted, and a first system information decision score is output. If the operating system of the first terminal device is not rooted, it determines whether the first terminal device is simulating location. If the first terminal device is not simulating location, it is determined that the first terminal device is untrusted, and a second system information decision score is output; if the first terminal device is simulating location, it is determined that the first terminal device is trustworthy, and a third system information decision score is output. The system information decision tree outputs a system information decision score. The first, second, and third system information decision scores can be set according to specific circumstances. For example, the first system information decision score can be 30 points, the second system information decision score can be 60 points, and the third system information decision score can be 100 points.

[0155] In one specific embodiment, see Figure 9The gateway characteristic information is input into the gateway information decision tree. The gateway information decision tree determines whether the gateway device is a desktop computer. If the gateway device is not a desktop computer, it is determined that the first terminal device has no rights, and a first gateway information decision score is output. If the gateway device is a desktop computer, it is determined whether the number of power-off cycles of the gateway device has exceeded the limit. If the number of power-off cycles of the gateway device has exceeded the limit, it is determined that the first terminal device has no rights, and a second gateway information decision score is output; if the number of power-off cycles of the gateway device has not exceeded the limit, it is determined that the first terminal device has rights, and a third gateway information decision score is output. The gateway characteristic information is input into the gateway information decision tree, and the gateway information decision tree outputs a gateway information decision score. The first, second, and third gateway information decision scores can be set according to specific circumstances. For example, the first gateway information decision score can be 30 points, the second gateway information decision score can be 60 points, and the third gateway information decision score can be 90 points.

[0156] In one specific embodiment, see Figure 10 The system inputs account risk information into an account risk decision tree. The tree determines whether the account on the first terminal device is blacklisted. If the account is blacklisted, the first terminal device is deemed untrustworthy, and a first account risk decision score is output. If the account is not blacklisted, it checks whether the risk level of associated accounts exceeds a preset level. Associated accounts can be accounts opened by the account in other applications. If the risk level of associated accounts exceeds the preset level, the first terminal device is deemed untrustworthy, and a second account risk decision score is output. If the risk level of associated accounts does not exceed the preset level, it checks whether the account's credit score exceeds a preset score. If the credit score does not exceed the preset score, the first terminal device is deemed untrustworthy, and a third account risk decision score is output. If the credit score exceeds the preset score, the first terminal device is deemed trustworthy, and a fourth account risk decision score is output. The system outputs an account risk decision score. The first, second, third, and fourth account risk decision scores can be set according to specific circumstances. For example, the risk decision score for the first account is 20 points, the risk decision score for the second account is 50 points, the risk decision score for the third account is 70 points, and the risk decision score for the fourth account is 100 points.

[0157] (3) The safety score is obtained by weighting and summing the decision scores corresponding to each sub-dimensional information based on the model weight coefficients corresponding to each scoring model.

[0158] For example, the LBS decision score, WiFi decision score, real-name authentication decision score, system information decision score, gateway information decision score, and account risk decision score are 30, 20, 20, 30, 20, and 20, respectively. The model weight coefficients for the LBS decision tree, WiFi decision tree, real-name authentication decision tree, system information decision tree, gateway information decision tree, system information decision tree, and account risk decision tree are 0.1, 0.15, 0.25, 0.05, 0.3, and 0.15, respectively.

[0159] Safety score = 0.1*30 + 0.15*20 + 0.25*20 + 0.05*30 + 0.3*20 + 0.15*20 = 21.5.

[0160] Furthermore, the security score of the first terminal device is updated according to a second preset period. The security score is dynamic and will be updated in real time based on the latest changes. The second preset period is shorter than the first preset period.

[0161] 203. When the security score is less than the first preset score, add the authentication strategy in the first authentication strategy set to obtain the second authentication strategy set.

[0162] The first preset score can be set according to specific circumstances; for example, the first preset score can be 30. If the security score of the first terminal device is lower than the first preset score, it indicates that the first terminal device has a low security score and needs to add an authentication strategy. Therefore, an authentication strategy from the first authentication strategy set is added to obtain the second authentication strategy set.

[0163] For example, if the gateway device is gateway type 1, the corresponding first authentication policy set includes a real-name authentication matching policy and a hotel PMS authentication policy. When the security score of the first terminal device is less than a first preset score, a location authentication policy is added to the first authentication policy set, resulting in a second authentication policy set. The second authentication policy set includes a real-name authentication matching policy, a hotel PMS authentication policy, and a location authentication policy.

[0164] 204. Send a second authentication policy set, wherein the gateway device authenticates with the first terminal device based on the second authentication policy set.

[0165] In this embodiment of the application, the second authentication policy set is sent to the gateway device, and the gateway device performs authentication with the first terminal device based on the second authentication policy set.

[0166] Furthermore, when the security score of the first terminal device is greater than the second preset score, the number of authentication policies in the first authentication policy set is reduced to obtain a third authentication policy set, where the second preset score is higher than the first preset score. The third authentication policy set is then sent, and the gateway device authenticates with the first terminal device based on the third authentication policy set. The second preset score can be set according to specific circumstances, for example, a second preset score of 70. When the security score of the first terminal device is greater than the second preset score, it indicates that the user's security is relatively high, and the authentication process needs to be reduced. For example, if the gateway device is gateway type 1, the corresponding first authentication policy set includes a real-name authentication matching policy and a hotel PMS authentication policy. When the security score of the first terminal device is greater than the second preset score, the hotel PMS authentication policy is removed from the first authentication policy set, resulting in a second authentication policy set. The second authentication policy set includes a real-name authentication matching policy.

[0167] Furthermore, when the security score of the first terminal device is not greater than the second preset score and not less than the first preset score, the security score of the first terminal device is determined based on the authentication process information according to the second preset cycle. The security score is repeatedly calculated, thereby dynamically modifying the authentication process.

[0168] Please refer to Figure 11 , Figure 11 This is a schematic flowchart of another embodiment of the device dynamic authentication method provided in this application, as shown below. Figure 11 As shown, the flow of the device dynamic authentication method provided in this application is as follows:

[0169] 301. Authentication is performed based on the first set of authentication strategies and the first terminal device.

[0170] 302. When the second authentication strategy is obtained, authentication is performed with the first terminal device based on the second authentication strategy set.

[0171] During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, the backend server obtains authentication process information, wherein the first authentication policy set includes at least one authentication policy; determines the security score of the first terminal device based on the authentication process information; when the security score of the first terminal device is less than a first preset score, adds an authentication policy from the first authentication policy set to obtain a second authentication policy set; and sends the second authentication policy set.

[0172] In one specific embodiment, authentication with the first terminal device based on the second authentication strategy set includes: removing completed authentication strategies from the second authentication strategy set to obtain a fourth authentication strategy set; and authenticating with the first terminal device based on the fourth authentication strategy set.

[0173] Please refer to Figure 12 , Figure 12 This is a schematic flowchart of another embodiment of the device dynamic authentication method provided in this application, as shown below. Figure 12 As shown, the flow of the device dynamic authentication method provided in this application is as follows:

[0174] 401. The gateway device authenticates the first terminal device based on the first authentication policy set.

[0175] 402. During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, the backend server obtains authentication process information, wherein the first authentication policy set includes at least one authentication policy.

[0176] In this embodiment, the authentication process information includes real-time feature information of the first terminal device, offline feature information of the first terminal device, and gateway feature information of the gateway device. The authentication process information includes multiple sub-dimensions. Specifically, the offline feature information of the first terminal device and the gateway feature information of the gateway device each constitute one sub-dimension, and the real-time feature information of the first terminal device includes multiple sub-dimensions.

[0177] 403. The backend server obtains multiple pre-trained scoring models and their corresponding model weight coefficients.

[0178] Among them, multiple scoring models are used to score sub-dimensional information of different dimensions.

[0179] In this embodiment, the multiple scoring models are multiple decision tree models. These decision tree models are: LBS decision tree, WiFi decision tree, real-name authentication decision tree, system information decision tree, gateway information decision tree, and account risk decision tree. For example, the model weight coefficients for the LBS decision tree, WiFi decision tree, real-name authentication decision tree, system information decision tree, gateway information decision tree, system information decision tree, and account risk decision tree are 0.1, 0.15, 0.25, 0.05, 0.3, and 0.15, respectively.

[0180] 404. The backend server inputs the sub-dimensional information of multiple dimensions of the authentication process information into the corresponding decision number model to obtain the decision score corresponding to each sub-dimensional information.

[0181] Specifically, LBS information is input into the LBS decision tree to obtain an LBS decision score; network connection information is input into the WiFi decision tree to obtain a WiFi decision score; real-name information is input into the real-name authentication decision tree to obtain a real-name authentication decision score; terminal system information is input into the system information decision tree to obtain a system information decision score; gateway feature information is input into the gateway information decision tree to obtain a gateway information decision score; and account risk information is input into the account risk decision tree to obtain an account risk decision score. For example, the LBS decision score, WiFi decision score, real-name authentication decision score, system information decision score, gateway information decision score, and account risk decision score are 30, 20, 20, 30, 20, and 20, respectively.

[0182] 405. The backend server calculates the weighted sum of the decision scores corresponding to each sub-dimension information based on the model weight coefficients corresponding to each scoring model to obtain the security score.

[0183] For example, the LBS decision score, WiFi decision score, real-name authentication decision score, system information decision score, gateway information decision score, and account risk decision score are 30, 20, 20, 30, 20, and 20, respectively. The model weight coefficients for the LBS decision tree, WiFi decision tree, real-name authentication decision tree, system information decision tree, gateway information decision tree, system information decision tree, and account risk decision tree are 0.1, 0.15, 0.25, 0.05, 0.3, and 0.15, respectively.

[0184] Safety score = 0.1*30 + 0.15*20 + 0.25*20 + 0.05*30 + 0.3*20 + 0.15*20 = 21.5.

[0185] 406. When the security score of the first terminal device is less than the first preset score, the backend server adds the authentication strategy from the first authentication strategy set to obtain the second authentication strategy set.

[0186] When the security score of the first terminal device is less than the first preset score, the backend server adds an authentication policy from the first authentication policy set to obtain the second authentication policy set.

[0187] The first preset score can be set according to specific circumstances; for example, the first preset score can be 30. If the security score of the first terminal device is lower than the first preset score, it indicates that the first terminal device has a low security score and needs to add an authentication strategy. Therefore, an authentication strategy from the first authentication strategy set is added to obtain the second authentication strategy set.

[0188] For example, if the gateway device is gateway type 1, the corresponding first authentication policy set includes a real-name authentication matching policy and a hotel PMS authentication policy. When the security score of the first terminal device is less than a first preset score, a location authentication policy is added to the first authentication policy set, resulting in a second authentication policy set. The second authentication policy set includes a real-name authentication matching policy, a hotel PMS authentication policy, and a location authentication policy.

[0189] 407. The backend server sends the second authentication policy set.

[0190] In this process, the gateway device authenticates the first terminal device based on the second set of authentication policies.

[0191] 408. When the second authentication strategy is obtained, authentication is performed with the first terminal device based on the second authentication strategy set.

[0192] 409. When the security score of the first terminal device is greater than the second preset score, the backend server reduces the number of authentication policies in the first authentication policy set to obtain the third authentication policy set.

[0193] When the security score of the first terminal device is greater than the second preset score, the backend server reduces the number of authentication policies in the first authentication policy set to obtain the third authentication policy set.

[0194] The second preset score is higher than the first preset score. The second preset score can be set according to specific circumstances; for example, it could be 70. When the security score of the first terminal device is greater than the second preset score, it indicates that the user's security is high, and the authentication process needs to be reduced. For example, if the gateway device is Gateway Type 1, the corresponding first authentication policy set includes a real-name authentication matching policy and a hotel PMS authentication policy. When the security score of the first terminal device is greater than the second preset score, the hotel PMS authentication policy is removed from the first authentication policy set, resulting in the second authentication policy set. The second authentication policy set includes the real-name authentication matching policy.

[0195] 410. The backend server sends a third authentication strategy set.

[0196] In this process, the gateway device authenticates the first terminal device based on a third set of authentication strategies.

[0197] 411. When a third authentication strategy is obtained, authentication is performed with the first terminal device based on the third authentication strategy set.

[0198] To facilitate better implementation of the device dynamic authentication method provided in this application, this application also provides a device dynamic authentication device based on the above-described device dynamic authentication method. The meanings of the terms used are the same as in the above-described device dynamic authentication method; for specific implementation details, please refer to the descriptions in the above method embodiments.

[0199] For further details, please refer to [link / reference]. Figures 13a-13j In one specific embodiment, the gateway device authenticates the first terminal device based on a first authentication policy set, including:

[0200] (1) Device initialization.

[0201] Specifically, the gateway device sends its gateway ID to the backend server. The backend server uses the gateway ID to determine whether the gateway device is already bound. If the gateway device is already bound, it sends the client key, merchant ID, and server key to the gateway device.

[0202] Furthermore, the first terminal device needs to maintain a heartbeat with the backend server, and the first terminal device periodically sends signals to the backend server to indicate its online status.

[0203] Furthermore, the gateway device reports a list of online mobile devices and updates the keys regularly to ensure communication security.

[0204] Specifically, such as Figure 13a As shown, when the second terminal device logs into the XX Privilege Platform, it clicks "Purchase Privileges" to purchase privileges. After completing the purchase, it clicks "Issue Benefits to Customers" to enter... Figure 13b On the interface, fill in the information. Figure 13b In the process, the merchant enters verification information such as "issuance duration", "identity information", "mobile phone number" and "verification code" on the interface of the second terminal device, selects to confirm issuance, and thus binds the gateway device.

[0205] Furthermore, if the verification information passes and the privilege is successfully granted, then the following will be displayed: Figure 13c The interface in the middle. If the verification information passes but the privilege is not successfully granted, it will display. Figure 13d On the interface, users can click the "Retry" control to retry, or click the "Retry" control. If the verification information fails, it will display... Figure 13e The interface prompts users to purchase privileges. If the entered identification document format does not meet the requirements, a message should be displayed: "Please enter the correct identification information." If the entered identification document indicates that the user is over 18 years old on the day of purchase, a message should be displayed: "Minors are not permitted to check into the e-sports hotel or use game privileges."

[0206] (2) The first terminal device initiates an access request to the gateway device.

[0207] The first terminal device can be the user's mobile phone.

[0208] Specifically, such as Figure 13f As shown, the first terminal device scans Figure 13fThe QR code in the document initiates an access request to the gateway device.

[0209] (3) The gateway device sends the network port, merchant ID, and merchant signature to the first terminal device. The first terminal device establishes a connection with the gateway device through the network port.

[0210] (4) The first terminal device uses the merchant ID and merchant signature to obtain the client key from the backend server.

[0211] (5) The backend server returns the client key to the first terminal device.

[0212] (6) The backend server returns the server key to the second terminal device.

[0213] (7) The second terminal device sends the device ID to the gateway device. The gateway device requests a QR code from the backend server using the device ID. The backend server returns the QR code to the gateway device based on the device ID.

[0214] Specifically, the backend server encrypts the QR code using the server-side key and then returns the encrypted QR code to the gateway device.

[0215] (8) The gateway device returns the QR code to the second terminal device.

[0216] The second terminal device displays the QR code and updates it periodically.

[0217] (9) The first terminal device sends the encrypted authentication information to the gateway device.

[0218] Once the first terminal device obtains the client key, it encrypts the authentication information based on the client key to obtain encrypted authentication information, and then sends the encrypted authentication information to the gateway device. The authentication information includes a QR code and LBS information.

[0219] Specifically, such as Figure 13g As shown, the first terminal device is scanning Figure 13f After scanning the QR code, enter Figure 13g The display interface. The user is in Figure 13g Click "Activate Privileges Now" on the display interface to enter. Figure 13h The interface, in which the user is Figure 13h After entering your mobile phone number, name, and other information on the interface, click "Verify and Enable Privileges." The encrypted authentication information will then be sent to the gateway device.

[0220] (10) The gateway device sends the encrypted authentication information to the backend server.

[0221] (11) When the backend server determines that the encrypted authentication information meets the pass conditions, it confirms that the authentication is passed and notifies the program backend to issue the rights.

[0222] Furthermore, the backend server determines whether the first terminal device is running the rights distribution application. If the first terminal device is running the rights distribution application, the application distributes the rights in the background.

[0223] Specifically, when the backend server determines that the encrypted authentication information meets the pass conditions, it sends a first prompt message to the first terminal device, indicating "Privilege successfully enabled" to the user. The first terminal device then displays... Figure 13i The display interface. When the backend server determines that the encrypted authentication information does not meet the pass conditions, it sends a second prompt message to the second terminal device, indicating to the user "not qualified to use privileges," and the first terminal device displays... Figure 13j The display interface.

[0224] For further details, please refer to [link / reference]. Figures 14a-14i In one specific embodiment, the gateway device authenticates the first terminal device based on a first authentication policy set, including:

[0225] (1) Device initialization.

[0226] Specifically, the gateway device sends its gateway ID to the backend server. The backend server uses the gateway ID to determine whether the gateway device is already bound. If the gateway device is already bound, it sends the client key, merchant ID, and server key to the gateway device.

[0227] Furthermore, the first terminal device needs to maintain a heartbeat with the backend server, and the first terminal device periodically sends signals to the backend server to indicate its online status.

[0228] Furthermore, the gateway device reports a list of online mobile devices and updates the keys regularly to ensure communication security.

[0229] Specifically, such as Figure 14a As shown, when the second terminal device logs into the XX Privilege Platform, it clicks "Merchant Privilege Service" to purchase privileges. After clicking "Merchant Privilege Service," it enters... Figure 14b The interface. Figure 14b In the process, after applying for activation on the interface of the second terminal device, the merchant enters... Figure 14c The interface.

[0230] (2) The first terminal device initiates an access request to the gateway device.

[0231] The first terminal device can be the user's mobile phone.

[0232] Specifically, such as Figure 14d As shown, the first terminal device scans Figure 14d The QR code in the document initiates an access request to the gateway device.

[0233] (3) The gateway device sends the network port, merchant ID, and merchant signature to the first terminal device. The first terminal device establishes a connection with the gateway device through the network port.

[0234] (4) The first terminal device uses the merchant ID and merchant signature to obtain the client key from the backend server.

[0235] (5) The backend server returns the client key to the first terminal device.

[0236] (6) The backend server returns the server key to the second terminal device.

[0237] (7) The second terminal device sends the device ID to the gateway device. The gateway device requests a QR code from the backend server using the device ID. The backend server returns the QR code to the gateway device based on the device ID.

[0238] Specifically, the backend server encrypts the QR code using the server-side key and then returns the encrypted QR code to the gateway device.

[0239] (8) The gateway device returns the QR code to the second terminal device.

[0240] The second terminal device displays the QR code and updates it periodically.

[0241] Specifically, such as Figure 14c As shown, click Figure 14c "Show QR code" to enter Figure 14d The interface displays a QR code.

[0242] (9) The first terminal device sends the encrypted authentication information to the gateway device.

[0243] Once the first terminal device obtains the client key, it encrypts the authentication information based on the client key to obtain encrypted authentication information, and then sends the encrypted authentication information to the gateway device. The authentication information includes a QR code and LBS information.

[0244] Specifically, such as Figure 14e As shown, the first terminal device is scanning Figure 14d After scanning the QR code, enter Figure 14e The display interface. The user is in Figure 14e Click "Activate Privileges Now" on the display interface to enter. Figure 14f The interface, in which the user is Figure 14f Click "Allow" on the interface to send the encrypted authentication information to the gateway device.

[0245] After entering your mobile phone number, name, and other information, click "Verify and Enable Privileges". The encrypted authentication information will then be sent to the gateway device.

[0246] (10) The gateway device sends the encrypted authentication information to the backend server.

[0247] (11) When the backend server determines that the encrypted authentication information meets the pass conditions, it confirms that the authentication is passed and notifies the program backend to issue the rights.

[0248] Furthermore, the backend server determines whether the first terminal device is running the rights distribution application. If the first terminal device is running the rights distribution application, the application distributes the rights in the background.

[0249] Specifically, when the backend server determines that the encrypted authentication information does not meet the pass conditions, it sends a third prompt message to the first terminal device, indicating "verification failed" to the user. The first terminal device then displays... Figure 14g The display interface. When the backend server determines that the encrypted authentication information meets the pass conditions, it sends a fourth prompt message to the second terminal device, and the first terminal device displays... Figure 14h The first terminal device starts the application and grants privileges upon entering the display interface. Once privileges are granted, it enters... Figure 14i This is the interface where users can use privileges.

[0250] Please refer to Figure 15 , Figure 15 This is a schematic diagram of an embodiment of the device dynamic authentication device provided in this application. The device dynamic authentication device may include an acquisition module 701, a scoring module 702, an adjustment module 703, and a sending module 704, wherein...

[0251] The acquisition module 701 is used to acquire authentication process information during the authentication process between the gateway device and the first terminal device based on the first authentication policy set, wherein the first authentication policy set includes at least one authentication policy.

[0252] The scoring module 702 is used to determine the security score of the first terminal device based on the authentication process information;

[0253] The adjustment module 703 is used to add authentication strategies from the first authentication strategy set to obtain a second authentication strategy set when the security score of the first terminal device is less than the first preset score.

[0254] The sending module 704 is used to send a second authentication policy set, wherein the gateway device performs authentication with the gateway device based on the second authentication policy set.

[0255] In an optional embodiment, the authentication process information includes sub-dimensional information across multiple dimensions, and the scoring module 702 is used for:

[0256] Obtain multiple pre-trained scoring models and their corresponding model weight coefficients, wherein the multiple scoring models are used to score sub-dimensional information of different dimensions;

[0257] The sub-dimensional information of multiple dimensions of the authentication process information is input into the corresponding decision number model to obtain the decision score corresponding to each sub-dimensional information;

[0258] The safety score is obtained by weighting and summing the decision scores corresponding to each sub-dimension information based on the model weight coefficients corresponding to each scoring model.

[0259] In an optional embodiment, the adjustment module 703 is configured to:

[0260] When the security score of the first terminal device is greater than the second preset score, the number of authentication strategies in the first authentication strategy set is reduced to obtain the third authentication strategy set, wherein the second preset score is higher than the first preset score.

[0261] A third authentication policy set is sent, wherein the gateway device authenticates the first terminal device based on the third authentication policy set.

[0262] In an optional embodiment, the acquisition module 701 is configured to:

[0263] Obtain the gateway type of the gateway device;

[0264] The gateway device determines its first authentication policy set based on its gateway type. Different gateway types correspond to different first authentication policy sets. When the first terminal device initiates an access request, the gateway device authenticates the first terminal device based on the first authentication policy set.

[0265] In an optional embodiment, the authentication process information includes real-time feature information of the first terminal device, offline feature information of the first terminal device, and gateway feature information of the gateway device.

[0266] Please refer to Figure 16 , Figure 16 This is a schematic diagram of an embodiment of the device dynamic authentication device provided in this application. The device dynamic authentication device may include a first authentication module 801 and a second authentication module 802, wherein...

[0267] The first authentication module 801 is used to perform authentication with the first terminal device based on the first authentication strategy set;

[0268] The second authentication module 802 is used to authenticate the first terminal device based on the second authentication policy set when a second authentication policy is obtained. During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, the backend server obtains authentication process information. The first authentication policy set includes at least one authentication policy. The backend server determines the security score of the first terminal device based on the authentication process information. When the security score is less than a first preset score, it adds an authentication policy from the first authentication policy set to obtain the second authentication policy set. Finally, it sends the second authentication policy set.

[0269] In an optional embodiment, the second authentication module 802 is used for:

[0270] The completed authentication strategies in the second authentication strategy set are removed from the second authentication strategy set to obtain the fourth authentication strategy set;

[0271] Authentication is performed based on the fourth set of authentication strategies and the first terminal device.

[0272] Please refer to Figure 17 , Figure 17 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0273] This electronic device is a backend server or gateway device. It may include a radio frequency (RF) circuit 901, a memory 902 including one or more computer-readable storage media, an input unit 903, a display unit 904, a sensor 905, an audio circuit 906, a wireless Fidelity (WiFi) module 907, a processor 908 including one or more processing cores, and a power supply 909, among other components. Those skilled in the art will understand that... Figure 17 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0274] RF circuit 901 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and hands it over to one or more processors 908 for processing; additionally, it transmits uplink data to the base station. Typically, RF circuit 901 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, etc. Furthermore, RF circuit 901 can also communicate wirelessly with networks and other devices. Wireless communication can use any communication standard or protocol, including but not limited to GSM, GPRS, CDMA, WCDMA, LTE, email, and SMS.

[0275] The memory 902 can be used to store software programs and modules. The processor 908 executes various functional applications and data processing by running the software programs and modules stored in the memory 902. The memory 902 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device (such as audio data, telephone directory, etc.). In addition, the memory 902 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 902 may also include a memory controller to provide access to the memory 902 for the processor 908 and the input unit 903.

[0276] Input unit 903 can be used to receive input digital or character information, and to generate keyboard, mouse, joystick, optical, or trackball signal inputs related to user settings and function control. Specifically, in one embodiment, input unit 903 may include a touch-sensitive surface and other input devices. A touch-sensitive surface, also known as a touch display or touchpad, can collect user touch operations on or near it (e.g., user operations using fingers, styluses, or any suitable object or accessory on or near the touch-sensitive surface) and drive corresponding connection devices according to a pre-set program. Optionally, the touch-sensitive surface may include a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, transmitting the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, sends it to the processor 908, and can receive and execute commands from the processor 908. Furthermore, various types of touch-sensitive surfaces, such as resistive, capacitive, infrared, and surface acoustic wave, can be used. In addition to the touch-sensitive surface, input unit 903 may also include other input devices. Specifically, other input devices may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0277] Display unit 904 can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces of electronic devices. These graphical user interfaces can be composed of graphics, text, icons, video, and any combination thereof. Display unit 904 may include a display panel, optionally configured as a liquid crystal display (LCD), organic light-emitting diode (OLED), or similar device. Furthermore, a touch-sensitive surface may cover the display panel. When the touch-sensitive surface detects a touch operation on or near it, it transmits the information to processor 908 to determine the type of touch event. Subsequently, processor 908 provides corresponding visual output on the display panel based on the type of touch event. Although in the figures, the touch-sensitive surface and the display panel are presented as two separate components for implementing input and output functions, in some embodiments, the touch-sensitive surface and the display panel can be integrated to achieve both input and output functions.

[0278] Electronic devices may also include at least one sensor 905, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel according to the ambient light level, and the proximity sensor can turn off the display panel and / or backlight when the electronic device is moved to the ear. As a type of motion sensor, a gravity acceleration sensor can detect the magnitude of acceleration in various directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometers, taps), etc. Other sensors that may be configured in electronic devices, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0279] Audio circuitry 906, a speaker, and a microphone provide an audio interface between the user and the electronic device. Audio circuitry 906 converts received audio data into electrical signals, transmits them to the speaker, and the speaker converts them into sound signals for output. Conversely, the microphone converts collected sound signals into electrical signals, which are then received by audio circuitry 906, converted back into audio data, and processed by processor 908. The processed data is then transmitted via RF circuitry 901 to, for example, another electronic device, or output to memory 902 for further processing. Audio circuitry 906 may also include an earphone jack to facilitate communication between external headphones and the electronic device.

[0280] WiFi is a short-range wireless transmission technology. Electronic devices using WiFi module 907 can help users send and receive emails, browse web pages, and access streaming media, providing users with wireless broadband internet access. Although WiFi module 907 is shown in the figure, it is understood that it is not an essential component of the electronic device and can be omitted as needed without changing the essence of the invention.

[0281] The processor 908 is the control center of the electronic device. It connects various parts of the phone via various interfaces and lines, and performs various functions and processes data by running or executing software programs and / or modules stored in the memory 902, and by calling data stored in the memory 902, thereby performing overall detection of the phone. Optionally, the processor 908 may include one or more processing cores; preferably, the processor 908 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor 908.

[0282] The electronic device also includes a power supply 909 (such as a battery) that supplies power to various components. Preferably, the power supply can be logically connected to the processor 908 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 909 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0283] Although not shown, the electronic device may also include a camera, Bluetooth module, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 908 in the electronic device loads the executable files corresponding to the processes of one or more applications into the memory 902 according to the following instructions, and the processor 908 runs the applications stored in the memory 902 to realize various functions:

[0284] During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, authentication process information is obtained, wherein the first authentication policy set includes at least one authentication policy; the security score of the first terminal device is determined based on the authentication process information; when the security score of the first terminal device is less than a first preset score, an authentication policy in the first authentication policy set is added to obtain a second authentication policy set; the second authentication policy set is sent, wherein the gateway device performs authentication with the gateway device based on the second authentication policy set.

[0285] Alternatively, authentication is performed with the first terminal device based on the first authentication policy set; when a second authentication policy is obtained, authentication is performed with the first terminal device based on the second authentication policy set, wherein the backend server obtains authentication process information during the authentication process between the gateway device and the first terminal device based on the first authentication policy set, wherein the first authentication policy set includes at least one authentication policy; a security score for the first terminal device is determined based on the authentication process information; when the security score is less than a first preset score, an authentication policy in the first authentication policy set is added to obtain the second authentication policy set; and the second authentication policy set is sent.

[0286] It should be noted that the electronic device provided in this application embodiment and the device dynamic authentication method in the above embodiment belong to the same concept. The specific implementation process can be found in the above related embodiments, and will not be repeated here.

[0287] This application also provides a computer-readable storage medium storing a computer program thereon. When the computer program stored thereon is executed on the processor of the electronic device provided in the embodiments of this application, the processor of the electronic device executes the steps in the device dynamic authentication method provided in this application. The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0288] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform various optional implementations of the aforementioned device dynamic authentication method.

[0289] The above provides a detailed description of the device dynamic authentication method and apparatus provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0290] It should be noted that when the above embodiments of this application are applied to specific products or technologies, and user-related data is involved, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

Claims

1. A method for dynamic device authentication, characterized in that, The device dynamic authentication method includes: During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, authentication process information is obtained, wherein the first authentication policy set includes at least one authentication policy. The security score of the first terminal device is determined based on the authentication process information. When the security score of the first terminal device is less than the first preset score, the authentication strategy in the first authentication strategy set is added to obtain the second authentication strategy set. Send the second authentication policy set, wherein the gateway device performs authentication with the gateway device based on the second authentication policy set.

2. The device dynamic authentication method according to claim 1, characterized in that, The authentication process information includes multiple sub-dimensional information, and determining the security score of the first terminal device based on the authentication process information includes: Obtain multiple pre-trained scoring models and their corresponding model weight coefficients, wherein the multiple scoring models are used to score sub-dimensional information of different dimensions; The sub-dimensional information of multiple dimensions of the authentication process information is input into the corresponding decision number model to obtain the decision score corresponding to each sub-dimensional information. The security score is obtained by weighting and summing the decision scores corresponding to each sub-dimension information based on the model weight coefficients corresponding to each scoring model.

3. The device dynamic authentication method according to claim 1, characterized in that, The device dynamic authentication method includes: When the security score of the first terminal device is greater than the second preset score, the number of authentication strategies in the first authentication strategy set is reduced to obtain a third authentication strategy set, wherein the second preset score is higher than the first preset score. The third authentication policy set is sent, wherein the gateway device authenticates the first terminal device based on the third authentication policy set.

4. The device dynamic authentication method according to claim 1, characterized in that, The device dynamic authentication method further includes: Obtain the gateway type of the gateway device; The gateway device determines a first authentication policy set based on its gateway type, wherein different gateway types correspond to different first authentication policy sets. When the first terminal device initiates an access request, the gateway device authenticates the first terminal device based on the first authentication policy set.

5. The device dynamic authentication method according to claim 1, characterized in that, The authentication process information includes the real-time characteristic information of the first terminal device, the offline characteristic information of the first terminal device, and the gateway characteristic information of the gateway device.

6. A method for dynamic device authentication, characterized in that, The device dynamic authentication method includes: Authentication is performed based on the first set of authentication strategies and the first terminal device; When a second authentication policy is obtained, authentication is performed with the first terminal device based on the second authentication policy set. During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, the backend server obtains authentication process information. The first authentication policy set includes at least one authentication policy. A security score for the first terminal device is determined based on the authentication process information. When the security score is less than a first preset score, an authentication policy from the first authentication policy set is added to obtain a second authentication policy set. The second authentication policy set is then sent.

7. The device dynamic authentication method according to claim 6, characterized in that, The authentication process based on the second authentication strategy set with the first terminal device includes: Remove the completed authentication strategies from the second authentication strategy set to obtain the fourth authentication strategy set; Authentication is performed on the first terminal device based on the fourth set of authentication strategies.

8. A device dynamic authentication device, characterized in that, The device dynamic authentication device includes: The acquisition module is used to acquire authentication process information during the authentication process between the gateway device and the first terminal device based on the first authentication policy set, wherein the first authentication policy set includes at least one authentication policy. The scoring module is used to determine the security score of the first terminal device based on the authentication process information. The adjustment module is used to add authentication strategies from the first authentication strategy set to obtain a second authentication strategy set when the security score of the first terminal device is less than the first preset score. The sending module is used to send the second authentication policy set, wherein the gateway device performs authentication with the gateway device based on the second authentication policy set.

9. A device dynamic authentication device, characterized in that, The device dynamic authentication device includes: The first authentication module is used to perform authentication with the first terminal device based on the first authentication strategy set. The second authentication module is used to authenticate the first terminal device based on the second authentication policy set when a second authentication policy is obtained. During the authentication process between the gateway device and the first terminal device based on the first authentication policy set, the backend server obtains authentication process information. The first authentication policy set includes at least one authentication policy. Based on the authentication process information, the backend server determines a security score for the first terminal device. When the security score is less than a first preset score, it adds an authentication policy from the first authentication policy set to obtain a second authentication policy set. Finally, it sends the second authentication policy set.

10. A backend server, characterized in that, The device includes a memory and a processor, the memory storing a computer program, and the processor running the computer program in the memory to perform the steps in the device dynamic authentication method according to any one of claims 1 to 5 or to perform the steps in the device dynamic authentication method according to any one of claims 6 to 7.

11. A gateway device, characterized in that, It includes a memory and a processor, the memory storing a computer program, and the processor running the computer program in the memory to perform the steps in the device dynamic authentication method according to any one of claims 6 to 7.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to execute the steps of the device dynamic authentication method according to any one of claims 1 to 5 or the steps of the device dynamic authentication method according to any one of claims 6 to 7.

13. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by the processor, they implement the steps in the device dynamic authentication method according to any one of claims 1 to 5 or the steps in the device dynamic authentication method according to any one of claims 6 to 7.

Images