When a security authentication request sent by a terminal is received, an identity authentication solution includes acquiring network environment information and user behavior data according to the security authentication request, then determining, according to the network environment information and the user behavior data, whether a current operation is a machine attack, and acquiring a CAPTCHA of a predetermined type according to a predetermined policy and delivering the CAPTCHA to the terminal if the current operation is a machine attack, to perform identity authentication, or determining that security authentication succeeds if the current operation is not a machine attack.