WO2019001566A1

WO2019001566A1 - Authentication method and device

Info

Publication number: WO2019001566A1
Application number: PCT/CN2018/093618
Authority: WO
Inventors: 冯继强
Original assignee: 苏州锦佰安信息技术有限公司
Priority date: 2017-06-29
Filing date: 2018-06-29
Publication date: 2019-01-03
Also published as: WO2019001558A1

Abstract

Provided by the present application is an authentication method and device, the method comprising: acquiring a plurality of parameters for a mobile terminal, wherein the plurality of parameters comprises operating environment, collected user behavior characteristics and an identifier that is used for uniquely determining the mobile terminal; authenticating the plurality of parameters by means of a preset intelligent analysis model; when the operating environment, user behavior characteristics and identifier within the plurality of parameters all pass authentication by the preset intelligent analysis model, confirming that an operator of the mobile terminal is a preset user thereof, and passing authentication. Thus, by means of authenticating a plurality of parameters, in particular user behavior characteristics within the plurality of parameters, the real-time behavior characteristics of a user are dynamic and are difficult to steal, which further increases the security of authentication and ensures a good user experience.

Description

Method and device for authentication

cross reference

This application claims the priority of the Chinese application numbered CN201710517649.4, filed on June 29, 2017, and the priority of the Chinese application numbering CN201710517666.8, filed on June 29, 2017. The content of the above application is hereby incorporated by reference.

Technical field

The present invention relates to the field of authentication, and in particular to a method and device for authentication.

Background technique

With the rapid development of the Internet, the situation of network security is becoming more and more complex and changing. People pay more and more attention to network security, and identity authentication is everywhere. The past identity authentication method can not meet the development of network security situation.

Existing authentication technologies, such as traditional character passwords, confirmation pushes, PIN (Personal Identification Number) codes, text messages, and voices, are all stolen, resulting in insufficient security.

Therefore, there is a need for a more secure authentication scheme.

Summary of the invention

Aiming at the defects in the prior art, the present invention proposes a method and device for authentication, which further improves the security of the authentication and ensures the use of the user by verifying the multi-parameters, especially the user behavior characteristics in the multi-parameters. Experience.

Specifically, the present invention proposes the following specific embodiments:

One embodiment of the present application provides a method for authentication implemented on a server, the server including at least one processor, a memory, and a communication platform connected to the network, the method comprising: acquiring at least one parameter of the terminal, The at least one parameter includes: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal; authenticating the at least one parameter by using a preset analysis model; and determining, according to the authentication result of the at least one parameter Whether the operator of the terminal is a preset user, and when the system running environment, the user behavior feature, and the verification of the terminal identifier in the at least one parameter are passed by the analysis model, the terminal is confirmed The operator is the default user itself and is authenticated.

In some embodiments, when the operating environment in the multivariate parameter, the user behavior feature, and the at least one verification of the identifier fail to pass the preset analysis model, determining that the authentication fails; and terminating the The process of certification.

In some embodiments, the analysis model includes an identifier of the plurality of mobile terminals, a behavior characteristic of the preset user corresponding to the plurality of mobile terminals, and a security database that determines whether the operating environment is secure.

In some embodiments, before acquiring the multi-parameter parameter of the terminal, the method further includes: receiving an authentication request of the terminal, where the authentication request includes information about the terminal; and matching the information based on the information of the terminal And transmitting a challenge authentication command to the terminal, so that the terminal uploads the at least one parameter to the server when receiving the challenge authentication command.

In some embodiments, the method further includes: releasing a process corresponding to the authentication on the terminal. Specifically, the release command may be transmitted to the terminal, and the terminal releases the process corresponding to the authentication on the terminal after executing the release command.

In some embodiments, the user behavior characteristic comprises sensor data generated by the terminal when operated by the operator.

In some embodiments, the user behavior characteristic comprises at least one of the following sensor data: rotation data, force data, orientation data, screen operation data, and input device operation data.

An embodiment of the present application provides an authentication device, including: an obtaining module, configured to acquire at least one parameter of a terminal, where the at least one parameter includes: a system operating environment of the terminal, a user behavior feature, and An identifier of the terminal, the authentication module, configured to authenticate the at least one parameter by using a preset analysis model, and a determining module, configured to determine, according to the authentication result of the at least one parameter, whether an operator of the terminal is Determining the user, when the system running environment, the user behavior feature, and the verification of the terminal identifier in the at least one parameter are passed by the analysis model, confirming that the operator of the terminal is preset The user himself, and the certification passed.

In some embodiments, the device further includes: a terminating module, configured to: when the at least one of the multi-parameters, the user behavior feature, and the identifier are not validated by a preset analysis model Determining that the authentication failed; and terminating the process of the authentication.

In some embodiments, the device further includes: a requesting module, configured to receive an authentication request of the terminal, where the authentication request includes information of the terminal; and a matching module, configured to be based on the terminal The information matches the terminal; and the challenge authentication module is configured to send a challenge authentication command to the terminal, so that the terminal uploads the at least one parameter to the server when receiving the challenge authentication command.

In some embodiments, the device further includes: a release module, configured to release a flow corresponding to the authentication on the terminal. Specifically, the release module may transmit a release command to the terminal, and after the terminal executes the release command, release the process corresponding to the authentication on the terminal.

In some embodiments, the user behavior characteristic comprises at least one of the following sensor data: rotation data, force data, orientation data, screen operation data, or input device operation data.

An embodiment of the present application provides an apparatus for authentication, including a processor, where the processor is configured to: acquire at least one parameter of a terminal, where the at least one parameter includes: a system operating environment of the terminal Determining the at least one parameter by using a preset analysis model; and determining, according to the authentication result of the at least one parameter, whether the operator of the terminal is a preset user, When the system running environment, the user behavior feature, and the verification of the terminal identifier in the at least one parameter are passed by the analysis model, confirm that the operator of the terminal is the preset user itself, and authenticate by.

One embodiment of the present application provides a computer readable storage medium, where the storage medium stores computer instructions, and when the computer reads a computer instruction in the storage medium, the computer performs a method of authenticating, where the method includes: acquiring at least a terminal a parameter, the at least one parameter comprising: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal; authenticating the at least one parameter by a preset analysis model; and according to the at least one parameter The result of the authentication is determined whether the operator of the terminal is a preset user, and when the verification of the system operating environment, the user behavior feature, and the verification of the terminal identifier in the at least one parameter is passed by the analysis model Confirm that the operator of the terminal is the preset user itself and pass the authentication.

One embodiment of the present application provides a method for authentication implemented on a terminal, where the terminal includes at least one processor, a memory, and a communication platform connected to the network, the method comprising: acquiring at least one parameter and sending the parameter to the server, The at least one parameter includes: a system operating environment of the terminal, a user behavior characteristic, and an identifier of the terminal; receiving server information, and determining, according to the server, whether the operator of the terminal is determined based on the at least one parameter The default user's judgment result passes or fails the certification.

The system of the present application provides an authentication system, which includes: an obtaining module, where the acquiring module is configured to acquire at least one parameter and send it to a server, where the at least one parameter includes: a system operating environment of the terminal, a user behavior feature and an identifier of the terminal; a receiving module, the receiving module, configured to receive server information, and determine, according to the server, whether the operator of the terminal is a preset user according to the at least one parameter that is authenticated by the server The judgment result passes or does not pass the certification.

An embodiment of the present application provides an authentication terminal, including a processor, where the processor is configured to: acquire at least one parameter and send the parameter to a server, where the at least one parameter includes: a system operating environment of the terminal. The user behavior characteristic and the identifier of the terminal; receiving server information, and passing or not authenticating according to whether the operator of the terminal determined by the server based on the at least one parameter is the default user's judgment result.

One embodiment of the present application provides a computer readable storage medium storing computer instructions for performing a method of authentication after a computer reads a computer instruction in a storage medium, the method comprising: acquiring at least one parameter And sending to the server, the at least one parameter includes: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal; receiving server information, and determining, according to the at least one parameter, the terminal according to the server Whether the operator passes the authentication or not the authentication result of the preset user.

The embodiment of the invention also provides a method for authentication, including:

Obtaining a multi-parameter parameter of the mobile terminal, where the multi-parameter parameter comprises: an operating environment, collected user behavior characteristics, and an identifier for uniquely determining the mobile terminal;

The multi-parameter parameter is authenticated by a preset intelligent analysis model;

When the operating environment of the multivariate parameter is passed by the intelligent analysis model, the user behavior feature and the verification of the identifier are all passed, confirming that the operator of the mobile terminal is the preset user itself, and the authentication is passed. .

In a specific embodiment, before acquiring the multi-parameter parameters of the mobile terminal, the method further includes:

Receiving an authentication request, where the authentication request includes information of the mobile terminal to be authenticated;

Matching the mobile terminal corresponding to the authentication request based on the information;

Sending a challenge authentication to the mobile terminal, so that the mobile terminal reports the multi-parameter parameter.

In a specific embodiment, the method further includes:

When the running environment of the multivariate parameter is not passed through the preset intelligent analysis model, the user behavior feature and the verification of the identifier are not completely passed, the authentication fails, and the process corresponding to the authentication on the mobile terminal is terminated. .

In a specific embodiment, the method further includes:

The flow corresponding to the authentication on the mobile terminal is released.

In a specific embodiment, the smart analysis model stores an identifier of each mobile terminal, and a human behavior characteristic of the preset user corresponding to each mobile terminal, and a security database that determines whether the operating environment is secure;

The method also includes:

The multivariate data is stored in a database in the intelligent analysis model.

The embodiment of the invention further provides an authentication device, including:

An obtaining module, configured to obtain a multi-parameter parameter of the mobile terminal, where the multi-parameter parameter includes: an operating environment, collected user behavior characteristics, and an identifier for uniquely determining the mobile terminal;

An authentication module, configured to authenticate the multi-parameter parameter by using a preset intelligent analysis model;

a determining module, configured to confirm that an operator of the mobile terminal is a preset user when the operating environment of the multivariate parameter, the user behavior feature, and the verification of the identifier are passed by the intelligent analysis model Self, and passed the certification.

In a specific embodiment, the device further includes:

a requesting module, configured to receive an authentication request, where the authentication request includes information about the mobile terminal to be authenticated;

In a specific embodiment, the device further includes:

a termination module, configured to: when the operating environment in the multivariate parameter is passed through a preset intelligent analysis model, the user behavior feature and the verification of the identifier are not completely passed, the authentication fails, and the corresponding correspondence on the mobile terminal is terminated. The process of the certification.

In a specific embodiment, the device further includes:

The release module is configured to release the process corresponding to the authentication on the mobile terminal.

The device also includes:

a storage module, configured to store the multivariate data in a database in the intelligent analysis model.

In this way, the embodiment of the present invention provides a method and device for authentication, where the method includes: acquiring multi-parameter parameters of the mobile terminal, where the multi-parameter parameters include: an operating environment, collected user behavior characteristics, and is used for uniquely determining The identifier of the mobile terminal; the multi-parameter parameter is authenticated by a preset intelligent analysis model; when the multi-parameter running environment, the user behavior feature, and the identifier are used by a preset intelligent analysis model When the verification is passed, it is confirmed that the operator of the mobile terminal is the preset user itself, and the authentication is passed. In this way, by verifying the multi-parameters, especially the user behavior characteristics in the multi-parameters, the user's instant behavior characteristics are dynamic and not easily stolen, further improving the security of the authentication and ensuring the user's experience.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly described below. It should be understood that the following drawings show only certain embodiments of the present invention, and therefore It should be seen as a limitation on the scope, and those skilled in the art can obtain other related drawings according to these drawings without any creative work.

1 is a schematic flowchart of a method for authentication according to an embodiment of the present invention;

2 is a schematic diagram of a method for authentication according to an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of an apparatus for authentication according to an embodiment of the present invention;

4 is a schematic structural diagram of an apparatus for authentication according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an apparatus for authentication according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of an apparatus for authentication according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of an apparatus for authentication according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of an application scenario of an authentication system according to an embodiment of the present invention.

Detailed ways

In the following, various embodiments of the present disclosure will be described more fully. The present disclosure can have various embodiments, and adjustments and changes can be made therein. It should be understood, however, that the present invention is not limited to the specific embodiments disclosed herein, but the invention is to be construed as being included within the spirit and scope of the various embodiments of the present disclosure. All adjustments, equivalents and/or alternatives.

In the following, the term "comprising" or "including" may be used in the various embodiments of the present disclosure to indicate the presence of the disclosed function, operation or element, and does not limit one or more functions, operations or elements. increase. In addition, the terms "comprising," "having," "," It should not be understood that the existence or addition of one or more features, numbers, steps, operations, components or components of one or more other features, numbers, steps, operations, components, components or combinations of the foregoing are excluded. Or the possibility of a combination of the foregoing.

In various embodiments of the present disclosure, the expression "or" or "at least one of A or / and B" includes any or all combinations of the simultaneously listed characters. For example, the expression "A or B" or "at least one of A or / and B" may include A, may include B, or may include both A and B.

Expressions used in various embodiments of the present disclosure (such as "first", "second", etc.) may modify various constituent elements in various embodiments, but the corresponding constituent elements may not be limited. For example, the above statements do not limit the order and/or importance of the elements. The above statements are only used for the purpose of distinguishing one element from another. For example, the first user device and the second user device indicate different user devices, although both are user devices. For example, a first element could be termed a second element, and a second element could be termed a first element, without departing from the scope of the various embodiments of the present disclosure.

It should be noted that if the description "connects" one constituent element to another constituent element, the first constituent element can be directly connected to the second constituent element and can be "connected" between the first constituent element and the second constituent element. "The third component. On the contrary, when a constituent element is "directly connected" to another constituent element, it is understood that there is no third constituent element between the first constituent element and the second constituent element.

The term "user" as used in various embodiments of the present disclosure may indicate a person using an electronic device or a device using an electronic device (for example, an artificial intelligence electronic device).

The terms used in the various embodiments of the present disclosure are only for the purpose of describing the specific embodiments and are not intended to limit the various embodiments of the present disclosure. As used herein, the singular forms " All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of the present disclosure pertain, unless otherwise defined. The term (such as a term defined in a commonly used dictionary) will be interpreted as having the same meaning as the contextual meaning in the related art and will not be interpreted as having an idealized meaning or an overly formal meaning, Unless clearly defined in the various embodiments of the present disclosure.

FIG. 8 is a schematic diagram of an application scenario of an authentication system (or an authentication device) according to some embodiments of the present application. The authentication system 800 can be an online service platform for Internet services. For example, the authentication system 800 can be applied to any combination of one or more of a game platform, a shopping platform, an instant messaging platform, a trading platform, an entertainment platform, an educational platform, and the like. In some embodiments, the authentication system 800 can determine if the operating environment of the terminal is good (eg, is it secure enough to perform an authentication operation). In some embodiments, the authentication system 800 can identify whether the operator of a terminal is a preset user (eg, whether it is the owner of the terminal, whether it is a user of a particular account under an application, etc.). Some of the technical goals that can be implemented include improving the reliability of the authentication and ensuring the user experience while ensuring the security of the authentication environment. As shown in FIG. 8, the authentication system 800 can include a server 810, a network 820, a terminal 830, and a database 840. The server 810 can include a processing device 812.

In some embodiments, server 810 can be used to process information and/or data related to authentication. Server 810 can be a standalone server or group of servers. The server group can be centralized or distributed (e.g., server 810 can be a distributed system). The server 810 can be regional or remote in some embodiments. For example, server 810 can access information and/or materials stored in terminal 830 and/or database 840 over network 820. In some embodiments, server 810 can interface directly with terminal 830 and/or database 840 to access information and/or materials stored therein. In some embodiments, server 810 can execute on a cloud platform. For example, the cloud platform may include one of a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, and the like, or any combination thereof.

In some embodiments, server 810 can include processing device 812. The processing device 812 can process data and/or information related to authentication to implement one or more of the functions described in this application. For example, the processing device 812 can authenticate the multivariate parameters through a preset intelligent analysis model. In some embodiments, processing device 812 can include one or more sub-processing devices (eg, a single core processing device or a multi-core multi-core processing device). By way of example only, processing device 812 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), an application specific instruction processor (ASIP), a graphics processing unit (GPU), a physical processor (PPU), a digital signal processor ( DSP, Field Programmable Gate Array (FPGA), Editable Logic (PLD), Controller, Microcontroller Unit, Reduced Instruction Set Computer (RISC), microprocessor, etc., any combination of one or more. In some embodiments, the server 810 can also be one or more components of the terminal 830, the server 810 can communicate with the terminal 830 in the same program, or the server 810 can communicate with the terminal 830 between different programs. In some embodiments, server 810 can be implemented on a computing device having one or more modules as described in Figures 3-7 of the present application.

Network 820 can facilitate the exchange of data and/or information. In some embodiments, one or more components of authentication system 800 (e.g., server 810, terminal 830, and database 840) can transmit data and/or information over network 820 to other components in authentication system 800. For example, server 810 can obtain user behavior characteristics from terminal 830 over network 820. In some embodiments, network 820 can be any type of wired or wireless network. For example, network 820 can include a cable network, a wired network, a fiber optic network, a telecommunications network, an internal network, an internet network, a regional network (LAN), a wide area network (WAN), a wireless area network (WLAN), a metropolitan area network (MAN). , public switched telephone network (PSTN), Bluetooth network, ZigBee network, near field communication (NFC) network, etc. or any combination of the above. In some embodiments, network 820 can include one or more network access points. For example, network 820 can include wired or wireless network access points, such as base stations and/or internetwork exchange points 820-1, 820-2, ... through which one or more components of authentication system 800 can be connected. Network 820 is exchanged for data and/or information.

In some embodiments, the terminal may be a mobile terminal (ie, a mobile terminal) or a fixed terminal, such as a mobile phone 830-1, a tablet 830-2, a notebook computer 830-3, an in-vehicle device 830-4, and a desktop. Computer, built-in computer, etc. In some embodiments, the terminal may also include a wearable device, a virtual reality device, and/or an augmented reality device, etc., or any combination thereof. In some embodiments, the wearable device can include a smart bracelet, smart footwear, smart glasses, smart helmet, smart watch, smart wear, smart backpack, smart accessory, and the like, or any combination thereof. In some embodiments, the virtual reality device and/or the augmented reality device may include a virtual reality helmet, virtual reality glasses, virtual reality eyewear, augmented reality helmet, augmented reality glasses, an augmented reality eye mask, and the like, or any combination thereof. For example, virtual reality devices and / or augmented reality device may include ^{^{Google Glass TM, RiftCon TM, Fragments}} TM, Gear VR TM like. In some embodiments, the terminal and server may be integrated or the terminal may be one or more components of the server. In some alternative embodiments, the terminal may be any device having one or more sensors that may be used to obtain user behavior characteristics, and the application does not limit the form of the terminal. In some embodiments, specifically, only the written terminal device is used in the present application.

Database 840 can store data and/or instructions. In some embodiments, database 840 can store material obtained from terminal 830. In some embodiments, database 840 can store information and/or instructions for execution or use by server 810 to perform the example methods described herein. For example, database 840 can store user behavior characteristics associated with the operation of the terminal from terminal 830. In some embodiments, database 840 can store data and/or instructions that server 810 uses to execute or use to perform the exemplary methods described herein. For example, database 840 can store instructions for authenticating multivariate parameters through a predetermined intelligent analysis model, which can be executed by processing device 812. In some embodiments, database 840 can include any combination of one or more of mass storage, removable storage, volatile read and write memory (eg, random access memory RAM), read only memory (ROM), and the like. In some embodiments, database 840 can be implemented on a cloud platform. For example, the cloud platform may include any combination of one or more of a private cloud, a public cloud, a hybrid cloud, a community cloud, a community cloud, a distributed cloud, an internal cloud, and the like.

In some embodiments, database 840 can be coupled to network 820 to communicate with one or more components of authentication system 800 (eg, server 810, terminal 830, etc.). One or more components of authentication system 800 can access data or instructions stored in database 840 over network 820. In some embodiments, database 840 can interface or communicate directly with one or more components (e.g., server 810, terminal 830, etc.) in authentication system 800. In some embodiments, database 840 can be part of server 810. In some embodiments, one or more components (eg, server 810, terminal 830, etc.) in authentication system 800 may have access to database 840.

Example 1

Embodiment 1 of the present invention discloses a method for authentication, as shown in FIG. 1, which includes the following steps:

Step 101: Obtain at least one parameter (also referred to as a multi-parameter parameter) of the terminal (such as a mobile terminal), and the following mainly uses a mobile phone as an example for description. In some embodiments, the at least one parameter (multiple parameter) may include: a system operating environment of the terminal, collected user behavior characteristics, and an identifier for uniquely determining the mobile terminal. In some embodiments, the multivariate parameter may be only one or two of them, for example, the multivariate parameter may be only the collected user behavior characteristics; and, for example, the multivariate parameter may include only the collected user behavior characteristics and for unique Determining an identity of the mobile terminal. In some embodiments, the multivariate parameter may also include other parameters, such as a user's biometric features (such as facial features, fingerprint features, etc.), user's linguistic features, user-entered information features (such as entered passwords, etc.), etc. There is no restriction on the application.

Specifically, in some embodiments, the operating environment may include a network security environment when the mobile phone is running, such as whether there is a virus, whether malicious code is embedded, whether an environmental requirement for a secure operation is reached, or whether a high-risk website is accessed. In some embodiments, the operating environment can include a system security environment of the terminal. For example, whether the mobile terminal is open to root privileges, whether it is jailbroken (for example, Untethered Jailbreak, Tethered Jailbreak), and the like. In some embodiments, the operating environment may also include an externally detected secure environment. For example, whether the mobile terminal moves abnormally or the like. Specifically, the server (such as the server 810) can track and locate the mobile terminal by using a positioning system (such as GPS), if the mobile terminal moves from the location A to the distance in a short time (for example, 3 seconds, 5 seconds, etc.) The remote location B (for example, the locations A and B are several hundred kilometers apart, several thousand kilometers, etc.), the mobile terminal can be considered as an abnormal movement, thereby judging that the mobile terminal operating environment is unsafe. In some embodiments, the operating environment may also include hardware and/or software parameters of the mobile terminal. Specifically, the hardware and/or software parameters of the mobile terminal may include one or more configuration parameters of a central processing unit (CPU), a memory, a screen resolution, a camera pixel, a battery capacity, and the like. In some embodiments, the server can determine whether the mobile terminal is modified or falsified by detecting whether the hardware and/or software parameters of the mobile terminal are changed (such as abnormal changes), thereby determining whether the operating environment is secure. In some embodiments, the security of the operating environment is an important condition for ensuring the security of subsequent authentication. Therefore, the authentication for the operating environment may take precedence over other authentications.

In some embodiments, the user's behavioral characteristics may be data caused by the user's biological behavior when the user operates the mobile terminal, such as movement trajectory, pressing pressure, moving range, moving speed, moving frequency, moving angle, grip strength, pressing Frequency, posture, etc. In some embodiments, the user behavior characteristics may be embodied by the client's rotation data, the client's force data, the client's orientation data, the client's screen operation data, the client's input device operation data, the client's image-aware data, and the client's magnetic field. Any combination of one or more of perceptual data, infrared sensing data of the client, and the like. In some embodiments, the server can determine user behavior actions through sensor data. For example, the server can determine the behavioral characteristics such as the grip strength, the pressing force, the posture posture, the movement amplitude, the movement frequency, and the movement speed when the user operates the mobile terminal by rotating the data, the force data, the orientation data, and the like. In some embodiments, the user behavior feature can include sensor data that reflects at least one operational behavior of the operator to the terminal. The sensor may include a GPS positioning device, a gyroscope, a position sensor, a speed sensor, an acceleration sensor, a torque sensor, a force sensor, a pressure sensor, a magnetometer, a camera, an acoustic sensor, a temperature sensor, a humidity sensor, a load cell, and a flow rate. Sensor, liquid level sensor, distance sensor, water immersion sensor, illuminance sensor, thermal sensor, light sensor, gas sensor, magnetic sensor, humidity sensor, sound sensor, radiation sensitive sensor, color sensor, taste sensor , resistive sensor, capacitive sensor, inductive sensor, piezoelectric sensor, electromagnetic sensor, magnetoresistive sensor, photoelectric sensor, piezoresistive sensor, thermoelectric sensor, nuclear radiation sensor, semiconductor sensor, etc. Any combination of species or multiples. In some embodiments, the sensor can be an embedded device of the mobile terminal. In some embodiments, the sensor can also be an external device of the mobile terminal. In some embodiments, the mobile terminal can acquire user behavior characteristics through the sensor. For example, the mobile terminal can acquire three-dimensional spatial component information (for example, numerical values and direction information in the x, y, and z directions) of rotation, force, and orientation through a gyroscope, an acceleration sensor, a magnetometer, or the like, and perform the above data. Further processing to obtain information such as rotation data, force data, and orientation data of the mobile terminal. For another example, the mobile terminal can also obtain information such as the strength and orientation of the user's own magnetic field through a magnetometer, and acquire other user behavior characteristic data through a machine learning process.

In some embodiments, the user behavior feature can also include non-sensor data. In some embodiments, the non-sensor data may include a habit of a user operating a screen or input using an input device such as a mouse, trackpad, keyboard, or the like. For example, the user inputs the field information through the keyboard of the mobile terminal, and the server can obtain the time difference of the user pressing each keyboard character in the process of inputting the field information and/or the total duration of inputting the complete field information, etc. as the user behavior feature. For another example, the user can scan the nine-square grid input information in the touch screen of the mobile terminal, and the server can acquire the time interval of the user sliding through each point or the like as a user behavior feature.

In some embodiments, the identity (e.g., mobile terminal identity) may be unique to determine the mobile terminal (e.g., cell phone) to avoid the risks (e.g., authentication errors) used on other handsets. In some embodiments, the mobile terminal identifier may be an International Mobile Equipment Identity (IMEI), a CDMA Mobile Equipment IDentifier, a Universally Unique Identifier (UUID), or a mobile phone network. MAC address, Bluetooth address, hardware serial number, etc., or any combination thereof.

In some embodiments, multiple parameters such as the operating environment, user behavior characteristics, and mobile terminal identification can be transmitted over the network to the server. In some embodiments, the multivariate parameters may be encrypted as they are transmitted. In some embodiments, algorithms for encrypting transmission of multivariate parameters may include digest algorithms (eg, MD5, SHA1, etc.), hash algorithms (eg, SM3, etc.), symmetric encryption algorithms (eg, AES, DES, IDEA, SSF33, SM1, SM4, SM7, etc.), any combination of one or more of asymmetric encryption algorithms (eg, SM2, SM9, RSA, etc.). In some embodiments, after the terminal obtains the multivariate parameter, the multivariate parameter may be encrypted, and the encrypted multivariate parameter is transmitted to the server, and after receiving the encrypted multivariate parameter, the server may perform decryption and then The decrypted multivariate parameters are processed.

In some embodiments, the server can obtain the multivariate parameter during the user login process. For example, when the user logs in to the mobile terminal and/or the application by inputting a password, the server can obtain multiple parameters such as an operating environment, a user behavior characteristic, and a mobile terminal identifier of the user during the login start to the login completion process. In some embodiments, the server may obtain the multivariate parameters described above during user operation. For example, when the user performs the password recovery operation, the server can acquire the above multivariate parameters of the user from the start of the operation to the end of the operation.

In some embodiments, subsequent verification may verify whether the environment at runtime is secure, whether the behavior characteristic of the user is a preset user corresponding to the mobile terminal (eg, the owner of the mobile terminal), and whether the operation is performed on the designated mobile phone. of. In some embodiments, only all three of them are satisfied, and all verifications are passed, and the final verification will pass.

Step 102: Perform multi-parameter authentication by using a preset analysis model (such as an intelligent analysis model);

Specifically, the smart analysis model stores an identifier of each terminal (such as a mobile terminal), a human behavior characteristic of the preset user corresponding to each mobile terminal, and a security database that determines whether the operating environment is secure; The multivariate parameters can be effectively identified to determine whether the verification passes, and ultimately determine whether the operation corresponding to the authentication needs to be performed normally or should be aborted. In some embodiments, one mobile terminal may correspond to one or more users (eg, multiple users). In some embodiments, one user may also correspond to multiple mobile terminals.

In some embodiments, multiple parameters such as the operating environment, user behavior characteristics, and mobile terminal identification can be authenticated simultaneously. For example, the server can simultaneously acquire multiple parameters such as the system operating environment, user behavior characteristics, and mobile terminal identification of the terminal and send them to the big data processing end. The big data processing end can simultaneously analyze and authenticate the multivariate parameters and return the verification result. The analysis confirms the verification result and sends information to the mobile terminal, and the information can be used to prompt the success or failure of the current authentication.

In some embodiments, the runtime environment, mobile terminal identification, and user behavior characteristics may be verified in turn. For example, the server may preferentially obtain the running environment parameter and send it to the big data processing end, and the big data processing end analyzes and authenticates the running environment parameter and returns the verification result. In some embodiments, if the running environment check result fails (meaning that the operating environment of the terminal may be unsafe), the server may terminate the authentication operation and send information to the mobile terminal. For example, the server may prompt the authentication failure. And / or prompt the current operating environment is abnormal. In some embodiments, if the running environment check result is successful (meaning that the operating environment of the terminal is relatively safe), the server may continue to acquire the mobile terminal identity and user behavior characteristics and send the data to the big data processing end, and the big data processing end may be based on The mobile terminal identifier determines a human behavior characteristic of the preset user corresponding to the mobile terminal, and compares the user behavior feature with the human behavior characteristic of the preset user to confirm whether the user is a preset user of the mobile terminal. In some embodiments, if the user behavior feature and the verification result of the mobile terminal identity fail, the server may terminate the authentication operation and send information to the mobile terminal, for example, may prompt the authentication failure and/or prompt the current user behavior. The feature is abnormal. If the user behavior feature and the verification result of the mobile terminal identity are successful, the server may send a message to the mobile terminal to prompt the current authentication success and/or release the current authentication operation.

In some embodiments, the analysis model can include a deep learning model, a machine learning model, and the like. Specifically, the analysis model may include, but is not limited to, a deep neural network (DNN), a convolutional neural network (CNN), a cyclic neural network (RNN), a feature pyramid network (FPN), and the like. In some embodiments, the big data processing end can acquire the analysis model through training. Specifically, the big data processing end can acquire original multivariate parameters such as an operating environment, a user behavior feature, and a mobile terminal identifier. In some embodiments, the raw data of the user behavior feature may be behavior characteristic data when a specific user operates a specific terminal, behavior characteristic data when a specific user operates a different terminal, behavior characteristic data when a specific user operates a specific terminal, and the like. In some embodiments, the original multivariate parameters can be divided into training parameters and test parameters, wherein the training parameters can be used for model training, and the test parameters can be used to test the training effects of the intelligent analysis model to adjust and correct the intelligent analysis model. Parameters. In some embodiments, the analysis model can be a comprehensive model capable of authenticating the operating environment, user behavior characteristics, and mobile terminal identification. In some embodiments, the analysis model can also include multiple sub-models. For example, the analysis model may include an operating environment authentication model, a user behavior feature authentication model, and a mobile terminal identity authentication model for authenticating the operating environment, user behavior characteristics, and mobile terminal identification, respectively.

Step 103: When the running environment of the multivariate parameter, the user behavior feature, and the verification of the identifier are passed by the analysis model, confirm that the operator of the mobile terminal is the preset user itself, and Certification passed.

In some embodiments, the server may set an authentication limit to avoid malicious authentication, machine authentication, and the like. For example, the server may limit the number of authentications (eg, 1 time, 3 times, 5 times, 10 times, etc.) of the same user per unit time (eg, 1 hour, half day, 1 day, 1 week, etc.). For another example, the server can limit the number of authentications of different users in the same mobile terminal unit time. Specifically, the server can limit the number of users who can perform authentication operations on the same terminal per unit time (for example, 1 hour, half day, 1 day, 1 week, etc.) (for example, 1, 3, 5, 10) And the number of verifications of each of the users (eg, 1 time, 3 times, 5 times, 10 times, etc.). In some embodiments, the server and/or the mobile terminal may include a defense mechanism. For example, if the number of verification failures exceeds a preset number of times, the server and/or the mobile terminal may lock the mobile terminal within a preset time, so that the user only has The authentication operation can be performed again after the preset time. In some embodiments, the server may also send prompt information to the associated account of the mobile terminal. For example, if the verification fails and/or the number of failed verifications exceeds the preset number of times, the server may send a prompt message to the associated account, prompting login or authentication abnormality. In some embodiments, the associated account includes, but is not limited to, a mobile number, a mailbox account, an instant messaging account, etc., or any combination thereof.

Specifically, the operating environment needs to be secured, or for example, the risk value is less than a preset value, the identifier needs to match the identifier in the security database, and the user behavior feature needs to match the human behavior characteristic.

Specifically, the multi-parameter parameter can be obtained in various ways, for example, the behavior characteristics of the user can be, for example, a sensor on a mobile phone, such as a gyroscope, a GPS positioning device, a pressure sensor, a position sensor, a speed sensor, an acceleration sensor, a torque sensor, The force sensor, the magnetometer, or the like, or any combination thereof, is used for acquisition. For example, the operating environment may be acquired by, for example, network detection, and the identifier may be read from the information or identified by the preset information. In the character segment.

In a specific embodiment, the method further includes:

Specifically, for example, when the process corresponding to the authentication is, for example, payment, in this case, if the authentication fails, the process of the payment needs to be terminated, so as to ensure security and avoid risks.

In a specific embodiment, when the authentication is passed, the method further includes:

In a specific embodiment, the method further includes:

Specifically, new data is continuously generated to generate multivariate data stored in a database in the intelligent analysis model, so that subsequent identification is more and more accurate.

Thus, in a specific embodiment, as shown in FIG. 2, a complete identity authentication process is as follows:

1. The authenticated service initiates an authentication request to the authentication processing server. Specifically, the mobile terminal may send an authentication request to the server. In some embodiments, the authentication request may include, but is not limited to, software and/or application account number, software development kit (SDK) unique identification, and the like. In some embodiments, the authentication request can be transmitted over the network to the server. In some embodiments, the transmission of the authentication request can be encrypted.

2. The authentication processing server matches the software and application programs in the mobile terminal and/or the mobile terminal corresponding to the mobile phone corresponding to the request. In some embodiments, one or more software development kits (SDKs), software and/or applications, etc., may be embedded in the handset. The Software Development Kit (SDK) can generate different unique identifiers for different software and/or application accounts, which can be associated with the one or more software and/or application accounts, respectively.

3. The authentication processing server sends challenge authentication to the user's mobile phone. In some embodiments, the server may send a challenge password to the mobile terminal according to the received authentication request, and the challenge password may include, but is not limited to, an authentication request, an authentication sequence number, random data, a server user name, and the like.

4. The mobile phone sends the current mobile phone environment, user behavior mode, mobile phone security and the like to the authentication processing server.

5. The authentication processing server sends the received information to the big data machine learning server. In some embodiments, a big data machine learning server can be used to analyze the runtime environment, mobile identity, and user behavior characteristics and their associated information and/or data.

6. The big data machine learning server analyzes whether the current user is the user, whether the environment is abnormal, etc. according to the model established in the user information collection process, and returns the verification result. In some embodiments, the authentication processing server and the big data machine learning server may be separate servers for separately processing the above functions. In some embodiments, the authentication processing server and the big data machine learning server may be the same server (eg, server 810).

7. The authentication processing server releases or rejects the service authentication request in the first step according to the verification result. In some embodiments, the authentication processing server can receive and confirm the verification results returned by the big data machine learning server. If the verification result is confirmed to be successful, the authentication processing server may send a prompt message to the mobile terminal (such as prompting that the authentication is successful) and release the service authentication request. In particular, the release operation can be performed by the release module 206. If the verification result fails to be confirmed, the authentication processing server may send a prompt message to the mobile terminal (such as prompting the authentication failure) and reject the service authentication request, and terminate the authentication operation. In particular, the termination operation can be performed by the termination module 205.

Therefore, the authentication method of the scheme has the following characteristics:

1. The concept of safety certification is diversified, including three-factor authentication, that is, information that the user knows (mobile phone environment), the authentication facility held by the user (the mobile phone itself), and the user biometric (user behavior);

2. Sensitive data is encrypted to prevent data transmission and storage;

3. Certification is mobile, diversified and unique. Mobileization is reflected in the use of mobile devices and other mobile device authentication. Diversification is the ability to add and delete authentication factors according to their own needs. The uniqueness is reflected in the fact that there is no authentication system similar to this product at present;

4. The back-end uses machine learning, big data analysis, and intelligent identification and analysis of data to accurately determine whether user authentication is legal;

5. The biggest difference from the current face recognition, fingerprint recognition, voice recognition, and blink recognition technology is the three factors. Not a single factor can complete the certification, and each factor replication is very low.

6, easy to use, safe and efficient, keep pace with the times.

Example 2

Embodiment 2 of the present invention discloses an authentication device. As shown in FIG. 3, the device may include:

The obtaining module 201 is configured to obtain a multi-parameter parameter of the mobile terminal, where the multi-parameter parameter may include: an operating environment, the collected user behavior feature, and an identifier for uniquely determining the mobile terminal.

The authentication module 202 is configured to authenticate the multi-parameter through a preset intelligent analysis model. In some embodiments, the intelligent analysis model can be a deep learning model. For example, the intelligent analysis model may include, but is not limited to, a deep neural network (DNN), a convolutional neural network (CNN), a cyclic neural network (RNN), a feature pyramid network (FPN), and the like. In some embodiments, the runtime environment, user behavior characteristics, and mobile terminal identification can be verified simultaneously. In some embodiments, the runtime environment, mobile terminal identification, and user behavior characteristics may be verified in turn.

The determining module 203 is configured to confirm that the operator of the mobile terminal is a preset when the running environment of the multivariate parameter, the user behavior feature, and the verification of the identifier are passed by a preset intelligent analysis model The user himself, and the certification passed.

In a specific embodiment, as shown in FIG. 4, the device further includes:

The requesting module 204 is configured to receive an authentication request, where the authentication request includes information about the mobile terminal to be authenticated. In some embodiments, the authentication request may also include software and/or application related information in the mobile terminal to be authenticated.

A mobile terminal corresponding to the authentication request is matched based on the information; in some embodiments, this step can be performed by a matching module.

Sending a challenge authentication to the mobile terminal, so that the mobile terminal reports the multi-parameter parameter. In some embodiments, this step can be performed by a challenge authentication model.

In a specific embodiment, as shown in FIG. 5, the device further includes:

The termination module 205 is configured to: when the operating environment in the multivariate parameter is passed through a preset intelligent analysis model, the user behavior feature and the verification of the identifier are not completely passed, the authentication fails, and the mobile terminal is terminated. Corresponding to the process of the certification.

In a specific embodiment, as shown in FIG. 6, the device further includes:

The release module 206 is configured to release the process corresponding to the authentication on the mobile terminal.

In a specific embodiment, the smart analysis model stores an identifier of each mobile terminal, and a behavioral human feature of the preset user corresponding to each mobile terminal, and a security database that determines whether the operating environment is secure;

In a specific embodiment, as shown in FIG. 7, the device further includes: a storage module 207, configured to store the multivariate data in a database in the intelligent analysis model.

It should be understood that the systems (e.g., devices) and their modules illustrated in Figures 3-7 can be implemented in a variety of ways. For example, in some embodiments, the system and its modules can be implemented in hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the methods and systems described above can be implemented using computer-executable instructions and/or embodied in processor control code, such as a carrier medium such as a magnetic disk, CD or DVD-ROM, such as read-only memory (firmware) Such code is provided on a programmable memory or on a data carrier such as an optical or electronic signal carrier. The system of the present application and its modules can be implemented not only with hardware such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, and the like. It can also be implemented by, for example, software executed by various types of processors, or by a combination of the above-described hardware circuits and software (for example, firmware).

It should be noted that the above description of the authentication system and its modules is merely for convenience of description, and the present application is not limited to the scope of the embodiments. It will be understood that, after understanding the principles of the system, it is possible for those skilled in the art to arbitrarily combine the various modules or connect the other subsystems without departing from the principle. For example, in some embodiments, the obtaining module 201, the authentication module 202, the determining module 203, the requesting module 204, the terminating module 205, the releasing module 206, and the storage module 207 may be different modules in one system, or may be implemented in one module. The functions of the above two or more modules. The above modules can be flexibly matched and combined as needed, and are not limited to several specific embodiments in the drawings of the specification.

In this way, the embodiment of the present invention provides a method and device for authentication, where the method includes: acquiring multi-parameter parameters of the mobile terminal, where the multi-parameter parameters include: an operating environment, collected user behavior characteristics, and is used for uniquely determining The identifier of the mobile terminal; the multi-parameter parameter is authenticated by a preset intelligent analysis model; when the multi-parameter running environment, the user behavior feature, and the identifier are used by a preset intelligent analysis model When the verification is passed, it is confirmed that the operator of the mobile terminal is the preset user itself, and the authentication is passed. In this way, by verifying the multi-parameters, especially the user behavior characteristics in the multi-parameters, the user's real-time behavior characteristics are dynamic and not easily stolen, further improving the security of the authentication and ensuring the user experience.

A person skilled in the art can understand that the drawings are only a schematic diagram of a preferred implementation scenario, and the modules or processes in the drawings are not necessarily required to implement the invention.

A person skilled in the art may understand that the modules in the apparatus in the implementation scenario may be distributed in the apparatus for implementing the scenario according to the implementation scenario description, or may be correspondingly changed in one or more devices different from the implementation scenario. The modules of the above implementation scenarios may be combined into one module, or may be further split into multiple sub-modules.

The above-mentioned serial numbers of the present invention are merely for description, and do not represent the advantages and disadvantages of the implementation scenario.

The above disclosure is only a few specific implementation scenarios of the present invention, but the present invention is not limited thereto, and any changes that can be made by those skilled in the art should fall within the protection scope of the present invention.

Claims

A method of authentication implemented on a server, the server comprising at least one processor, a memory, and a communication platform connected to the network, the method comprising:

Acquiring at least one parameter of the terminal, where the at least one parameter includes: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal;

Authenticating the at least one parameter by a preset analysis model;

Determining, according to the authentication result of the at least one parameter, whether an operator of the terminal is a preset user, when a system operating environment, the user behavior feature, and the terminal in the at least one parameter are used by the analysis model When the verification of the identification is passed, it is confirmed that the operator of the terminal is the preset user itself, and the authentication is passed.
The method of claim 1 further comprising:

Determining the authentication failure when the system operating environment of the multivariate parameter is passed, the user behavior feature, and the at least one verification of the terminal identifier fail by a preset analysis model; and terminating the authentication process.
The method according to claim 1, wherein the analysis model comprises an identifier of a plurality of mobile terminals, a behavior characteristic of a preset user corresponding to the plurality of mobile terminals, and a security for determining whether the operating environment of the system is safe. database.
The method of claim 1 further comprising: before acquiring the multivariate parameters of the terminal, further comprising:

Receiving an authentication request of the terminal, where the authentication request includes information about the terminal;

Matching the terminal based on information of the terminal;

Sending a challenge authentication command to the terminal, so that the terminal uploads the at least one parameter to the server when receiving the challenge authentication command.
The method of claim 1, further comprising: releasing a flow corresponding to said authenticating on said terminal.
The method of claim 1 wherein said user behavior characteristic comprises sensor data generated by said terminal when operated by said operator.
The method of claim 6 wherein said user behavior characteristic comprises at least one of the following sensor data: rotation data, force data, orientation data, screen operation data, and input device operation data.
An authentication device, comprising:

An acquiring module, configured to acquire at least one parameter of the terminal, where the at least one parameter includes: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal;

An authentication module, configured to authenticate the at least one parameter by using a preset analysis model;

a determining module, configured to determine, according to the authentication result of the at least one parameter, whether an operator of the terminal is a preset user, when a system operating environment, the user behavior in the at least one parameter is used by the analysis model When the feature and the verification of the terminal identifier are all passed, it is confirmed that the operator of the terminal is the preset user itself, and the authentication is passed.
The device of claim 8 further comprising:

a termination module, configured to determine that the authentication fails when the system operating environment in the multivariate parameter is passed through a preset analysis model, the user behavior feature and at least one verification of the identifier fail; and terminating the termination The process of certification.
The device according to claim 8, wherein the analysis model includes an identifier of the plurality of mobile terminals, a behavior characteristic of the preset user corresponding to the plurality of mobile terminals, and whether the operating environment of the system is safe. Security database.
The device of claim 8 further comprising:

a requesting module, configured to receive an authentication request of the terminal, where the authentication request includes information about the terminal;

a matching module, configured to match the terminal based on information of the terminal;

And a challenge authentication module, configured to send a challenge authentication command to the terminal, so that the terminal uploads the at least one parameter to the server when receiving the challenge authentication command.
The device of claim 8 further comprising:

The release module is configured to release the process corresponding to the authentication on the terminal.
The device of claim 8 wherein said user behavior characteristic comprises sensor data generated by said terminal when operated by said operator.
The device according to claim 13, wherein said user behavior characteristic comprises at least one of the following sensor data: rotation data, force data, orientation data, screen operation data, or input device operation data.
An authentication device, comprising a processor, the processor configured to:

Acquiring at least one parameter of the terminal, where the at least one parameter includes: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal;

Authenticating the at least one parameter by a preset analysis model;

Determining, according to the authentication result of the at least one parameter, whether an operator of the terminal is a preset user, when a system operating environment, the user behavior feature, and the terminal in the at least one parameter are used by the analysis model When the verification of the identification is passed, it is confirmed that the operator of the terminal is the preset user itself, and the authentication is passed.
A computer readable storage medium storing computer instructions for performing a method of authentication after a computer reads a computer instruction in a storage medium, the method comprising:

Acquiring at least one parameter of the terminal, where the at least one parameter includes: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal;

Authenticating the at least one parameter by a preset analysis model;

Determining, according to the authentication result of the at least one parameter, whether an operator of the terminal is a preset user, when a system operating environment, the user behavior feature, and the terminal in the at least one parameter are used by the analysis model When the verification of the identification is passed, it is confirmed that the operator of the terminal is the preset user itself, and the authentication is passed.
A method for authentication implemented on a terminal, the terminal comprising at least one processor, a memory, and a communication platform connected to the network, the method comprising:

Obtaining at least one parameter and sending the parameter to the server, where the at least one parameter comprises: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal;

Receiving server information, and passing or not authenticating according to whether the operator of the terminal determined by the server to determine the at least one parameter is a default user.
The method of claim 17 wherein said user behavior characteristic comprises sensor data generated by said terminal when operated by said operator.
A system for authentication, comprising:

An obtaining module, configured to acquire at least one parameter and send the parameter to the server, where the at least one parameter comprises: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal;

And a receiving module, configured to receive server information, and pass or not authenticate according to whether the operator of the terminal determined by the server to determine the at least one parameter is a determination result of the preset user.
The system of claim 19 wherein said user behavior characteristic comprises sensor data generated by said terminal when operated by said operator.
An authenticated terminal, comprising a processor, the processor configured to:

Obtaining at least one parameter and sending the parameter to the server, where the at least one parameter comprises: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal;

Receiving server information, and passing or not authenticating according to whether the operator of the terminal determined by the server to determine the at least one parameter is a default user.
A computer readable storage medium storing computer instructions for performing a method of authentication after a computer reads a computer instruction in a storage medium, the method comprising:

Obtaining at least one parameter and sending the parameter to the server, where the at least one parameter comprises: a system operating environment of the terminal, a user behavior feature, and an identifier of the terminal;

Receiving server information, and passing or not authenticating according to whether the operator of the terminal determined by the server to determine the at least one parameter is a default user.