CN111062010A

CN111062010A - Identity verification method, device and equipment

Info

Publication number: CN111062010A
Application number: CN201911088064.0A
Authority: CN
Inventors: 覃桃; 杨陆毅; 陈弢
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2019-11-08
Filing date: 2019-11-08
Publication date: 2020-04-24
Anticipated expiration: 2039-11-08
Also published as: CN111062010B

Abstract

An identity authentication method, device and equipment are disclosed. By the case provided by the embodiment of the specification, when the identity information of the user does not need to be acquired, the current device information and the current network environment information of the user are subjected to double verification, when the current device information and the current network environment information are verified, the current operator can be considered as the real account owner, and otherwise, the verification fails.

Description

Identity verification method, device and equipment

Technical Field

The embodiment of the specification relates to the technical field of information, in particular to an identity authentication method, an identity authentication device and identity authentication equipment.

Background

In order to protect the privacy of the user, the identity information of the user cannot be obtained in many cases. For example, legislation prohibits the collection of national identification card information, real name information, biometric features (e.g., fingerprints, facial information), and the like; for another example, in order to simplify the account registration process, the account is not required to be bound with a real mobile phone number, and the real registered mailbox is not required to be verified, so that common identity verification methods such as short message verification, biometric identification verification, mailbox verification code verification and the like cannot be used.

Based on this, there is a need for a more adaptable authentication approach.

Disclosure of Invention

The embodiment of the application aims to provide an identity authentication method, device and equipment with wider adaptability.

In order to solve the above technical problem, the embodiment of the present application is implemented as follows:

an identity verification method comprising:

sending prompt information to a client, wherein the prompt information is used for reminding a user of using common equipment to perform identity authentication in a common network environment;

when the client side is detected to initiate feedback operation on the prompt message, current equipment information and current network environment information related to the feedback operation are obtained;

and judging whether the current equipment information is the common equipment information of the client or not, and judging whether the current network environment information is the common network environment information of the client or not, wherein if yes, the identity authentication is successful, and otherwise, the identity authentication is failed.

Correspondingly, an embodiment of the present specification further provides an identity authentication apparatus, including:

the system comprises a sending module, a receiving module and a processing module, wherein the sending module sends prompt information to a client, and the prompt information is used for reminding a user of using common equipment to perform identity authentication in a common network environment;

the acquisition module is used for acquiring current equipment information and current network environment information related to the feedback operation when the client is detected to initiate the feedback operation on the prompt information;

and the judging module is used for judging whether the current equipment information is the common equipment information of the client side or not and judging whether the current network environment information is the common network environment information of the client side or not, if so, the authentication is successful, and otherwise, the authentication is failed.

Through the case provided by the embodiment of the specification, when the privacy information of the user does not need to be acquired, the current equipment information and the current network environment information of the user are subjected to double verification, when the current equipment information and the current network environment information are verified, the current operator can be considered as the real account owner, otherwise, the verification fails, the identity verification is carried out when the privacy information of the user is not needed, the safety is guaranteed, and the adaptability is wider.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of embodiments of the invention.

In addition, any one of the embodiments in the present specification is not required to achieve all of the effects described above.

Drawings

In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the embodiments of the present specification, and other drawings can be obtained by those skilled in the art according to the drawings.

Fig. 1 is a schematic flow chart of a business risk prevention and control method provided in an embodiment of the present specification;

FIG. 2 is an exemplary diagram of a hint provided by an embodiment of the present disclosure;

FIG. 3 is a logic diagram for authentication provided by embodiments of the present disclosure;

fig. 4 is a schematic structural diagram of an authentication apparatus provided in an embodiment of the present disclosure;

fig. 5 is a schematic structural diagram of an apparatus for configuring a method according to an embodiment of the present disclosure.

Detailed Description

In order to make those skilled in the art better understand the technical solutions in the embodiments of the present specification, the technical solutions in the embodiments of the present specification will be described in detail below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only a part of the embodiments of the present specification, and not all the embodiments. All other embodiments that can be derived by one of ordinary skill in the art from the embodiments given herein are intended to be within the scope of protection.

At present, the conventional authentication methods include methods such as short message authentication, mailbox authentication code authentication, and biometric authentication. However, in order to protect the privacy of the user, the relevant privacy information of the user, including the user identification number, the real mobile phone number, the real registered mailbox, and the user biological characteristics (including fingerprint, facial characteristics, iris), etc., cannot be obtained in many cases.

For example, the relevant private information of citizens is prohibited to be collected based on laws, so that the real mobile phone number is not required to be bound when a user registers, and the short message cannot be used for verification; or, real mailbox registration is not required, so that mailbox authentication code verification cannot be used; or, when the citizen's biometric feature cannot be called based on the data security rules or when the user equipment does not support the biometric feature collection function, the biometric-based authentication cannot be used.

In short, in some situations or regions, based on the need of protecting the privacy information of the user, the authentication in the conventional manner cannot be performed, and the manual authentication method is often used. Based on this, this application embodiment provides a more extensive authentication mode.

The technical solutions provided by the embodiments of the present description are described in detail below with reference to the accompanying drawings. As shown in fig. 1, fig. 1 is a schematic flow chart of a business risk prevention and control method provided in an embodiment of this specification, where the flow chart specifically includes the following steps:

and S101, sending prompt information to the client.

In the embodiment of the present specification, since the identity authentication is performed without the identity information of the registered user, in order to pay attention to the user and avoid an authentication error, an explicit prompt message should be sent to the client.

The prompt message should include an explicit verification prompt to inform the user that the server is going to perform authentication, and prompt the user that the user should use the common device to perform corresponding feedback operation in the common network environment. If the common equipment cannot be used immediately and the common network environment is entered, the user should stop the feedback operation for the prompt message.

As shown in fig. 2, fig. 2 is an exemplary schematic diagram of a prompt message provided in the embodiment of the present disclosure. Under the condition of no user identity information, if prompt information is not sent, the user is likely to not know that identity authentication is to be carried out and continue operation, and further the server side continues identity authentication, and an account of the user is likely to be locked.

S103, when the client is detected to initiate a feedback operation on the prompt message, current device information and current network environment information related to the feedback operation are obtained.

The feedback operation may include a variety of forms, such as the following exemplary list:

firstly, the prompt message provides a specific verification interface link, and guides the user to jump to an interface indicated by the link through the client to perform corresponding user operation, so as to realize active identity verification. The user operation herein may include a login operation, or an input operation of user-related information, or the like.

For example, providing a link in the prompt directs the user to a dedicated authentication interface where the user is required to enter a specified authentication code. It should be noted that the verification code is not used for verifying whether the user is the user himself or herself, but is only used for the server to receive the verification code input by the user and activate the authentication process, and the feedback operation at this time is related to the user inputting the verification code.

For another example, providing a link in the prompt may guide the user to re-enter the login interface where the user needs to perform the login operation again. The feedback operation at this time is the re-login operation of the user.

And secondly, the latest login operation or payment operation after the prompt message is received by the user. Specifically, the user may still be left alone after receiving the prompt message, and active authentication is not performed, so that passive authentication may be performed at this time.

For example, the user logs out of the client after receiving the prompt message, and logs in again after three days, at this time, the login operation may be regarded as a feedback operation for the prompt message.

For another example, after receiving the prompt message, the user does not first perform active authentication, but still performs a corresponding payment operation in the client, and then the payment operation may be regarded as a feedback operation for the prompt message.

By confirming the passive feedback operation, the identity of the current user can be immediately triggered to be verified, and the risk is avoided.

The above lists only some feedback operations that the user may initiate for the prompt information through the client, and in practical application, the feedback operations should not be limited to the foregoing feedback operations.

In this embodiment, the detection of the feedback operation may be performed in real time by the server through data sent by the client. As described above, after sending the prompt information to a client, the server may detect various data information such as the verification code, the login information, and the payment information sent by the client in real time to determine whether the client performs the feedback operation.

And when the client is detected to initiate the feedback operation on the prompt message, acquiring the current equipment information and the current network environment information used when the client initiates the feedback operation.

The device information includes an International Mobile Equipment Identity (IMEI), and the device information may further include a device model, device hardware information, and the like. The network environment information includes at least one of a network Address IP or a Media Access Control (Media Access Control Address) Address.

S105, judging whether the current equipment information is the common equipment information of the client or not, and judging whether the current network environment information is the common network environment information of the client or not, wherein if yes, the identity authentication is successful, and otherwise, the identity authentication is failed.

The server may count the device information and the network environment information of each client in advance to generate a common device information set and a common network environment information set.

Specifically, for any client, the server may obtain historical device information and historical network environment information at the time of login of the client within a specified window period, and perform corresponding statistics on each piece of historical device information and historical network environment information. Wherein the specified window period refers to

Taking the device information as an example, the server may count, for any client, the number of times that the client uses a certain historical device during login and the duration of time for using each historical device after login, according to the history data. And then, screening according to preset conditions, and confirming the historical equipment information meeting the conditions as the frequently-used equipment information.

The preset condition here may be that the login number or the login duration (i.e., the usage duration after login) exceeds a certain threshold (for example, the login number exceeds 20 times, or the login duration exceeds 20 hours); or, sorting is performed according to the login times or the login duration, and a plurality of names sorted in the top (for example, the device information 3 names before the login times) are determined as the common device information, so that a common device information set including at least one piece of common device information is generated. For the common network environment information set, the generation mode is similar to that of the common device information set, and is not described again.

In an embodiment, the user may also perform corresponding configuration on elements included in the common device information set or the common network environment information set in advance.

For example, the client displays a corresponding option "commonly used device setting item" to the user for setting, and by operating the option by the user, the client can obtain and display the historical device information of the user from the server, so that the user can perform configuration, including selection or deletion, and the like.

It should be noted that, in this process, the displayed historical device information generally needs to have a certain window period, for example, the displayed historical device information may be the total historical device information before several days (for example, 7 days), and should not include the historical device information currently in use, so as to avoid being hidden from authentication by the current user.

The judging mode is to inquire whether the current equipment information is in the common equipment information set or not and to inquire whether the current network environment information is in the common network environment information set or not. As shown in fig. 3, fig. 3 is a logic diagram for authentication provided in the embodiment of the present disclosure. In practical application, for the network environment information, one of the MAC and the IP may be selected for judgment, or both of the MAC and the IP may be selected for judgment at the same time, which requires that the MAC and the IP are the common network environment information at the same time.

In the embodiment of the present specification, the two are satisfied at the same time to determine that the authentication is successful, otherwise, the authentication fails. The reason is that, if the user's normal device is stolen, the account may be logged in by the thief on the normal device, but it is difficult for the thief to know the network environment in which the user is normally used. Therefore, the risk of equipment theft can be eliminated through the double-factor identity verification, and the safe identity verification is realized.

In practical application, the server side can send prompt information to the client side at any time to request identity verification, or send prompt information to request identity verification when the client side is judged to have safety risks. For example, when the server determines that the payment amount or the payment frequency of a certain client exceeds a certain security threshold, a prompt message is sent to the client to request authentication.

In one embodiment, the common network environment information of a client can be classified as private common network environment information or public common network environment information (including public IP or public MAC).

For example, for a MAC address, it is an address used to identify the location of a network device. Specifically, for a device accessing the network, such as a router, the MAC is manufacturer-burned and generally cannot be changed, and can uniquely identify the router.

For a user accessing the network through the router 1 in a company, the network environment information at this time can be represented as MAC1, and for a user accessing the network through the router 2 in a home environment, the network environment information at this time can be represented as MAC 2.

At this time, for the service end, both MAC1 and MAC2 can be regarded as common network environment information of the user. Further, the service side may also statistically obtain that the MAC1 may be a common network environment of multiple users at the same time, so that it can be known that the MAC1 is not only used by the user, but also has public access to multiple users, so that the MAC1 may be determined to be a public MAC according to a certain condition (for example, more than 50 users using the MAC1 as common network environment information), and meanwhile, the MAC2 may be determined not to be a public MAC but to be private common network environment information of the user according to a certain condition (for example, not more than 4 users using the MAC2 as common network environment information).

For the IP address, the common IP and the public IP can be divided in the same manner, and will not be described herein.

In this case, even if the thief acquires the common device of the user, it is difficult to perform feedback operation on the private common network environment information of the user, so that the protection for the thief can be further improved through two-factor verification, and the security is enhanced.

Correspondingly, an embodiment of the present specification further provides an identity authentication apparatus, as shown in fig. 4, fig. 4 is a schematic structural diagram of the identity authentication apparatus provided in the embodiment of the present specification, and the identity authentication apparatus includes:

the sending module 401 sends a prompt message to the client, where the prompt message is used to remind the user to use a common device to perform identity authentication in a common network environment;

an obtaining module 403, configured to obtain current device information and current network environment information associated with the feedback operation when it is detected that the client initiates a feedback operation on the prompt information;

the determining module 405 determines whether the current device information is the common device information of the client, and determines whether the current network environment information is the common network environment information of the client, if so, the authentication is successful, otherwise, the authentication is failed.

Further, the sending module 401 determines whether the client has a security risk, and if so, sends a prompt message to the client.

Further, the determining module 405 acquires a common device information set and a common network environment information set of the client, where the common device information set and the common network environment information set are generated in advance based on the historical login information of the client; and judging whether the current equipment information and the current network environment information are in the common equipment information set and the common network environment information set.

Further, the apparatus further includes a generating module 407, configured to obtain historical device information and historical network environment information when the client logs in within a specified window period; determining historical equipment information with login times or login duration meeting preset conditions as frequently-used equipment information to generate a frequently-used equipment information set, and determining historical network environment information with login times or login duration meeting the preset conditions as frequently-used network environment information to generate a frequently-used network environment information set.

Further, the obtaining module 403 detects a user operation when the client skips to a specified verification page according to the prompt information; or detecting the latest login operation or payment operation of the client after the prompt message is received.

Further, in the apparatus, the device information includes an international mobile equipment identity IMEI, and the network environment information includes at least one of a network address IP or a media access control MAC address;

accordingly, the common network environment information does not include the public IP or the public Mac of the client.

Embodiments of the present specification also provide a computer device, which at least includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the authentication method shown in fig. 1 when executing the program.

Fig. 5 is a schematic diagram illustrating a more specific hardware structure of a computing device according to an embodiment of the present disclosure, where the computing device may include: a processor 1010, a memory 1020, an input/output interface 1030, a communication interface 1040, and a bus 1050. Wherein the processor 1010, memory 1020, input/output interface 1030, and communication interface 1040 are communicatively coupled to each other within the device via bus 1050.

The processor 1010 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an Application Specific Integrated Circuit (ASIC), or one or more Integrated circuits, and is configured to execute related programs to implement the technical solutions provided in the embodiments of the present disclosure.

The Memory 1020 may be implemented in the form of a ROM (Read Only Memory), a RAM (Random access Memory), a static storage device, a dynamic storage device, or the like. The memory 1020 may store an operating system and other application programs, and when the technical solution provided by the embodiments of the present specification is implemented by software or firmware, the relevant program codes are stored in the memory 1020 and called to be executed by the processor 1010.

The input/output interface 1030 is used for connecting an input/output module to input and output information. The i/o module may be configured as a component in a device (not shown) or may be external to the device to provide a corresponding function. The input devices may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices may include a display, a speaker, a vibrator, an indicator light, etc.

The communication interface 1040 is used for connecting a communication module (not shown in the drawings) to implement communication interaction between the present apparatus and other apparatuses. The communication module can realize communication in a wired mode (such as USB, network cable and the like) and also can realize communication in a wireless mode (such as mobile network, WIFI, Bluetooth and the like).

Bus 1050 includes a path that transfers information between various components of the device, such as processor 1010, memory 1020, input/output interface 1030, and communication interface 1040.

It should be noted that although the above-mentioned device only shows the processor 1010, the memory 1020, the input/output interface 1030, the communication interface 1040 and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, those skilled in the art will appreciate that the above-described apparatus may also include only those components necessary to implement the embodiments of the present description, and not necessarily all of the components shown in the figures.

Embodiments of the present description also provide a computer-readable storage medium on which a computer program is stored, where the computer program is executed by a processor to implement the identity authentication method shown in fig. 1.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

From the above description of the embodiments, it is clear to those skilled in the art that the embodiments of the present disclosure can be implemented by software plus necessary general hardware platform. Based on such understanding, the technical solutions of the embodiments of the present specification may be essentially or partially implemented in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in the embodiments or some parts of the embodiments of the present specification.

The systems, methods, modules or units described in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. A typical implementation device is a computer, which may take the form of a personal computer, laptop computer, cellular telephone, camera phone, smart phone, personal digital assistant, media player, navigation device, email messaging device, game console, tablet computer, wearable device, or a combination of any of these devices.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, as for the method embodiment, since it is substantially similar to the method embodiment, it is relatively simple to describe, and reference may be made to the partial description of the method embodiment for relevant points. The above-described method embodiments are merely illustrative, wherein the modules described as separate components may or may not be physically separate, and the functions of the modules may be implemented in one or more software and/or hardware when implementing the embodiments of the present specification. And part or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of the embodiment. One of ordinary skill in the art can understand and implement it without inventive effort.

The foregoing is only a specific embodiment of the embodiments of the present disclosure, and it should be noted that, for those skilled in the art, a plurality of modifications and decorations can be made without departing from the principle of the embodiments of the present disclosure, and these modifications and decorations should also be regarded as the protection scope of the embodiments of the present disclosure.

Claims

1. An identity verification method comprising:

and judging whether the current equipment information is the common equipment information of the client or not, judging whether the current network environment information is the common network environment information of the client or not, if so, successfully authenticating, and otherwise, failing to authenticate.

2. The method of claim 1, sending a prompt to the client, comprising:

and judging whether the client has a safety risk, if so, sending prompt information to the client.

3. The method of claim 1, wherein determining whether the current device information and the current network environment information are the common device information and the common network environment information of the client comprises:

acquiring a common equipment information set and a common network environment information set of the client, wherein the common equipment information set and the common network environment information set are generated in advance based on historical login information of the client;

and judging whether the current equipment information and the current network environment information are in the common equipment information set and the common network environment information set.

4. The method of claim 3, wherein the common device information set and the common network environment information set are pre-generated based on:

acquiring historical equipment information and historical network environment information when the client logs in within a specified window period;

determining historical equipment information with login times or login duration meeting preset conditions as frequently-used equipment information to generate a frequently-used equipment information set, and determining historical network environment information with login times or login duration meeting the preset conditions as frequently-used network environment information to generate a frequently-used network environment information set.

5. The method of claim 1, when detecting a feedback operation of the client for the hint information, comprising:

when the user operation that the client jumps to a specified verification page according to the prompt information is detected; alternatively, the first and second electrodes may be,

when the last login operation or payment operation of the client after the prompt message is received is detected.

6. The method of claim 1, the device information comprises an International Mobile Equipment Identity (IMEI), and the network environment information comprises at least one of a network address (IP) or a media access control address (MAC);

7. An authentication apparatus comprising:

8. The apparatus of claim 7, wherein the sending module determines whether the client has a security risk, and if so, sends a prompt to the client.

9. The apparatus according to claim 7, wherein the determining module obtains a common device information set and a common network environment information set of the client, wherein the common device information set and the common network environment information set are generated in advance based on historical login information of the client; and judging whether the current equipment information and the current network environment information are in the common equipment information set and the common network environment information set.

10. The apparatus of claim 9, further comprising a generation module that obtains historical device information and historical network environment information at the time of the client login within a specified window period; determining historical equipment information with login times or login duration meeting preset conditions as frequently-used equipment information to generate a frequently-used equipment information set, and determining historical network environment information with login times or login duration meeting the preset conditions as frequently-used network environment information to generate a frequently-used network environment information set.

11. The device of claim 7, wherein the obtaining module detects a user operation of the client when jumping to a specified verification page according to the prompt message; or detecting the latest login operation or payment operation of the client after the prompt message is received.

12. The apparatus of claim 7, the equipment information comprises an International Mobile Equipment Identity (IMEI), and the network environment information comprises at least one of a network address (IP) or a Media Access Control (MAC) address;

13. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any of claims 1 to 6 when executing the program.