CN114048449B - Method and device for improving security of verification code by combining cache information - Google Patents
Method and device for improving security of verification code by combining cache information Download PDFInfo
- Publication number
- CN114048449B CN114048449B CN202210024691.3A CN202210024691A CN114048449B CN 114048449 B CN114048449 B CN 114048449B CN 202210024691 A CN202210024691 A CN 202210024691A CN 114048449 B CN114048449 B CN 114048449B
- Authority
- CN
- China
- Prior art keywords
- verification code
- browser
- identifier
- environment information
- information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/316—User authentication by observing the pattern of computer usage, e.g. typical user behaviour
Abstract
The invention discloses a method and a device for improving the safety of verification codes by combining cache information, wherein the method comprises the following steps: s1, setting a cache mark aiming at a marketing activity in a preset time before the marketing activity starts, so that a user server generates a unique identifier X; s2, collecting information of the associated account in a preset time period through caching; s3, after the marketing activity starts, when a verification code service is called, a verification code module collects browser environment information at a client, compares the browser environment information with browser environment information collected when a unique identifier X is generated at that time, and judges whether the browser environment information is consistent or not; s4, popping up a first-level verification code under the condition that the environmental information of the browser is judged to be consistent; and popping up a second-level verification code under the condition that the environment information of the browser is judged to be inconsistent. The method and the device identify the abnormal user through the cache information, improve the security of the verification code by giving the verification code with high difficulty, and optimize the verification code display strategy.
Description
Technical Field
The invention relates to a computer network communication technology, in particular to a method and a device for improving the security of verification codes by collecting cache information.
Background
The black grey product is a major protection point of the current internet online service. For many marketing scenarios, black and gray products can use various tools to carry out thinning wool in batches, which causes great loss to enterprises. The scene is mainly a human-computer problem, and various script tools are generally used for carrying out automatic attack in the black products. The rate of normal user manual operation is far slower than the speed of the automated script, so a large number of coupons, small red packets, etc. can be taken out of black production.
A common prevention and control scheme is verification codes, and man-machine verification is a very general man-machine protection means. And many security manufacturers have introduced various types of human-machine verification, ranging from simple slider puzzles, somewhat difficult character clicks, to complex out-of-order reduction puzzles. The verification code technology is a common technology in the field of internet, is especially common in the field of business security, and is a basic security service. With the rapid development of the internet technology, the information security problem is increasingly prominent, and in order to prevent phenomena such as malicious password cracking, ticket swiping, forum water filling and the like, the prior art mainly adopts a verification code to distinguish whether a user is a computer or a human. The method is characterized in that a user clicks or slides a verification code according to a given prompt, clicking or track information is uploaded to a server, and the server determines whether verification passes through algorithm analysis and matching so as to distinguish man-machine operation.
However, the current problem is that how to display the verification code is troublesome in the marketing scene. If all the users are easy to use, the black products can be automatically completed through some tools, and at present, a plurality of automatic scripts capable of completing the sliding jigsaw puzzle on the network exist. If the users use the system with higher difficulty, the system affects the experience of the users and even the marketing effect.
The invention mainly aims at the problem and adopts a cache correlation calculation mode to optimize the verification code display strategy.
Disclosure of Invention
Aiming at the problems in the prior art, the invention aims to collect user cache information through the cache mark, identify normal users and abnormal users, display simple verification codes for normal users and display difficult verification codes for abnormal users, thereby improving the safety of the verification codes.
In order to achieve the above object, the present invention provides a method for improving security of a verification code by combining with cache information, comprising the following steps:
s1, setting a cache mark aiming at a marketing activity in a preset time before the marketing activity starts, so that a server generates a unique identifier X;
s2, collecting user operation behavior information of the associated account in a preset time period through caching;
s3, after the marketing activity starts, when a verification code service is called, a verification code module collects browser environment information at a client, compares the browser environment information with browser environment information collected when a unique identifier X is generated at that time, and judges whether the browser environment information is consistent or not;
s4, popping up a first-level verification code under the condition that the environmental information of the browser is judged to be consistent; and popping up a second-level verification code under the condition that the environment information of the browser is judged to be inconsistent.
Further, the difficulty of the verification code of the second level is higher than the difficulty of the verification code of the first level.
Further, in step S1, when the user accesses the service system, the service system generates a unique identifier X at the service end, and issues a credential Y to the client, where both the identifier X and the credential Y need to have uniqueness and cannot be tampered; carrying the existing credential Y of the client to the server when a business request is made, and enabling the server to be associated with X through Y, so that the server generates a new credential Y1 to be sent to the client; so that the credential changes every request but the associated background unique identification X remains unchanged.
Further, once credential Y is not queried for identification X at the server, an identification X1 is regenerated, as is credential Y1 to the client.
Further, the browser environment information includes a browser model, a version, and a screen resolution; and when the identifier X is generated, acquiring the browser model, version and screen resolution of the client, and recording the browser environment information when the identifier X is generated.
Further, the service system runs in a silent mode within the preset time, the related account numbers are collected through caching, the existence time of the unique identifier X is cached, and the user operation behavior information is obtained.
On the other hand, the invention provides a device for improving the security of a verification code by combining cache information, which comprises a cache mark setting module, an information collecting module, a judging module and a verification code executing module; wherein:
the cache mark setting module is used for setting a cache mark aiming at the marketing campaign within a preset time before the marketing campaign starts so as to enable the user server to generate a unique identifier X;
the information collection module is used for collecting user operation behavior information of the associated account within a preset time period through caching;
the judging module is used for acquiring the browser environment information at the client side when the verification code service is called after the marketing activity is started, comparing the browser environment information with the browser environment information collected when the unique identifier X is generated at that time, and judging whether the browser environment information is consistent;
the verification code execution module is used for popping up a first-level verification code under the condition of judging that the environment information of the browser is consistent; and popping up a second-level verification code under the condition that the environment information of the browser is judged to be inconsistent.
The scheme of the invention considers how to identify normal users by some modes when preventing the wool from being produced in black and gray, and displays simple verification codes for the normal users, and displays difficult verification codes for the users who can not identify the normal users. The scheme is suitable for specific scenes, namely, the target user is very clear. The identification result is mainly fed back to the verification code under a specific scene, namely, the difficulty of the verification code of the user which is considered as a normal user is reduced, and the difficulty of the verification code of the user which cannot be identified as credible is improved.
Drawings
FIG. 1 is a flowchart illustrating a method for enhancing security of an authentication code according to cache information of the present invention;
FIG. 2 is a block diagram illustrating an architecture of an apparatus for enhancing security of an authentication code in combination with cache information according to the present invention.
Detailed Description
The technical solutions of the present invention will be described clearly and completely with reference to the accompanying drawings, and it should be understood that the described embodiments are some, but not all embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings, and are only for convenience of description and simplicity of description, but do not indicate or imply that the device or element being referred to must have a particular orientation, be constructed and operated in a particular orientation, and thus, should not be construed as limiting the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance.
In the description of the present invention, it should be noted that, unless otherwise explicitly specified or limited, the terms "mounted," "connected," and "connected" are to be construed broadly, e.g., as meaning either a fixed connection, a removable connection, or an integral connection; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meanings of the above terms in the present invention can be understood by those skilled in the art according to specific situations.
The following detailed description of embodiments of the invention refers to the accompanying drawings. It should be understood that the detailed description and specific examples, while indicating the present invention, are given by way of illustration and explanation only, not limitation.
In the prior art, in a marketing scene, a plurality of ways for popping up a plurality of verification codes exist. For example, some pre-judgment is performed by a risk identification system, and the judgment is mainly calculated by combining data acquired by equipment fingerprints, recent access frequency, ip access frequency and the like. There are also decisions made in connection with the risk profile of the account by which different authentication codes are presented.
But for many marketing scenarios, a large amount of the case of wool still exists. The problems are mainly concentrated on the web side and the small program, because the information which can be collected by the web side and the small program is limited, the identification capability of the device fingerprint is not strong enough (the collection is limited by a browser), and the black grey can modify the fingerprint tracking of the web side and the small program through some uncomplicated operations, namely, new fingerprints are generated. For example, a large number of account numbers are mastered in black birth, the traditional wind control strategy is to limit one device from logging in a plurality of accounts, and the limitation is difficult to be effective in a web and an applet channel because environmental data of the web and the applet are easy to modify, and device fingerprints can be changed by clearing cache, using a privacy mode, modifying ua, switching ip and the like. The black grey product is generated in such a way, and the ip is switched, so that many limiting strategies cannot be effective. Meanwhile, the mode also influences the display strategy of the verification code, and the black and gray product can easily obtain a clean environment through the mode, so that some general verification code display strategies are difficult to take effect, and the black and gray product can always obtain the simple verification code.
The invention mainly aims at the problem and provides a method for judging risks by caching data.
First the solution is mainly directed to web and applet channels.
A basic starting point considered by the present invention is that, no matter based on common sense or data statistics, most normal users will not clear the browser cache or will clear it, but the frequency will not be high.
As shown in fig. 1-2, a method for improving security of a verification code by combining with cache information according to the present invention includes the following steps:
s1, setting a cache mark aiming at a marketing activity in a preset time before the marketing activity starts, so that a server generates a unique identifier X;
s2, collecting information of the associated account in a preset time period through caching;
s3, after the marketing activity starts, when a verification code service is called, a verification code module collects browser environment information at a client, compares the browser environment information with browser environment information collected when a unique identifier X is generated at that time, and judges whether the browser environment information is consistent or not;
s4, popping up a first-level verification code under the condition that the environmental information of the browser is judged to be consistent; and popping up a second-level verification code under the condition that the environment information of the browser is judged to be inconsistent.
The first-level verification code is a simple verification code or a low-difficulty verification code, the second-level verification code is a high-difficulty verification code, the difficulty of the second-level verification code is higher than that of the first-level verification code, and in order to improve safety, obvious difficulty level differences need to exist in difficulty level difference setting.
And under the condition that the environment information of the browser is not consistent, the credential is considered to be copied from other places, so that the risk exists, and a high-difficulty verification code (second-level verification code) is popped up. If the environment information is not abnormal and the cache is credible, a safer strategy is adopted, and a few simple verification codes (first-level verification codes) are popped.
The browser environment information includes a version, a model, a screen resolution, and the like of the browser.
A cache marker is specifically designed for the marketing campaign some time before the marketing campaign begins. When a user accesses the business system, the business system generates a unique identifier X at a server side, and simultaneously issues a credential Y to a browser, wherein X and Y are random character strings and are stored in a server database, and X and Y are unique and cannot be tampered. And carrying the existing credential Y of the client to the server when a service request is made, and associating the credential Y with the X by the server, so that the server generates a new credential Y1 to be sent to the client. I.e. credentials change every request, but the associated background identification X remains unchanged, with the purpose of uniquely identifying the user's browser. If the Y-proof is not queried for X at the server, then an identification X1 is regenerated, and a proof Y1 is also regenerated to the client. The normal Y voucher can inquire X in the background, if the X cannot be inquired, the Y is considered to be tampered, the tampered Y is invalid, and therefore the front end and the back end regenerate X1 and Y1. Thus achieving the technical goal of tamper resistance.
When the identifier X is generated, basic environment information such as the browser model, version, screen resolution and the like of the client needs to be acquired, and the environment information when the identifier X is generated is recorded. The mechanism needs to run in a silent state of the service system for a period of time, such as two weeks or about one month, and the period of time mainly includes collecting information of associated accounts through cache, cache existence time, user operation behaviors and the like.
The idea of the scheme is that for the identifier X of the identifier browser, if the identifier X can exist and be valid for a long time, and the account number associated through the cache is relatively stable, and the operation behavior of the account is not obviously abnormal, such as no high-frequency operation, no night sensitive time operation, and no long-term inactivity, the identifier X is considered to be a trusted cache.
In the rule setting of the high frequency operation, the night sensitive time operation and the long-term inactivity, it can be freely set according to the actual scene. In a specific setting stage, the number of times of inquiring and browsing each normal user on the platform and the number of times of placing orders can be counted, and N times of the average number of times can be set as high-frequency operation. For example, through statistics, a normal user of a certain e-commerce platform browses 20 times in average in a day, and if the number of times of placing an order is 2 in average, the number of times that an account number associated with an identifier X is higher than 10 times can be set as high-frequency operation, if the number of times of querying in a day exceeds 200, and if the number of times of placing an order exceeds 20, the operation is set as high-frequency operation, and the operation is marked as abnormal behavior.
The night sensitive time can be set to 1-5 points in the morning, if the account number associated with the identifier X is frequently active between 1-5 points, the account number is regarded as an untrusted user and possibly a crawler, and the specific set time period and the number of active times can be set according to needs.
Long-term inactivity means that the platform has not been visited for more than N days, and is set to 10 days, for example.
After the analysis data is collected in a silent state for a period of time, if a marketing activity exists, and the verification code service is called, the verification code module collects information such as the version, the model and the screen resolution of the browser at the client side and compares the information with the environment information collected when the identifier X is generated at that time, so that the environment when the identifier X is generated is ensured to be consistent with the environment information collected by the verification code at this time. If they do not match, the credential is considered to have been copied from elsewhere, and there is a risk that a high difficulty verification code will be popped. If the environment information is not abnormal and the cache is credible, a safer strategy is adopted, and some simple verification codes are popped. If during the activity the just generated cache appears, a higher difficulty verification code pops up. The consideration point is mainly that for the black and grey product of wool, the account information of the wool is generally few to thousands and many to tens of thousands in hands, and the marketing activity occurs, and the preference is swiped in batches by using a tool. In the case that the account of the black and gray product cannot acquire a long-term stable identifier X, the account of the black and gray product is considered as an untrusted user, and a high-difficulty verification code is selected to pop up. This situation is not necessarily completely accurate, and may injure a user who partially clears the browser cache by mistake, but the ratio is not very high, and at the same time, the difficulty of the verification code is higher, and normal people can still pass through the verification code, and the difficulty is higher for the script of the black product.
In addition, as shown in fig. 2, the present invention further provides a device 100 for improving security of a verification code by combining with cache information, which includes a cache flag setting module 101, an information collecting module 102, a determining module 103, and a verification code executing module 104; wherein:
the cache mark setting module 101 is configured to set a cache mark for the marketing campaign within a preset time before the marketing campaign starts, so that the user server generates a unique identifier X;
the information collection module 102 is configured to collect, by caching, user operation behavior information of the associated account within a preset time period;
the judging module 103 is used for acquiring the browser environment information at the client by the identifying code module when the identifying code service is called after the marketing campaign starts, comparing the browser environment information with the browser environment information collected when the unique identifier X is generated at that time, and judging whether the browser environment information is consistent;
the verification code execution module 104 is configured to pop up a first-level verification code when it is determined that the browser environment information is consistent; and popping up a second-level verification code under the condition that the environment information of the browser is judged to be inconsistent.
The scheme of the invention is a weak stability mark, and the mark which has weak stability and can be kept stable for a long time is regarded as a safer user. Since the black products are generally protected from being tracked, the cache is basically cleared, the device information is basically tampered with, and the like. This does not guarantee a stable identification. The basis for this dependence is also the aforementioned, and for the vast majority of normal users, there are few cases of clearing the cache. The invention also has obvious prevention and control effects on the condition that black grey products are sold in batches and account numbers are sold, and basically, a stable cache mark is difficult to guarantee after the account numbers are sold to other people in batches.
The scheme is only suitable for marketing activities carried out by users with stock, such as carrying out coupon issuing activities by users with points exceeding a certain number on a platform in a certain shopping mall, and providing low-price air ticket purchasing activities for users who purchase air tickets on an official website of an airline company for a long time. In these cases it can be assumed that most normal target users will have a corresponding stable identity.
The cache in the invention is a specified marketing activity aiming at a certain specific scene, and is specially prepared for the marketing activity. The delivery is initiated some time before the marketing campaign begins.
When the cache identifier is on line in the scheme, decision cannot be made immediately, and the display of the verification code is influenced. But rather are run silently for a period of time that will not affect the average user. After the silent operation is carried out for a period of time, the collected user operation behavior data is analyzed, and under the condition of the weak stability identification, the user still can be stably kept and is considered as a credible user. Thus, when a policy is initially applied to the authentication code, only a small range of users is affected.
The strategy of the scheme mainly aims at the man-machine verification code, whether a user really has a problem or not can not be judged through the invention, and the verification code display is influenced through the cache strategy.
The marketing scene aimed by the scheme is preferential activities developed by users with longer existence on a certain platform, and is not suitable for all scenes. And only for web and applet channels.
The above-mentioned apparatus may comprise a processor and a memory, and the above-mentioned units may be stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to implement the corresponding functions.
The memory may include volatile memory in a computer readable medium, Random Access Memory (RAM) and/or nonvolatile memory such as Read Only Memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip.
The order of the embodiments of the present application described above does not represent the merits of the embodiments.
In the above embodiments of the present application, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments. In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways.
The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units may be a logical division, and in actual implementation, there may be another division, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.
In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.
The foregoing embodiments are merely illustrative of the principles and utilities of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Accordingly, it is intended that all equivalent modifications or changes which can be made by those skilled in the art without departing from the spirit and technical spirit of the present invention be covered by the claims of the present invention.
Claims (2)
1. A method for improving the security of a verification code by combining cache information is characterized by comprising the following steps:
s1, setting a cache mark aiming at a marketing activity in a preset time before the marketing activity starts, enabling a server to generate a unique identifier X, and collecting browser environment information at the moment; when a user accesses the business system, the business system can generate a unique identifier X at a server side, and simultaneously issues a credential Y to a client side, wherein the identifier X and the credential Y both need to have uniqueness and cannot be tampered; when a business system is accessed each time, carrying the existing credential Y of the client to the server, and the server is associated to the identifier X through the credential Y, so that the server generates a new credential Y1 to be sent to the client; enabling the credential to change every request, but keeping the associated background unique identifier X unchanged; once the certificate Y cannot inquire the identifier X at the server, regenerating an identifier X1 and also regenerating a certificate Y1 to the client; the browser environment information comprises a browser model, a version and a screen resolution; when the identifier X is generated, acquiring the browser model, version and screen resolution of a client, and recording browser environment information when the identifier X is generated;
s2, collecting user operation behavior information of the associated account in a preset time period through caching; the service system operates in a silent mode within preset time, and existence time of the unique identifier X and user operation behavior information are cached and collected in the associated account;
s3, after the marketing activity starts, when a verification code service is called, a verification code module collects browser environment information at a client, compares the browser environment information with browser environment information collected when a unique identifier X is generated at that time, and judges whether the browser environment information is consistent or not;
s4, popping up a first-level verification code under the condition that the environment information of the browser is judged to be consistent and the cache is credible; popping up a second-level verification code under the condition that the environment information of the browser is judged to be inconsistent; the difficulty of the verification code of the second grade is higher than that of the verification code of the first grade;
for the identifier X of the identifier browser, if the account number associated with the identifier X through the cache is stable, and the operation behavior of the account is not high-frequency operation, night sensitive time operation or long-term inactivity, the identifier X is considered to be a credible cache; in the rule setting of high-frequency operation, night sensitive time operation and long-term inactivity, counting the number of times of inquiring and browsing and the number of times of ordering of each normal user on a platform, and setting N times of the number of times higher than the average number of times as the high-frequency operation; setting the sensitive time at night to be 1-5 points in the morning; long-term inactivity means that the platform has not been visited for more than N days; after the analysis data is collected in a silent state for a period of time, when a verification code service is called under the condition of marketing activities, the verification code module collects the version, the model and the screen resolution information of the browser at the client side and compares the version, the model and the screen resolution information with the environment information collected when the identifier X is generated at that time, so that the environment when the identifier X is generated is ensured to be consistent with the environment information collected by the verification code at this time, and if the environment information is not consistent, the evidence is considered to be copied from other places, so that the risk exists.
2. A device for improving the security of a verification code by combining cache information is characterized by comprising a cache mark setting module, an information collecting module, a judging module and a verification code executing module; wherein:
the cache mark setting module is used for setting a cache mark aiming at the marketing campaign within a preset time before the marketing campaign starts so that the server generates a unique identifier X; when a user accesses the business system, the business system can generate a unique identifier X at a server side, and simultaneously issues a credential Y to a client side, wherein the identifier X and the credential Y both need to have uniqueness and cannot be tampered; when a business system is accessed each time, carrying the existing credential Y of the client to the server, and the server is associated to the identifier X through the credential Y, so that the server generates a new credential Y1 to be sent to the client; enabling the credential to change every request, but keeping the associated background unique identifier X unchanged; once the certificate Y cannot inquire the identifier X at the server, regenerating an identifier X1 and regenerating a certificate Y1 to the client; the browser environment information comprises a browser model, a version and a screen resolution; when the identifier X is generated, acquiring the browser model, version and screen resolution of a client, and recording browser environment information when the identifier X is generated;
the information collection module is used for collecting user operation behavior information of the associated account within a preset time period through caching; the service system operates in a silent mode within preset time, and existence time of the unique identifier X and user operation behavior information are cached and collected in the associated account;
the judging module is used for acquiring the browser environment information at the client side when the verification code service is called after the marketing activity is started, comparing the browser environment information with the browser environment information collected when the unique identifier X is generated at that time, and judging whether the browser environment information is consistent;
the verification code execution module is used for popping up a first-level verification code under the condition that the environment information of the browser is judged to be consistent and the cache is credible; popping up a second-level verification code under the condition that the environment information of the browser is judged to be inconsistent; the difficulty of the verification code of the second grade is higher than that of the verification code of the first grade;
for the identifier X of the identifier browser, if the account number associated with the identifier X through the cache is stable, and the operation behavior of the account is not high-frequency operation, night sensitive time operation or long-term inactivity, the identifier X is considered to be a credible cache; in the rule setting of high-frequency operation, night sensitive time operation and long-term inactivity, counting the number of times of inquiring and browsing and the number of times of ordering of each normal user on a platform, and setting N times of the number of times of inquiring and browsing and the number of times of ordering higher than the average number of times as the high-frequency operation; setting the sensitive time at night to be 1-5 points in the morning; long-term inactivity refers to no access to the platform for more than N days; after the data are collected and analyzed in a silent mode for a period of time, and when a verification code service is called under the condition that a marketing activity exists, the verification code module collects the version, the model and the screen resolution information of the browser at the client side and compares the version, the model and the screen resolution information with the environmental information collected when the identification X is generated at that time, so that the consistency of the environment when the identification X is generated and the environmental information collected by the verification code at this time is ensured, and if the identification X is not consistent, the evidence is considered to be copied from other places, and risks exist.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210024691.3A CN114048449B (en) | 2022-01-11 | 2022-01-11 | Method and device for improving security of verification code by combining cache information |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210024691.3A CN114048449B (en) | 2022-01-11 | 2022-01-11 | Method and device for improving security of verification code by combining cache information |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114048449A CN114048449A (en) | 2022-02-15 |
| CN114048449B true CN114048449B (en) | 2022-05-13 |
Family
ID=80196198
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210024691.3A Active CN114048449B (en) | 2022-01-11 | 2022-01-11 | Method and device for improving security of verification code by combining cache information |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114048449B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9237146B1 (en) * | 2012-01-26 | 2016-01-12 | United Services Automobile Association | Quick-logon for computing device |
| CN107948131A (en) * | 2012-06-18 | 2018-04-20 | 谷歌有限责任公司 | User is set to sign in the method, system and equipment of browser |
| CN109688109A (en) * | 2018-11-21 | 2019-04-26 | 武汉极意网络科技有限公司 | The verification method and device of identifying code based on client-side information identification |
| CN109918892A (en) * | 2019-02-13 | 2019-06-21 | 平安科技（深圳）有限公司 | Verification code generation method, device and storage medium, computer equipment |
| CN112328986A (en) * | 2020-11-26 | 2021-02-05 | 西安四叶草信息技术有限公司 | User identity authentication method, device, server and storage medium |
| CN113301033A (en) * | 2021-05-14 | 2021-08-24 | 顶象科技有限公司 | Verification code display method and system for light-weight service intrusion |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10705860B2 (en) * | 2018-07-27 | 2020-07-07 | Salesforce.Com, Inc. | Method and system for declarative configuration of user self-registration and log in pages and processes for a service provider and automatic deployment of the same |
| CN112187702A (en) * | 2019-07-02 | 2021-01-05 | 北京京东尚科信息技术有限公司 | Method and device for verifying client |
| CN110415124A (en) * | 2019-07-31 | 2019-11-05 | 深圳市思迪信息技术股份有限公司 | The anti-brush method and device of security marketing activity current limliting |
-
2022
- 2022-01-11 CN CN202210024691.3A patent/CN114048449B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9237146B1 (en) * | 2012-01-26 | 2016-01-12 | United Services Automobile Association | Quick-logon for computing device |
| CN107948131A (en) * | 2012-06-18 | 2018-04-20 | 谷歌有限责任公司 | User is set to sign in the method, system and equipment of browser |
| CN109688109A (en) * | 2018-11-21 | 2019-04-26 | 武汉极意网络科技有限公司 | The verification method and device of identifying code based on client-side information identification |
| CN109918892A (en) * | 2019-02-13 | 2019-06-21 | 平安科技（深圳）有限公司 | Verification code generation method, device and storage medium, computer equipment |
| CN112328986A (en) * | 2020-11-26 | 2021-02-05 | 西安四叶草信息技术有限公司 | User identity authentication method, device, server and storage medium |
| CN113301033A (en) * | 2021-05-14 | 2021-08-24 | 顶象科技有限公司 | Verification code display method and system for light-weight service intrusion |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114048449A (en) | 2022-02-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP4954979B2 (en) | Systems and methods for fraud monitoring, detection, and hierarchical user authentication | |
| CN103490884B (en) | Be used for the method for the checking of digital certificate | |
| JP6068506B2 (en) | System and method for dynamic scoring of online fraud detection | |
| US8880435B1 (en) | Detection and tracking of unauthorized computer access attempts | |
| US8806622B2 (en) | Fraudulent page detection | |
| JP5207736B2 (en) | Network security and fraud detection system and method | |
| WO2015043491A1 (en) | Method and system for performing security verification on login of internet account | |
| US8850567B1 (en) | Unauthorized URL requests detection | |
| CN105913257A (en) | System And Method For Detecting Fraudulent Online Transactions | |
| CN104836781A (en) | Method distinguishing identities of access users, and device | |
| CN105229596A (en) | High level of authentication technology and application | |
| CN106797371A (en) | For the method and system of user authentication | |
| CN104519018A (en) | Method, device and system for preventing malicious requests for server | |
| EP2748781A2 (en) | Multi-factor identity fingerprinting with user behavior | |
| EP3750275B1 (en) | Method and apparatus for identity authentication, server and computer readable medium | |
| CA3038029A1 (en) | Identity recognition method and device | |
| CN105262779A (en) | Identity authentication method, device and system | |
| CN107302586A (en) | A kind of Webshell detection methods and device, computer installation, readable storage medium storing program for executing | |
| CN108133373A (en) | Seek the method and device for the adventure account for relating to machine behavior | |
| CN110443031A (en) | A kind of two dimensional code Risk Identification Method and system | |
| TW201318376A (en) | Phishing detecting method, network apparatus applying thereof and computer readable storage medium storing thereof | |
| CN110602184A (en) | Method and device for monitoring and processing cheating behaviors in website | |
| CN114048449B (en) | Method and device for improving security of verification code by combining cache information | |
| CN111597538A (en) | Verification code generation method and system | |
| JP7000271B2 (en) | Vehicle unauthorized access countermeasure device and vehicle unauthorized access countermeasure method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |