KR102589633B1 - Method and device to contrl abusing - Google Patents

Abstract

A fraud control device and method are provided. The fraud control device according to an embodiment may receive fraud information about a first user account from a first service server, and update fraud user information about the first user account using the corresponding fraud information. , fraudulent user information can be transmitted to the second service server.

Description

{METHOD AND DEVICE TO CONTRL ABUSING}

Below, techniques related to fraud control are provided.

Online games (on-line games) are games played over various networks, and have grown rapidly due to the development of the Internet. Common MUD (Multiple User Dialogue or Multiple User Dungeon) games and MUG (Multiple User Graphic) games that can be played by installing a program on the hard disk drive and connecting to an Internet server, and web-based games that can be played using only a browser Games, mobile games using mobile phones or portable game consoles, etc. belong to this category. Various genres of online games are supported on various devices such as computers, mobile phones, and portable game consoles, but generally refers to wired online games played on computers over the Internet.

There is a need to effectively control cheating practices that occur in online games.

The authentication server according to one embodiment can comprehensively manage users who use elements that impede the service environment, such as hacking programs and unauthorized programs.

The authentication server according to one embodiment may provide information about a user who commits a fraudulent act on an arbitrary service server to another service server.

The authentication server according to one embodiment may guide users to use a common authentication method.

The authentication server according to one embodiment may share a single authentication method for a plurality of services.

An abuse control method performed by an authentication server according to an embodiment includes receiving abuse action information about a first user account from a first service server; updating abusive user information for the first user account based on the fraudulent activity information; And it may include transmitting the fraudulent user information to a second service server.

The fraud control method includes receiving, from a first user terminal, a connection request for the first user account to the first service server and authenticating the connection request; And in response to the connection request being successfully authenticated, it may further include allowing the first user terminal to access the first service server through the first user account.

The step of receiving the fraud information may include receiving the fraud information from the first service server in response to the occurrence of a fraud by the first user account.

Receiving the fraudulent activity information may include receiving at least one of the type, number of occurrences, and level of the fraudulent activity.

The step of updating fraudulent user information includes calculating a fraud score based on at least one of the type, number of occurrences, and level of the fraud; and updating the calculated fraud score to the fraudulent user information.

The fraud control method may further include managing the user as a fraudulent user in response to the calculated fraud score exceeding a threshold score.

The step of transmitting the fraudulent user information includes, in response to receiving a connection request for a second user account associated with the first user account from the second service server, the fraudulent user information updated up to the time the connection request is received. It may include transmitting user information.

The fraud control method includes receiving, from a first user terminal, a connection request for the first user account to the first service server; searching for fraudulent user information corresponding to the first user account; and determining whether to restrict the first user account based on the retrieved fraudulent user information.

The fraud control method may further include restricting at least some of the operations triggered by the user within the second service server based on the fraudulent user information.

The fraud control method includes receiving restriction information from at least one of the first service server and the second service server; and restricting operations performed by the first user account based on the restriction information.

The step of transmitting the fraudulent user information may include transmitting the fraudulent user information to the second service server through a push method in response to an update of the fraudulent user information.

The fraud control method may further include providing a premium service for the first user account in response to the user's connection through the first user account being successfully authenticated by the authentication server. .

The step of receiving the fraudulent information includes identifying a user corresponding to the first user account based on device identification information, and the step of updating the fraudulent user information includes updating the fraudulent information. A step of updating fraudulent user information mapped to an identified user, wherein transmitting the fraudulent user information includes providing the fraudulent user information to a second user account corresponding to the identified user. can do.

Transmitting the fraudulent user information may include receiving a request to provide information corresponding to at least one item from the second service server; and transmitting information corresponding to the at least one item among the fraudulent user information to the second service server.

The fraud control method includes: estimating a first location of the user when a user terminal corresponding to the user connects to the first service server; estimating a second location of the user when a user terminal corresponding to the user accesses the second service server; and determining an association between the first user account and the second user account based on the first location and the second location.

The fraud control method is based on at least one of device identification information, behavior patterns of individual user accounts collected from each service server, user account information collected from each service server, and biometric information of the user collected from each service server. , It may further include determining that the first user account registered with the first service server and the second user account registered with the second service server are the same user.

A fraud control device according to an embodiment includes a communication unit that establishes communication with a first service server and a second service server; and receiving fraud information about the first user account from the first service server using the communication unit, updating fraud information about the first user account based on the fraud information, and providing the second service. It may include a processing unit that transmits the fraudulent user information to the server.

The authentication server according to one embodiment can provide quality service by controlling factors that impede the service environment.

The authentication server according to one embodiment can easily detect accounts newly created by the same user by sharing fraud information between a plurality of services.

The authentication server according to one embodiment can collect fraud information comprehensively by encouraging users to use a common authentication method.

The authentication server according to one embodiment can proactively control and manage fraudulent users through a single authentication method.

The authentication server according to one embodiment can fundamentally suppress fraudulent activity by all users.

1 is a diagram illustrating the configuration of a fraud control system according to an embodiment.
Figure 2 is a diagram schematically showing the configuration of a fraud control server according to an embodiment.
Figure 3 is a diagram schematically showing the configuration of a user terminal according to an embodiment.
Figure 4 is a diagram illustrating fraud control for each user account according to an embodiment.
5 to 8 are flowcharts showing a fraud control method according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the attached drawings. The same reference numerals in each drawing indicate the same members.

Various changes may be made to the embodiments described below. The embodiments described below are not intended to limit the embodiments, but should be understood to include all changes, equivalents, and substitutes therefor.

Terms used in the examples are merely used to describe specific examples and are not intended to limit the examples. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by a person of ordinary skill in the technical field to which the embodiments belong. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and unless explicitly defined in the present application, should not be interpreted in an ideal or excessively formal sense. No.

In addition, when describing with reference to the accompanying drawings, identical components will be assigned the same reference numerals regardless of the reference numerals, and overlapping descriptions thereof will be omitted. In describing the embodiments, if it is determined that detailed descriptions of related known technologies may unnecessarily obscure the gist of the embodiments, the detailed descriptions are omitted.

1 is a diagram illustrating the configuration of a fraud control system according to an embodiment.

The fraud control system 100 may include a first service server 110, a second service server 120, an authentication server 130, and a user terminal 140.

The first service server 110 may provide a first service to the user terminal 140. The second service server 120 may provide a second service to the user terminal 140. The first service and the second service may be different services, but are not limited to this, and the first service and the second service may be the same service. The first service server 110 may report fraudulent activity that occurs while providing the first service to the user terminal 140 to the authentication server 130, and the second service server 120 may report fraud that occurs while providing the first service to the user terminal 140. Any fraudulent activity that occurs while providing the second service can be reported to the authentication server 130. For convenience of explanation in this specification, the first service server 110 is a server that is subject to collection of fraudulent information by the authentication server 130, and the second service server 120 is a server that collects fraudulent information from the authentication server 130. Although it has been described as a server that receives information, it is not limited to this.

Abuse actions may refer to actions that are restricted by the service provider among actions that a user can perform while a service is provided, for example, illegal programs (e.g., the use of illegal programs by the service provider). Acts such as using prohibited programs), unmannered behavior, sending messages that insult other users (e.g. profanity) or performing insulting actions, or acts that threaten the in-game economy (e.g. workplace) , and may indicate actions that exploit bugs in the game (for example, it may indicate behavior unintended by the game developer).

The authentication server 130 can authenticate a user account for the user terminal 140 to access each service server. According to one embodiment, when receiving a connection request from the user terminal 140, the authentication server 130 may authenticate whether the connection request is legitimate. When a connection request for a user account is successfully authenticated, the authentication server 130 may allow the user terminal 140 to access the service server through the user account. For example, the authentication server 130 may store logs related to authentication.

The authentication server 130 according to one embodiment may be configured to use a plurality of service servers when any user uses a plurality of service servers (e.g., the first service server 110 and the second service server 120, etc.). Common fraudulent user information can be shared for each. For example, the authentication server 130 may collect information related to fraudulent activity occurring by the same user from each service server and generate fraudulent user information for the corresponding user. The authentication server 130 may share the generated fraudulent user information with each service server.

The user terminal 140 may request access to at least one of the first service server 110 and the second service server 120 through the authentication server 130. If authentication by the authentication server 130 is successful, the user terminal 140 can connect to at least one of the first service server and the second service server. In Figure 1, the user terminal 140 is shown as one, but is not limited to this and may be plural. According to one embodiment, any user may access each service server using a plurality of user terminals, for example, attempt to connect to the first service server 110 through the first user terminal, and use the second user terminal to access the first service server 110. You may attempt to connect to the second service server 120 through the user terminal.

According to one embodiment, the authentication server 130 and each service server may provide compensation to a user who performs user account authentication through the authentication server 130. For example, in response when the user's connection through the first user account is successfully authenticated by the authentication server 130, the authentication server 130 provides a premium service for the first user account. can do. It is not limited to only the first user account, and if authentication is successful for the second user account, the authentication server 130 may provide a premium service as compensation for the second user account.

In this specification, a premium service may refer to a service that provides compensation to a user account, for example, providing limited items, special items, and additional items, providing in-game goods and cash, etc., or exclusive content ( For example, it may represent a service that provides (content, etc.) that can only be used and accessed by users who use the authentication service through the authentication server 130. However, premium services and compensation are not limited to the above, and may include various benefits provided to users. However, if a user is managed as an unauthorized user, the authentication server 130 may stop providing premium services to that user.

However, even if the user does not use the authentication server 130, the user can directly access each of the first service server 110 and the second service server 120 through the user terminal 140. When each self-authentication is successful, the first service server 110 and the second service server 120 may provide the first service and the second service to the corresponding user terminal 140.

Figure 2 is a diagram schematically showing the configuration of a fraud control server according to an embodiment.

The fraud control server 130 includes a communication unit 210, a processing unit 220, and a storage unit 230.

The communication unit 210 may establish communication with at least one of a first service server, a second service server, and a user terminal. For example, the communication unit 210 may communicate with the first service server, the second service server, and the user terminal using at least one of wireless communication and wired communication.

According to one embodiment, the communication unit 210 may receive a connection request for at least one of the first service server and the second service server from the user terminal. For example, the communication unit 210 may receive user account information along with a connection request from the user terminal, and may transmit the user account information to the processing unit 220.

Additionally, the communication unit 210 may receive fraud information related to fraud committed by each user account from each service server. For example, the first service server and the second service server may generate fraud information and transmit it to the communication unit 210 in response to a case where a fraud occurs. For another example, the communication unit 210 may relay communication between a service server and a user terminal, and the communication unit 210 may detect fraudulent activity by directly monitoring information related to the relayed service.

Cheating information may represent information related to cheating. For example, the fraud information may include at least one of the type, number of occurrences, and level of the fraud. Types of cheating include using illegal programs, unmannered behavior, sending messages that insult other users or performing insulting actions, threatening the in-game economy, and exploiting bugs in the game. You can. However, it is not limited to this, and the type of fraudulent activity may include all types designated as restricted acts by the service provider. The number of occurrences of fraudulent activity may be accumulated from the beginning for each user account, but is not limited to this and may also indicate the number of occurrences accumulated over a certain period of time. The degree of cheating may indicate the degree of impact the cheating has on the game, for example, the degree to which other users are insulted, and the amount of goods obtained through actions restricted by the service provider. In addition, the cheating information may include log information recording the actions of a user account related to the cheating, and may include, for example, logs of a certain time period adjacent to the time when the cheating was determined. However, it is not limited to the above.

For example, the communication unit 210 may be a hardware module such as a network interface card, a network interface chip, and a networking interface port, and a network device driver. It may be a software module such as a (network device driver) or a networking program.

The processing unit 220 may perform processing to control fraudulent activity occurring in a service (eg, a game service). For example, the processing unit 220 may authenticate a connection request for a game service. The processing unit 220 may receive fraudulent activity information and perform processing such as creating, updating, and deleting fraudulent user information. The processing unit 220 may transmit fraudulent user information to the service server or perform processing to restrict the operation of the user terminal to the service server based on the fraudulent user information.

Additionally, the processing unit 220 may perform processing necessary for the operation of the fraud control server 130. Here, performing processing may represent executing program code stored in the fraud control server 130. For example, the processing unit 220 may include at least one processor or at least one core within the processor.

According to one embodiment, the processing unit 220 may receive abusive action information about the first user account from the first service server through the communication unit 210, and based on the abusive action information, Abusing user information for the first user account can be updated, and the abusive user information can be transmitted to the second service server through the communication unit 210. The specific operation of the processing unit 220 of the fraud control server 130 will be described in detail in FIGS. 4 to 8 below.

The storage unit 230 may store information necessary to control fraudulent activity. The storage unit 230 may store a program including instructions for operating the fraud control server 130. The program stored in the storage unit 230 can be executed by the processing unit 220 described above. For example, the storage unit 230 includes instructions for executing operations that define operations for authenticating a user account, operations for updating fraudulent user information, and actions allowed and restricted for a user account. , account information of each user account (e.g., account ID, password, information associated with the user's character, information associated with the user's item, user account level information, user's character level information, user's matching score , fixed scores, etc.), fraudulent user information, etc. for each user account can be stored.

Hereinafter, the fraud control server 130 may be referred to as a fraud control device.

Figure 3 is a diagram schematically showing the configuration of a user terminal according to an embodiment.

Figure 3 illustrates the detailed configuration of the user terminal 300 as an example. The user terminal 300 may include a communication unit 310, a display 320, an input reception unit 330, a processing unit 340, and a storage unit 350.

The communication unit 310 may communicate with a service server and an authentication server. For example, the communication unit 310 may communicate with the service server and the authentication server using at least one of wireless communication and wired communication. According to one embodiment, the communication unit 310 may transmit a connection request to the authentication server. Additionally, information related to the game necessary to provide game services can be transmitted to the game server, or the information can be received from the game server. For another example, when the authentication server relays the connection between the game server and the user terminal 300, the communication unit 310 may receive information related to the game from the game server through the authentication server.

The display 320 may display a screen related to a game service to the user. The display 320 may display a screen based on information related to the game to the user in response to the control of the processing unit 340. Additionally, the display 320 may also display a screen related to user account authentication of a game service, a screen related to fraud control, etc.

The input receiver 330 may receive user input from the user. According to one embodiment, the input received through the input receiver 330 may be converted into a command related to the game service by the processor 340. For example, instructions associated with a game service may include instructions for sending a connection request to an authentication server. Hereinafter, in this specification, input may include input by all operations received from the user during provision of game services, user account authentication, and fraud control.

Additionally, the processing unit 340 may perform processing necessary for the operation of the user terminal 300. Here, performing processing may refer to executing program code stored in the storage unit 350.

The storage unit 350 may store a program including instructions for operating the user terminal 300. The program stored in the storage unit 350 can be executed by the processing unit 340 described above. For example, the storage unit 350 can store game programs. In addition, the storage unit 350 contains account information of the user account, such as account ID, password, information related to the user's character, information related to the user's item, level information of the user account, and level information of the user's character. You can also save etc.

Figure 4 is a diagram illustrating fraud control for each user account according to an embodiment.

As described above, the user terminal 140 can access the first service server 110 with a user account through the authentication server 130. According to one embodiment, the user terminal 140 may transmit a connection request through the first user account 491 to the authentication server 130 based on an input from the user 409. According to another embodiment, the user terminal 140 may transmit a connection request through the second user account 492 to the authentication server 130 based on an input from the user 409.

The authentication server 130 may authenticate a connection request for the first user account 491. The authentication server 130 provides fraud information associated with fraud occurring by the first user account 491 while the user terminal 140 is connected to the first service server 110 with the first user account 491. can receive. The authentication server 130 may update fraudulent user information for the first user account 491 based on fraudulent activity information.

Additionally, the authentication server 130 may authenticate a connection request for the second user account 492. The authentication server 130 provides fraud information associated with fraud occurring by the second user account 492 while the user terminal 140 is connected to the second service server 120 with the second user account 492. can receive. The authentication server 130 may update fraudulent user information for the first user account 491 based on fraudulent activity information. Here, in response to the case where the user of the first user account 491 and the user of the second user account 492 are determined to be the same user 409, the authentication server 130 2 The integrated fraudulent user information for the user account 492 can be updated.

According to one embodiment, the authentication server 130 includes device identification information, behavior patterns of individual user accounts collected from each service server, user account information collected from each service server, and the user's biometrics collected from each service server. Based on at least one of the information, the first user account 491 registered with the first service server 110 and the second user account 492 registered with the second service server 120 are connected to the same user 409. ) can be judged. For example, the authentication server 130 may determine the relationship between a plurality of user accounts and determine whether they are the same user 409. Association may indicate the degree to which a plurality of user accounts are related, and may be sent to the authentication server 130 based on similarity between device identification information, similarity between behavior patterns, similarity between user account information, similarity between biometric information, and similarity between location information. can be determined by

Device identification information is information for identifying a device, and may represent, for example, unique information (e.g., device serial number, phone number, etc.) individually assigned to each device. Additionally, device identification information may represent unique information (eg, application serial number, etc.) provided to an application installed on the device. However, it is not limited to this, and the device identification information includes unique information assigned to each of the hardware elements that make up the device (e.g., model number of the CPU (central processing unit), MAC (Media Access Control) address of the LAN card) etc.) may also be included.

A behavioral pattern may represent a pattern according to actions performed by an individual user account. It may represent habitual behavior that appears when the user 409 plays a game, and may include, for example, a combination of keys designated as shortcuts, a mouse movement pattern or key input pattern during game play.

User account information may include the user account name and password, and may further include personal information. Personal information may include information such as the user 409's name, phone number, address, and hobbies.

Biometric information is information representing the biometric characteristics of the user 409 and may include, for example, information about the user 409's fingerprint, information about blood vessels, and information about the iris. . However, biometric information is not limited to this.

For example, the user 409 uses the same user terminal 140 to use the first user account 491 in the first service server 110 and the second user account 492 in the second service server 120. When connecting, the device identification information may be the same. When the device identification information of the user terminal 140 connected through the first user account 491 and the user terminal 140 connected through the second user account 492 are the same, the authentication server 130 sets the two user accounts It can be determined that this is the same user 409.

Additionally, the authentication server 130 may determine that user accounts with the same biometric information used for authentication belong to the same user 409. In addition, the authentication server 130 may detect an account owned by the same user 409 among several user accounts by referring to behavior patterns and user account information. For example, based on the similarity between behavior patterns between user accounts and the similarity between user account information, the probability that user accounts to be compared are owned by the same user 409 can be calculated. Specifically, the similarity between user account information may include similarity between user account names. However, it is not limited to this, and the similarity between behavior patterns and user account information may be applied as a weight to device identification information, etc. Similarity can indicate the degree to which two pieces of information are similar to each other.

Furthermore, the authentication server 130 may estimate the first location of the user 409 when the user terminal 140 corresponding to the user 409 connects to the first service server 110. . The authentication server 130 may estimate the second location of the user 409 when the user terminal 140 corresponding to the user 409 connects to the second service server 120. In addition, the authentication server 130 may determine the correlation between the first user account 491 and the second user account 492 based on the first location and the second location. For example, the authentication server 130 determines that the smaller the distance difference between the first location and the second location, the higher the correlation between the first user account 491 and the second user account 492 (e.g., Relevance can be determined in inverse proportion to the distance difference.

However, although only one user terminal 140 is shown in FIG. 4, it is not limited to this. The user 409 may use a plurality of user terminals 140. For example, the user 409 may access the first user account 491 using the first user terminal 140, and 2 The user account 492 can be accessed using the second user terminal 140.

5 to 8 are flowcharts showing a fraud control method according to an embodiment.

Figure 5 is a flow chart schematically showing a fraud control method.

First, in step 510, the fraud control device may receive abusive action information about the first user account from the first service server. According to one embodiment, the fraud control device may receive the fraud information from the first service server in response to the occurrence of a fraud by the first user account. Additionally, the fraud control device may receive fraud information from the second service server in response to the occurrence of fraud by the second user account. The fraud control device may receive at least one of the type of fraud (eg, reason for user block, etc.), number of occurrences, and level. Here, the fraud control device may identify the user corresponding to the first user account based on device identification information. However, it is not limited to this, and the fraud control device may receive fraud information at regular intervals and may identify the user corresponding to the first user account using information other than device identification information.

And in step 520, the fraud control device may update abuse user information for the first user account based on the abuse information. According to one embodiment, the fraud control device may calculate a fraud score based on at least one of the type, number of occurrences, and level of the fraud. The fraud control device may update the calculated fraud score to the fraudulent user information. Fraud scores can be shared in real time or asynchronously with each service server.

In this specification, the cheating score is a score related to cheating, and may represent, for example, a score indicating the possibility that a random user is a cheating user. The score added to the fraudulent user information may vary depending on the type of fraud, and as the number of issuances accumulates, the score may be repeatedly added to the fraudulent user information, and the fraud score will be calculated in proportion to the degree of fraud. You can.

Additionally, the fraud control device may update the fraud information to the fraud user information mapped to the user identified in step 510. In this specification, it has been described that the first user account and the second user account are identified as the same user, but this is not limiting, and a plurality of three or more user accounts may be identified as the same user.

Furthermore, the fraud control device can determine whether the user is a fraudulent user based on fraud information. A fraudulent user is a user who has committed excessive fraudulent activity and may represent a user who is managed to limit the operations that can be performed within each service. For example, in response to a case where the calculated fraud score exceeds a threshold score, the fraud control device may manage the user as a fraud user (eg, add it to a black list). The threshold score may represent a fraud score that serves as a standard for distinguishing fraudulent users. Furthermore, the fraud control device can manage the user account to prevent the use of an authentication service based on the fraud control device.

A user designated as an unauthorized user may individually request block release from each service provider (eg, a person providing the first service, a person providing the second service) through the user terminal. The service server operated by each service provider can individually determine whether to release a block.

Subsequently, in step 530, the fraud control device may transmit the fraudulent user information to the second service server. According to one embodiment, the fraud control device responds when a connection request for a second user account associated with the first user account is received from the second service server, and updates the fraudulent user account up to the time the connection request is received. Information can be transmitted. However, it is not limited to this, and as another example, the fraud control device may transmit the fraudulent user information to the second service server through a push method in response to an update of the fraudulent user information.

Additionally, the fraud control device may provide the fraudulent user information to a second user account corresponding to the user identified in step 510. As described above, the case where the first user account and the second user account are identified as the same user has been described as an example, but it is not limited to this, and if three or more user accounts are identified as the same user, a fraud control device may be used. may provide fraudulent user information for all user accounts corresponding to the identified user.

Figure 6 is a flowchart showing a method by which the authentication server transmits fraudulent user information to the service server when updating fraudulent user information.

The user terminal 140 may request (610) authentication for the first user account from the authentication server 130 based on input from the user. The authentication server 130 may receive a connection request for the first user account to the first service server 110 from the first user terminal. The authentication server 130 may perform authentication on the received connection request (620).

In response to the connection request being successfully authenticated, the authentication server 130 may allow the first user terminal to access the first service server 110 through the first user account. For example, the authentication server 130 may notify the first service server 110 of successful authentication 630 of the first user account. Thereafter, the first service server 110 may establish communication with the user terminal 140 and provide the first service to the user terminal 140.

The first service server 110 may monitor (640) the activity of the first user account while providing the first service. For example, the first service server 110 may send data packets that the first user terminal transmits to the first service server 110 through the first user account, applications running on the first user terminal, and the first user terminal. You can monitor user input, etc. Based on this monitoring, the first service server 110 may detect (650) fraudulent activity by the first user account. The first service server 110 may transmit fraud information to the authentication server 130 (660) in response to detecting fraud.

The authentication server 130 may receive the fraud information from the first service server 110 in response to the occurrence of a fraud by the first user account. The authentication server 130 may update (670) fraudulent user information based on the received fraudulent activity information. The authentication server 130 may transmit fraudulent user information to the second service server 120. For example, the authentication server 130 may transmit the above-described fraudulent user information to a second user account in the second service server 120 that is determined to be the same user as the first user account. Here, the user may connect to the second user account of the second service server through the first user terminal, but is not limited to this and may also connect through a second user terminal that is distinct from the first user terminal.

However, it is not limited to the above, and the authentication server 130 may directly restrict services for the user account. According to one embodiment, the authentication server 130 may restrict at least some of the operations triggered by the user within the second service server based on the fraudulent user information. For example, the authentication server 130 may restrict at least some of the operations triggered by the user by blocking at least some of the information related to the operation received from the user terminal 140.

Figure 7 is a flowchart showing a process in which an authentication server rejects authentication based on fraudulent user information.

The user terminal 140 may request authentication of the first user account from the authentication server 130 (710).

The authentication server 130 may receive an authentication request for the first user account from the user terminal 140. For example, the authentication server 130 may receive a connection request for the first user account to the first service server from the first user terminal. The authentication server 130 may search 720 for fraudulent user information corresponding to the first user account. The authentication server 130 may determine whether to restrict the first user account based on the retrieved fraudulent user information. For example, as shown in FIG. 7, the authentication server 130 may deny authentication 730 for the first user account.

If the first user account for the first service server and the second user account for the second service server are identified as belonging to the same user, the authentication server 130 may perform a similar operation for the second user account. there is.

For example, the user terminal 140 may request authentication of a second user account from the authentication server 130 (740).

The authentication server 130 may receive an authentication request for the second user account from the user terminal 140. The authentication server 130 may search 750 for fraudulent user information corresponding to the second user account. The authentication server 130 may reject authentication for the second user account (760) based on the retrieved fraudulent user information.

Figure 8 is a flowchart showing a process by which a service server limits a service.

The user terminal 140 may request (810) the authentication server 130 for authentication of the first user account.

The authentication server 130 may search 820 for fraudulent user information in response to receiving an authentication request for the first user account. In response to the case where fraudulent user information is searched, the authentication server 130 may transmit (830) the fraudulent user information to the first service server 110.

The first service server 110 may receive fraudulent user information from the authentication server 130 and determine whether to allow operation of the user's user account based on the received fraudulent user information. In response to the case where the first service server 110 determines that the user is an unauthorized user, the first service server 110 may restrict the first service to the user terminal 140 (840).

Here, the first service server 110 may directly restrict operations performed by the first user account connected to the user terminal 140, but is not limited to this. For another example, the authentication server 130 may receive restriction information from at least one of the first service server 110 and the second service server 120. The authentication server 130 may receive restriction information based on the restriction information. Thus, operations performed by the first user account can be restricted. Restriction information is information related to the restriction of the operation of a specific user account and may include, for example, information indicating the user account subject to the restriction, information indicating the type and scope of the restricted operation, etc. According to one embodiment, the first service server 110, the second service server 120, and the authentication server 130 may determine the scope of the service to be provided based on the reason for the user block included in the restriction information. there is.

The above-described operations can be similarly applied to the second service. For example, the user terminal 140 may request (850) the authentication server 130 for authentication of the second user account.

The authentication server 130 may search 860 for fraudulent user information in response to receiving an authentication request for the second user account. In response to the case where fraudulent user information is searched, the authentication server 130 may transmit the fraudulent user level to the second service server 120 (870).

In response to the case where the user is determined to be an unauthorized user, the second service server 120 may restrict the second service to the second user account accessed by the user (880).

As described above, the first service server 110 and the second service server 120 are based on the fraudulent user information received from the authentication server 130 and based on standards set differently for each service. It is possible to determine whether a user is fraudulent. Additionally, the first service server 110 and the second service server 120 may receive information with different detailed items of fraudulent user information.

For example, in step 870 described above, the authentication server 130 may receive a request to provide information corresponding to at least one item from the second service server 120. The information provision request may represent a signal requesting at least some of a plurality of items of fraudulent user information. The authentication server 130 may transmit information corresponding to the at least one item among the fraudulent user information to the second service server 120. In this way, the second service server 120, the authentication server 130, can reduce the amount of data required for communication by requesting only the information necessary to determine a fraudulent user.

The device described above may be implemented with hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA), It may be implemented using one or more general-purpose or special-purpose computers, such as a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. A processing device may perform an operating system (OS) and one or more software applications that run on the operating system. Additionally, a processing device may access, store, manipulate, process, and generate data in response to the execution of software. For ease of understanding, a single processing device may be described as being used; however, those skilled in the art will understand that a processing device includes multiple processing elements and/or multiple types of processing elements. It can be seen that it may include. For example, a processing device may include a plurality of processors or one processor and one controller. Additionally, other processing configurations, such as parallel processors, are possible.

Software may include a computer program, code, instructions, or a combination of one or more of these, which may configure a processing unit to operate as desired, or may be processed independently or collectively. You can command the device. Software and/or data may be used on any type of machine, component, physical device, virtual equipment, computer storage medium or device to be interpreted by or to provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. Computer-readable media may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and configured for the embodiment or may be known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with limited examples and drawings, various modifications and variations can be made by those skilled in the art from the above description. For example, the described techniques are performed in a different order than the described method, and/or components of the described system, structure, device, circuit, etc. are combined or combined in a different form than the described method, or other components are used. Alternatively, appropriate results may be achieved even if substituted or substituted by an equivalent.

Therefore, other implementations, other embodiments, and equivalents of the claims also fall within the scope of the claims described below.

100: Fraud control system
110: first service server
120: second service server
130: Authentication server
140: User terminal

Claims (18)

As an abusing control method performed by an authentication server,
Receiving abusive action information about a first user account from a first service server.
updating abusive user information for the first user account based on the fraudulent activity information; and
Transmitting the fraudulent user information for the first user account to a second service server
Including,
The step of receiving the fraud information is,
Based on device identification information, identifying a user corresponding to the first user account,
The step of updating the fraudulent user information is,
Comprising the step of updating the fraudulent activity information to fraudulent user information mapped to the identified user,
The step of transmitting the fraudulent user information is,
Comprising providing the fraudulent user information for a second user account corresponding to the identified user,
Negative control methods. According to paragraph 1,
Receiving, from a first user terminal, a connection request for the first user account to the first service server and authenticating the connection request; and
In response to the connection request being successfully authenticated, allowing the first user terminal to access the first service server through the first user account.
A negative control method further comprising: According to paragraph 1,
The step of receiving the fraud information is,
In response to the occurrence of a fraudulent activity by the first user account, receiving the fraudulent activity information from the first service server.
A negative control method including. According to paragraph 1,
The step of receiving the fraud information is,
Receiving at least one of the type, number of occurrences, and level of fraud
A negative control method including. According to paragraph 1,
The steps for updating fraudulent user information are:
Calculating a fraud score based on at least one of the type, number of occurrences, and level of the fraud; and
Updating the calculated fraud score to the fraudulent user information
A negative control method including. According to clause 5,
In response to the calculated fraud score exceeding a threshold score, managing the user as a fraud user.
A negative control method further comprising: According to paragraph 1,
The step of transmitting the fraudulent user information is,
In response to receiving a connection request for a second user account associated with the first user account from the second service server, transmitting fraudulent user information updated up to the time the connection request is received.
A negative control method including. According to paragraph 1,
Receiving, from a first user terminal, a connection request for the first user account to the first service server;
searching for fraudulent user information corresponding to the first user account; and
Based on the retrieved fraudulent user information, determining whether to restrict the first user account.
A negative control method further comprising: According to paragraph 1,
Based on the fraudulent user information, restricting at least some of the operations triggered by the user within the second service server.
A negative control method including. According to paragraph 1,
Receiving restriction information from at least one of the first service server and the second service server; and
Restricting operations performed by the first user account based on the restriction information
A negative control method further comprising: According to paragraph 1,
The step of transmitting the fraudulent user information is,
In response to the update of the fraudulent user information, transmitting the fraudulent user information to the second service server through a push method.
A negative control method including. According to paragraph 1,
In response to the user's connection through the first user account being successfully authenticated by the authentication server, providing a premium service for the first user account.
A negative control method further comprising: delete According to paragraph 1,
The step of transmitting the fraudulent user information is,
Receiving a request to provide information corresponding to at least one item from the second service server; and
Transmitting information corresponding to the at least one item among the fraudulent user information to the second service server
A negative control method including. According to paragraph 1,
estimating a first location of the user when a user terminal corresponding to the user accesses the first service server;
estimating a second location of the user when a user terminal corresponding to the user accesses the second service server; and
Based on the first location and the second location, determining an association between the first user account and the second user account.
A negative control method including. According to paragraph 1,
Based on at least one of the device identification information, behavior patterns of individual user accounts collected from each service server, user account information collected from each service server, and biometric information of the user collected from each service server, the first Determining that the first user account registered with the service server and the second user account registered with the second service server are the same user.
A negative control method further comprising: A computer program combined with hardware and stored in a medium to execute the method of any one of claims 1 to 12 and 14 to 16. In the fraud control device,
a communication unit that establishes communication with the first service server and the second service server; and
Receive fraud information about the first user account from the first service server using the communication unit, update fraud information about the first user account based on the fraud information, and the second service server A processing unit that transmits the fraudulent user information for the first user account to
Including,
The processing unit,
Based on device identification information, identify the user corresponding to the first user account,
Update the fraudulent activity information to fraudulent user information mapped to the identified user,
Providing the fraudulent user information for a second user account corresponding to the identified user,
Fraud control device.

Images