TWI817674B - Two-steps authentication method and two-steps authentication system - Google Patents

Abstract

A two-steps authentication method and a two-steps authentication system are disclosed. The method includes: collecting contact interaction information related to a first user; activating a two-steps authentication for the first user; presenting a first prompt message through a first electronic device; in response to that a first response from the first electronic device for the first prompt message meets a fist condition, presenting a second prompt message through a second electronic device according to the contact interaction information, wherein an owner bound to the second electronic device is not the first user; and in response to that a second response from the second electronic device for the second prompt message meets a second condition, determining that the first passes the two-steps authentication.

Description

Two-step verification method and two-step verification system

The present invention relates to an identity authentication technology, and in particular to a two-step verification method and a two-step verification system.

In an era where the Internet is quite popular, account security is very important. Currently, using mobile phones to perform two-step verification when logging in to an account is a current method to provide an additional layer of protection when logging in to an account. However, there are always times when people are not around their mobile phones or their batteries are out of battery. When two-step verification is required without a phone, there seems to be no way to pass it. Therefore, how to use other people's mobile phones and other auxiliary verification devices to replace the user's own mobile phone to perform two-step verification is actually one of the topics that technicians in the related field are dedicated to.

The present invention provides a two-step verification method and a two-step verification system, which can bring more convenience in identity verification to users who forget to bring their mobile phones when going out or whose mobile phones are out of battery on the premise of meeting relevant security requirements.

Embodiments of the present invention provide a two-step verification method, which includes: collecting contact interaction information related to a first user; initiating a two-step verification for the first user; and presenting a first prompt through the first electronic device Message; in response to the first response of the first electronic device to the first prompt message meeting the first condition, a second prompt message is presented via the second electronic device according to the contact interaction information, wherein the second The owner bound to the electronic device is not the first user; and in response to the second response of the second electronic device to the second prompt message meeting the second condition, determining the user of the first electronic device Pass the two-step verification.

An embodiment of the present invention further provides a two-step verification system, which includes a storage circuit and a processor. The processor is coupled to the storage circuit. The processor is used to: collect contact interaction information related to the first user and store the contact interaction information in the storage circuit; initiate a two-step verification for the first user; present via the first electronic device A first prompt message; in response to the first response of the first electronic device to the first prompt message meeting the first condition, a second prompt message is presented via the second electronic device according to the contact interaction information, wherein the The owner bound to the second electronic device is not the first user; and in response to the second response of the second electronic device to the second prompt message meeting the second condition, it is determined that the first electronic device of users passed the two-step verification.

Based on the above, the two-step verification method and the two-step verification system provided by embodiments of the present invention can collect contact interaction information related to the first user. After activating the two-step verification for the first user, based on the contact interaction information and the first response of the first electronic device to the first prompt message, the second electronic device can further complete the verification for the first user. Two-step verification. In particular, the owner of the second electronic device is not the first user. In this way, it can bring more convenience in identity verification to users who forget to bring their mobile phones when they go out or when their mobile phones are out of battery, while meeting relevant security requirements.

FIG. 1 is a schematic diagram of a two-step verification system according to an embodiment of the present invention. Referring to Figure 1, the two-step verification system 10 can be installed in various computer devices that can serve as server hosts, such as smartphones, tablet computers, notebook computers, desktop computers or industrial computers, and the computer device The type is not limited to this.

The two-step verification system 10 may include a processor 11, a storage circuit 12, and an input/output (I/O) device 13. The processor 11 may be responsible for the entire or partial operation of the two-step verification system 10 . For example, the processor 11 may include a central processing unit (CPU) or other programmable general-purpose or special-purpose microprocessor, digital signal processor (Digital Signal Processor, DSP), programmable control devices, Application Specific Integrated Circuits (ASIC), Programmable Logic Device (PLD) or other similar devices or a combination of these devices.

The storage circuit 12 is coupled to the processor 11 and used to store data. For example, storage circuit 12 may include volatile storage circuits and non-volatile storage circuits. Volatile storage circuits are used to store data volatilely. For example, the volatile storage circuit may include random access memory (RAM) or similar volatile storage media. Non-volatile storage circuits are used to store data in a non-volatile manner. For example, non-volatile storage circuits may include read only memory (ROM), solid state disk (SSD), traditional hard disk drive (HDD), flash memory (flash memory) ), embedded MultiMedia Card (eMMC), Universal Flash Storage (UFS) device or similar non-volatile storage media.

The input/output device 13 is coupled to the processor 11 and can be used to transmit signals. For example, the input/output device 13 may include various interface circuits with signal transmission functions such as network interface cards, monitors, mice, keyboards, touch screens, touch pads, and speakers, and the type of the input/output device 13 varies. Limited to this.

The processor 11 can collect contact interaction information 101 related to a specific user (also referred to as the first user) via the input/output device 13 . For example, the contact interaction information 101 may reflect the first user's usual interaction status with other users through interactive programs such as social media, email programs, and/or instant messaging programs. For example, the contact interaction information 101 may reflect the first user's usual text conversations, voice conversations, and online interactions with other users through interactive programs such as social media, email programs, and/or instant messaging programs (for example, for specific applications). Users like posts on social media, leave comments or tag specific users on social media, etc.), the time, frequency and/or content of email exchanges. The processor 11 can store the contact interaction information 101 in the storage circuit 12 for subsequent query.

In one embodiment, the processor 11 can use an agent program installed in various electronic devices bound to the first user (such as a smartphone, tablet, or desktop computer owned by the first user). To retrieve contact interaction information 101. This agent can report the captured contact interaction information 101 to the two-step verification system 10 regularly or irregularly. Alternatively, the processor 11 can also directly retrieve the contact interaction information 101 through social media, email programs and/or online platforms used by instant messaging programs.

In one embodiment, the user (eg, the first user) can send the verification request through the electronic device at hand (also referred to as the first electronic device). This verification request can be used to request the two-step verification system 10 to use other people's electronic devices to perform two-step verification on the user who is currently operating the first electronic device. That is, this two-step verification can be used to verify whether the user currently operating the first electronic device is the first user himself.

It should be noted that the user bound to the first electronic device may or may not be the first user. For example, the first electronic device may include a tablet computer or a laptop computer owned by the first user and bound to the first user. Alternatively, the first electronic device may also be a private or public computer that is not bound to the user.

In one embodiment, the processor 11 may receive the verification request through the input/output device 13 . In response to the verification request, the processor 11 may initiate a two-step verification for the first user.

In response to the two-step verification for the first user being activated, the processor 11 may present a prompt message (also referred to as a first prompt message) via the first electronic device. For example, the processor 11 can generate a first prompt message according to the contact interaction information 101 . For example, the first prompt message can randomly ask the first user about the content of his recent interactions with close friends, for example, "What type of chat content have been most common with friend A in the past week?" or "Please enter the phone number of the friend you have recently contacted. number or email address" etc. The answers to these questions can be obtained from Contact Interactive Information 101.

The processor 11 can send the first prompt message to the first electronic device for presentation through the input/output device 13 (for example, displayed on the display of the first electronic device). In other words, this first prompt message is used to perform preliminary verification (also called first-stage verification) in the two-step verification of the first user's identity to initially determine whether the user currently operating the first electronic device is the The first user himself.

After the first prompt message is presented via the first electronic device, the processor 11 may receive a response (also referred to as a first response) from the first electronic device to the first prompt message via the input/output device 13 . Then, the processor 11 can verify the first response and determine whether the first response meets the preset condition (also referred to as the first condition).

Generally speaking, if the user currently operating the first electronic device is indeed the first user, the first response returned by the first user in response to the first prompt message should be correct. For example, assume that the contact interaction information 101 reflects that the chat content of the first user with friend A in the past week is mostly related to "mobile games" and "exams", and the message included in the first response is also "mobile games". "Game" and/or "Examination" related content, then the processor 11 can determine that the first response is correct according to the contact interaction information 101. In response to the first response being correct, the processor 11 may determine that the first response meets the first condition. Wherein, if the first response meets the first condition, it can also be deemed that the identity of the user currently operating the first electronic device has passed preliminary verification (ie, passed the first stage of verification).

On the other hand, if the contact interaction information 101 reflects that most of the first user's chats with friend A in the past week were related to "mobile games" and "exams", but the message in the first response is "Child" related content, the processor 11 can determine that the first response is not correct based on the contact interaction information 101. In response to the first response being incorrect, the processor 11 may determine that the first response does not meet the first condition. Wherein, if the first response does not meet the first condition, it can also be regarded as that the identity of the user currently operating the first electronic device has not passed the preliminary verification (ie, has not passed the first stage of verification). In response to the first response not meeting the first condition, the processor 11 may determine that the user currently operating the first electronic device has failed the two-step verification (ie, the two-step verification failed).

In one embodiment, in response to the first response of the first electronic device to the first prompt message meeting the first condition, the processor 11 may, according to the contact interaction information 101, via another electronic device (also referred to as the second electronic device ) presents another prompt message (also called a second prompt message).

In particular, the owner bound to the second electronic device (also referred to as the second user) is not the first user. For example, the second user may be a family member, relative, colleague or friend of the first user. In other words, the second electronic device is used to replace the electronic device that has been bound to the first user, such as the first user's smartphone, to perform two steps on the identity of the user currently operating the first electronic device. Advanced verification within verification (also known as second-stage verification).

In one embodiment, in response to the first response meeting the first condition, the processor 11 may generate a contact list according to the contact interaction information 101 and present the contact list through the first electronic device. For example, according to the contact interaction information 101, the generated contact list may list at least one contact who has interacted more frequently and/or interacted more closely with the first user in the past period of time.

In one embodiment, the processor 11 can filter multiple contacts related to the first user based on the contact interaction information 101 . Contacts obtained through filtering can be added to the contact list. For example, the processor 11 may refer to Table 1 below to score multiple contacts related to the first user in the contact interaction information 101 . Table 1 Project Give points Send a letter to the other party and receive a reply from the other party 2 points for each exchange Instant messaging and response 2 points for each exchange Voice conversation exceeds ten seconds 2 points every ten seconds Like the other person’s post 0.5 points for each like Tag someone's name in a photo 1 point for each photo tagged An artificial intelligence model is used to analyze the text content that comes and goes. There are close names for each other, such as mother, husband, baby; or interaction methods, such as: Ouch, I hate it, what’s wrong with you? 10 points for each piece of text

It should be noted that the items and scoring standards listed in Table 1 above are only examples and are not used to limit the present invention. After comprehensive scoring results, some contacts with relatively high scores may be added to the contact list.

After the first electronic device presents the contact list, the processor 11 may receive a user operation (also referred to as a first user operation) via the first electronic device and retrieve the information from the contact list according to the first user operation. Determine a contact person as the second user. The second user can be used to assist the user currently operating the first electronic device (eg, the first user) to complete the two-step verification. Then, the processor 11 can send the second prompt message to the second electronic device for presentation through the input/output device 13 according to the contact selected by the first user's operation (ie, the second user) (for example, by the second electronic device). display on the device). For example, the processor 11 can send the second prompt message to the second electronic device for presentation based on the communication information such as the phone number, email account, or instant messaging account bound to the second user.

FIG. 2 is a schematic diagram of a contact list according to an embodiment of the present invention. Please refer to Figure 2. Multiple contacts (including 1. Wife, 2. Mom, 3. Colleague A, 4. Dad, 5. Best Buddy) can be displayed in the contact list 21 for the user to select. It should be noted that the contact list 21 in FIG. 2 is only an example and is not used to limit the present invention.

In one embodiment, assuming that the user selects “4.Dad” as the second user from the contact list 21 through the first user operation, the processor 11 may send the second prompt message to the contact “4. .Dad" is an electronic device bound to it. Then, the electronic device bound to the contact "4. Dad" can be used as a second electronic device to assist in the two-step verification of the user.

After the second prompt message is presented via the second electronic device, the processor 11 may receive a response (also referred to as a second response) from the second electronic device to the second prompt message via the input/output device 13 . Then, the processor 11 can verify the second response and determine whether the second response meets the preset condition (also referred to as the second condition).

In one embodiment, the second prompt message may include a message upload interface. This message upload interface can be used to upload images or text messages. According to the second prompt message, the user can operate the second electronic device to upload the message carried in the second response through the message upload interface. Thereby, the second response from the second electronic device may include an image or a text message sent by the second electronic device through the message upload interface.

In one embodiment, the processor 11 can determine whether the message in the second response is correct. If the message in the second response is correct, the processor 11 may determine that the second response meets the second condition. On the contrary, if the message in the second response is not correct, the processor 11 may determine that the second response does not meet the second condition. Alternatively, in one embodiment, if the processor 11 does not receive the second response from the second electronic device within a preset time range after sending the second prompt message, the processor 11 may also determine that the second response does not meet the requirements. Second condition.

In one embodiment, after determining the second user based on the first user operation, the processor 11 may receive another user operation (also called a second user operation) via the first electronic device. The processor 11 can determine the target information type from at least one information type according to the second user operation.

After the second prompt message is presented through the second electronic device and the second response is received, the processor 11 can identify whether the message in the second response belongs to the target information category through the artificial intelligence model. For example, the artificial intelligence model can be trained (such as image recognition training or semantic recognition training) to determine whether the image or text message in the second response belongs to the target information category. How to perform image recognition training or semantic recognition training on artificial intelligence models is a common knowledge technology in related technical fields, so it will not be described in detail here.

In one embodiment, in response to the message in the second response belonging to the target information category, the processor 11 may determine that the second response meets the second condition. Alternatively, in response to the message in the second response not belonging to the target information category, the processor 11 may determine that the second response does not meet the second condition.

FIG. 3 is a schematic diagram of determining a target information type according to an embodiment of the present invention. Referring to FIG. 3 , the operation interface 31 can be presented on the first electronic device. The user can select one of multiple information categories (including 1. whale, 2. ink cartridge, 3. baby) provided in the operation interface 31 as the target information category through the second user operation. For example, assuming that the user selects "1. Whale" as the target information category in the operation interface 31 through the second user operation, the subsequent second response must contain an image that matches this target information category (i.e., whale). Passed the second stage of verification.

FIG. 4 is a schematic diagram of a message upload interface according to an embodiment of the present invention. Referring to Figure 4, the prompt message (ie, the second prompt message) 41 can be used to inform the current user of the second electronic device (for example, the second user or the first user currently borrowing the second electronic device for identity verification) to upload Message used for advanced verification (i.e. second message).

Taking Figure 3 as an example, assuming that the target information category selected by the user through the second user operation is "1. Whale", the user must upload a tape by pressing the upload button 401 in the prompt message 41. A picture with a whale pattern (that is, the message in the second response belongs to the target information category) can complete the two-step verification for the first user. On the contrary, if the image uploaded by the user does not have a whale pattern (that is, the message in the second response does not belong to the target information category), the two-step verification for the first user will be judged as failed.

In one embodiment, in response to the second response meeting the second condition, the processor 11 may determine that the user currently operating the first electronic device has passed the two-step verification (ie, second-stage verification). That is to say, when the user currently operating the first electronic device has successively passed the first stage verification and the second stage verification in the two-step verification, the processor 11 can determine that the user currently operating the first electronic device should For the first user himself. Therefore, the processor 11 can grant the current user of the first electronic device certain system permissions that match the first user, such as logging in to the first user's account on certain websites or operating a specific application.

On the other hand, in response to the second response not meeting the second condition, the processor 11 may determine that the user currently operating the first electronic device has failed the two-step verification (ie, second-stage verification), and does not grant the user currently operating the first electronic device The user of the device matches the system permissions of the first user to prevent the first user's account from being stolen.

FIG. 5 is a schematic diagram of the usage environment of the two-stage verification system according to an embodiment of the present invention. Referring to FIG. 5 , the server 51 may include the two-stage verification system 10 of FIG. 1 . The server 51, the electronic device 52 and the auxiliary verification device 53 can be connected through a network (such as the Internet).

In one embodiment, it is assumed that user A (i.e., the first user) carries the electronic device 52 (i.e., the first electronic device, such as a laptop computer, and its owner is user A) when going out but forgets Bring a smartphone (or user A’s smartphone is out of battery). At this time, if user A wants to use the electronic device 52 to perform certain functions that require identity verification, such as logging in to a specific website or application, user A can request the server 51 to execute the function for the user through the electronic device 52 A two-step verification.

After activating the two-step verification for user A, the server 51 can finally select the auxiliary verification device 53 (i.e., the second electronic device) based on the contact interaction information related to user A through the above-mentioned operations. ) to assist in the two-step verification of User A. In particular, the owner of the auxiliary verification device 53 is user B (ie, the second user).

In one embodiment, if user A can operate the electronic device 52 to pass the preliminary verification in the two-step verification, and user A or user B can further operate the auxiliary verification device 53 to pass the advanced verification in the two-step verification, then The server 51 can determine that the user currently operating the electronic device 52 has passed the two-step verification, and grant the user currently operating the electronic device 52 system permissions that match user A. On the contrary, if user A (or other users) fails to pass the preliminary verification in the two-step verification by operating the electronic device 52 , or user A (or other users) fails to pass the two-step verification by operating the auxiliary verification device 53 In the advanced verification, the server 51 may determine that the user currently operating the electronic device 52 has failed the two-step verification, and does not grant the system authority matching the user A to the user currently operating the electronic device 52 .

FIG. 6 is a flow chart of a two-step verification method according to an embodiment of the present invention. Please refer to Figure 6. In step S601, contact interaction information related to the first user is collected. In step S602, a two-step verification for the first user is initiated. In step S603, the first prompt message is presented via the first electronic device. In step S604, it is determined whether the first response of the first electronic device to the first prompt message meets the first condition. If the first response of the first electronic device to the first prompt message does not meet the first condition, in step S605, it is determined that the two-step verification fails and the two-step verification ends.

If the first response of the first electronic device to the first prompt message meets the first condition, in step S606, a second prompt message is presented via the second electronic device according to the contact interaction information. In particular, the owner bound to the second electronic device is not the first user. Next, in step S607, it is determined whether the second response of the second electronic device to the second prompt message meets the second condition. If the second response of the second electronic device to the second prompt message does not meet the second condition, in step S608, it is determined that the two-step verification fails and the two-step verification ends. In addition, if the second response of the second electronic device to the second prompt message meets the second condition, in step S609, it is determined that the user currently operating the first electronic device passes the two-step verification.

However, each step in Figure 6 has been described in detail above and will not be described again here. It is worth noting that each step in Figure 6 can be implemented as multiple program codes or circuits, and is not limited in this case. In addition, the method in Figure 6 can be used in conjunction with the above example embodiments or can be used alone, and is not limited in this case.

To sum up, compared with the traditional method when users perform two-step verification, they must prepare at least one electronic device belonging to the same user as an auxiliary verification. The two-step verification method and system proposed by the embodiment of the present invention , when the user does not have a smartphone at hand or the smartphone is out of battery, they can borrow auxiliary verification devices such as smartphones from familiar relatives and friends to help complete the two-step verification. In this way, it can bring more convenience in identity verification to users who forget to bring their mobile phones when they go out or when their mobile phones are out of battery, while meeting relevant security requirements.

Although this case has been invented as above with the embodiment, it is not used to limit this case. Anyone with ordinary knowledge in the technical field should be able to make some changes and modifications without departing from the spirit and scope of this case. Therefore, the protection of this case The scope shall be determined by the appended patent application scope.

10: Two-step verification system 11: Processor 12:Storage circuit 13:Input/output device 101:Contact interaction information 21: Contact list 31: Operation interface 41: Prompt message 401:Upload button 51:Server 52:Electronic devices 53: Auxiliary verification device S601~S609: steps

FIG. 1 is a schematic diagram of a two-step verification system according to an embodiment of the present invention. FIG. 2 is a schematic diagram of a contact list according to an embodiment of the present invention. FIG. 3 is a schematic diagram of determining a target information type according to an embodiment of the present invention. FIG. 4 is a schematic diagram of a message upload interface according to an embodiment of the present invention. FIG. 5 is a schematic diagram of the usage environment of the two-stage verification system according to an embodiment of the present invention. FIG. 6 is a flow chart of a two-step verification method according to an embodiment of the present invention.

S601~S609: steps

Claims (12)

A two-step verification method, including: Collect contact interaction information related to the first user; Initiate two-step verification for the first user; Present the first prompt message via the first electronic device; In response to the first response of the first electronic device to the first prompt message meeting the first condition, a second prompt message is presented through the second electronic device according to the contact interaction information, wherein the second electronic device is bound to The owner is not the first user; and In response to the second response of the second electronic device to the second prompt message meeting the second condition, it is determined that the user currently operating the first electronic device passes the two-step verification. The two-step verification method as described in request item 1 further includes: Determine whether the first response is correct based on the contact's interaction information; and In response to the first response being correct, it is determined that the first response meets the first condition. The two-step verification method as described in claim 1, wherein the owner bound to the second electronic device is a second user, and the second prompt is presented through the second electronic device based on the contact interaction information The message steps include: Present a contact list via the first electronic device based on the contact interaction information; receiving a first user operation via the first electronic device; and Determine the second user from the contact list based on the first user operation; and The second prompt message is sent to the second electronic device for display. The two-step verification method of claim 1, wherein the second prompt message includes a message upload interface, and the second response includes a message sent by the second electronic device through the message upload interface. The two-step verification method as described in request item 1 further includes: receiving a second user operation via the first electronic device; Determine a target information category from at least one information category based on the second user operation; After receiving the second response, identify whether the information in the second response belongs to the target information category through an artificial intelligence model; and In response to the message belonging to the target information category, it is determined that the second response meets the second condition. The two-step verification method as described in request item 1 further includes: In response to the first response not meeting the first condition or the second response not meeting the second condition, it is determined that the user currently operating the first electronic device has failed the two-step verification. A two-step verification system including: storage circuitry; and a processor coupled to the storage circuit, The processor is used to: Collect contact interaction information related to the first user and store the contact interaction information in the storage circuit; Initiate two-step verification for the first user; Present the first prompt message via the first electronic device; In response to the first response of the first electronic device to the first prompt message meeting the first condition, a second prompt message is presented through the second electronic device according to the contact interaction information, wherein the second electronic device is bound to The owner is not the first user; and In response to the second response of the second electronic device to the second prompt message meeting the second condition, it is determined that the user currently operating the first electronic device passes the two-step verification. The two-step verification system as described in claim 7, wherein the processor is further used to: Determine whether the first response is correct based on the contact's interaction information; and In response to the first response being correct, it is determined that the first response meets the first condition. The two-step verification system as described in claim 7, wherein the owner bound to the second electronic device is a second user, and the processor presents the contact information through the second electronic device based on the contact interaction information. The operations for the second prompt message include: Present a contact list via the first electronic device based on the contact interaction information; receiving a first user operation via the first electronic device; and Determine the second user from the contact list based on the first user operation; and The second prompt message is sent to the second electronic device for display. The two-step verification system of claim 7, wherein the second prompt message includes a message upload interface, and the second response includes a message sent by the second electronic device through the message upload interface. The two-step verification system as described in claim 7, wherein the processor is further used to: receiving a second user operation via the first electronic device; Determine a target information category from at least one information category based on the second user operation; After receiving the second response, identify whether the information in the second response belongs to the target information category through an artificial intelligence model; and In response to the message belonging to the target information category, it is determined that the second response meets the second condition. The two-step verification system as described in claim 7, wherein the processor is further used to: In response to the first response not meeting the first condition or the second response not meeting the second condition, it is determined that the user currently operating the first electronic device has failed the two-step verification.

Images