WO2007104243A1 - Système de gestion de la sécurité de comptes fondé sur le logiciel de messagerie instantanée, procédé correspondant - Google Patents

Système de gestion de la sécurité de comptes fondé sur le logiciel de messagerie instantanée, procédé correspondant Download PDF

Info

Publication number
WO2007104243A1
WO2007104243A1 PCT/CN2007/000754 CN2007000754W WO2007104243A1 WO 2007104243 A1 WO2007104243 A1 WO 2007104243A1 CN 2007000754 W CN2007000754 W CN 2007000754W WO 2007104243 A1 WO2007104243 A1 WO 2007104243A1
Authority
WO
WIPO (PCT)
Prior art keywords
client
account
strong binding
binding information
verification
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2007/000754
Other languages
English (en)
French (fr)
Inventor
Zhao Liu
Fan Wang
Xiaobo Shao
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to BRPI0708738A priority Critical patent/BRPI0708738B1/pt
Publication of WO2007104243A1 publication Critical patent/WO2007104243A1/zh
Priority to US12/194,292 priority patent/US8892690B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/04—Real-time or near real-time messaging, e.g. instant messaging [IM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security

Definitions

  • the present invention relates to the field of instant messaging, and in particular to an account security management system and method based on instant messaging. Background of the invention
  • Instant messenger ( mess ) tools can be used to communicate, entertain and access information. Since its development, it has been accepted and recognized by more and more netizens, and has gradually become an indispensable part of the lives of netizens. Instant messaging tools are widely used not only in the entertainment and leisure life of users, but also in the work and life of users.
  • Existing instant messaging tools generally provide services such as "password protection system”, "password appeal system,” and so on to the user to retrieve stolen or lost accounts.
  • password prompt question and answer are required. , so that when the user forgets the password, the password is retrieved by answering the password prompt question and answer.
  • the "Password Protection Data” has a low fill rate, it is easy to forget; and when the user fills in the password prompt question and answer, it is a plaintext transmission, which is easily intercepted by the Trojan.
  • users are generally only allowed to fill in a question and answer. It is not possible to determine the number and depth of questions to be answered based on the strength of the security level. Therefore, it is sometimes difficult to retrieve stolen or lost accounts.
  • the technical problem to be solved by the present invention is to provide an account security management system and method based on instant communication in order to overcome the above disadvantages of the prior art.
  • An account security management system based on instant communication including a processing server and a database server, wherein
  • the processing server is configured to receive the registration of the strong binding information of the account by the client, transmit the registered strong binding information to the database server, and invoke the service request from the database server when accepting the service request of the client.
  • the strong binding information of the level, and the verification information is sent to the client to verify the validity of the identity of the client user;
  • a database server is used to store strong binding information corresponding to each account.
  • the processing server includes a registration module and a verification module.
  • a registration module configured to receive a registration of strong binding information of the client by the client, and transmit the strong binding information of the registration to the database server;
  • the verification module is configured to accept the service request of the client, and invoke the strong binding information of the corresponding level of the service request from the database server, and generate verification information to send to the client to verify the validity of the identity of the client user.
  • the verification information is delivered in the form of a picture between the processing server and the client.
  • the registration module transmits to the registered strong binding information of the database server as encrypted data.
  • the strong binding information in the database server includes: a password corresponding to each account, a question and an answer selected by the account owner, and a correspondence with a security level.
  • the face certificate module increases the security level and verifies the client again.
  • a method for account security management based on instant messaging comprising:
  • the client registers the strong binding information corresponding to the account with the processing server, and the processing server sends the registered strong binding information to the database server;
  • the processing server transmits the verification information to the client, and receives the verification answer from the client;
  • the processing server determines whether to receive the service request of the client according to the verification answer.
  • the step (a) further includes the step of the processing server encrypting the strong binding information registered by the client.
  • the strong binding information in the database server includes: a password corresponding to each account, a question and an answer selected by the account owner, and a correspondence with a security level.
  • the step (c) includes:
  • step (c2) randomly selecting a predetermined number of questions, correct answers, and alternative answers corresponding to the security level according to the security level corresponding to the service requested by the client, and generating the write lr certificate information in the form of a picture.
  • the step (e) includes:
  • step (e2) If the two in the step (el) are the same, it means that the client is a legitimate user and receives the service request; if the two are different in the step (el), the face module adds a security level, and the random selection corresponds to the A predetermined number of questions, correct answers, and preliminary answers for the added security level, generate verification information in the form of pictures, and proceed to step (d).
  • the service request includes at least a password corresponding to the request to modify the account.
  • the system and method for implementing instant messaging-based account security management of the present invention have the following beneficial effects: through the setting of strong binding information corresponding to each instant messaging account, and in the verification process, the verification information is randomly processed by the processing server Generated, and associated with the security level of the service request, thus increasing the threshold for the hacker to modify the password or sensitive information of the stolen account; meanwhile, because the problem in the verification includes the correct answer, reducing the user's password recovery
  • the memory threshold of the time and all the strong binding information is transmitted in encrypted form, and the verification information is a picture transmission, not a plaintext transmission, which ensures that the verification information is not intercepted by the Trojan horse program.
  • FIG. 1 is an exemplary schematic diagram of an account security management system based on instant messaging according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram showing a flow exemplary use case of an account security management method based on instant communication according to an embodiment of the present invention. Mode for carrying out the invention
  • the invention provides an account security management system and method based on instant communication.
  • the instant messaging account is strongly bound to the information closely related to the owner of the account, so that the user's identity is verified when the user modifies the account password or operates other sensitive information.
  • FIG. 1 it is an exemplary schematic diagram of an account security management system based on instant communication in an embodiment of the present invention. It can be seen that the system mainly includes: database server 3, processing server 2 and multiple clients 1 (only one is shown in the figure).
  • the client 1 is connected to the processing server 2 through the network, and the client software of the instant communication tool is installed on the client 1. Users can use it to implement account application, instant messaging services (such as chat games, etc.), account retrieval and appeals.
  • the processing server 2 may specifically include a registration module 20 for receiving the registration, and the registration module 20 is specifically configured to receive the registration of the strong binding information from the account of the client 1, the strong binding information may include: The password corresponding to the account number, the question and answer selected by the account owner, and the correspondence with the security level.
  • the processing server 1 may also include a verification module 21.
  • the verification module 21 calls the strong binding information of the corresponding level of the service request, generates verification information, and sends the generated verification information to the client 1 to verify the identity of the client 1 user. Legitimacy.
  • the verification module 21 can be used to accept the user's modification request for the account password, the account retrieval and the appeal request.
  • the verification module 21 increases the security level to the client. 1 Perform verification again; after verifying the legitimacy of the user request, pass the request of the legitimate user to the registration module 20 to change the corresponding data or obtain the corresponding data, or directly reject the service request.
  • the database server 3 includes (or is connected to) a strong binding information database, and the strong binding information database stores strong binding information of users corresponding to each account.
  • the data between the database server 3 and the processing server 2 is preferably encrypted data, and the database service The server 3 can distribute the account successfully applied by the user to the client 1.
  • FIG. 2 it is an exemplary schematic diagram of a flow use case of an instant messaging-based account security management method according to an embodiment of the present invention. It includes the steps of registration and insurance.
  • the processing server 2 requests them to perform strong binding information registration; when the new user applies for an account, the processing server 2 In the process of applying for an account, the user is required to actively fill in the strong binding information.
  • the processing server 2 also reminds the user to register the strong binding information (i.e., supplementary registration) in the form of a security warning, and enters the registration process (step S20).
  • Strong binding information includes questions and answers that are closely related to the account user itself, such as age, height, favorite things, birthplace, graduation school, and so on.
  • the processing server 2 first collects these questions from the user in two ways. One way is a fixed number of problems given by the processing server 2 by default, which are obtained from the database server 3 in the form of pictures or encrypted data, which ensures that the Trojan is not easily intercepted during transmission. The second way is that the problem itself is given by the account owner according to his or her own situation. If the user thinks that the problem given by the processing server 2 is not easy to answer or is not easy to remember, it is possible to set the privacy question and give the answer. When the owner sets the question and answer, the answer is submitted in step S22, and the processing server 2 encrypts the question and answer and transmits it to the database server 3. In step S23, the database server 3 holds these strong binding information.
  • the processing server 2 When a strong binding information is successfully received by the processing server 2, it will become the only authentication basis for the user to operate sensitive data in the future.
  • the processing server 2 receives a service request sent from the client 1 (in this case, the account user is not necessarily a legitimate user) (such as modifying the account password request, making an online payment request, or sensitive data to the other account)
  • the processing server 2 enters the verification process (step S24), The legality of the user is required to be authenticated, and the strong binding information registered in advance by the user is verified.
  • the verification module 21 acquires the account number from the database server 3, and transmits the corresponding strong binding information, that is, the stored questions and answers, the stored questions and answers to the verification module 21 in the form of pictures.
  • the database server 3 generates a plurality of alternative answers according to the correct answer to the question corresponding to the account, and the candidate answers are very close to the correct answer and may have a certain interference effect.
  • step S25 the processing server 1 randomly selects a predetermined number of questions, correct answers, and alternative answers corresponding to the security level according to the corresponding security level of the service requested by the client 1, and generates a picture form. verify message. And send the verification information to client 1.
  • the transmission of pictures and the random display order are the key to ensuring that the questions and answers are not easily intercepted by Trojans.
  • the security level is divided according to the extent to which the service request of the client 1 may potentially bring losses to the account owner.
  • the system may determine that the security level is the strongest, then the processing server 1 will query the user for all the registered questions; if the user's operation is determined to be weak, then Processing server 2 may only ask a few more questions.
  • step S26 the client 1 responds based on the question in the received verification information, and submits the verification answer to the processing server 2.
  • step S27 the verification module 21 of the processing server 2 judges whether the verification answer from the client 1 is correct based on the correct answer from the database server 3; if it is correct, it receives the service request of the client 1.
  • the service request is sent to the registration module 20 or the database server 3 according to the type of the service request. For example, when the service request of the client 1 is a request to modify the password, the verification module 21 sends the modified password request of the client 1 to the registration module 20 to perform a process of password modification.
  • the verification module 21 increases the security level, randomly selects more questions and answers (and alternatives), and generates verification information in the form of a picture and sends it to the client 1. Repeat the above process. After completing the predetermined number of verifications, if from If the verification answer of the client 1 is still incorrect, the verification module 21 of the processing server 2 considers the user to be an illegal user and rejects the service request.
  • strong binding is performed by information in which an instant messaging account is closely related to its owner.
  • the account user performs password or sensitive information modification, the user's identity is verified to ensure account security and avoid illegal users.
  • all questions and answers (including alternative answers) in all strongly bound information are transmitted in the form of pictures; and in the verification process, the questions to be answered are randomly selected by the processing server, the problem and The order in which the alternative answers are displayed is also randomly generated; and the processing server divides the security level according to the client's business request. The strength of the security level determines the number and depth of questions to be answered.
  • the threshold for the hacker to modify the stolen account password or sensitive information is improved; at the same time, because the problem in the verification includes the correct answer, the user is reduced when the password is retrieved.
  • Memory threshold Because the application information is transmitted by encryption or picture, the verification information is picture transmission, not clear text transmission, ensuring that the verification information will not be intercepted by the Trojan horse program.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Description

一种基于即时通信的帐号安全管理系统及方法
技术领域
本发明涉及即时通信领域， 具体来说， 涉及一种基于即时通信的帐 号安全管理系统及方法。 发明背景
网络即时通信（ Instant messenger , ΙΜ )工具可以用来交流、 娱乐及 获取资讯， 其发展到现在， 已经被越来越多的网民所接受与认可， 渐渐 成为广大网民生活中不可缺少的一部分。 即时通信工具不但广泛应用在 用户的娱乐休闲生活中， 而且也逐渐应用在广大用户的工作生活中。
随着即时通信用户数量的迅速增长 , 即时通信工具的安全问题也日 益严重， 并引起大众的高度重视。 其中， 通过即时通信工具传播病毒、 用户帐号被盗等安全事故屡见不鲜。 帐号被盗不仅影响了被盗用户的基 本即时通信， 严重时， 还会造成出现用户丟失虚拟财产， 或用户的个人 隐私被泄露等问题。
现有的即时通信工具一般提供诸如 "密码保护系统"、 "密码申诉系 统，， 等服务给用户用来找回被盗或遗失的帐号。 当用户在注册帐号时， 需要填写密码提示问题和答案， 以便当用户忘记密码时， 通过回答密码 提示问题和答案找回密码。
但是由于 "密码保护资料" 填写率低， 容易忘记; 且用户在填写密 码提示问题和答案时， 都是明文传输， 很容易被木马明文截获。 另外， 一般只允许用户填写一个问题和答案， 不能够根据安全等级的强弱来决 定了需回答的问题的数量和深度， 故有时很难找回被盗或遗失的帐号。
不仅与此， "密码申诉"还存在证实率低等自身缺陷从而造成用户申 诉门槛高， 申诉成功的几率比较低。
而且由于现有的技术中， 帐号本身和拥有者身份绑定性差、 一个密 码对应多项业务， 使盗号者容易将被盗帐号易主， 更容易加大被盗者的 损失。 发明内容 '
有鉴于此， 本发明所要解决的技术问题在于， 为克服现有技术的上 述缺点， 提供一种涉及一种基于即时通信的帐号安全管理系统及方法。
本发明为解决其技术问题所采用的技术方案为：
一种基于即时通信的帐号安全管理系统， 包括处理服务器和数据库 服务器， 其中
所述处理服务器， 用于接收客户端对帐号的强绑定信息的登记， 将 该登记的强绑定信息传送给数据库服务器， 并在接受客户端的业务请求 时， 从数据库服务器调用该业务请求对应等级的强绑定信息， 生成验证 信息发送给客户端， 以验证客户端使用者身份的合法性；
数据库服务器， 用于存储每一帐号所对应的强绑定信息。
所述处理服务器包括登记模块及验证模块，
登记模块， 用于接收客户端对帐号的强绑定信息的登记， 并将该登 记的强绑定信息传送给数据库服务器；
验证模块， 用于接受客户端的业务请求， 并从数据库服务器调用该 业务请求对应等级的强绑定信息， 生成验证信息发送给客户端， 以验证 客户端使用者身份的合法性。
所述验证信息在处理服务器和客户端之间以图片的形式传递。
所述登记模块传送给将数据库服务器的所述登记的强绑定信息为加 密的数据。 所述的数据库服务器中的强绑定信息包括：每一帐号所对应的密码、 帐号所有者选择的问题及答案以及与安全等级的对应关系。
当客户端的验证答案与强绑定信息不符时， 所述臉证模块增加安全 等级， 对客户端再次验证。
一种基于即时通信的帐号安全管理的方法， 包括：
( a )客户端向处理服务器登记其帐号所对应的强绑定信息， 处理服 务器将该登记的强绑定信息发送给数据库服务器；
( b )处理服务器接收来自客户端的业务请求；
( c )处理服务器调用存储于数据库服务器中对应于该客户端帐号的 强绑定信息， 并根据业务请求的安全等级， 生成验证信息；
( d )处理服务器将该验证信息传送给客户端， 并接收来自客户端的 验证答案；
( e )处理服务器根据该验证答案，判断是否接收该客户端的业务请 求。
所述步骤（a )进一步包括， 处理服务器将所述客户端登记的强绑定 信息进行加密的步骤。
所述的数据库服务器中的强绑定信息包括：每一帐号所对应的密码、 帐号所有者选择的问题及答案、 及与安全等级的对应关系。
所述步骤（ c ) 包括：
( cl )从数据库服务器中获取与该帐号对应的强绑定信息， 所述强 绑定信息中包括有登记的问题、 正确答案及备选答案， 该强绑定信息为 图片形式；
( c2 )根据客户端所请求的业务所对应的安全等级， 随机选择对应 于该安全等级的预定数量的问题、 正确答案及备选答案， 生成图片形式 的写 lr证信息。 所述步骤（ e ) 包括：
( el )判断来自客户端的验证答案与该帐号中预登记的强绑定信息 中的答案是否相同；
( e2 )如果步骤（el ) 中两者相同， 则表示该客户端为合法用户， 接收该业务请求； 如果步骤（el ) 中两者不同， 则臉证模块增加安全等 级， 随机选择对应于该增加的安全等级的预定数量的问题、 正确答案及 备先答案， 生成图片形式的验证信息， 并转入步骤（d )。
所述业务请求至少包括有请求修改该帐号所对应的密码。
实施本发明的基于即时通信的帐号安全管理的系统及方法， 具有如 下有益效果： 通过每一即时通信帐号所对应的强绑定信息的设定， 且在 验证流程中， 验证信息由处理服务器随机生成， 并与业务请求的安全等 级相关联， 这样， 提高了盗号者修改被盗帐号密码或敏感信息的门槛； 同时， 因为在验证时的问题中， 包含了正确的答案， 降低用户找回密码 时的记忆门槛； 且所有强绑定信息以加密形式传输的， 验证信息为图片 传输， 不是明文传输， 可以确保验证信息不会被木马程序所截获。 附图简要说明
图 1是本发明实施例的基于即时通信的帐号安全管理系统的示范性 示意图；
图 2是本发明实施例的基于即时通信的帐号安全管理方法的流程示 范性用例示意图。 实施本发明的方式
为使本发明的目的、 技术方案和优点表达得更加清楚明白， 下面结 合附图及具体实施例对本发明再作进一步详细的说明。 本发明提出一种基于即时通信的帐号安全管理系统及方法。 将即时 通信帐号与该帐号的拥有者密切相关的信息强绑定起来， 以便在使用者 修改帐号密码、 或对其他敏感信息进行操作时对该帐号使用者的身份进 行验证。
如图 1所示， 是本发明实施例中基于即时通信的帐号安全管理系统 的示范性示意图。 从中可以看出， 该系统主要包括有： 数据库服务器 3、 处理服务器 2及多个客户端 1 (图中只画出一个）。
其中， 客户端 1通过网络与处理服务器 2连接， 客户端 1上安装有 即时通信工具的客户端软件。 使用者可以藉之实现帐号申请、 即时通信 服务（如聊天游戏等）、 帐号取回与申诉等功能。 此处， 处理服务器 2 具体可以包括用于接收登记的登记模块 20, 登记模块 20具体用于接收 来自客户端 1的帐号的强绑定信息的登记， 所述强绑定信息可以包括： 每一帐号所对应的密码、 帐号所有者选择的问题及答案以及与安全等级 的对应关系等等。
处理服务器 1还可以包括验证模块 21。验证模块 21在接受客户端 1 的业务请求时，调用该业务请求对应等级的强绑定信息，生成验证信息， 并将所生成的验证信息发送给客户端 1 , 以验证客户端 1使用者身份的 合法性。 例如， 验证模块 21 可以用于接受使用者对帐号密码的修改请 求、帐号取回与申诉请求， 当客户端 1的验证答案与强绑定信息不符时， 验证模块 21增加安全等级， 对客户端 1再次进行验证； 在验证该使用 者请求的合法性之后， 将合法用户的请求传给登记模块 20 更改相应资 料或获取相应资料， 或直接拒绝该业务请求。
数据库服务器 3包含（或连接有） 强绑定信息数据库， 强绑定信息 数据库中存储有与每一帐号相对应的用户的强绑定信息。 所述数据库服 务器 3与处理服务器 2之间的数据优选是经过加密的数据， 且数据库服 务器 3可以将用户所申请成功的帐号分发给客户端 1。
如图 2所示， 是本发明实施例的基于即时通信的帐号安全管理方法 的流程用例示范性示意图。 其包括登记和险证的步驟。
在登记步骤中， 当新用户进行帐号申请， 或者未登记强绑定信息的 老用户使用该帐号时，处理服务器 2均会要求他们进行强绑定信息登记； 当新用户申请帐号时， 处理服务器 2会在申请帐号过程中要求该用户主 动填写其强绑定信息。 当未曾登记过强绑定信息的老用户登录后， 处理 服务器 2也会通过安全警告的形式来提醒用户登记强绑定信息（即补充 登记）， 此时进入登记流程（步驟 S20 )。
强绑定信息中包括有与帐号用户自身密切相关的问题与答案，例如， 年龄、 身高、 最喜欢的事物、 籍贯、 毕业学校等等。 在步骤 S21中， 当 用户进入帐号强绑定信息登记流程后， 处理服务器 2首先会通过两种方 式向用户收集这些问题。 一种方式是由处理服务器 2默认给出的固定数 量的问题， 这些问题是以图片方式或加密数据的形式从数据库服务器 3 获得， 这样可以确保在传输过程中不会轻易被木马截获。 第二种方式是 问题本身是由帐号拥有者根据自身情况给出的。 如果用户认为处理服务 器 2默认给出的问题不易回答或不容易记忆时， 就可以自己设定隐私问 题， 并给出答案。 当拥有者设定好问题和答案后， 在步骤 S22中进行答 案提交， 且处理服务器 2会将该问题和答案进行加密， 并传输给数据库 服务器 3。 在步骤 S23中， 数据库服务器 3保存这些强绑定信息。
当一个强绑定信息被处理服务器 2成功接收后， 它将成为今后该用 户操作敏感数据唯一的身份验证依据。 在验证步驟中， 当处理服务器 2 接收到来自客户端 1 (此时帐号用户不一定是合法用户）所发送业务请 求（诸如， 修改帐号密码请求、 进行网上支付请求或对其他的该帐号敏 感数据进行操作的请求）时，处理服务器 2就会进入验证流程（步骤 S24 ), 需要臉证该用户的合法性， 对该用户事先登记的强绑定信息进行验证。 验证模块 21向数据库服务器 3获取该帐号， 把对应的强绑定信息， 即所存储的问题和答案、 该存储的问题和答案以图片的形式传输给验证 模块 21。数据库服务器 3根据该帐号所对应的问题的正确答案生成若干 备选答案， 所述备选答案与正确答案非常接近， 会起到一定干扰作用。
随后， 在步驟 S25中， 处理服务器 1会根据客户端 1所请求的业务 的所对应的安全等级， 随机选择对应于该安全等级的预定数量的问题、 正确答案及备选答案， 生成图片形式的验证信息。 并将该验证信息发送 给客户端 1。 其中， 图片形式的传输和随机的显示顺序是保证问题和答 案不会轻易被木马截获的关键。 其中， 该安全等级对应于客户端 1的业 务请求潜在的可能给帐号拥有者带来损失的程度来划分的。 譬如， 若使 用者试图更改帐号密码， 将可能会被系统判定为安全等级最强， 则处理 服务器 1会对使用者询问登记过的所有问题； 若使用者的操作被判定为 等级较弱， 则处理服务器 2可能只询问较少的几条问题。
在步骤 S26中， 客户端 1根据所接收到的验证信息中的问题进行回 答， 并将验证答案提交给处理服务器 2。 在步骤 S27 中， 处理服务器 2 的验证模块 21根据来自数据库服务器 3 中的正确答案判断该来自客户 端 1的验证答案是否正确； 如果正确， 则接收客户端 1的业务请求。 并 根据业务请求的类型， 将该业务请求发送给登记模块 20 或数据库服务 器 3。 例如， 当客户端 1的业务请求为修改密码的请求， 则该验证模块 21将客户端 1的修改密码请求发送给登记模块 20 , 进行密码修改的流 程。
如果来自客户端 1的验证答案不正确。则验证模块 21提高安全等级， 重新随机选择更多的问题和答案 （及备选项）， 生成图片形式的验证信 息发送给客户端 1。 重复上述流程。 在完成预定次数验证后， 如果来自 客户端 1的验证答案仍然是错误的， 则处理服务器 2的验证模块 21认 为该用户为非法用户， 拒绝该次业务请求。
在本发明中， 通过将某一即时通信帐号与其拥用者密切相关的信息 进行强绑定。 当帐号使用者进行密码或敏感信息修改时对使用者的身份 进行验证， 以保证帐号安全性， 避免非法用户的使用。
在本发明中， 所有强绑定信息中的所有问题和答案（包括备选答案 ) 都是以图片形式传输的； 且在验证流程中， 需要回答的问题是被处理服 务器随机选中的， 问题和备选答案的显示顺序也是随机生成的； 且处理 服务器会根据客户端的业务请求划分安全等级。 安全等级的强弱， 决定 了需回答的问题的数量和深度也不同。
这样， 因为帐号和拥有者身份强绑定， 提高了盗号者修改被盗帐号 密码或敏感信息的门槛； 同时， 因为在验证时的问题中， 包含了正确的 答案， 降低用户找回密码时的记忆门槛； 因为申请信息是通过加密或图 片传输， 验证信息为图片传输， 不是明文传输， 确保验证信息不会被木 马程序所截获。
显然， 本领域的技术人员可以对本发明进行各种改动和变型而不脱 离本发明的精神和范围。 这样， 倘若本发明的这些修改和变型属于本发 明权利要求及其等同技术的范围之内， 则本发明也意图包含这些改动和 变型在内。

Claims

权利要求书
1、 一种基于即时通信的帐号安全管理系统， 其特征在于， 包括处理 服务器和数据库服务器， 其中
所述处理服务器， 用于接收客户端对帐号的强绑定信息的登记， 将 该登记的强绑定信息传送给数据库服务器， 并在接受客户端的业务请求 时， 从数据库服务器调用该业务请求对应等级的强绑定信息， 生成验证 信息发送给客户端， 以验证客户端使用者身份的合法性；
数据库服务器， 用于存储每一帐号所对应的强绑定信息。
2、根据权利要求 1所述的基于即时通信的帐号安全管理系统，其特 征在于， 所述处理服务器包括登记模块及验证模块，
登记模块， 用于接收客户端对帐号的强绑定信息的登记， 并将该登 记的强绑定信息传送给数据库服务器；
验证模块， 用于接受客户端的业务请求， 并从数据库服务器调用该 业务请求对应等级的强绑定信息， 生成验证信息发送给客户端， 以验证 客户端使用者身份的合法性。
3、根据权利要求 1所述的基于即时通信的帐号安全管理系统，其特 征在于，
所述猃证信息以图片的形式呈现给客户端。
4、如权利要求 2所述的基于即时通信的帐号安全管理系统，其特征 在于， 所述登记模块传送给将数据库服务器的所述登记的强绑定信息为 加密的数据。
5、如权利要求 2所述的基于即时通信的帐号安全管理系统，其特征 在于， 所述的数据库服务器中的强绑定信息包括： 每一帐号所对应的密 码、 帐号所有者选择的问题及答案以及与安全等级的对应关系。
6、如权利要求 5所述的基于即时通信的帐号安全管理系统，其特征 在于， 当客户端的验证答案与强绑定信息不符时， 所述验证模块增加安 全等级， 对客户端再次验证。
7、 一种基于即时通信的帐号安全管理的方法， 其特征在于， 包括：
( a )客户端向处理服务器登记其帐号所对应的强绑定信息， 处理服 务器将该登记的强绑定信息发送给数据库服务器；
( b )处理服务器接收来自客户端的业务请求；
( c )处理服务器调用存储于数据库服务器中对应于该客户端帐号的 强绑定信息， 并根据业务请求的安全等级， 生成验证信息；
( d )处理服务器将该验证信息传送给客户端，并接收来自客户端的 验证答案；
( e )处理服务器根据该验证答案， 判断是否接收该客户端的业务请 求。
8、如权利要求 7所述的基于即时通信的帐号安全管理的方法，其特 征在于， 所述步骤（a )进一步包括， 处理服务器将所述客户端登记的强 绑定信息进行加密的步骤。
9、如权利要求 7所述的基于即时通信的帐号安全管理的方法，其特 征在于， 所述的数据库服务器中的强绑定信息包括： 每一帐号所对应的 密码、 帐号所有者选择的问题及答案、 及与安全等级的对应关系。
10、 如权利要求 9所述的基于即时通信帐号安全管理的方法， 其特 征在于， 所述步驟 ( c ) 包括：
( cl )从数据库服务器中获取与该帐号对应的强绑定信息， 所述强 绑定信息中包括有登记的问题、 正确答案及备选答案， 该强绑定信息为 图片形式；
( c2 )根据客户端所请求的业务所对应的安全等级， 随机选择对应 于该安全等级的预定数量的问题、 正确答案及备选答案， 生成图片形式 的驗证信息。
11、如权利要求 10所述的基于即时通信帐号安全管理的方法，其特 征在于， 所述步驟（e ) 包括：
( el )判断来自客户端的验证答案与该帐号中预登记的强绑定信息 中的答案是否相同；
( e2 )如果步骤（el ) 中两者相同， 则表示该客户端为合法用户， 接收该业务请求； 如果步骤（el ) 中两者不同， 则验证模块增加安全等 级， 随机选择对应于该增加的安全等级的预定数量的问题、 正确答案及 备先答案， 生成图片形式的验证信息， 并转入步骤（d )。
12、如权利要求 7-11任一项所述的基于即时通信帐号安全管理的方 法， 其特征在于， 所述业务请求至少包括有请求修改该帐号所对应的密 码。 .
PCT/CN2007/000754 2006-03-10 2007-03-08 Système de gestion de la sécurité de comptes fondé sur le logiciel de messagerie instantanée, procédé correspondant Ceased WO2007104243A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
BRPI0708738A BRPI0708738B1 (pt) 2006-03-10 2007-03-08 sistema e método para gerenciamento de conta de mensagens instantâneas
US12/194,292 US8892690B2 (en) 2006-03-10 2008-08-19 System and method for managing account of instant messenger

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200610034329.5 2006-03-10
CNB2006100343295A CN100556042C (zh) 2006-03-10 2006-03-10 一种基于即时通信的帐号安全管理系统及方法

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/194,292 Continuation US8892690B2 (en) 2006-03-10 2008-08-19 System and method for managing account of instant messenger

Publications (1)

Publication Number Publication Date
WO2007104243A1 true WO2007104243A1 (fr) 2007-09-20

Family

ID=38509047

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2007/000754 Ceased WO2007104243A1 (fr) 2006-03-10 2007-03-08 Système de gestion de la sécurité de comptes fondé sur le logiciel de messagerie instantanée, procédé correspondant

Country Status (6)

Country Link
US (1) US8892690B2 (zh)
CN (1) CN100556042C (zh)
BR (1) BRPI0708738B1 (zh)
MY (1) MY180568A (zh)
RU (1) RU2402882C2 (zh)
WO (1) WO2007104243A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2787304C1 (ru) * 2022-04-18 2023-01-09 федеральное государственное бюджетное образовательное учреждение высшего образования "Ставропольский государственный аграрный университет" Стенд микроконтроллерный для изучения и исследования алгоритмов передачи данных от беспроводных датчиков

Families Citing this family (66)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110078779A1 (en) * 2009-09-25 2011-03-31 Song Liu Anonymous Preservation of a Relationship and Its Application in Account System Management
WO2011066666A1 (es) * 2009-12-03 2011-06-09 Juan Carlos Gonzalez Pellegrini Proceso de autovalidación de identidad, que puede ser usado en ambientes informáticos o en la vida real
CN102291369A (zh) * 2010-06-21 2011-12-21 上海薄荷信息科技有限公司 一种确认垃圾信息设置的控制方法以及相应的控制装置
CN102073810B (zh) * 2010-12-06 2013-01-23 上海合合信息科技发展有限公司 输入法软件中集成账户管理功能的方法
US8572194B2 (en) * 2011-06-10 2013-10-29 Microsoft Corporation Selective linking of message accounts
CN102255913A (zh) * 2011-07-14 2011-11-23 北京百度网讯科技有限公司 一种用于基于验证安全等级提供语音验证码的方法与设备
CN102316205A (zh) * 2011-08-19 2012-01-11 上海华勤通讯技术有限公司 手机密码系统、手机及手机安全保护方法
CN102957682A (zh) * 2011-08-30 2013-03-06 北京百度网讯科技有限公司 一种用于基于验证安全等级提供图片验证码的方法与设备
US11115415B2 (en) * 2011-09-13 2021-09-07 Stefano Foresti Method and system to capture and find information and relationships
CN103368928B (zh) * 2012-04-11 2018-04-27 富泰华工业（深圳）有限公司 帐号密码重置系统及方法
CN103002139B (zh) * 2012-11-22 2015-01-14 广东欧珀移动通信有限公司 一种触屏终端的解锁方法
CN103929401B (zh) * 2013-01-11 2017-12-12 深圳市腾讯计算机系统有限公司 控制用户敏感信息修改的方法和系统
GB2526501A (en) 2013-03-01 2015-11-25 Redowl Analytics Inc Modeling social behavior
US20140250048A1 (en) 2013-03-01 2014-09-04 RedOwl Analytics, Inc. Analyzing behavior in light of social context
CN104065634B (zh) * 2013-05-07 2015-08-19 腾讯科技（深圳）有限公司 网络游戏盗号处理方法和系统
CN104144146B (zh) * 2013-05-10 2017-11-03 中国电信股份有限公司 一种访问网站的方法和系统
CN104184705B (zh) * 2013-05-23 2019-05-07 腾讯科技（深圳）有限公司 验证方法、装置、服务器、用户数据中心和系统
CN104348786B (zh) * 2013-07-29 2018-09-04 腾讯科技（深圳）有限公司 密码找回方法、装置和系统
CN104348809B (zh) * 2013-08-02 2018-09-04 深圳市腾讯计算机系统有限公司 网络安全监控方法及系统
CN103488947A (zh) * 2013-10-11 2014-01-01 北京金山网络科技有限公司 即时通信客户端盗号木马程序的识别方法及装置
CN104901925A (zh) * 2014-03-05 2015-09-09 中国移动通信集团北京有限公司 终端用户身份认证方法、装置、系统及终端设备
CN104917737B (zh) * 2014-03-14 2019-12-20 腾讯科技（深圳）有限公司 用户帐号的保护方法及装置
CN105323219B (zh) * 2014-07-01 2020-06-16 腾讯科技（深圳）有限公司 验证用户帐号身份信息的方法及装置
CN104202345A (zh) * 2014-09-28 2014-12-10 北京奇虎科技有限公司 验证码生成方法、装置及系统
US10068086B2 (en) 2014-09-29 2018-09-04 Yandex Europe Ag System and method of automatic password recovery for a service
RU2609085C2 (ru) * 2014-09-29 2017-01-30 Общество С Ограниченной Ответственностью "Яндекс" Способ автоматического восстановления пароля к сервису и компьютер, используемый в нем
CN104394170B (zh) * 2014-12-11 2018-05-25 大唐微电子技术有限公司 安全账户使用方法、安全装置、服务器及系统
CN105871784A (zh) * 2015-01-22 2016-08-17 阿里巴巴集团控股有限公司 信息变更处理方法及装置
US9748990B2 (en) 2015-02-09 2017-08-29 Huawei Technologies Co., Ltd. System and method for training signals for full-duplex communications systems
US9886572B2 (en) * 2015-03-05 2018-02-06 International Business Machines Corporation Lie vault
CN107113308A (zh) * 2015-05-06 2017-08-29 华为技术有限公司 鉴权方法和接入设备
CN106921626B (zh) * 2015-12-25 2020-03-31 阿里巴巴集团控股有限公司 一种用户注册方法及装置
CN106888201A (zh) * 2016-08-31 2017-06-23 阿里巴巴集团控股有限公司 一种校验方法及装置
CN106453257A (zh) * 2016-09-09 2017-02-22 北京小米移动软件有限公司 安全验证方法、装置、系统、终端设备和网络服务器
US10999296B2 (en) 2017-05-15 2021-05-04 Forcepoint, LLC Generating adaptive trust profiles using information derived from similarly situated organizations
US11888859B2 (en) 2017-05-15 2024-01-30 Forcepoint Llc Associating a security risk persona with a phase of a cyber kill chain
US10318729B2 (en) 2017-07-26 2019-06-11 Forcepoint, LLC Privacy protection during insider threat monitoring
US10803178B2 (en) 2017-10-31 2020-10-13 Forcepoint Llc Genericized data model to perform a security analytics operation
US11314787B2 (en) 2018-04-18 2022-04-26 Forcepoint, LLC Temporal resolution of an entity
US10949428B2 (en) 2018-07-12 2021-03-16 Forcepoint, LLC Constructing event distributions via a streaming scoring operation
US11755584B2 (en) 2018-07-12 2023-09-12 Forcepoint Llc Constructing distributions of interrelated event features
US11436512B2 (en) 2018-07-12 2022-09-06 Forcepoint, LLC Generating extracted features from an event
US11810012B2 (en) 2018-07-12 2023-11-07 Forcepoint Llc Identifying event distributions using interrelated events
US11025638B2 (en) * 2018-07-19 2021-06-01 Forcepoint, LLC System and method providing security friction for atypical resource access requests
US11811799B2 (en) 2018-08-31 2023-11-07 Forcepoint Llc Identifying security risks using distributions of characteristic features extracted from a plurality of events
US11025659B2 (en) 2018-10-23 2021-06-01 Forcepoint, LLC Security system using pseudonyms to anonymously identify entities and corresponding security risk related behaviors
US11171980B2 (en) 2018-11-02 2021-11-09 Forcepoint Llc Contagion risk detection, analysis and protection
US11223646B2 (en) 2020-01-22 2022-01-11 Forcepoint, LLC Using concerning behaviors when performing entity-based risk calculations
US11630901B2 (en) 2020-02-03 2023-04-18 Forcepoint Llc External trigger induced behavioral analyses
US11080109B1 (en) 2020-02-27 2021-08-03 Forcepoint Llc Dynamically reweighting distributions of event observations
US11429697B2 (en) 2020-03-02 2022-08-30 Forcepoint, LLC Eventually consistent entity resolution
US11836265B2 (en) 2020-03-02 2023-12-05 Forcepoint Llc Type-dependent event deduplication
US11080032B1 (en) 2020-03-31 2021-08-03 Forcepoint Llc Containerized infrastructure for deployment of microservices
US11568136B2 (en) 2020-04-15 2023-01-31 Forcepoint Llc Automatically constructing lexicons from unlabeled datasets
US12130908B2 (en) 2020-05-01 2024-10-29 Forcepoint Llc Progressive trigger data and detection model
US11516206B2 (en) 2020-05-01 2022-11-29 Forcepoint Llc Cybersecurity system having digital certificate reputation system
US11544390B2 (en) 2020-05-05 2023-01-03 Forcepoint Llc Method, system, and apparatus for probabilistic identification of encrypted files
US11895158B2 (en) 2020-05-19 2024-02-06 Forcepoint Llc Cybersecurity system having security policy visualization
US11770377B1 (en) * 2020-06-29 2023-09-26 Cyral Inc. Non-in line data monitoring and security services
US11704387B2 (en) 2020-08-28 2023-07-18 Forcepoint Llc Method and system for fuzzy matching and alias matching for streaming data sets
US11190589B1 (en) 2020-10-27 2021-11-30 Forcepoint, LLC System and method for efficient fingerprinting in cloud multitenant data loss prevention
CN113032762A (zh) * 2021-02-23 2021-06-25 北京焦耳科技有限公司 一种阅卷软件的登录密码设置方法、装置、存储介质及终端
CN113259319B (zh) * 2021-04-12 2023-05-12 杭州顶象科技有限公司 验证处理方法及系统
CN113535689B (zh) * 2021-08-02 2022-02-11 曜立科技(北京)有限公司 一种用于数字疗法的数据库建立管理系统
CN113888165A (zh) * 2021-10-04 2022-01-04 杭州复杂美科技有限公司 区块链的地址改造和身份认证方法、设备及储存介质
CN113922954A (zh) * 2021-10-04 2022-01-11 杭州复杂美科技有限公司 一种区块链私钥生成和找回方法、设备及储存介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5935248A (en) * 1995-10-19 1999-08-10 Fujitsu Limited Security level control apparatus and method for a network securing communications between parties without presetting the security level
US20030196108A1 (en) * 2002-04-12 2003-10-16 Kung Kenneth C. System and techniques to bind information objects to security labels
CN1599313A (zh) * 2004-08-01 2005-03-23 常志文 一种公开加密方式的口令动态加密输入方法
CN1601960A (zh) * 2004-10-26 2005-03-30 杭州恒生电子股份有限公司 手机银行系统的安全认证方法
CN1719767A (zh) * 2004-07-08 2006-01-11 腾讯科技（深圳）有限公司 一种基于即时通讯平台的网络存储方法及系统

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1180872A (zh) 1997-10-27 1998-05-06 余路 加密和自动验证银行票据的方法
US20030129574A1 (en) * 1999-12-30 2003-07-10 Cerego Llc, System, apparatus and method for maximizing effectiveness and efficiency of learning, retaining and retrieving knowledge and skills
US7231657B2 (en) * 2002-02-14 2007-06-12 American Management Systems, Inc. User authentication system and methods thereof
US7134015B2 (en) * 2003-01-16 2006-11-07 International Business Machines Corporation Security enhancements for pervasive devices
RU2237375C1 (ru) * 2003-03-06 2004-09-27 Кравченко Тимофей Эдуардович Способ защиты системы от несанкционированного доступа
US20040189441A1 (en) * 2003-03-24 2004-09-30 Kosmas Stergiou Apparatus and methods for verification and authentication employing voluntary attributes, knowledge management and databases
US7549170B2 (en) * 2003-04-30 2009-06-16 Microsoft Corporation System and method of inkblot authentication
US9191215B2 (en) * 2003-12-30 2015-11-17 Entrust, Inc. Method and apparatus for providing authentication using policy-controlled authentication articles and techniques
WO2006062998A2 (en) * 2004-12-07 2006-06-15 Farsheed Atef System and method for identity verification and management
US7200576B2 (en) * 2005-06-20 2007-04-03 Microsoft Corporation Secure online transactions using a captcha image as a watermark

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5935248A (en) * 1995-10-19 1999-08-10 Fujitsu Limited Security level control apparatus and method for a network securing communications between parties without presetting the security level
US20030196108A1 (en) * 2002-04-12 2003-10-16 Kung Kenneth C. System and techniques to bind information objects to security labels
CN1719767A (zh) * 2004-07-08 2006-01-11 腾讯科技（深圳）有限公司 一种基于即时通讯平台的网络存储方法及系统
CN1599313A (zh) * 2004-08-01 2005-03-23 常志文 一种公开加密方式的口令动态加密输入方法
CN1601960A (zh) * 2004-10-26 2005-03-30 杭州恒生电子股份有限公司 手机银行系统的安全认证方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2787304C1 (ru) * 2022-04-18 2023-01-09 федеральное государственное бюджетное образовательное учреждение высшего образования "Ставропольский государственный аграрный университет" Стенд микроконтроллерный для изучения и исследования алгоритмов передачи данных от беспроводных датчиков

Also Published As

Publication number Publication date
US20090006544A1 (en) 2009-01-01
RU2008136311A (ru) 2010-04-20
BRPI0708738B1 (pt) 2019-08-27
US8892690B2 (en) 2014-11-18
BRPI0708738A2 (pt) 2011-06-14
CN100556042C (zh) 2009-10-28
MY180568A (en) 2020-12-02
CN101035116A (zh) 2007-09-12
RU2402882C2 (ru) 2010-10-27

Similar Documents

Publication Publication Date Title
WO2007104243A1 (fr) Système de gestion de la sécurité de comptes fondé sur le logiciel de messagerie instantanée, procédé correspondant
US8627424B1 (en) Device bound OTP generation
AU2013272182B2 (en) Enterprise triggered 2CHK association
US8060916B2 (en) System and method for website authentication using a shared secret
CN106612180B (zh) 实现会话标识同步的方法及装置
US20170353442A1 (en) Proximity-based authentication
US20050021975A1 (en) Proxy based adaptive two factor authentication having automated enrollment
CN100574511C (zh) 一种移动终端通讯中对端身份确认的方法及系统
CN104202162B (zh) 一种基于手机登录的系统及登录方法
DK2414983T3 (en) Secure computer system
KR20180026508A (ko) 생체 특징에 기초한 보안 검증 방법, 클라이언트 단말, 및 서버
TW201741922A (zh) 一種基於生物特徵的安全認證方法及裝置
CN103119975B (zh) 用户账户恢复
CN111949959B (zh) Oauth协议中的授权认证方法及装置
JPH05333775A (ja) ユーザ認証システム
CN105978994A (zh) 一种面向Web系统的登录方法
JP4513271B2 (ja) アクセス制御装置および方法
CN112383401B (zh) 一种提供身份鉴别服务的用户名生成方法及系统
CN118214586A (zh) 一种身份认证方法、系统、设备及存储介质
CN109743338A (zh) 一种自动登陆的验证方法、系统、服务器及可读存储介质
CN109587683B (zh) 短信防监听的方法及系统、应用程序和终端信息数据库
KR101523629B1 (ko) 로그인 인증 장치, 방법 및 이를 저장한 기록 매체
CN114500031B (zh) 基于单点登录获取bi报表的系统、方法、电子设备及介质
KR100750214B1 (ko) 공인 인증서를 이용한 로그인 방법
CN114051244B (zh) 一种终端侧设备与网络侧设备之间的认证方法、系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07711069

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 4325/CHENP/2008

Country of ref document: IN

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2008136311

Country of ref document: RU

Kind code of ref document: A

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC OF 150109

122 Ep: pct application non-entry in european phase

Ref document number: 07711069

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: PI0708738

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20080910