WO2015035936A1 - 身份验证方法、身份验证装置和身份验证系统 - Google Patents

身份验证方法、身份验证装置和身份验证系统 Download PDF

Info

Publication number
WO2015035936A1
WO2015035936A1 PCT/CN2014/086366 CN2014086366W WO2015035936A1 WO 2015035936 A1 WO2015035936 A1 WO 2015035936A1 CN 2014086366 W CN2014086366 W CN 2014086366W WO 2015035936 A1 WO2015035936 A1 WO 2015035936A1
Authority
WO
WIPO (PCT)
Prior art keywords
location
user
identity
binding
terminal device
Prior art date
Application number
PCT/CN2014/086366
Other languages
English (en)
French (fr)
Inventor
胡帅
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2015035936A1 publication Critical patent/WO2015035936A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/029—Location-based management or tracking services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/52—Network services specially adapted for the location of the user terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/69—Types of network addresses using geographic information, e.g. room number
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent

Definitions

  • the present invention relates to the field of network technologies, and in particular, to an identity verification method, apparatus, and system. Background technique
  • terminal device can be any of a desktop computer, a notebook, a smart phone, a tablet, and an e-book reader.
  • An existing identity authentication method includes: First, a user sends a user information to a server by using a terminal device, where the user information is used to identify a user identity, and usually includes a user name and a password; second, the server receives the user information sent by the terminal device. Then, according to the user name, the corresponding password is queried, and the received password is consistent with the queried password; if the received password is consistent with the queried password, the verification is passed, if the received password is inconsistent with the queried password. , the verification fails; Finally, the terminal device performs services such as viewing, accessing, transacting, or data interaction after being authenticated.
  • the prior art has at least the following disadvantages: If the user information is illegally obtained by the hacker, the hacker can complete the identity verification process according to the illegally obtained user information, thereby stealing the user's network account. Information or property. Summary of the invention
  • the embodiment of the present invention provides an identity authentication method, an identity verification device, and an identity verification system.
  • the technical solution is as follows:
  • an authentication method comprising:
  • the identity verification request carries a user identifier and a first location, where the first location is a location where the terminal device is currently located;
  • an identity verification apparatus comprising:
  • a first receiving module configured to receive an identity verification request sent by the terminal device, where the identity fingerprint request carries a user identifier and a first location, where the first location is a location where the terminal device is currently located;
  • a first detecting module configured to detect, according to the first location in the identity verification request, whether the first location and a second location bound to the user match;
  • a first determining module configured to determine, when the detection result of the first detecting module is that the first location and the second location match, determine identity verification of the user identity.
  • an identity authentication system where the system includes a terminal device and a server; and the terminal device includes:
  • a first acquiring module configured to acquire a user identifier and a first location, where the first location is a geographic location where the terminal is currently located;
  • a first sending module configured to send an authentication request to the server, where the verification request carries the user identifier and the first location acquired by the first acquiring module;
  • the server includes the identity face device of the second aspect
  • the terminal device and the server are connected by a wired or wireless network.
  • the terminal device acquires the user identifier and the first location, where the first location is the location where the terminal device is currently located; and sends an identity verification request to the server, where the identity verification request carries the user identifier and the first location;
  • the server detects whether the first location matches the second location according to the first location in the identity fingerprint request; if the first location and the second location match, determining that the identity verification of the user identity passes.
  • FIG. 1 is a flowchart of an identity verification method according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for identity verification according to another embodiment of the present invention.
  • FIG. 3 is a flowchart of an identity verification method according to another embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for verifying identity according to another embodiment of the present invention.
  • FIG. 6 is a flowchart of a method for identity verification according to another embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of an identity verification apparatus according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of an identity face card device according to another embodiment of the present invention.
  • FIG. 9 is a structural block diagram of an identity face certificate system according to an embodiment of the present invention.
  • FIG. 10 is a structural block diagram of an identity verification system according to another embodiment of the present invention.
  • FIG. 11 is a block diagram showing the structure of a server in an identity verification system according to another embodiment of the present invention.
  • FIG. 12 is a block diagram showing the structure of a server in an identity verification system according to another embodiment of the present invention.
  • FIG. 13 is a block diagram showing the structure of a server in an identity verification system according to another embodiment of the present invention.
  • FIG. 14 is a structural block diagram of a terminal device according to an embodiment of the present invention.
  • FIG. 15 is a structural block diagram of a server according to an embodiment of the present invention. detailed description
  • FIG. 1 is a flowchart of an identity fingerprint method according to an embodiment of the present invention.
  • the identity verification method includes:
  • Step 101 Obtain a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • Step 102 Send an identity verification request to the server, where the identity verification request carries a user identifier and a first location, so that the server detects the first location and the second location bound to the user identity according to the first location in the identity fingerprint request. Whether it matches; if the first location and the second location match, it is determined that the identity verification of the user identity is passed.
  • the method for authenticating face ID obtained by the embodiment of the present invention obtains the user identifier and the first location, where the first location is the current location of the terminal device, and sends an identity verification request to the server, so that the server can perform the authentication request according to the identity verification.
  • the first location of the first location determines whether the first location matches the second location; if the first location and the second location match, determining that the identity verification of the user identity passes.
  • the embodiment of the present invention verifies the user identifier by detecting whether the location where the terminal device is currently located and the location bound to the user identifier are matched after receiving the identity fingerprint request sent by the terminal device.
  • FIG. 2 is a flowchart of an identity authentication method according to an embodiment of the present invention.
  • the identity verification method includes:
  • Step 201 Receive an identity verification request sent by the terminal device, where the identity verification request carries a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the server receives the face card request sent by the terminal device, where the verification request carries the user identifier and the first location, where the first location is the current location of the terminal device.
  • Step 202 Detect whether the first location and the second location bound to the user identifier match according to the first location in the identity verification request.
  • the server detects whether the first location matches the second location according to the first location in the identity fingerprint request.
  • Step 203 If the first location matches the second location, determine that the identity identifier of the user identity is passed.
  • the server determines that the identity verification of the user identity is passed.
  • the identity authentication method receives the verification request sent by the terminal device, and the verification request carries the user identifier and the first location, where the first location is the terminal device. The previous location; detecting whether the first location matches the second location according to the first location in the identity verification request; if the first location and the second location match, determining that the identity identity of the user identity passes.
  • the problem of information leakage or property loss that may be brought about by the user's information once illegally obtained by the hacker is solved; the effect of further protecting the security of the user information and the property is achieved.
  • FIG. 3 is a flowchart of an identity verification method according to another embodiment of the present invention.
  • the authentication method includes:
  • Step 301 The terminal device acquires the user identifier, the authentication information of the user identifier, and the second location that needs to be bound to the user identifier.
  • the user may choose to bind the user ID and geographic location of the network account.
  • the terminal device acquires the current location, the user identifier of the network account, and the authentication information of the user identifier; the authentication information generally includes a password and a verification code.
  • the user can choose to bind himself to the online account of a shopping website and the location of the family.
  • the user opens the login interface of the network account of a shopping website through the mobile phone or other mobile device used at home, and inputs the user identification of the network account and the authentication information of the user identification on the login interface, that is, The username and password may also include the face code.
  • the mobile phone or other mobile device obtains the location in the binding process, that is, the location of the user's home.
  • the mobile phone or other mobile device calls the GPS (Global Positioning System) locator to get the location in the binding process.
  • GPS Global Positioning System
  • the terminal device acquires a location specified by the user, a user identifier of the network account, and authentication information of the user identifier.
  • a user logging into a network account on a shopping site and choosing to bind their own online account on a shopping site to a location.
  • the user can specify where they need to be bound. For example, you can bind a network account to that location by using a map feature on your phone or other mobile device to select a location on the map.
  • Step 302 The terminal device sends a binding request to the server, where the binding request carries the user identifier, the authentication information of the user identifier, and the second location.
  • the terminal device After obtaining the user identifier, the authentication information of the user identifier, and the second location, the terminal device sends a binding request to the server, and the binding request carries the obtained user identifier, the authentication information of the user identifier, and the second position.
  • the user inputs the user identification of the network account and the authentication information of the user identifier on the login interface of a shopping website, and after the mobile phone or other mobile device used by the user also obtains the second location, click the login button.
  • the mobile phone or other mobile device sends a binding request to the server, and the binding request carries the user identifier, the authentication information of the user identifier, and the second location.
  • the server receives the binding request sent by the terminal device.
  • Step 303 The server performs an identity certificate on the user identifier according to the authentication information.
  • the server After receiving the authentication information carrying the user identifier, the user identifier, and the binding request of the second location, the server queries the authentication information corresponding to the user identifier, and matches the received authentication information with the queried authentication information. .
  • the server After receiving the authentication request of the user name, the password, and the second location of the network account carrying the user, the server queries the password corresponding to the username, and matches the received password with the queried password, that is, the server User ID is authenticated.
  • Step 304 The server binds the user identifier to the second location.
  • the server After the identity certificate passes, the server binds the user ID to the second location.
  • the server determines that the received password matches the queried password
  • the authentication of the user identifier passes; after the identity certificate passes, the server objects the user name and binding request of the network account of a shopping website. The second position carried is bound.
  • Step 305 The terminal device acquires a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the server After the terminal device has sent the binding request to the server, the server binds the user identifier to the second location after receiving the binding application sent by the terminal device. Therefore, when the terminal device needs to perform the identity authentication again, the user needs to acquire the user. Identification and current location.
  • the user has already placed his or her own username on the online account of a shopping site and their family.
  • the location is sent to the server, so that the server binds the username to the location of the home, so when the user needs to log in to the online account of a shopping website again, he only needs to use a mobile device such as a mobile phone at home for a certain shopping. Enter your own username on the login screen of the web account of the website, and the mobile device can obtain the location in the verification process.
  • the hacker uses the mobile device such as the mobile phone to log in to the network account of the user's shopping website, and after inputting the user name and password, the mobile device used by the hacker also acquires the time. The location of the mobile device used by the hacker.
  • Step 306 The terminal device sends an authentication request to the server, where the verification request carries the user identifier and the first location.
  • the terminal device After obtaining the user identifier and the location of the current verification process, the terminal device sends a face certificate request to the server, where the face card request carries the user identifier and the location where the current terminal device is located.
  • the user enters his/her own user name on the login interface of the online account of a shopping website through a mobile device such as a mobile phone at home, and the mobile phone or other mobile device simultaneously obtains the location in the verification process, and then clicks the login button.
  • the mobile device sends a certificate request to the server, and the face certificate request carries the user name and the current location of the mobile device, that is, the location of the user's home.
  • the hacker enters the username and password on the login interface of the network account of a shopping website through a mobile device such as a mobile phone, and the mobile device used by the hacker simultaneously acquires the location at the time, clicks the login button, and the mobile phone or other mobile device
  • the server sends a face certificate request, and the verification request carries the user name and password and the location of the mobile device in the face certificate process.
  • the server receives the face certificate request sent by the terminal device.
  • Step 307 The server queries whether there is a second location bound to the user identifier.
  • the server After receiving the verification request sent by the terminal device, the server queries whether there is a second location bound to the user identification.
  • the server After receiving the verification request sent by the user, the server queries whether the location bound to the username exists according to the username carried in the verification request.
  • the server queries whether the location bound to the username exists according to the username carried in the verification request.
  • Step 308 The server detects whether the first location matches the second location. If it is found that there is a second location bound to the user identity, the server detects whether the first location matches the second location.
  • the server detects whether the location carried in the verification request matches the queried location bound to the username. That is, the server detects whether the location carried in the face certificate request matches the location of the family bound by the username.
  • the server matches the location in the authentication request sent by the hacker with the location of the queried binding to the username.
  • Step 309 The server determines that the identity identifier of the user identifier passes.
  • the server determines that the identity verification of the user identity is passed.
  • the location carried in the verification request is still the location of the user's home, so the detection result of the server is the face certificate.
  • the location information carried in the request matches the queried location of the user name binding, that is, the risk certificate request sent to the user passes.
  • the user uses the mobile device to send the verification request at any position in the home, and the location acquired by the mobile device may have a certain range of deviation. As long as the deviation is less than the predetermined threshold, the server considers that the two match.
  • the hacker uses the location carried in the verification request sent by the mobile device and the user The location of the name binding does not match, that is, the authentication request sent by the hacker cannot pass.
  • the terminal device obtains the user identifier and the first location, where the first location is the current location of the terminal device; the face card request is sent to the server; The second location of the user identity binding; if the second location exists, detecting whether the first location matches the second location; if the first location and the second location match, determining that the identity verification of the user identity passes.
  • the server After receiving the verification request sent by the terminal device, the server detects whether the current location of the terminal device and the location bound to the user identifier match to verify the user identifier; and solves the problem that the user information is hacked. After illegal acquisition The problem of information leakage or property loss; the effect of further protecting the security of user information and property.
  • FIG. 4 shows a flowchart of an identity verification method according to another embodiment of the present invention.
  • the authentication method includes:
  • Step 401 The terminal device acquires the user identifier, the authentication information of the user identifier, and the third location, where the third location is a location where the terminal device is located in the current verification process.
  • the server needs to authenticate the user.
  • the terminal device needs to obtain the user identifier of the network account, the authentication information of the user identifier, and the third location, where the third location is the location of the terminal device in the current verification process.
  • a user logs in to a network account of a shopping website using a mobile device such as a mobile phone at home
  • the user needs to input the user identification of the network account and the authentication information of the user identifier in the login interface of the network account of a shopping website, that is, the user.
  • Name and password and may also include a verification code.
  • a mobile device such as a mobile phone acquires the location in the normal authentication process.
  • the mobile device invokes the GPS (Global Positioning System) locator to obtain the location during the binding process.
  • GPS Global Positioning System
  • the method for obtaining the location of the terminal device in the current binding process is not limited in the embodiment of the present invention.
  • Step 402 The terminal device sends a normal face certificate request to the server, where the normal face card request carries the user identifier, the authentication information of the user identifier, and the third location.
  • the terminal device After obtaining the user identifier, the authentication information of the user identifier, and the location in the current binding process, the terminal device sends a normal face certificate request to the server, and the normal authentication request carries the obtained user identifier, The authentication information of the user ID and the location in the binding process.
  • the user inputs the user ID of the user account and the authentication information of the user ID on the login interface of a shopping website, and the mobile device used by the user also obtains the location in the normal verification process.
  • the mobile phone or other mobile device sends an authentication request to the server, and the authentication request carries the user identifier, the authentication information of the user identifier, and the location in the binding process.
  • the server receives a normal verification request sent by the terminal device.
  • Step 403 The server performs identity verification on the user identifier according to the authentication information.
  • the server After receiving the authentication information carrying the user identifier, the user identifier, and the verification request in the current authentication process, the server queries the corresponding authentication information according to the user identifier, and the received authentication information is received. Matches the queried authentication information.
  • the server After receiving the user name, password, and the verification request of the location of the user in the normal authentication process, the server queries the corresponding password according to the user name, and receives the password and the query. The password is matched, that is, the user ID is authenticated.
  • Step 404 the server records the third location as the historical third location.
  • the server After the identity certificate passes, the server records the third location as the historical third location.
  • the server After the server authenticates the user identifier according to the authentication information, the server records the third location carried in the normal verification request, that is, the location of the user's home as the historical third location.
  • the server records the location of the company or the location of the other location as the historical third location.
  • Step 405 The terminal device acquires the user identifier, the authentication information of the user identifier, and the second location that needs to be bound to the user identifier, where the second location is a location specified by the user through the terminal device.
  • the user may choose to bind the user ID of the network account with the location where it is often located.
  • the terminal device needs to obtain the location specified by the user, the user identifier of the network account, and the authentication information of the user identifier.
  • Authentication information usually includes a password and a verification code.
  • the user can choose to bind himself to the online account of a shopping website and the location of the family.
  • the user opens the login interface of the network account of a shopping website through the mobile phone or other mobile device used, and enters the user identification of the network account and the authentication information of the user identification on the login interface, that is, the user name and The password, which may also include a verification code.
  • a mobile device such as a mobile phone acquires a location specified by the user, that is, the location of the user's home.
  • Step 406 The terminal device sends a binding request to the server, where the binding request carries the user identifier, the authentication information of the user identifier, and the second location. After obtaining the user identifier, the authentication information of the user identifier, and the second location, the terminal device sends a binding request to the server, and the binding request carries the obtained user identifier, the authentication information of the user identifier, and the second position.
  • the user inputs the user identification of the network account and the authentication information of the user identifier on the login interface of a shopping website, and the mobile device used by the user also obtains the location in the binding process.
  • Clicking the login button, the mobile phone or other mobile device sends an authentication request to the server, and the verification request carries the user identification, the authentication information of the user identifier, and the second location.
  • the server receives the binding request sent by the terminal device.
  • Step 407 The server performs identity verification on the user identifier according to the authentication information.
  • the server After receiving the authentication information carrying the user identifier, the user identifier, and the second location, the server queries the authentication information corresponding to the user identifier, and matches the received authentication information with the queried authentication information. .
  • the server After receiving the authentication request of the user name, the password, and the second location of the network account carrying the user, the server queries the pre-stored password according to the username, and matches the received password with the queried password, that is, Authenticate the user ID.
  • Step 408 The server queries the historical location recorded by the user identifier each time the identity fingerprint passes within the predetermined time period before the binding.
  • the server queries the historical location recorded by the user ID each time the identity certificate passes within the predetermined time period before the binding.
  • step 404 it can be seen from step 404 that after the server identifies the user ID, the location of the terminal device in the verification process is recorded, so the server can query the reservation before the binding.
  • the historical location recorded each time an identity badge passes during the time period.
  • Step 409 The server counts the number of times the queried historical location matches the second location of the current binding. The number of times the historical position query recorded matches the second position of the current binding.
  • the historical location includes the historical third location
  • the number of times the third location of the history that is queried matches the second location of the current binding is included, including: Querying the historical third location recorded in the predetermined time period before the binding, the historical third location is a general verification request that the server receives the authentication information carried by the terminal device and carries the user identifier, the user identifier, and the third location, according to the After the authentication information is authenticated by the user identifier, the third location is recorded according to the third location, where the terminal location is in the normal verification process.
  • step 401 to step 403 are a verification process for the terminal device to send a normal face certificate request to the server.
  • the server records the location carried in the normal verification request as the historical third location, and the server statistically queries the historical third location. The number of times to match the second position of this binding. Assuming that the location of the user's home is twice in the history third position recorded by the server, and once is the location of the user's company, the number of matches with the home location of the current binding is two.
  • the number of times the historical location of the query matches the second location of the binding is included, including:
  • the first position of the history is recorded after the server authenticates the user identity through the second position of the last binding.
  • the server binds the user identifier to the location of the user's home, and in the subsequent verification process, the server performs the user identifier according to the location of the bound user's home.
  • the number of times of the face-to-face authentication is 3, and the number of times the server collects the identity of the user ID based on the location of the user of the user is 3 times.
  • the binding process is the first binding process, so the historical location is not included in the historical location.
  • Step 410 The server binds the second location to the validity period of the user identifier according to the number of times in the first correspondence, and/or queries the second location to bind the second location to the permission range of the user identifier according to the number of times. .
  • the first correspondence relationship is a positive correlation between the number of times and the binding validity period; the second correspondence relationship is a positive correlation between the number of times and the binding authority range.
  • the server queries the validity period of binding the second location to the user identifier according to the positive correlation between the number of times and the binding validity period, and/or according to the number of times
  • the query in the positive correlation between the number of times and the bound permission range binds the second location to the scope of the user ID.
  • the validity period corresponding to 2 times is 10 days, and the scope of authority is Deng Recorded.
  • the user before the binding, the user often logs in to the network account of a shopping website at home, that is, the more times the verification request sent by the terminal device carries the location of the user's home, the more times and the tied
  • the positive correlation between the positive correlation between the validity period and/or the number of times and the bound permission range is, the more times the verification request sent by the terminal device carries the location of the user's home, the more times and the tied
  • Step 411 The server binds the user identifier to the second location.
  • the server binds the user name of the user's network account on a shopping website to the second location, that is, the location of the user's home.
  • Step 412 The server determines the validity period and/or the permission range of the query as the validity period and/or the permission range of the user identifier and the second location binding.
  • the server determines the validity period of the query in step 410 as 10 days for the user's username of the network account of the shopping website and the location of the user's home, and/or the scope of the query queried in step 410.
  • the login determines the scope of the binding of the user's username in the network account of the shopping site and the location of the user's home. That is, in the 10 days after the binding, the user only needs to send the user name and the home location to the server in his home to log in to the online account of a shopping website without sending the authentication information, that is, the password and Verification code.
  • Step 413 The terminal device acquires a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the server Since the terminal device has sent the binding request to the server, the server binds the user identifier and the location of the terminal device in the binding process after receiving the binding application sent by the terminal device, so when the terminal device needs to perform identity again In the case of a face certificate, you need to obtain the user ID and the location in the verification process.
  • the user has sent his/her own user name on the online account of a shopping website to the server, and the server binds the user name to the location of the family, so when the user needs to log in again, he or she is on a shopping website.
  • the server binds the user name to the location of the family, so when the user needs to log in again, he or she is on a shopping website.
  • the hacker enters the user's name and password after logging in to the online account of the user's website using a mobile device such as a mobile phone.
  • the mobile device used by the guest will also get the location at this time.
  • Step 414 The terminal device sends an authentication request to the server, where the verification request carries the user identifier and the first location.
  • the terminal device After obtaining the user identifier and the location of the verification process, the terminal device sends a face certificate request to the server, where the face card request carries the user identifier and the current location of the terminal device.
  • the user enters his/her own user name on the login interface of the network account of a shopping website through the mobile device at home, and after the mobile device obtains the location in the verification process at the same time, clicks the login button, then the mobile device sends the device to the server.
  • the verification request is sent, and the verification request carries the user name and the current location of the mobile device, that is, the location of the user's family.
  • the hacker enters the user name and password on the login interface of the network account of a shopping website through a mobile device such as a mobile phone, and the mobile device used by the hacker simultaneously acquires the location at the time, clicks the login button, and the mobile device sends the server to the server.
  • the request is verified, and the verification request carries a useful username and password and the location of the mobile device at this time.
  • the server receives the face certificate request sent by the terminal device.
  • Step 415 The server queries whether there is a second location bound to the user identifier.
  • the server After receiving the verification request sent by the terminal device, the server queries whether there is a second location bound to the user identification.
  • the server After receiving the verification request sent by the user, the server queries whether the location bound to the username exists according to the username carried in the verification request.
  • the server queries whether the location bound to the username exists according to the username carried in the verification request.
  • Step 416 The server detects whether the first location matches the second location.
  • the server detects whether the first location matches the second location.
  • the server detects whether the location information carried in the face certificate request matches the location bound to the username. Since the user is using the verification request sent by the mobile device such as the mobile phone at home, the location carried in the verification request is still the location of the user's home, and the server detects whether the two match. Similarly, the server matches the location of the authentication request sent by the hacker to the location bound to the username.
  • Step 417 The server queries a validity period and/or a permission range of the user identifier and the second location binding. For example, the server queries the validity period and/or the scope of the binding of the username and the location of the user's home.
  • Step 418 The server detects, according to the valid period and/or the scope of the query, whether the binding of the user identifier and the second location is valid.
  • step 412 in the last binding process, the user is bound to the user name of the network account of a shopping website and the location of the user's home for 10 days, and the binding authority range is login, that is, the user is in the Within 10 days after the last binding, you only need to send the user name and family location to the server in your home to log in to your online account on a shopping site.
  • the server detects whether the current time is within the 10-day range after the last binding. Whether the permission of this verification request is within the bound permission of the last binding.
  • Step 419 The server determines that the identity identifier of the user identifier passes.
  • the server determines that the authentication of the user identification is passed.
  • the current 3 certificate request is within 10 days of the binding validity period of the above binding, and the permission of the current insurance request is also the login, the server determines that the identity verification of the current user identification is passed.
  • Step 420 The server sends the reminder information to the pre-stored communication address corresponding to the user identifier.
  • the reminder information is sent to the pre-stored communication address corresponding to the user identifier, and the reminder information includes the first location and the time of receiving the face certificate request.
  • the server sends a reminder message to the pre-stored mobile phone number or email address corresponding to the username.
  • the reminder information includes the location where the hacker sent the facet request and the time the authentication request was sent. That is, the user receives the information of "I received an illegal face card request sent from the XX position at the XX time, and if the user does not operate, please change the password in time" sent by the server through the mobile phone or the mailbox. According to the reminder information, the user can know the user name and password of a shopping website. The code was illegally obtained by a hacker.
  • the method for authenticating the face ID of the embodiment of the present invention binds the second location specified by the user to the user identifier, and matches the second location of the current location according to the queried historical location. Determine the validity period and the scope of the binding, so that when the authentication is performed again, the terminal device is authenticated according to the location of the terminal device that sends the verification request, and the location of the terminal device and the location in the binding relationship are sent. Matching, and determining that the binding of the user name and the second location is valid according to the validity period and the scope of the binding, the identity of the user identity is passed; otherwise, the verification fails.
  • FIG. 5 is a flowchart of an identity fingerprint method according to another embodiment of the present invention.
  • the authentication method includes:
  • Step 501 The server records, as the historical location, the location where the terminal device is located when the user identifier in the subscription time period passes the authentication.
  • the terminal device After the terminal device obtains the user identifier, the authentication information of the user identifier, and the location in the current binding process, the terminal device sends a normal verification request to the server, and the common face certificate request carries the The obtained user ID, the authentication information of the user ID, and the location in the binding process.
  • the server performs an identity certificate on the user identifier according to the authentication information.
  • the server After receiving the authentication information carrying the user identifier, the user identifier, and the face certificate request in the current verification process, the server queries the corresponding authentication information according to the user identifier, and receives the received authentication information. The authentication information is matched with the queried authentication information. If the received authentication information matches the queried authentication information, the identity certificate passes. After the authentication is passed, the server records the location as a historical location.
  • Step 502 The server counts the number of times the identity verification request carries the user identification and the historical location through the authentication period.
  • the authentication request received by the server includes the user ID and the historical location during the predetermined time period. Therefore, when the server determines that the identity certificate of the user identity passes, the record carries the historical location in the identity certificate request. Thus, the number of times an authentication request carrying each historical location is authenticated within a predetermined time period can be counted. In other words, you can count user usage. The number of times the terminal device logs in at each historical location.
  • Step 503 The terminal device acquires the user identifier, the authentication information of the user identifier, and the second location, where the second location is a location specified by the user through the terminal device.
  • the user may choose to bind the user identifier of the network account with the location where it is often located.
  • the terminal device needs to obtain the location specified by the user, the user identifier of the network account, and the authentication information of the user identifier.
  • Authentication information usually includes a password and a verification code.
  • Step 504 The terminal device sends a binding request to the server, where the binding request carries the user identifier, the authentication information of the user identifier, and the second location.
  • the terminal device After obtaining the user identifier, the authentication information of the user identifier, and the second location, the terminal device sends a binding request to the server, and the binding request carries the obtained user identifier, the authentication information of the user identifier, and the second position.
  • the server receives the binding request sent by the terminal device.
  • Step 505 The server performs an identity face certificate on the user identifier according to the authentication information.
  • the server After receiving the authentication information carrying the user identifier, the user identifier, and the second location, the server queries the authentication information corresponding to the user identifier, and matches the received authentication information with the queried authentication information. .
  • Step 506 The server determines that the second location matches one of the historical locations.
  • the server After the identity certificate is passed, the server queries the historical location of the user identifier within a predetermined time period before the binding, and determines that the second location of the binding matches one of the historical locations.
  • Step 507 The server queries the number of times the identity verification request carrying the user identity and the second location passes the identity authentication during the subscription time period.
  • the server queries the number of times the mobile terminal logs in at the second location within a predetermined time period before the user identifier and the second location are bound according to the user identifier.
  • Step 508 The server determines, according to the number of times, a validity period in which the user identifier is bound to the second location, and/or a permission scope in which the user identifier is bound to the second location.
  • the server determines according to the number of times The second location is bound to the user ID for a period of 10 days, and/or the number of permissions to bind the second location to the user identity is determined according to the number of times. If the number of times queried in step 507 is 10, the server determines, according to the number of times, that the second location is bound to the user identifier for a period of 30 days, and/or determines to bind the second location to the user identifier according to the number of times.
  • the scope of permissions is login and transaction.
  • Step 509 The server binds the user identifier to the second location.
  • the server binds the user name of the user's network account on a shopping website to the second location, that is, the location of the user's home.
  • Step 510 The server determines the validity period and/or the permission range of the query as the validity period and/or the permission range of the user identifier and the second location binding.
  • the server determines the validity period determined in step 508 as 10 days as the validity period of the user's username of the network account of the shopping website and the location of the user's home, and/or determines the permission range determined in step 508.
  • the scope of the binding for the user's username in the network account of a shopping site and the location of the user's home That is, in the 10 days after the binding, the user only needs to send the user name and the home location to the server in his home to log in to the online account of a shopping website without sending the authentication information, that is, the password and Face certificate.
  • Step 511 The terminal device sends a sensitive operation request to the server, where the sensitive operation request may include: a login request and a transaction request.
  • Step 512 The server returns a prompt for performing identity verification to the terminal device.
  • Step 513 The terminal device acquires a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the server Since the terminal device has sent the binding request to the server, the server binds the user identifier and the location of the terminal device in the binding process after receiving the binding application sent by the terminal device, so when the terminal device needs to perform identity again In the case of a face certificate, you need to obtain the user ID and the location in the verification process.
  • Step 514 The terminal device sends an authentication request to the server, where the verification request carries the user identifier and the first location.
  • the terminal device After obtaining the location of the user identifier and the current face certificate process, the terminal device sends a face certificate request to the server, where the face card request carries the user identifier and the current location of the terminal device.
  • the server receives the verification request sent by the terminal device.
  • Step 515 The server detects whether the first location matches the second location.
  • Step 516 The server queries a validity period and/or a permission range of the user identifier and the second location binding. For example, the server queries the validity period and/or the scope of the binding of the username and the location of the user's home.
  • Step 517 The server detects, according to the validity period and/or the permission range of the query, whether the binding of the user identifier and the second location is valid.
  • step 510 the binding validity period of the user name of the network account of the shopping website and the location of the user's home is 10 days, and the binding permission range is login, that is, the user is in the Within 10 days after the last binding, you only need to send the user name and family location to the server in your home to log in to your online account on a shopping site.
  • the server detects whether the current time is within the 10-day range after the last binding. Whether the permission of this verification request is within the bound permission of the last binding.
  • Step 518 The server determines that the identity verification of the user identity is passed.
  • the server determines that the authentication of the user identification is passed.
  • the server determines that the identity verification of the current user identifier passes.
  • Step 519 The server sends a reminder message to a pre-stored communication address corresponding to the user identifier.
  • the reminder information is sent to the pre-stored communication address corresponding to the user identifier, and the reminder information includes the first location and the time of receiving the face certificate request.
  • the method for authenticating face ID binds the second location specified by the user to the user identifier, and matches the number of times the queried historical location matches the second location of the current binding. Determine the validity period and the scope of the binding, so that when the authentication is performed again, the terminal device is authenticated according to the location of the terminal device that sends the verification request, and the location of the terminal device and the location in the binding relationship are sent. Matching, and determining that the binding between the username and the second location is valid according to the validity period and the scope of the binding, the authentication of the user identifier is passed; otherwise, the verification fails.
  • the solution may be solved after the user information is illegally obtained by the hacker.
  • the problem of interest leakage or property loss; the effect of further protecting the security of user information and property is achieved.
  • FIG. 6, shows a flowchart of an identity verification method according to another embodiment of the present invention.
  • the authentication method includes:
  • Step 601 The terminal device acquires the user identifier, the authentication information of the user identifier, and the historical first location that needs to be bound to the user identifier.
  • the terminal device obtains the user identifier, the authentication information of the user identifier, and the historical first location that needs to be bound to the user identifier, in the predetermined time period before the binding.
  • Step 602 The terminal device sends a binding request to the server, where the binding request carries the user identifier, the authentication information of the user identifier, and the historical first location.
  • the terminal device After obtaining the user identifier, the authentication information of the user identifier, and the historical first location, the terminal device sends a binding request to the server, and the binding request carries the acquired user identifier, the authentication information and the history of the user identifier. First position.
  • the server receives the binding request sent by the terminal device.
  • Step 603 The server performs an identity face certificate on the user identifier according to the authentication information.
  • the server After receiving the authentication information carrying the user identifier, the user identifier, and the face certificate request in the history first location, the server queries the authentication information corresponding to the user identifier, and performs the received authentication information and the queried authentication information. match.
  • Step 604 after the identity verification is passed, the server binds the user identifier and the first location of the history.
  • Step 605 Count the number of times the identity fingerprint request carrying the user identifier and the first location of the history passes the identity verification.
  • the terminal device sends an identity certificate request to the server, which includes the user identifier and the current location of the terminal device. Therefore, the server receives the identity fingerprint request sent by the terminal device, including the user identifier and the location where the terminal device is currently located, and verifies the identity of the user identifier according to the current location of the terminal device in the identity verification request. The server counts the number of times the terminal device successfully logs in at the first location in the history by using the user ID.
  • Step 606 The terminal device acquires the user identifier, the authentication information of the user identifier, and the second location that needs to be bound to the user identifier.
  • Step 607 The terminal device sends a binding request to the server, where the binding request carries the user identifier, the authentication information of the user identifier, and the second location.
  • the server receives the binding request sent by the terminal device.
  • Step 608 The server performs identity verification on the user identifier according to the authentication information.
  • Step 609 Determine a number of times that the identity verification request carrying the user identifier and the first location of the history passes the identity verification during the binding of the first location of the history to the user identifier.
  • Step 610 Query, according to the number of times, a validity period of the user identifier bound to the first location of the history, and/or a permission scope of the user identifier bound to the first location of the history.
  • Step 611 the server binds the user identifier to the second location.
  • the server binds the user name of the user's network account on a shopping website to the second location, that is, the location of the user's home.
  • Step 612 The server determines the validity period and/or the permission range of the query as the validity period and/or the permission range of the user identifier and the second location binding.
  • Step 613 The terminal device sends a sensitive operation request to the server, where the sensitive operation request may include: a login request and a transaction request.
  • Step 614 The server returns a prompt for performing identity verification to the terminal device.
  • Step 615 The terminal device acquires a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • Step 616 The terminal device sends an authentication request to the server, where the verification request carries the user identifier and the first location.
  • the server receives the face certificate request sent by the terminal device.
  • Step 617 The server detects whether the first location matches the second location.
  • Step 618 The server queries a validity period and/or a permission range of the user identifier and the second location binding. For example, the server queries the validity period and/or the scope of the binding of the username and the location of the user's home.
  • Step 619 The server detects, according to the valid period and/or the scope of the query, whether the binding of the user identifier and the second location is valid.
  • Step 620 The server determines that the identity identifier of the user identifier passes.
  • the server determines the user identifier The identity verification passed.
  • Step 621 The server sends a reminder message to the pre-stored communication address corresponding to the user identifier. If the detection result is that the first location and the second location do not match, the server sends a reminder message to the pre-stored communication address corresponding to the user identifier, and the reminder information is sent. Includes the first location and the time to receive the facet request.
  • the identity verification method binds the second location specified by the user and the user identifier, and determines the binding according to the validity period and the permission scope of the first location of the queried history.
  • the validity period and the permission range of the second location so that when the authentication is performed again, the terminal device is authenticated according to the location of the terminal device that sends the verification request, and if the location of the terminal device that sends the verification request matches the location in the binding relationship, and according to The validity period and the scope of the binding determine that the binding between the username and the second location is valid, and the identity of the user identifier passes; otherwise, the verification fails.
  • FIG. 7 a schematic structural diagram of an identity verification apparatus according to an embodiment of the present invention is shown.
  • the identity verification device can be implemented as a whole or a part of the terminal device by using software, hardware or a combination of the two.
  • the identity authentication device includes:
  • the first obtaining module 702 is configured to obtain a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the first sending module 704 is configured to send an identity verification request to the server, where the identity fingerprint request carries the user identifier and the first location acquired by the first obtaining module 702, so that the server detects the first Whether the location and the second location bound to the user identifier match; if the detection result is that the first location and the second location match, determining that the identity verification of the user identity passes.
  • the identity authentication device obtains the user identifier and the first location, where the first location is the location of the terminal device in the current face verification process; and sends an authentication request to the server for the server. Querying whether there is a second location bound to the user identifier; if the second location exists, detecting whether the first location matches the second location; if the first location and the second location match, determining that the identity verification of the user identity passes . Solved the user information once illegally obtained by hackers Possible information disclosure or property damage problems; achieved the security of further protection of user information and property.
  • FIG. 8 is a schematic structural diagram of an identity verification apparatus according to another embodiment of the present invention.
  • the authentication device can be implemented as all or part of the server by software, hardware or a combination of both.
  • the identity verification device includes:
  • the first receiving module 802 is configured to receive an identity verification request sent by the terminal device, where the identity verification request carries a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the first detecting module 804 is configured to detect, according to the first location in the identity verification request, whether the first location and the second location bound to the user identifier match.
  • the first determining module 806 is configured to determine, when the detection result of the first detecting module 806 is that the first location and the second location match, determine that the identity insurance of the user identity passes.
  • the identity authentication device receives the face certificate request sent by the terminal device, and the verification request carries the user identifier and the first location, where the first location is where the terminal device is located in the verification process. Detecting whether the first location and the second location match; if the detection result is that the first location and the second location match, determining that the identity verification of the user identity passes; solving the possibility that the user information may be brought after being illegally acquired by the hacker The problem of information disclosure or property damage; achieves the effect of further protecting the security of user information and property. It should be noted that, when performing the verification, the identity verification device provided by the foregoing embodiment is only illustrated by the division of each functional module.
  • FIG. 9 is a structural block diagram of a face certificate system according to an embodiment of the present invention.
  • the verification system includes: a terminal device 910 and a server 950.
  • the terminal device 910 and the server 950 are connected by a wired or wireless network.
  • the terminal device 910 includes:
  • the second obtaining module 911 is configured to obtain the user identifier, the authentication information of the user identifier, and the second location that needs to be bound to the user identifier, where the second location is a location specified by the user.
  • a second sending module 912 configured to send a binding request to the server, where the binding request carries the user identifier acquired by the second obtaining module 911, the authentication information of the user identifier, and the a second location, so that the server performs an identity certificate on the user identifier according to the authentication information, and binds the user identifier and the second location after the identity certificate passes.
  • the first obtaining module 913 is configured to obtain a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the first sending module 914 is configured to send a certificate request to the server, where the face certificate request carries the user identifier and the first location acquired by the first obtaining module 913, so that the server detects the Whether the first location matches the second location; if the detection result is that the first location and the second location match, determining that the identity identity of the user identity passes.
  • the server 950 includes:
  • the second receiving module 951 is configured to receive a binding request sent by the terminal device, where the binding request carries the user identifier, the authentication information of the user identifier, and the number that needs to be bound to the user identifier. Two locations.
  • the verification module 952 is configured to perform identity verification on the user identifier according to the authentication information carried in the binding request received by the second receiving module 951.
  • the binding module 953 is configured to bind the user identifier and the second location after the identity certificate is passed.
  • the first receiving module 954 is configured to receive an authentication request sent by the terminal device, where the verification request carries a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the first detecting module 955 is configured to detect whether the first location matches the second location.
  • the first determining module 956 is configured to determine, when the detection result of the first detecting module 955 is that the first location and the second location match, determine that the identity verification of the user identity passes.
  • the verification system acquires the user identifier by using the terminal device. And the first location, where the first location is the location of the terminal device in the current verification process; sending a face certificate request to the server, so that the server detects whether the first location matches the second location; if the first location and the second location match , then the identity verification of the user identity is determined to pass.
  • the server After receiving the verification request sent by the terminal device, the server detects that the location of the terminal device in the verification process matches the location bound to the user identifier to verify the user identifier, and solves the user information.
  • the problem of information leakage or property loss that may result if it is illegally obtained by hackers; achieves the effect of further protecting the security of user information and property.
  • FIG. 10 is a structural block diagram of an identity face certificate system according to another embodiment of the present invention.
  • the identity verification system includes: a terminal device 1010 and a server 1050.
  • the terminal device 1010 and the server 1050 are connected by a wired or wireless network.
  • the terminal device 1010 includes:
  • the third obtaining module 1011 is configured to obtain the user identifier, the authentication information of the user identifier, and the third location, where the third location is a location where the terminal device is located in the current verification process.
  • the third sending module 1012 is configured to send a normal verification request to the server, where the common authentication request carries the user identifier acquired by the third obtaining module 1011, the authentication information of the user identifier, and the third a third location, so that the server authenticates the user identifier according to the authentication information, and records the third location as a historical third location after the identity verification is passed.
  • the second location is used to obtain the user identifier, the authentication information of the user identifier, and the second location that needs to be bound to the user identifier, where the second location is the terminal device. The location in this binding process.
  • the second sending module 1014 is configured to send a binding request to the server, where the binding request carries the user identifier acquired by the second obtaining module 1013, the authentication information of the user identifier, and the a second location, so that the server performs an identity certificate on the user identifier according to the authentication information, and binds the user identifier and the second location after the identity verification is passed.
  • the first obtaining module 1015 is configured to obtain a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the first sending module 1016 is configured to send an authentication request to the server, where the verification request carries the user identifier and the first location acquired by the first obtaining module 1015, so that the server detects the first Whether the location matches the second location; if the detection result is that the first location and the second location match, determining that the identity insurance of the user identity passes.
  • the server 1050 includes:
  • the third receiving module 1051 is configured to receive a normal verification request sent by the terminal device, where the normal verification request carries the user identifier, the authentication information of the user identifier, and a third location.
  • the second verification module 1052 is configured to perform identity verification on the user identifier according to the authentication information carried in the common authentication request received by the third receiving module 1051.
  • the recording module 1053 is configured to record the third location as a historical third location after the authentication is passed.
  • the second receiving module 1054 is configured to receive a binding request that is sent by the terminal device, where the binding request carries the user identifier, the authentication information of the user identifier, and the number that needs to be bound to the user identifier. Two locations.
  • the verification module 1055 is configured to perform identity verification on the user identifier according to the authentication information carried in the binding request received by the second receiving module 1054.
  • the second query module 1056 is configured to query a historical location recorded by the user identifier each time an identity badge passes within a predetermined time period before the binding.
  • the statistics module 1057 is configured to count the number of times the historical location queried by the second query module 1056 matches the second location of the current binding.
  • the statistic module 1057 includes: a first query unit 1057a, configured to query a historical third location recorded in a predetermined time period before the binding, the history
  • the third location is that the server receives the normal authentication request that is sent by the terminal device and carries the user identifier, the authentication information of the user identifier, and the third location, and performs identity on the user identifier according to the authentication information.
  • the third location is recorded according to the third location after the face card is passed, and the third location is a location where the terminal device is in the normal verification process.
  • the statistic module 1057 includes: a second query unit 1057b, configured to query a historical first location recorded in a predetermined time period before the binding, the history A location is the second location of the server through the last binding The user ID is recorded after the authentication is passed.
  • the third query module 1058 is configured to query, in the first correspondence relationship, the binding validity period of the second location of the current binding according to the number of times counted by the statistics module 1057, and/or according to the number of times In the second correspondence, the binding permission range of the second location of the current binding is queried.
  • a second determining module 1059 configured to determine, by the third query module 1058, the binding validity period and/or the binding authority range as binding of the user identifier and the second location binding Validity period and / or binding scope of authority.
  • the first correspondence relationship is a positive correlation between the number of times and the binding validity period; and the second correspondence relationship is a positive correlation between the number of times and the binding authority range.
  • the binding module 1060 is configured to bind the user identifier and the second location after the authentication is passed.
  • the first receiving module 1062 is configured to receive a request for a certificate sent by the terminal device, where the face card request carries a user identifier and a first location, where the first location is a location where the terminal device is currently located.
  • the first detecting module 1062 is configured to detect whether the first location matches the second location.
  • the fourth query module 1063 is configured to query a binding validity period and/or a binding authority range of the user identifier and the second location binding.
  • the second detecting module 1064 is configured to detect, according to the binding validity period and/or the binding authority range that is queried by the fourth query module 1064, whether the binding of the user identifier and the second location is valid.
  • the first determining module 1065 is configured to determine, when the detection result of the second detecting module 1065 is that the binding of the user identifier and the second location is valid, determine the identity verification of the user identifier.
  • the reminder sending module 1066 is configured to: when the detection result of the first detecting module 1063 is that the first location and the second location do not match, send reminding information to a pre-stored communication address corresponding to the user identifier
  • the reminder information includes the first location and a time when the verification request is received.
  • the verification system binds the location of the terminal device in the binding process and the user identifier, and binds the current location according to the query.
  • the number of times the second position matches determines the binding validity period and binding permission range of the current binding, so that
  • the terminal device is authenticated according to the location of the terminal device that sends the verification request, and if the location of the terminal device that sends the verification request matches the location in the binding relationship, and the binding binding validity period and binding permission are If the scope determines that the binding between the username and the second location is valid, the identity verification of the user identifier is passed, and the verification fails, and the problem of information leakage or property loss may be caused after the user information is illegally obtained by the hacker; Achieving the security of further protecting user information and property.
  • FIG. 11 is a structural block diagram of a server 950 in an identity authentication system according to another embodiment of the present invention.
  • Server 950 can include:
  • the historical location recording module 1101 is configured to record the location where the user identifier passes the identity fingerprint during the subscription time period before the binding of the user identifier and the second location, as a historical location.
  • the historical location statistic module 1102 is configured to count the number of times that the identity verification request carrying the user identifier and the historical location is passed through the subscription period.
  • the matching determination module 1103 is configured to determine that the second location matches one of the historical locations.
  • the second location querying module 1104 is configured to query the number of times that the identity party certificate carrying the user identifier and the second location requests to pass the identity face certificate during the subscription time period.
  • the first attribute determining module 1105 is configured to determine, according to the number of times that the identity certificate is carried by the identity identifier that carries the user identifier and the second location in the subscription time period, that the user identifier is bound to the Determining the validity period of the second location, and/or the scope of the binding of the user identity to the second location.
  • Server 950 can include:
  • the history first location determining module 1201 is configured to bind to the location of the user identifier within a predetermined time period before the user identifier and the second location are bound, and determine the first position in the history.
  • a history first location statistic module 1202 configured to determine the first location in the history and the user During the identification binding, the number of times the authentication request carrying the user identifier and the first location of the history passes the authentication.
  • the second attribute determining module 1203 is configured to: according to the number of times the identity verification request is carried by the identity verification request carrying the user identifier and the historical first location during the binding of the historical first location to the user identifier, Determining a validity period in which the user identification is bound to the second location, and/or a permission scope in which the user identification is bound to the second location.
  • FIG. 13 is a structural block diagram of a server 950 in an identity authentication system according to an embodiment of the present invention.
  • Server 950 can also include:
  • the sensitive request receiving module 1301 is configured to receive a sensitive operation request, where the sensitive operation request includes: a login request and a transaction request.
  • the authentication prompt sending module 1302 is configured to return a prompt for performing authentication.
  • FIG. 14 is a structural block diagram of a terminal device according to an embodiment of the present invention.
  • a terminal device in an embodiment of the present invention may include one or more of the following components: a processor for executing computer program instructions to perform various processes and methods, for information and storage program instructions, random access memory (RAM), and Read-only memory (ROM), memory for storing data and information, I/O devices, interfaces, antennas, etc.
  • RAM random access memory
  • ROM Read-only memory
  • the terminal device 1400 may include an RF (Radio Frequency) circuit 1410, a memory 1420, an input unit 1430, a display unit 1440, a sensor 1450, an audio circuit 1460, a WiFi (Wireless Fidelity) module 1470, a processor 1480, and a power supply. 1482, camera 1490 and other components.
  • RF Radio Frequency
  • the components of the terminal device 1400 are specifically described below with reference to FIG. 9:
  • the RF circuit 1410 can be used for receiving and transmitting signals during and after receiving or transmitting information, and in particular, after receiving the downlink information of the base station, it is processed by the processor 1480; in addition, the uplink data is designed to be sent to the base station.
  • RF circuits include, but are not limited to, an antenna, at least one amplifier, and a transceiver. Machine, coupler, LNA (Low Noise Amplifier), duplexer, etc.
  • RF circuitry 1410 can also communicate with the network and other devices via wireless communication.
  • the wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access). , Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), e-mail, SMS (Short Messaging Service), and the like.
  • the memory 1420 can be used to store software programs and modules, and the processor 1480 executes various functional applications and data processing of the terminal device 1400 by running software programs and modules stored in the memory 1420.
  • the memory 1420 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored according to Data created by the use of the terminal device 1400 (such as audio data, phone book, etc.), and the like.
  • memory 1420 can include high speed random access memory, and can also include non-volatile memory, such as at least one disk memory device, flash memory device, or other volatile solid state memory device.
  • the input unit 1430 can be configured to receive input numeric or character information, and to generate key signal inputs related to user settings and function control of the terminal device 1400.
  • the input unit 1430 may include a touch panel 1431 and other input devices 1432.
  • the touch panel 1431 also referred to as a touch screen, can collect touch operations on or near the user (such as the user using a finger, a stylus, or the like on the touch panel 1431 or near the touch panel 1431. Operation), and drive the corresponding connecting device according to a preset program.
  • the touch panel 1431 may include two parts: a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information
  • the processor 1480 is provided and can receive commands from the processor 1480 and execute them.
  • the touch panel 1431 can be implemented in various types such as a resistive type, a capacitive type, an infrared ray, and a surface acoustic wave.
  • the input unit 1430 may also include other input devices 1432.
  • the other input device 1432 may include, but is not limited to, a physical keyboard, function keys (such as a volume control button, a switch button, etc.), a track.
  • function keys such as a volume control button, a switch button, etc.
  • a track One or more of a ball, a mouse, a joystick, and the like.
  • Display unit 1440 can be used to display information entered by the user or information provided to the user as well as various menus of terminal device 1400.
  • the display unit 1440 may include a display panel 1441.
  • the display panel 1441 may be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like.
  • the touch panel 1431 may cover the display panel 1441. After the touch panel 1431 detects a touch operation thereon or nearby, the touch panel 1431 transmits to the processor 1480 to determine the type of the touch event, and then the processor 1480 according to the touch event. The type provides a corresponding visual output on display panel 1441.
  • the touch panel 1431 and the display panel 1441 are used as two independent components to implement the input and input functions of the terminal device 1400 , in some embodiments, the touch panel 1431 and the display panel 1441 may be The input and output functions of the terminal device 1400 are implemented integrated.
  • Terminal device 1400 can also include at least one type of sensor 1450, such as a gyro sensor, a magnetic induction sensor, a light sensor, a motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1441 according to the brightness of the ambient light, and the proximity sensor may close the display panel 1441 when the terminal device 1400 moves to the ear. And / or backlight.
  • the acceleration sensor can detect the magnitude of acceleration in all directions (usually three axes). When it is stationary, it can detect the magnitude and direction of gravity. It can be used to identify the attitude of the terminal device (such as horizontal and vertical screen switching, correlation).
  • Game magnetometer attitude calibration
  • vibration recognition related functions such as pedometer, tapping
  • other sensors such as barometer, hygrometer, thermometer, infrared sensor, etc., will not be described here. .
  • An audio circuit 1460, a speaker 1461, and a microphone 1462 provide an audio interface between the user and the terminal device 1400.
  • the audio circuit 1460 can transmit the converted electrical data of the received audio data to the speaker 1461, and convert it into a sound signal output by the speaker 1461.
  • the microphone 1462 converts the collected sound signal into an electrical signal, and the audio circuit 1460 After receiving, it is converted into audio data, and then processed by the audio data output processor 1480, transmitted to the terminal device, for example, by the RF circuit 1410, or the audio data is output to the memory 1420 for further processing.
  • WiFi is a short-range wireless transmission technology
  • the terminal device 1400 can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 1470, which provides wireless for users. Broadband internet access.
  • FIG. 14 shows the WiFi module 1470, it can be understood that it does not belong to the essential configuration of the terminal device 1400, and may be omitted as needed within the scope of not changing the essence of the invention.
  • the processor 1480 is a control center of the terminal device 1400 that connects various portions of the entire terminal device using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 1420, and recalling stored in the memory 1420. Data, performing various functions and processing data of the terminal device 1400, thereby performing overall monitoring of the terminal device.
  • the processor 1480 may include one or more processing units.
  • the processor 1480 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like.
  • the modem processor primarily handles wireless communications. It will be appreciated that the above described modem processor may also not be integrated into the processor 1480.
  • the terminal device 1400 further includes a power source 1482 (such as a battery) for supplying power to various components.
  • a power source 1482 such as a battery
  • the power source can be logically connected to the processor 1482 through a power management system to manage functions such as charging, discharging, and power management through the power management system. .
  • the camera 1490 is generally composed of a lens, an image sensor, an interface, a digital signal processor, a CPU, a display screen, and the like.
  • the lens is fixed above the image sensor, and the focus can be changed by manually adjusting the lens;
  • the image sensor is equivalent to the "film" of the conventional camera, and is the heart of the image captured by the camera;
  • the interface is used to connect the camera with the cable and the board to the board And the spring-type connection mode is connected to the terminal device motherboard, and the collected image is sent to the memory 1420;
  • the digital signal processor processes the acquired image through a mathematical operation, converts the collected analog image into a digital image, and sends the image through the interface.
  • Terminal device 1400 may further include a Bluetooth module or the like, which will not be described herein.
  • Terminal device 1400 includes, in addition to one or more processors 1480, a memory, and one or more modules, one or more of which are stored in a memory and configured to be executed by one or more processors.
  • processors 1480 include, in addition to one or more processors 1480, a memory, and one or more modules, one or more of which are stored in a memory and configured to be executed by one or more processors.
  • modules one or more of which are stored in a memory and configured to be executed by one or more processors.
  • One or more of the above modules have the following functions:
  • the first location is a location where the terminal device is located in the verification process
  • the one or more modules also have the following functions:
  • the one or more modules further have the following functions: acquiring the user identifier, the authentication information of the user identifier, and the third location, where the third location is where the terminal device is located in the verification process.
  • the server Sending a normal face certificate request to the server, where the normal authentication request carries the user identifier, the authentication information of the user identifier, and a third location, so that the server identifies the user identifier according to the authentication information.
  • the authentication is performed, and after the authentication is passed, the third location is recorded as a historical third location.
  • the terminal device obtains the user identifier and the first location, where the first location is a location where the terminal device is located in the current face verification process; and sends a verification request to the server, so that the server queries whether There is a second location bound to the user identifier; if the second location exists, detecting whether the first location matches the second location; if the first location and the second location match, determining that the identity identity of the user identity passes. It solves the problem of information leakage or property loss that may be brought about by user information once it is illegally obtained by hackers; it achieves the effect of further protecting the security of user information and property. Referring to FIG. 15, a device configuration diagram of a server according to an embodiment of the present invention is shown.
  • the server 1500 includes a processor (CPU) 1501, a system memory 1504 including a random access memory (RAM) 1502 and a read only memory (ROM) 1503, and a connection system memory. 1504 and system bus 1505 of processor 1501.
  • the server 1500 also includes a basic input/output system (I/O system) 1506 that facilitates transfer of information between various devices within the computer, and mass storage for storing the operating system 1513, applications 1514, and other program modules 1515.
  • I/O system basic input/output system
  • the basic input/output system 1506 includes a display 1508 for displaying information and an input device 1509 such as a mouse or keyboard for user input of information.
  • the display 1508 and input device 1509 are both coupled to the processor 1501 via an input and output controller 1510 coupled to the system bus 1505.
  • the basic input/output system 1506 can also include an input and output controller 1510 for receiving and processing input from a plurality of other devices, such as a keyboard, mouse, or electronic stylus.
  • input/output controller 1510 also provides output to a display screen, printer, or other type of output device.
  • the mass storage device 1507 is coupled to the processor 1501 via a mass storage controller (not shown) coupled to the system bus 1505.
  • the mass storage device 1507 and its associated computer readable medium provide non-volatile storage for the client device 1500. That is, the mass storage device 1507 can include a computer readable medium (not shown) such as a hard disk or a CD-ROM drive.
  • the computer readable medium can include computer storage media and communication media.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.
  • Computer storage media includes RAM, ROM, EPROM, EEPROM, flash memory or other solid state storage technologies, CD-ROM, DVD or other optical storage, magnetic tape cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices.
  • RAM random access memory
  • ROM read only memory
  • EPROM Erasable programmable read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • the server 1500 can also be operated by a remote computer connected to the network through a network such as the Internet. That is, the server 1500 can be connected to the network 1512 through the network interface unit 1511 connected to the system bus 1505, or can also be connected to other types of networks or remote computer systems (not shown) using the network interface unit 1511. .
  • the memory also includes one or more modules, the one or more modules being stored in a memory and configured to be executed by one or more processors 1501, the one or more The modules have the following functions:
  • the face card request carries the user identifier and the first location, where the first location is a location where the terminal device is located in the current verification process;
  • the one or more modules further have the following functions: receiving a binding request sent by the terminal device, where the binding request carries the user identifier, the authentication information of the user identifier, and the need for the user identifier a second location of the binding, the second location being a location specified by the user;
  • the one or more modules also have the following functions:
  • the method further includes:
  • the first correspondence relationship is a positive correlation between the number of times and the binding validity period; and the second correspondence relationship is a positive correlation between the number of times and the binding authority range.
  • the one or more modules also have the following functions:
  • the history third position recorded in the predetermined time period before the binding
  • the history third The location is that the server receives the normal face certificate request that is sent by the terminal device and carries the user identifier, the authentication information of the user identifier, and the third location, and performs identity on the user identifier according to the authentication information.
  • the third location is recorded according to the third location after the verification is passed, and the third location is a location where the terminal device is in the normal verification process.
  • the one or more modules also have the following functions:
  • the historical first location is recorded after the server authenticates the user identifier by using the second location of the last binding.
  • the one or more modules also have the following functions:
  • the detection result is that the binding of the user identifier and the second location is valid, it is determined that the identity verification of the user identifier is passed.
  • the one or more modules further have the following functions:
  • the reminder information including the first location and a time of receiving the face card request.
  • the server provided by the embodiment of the present invention receives the face certificate request sent by the terminal device, and the verification request carries the user identifier and the first location, where the first location is a location specified by the user; and the first location and the second location are detected. Whether the location matches; if the detection result is that the first location and the second location match, determining that the identity identifier of the user identifier passes; solving the problem of information leakage or property loss that may be caused by the user information being illegally acquired by the hacker; The effect of further protecting the security of user information and property.
  • the serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.
  • the completion of the hardware may also be performed by a program to instruct related hardware.
  • the program may be stored in a computer readable storage medium.
  • the storage medium mentioned above may be a read only memory, a magnetic disk or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种身份验证方法、装置和系统，属于网络技术领域。该方法包括：接收所述终端设备发送的身份验证请求，所述身份验证请求携带有用户标识和第一位置，所述第一位置为所述终端设备当前所处的位置；根据所述身份验证请求中的所述第一位置，检测所述第一位置和与所述用户标识绑定的第二位置是否匹配；以及若所述第一位置与所述第二位置相匹配，则确定所述用户标识的身份验证通过。本发明通过服务器检测终端设备在验证过程中所处的位置和与用户标识绑定的位置是否匹配来对该用户标识进行验证；解决了用户信息一旦被黑客非法获取之后可能带来的信息泄露或财产损失的问题；达到了进一步保护用户信息和财产的安全的效果。

Description

身份验证方法、 身份验证装置和身份验证系统 技术领域
本发明涉及网络技术领域， 特别涉及一种身份验证方法、 装置和系统。 背景技术
随着网络应用的发展， 用户使用网络账户在终端设备上进行游戏、 交易 和数据交互之类的业务越来越广泛。 此处所述的 "终端设备" 可以是台式计 算机、 笔记本、 智能手机、 平板电脑和电子书阅读器中的任意一种。
在用户使用网络账户的过程中， 出于安全性地考虑， 需要进行身份验证。 现有的一种身份臉证方法， 包括： 首先， 用户使用终端设备向服务器发送用 户信息， 该用户信息用于标识用户的身份， 通常包括用户名和密码； 其次， 服务器接收终端设备发送的用户信息， 然后根据用户名查询对应的密码， 检 测接收到的密码和查询到的密码是否一致； 如果接收到的密码和查询到的密 码一致， 则验证通过， 如果接收到的密码和查询到的密码不一致， 则验证不 通过； 最后， 终端设备在通过身份验证之后， 执行查看、 访问、 交易或者数 据交互之类的业务。
在实现本发明的过程中， 发明人发现现有技术至少存在以下缺点： 若用 户信息被黑客非法获取， 则黑客可以根据非法获取到的用户信息完成上述身 份验证过程， 从而窃取用户的网络账户中的信息或财产。 发明内容
为了解决用户信息一旦被黑客非法获取之后可能带来的信息泄露或财产 损失的问题， 本发明实施例提供了一种身份臉证方法、 身份验证装置和身份 验证系统。 所述技术方案如下：
第一方面， 提供了一种身份验证方法， 所述方法包括：
接收所述终端设备发送的身份验证请求， 所述身份验证请求携带有用户 标识和第一位置， 所述第一位置为所述终端设备当前所处的位置；
根据所述身份验证请求中的所述第一位置， 检测所述第一位置和与所述 用户标识绑定的第二位置是否匹配； 以及
若所述第一位置与所述第二位置相匹配， 则确定所述用户标识的身份臉 证通过。
第二方面， 提供了一种身份验证装置， 所述装置包括：
第一接收模块， 用于接收终端设备发送的身份验证请求， 所述身份臉证 请求携带有用户标识和第一位置， 所述第一位置为所述终端设备当前所处的 位置；
第一检测模块， 用于根据所述身份验证请求中的所述第一位置， 检测所 述第一位置和与所述用户绑定的第二位置是否匹配；
第一确定模块， 用于当所述第一检测模块的检测结果为所述第一位置和 所述第二位置匹配时， 确定所述用户标识的身份验证通过。
第三方面， 提供了一种身份臉证系统， 所述系统包括终端设备和服务器； 所述终端设备包括：
第一获取模块， 用于获取用户标识和第一位置， 所述第一位置为终端当 前所处的地理位置；
第一发送模块， 用于向服务器发送验证请求， 所述验证请求携带有所述 第一获取模块获取到的所述用户标识和所述第一位置；
所述服务器包括第二方面所述的身份臉证装置；
所述终端设备和所述服务器通过有线或者无线网络进行连接。
根据本发明实施例的方法中， 终端设备获取用户标识和第一位置， 第一 位置为终端设备当前所处的位置； 向服务器发送身份验证请求， 身份验证请 求携带有用户标识和第一位置； 服务器根据身份臉证请求中的第一位置， 检 测第一位置与第二位置是否匹配； 若第一位置和第二位置匹配， 则确定用户 标识的身份验证通过。 通过上述方案， 解决了用户信息一旦被黑客非法获取 之后可能带来的信息泄露或财产损失的问题； 达到了进一步保护用户信息和 财产的安全的效果。 附图说明
为了更清楚地说明本发明实施例中的技术方案， 下面将对实施例描述中 所需要使用的附图作筒单地介绍， 显而易见地， 下面描述中的附图仅仅是本 发明的一些实施例， 对于本领域普通技术人员来讲， 在不付出创造性劳动的 前提下， 还可以根据这些附图获得其他的附图。
图 1是本发明一个实施例提供的身份验证方法的流程图；
图 2是本发明另一实施例提供的身份猃证方法的流程图；
图 3是本发明另一实施例提供的身份验证方法的流程图；
图 4是本发明另一实施例提供的身份验证方法的流程图；
图 5是本发明另一实施例提供的身份猃证方法的流程图；
图 6是本发明另一实施例提供的身份猃证方法的流程图；
图 7是本发明一个实施例提供的身份验证装置的结构示意图；
图 8是本发明另一实施例提供的身份臉证装置的结构示意图；
图 9是本发明一个实施例提供的身份臉证系统的结构方框图；
图 10是本发明另一实施例提供的身份验证系统的结构方框图；
图 11 是本发明另一实施例提供的身份验证系统中的服务器的结构方框 图；
图 12是本发明另一实施例提供的身份验证系统中的服务器的结构方框 图；
图 13 是本发明另一实施例提供的身份验证系统中的服务器的结构方框 图；
图 14是本发明一个实施例提供的终端设备的结构方框图； 以及
图 15是本发明一个实施例提供的服务器的结构方框图。 具体实施方式
为使本发明的目的、 技术方案和优点更加清楚， 下面将结合附图对本发 明实施方式作进一步地详细描述。
请参考图 1 , 其示出了本发明一个实施例提供的身份臉证方法的流程图， 该身份验证方法包括：
步骤 101 , 获取用户标识和第一位置， 第一位置为终端设备当前所处的位 置。 步骤 102, 向服务器发送身份验证请求， 该身份验证请求携带有用户标识 和第一位置， 以便服务器根据身份臉证请求中的第一位置， 检测第一位置和 与用户标识绑定的第二位置是否匹配； 若第一位置和第二位置匹配， 则确定 用户标识的身份验证通过。
综上所述， 本发明实施例提供的身份臉证方法， 通过获取用户标识和第 一位置， 第一位置为终端设备当前所处的位置； 向服务器发送身份验证请求， 以便服务器根据身份验证请求中的第一位置， 检测第一位置与第二位置是否 匹配； 若第一位置和第二位置匹配， 则确定用户标识的身份验证通过。 本发 明实施例通过服务器在接收到终端设备发送的身份臉证请求之后， 检测终端 设备当前所处的位置和与用户标识绑定的位置是否匹配来对该用户标识进行 验证。 从而， 解决了用户信息一旦被黑客非法获取之后可能带来的信息泄露 或财产损失的问题； 达到了进一步保护用户信息和财产的安全的效果。 请参考图 2, 其示出了本发明一个实施例提供的身份臉证方法的流程图， 该身份验证方法包括：
步骤 201 ,接收终端设备发送的身份验证请求， 身份验证请求携带有用户 标识和第一位置， 第一位置为终端设备当前所处的位置。
服务器接收终端设备发送的臉证请求， 验证请求携带有用户标识和第一 位置， 第一位置为终端设备当前所处的位置。
步骤 202,根据身份验证请求中的第一位置，检测第一位置和与用户标识 绑定的第二位置是否匹配。
服务器根据身份臉证请求中的第一位置， 检测第一位置与第二位置是否 匹配。
步骤 203 , 若第一位置与第二位置相匹配， 则确定用户标识的身份臉证通 过。
若检测结果为第一位置和第二位置匹配， 则服务器确定用户标识的身份 验证通过。
综上所述， 本发明实施例提供的身份臉证方法， 通过接收终端设备发送 的验证请求， 验证请求携带有用户标识和第一位置， 第一位置为终端设备当 前所处的位置； 根据身份验证请求中的第一位置， 检测第一位置与第二位置 是否匹配； 若第一位置和第二位置相匹配， 则确定用户标识的身份臉证通过。 从而， 解决了用户信息一旦被黑客非法获取之后可能带来的信息泄露或财产 损失的问题； 达到了进一步保护用户信息和财产的安全的效果。 请参考图 3 , 其示出了本发明另一实施例提供的身份验证方法的流程图。 该身份验证方法包括：
步骤 301 , 终端设备获取用户标识、用户标识的鉴权信息和需要与用户标 识绑定的第二位置。
为了进一步保证用户网络账户的安全， 用户可以选择将网络账户的用户 标识和地理位置进行绑定。
在一个实施例中， 终端设备获取当前所处的位置， 网络账户的用户标识 及该用户标识的鉴权信息； 鉴权信息通常包括密码和验证码。
比如， 某用户经常在家里登录某购物网站的网络账户， 则该用户可以选 择将自己在某购物网站的网络账户和家庭的位置进行绑定。 在绑定过程中， 该用户在家里通过所使用的手机或者其他移动设备打开某购物网站的网络账 户的登录界面， 在登录界面输入自己的网络账户的用户标识和用户标识的鉴 权信息， 即用户名和密码， 可能还包括臉证码。
同时， 手机或者其他移动设备获取在本次绑定过程中所处的位置即该用 户的家庭的位置。手机或者其他移动设备调用 GPS( Global Positioning System, 全球定位系统）定位程序来获取在本次绑定过程中所处的位置。
在另一实施例中， 终端设备获取用户指定的位置， 网络账户的用户标识 及该用户标识的鉴权信息。
比如， 用户登录某购物网站的网络账户， 并选择将需要将自己在某购物 网站的网络账户与某位置进行绑定。 在绑定过程中， 该用户可以指定需要绑 定的位置。 例如， 通过使用手机或者其他移动设备上的地图功能选定地图上 的某个位置， 来绑定网络账户与该位置。
需要说明的是， 本发明实施例对终端设备获取在本次绑定过程中所处的 位置的方法不做限定。 步骤 302,终端设备向服务器发送绑定请求，该绑定请求携带有用户标识、 用户标识的鉴权信息和第二位置。
终端设备在获取到用户标识、 用户标识的鉴权信息和第二位置之后， 向 服务器发送绑定请求， 并且该绑定请求中携带有获取到的用户标识、 用户标 识的鉴权信息和第二位置。
比如， 该用户在某购物网站的登录界面输入自己的网络账户的用户标识 和用户标识的鉴权信息 , 并且该用户所使用的手机或者其他移动设备也获取 到第二位置之后， 点击登录按钮， 则手机或者其他移动设备即向服务器发送 绑定请求， 且该绑定请求中携带有用户标识、 用户标识的鉴权信息和第二位 置。
相应的， 服务器接收终端设备发送的绑定请求。
步骤 303 , 服务器根据鉴权信息对用户标识进行身份臉证。
服务器在接收到携带有用户标识、 用户标识的鉴权信息和第二位置的绑 定请求之后， 查询用户标识对应的鉴权信息， 将接收到的鉴权信息和查询到 的鉴权信息进行匹配。
比如， 服务器在接收到携带有该用户的网络账户的用户名、 密码和第二 位置的验证请求之后， 查询用户名对应的密码， 将接收到的密码和查询到的 密码进行匹配， 即对该用户标识进行身份验证。
步骤 304, 服务器将用户标识和第二位置进行绑定。
在身份臉证通过之后， 服务器将用户标识和第二位置进行绑定。
比如， 服务器确定接收到的密码和查询到的密码匹配之后， 对该用户标 识的身份验证通过； 在身份臉证通过之后， 服务器将该用户在某购物网站的 网络账户的用户名和绑定请求中携带的第二位置进行绑定。
步骤 305 , 终端设备获取用户标识和第一位置， 第一位置为终端设备当前 所处的位置。
由于终端设备已经向服务器发送绑定申请， 服务器在接收到终端设备发 送的绑定申请后将用户标识和第二位置进行了绑定， 所以当终端设备需要再 次进行身份臉证时， 需要获取用户标识和当前所处的位置。
比如， 该用户已经将自己在某购物网站的网络账户的用户名和自己家庭 的位置发送给服务器， 以便服务器将该用户名和自己家庭的位置进行了绑定， 所以当用户需要再次登录自己在某购物网站的网络账户时， 只需要在家里通 过诸如手机的移动设备在某购物网站的网络账户的登录界面上输入自己的用 户名， 移动设备获取此次验证过程中所处的位置即可。
若该用户的用户名和密码被黑客非法获取， 则黑客在使用诸如手机的移 动设备登录该用户在某购物网站的网络账户时， 输入用户名和密码之后， 黑 客所使用的移动设备同时会获取此时黑客所使用的移动设备所处的位置。
步骤 306, 终端设备向服务器发送验证请求，验证请求携带有用户标识和 第一位置。
终端设备在获取到用户标识和本次验证过程所处的位置之后， 向服务器 发送臉证请求， 该臉证请求中携带有用户标识和当前终端设备所处的位置。
比如， 用户在家里通过诸如手机的移动设备在某购物网站的网络账户的 登录界面上输入自己的用户名， 手机或者其他移动设备同时获取到此次验证 过程中所处的位置之后， 点击登录按钮， 则移动设备向服务器发送猃证请求， 且该臉证请求中携带有用户名和移动设备当前所处的位置即该用户的家庭的 位置。
而黑客在通过诸如手机的移动设备在某购物网站的网络账户的登录界面 上输入用户名和密码， 黑客所使用移动设备同时获取此时所处的位置， 点击 登录按钮， 则手机或者其他移动设备向服务器发送臉证请求， 且该验证请求 中携带有用户名和密码以及移动设备在此次臉证过程中所处的位置。
相应的， 服务器接收终端设备发送的臉证请求。
步骤 307, 服务器查询是否存在与用户标识绑定的第二位置。
服务器在接收到终端设备发送的验证请求之后， 查询是否存在与用户标 识绑定的第二位置。
比如， 服务器接收到该用户发送的验证请求之后， 根据验证请求中携带 的用户名查询是否存在与该用户名绑定的位置。
同样， 服务器在接收到黑客发送的验证请求之后， 根据验证请求中携带 的用户名查询是否存在与该用户名绑定的位置。
步骤 308 , 服务器检测第一位置与第二位置是否匹配。 若查询到存在与用户标识绑定的第二位置， 则服务器检测第一位置与第 二位置是否匹配。
比如， 服务器查询到存在与该用户名绑定的位置， 即该用户的家庭的位 置， 则服务器检测此次验证请求中所携带的位置和查询到的与该用户名绑定 的位置是否匹配。 即服务器检测此次臉证请求中所携带的位置与该用户名绑 定的家庭的位置是否匹配。
同样， 服务器将黑客发送的验证请求中的位置与查询到的与该用户名绑 定的位置是否匹配。
步骤 309, 服务器确定用户标识的身份臉证通过。
若检测结果为第一位置和第二位置匹配， 则服务器确定用户标识的身份 验证通过。
比如， 由于该用户是在家里使用诸如手机的移动设备发送的此次验证请 求， 所以此次验证请求中所携带的位置仍为该用户的家庭的位置， 所以服务 器的检测结果为此次臉证请求中所携带的位置信息和查询到的与该用户名绑 定的位置匹配， 即对该用户发送的险证请求通过。
需要说明的是， 用户在家庭的任意位置使用移动设备发送验证请求， 移 动设备获取到的位置可能存在一定范围的偏差， 只要该偏差小于预定阈值， 服务器即认为二者匹配。
对于黑客发送的臉证请求， 由于黑客所使用的诸如手机的移动设备所处 的地理不可能为该用户的家庭的位置， 所以黑客使用移动设备发送的验证请 求中所携带的位置和与该用户名绑定的位置并不匹配， 即对于黑客发送的验 证请求不能通过。
综上所述， 本发明实施例提供的身份臉证方法， 终端设备获取用户标识 和第一位置， 第一位置为终端设备当前所处的位置； 向服务器发送臉证请求； 服务器查询是否存在与用户标识绑定的第二位置； 若存在该第二位置， 则检 测第一位置与第二位置是否匹配； 若第一位置和第二位置匹配， 则确定用户 标识的身份验证通过。 本发明实施例通过服务器在接收到终端设备发送的验 证请求之后， 检测终端设备当前所处的位置和与用户标识绑定的位置是否匹 配来对该用户标识进行验证； 解决了用户信息一旦被黑客非法获取之后可能 带来的信息泄露或财产损失的问题； 达到了进一步保护用户信息和财产的安 全的效果。 请参考图 4, 其示出了本发明另一实施例提供的身份验证方法的流程图。 该身份验证方法包括：
步骤 401 , 终端设备获取用户标识、 用户标识的鉴权信息和第三位置， 第 三位置为终端设备在本次验证过程中所处的位置。
用户在使用网络账户的过程中， 服务器需要对用户进行身份验证。 在一 次身份验证过程中， 终端设备需要获取该网络账户的用户标识、 用户标识的 鉴权信息和第三位置， 第三位置为终端设备在本次验证过程中所处的位置。
比如， 用户在家里使用诸如手机的移动设备登录某购物网站的网络账户 时， 用户需要在某购物网站的网络账户的登录界面输入自己的网络账户的用 户标识和用户标识的鉴权信息， 即用户名和密码， 可能还包括验证码。
同时， 诸如手机的移动设备获取在本次普通验证过程中所处的位置。 移 动设备调用 GPS ( Global Positioning System, 全球定位系统 )定位程序来获取 在本次绑定过程中所处的位置。
需要说明的是， 本发明实施例对终端设备获取在本次绑定过程中所处的 位置的方法不做限定。
步骤 402, 终端设备向服务器发送普通臉证请求， 普通臉证请求携带有用 户标识、 用户标识的鉴权信息和第三位置。
终端设备在获取到用户标识、 用户标识的鉴权信息和在本次绑定过程中 所处的位置之后， 向服务器发送普通臉证请求， 并且该普通验证请求中携带 有获取到的用户标识、 用户标识的鉴权信息和在本次绑定过程中所处的位置。
比如， 该用户在某购物网站的登录界面输入自己的网络账户的用户标识 和用户标识的鉴权信息并且该用户所使用的移动设备也获取到在本次普通验 证过程中所处的位置之后， 点击登录按钮， 则手机或者其他移动设备即向服 务器发送验证请求， 且该验证请求中携带有用户标识、 用户标识的鉴权信息 和在本次绑定过程中所处的位置。
相应的， 服务器接收终端设备发送的普通验证请求。 步骤 403 , 服务器根据鉴权信息对用户标识进行身份验证。
服务器在接收到携带有用户标识、 用户标识的鉴权信息和在本次普通猃 证过程中所处的位置的验证请求之后， 根据用户标识查询对应的鉴权信息， 将接收到的鉴权信息和查询到的鉴权信息进行匹配。
比如， 服务器在接收到携带有该用户的网络账户的用户名、 密码和在本 次普通验证过程中所处的位置的验证请求之后， 根据用户名查询对应的密码， 将接收到的密码和查询到的密码进行匹配， 即对该用户标识进行身份验证。
步骤 404, 服务器将第三位置记录为历史第三位置。
在身份臉证通过之后， 服务器将第三位置记录为历史第三位置。
比如， 服务器在根据鉴权信息对该用户标识进行身份验证通过之后， 将 本次普通验证请求中携带的第三位置即该用户的家庭的位置记录为历史第三 位置。
若用户是在公司或者其它地方使用诸如手机的移动设备发送的普通验证 请求， 则服务器将公司的位置或者其它地方的位置记录为历史第三位置。
步骤 405 , 终端设备获取用户标识、用户标识的鉴权信息和需要与用户标 识绑定的第二位置， 该第二位置为用户通过终端设备指定的位置。
为了进一步保证用户网络账户的安全， 同时也为了后续臉证过程的方便， 用户可以选择将网络账户的用户标识和经常所处的位置进行绑定。 在一次绑 定过程中， 终端设备需要获取用户指定的位置， 网络账户的用户标识， 和该 用户标识的鉴权信息。 鉴权信息通常包括密码和验证码。
比如， 某用户经常在家里登录某购物网站的网络账户， 则该用户可以选 择将自己在某购物网站的网络账户和家庭的位置进行绑定。 在绑定过程中， 该用户通过所使用的手机或者其他移动设备打开某购物网站的网络账户的登 录界面， 在登录界面输入自己的网络账户的用户标识和用户标识的鉴权信息， 即用户名和密码， 可能还包括验证码。
同时， 诸如手机的移动设备获取用户指定的位置， 即该用户的家庭的位 置。
步骤 406,终端设备向服务器发送绑定请求，该绑定请求携带有用户标识、 用户标识的鉴权信息和第二位置。 终端设备在获取到用户标识、 用户标识的鉴权信息和第二位置之后， 向 服务器发送绑定请求， 并且该绑定请求中携带有获取到的用户标识、 用户标 识的鉴权信息和第二位置。
比如， 该用户在某购物网站的登录界面输入自己的网络账户的用户标识 和用户标识的鉴权信息， 并且该用户所使用的移动设备也获取到在本次绑定 过程中所处的位置之后， 点击登录按鈕， 则手机或者其他移动设备即向服务 器发送验证请求， 且该验证请求中携带有用户标识、 用户标识的鉴权信息和 第二位置。
相应的， 服务器接收终端设备发送的绑定请求。
步骤 407, 服务器根据鉴权信息对用户标识进行身份验证。
服务器在接收到携带有用户标识、 用户标识的鉴权信息和第二位置的猃 证请求之后， 查询用户标识对应的鉴权信息， 将接收到的鉴权信息和查询到 的鉴权信息进行匹配。
比如， 服务器在接收到携带有该用户的网络账户的用户名、 密码和第二 位置的验证请求之后， 根据用户名查询预先存储的密码， 将接收到的密码和 查询到的密码进行匹配， 即对该用户标识进行身份验证。
步骤 408,服务器查询用户标识在本次绑定之前预定时间段内每次身份臉 证通过时所记录的历史位置。
在身份臉证通过之后， 服务器查询用户标识在本次绑定之前预定时间段 内每次身份臉证通过时所记录的历史位置。
比如， 由步骤 404可知， 服务器在对该用户标识每次臉证通过之后， 都 会将此次验证过程中终端设备所处的位置进行记录， 所以， 服务器可以查询 到在本次绑定之前的预定时间段内每次身份臉证通过时所记录的历史位置。
步骤 409 ,服务器统计查询到的历史位置与本次绑定的第二位置匹配的次 数。 时所记录的历史位置查询与本次绑定的第二位置匹配的次数。
具体的， 若历史位置包括历史第三位置， 则统计查询到的历史第三位置 与本次绑定的第二位置匹配的次数， 包括： 查询在本次绑定之前预定时间段内记录的历史第三位置， 历史第三位置 是服务器接收终端设备发送的携带有用户标识、 用户标识的鉴权信息和第三 位置的普通验证请求， 根据鉴权信息对用户标识进行身份验证通过之后根据 第三位置记录的， 第三位置为终端设备在普通验证过程中所处的位置。
比如， 上述步骤 401至步骤 403为终端设备向服务器发送普通臉证请求 的验证过程， 步骤 404 中服务器将普通验证请求中携带的位置记录为历史第 三位置， 服务器统计查询到的历史第三位置与本次绑定的第二位置匹配的次 数。 假设服务器记录的历史第三位置中有两次为该用户的家庭的位置， 一次 为该用户的公司的位置， 那么与本次绑定的家庭位置匹配的次数即为 2次。
若历史位置包括历史第一位置， 则统计查询到的历史位置与本次绑定的 第二位置匹配的次数， 包括：
查询在本次绑定之前预定时间段内记录的历史第一位置， 历史第一位置 是服务器通过上一次绑定的第二位置对用户标识进行身份验证通过之后记录 的。
比如， 若在本次绑定之前， 服务器将该用户标识和该用户的家庭的位置 进行绑定过， 且在后续验证过程中， 服务器即根据绑定的该用户的家庭的位 置对用户标识进行身份臉证的次数为 3 次， 则服务器统计根据绑定的该用户 的家庭的位置对用户标识进行身份臉证通过的次数即为 3次。
本实施中以本次绑定过程为第一次绑定过程， 所以历史位置中不包括历 史第一位置。
步骤 410 ,服务器根据次数在第一对应关系中查询的将第二位置绑定到用 户标识的有效期， 和 /或根据次数在第二对应关系中查询将第二位置绑定到用 户标识的权限范围。
其中， 第一对应关系是次数与绑定有效期之间的正相关关系； 第二对应 关系是次数与绑定权限范围之间的正相关关系。
比如， 步骤 409查询到的次数为 2次， 则服务器根据该次数在次数与绑 定有效期之间的正相关关系中查询将第二位置绑定到用户标识的有效期， 和 / 或根据该次数在次数与绑定权限范围之间的正相关关系中查询将第二位置绑 定到用户标识的权限范围。 假设 2次所对应的有效期为 10天， 权限范围为登 录。
需要说明的是， 若本次绑定之前， 用户经常在家里登录某购物网站的网 络账户， 即终端设备发送的验证请求中携带有该用户的家庭的位置的次数越 多， 则根据次数与绑定有效期之间的正相关关系中和 /或次数与绑定权限范围 之间的正相关关系中查询到的有效期越长和 /或权限范围越大。
步骤 411 , 服务器将用户标识和第二位置进行绑定。
比如， 在身份验证通过之后， 服务器将该用户在某购物网站的网络账户 的用户名和第二位置， 即该用户的家庭的位置进行绑定。
步骤 412, 服务器将查询到的有效期和 /或权限范围确定为用户标识和第 二位置绑定的有效期和 /或权限范围。
比如， 服务器将步骤 410中查询到的有效期 10天确定为该用户在某购物 网站的网络账户的用户名和该用户的家庭的位置绑定的有效期， 和 /或将步骤 410 中查询到的权限范围登录确定为该用户在某购物网站的网络账户的用户 名和该用户的家庭的位置绑定的权限范围。 即在本次绑定之后的 10天里， 该 用户在自己家里只需要向服务器发送用户名和家庭的位置即可登陆自己在某 购物网站的网络账户， 而不需要再发送鉴权信息即密码和验证码。
步骤 413 , 终端设备获取用户标识和第一位置， 第一位置为终端设备当前 所处的位置。
由于终端设备已经向服务器发送绑定申请， 服务器在接收到终端设备发 送的绑定申请后将用户标识和绑定过程中终端设备所处的位置进行了绑定， 所以当终端设备需要再次进行身份臉证时， 需要获取用户标识和本次验证过 程中所处的位置。
比如， 该用户已经将自己在某购物网站的网络账户的用户名和自己家庭 的位置发送给服务器， 服务器将该用户名和自己家庭的位置进行了绑定， 所 以当用户需要再次登录自己在某购物网站的网络账户时， 只需要在家里通过 诸如手机的移动设备在某购物网站的网络账户的登录界面上输入自己的用户 名， 移动设备获取此次猃证过程中所处的位置即可。
若该用户的用户名和密码被黑客非法获取， 则黑客在使用诸如手机的移 动设备登录该用户在某购物网站的网络账户时， 输入用户名和密码之后， 黑 客所使用的移动设备同时会获取此时所处的位置。
步骤 414, 终端设备向服务器发送验证请求，验证请求携带有用户标识和 第一位置。
终端设备在获取到用户标识和本次验证过程所处的位置之后， 向服务器 发送臉证请求， 该臉证请求中携带有用户标识和终端设备当前所处的位置。
比如， 用户在家里通过移动设备在某购物网站的网络账户的登录界面上 输入自己的用户名， 移动设备同时获取到此次验证过程中所处的位置之后， 点击登录按钮， 则移动设备向服务器发送验证请求， 且该验证请求中携带有 用户名和移动设备当前所处的位置， 即该用户的家庭的位置。
而黑客在通过诸如手机的移动设备在某购物网站的网络账户的登录界面 上输入用户名和密码， 黑客所使用的移动设备同时获取此时所处的位置， 点 击登录按钮， 则移动设备向服务器发送验证请求， 且该验证请求中携带有用 用户名和密码以及移动设备在此时所处的位置。
相应的， 服务器接收终端设备发送的臉证请求。
步骤 415 , 服务器查询是否存在与用户标识绑定的第二位置。
服务器在接收到终端设备发送的验证请求之后， 查询是否存在与用户标 识绑定的第二位置。
比如， 服务器接收到该用户发送的验证请求之后， 根据验证请求中携带 的用户名查询是否存在与该用户名绑定的位置。
同样， 服务器在接收到黑客发送的验证请求之后， 根据验证请求中携带 的用户名查询是否存在与该用户名绑定的位置。
步骤 416 , 服务器检测第一位置与第二位置是否匹配。
若查询到存在与用户标识绑定的第二位置， 则服务器检测第一位置与第 二位置是否匹配。
比如， 服务器查询到存在与该用户名绑定的位置， 即该用户的家庭的位 置， 则服务器检测此次臉证请求中所携带的位置信息与该用户名绑定的位置 是否匹配。 由于该用户是在家里使用诸如手机的移动设备发送的此次验证请 求， 所以此次验证请求中所携带的位置仍为该用户的家庭的位置， 服务器检 测二者是否匹配。 同样， 服务器将黑客发送的验证请求中的位置与该用户名绑定的位置是 否匹配。
步骤 417, 服务器查询用户标识与第二位置绑定的有效期和 /或权限范围。 比如， 服务器查询该用户名和该用户的家庭的位置绑定的有效期和 /或权 限范围。
步骤 418, 服务器根据查询到的有效期和 /或权限范围检测用户标识和第 二位置的绑定是否有效。
由步骤 412可知， 在上次绑定过程中， 该用户在某购物网站的网络账户 的用户名和该用户的家庭的位置的绑定有效期为 10天，绑定权限范围为登录， 即该用户在上次绑定之后的 10天内， 在自己家里只需要向服务器发送用户名 和家庭的位置即可登陆自己在某购物网站的网络账户。 服务器检测当前时间 是否在上次绑定之后的 10天范围内， 本次验证请求的权限是否在上次绑定的 绑定权限范围内。
步骤 419, 服务器确定用户标识的身份臉证通过。
若检测结果为该用户标识和第二位置的绑定有效， 则服务器确定用户标 识的身份验证通过。
比如， 本次 3 证请求在上述绑定的绑定有效期 10天内， 且本次险证请求 的权限也为登录， 则服务器确定本次用户标识的身份验证通过。
步骤 420, 服务器向预先存储的与用户标识对应的通讯地址发送提醒信 息。
若检测结果为第一位置和第二位置不匹配， 则向预先存储的与用户标识 对应的通讯地址发送提醒信息， 提醒信息包括第一位置和接收臉证请求的时 间。
比如， 黑客发送的臉证请求中携带的位置和与该用户名绑定的该用户的 家庭位置不匹配， 则服务器向预先存储的与该用户名对应的手机号码或邮箱 地址发送提醒信息， 该提醒信息中包括黑客发送臉证请求时所处的位置和发 送验证请求的时间。 即用户通过手机或者邮箱接收到服务器发送的 "在 XX 时间接收到从 XX位置发送的非法臉证请求， 若非本人操作， 请及时修改密 码" 的信息。 用户根据该提醒信息即可知道自己在某购物网站的用户名和密 码被黑客非法获取。
综上所述， 本发明实施例提供的身份臉证方法， 通过将用户指定的第二 位置和用户标识进行绑定， 并根据查询到的历史位置与本次绑定的第二位置 匹配的次数确定本次绑定的有效期和权限范围， 使得再次验证时， 根据发送 验证申请的终端设备的位置对终端设备进行身份猃证， 若发送猃证申请的终 端设备的位置和绑定关系中的位置匹配， 且根据绑定的有效期和权限范围确 定用户名和第二位置的绑定有效， 则对该用户标识的身份 3全证通过； 否则， 验证不通过。 从而， 解决了用户信息一旦被黑客非法获取之后可能带来的信 息泄露或财产损失的问题； 达到了进一步保护用户信息和财产的安全的效果。 请参考图 5 , 其示出了本发明另一实施例提供的身份臉证方法的流程图。 该身份验证方法包括：
步骤 501 ,服务器将预订时间段内用户标识通过身份验证时终端设备所处 的位置， 记录为历史位置。
在预定时间段内， 终端设备在获取到用户标识、 用户标识的鉴权信息和 在本次绑定过程中所处的位置之后， 向服务器发送普通验证请求， 并且该普 通臉证请求中携带有获取到的用户标识、 用户标识的鉴权信息和在本次绑定 过程中所处的位置。 服务器根据鉴权信息对用户标识进行身份臉证。
具体地， 服务器在接收到携带有用户标识、 用户标识的鉴权信息和在本 次普通验证过程中所处的位置的臉证请求之后， 根据用户标识查询对应的鉴 权信息， 将接收到的鉴权信息和查询到的鉴权信息进行匹配。 如果接收到的 鉴权信息与查询到的鉴权信息相匹配， 则身份臉证通过。 在身份验证通过之 后， 服务器将该位置记录为历史位置。
步骤 502,服务器统计在预订时间段内携带有用户标识和历史位置的身份 验证请求通过身边猃证的次数。
在预定时间段内， 服务器接收到的身份验证请求均包括用户标识和历史 位置。 因此， 当服务器确定所述用户标识的身份臉证通过时， 记录携带在身 份臉证请求中的历史位置。 从而， 可以统计在预定时间段内携带有各个历史 位置的身份验证请求通过身份验证的次数。 也就是说， 可以统计用户使用所 述终端设备在各个历史位置处登录的次数。
步骤 503 , 终端设备获取用户标识、 用户标识的鉴权信息和第二位置， 该 第二位置为用户通过终端设备指定的位置。
为了进一步保证用户网络账户的安全， 同时也为了后续验证过程的方便， 用户可以选择将网络账户的用户标识和经常所处的位置进行绑定。 在一次绑 定过程中， 终端设备需要获取用户指定的位置， 网络账户的用户标识， 和该 用户标识的鉴权信息。 鉴权信息通常包括密码和验证码。
步骤 504,终端设备向服务器发送绑定请求，该绑定请求携带有用户标识、 用户标识的鉴权信息和第二位置。
终端设备在获取到用户标识、 用户标识的鉴权信息和第二位置之后， 向 服务器发送绑定请求， 并且该绑定请求中携带有获取到的用户标识、 用户标 识的鉴权信息和第二位置。
相应的， 服务器接收终端设备发送的绑定请求。
步骤 505 , 服务器根据鉴权信息对用户标识进行身份臉证。
服务器在接收到携带有用户标识、 用户标识的鉴权信息和第二位置的猃 证请求之后， 查询用户标识对应的鉴权信息， 将接收到的鉴权信息和查询到 的鉴权信息进行匹配。
步骤 506 , 服务器确定第二位置与历史位置中的一个相匹配。
在身份臉证通过之后， 服务器查询用户标识在本次绑定之前预定时间段 内的历史位置， 并确定本次绑定的第二位置与历史位置中的一个相匹配。
步骤 507,服务器查询在预订时间段内携带有用户标识和第二位置的身份 验证请求通过身份猃证的次数。
服务器根据用户标识查询在用户标识和第二位置进行绑定之前的预定时 间段内移动终端在第二位置登录的次数。
步骤 508 , 服务器根据次数， 确定所述用户标识绑定到所述第二位置的有 效期， 和 /或所述用户标识绑定到所述第二位置的权限范围。
其中， 次数的值越大， 则有效期越长； 以及次数的值越大， 权限范围越 大。
比如， 在步骤 507查询到的次数为 2次， 则服务器根据该次数确定将第 二位置绑定到用户标识的有效期为 10天，和 /或才艮据该次数确定将第二位置绑 定到用户标识的权限范围为登录。 如果在步骤 507查询到的次数为 10次， 则 服务器根据该次数确定将第二位置绑定到用户标识的有效期为 30天，和 /或根 据该次数确定将第二位置绑定到用户标识的权限范围为登录和交易。
步骤 509, 服务器将用户标识和第二位置进行绑定。
比如， 在身份验证通过之后， 服务器将该用户在某购物网站的网络账户 的用户名和第二位置， 即该用户的家庭的位置进行绑定。
步骤 510, 服务器将查询到的有效期和 /或权限范围确定为用户标识和第 二位置绑定的有效期和 /或权限范围。
比如， 服务器将步骤 508中确定的有效期 10天确定为该用户在某购物网 站的网络账户的用户名和该用户的家庭的位置绑定的有效期，和 /或将步骤 508 中确定的权限范围登录确定为该用户在某购物网站的网络账户的用户名和该 用户的家庭的位置绑定的权限范围。 即在本次绑定之后的 10天里， 该用户在 自己家里只需要向服务器发送用户名和家庭的位置即可登陆自己在某购物网 站的网络账户， 而不需要再发送鉴权信息即密码和臉证码。
步骤 511 , 终端设备向服务器发送敏感操作请求， 其中所述敏感操作请求 可以包括： 登录请求和交易请求。
步骤 512, 服务器向终端设备返回执行身份猃证的提示。
步骤 513 , 终端设备获取用户标识和第一位置， 第一位置为终端设备当前 所处的位置。
由于终端设备已经向服务器发送绑定申请， 服务器在接收到终端设备发 送的绑定申请后将用户标识和绑定过程中终端设备所处的位置进行了绑定， 所以当终端设备需要再次进行身份臉证时， 需要获取用户标识和本次验证过 程中所处的位置。
步骤 514, 终端设备向服务器发送验证请求，验证请求携带有用户标识和 第一位置。
终端设备在获取到用户标识和本次臉证过程所处的位置之后， 向服务器 发送臉证请求， 该臉证请求中携带有用户标识和终端设备当前所处的位置。
相应的， 服务器接收终端设备发送的验证请求。 步骤 515 , 服务器检测第一位置与第二位置是否匹配。
步骤 516, 服务器查询用户标识与第二位置绑定的有效期和 /或权限范围。 比如， 服务器查询该用户名和该用户的家庭的位置绑定的有效期和 /或权 限范围。
步骤 517, 服务器根据查询到的有效期和 /或权限范围检测用户标识和第 二位置的绑定是否有效。
由步骤 510可知， 在上次绑定过程中， 该用户在某购物网站的网络账户 的用户名和该用户的家庭的位置的绑定有效期为 10天，绑定权限范围为登录， 即该用户在上次绑定之后的 10天内， 在自己家里只需要向服务器发送用户名 和家庭的位置即可登陆自己在某购物网站的网络账户。 服务器检测当前时间 是否在上次绑定之后的 10天范围内， 本次验证请求的权限是否在上次绑定的 绑定权限范围内。
步骤 518 , 服务器确定用户标识的身份验证通过。
若检测结果为该用户标识和第二位置的绑定有效， 则服务器确定用户标 识的身份验证通过。
比如， 本次验证请求在上述绑定的绑定有效期 10天内， 且本次验证请求 的权限也为登录， 则服务器确定本次用户标识的身份验证通过。
步骤 519 , 服务器向预先存储的与用户标识对应的通讯地址发送提醒信 息。
若检测结果为第一位置和第二位置不匹配， 则向预先存储的与用户标识 对应的通讯地址发送提醒信息， 提醒信息包括第一位置和接收臉证请求的时 间。
综上所述， 本发明实施例提供的身份臉证方法， 通过将用户指定的第二 位置和用户标识进行绑定， 并 居查询到的历史位置与本次绑定的第二位置 匹配的次数确定本次绑定的有效期和权限范围， 使得再次验证时， 根据发送 验证申请的终端设备的位置对终端设备进行身份猃证， 若发送猃证申请的终 端设备的位置和绑定关系中的位置匹配， 且根据绑定的有效期和权限范围确 定用户名和第二位置的绑定有效， 则对该用户标识的身份验证通过； 否则， 验证不通过。 从而， 解决了用户信息一旦被黑客非法获取之后可能带来的信 息泄露或财产损失的问题； 达到了进一步保护用户信息和财产的安全的效果。 请参考图 6, 其示出了本发明另一实施例提供的身份验证方法的流程图。 该身份验证方法包括：
步骤 601 , 终端设备获取用户标识、用户标识的鉴权信息和需要与用户标 识绑定的历史第一位置。
在本次绑定之前预定时间段内， 终端设备获取到用户标识、 用户标识的 鉴权信息和需要与用户标识绑定的历史第一位置。
步骤 602,终端设备向服务器发送绑定请求，该绑定请求携带有用户标识、 用户标识的鉴权信息和历史第一位置。
终端设备在获取到用户标识、 用户标识的鉴权信息和历史第一位置之后， 向服务器发送绑定请求， 并且该绑定请求中携带有获取到的用户标识、 用户 标识的鉴权信息和历史第一位置。
相应的， 服务器接收终端设备发送的绑定请求。
步骤 603 , 服务器根据鉴权信息对用户标识进行身份臉证。
服务器在接收到携带有用户标识、 用户标识的鉴权信息和历史第一位置 的臉证请求之后， 查询用户标识对应的鉴权信息， 将接收到的鉴权信息和查 询到的鉴权信息进行匹配。
步骤 604, 在身份验证通过后， 服务器将用户标识和历史第一位置进行绑 定。
步骤 605 ,统计携带有用户标识和历史第一位置的身份臉证请求通过身份 验证的次数。
终端设备向服务器发起身份臉证请求均包括用户标识和终端设备当前所 处的位置。 从而， 服务器接收终端设备发送的包括用户标识和终端设备当前 所处的位置的身份臉证请求， 并根据身份验证请求中的终端设备当前所处的 位置来验证用户标识的身份。 服务器统计终端设备利用用户标识在历史第一 位置成功登录的次数。
步骤 606, 终端设备获取用户标识、用户标识的鉴权信息和需要与用户标 识绑定的第二位置。 步骤 607,终端设备向服务器发送绑定请求，该绑定请求携带有用户标识、 用户标识的鉴权信息和第二位置。
相应的， 服务器接收终端设备发送的绑定请求。
步骤 608, 服务器根据鉴权信息对用户标识进行身份验证。
步骤 609, 确定在历史第一位置与用户标识绑定期间，携带有用户标识和 历史第一位置的身份验证请求通过身份验证的次数。
步骤 610, 根据次数， 查询用户标识绑定到历史第一位置的有效期， 和 / 或用户标识绑定到历史第一位置的权限范围。
步骤 611， 服务器将用户标识和第二位置进行绑定。
比如， 在身份验证通过之后， 服务器将该用户在某购物网站的网络账户 的用户名和第二位置， 即该用户的家庭的位置进行绑定。
步骤 612, 服务器将查询到的有效期和 /或权限范围确定为用户标识和第 二位置绑定的有效期和 /或权限范围。
步骤 613 , 终端设备向服务器发送敏感操作请求， 其中所述敏感操作请求 可以包括： 登录请求和交易请求。
步骤 614, 服务器向终端设备返回执行身份验证的提示。
步骤 615 , 终端设备获取用户标识和第一位置， 第一位置为终端设备当前 所处的位置。
步骤 616, 终端设备向服务器发送验证请求，验证请求携带有用户标识和 第一位置。
相应的， 服务器接收终端设备发送的臉证请求。
步骤 617, 服务器检测第一位置与第二位置是否匹配。
步骤 618, 服务器查询用户标识与第二位置绑定的有效期和 /或权限范围。 比如， 服务器查询该用户名和该用户的家庭的位置绑定的有效期和 /或权 限范围。
步骤 619, 服务器根据查询到的有效期和 /或权限范围检测用户标识和第 二位置的绑定是否有效。
步骤 620, 服务器确定用户标识的身份臉证通过。
若检测结果为该用户标识和第二位置的绑定有效， 则服务器确定用户标 识的身份验证通过。
步骤 621 , 服务器向预先存储的与用户标识对应的通讯地址发送提醒信 若检测结果为第一位置和第二位置不匹配， 则向预先存储的与用户标识 对应的通讯地址发送提醒信息， 提醒信息包括第一位置和接收臉证请求的时 间。
综上所述， 本发明实施例提供的身份验证方法， 通过将用户指定的第二 位置和用户标识进行绑定， 并根据查询到的历史第一位置的有效期和权限范 围确定本次绑定的第二位置的有效期和权限范围， 使得再次验证时， 根据发 送验证申请的终端设备的位置对终端设备进行身份验证 , 若发送验证申请的 终端设备的位置和绑定关系中的位置匹配， 且根据绑定的有效期和权限范围 确定用户名和第二位置的绑定有效， 则对该用户标识的身份臉证通过； 否则， 验证不通过。 从而， 解决了用户信息一旦被黑客非法获取之后可能带来的信 息泄露或财产损失的问题； 达到了进一步保护用户信息和财产的安全的效果。 请参考图 7,其示出了本发明一个实施例提供的身份验证装置的结构示意 图。 该身份验证装置可以通过软件、 硬件或者两者的结合实现成为终端设备 的全部或者一部分， 该身份臉证装置， 包括：
第一获取模块 702， 用于获取用户标识和第一位置， 所述第一位置为终端 设备当前所处的位置。
第一发送模块 704， 用于向服务器发送身份猃证请求， 所述身份臉证请求 携带有所述第一获取模块 702获取到的所述用户标识和第一位置， 以便所述 服务器检测第一位置和与用户标识绑定的第二位置是否匹配； 若检测结果为 第一位置和第二位置匹配， 则确定所述用户标识的身份验证通过。
综上所述， 本发明实施例提供的身份臉证装置， 通过获取用户标识和第 一位置， 第一位置为终端设备在本次臉证过程所处的位置； 向服务器发送验 证请求， 以便服务器查询是否存在与用户标识绑定的第二位置； 若存在该第 二位置， 则检测第一位置与第二位置是否匹配； 若第一位置和第二位置匹配， 则确定用户标识的身份验证通过。 解决了用户信息一旦被黑客非法获取之后 可能带来的信息泄露或财产损失的问题； 达到了进一步保护用户信息和财产 的安全的效果。 请参考图 8 ,其示出了本发明另一实施例提供的身份验证装置的结构示意 图。 该身份验证装置可以通过软件、 硬件或者两者的结合实现成为服务器的 全部或者一部分。 该身份验证装置， 包括：
第一接收模块 802, 用于接收终端设备发送的身份验证请求， 所述身份验 证请求携带有用户标识和第一位置， 所述第一位置为所述终端设备当前所处 的位置。
第一检测模块 804, 用于根据所述身份验证请求中的所述第一位置，检测 所述第一位置和与所述用户标识绑定的所述第二位置是否匹配。
第一确定模块 806，用于当所述第一检测模块 806的检测结果为所述第一 位置和所述第二位置匹配时， 确定所述用户标识的身份险证通过。
综上所述， 本发明实施例提供的身份臉证装置， 通过接收终端设备发送 的臉证请求， 验证请求携带有用户标识和第一位置， 第一位置为终端设备在 本次验证过程所处的位置； 检测第一位置与第二位置是否匹配； 若检测结果 为第一位置和第二位置匹配， 则确定用户标识的身份验证通过； 解决了用户 信息一旦被黑客非法获取之后可能带来的信息泄露或财产损失的问题； 达到 了进一步保护用户信息和财产的安全的效果。 需要说明的是： 上述实施例提供的身份验证装置在进行验证时， 仅以上 述各功能模块的划分进行举例说明， 实际应用中， 可以根据需要而将上述功 能分配由不同的功能模块完成， 即将装置的内部结构划分成不同的功能模块， 以完成以上描述的全部或者部分功能。 另外， 上述实施例提供的身份险证装 置与身份 3 证方法实施例属于同一构思， 其具体实现过程详见方法实施例， 这里不再赘述。 请参考图 9, 其示出了本发明一个实施例提供的臉证系统的结构方框图。 该验证系统包括： 终端设备 910和服务器 950。 所述终端设备 910和所述服务器 950通过有线或者无线网络进行连接。 所述终端设备 910， 包括：
第二获取模块 911 , 用于获取所述用户标识、 所述用户标识的鉴权信息和 需要与所述用户标识绑定的第二位置， 所述第二位置为用户指定的位置。
第二发送模块 912， 用于向所述服务器发送绑定请求， 所述绑定请求携带 有所述第二获取模块 911 获取到的所述用户标识、 所述用户标识的鉴权信息 和所述第二位置， 以便所述服务器根据所述鉴权信息对所述用户标识进行身 份臉证， 并在所述身份臉证通过之后， 将所述用户标识和所述第二位置进行 绑定。
第一获取模块 913 , 用于获取用户标识和第一位置， 所述第一位置为终端 设备当前所处的位置。
第一发送模块 914， 用于向服务器发送猃证请求， 所述臉证请求携带有所 述第一获取模块 913 获取到的所述用户标识和所述第一位置， 以便所述服务 器检测所述第一位置与所述第二位置是否匹配； 若检测结果为所述第一位置 和所述第二位置匹配， 则确定所述用户标识的身份臉证通过。
所述服务器 950, 包括：
第二接收模块 951， 用于接收所述终端设备发送的绑定请求， 所述绑定请 求携带有所述用户标识、 所述用户标识的鉴权信息和需要与所述用户标识绑 定的第二位置。
验证模块 952,用于根据所述第二接收模块 951接收到的所述绑定请求中 携带的所述鉴权信息对所述用户标识进行身份猃证。
绑定模块 953 , 用于在所述身份臉证通过之后， 将所述用户标识和所述第 二位置进行绑定。
第一接收模块 954， 用于接收终端设备发送的验证请求， 所述验证请求携 带有用户标识和第一位置， 所述第一位置为所述终端设备当前所处的位置。
第一检测模块 955， 用于检测所述第一位置与所述第二位置是否匹配。 第一确定模块 956，用于当所述第一检测模块 955的检测结果为所述第一 位置和所述第二位置匹配时， 确定所述用户标识的身份验证通过。
综上所述， 本发明实施例提供的验证系统， 通过终端设备获取用户标识 和第一位置， 第一位置为终端设备在本次验证过程所处的位置； 向服务器发 送臉证请求， 以便服务器检测第一位置与第二位置是否匹配； 若第一位置和 第二位置匹配， 则确定用户标识的身份验证通过。 本发明实施例通过服务器 在接收到终端设备发送的验证请求之后， 检测终端设备在验证过程中所处的 位置和与用户标识绑定的位置是否匹配来对该用户标识进行验证； 解决了用 户信息一旦被黑客非法获取之后可能带来的信息泄露或财产损失的问题； 达 到了进一步保护用户信息和财产的安全的效果。 请参考图 10, 其示出了本发明另一实施例提供的身份臉证系统的结构方 框图。 该身份验证系统包括： 终端设备 1010和服务器 1050。
所述终端设备 1010和所述服务器 1050通过有线或者无线网络进行连接。 所述终端设备 1010, 包括：
第三获取模块 1011 , 用于获取所述用户标识、 所述用户标识的鉴权信息 和第三位置， 所述第三位置为所述终端设备在本次验证过程中所处的位置。
第三发送模块 1012, 用于向所述服务器发送普通验证请求， 所述普通猃 证请求携带有所述第三获取模块 1011获取到的所述用户标识、 所述用户标识 的鉴权信息和第三位置， 以便所述服务器根据所述鉴权信息对所述用户标识 进行身份验证， 并在所述身份猃证通过之后， 将所述第三位置记录为历史第 三位置。
第二获耳^莫块 1013 , 用于获取所述用户标识、 所述用户标识的鉴权信息 和需要与所述用户标识绑定的第二位置， 所述第二位置为所述终端设备在本 次绑定过程中所处的位置。
第二发送模块 1014, 用于向所述服务器发送绑定请求， 所述绑定请求携 带有所述第二获取模块 1013获取到的所述用户标识、 所述用户标识的鉴权信 息和所述第二位置， 以便所述服务器根据所述鉴权信息对所述用户标识进行 身份臉证， 并在所述身份验证通过之后， 将所述用户标识和所述第二位置进 行绑定。
第一获取模块 1015 , 用于获取用户标识和第一位置， 所述第一位置为终 端设备当前所处的位置。 第一发送模块 1016, 用于向服务器发送验证请求， 所述验证请求携带有 所述第一获取模块 1015获取到的所述用户标识和所述第一位置， 以便所述服 务器检测所述第一位置与所述第二位置是否匹配； 若检测结果为所述第一位 置和所述第二位置匹配， 则确定所述用户标识的身份险证通过。
所述服务器 1050， 包括：
第三接收模块 1051 , 用于接收所述终端设备发送的普通验证请求， 所述 普通验证请求携带有所述用户标识、 所述用户标识的鉴权信息和第三位置。
第二验证模块 1052,用于根据所述第三接收模块 1051接收到的普通猃证 请求中携带的所述鉴权信息对所述用户标识进行身份验证。
记录模块 1053 , 用于在所述身份验证通过之后， 将所述第三位置记录为 历史第三位置。
第二接收模块 1054, 用于接收所述终端设备发送的绑定请求， 所述绑定 请求携带有所述用户标识、 所述用户标识的鉴权信息和需要与所述用户标识 绑定的第二位置。
验证模块 1055 ,用于根据所述第二接收模块 1054接收到的所述绑定请求 中携带的所述鉴权信息对所述用户标识进行身份验证。
第二查询模块 1056, 用于查询所述用户标识在本次绑定之前预定时间段 内每次身份臉证通过时所记录的历史位置。
统计模块 1057,用于统计所述第二查询模块 1056查询到的所述历史位置 与本次绑定的所述第二位置匹配的次数。
若所述历史位置包括历史第三位置， 则所述统计模块 1057， 包括： 第一查询单元 1057a，用于查询在本次绑定之前预定时间段内记录的历史 第三位置， 所述历史第三位置是所述服务器接收所述终端设备发送的携带有 所述用户标识、 所述用户标识的鉴权信息和第三位置的普通验证请求， 根据 所述鉴权信息对所述用户标识进行身份臉证通过之后根据所述第三位置记录 的， 所述第三位置为所述终端设备在普通验证过程中所处的位置。
若所述历史位置包括历史第一位置， 则所述统计模块 1057， 包括： 第二查询单元 1057b,用于查询在本次绑定之前预定时间段内记录的历史 第一位置， 所述历史第一位置是所述服务器通过上一次绑定的第二位置对所 述用户标识进行身份验证通过之后记录的。
第三查询模块 1058,用于根据所述统计模块 1057统计出的所述次数在第 一对应关系中查询本次绑定的所述第二位置的绑定有效期， 和 /或根据所述次 数在第二对应关系中查询本次绑定的所述第二位置的绑定权限范围。
第二确定模块 1059,用于将所述第三查询模块 1058查询到的所述绑定有 效期和 /或所述绑定权限范围确定为所述用户标识和所述第二位置绑定的绑定 有效期和 /或绑定权限范围。
其中， 所述第一对应关系是次数与绑定有效期之间的正相关关系； 所述 第二对应关系是次数与绑定权限范围之间的正相关关系。
绑定模块 1060, 用于在所述身份验证通过之后， 将所述用户标识和所述 第二位置进行绑定。
第一接收模块 1062, 用于接收终端设备发送的猃证请求， 所述臉证请求 携带有用户标识和第一位置， 所述第一位置为所述终端设备当前所处的位置。
第一检测模块 1062, 用于检测所述第一位置与所述第二位置是否匹配。 第四查询模块 1063 , 用于查询所述用户标识与所述第二位置绑定的绑定 有效期和 /或绑定权限范围。
第二检测模块 1064,用于根据所述第四查询模块 1064查询到的所述绑定 有效期和 /或绑定权限范围检测所述用户标识和所述第二位置的绑定是否有 效。
第一确定模块 1065 ,用于当所述第二检测模块 1065的检测结果为所述用 户标识和所述第二位置的绑定是否有效时， 确定所述用户标识的身份验证通 过。
提醒发送模块 1066,用于当所述第一检测模块 1063的检测结果为所述第 一位置和所述第二位置不匹配时， 向预先存储的与所述用户标识对应的通讯 地址发送提醒信息， 所述提醒信息包括所述第一位置和接收所述验证请求的 时间。
综上所述， 本发明实施例提供的验证系统， 通过将终端设备的在绑定过 程中所处的位置和用户标识进行绑定， 并才艮据查询到的历史位置与本次绑定 的第二位置匹配的次数确定本次绑定的绑定有效期和绑定权限范围， 使得再 次验证时， 根据发送验证申请的终端设备的位置对终端设备进行身份验证 , 若发送验证申请的终端设备的位置和绑定关系中的位置匹配， 且根据绑定的 绑定有效期和绑定权限范围确定用户名和第二位置的绑定有效， 则对该用户 标识的身份验证通过， 反正， 验证不通过； 解决了用户信息一旦被黑客非法 获取之后可能带来的信息泄露或财产损失的问题； 达到了进一步保护用户信 息和财产的安全的效果。 请参考图 11， 其示出了本发明另一实施例提供的身份臉证系统中的服务 器 950的结构方框图。 服务器 950可以包括：
历史位置记录模块 1101 , 用于将在所述用户标识和所述第二位置进行绑 定之前的预订时间段内所述用户标识通过身份臉证时所处的位置， 记录为历 史位置。
历史位置统计模块 1102, 用于统计在所述预订时间段内携带有所述用户 标识和所述历史位置的身份猃证请求通过身边猃证的次数。
匹配确定模块 1103 , 用于确定所述第二位置与所述历史位置中的一个相 匹配。
第二位置查询模块 1104, 用于查询在所述预订时间段内携带有所述用户 标识和所述第二位置的身份臉证请求通过身份臉证的次数。
第一属性确定模块 1105 , 用于根据在所述预订时间段内携带有所述用户 标识和所述第二位置的身份臉证请求通过身份臉证的次数， 确定所述用户标 识绑定到所述第二位置的有效期， 和 /或所述用户标识绑定到所述第二位置的 权限范围。 请参考图 12,其示出了本发明实施例提供的身份臉证系统中的服务器 950 的结构方框图。 服务器 950可以包括：
历史第一位置确定模块 1201， 用于将在所述用户标识和所述第二位置进 行绑定之前的预定时间段内绑定至所述用户标识的位置， 确定为历史第一位 置。
历史第一位置统计模块 1202, 用于确定在所述历史第一位置与所述用户 标识绑定期间， 携带有所述用户标识和所述历史第一位置的身份验证请求通 过身份验证的次数。
第二属性确定模块 1203 , 用于根据在所述历史第一位置与所述用户标识 绑定期间携带有所述用户标识和所述历史第一位置的身份验证请求通过身份 一险证的次数， 确定所述用户标识绑定到所述第二位置的有效期， 和 /或所述用 户标识绑定到所述第二位置的权限范围。 请参考图 13 ,其示出了本发明实施例提供的身份臉证系统中的服务器 950 的结构方框图。 服务器 950还可以包括：
敏感请求接收模块 1301 , 用于接收敏感操作请求， 其中所述敏感操作请 求包括： 登录请求和交易请求。
身份验证提示发送模块 1302， 用于返回执行身份验证的提示。 请参考图 14,其示出了本发明一个实施例提供的终端设备的结构方框图。 本发明实施例中的终端设备可以包括一个或多个如下组成部分： 用于执 行计算机程序指令以完成各种流程和方法的处理器， 用于信息和存储程序指 令随机接入存储器 （RAM )和只读存储器 （ROM ), 用于存储数据和信息的 存储器， I/O设备， 界面， 天线等。 具体来讲：
终端设备 1400可以包括 RF ( Radio Frequency, 射频） 电路 1410、 存储 器 1420、 输入单元 1430、 显示单元 1440、 传感器 1450、 音频电路 1460、 WiFi(wireless fidelity, 无线保真)模块 1470、 处理器 1480、 电源 1482、 摄像头 1490等部件。 本领域技术人员可以理解， 图 9中示出的终端设备结构并不构 成对终端设备的限定， 可以包括比图示更多或更少的部件， 或者组合某些部 件， 或者不同的部件布置。
下面结合图 9对终端设备 1400的各个构成部件进行具体的介绍：
RF电路 1410可用于收发信息或通话过程中， 信号的接收和发送， 特别 地， 将基站的下行信息接收后， 给处理器 1480处理； 另外， 将设计上行的数 据发送给基站。 通常， RF电路包括但不限于天线、 至少一个放大器、 收发信 机、 耦合器、 LNA ( Low Noise Amplifier, 低噪声放大器）、 双工器等。 此外， RF电路 1410还可以通过无线通信与网络和其他设备通信。 所述无线通信可 以使用任一通信标准或协议， 包括但不限于 GSM(Global System of Mobile communication, 全球移动通讯系统)、 GPRS(General Packet Radio Service, 通 用分组无线服务）、 CDMA(Code Division Multiple Access， 码分多址）、 WCDMA(Wideband Code Division Multiple Access, 宽带码分多址）、 LTE(Long Term Evolution,长期演进）、 电子邮件、 SMS(Short Messaging Service, 短消息 服务)等。
存储器 1420可用于存储软件程序以及模块， 处理器 1480通过运行存储 在存储器 1420的软件程序以及模块， 从而执行终端设备 1400的各种功能应 用以及数据处理。 存储器 1420可主要包括存储程序区和存储数据区， 其中， 存储程序区可存储操作系统、 至少一个功能所需的应用程序 （比如声音播放 功能、 图像播放功能等）等； 存储数据区可存储根据终端设备 1400的使用所 创建的数据（比如音频数据、 电话本等）等。 此外， 存储器 1420可以包括高 速随机存取存储器， 还可以包括非易失性存储器， 例如至少一个磁盘存储器 件、 闪存器件、 或其他易失性固态存储器件。
输入单元 1430可用于接收输入的数字或字符信息， 以及产生与终端设备 1400的用户设置以及功能控制有关的键信号输入。 具体地， 输入单元 1430可 包括触控面板 1431以及其他输入设备 1432。 触控面板 1431， 也称为触摸屏， 可收集用户在其上或附近的触摸操作 （比如用户使用手指、 触笔等任何适合 的物体或附件在触控面板 1431上或在触控面板 1431附近的操作 ), 并根据预 先设定的程式驱动相应的连接装置。 可选的， 触控面板 1431可包括触摸检测 装置和触摸控制器两个部分。 其中， 触摸检测装置检测用户的触摸方位， 并 检测触摸操作带来的信号， 将信号传送给触摸控制器； 触摸控制器从触摸检 测装置上接收触摸信息， 并将它转换成触点坐标， 再送给处理器 1480， 并能 接收处理器 1480发来的命令并加以执行。 此外， 可以采用电阻式、 电容式、 红外线以及表面声波等多种类型实现触控面板 1431。 除了触控面板 1431， 输 入单元 1430还可以包括其他输入设备 1432。 具体地， 其他输入设备 1432可 以包括但不限于物理键盘、 功能键（比如音量控制按键、 开关按键等）、 轨迹 球、 鼠标、 操作杆等中的一种或多种。
显示单元 1440可用于显示由用户输入的信息或提供给用户的信息以及终 端设备 1400的各种菜单。 显示单元 1440可包括显示面板 1441 , 可选的， 可 以采用 LCD(Liquid Crystal Display , 液晶显示器）、 OLED(Organic Light-Emitting Diode,有机发光二极管)等形式来配置显示面板 1441。进一步的， 触控面板 1431可覆盖显示面板 1441 , 当触控面板 1431检测到在其上或附近 的触摸操作后，传送给处理器 1480以确定触摸事件的类型， 随后处理器 1480 根据触摸事件的类型在显示面板 1441上提供相应的视觉输出。虽然在图 9中， 触控面板 1431与显示面板 1441是作为两个独立的部件来实现终端设备 1400 的输入和输入功能， 但是在某些实施例中， 可以将触控面板 1431与显示面板 1441集成而实现终端设备 1400的输入和输出功能。
终端设备 1400还可包括至少一种传感器 1450， 比如陀螺仪传感器、磁感 应传感器、 光传感器、 运动传感器以及其他传感器。 具体地， 光传感器可包 括环境光传感器及接近传感器， 其中， 环境光传感器可根据环境光线的明暗 来调节显示面板 1441的亮度， 接近传感器可在终端设备 1400移动到耳边时， 关闭显示面板 1441和 /或背光。作为运动传感器的一种，加速度传感器可检测 各个方向上 （一般为三轴）加速度的大小， 静止时可检测出重力的大小及方 向， 可用于识别终端设备姿态的应用 （比如横竖屏切换、 相关游戏、 磁力计 姿态校准）、 振动识别相关功能（比如计步器、 敲击）等； 至于终端设备 1400 还可配置的气压计、 湿度计、 温度计、 红外线传感器等其他传感器， 在此不 再赘述。
音频电路 1460、 扬声器 1461 , 传声器 1462可提供用户与终端设备 1400 之间的音频接口。 音频电路 1460可将接收到的音频数据转换后的电信号， 传 输到扬声器 1461， 由扬声器 1461 转换为声音信号输出； 另一方面， 传声器 1462将收集的声音信号转换为电信号，由音频电路 1460接收后转换为音频数 据， 再将音频数据输出处理器 1480处理后， 经 RF电路 1410以发送给比如另 一终端设备， 或者将音频数据输出至存储器 1420以便进一步处理。
WiFi属于短距离无线传输技术，终端设备 1400通过 WiFi模块 1470可以 帮助用户收发电子邮件、 浏览网页和访问流式媒体等， 它为用户提供了无线 的宽带互联网访问。 虽然图 14示出了 WiFi模块 1470, 但是可以理解的是， 其并不属于终端设备 1400的必须构成， 完全可以根据需要在不改变发明的本 质的范围内而省略。
处理器 1480是终端设备 1400的控制中心， 利用各种接口和线路连接整 个终端设备的各个部分， 通过运行或执行存储在存储器 1420内的软件程序和 /或模块， 以及调用存储在存储器 1420内的数据， 执行终端设备 1400的各种 功能和处理数据， 从而对终端设备进行整体监控。 可选的， 处理器 1480可包 括一个或多个处理单元； 优选的， 处理器 1480可集成应用处理器和调制解调 处理器， 其中， 应用处理器主要处理操作系统、 用户界面和应用程序等， 调 制解调处理器主要处理无线通信。 可以理解的是， 上述调制解调处理器也可 以不集成到处理器 1480中。
终端设备 1400还包括给各个部件供电的电源 1482 (比如电池），优选的， 电源可以通过电源管理系统与处理器 1482逻辑相连， 从而通过电源管理系统 实现管理充电、 放电、 以及功耗管理等功能。
摄像头 1490—般由镜头、 图像传感器、 接口、 数字信号处理器、 CPU、 显示屏幕等组成。 其中， 镜头固定在图像传感器的上方， 可以通过手动调节 镜头来改变聚焦； 图像传感器相当于传统相机的"胶卷"，是摄像头采集图像的 心脏； 接口用于把摄像头利用排线、 板对板连接器、 弹簧式连接方式与终端 设备主板连接， 将采集的图像发送给所述存储器 1420; 数字信号处理器通过 数学运算对采集的图像进行处理， 将采集的模拟图像转换为数字图像并通过 接口发送给存储器 1420。
尽管未示出， 终端设备 1400还可以包括蓝牙模块等， 在此不再赘述。 终端设备 1400除了包括一个或者多个处理器 1480, 还包括有存储器， 以 及一个或者多个模块， 其中一个或者多个模块存储于存储器中， 并被配置成 由一个或者多个处理器执行。 上述一个或者多个模块具有如下功能：
获取用户标识和第一位置， 所述第一位置为终端设备在本次验证过程所 处的位置；
向服务器发送臉证请求， 所述验证请求携带有所述用户标识和所述第一 位置， 以便所述服务器查询是否存在与所述用户标识绑定的第二位置； 若查 询到存在与所述用户标识绑定的第二位置， 则检测所述第一位置与所述第二 位置是否匹配； 若检测结果为所述第一位置和所述第二位置匹配， 则确定所 述用户标识的身份验证通过。
所述一个或者多个模块还具有如下功能：
获取所述用户标识、 所述用户标识的鉴权信息和需要与所述用户标识绑 定的第二位置， 所述第二位置为所述终端设备在本次绑定过程中所处的位置； 向所述服务器发送绑定请求， 所述绑定请求携带有所述用户标识、 所述 用户标识的鉴权信息和所述第二位置， 以便所述服务器根据所述鉴权信息对 所述用户标识进行身份臉证， 并在所述身份臉证通过之后， 将所述用户标识 和所述第二位置进行绑定。
所述一个或者多个模块还具有如下功能： 获取所述用户标识、 所述用户标识的鉴权信息和第三位置， 所述第三位 置为所述终端设备在本次验证过程中所处的位置；
向所述服务器发送普通臉证请求， 所述普通验证请求携带有所述用户标 识、 所述用户标识的鉴权信息和第三位置， 以便所述服务器根据所述鉴权信 息对所述用户标识进行身份验证， 并在所述身份验证通过之后， 将所述第三 位置记录为历史第三位置。
综上所述， 本发明实施例提供的终端设备， 通过获取用户标识和第一位 置， 第一位置为终端设备在本次臉证过程所处的位置； 向服务器发送验证请 求， 以便服务器查询是否存在与用户标识绑定的第二位置； 若存在该第二位 置， 则检测第一位置与第二位置是否匹配； 若第一位置和第二位置匹配， 则 确定用户标识的身份臉证通过。 解决了用户信息一旦被黑客非法获取之后可 能带来的信息泄露或财产损失的问题； 达到了进一步保护用户信息和财产的 安全的效果。 请参考图 15 , 其示出了本发明一个实施例提供的服务器的设备构成图。 所述服务器 1500包括处理器（ CPU ) 1501、 包括随机存取存储器（ RAM ) 1502和只读存储器（ROM ) 1503的系统存储器 1504, 以及连接系统存储器 1504和处理器 1501的系统总线 1505。 所述服务器 1500还包括帮助计算机内 的各个器件之间传输信息的基本输入 /输出系统（I/O系统） 1506, 和用于存储 操作系统 1513、应用程序 1514和其他程序模块 1515的大容量存储设备 1507。
所述基本输入 /输出系统 1506包括有用于显示信息的显示器 1508和用于 用户输入信息的诸如鼠标、 键盘之类的输入设备 1509。 其中所述显示器 1508 和输入设备 1509都通过连接到系统总线 1505的输入输出控制器 1510连接到 处理器 1501。 所述基本输入 /输出系统 1506还可以包括输入输出控制器 1510 以用于接收和处理来自键盘、 鼠标、 或电子触控笔等多个其他设备的输入。 类似地， 输入输出控制器 1510还提供输出到显示屏、 打印机或其他类型的输 出设备。
所述大容量存储设备 1507通过连接到系统总线 1505的大容量存储控制 器（未示出）连接到处理器 1501。 所述大容量存储设备 1507及其相关联的计 算机可读介质为客户端设备 1500提供非易失性存储。 也就是说， 所述大容量 存储设备 1507可以包括诸如硬盘或者 CD-ROM驱动器之类的计算机可读介 质 （未示出）。
不失一般性， 所述计算机可读介质可以包括计算机存储介质和通信介质。 计算机存储介质包括以用于存储诸如计算机可读指令、 数据结构、 程序模块 或其他数据等信息的任何方法或技术实现的易失性和非易失性、 可移动和不 可移动介质。 计算机存储介质包括 RAM、 ROM, EPROM、 EEPROM、 闪存 或其他固态存储其技术， CD-ROM、 DVD或其他光学存储、 磁带盒、 磁带、 磁盘存储或其他磁性存储设备。 当然， 本领域技术人员可知所述计算机存储 介质不局限于上述几种。 上述的系统存储器 1504和大容量存储设备 1507可 以统称为存储器。
根据本发明的各种实施例， 所述服务器 1500还可以通过诸如因特网等网 络连接到网络上的远程计算机运行。 也即服务器 1500可以通过连接在所述系 统总线 1505上的网络接口单元 1511连接到网络 1512, 或者说， 也可以使用 网络接口单元 1511来连接到其他类型的网络或远程计算机系统（未示出）。
所述存储器还包括一个或者一个以上的模块， 所述一个或者一个以上模 块存储于存储器中， 且被配置由一个或多个处理器 1501执行， 所述一个或多 个模块具有如下功能：
接收终端设备发送的验证请求， 所述臉证请求携带有用户标识和第一位 置， 所述第一位置为所述终端设备在本次验证过程所处的位置；
查询是否存在与所述用户标识绑定的第二位置；
若查询到存在与所述用户标识绑定的第二位置， 则检测所述第一位置与 所述第二位置是否匹配；
若检测结果为所述第一位置和所述第二位置匹配， 则确定所述用户标识 的身份验证通过。
所述一个或者多个模块还具有如下功能： 接收所述终端设备发送的绑定请求， 所述绑定请求携带有所述用户标识、 所述用户标识的鉴权信息和需要与所述用户标识绑定的第二位置， 所述第二 位置为用户指定的位置；
根据所述鉴权信息对所述用户标识进行身份验证；
在所述身份臉证通过之后， 将所述用户标识和所述第二位置进行绑定。 所述一个或者多个模块还具有如下功能：
查询所述用户标识在本次绑定之前预定时间段内每次身份验证通过时所 记录的历史位置；
统计查询到的所述历史位置与本次绑定的所述第二位置匹配的次数； 根据所述次数在第一对应关系中查询本次绑定的所述第二位置的绑定有 效期， 和 /或根据所述次数在第二对应关系中查询本次绑定的所述第二位置的 绑定权限范围；
所述将所述用户标识和所述第二位置进行绑定之后， 还包括：
将查询到的所述绑定有效期和 /或所述绑定权限范围确定为所述用户标识 和所述第二位置绑定的绑定有效期和 /或绑定权限范围；
其中， 所述第一对应关系是次数与绑定有效期之间的正相关关系； 所述 第二对应关系是次数与绑定权限范围之间的正相关关系。
若所述历史位置包括历史第三位置， 所述一个或者多个模块还具有如下 功能：
查询在本次绑定之前预定时间段内记录的历史第三位置， 所述历史第三 位置是所述服务器接收所述终端设备发送的携带有所述用户标识、 所述用户 标识的鉴权信息和第三位置的普通臉证请求， 根据所述鉴权信息对所述用户 标识进行身份验证通过之后根据所述第三位置记录的， 所述第三位置为所述 终端设备在普通验证过程中所处的位置。
若所述历史位置包括历史第一位置， 所述一个或者多个模块还具有如下 功能：
查询在本次绑定之前预定时间段内记录的历史第一位置， 所述历史第一 位置是所述服务器通过上一次绑定的第二位置对所述用户标识进行身份验证 通过之后记录的。
所述一个或者多个模块还具有如下功能：
查询所述用户标识与所述第二位置绑定的绑定有效期和 /或绑定权限范 围；
才艮据查询到的所述绑定有效期和 /或绑定权限范围检测所述用户标识和所 述第二位置的绑定是否有效；
若检测结果为所述用户标识和所述第二位置的绑定是否有效， 则确定所 述用户标识的身份验证通过。
若检测结果为所述第一位置和所述第二位置不匹配， 所述一个或者多个 模块还具有如下功能：
向预先存储的与所述用户标识对应的通讯地址发送提醒信息， 所述提醒 信息包括所述第一位置和接收所述臉证请求的时间。
综上所述， 本发明实施例提供的服务器， 通过接收终端设备发送的臉证 请求， 验证请求携带有用户标识和第一位置， 第一位置为用户指定的位置； 检测第一位置与第二位置是否匹配； 若检测结果为第一位置和第二位置匹配， 则确定用户标识的身份臉证通过； 解决了用户信息一旦被黑客非法获取之后 可能带来的信息泄露或财产损失的问题； 达到了进一步保护用户信息和财产 的安全的效果。 上述本发明实施例序号仅仅为了描述， 不代表实施例的优劣。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通 过硬件来完成， 也可以通过程序来指令相关的硬件完成， 所述的程序可以存 储于一种计算机可读存储介质中， 上述提到的存储介质可以是只读存储器， 磁盘或光盘等。
以上所述仅为本发明的较佳实施例， 并不用以限制本发明， 凡在本发明 的精神和原则之内， 所作的任何修改、 等同替换、 改进等， 均应包含在本发 明的保护范围之内。

Claims

权 利 要 求
1、 一种身份验证方法， 其特征在于， 所述方法包括：
接收所述终端设备发送的身份验证请求， 所述身份验证请求携带有用户 标识和第一位置， 所述第一位置为所述终端设备当前所处的位置；
根据所述身份验证请求中的所述第一位置， 检测所述第一位置和与所述 用户标识绑定的第二位置是否匹配； 以及
若所述第一位置与所述第二位置相匹配， 则确定所述用户标识的身份臉 证通过。
2、 根据权利要求 1所述的方法， 其特征在于， 在所述终端设备获取用户 标识和第一位置之前， 还包括：
接收所述终端设备发送的绑定请求， 所述绑定请求携带有所述用户标识、 所述用户标识的鉴权信息和所述第二位置；
根据所述鉴权信息对所述用户标识进行身份验证； 以及
在所述身份验证通过之后， 将所述用户标识和所述第二位置进行绑定。
3. 根据权利要求 2所述的方法， 其特征在于， 在将所述用户标识和所述 第二位置进行绑定之前， 所述方法进一步包括：
将在所述用户标识和所述第二位置进行绑定之前的预订时间段内所述用 户标识通过身份臉证时所述终端设备所处的位置， 记录为历史位置； 以及 统计在所述预订时间段内携带有所述用户标识和所述历史位置的身份验 证请求通过身边臉证的次数。
4. 根据权利要求 3所述的方法， 其特征在于， 所述将所述用户标识和所 述第二位置进行绑定包括：
确定所述第二位置与所述历史位置中的一个相匹配；
查询在所述预订时间段内携带有所述用户标识和所述第二位置的身份臉 证请求通过身份验证的次数； 以及 根据在所述预订时间段内携带有所述用户标识和所述第二位置的身份验 证请求通过身份臉证的次数， 确定所述用户标识绑定到所述第二位置的有效 期， 和 /或所述用户标识绑定到所述第二位置的权限范围。
5. 根据权利要求 2所述的方法， 其特征在于， 在将所述用户标识和所述 第二位置进行绑定之前， 所述方法进一步包括：
将在所述用户标识和所述第二位置进行绑定之前的预定时间段内绑定至 所述用户标识的位置， 确定历史第一位置；
确定在所述历史第一位置与所述用户标识绑定期间， 携带有所述用户标 识和所述历史第一位置的身份验证请求通过身份验证的次数； 以及
根据在所述历史第一位置与所述用户标识绑定期间携带有所述用户标识 和所述历史第一位置的身份臉证请求通过身份臉证的次数， 确定所述用户标 识绑定到所述第二位置的有效期， 和 /或所述用户标识绑定到所述第二位置的 权限范围。
6、 根据权利要求 4或 5的方法， 其特征在于， 所述确定所述用户标识的 身份猃证通过包括：
查询所述用户标识绑定到所述第二位置的有效期和 /或权限范围； 根据查询到的所述有效期和 /或权限范围检测所述用户标识和所述第二位 置的绑定是否有效； 以及
若检测结果为所述用户标识和所述第二位置的绑定有效， 则确定所述用 户标识的身份臉证通过。
7、 根据权利要求 1所述的方法， 其特征在于，
若所述第一位置和所述第二位置不匹配， 则向预先存储的与所述用户标 识对应的通讯地址发送提醒信息， 所述提醒信息包括所述第一位置和接收所 述 证请求的时间。
8. 根据权利要求 1所述的方法， 其特征在于， 在所述接收所述终端设备 发送的身份验证请求之前， 所述方法进一步包括：
所述服务器接收敏感操作请求， 其中所述敏感操作请求包括： 登录请求 和交易请求； 以及
所述服务器返回执行身份验证的提示。
9. 根据权利要求 8所述的方法， 其特征在于， 在所述接收所述终端设备 发送的身份验证请求之前， 所述方法还包括：
所述终端设备根据执行身份臉证的提示， 获取所述用户标识和所述第一 位置。
10. 一种身份臉证装置， 其特征在于， 所述装置包括：
第一接收模块， 用于接收终端设备发送的身份验证请求， 所述身份臉证 请求携带有用户标识和第一位置， 所述第一位置为所述终端设备当前所处的 位置；
第一检测模块， 用于根据所述身份验证请求中的所述第一位置， 检测所 述第一位置和与所述用户标识绑定的第二位置是否匹配； 以及
第一确定模块， 用于当所述第一检测模块的检测结果为所述第一位置和 所述第二位置匹配时， 确定所述用户标识的身份验证通过。
11、 根据权利要求 10所述的装置， 其特征在于， 所述装置还包括： 第二接收模块， 用于接收所述终端设备发送的绑定请求， 所述绑定请求 携带有所述用户标识、 所述用户标识的鉴权信息和所述第二位置；
验证模块， 用于根据所述鉴权信息对所述用户标识进行身份验证； 以及 绑定模块， 用于在所述身份臉证通过之后， 将所述用户标识和所述第二 位置进行绑定。
12、 根据权利要求 11所述的装置， 其特征在于， 所述装置还包括： 历史位置记录模块， 用于将在所述用户标识和所述第二位置进行绑定之 前的预订时间段内所述用户标识通过身份验证时所处的位置， 记录为历史位 置； 以及
历史位置统计模块， 用于统计在所述预订时间段内携带有所述用户标识 和所述历史位置的身份验证请求通过身边验证的次数。
13.根据权利要求 12所述的装置， 其特征在于， 所述装置还包括： 匹配确定模块， 用于确定所述第二位置与所述历史位置中的一个相匹配； 第二位置查询模块， 用于查询在所述预订时间段内携带有所述用户标识 和所述第二位置的身份臉证请求通过身份验证的次数； 以及
第一属性确定模块， 用于根据在所述预订时间段内携带有所述用户标识 和所述第二位置的身份验证请求通过身份验证的次数， 确定所述用户标识绑 定到所述第二位置的有效期， 和 /或所述用户标识绑定到所述第二位置的权限 范围。
14.根据权利要求 11所述的装置， 其特征在于， 所述装置还包括： 历史第一位置确定模块， 用于将在所述用户标识和所述第二位置进行绑 定之前的预定时间段内绑定至所述用户标识的位置， 确定为历史第一位置； 历史第一位置统计模块， 用于确定在所述历史第一位置与所述用户标识 绑定期间， 携带有所述用户标识和所述历史第一位置的身份验证请求通过身 份验证的次数； 以及
第二属性确定模块， 用于根据在所述历史第一位置与所述用户标识绑定 期间携带有所述用户标识和所述历史第一位置的身份验证请求通过身份验证 的次数， 确定所述用户标识绑定到所述第二位置的有效期， 和 /或所述用户标 识绑定到所述第二位置的权限范围。
15. 根据权利要求 13或 14所述的装置， 其特征在于， 所述装置还包括： 第四查询模块和第二检测模块；
所述第四查询模块， 用于查询所述用户标识绑定到所述第二位置的有效 期和 /或权限范围；
所述第二检测模块， 用于根据所述第四查询模块查询到的所述有效期和 / 或权限范围检测所述用户标识和所述第二位置的绑定是否有效； 以及 所述第一确定模块， 用于当所述第二检测模块的检测结果为所述用户标 识和所述第二位置的绑定有效时， 确定所述用户标识的身份险证通过。
16、 根据权利要求 15所述的装置， 其特征在于， 所述装置还包括： 提醒发送模块， 用于当所述第一检测模块的检测结果为所述第一位置和 所述第二位置不匹配时， 向预先存储的与所述用户标识对应的通讯地址发送 提醒信息， 所述提醒信息包括所述第一位置和接收所述验证请求的时间。
17、 根据权利要求 10所述的装置， 其特征在于， 还包括：
敏感请求接收模块， 用于接收敏感操作请求， 其中所述敏感操作请求包 括： 登录请求和交易请求； 以及
身份验证提示发送模块， 用于返回执行身份验证的提示。
18、 一种身份验证系统， 其特征在于， 所述系统包括终端设备和服务器； 所述终端设备包括：
第一获取模块， 用于获取用户标识和第一位置， 所述第一位置为终 端当前所处的地理位置；
第一发送模块， 用于向服务器发送臉证请求， 所述臉证请求携带有 所述第一获取模块获取到的所述用户标识和所述第一位置；
所述服务器包括如权利要求 10至 17任一所述的身份臉证装置； 所述终端设备和所述服务器通过有线或者无线网络进行连接。
PCT/CN2014/086366 2013-09-12 2014-09-12 身份验证方法、身份验证装置和身份验证系统 WO2015035936A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310416556.4A CN104468463B (zh) 2013-09-12 2013-09-12 验证方法、装置和系统
CN201310416556.4 2013-09-12

Publications (1)

Publication Number Publication Date
WO2015035936A1 true WO2015035936A1 (zh) 2015-03-19

Family

ID=52665089

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/086366 WO2015035936A1 (zh) 2013-09-12 2014-09-12 身份验证方法、身份验证装置和身份验证系统

Country Status (2)

Country Link
CN (1) CN104468463B (zh)
WO (1) WO2015035936A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111368273A (zh) * 2020-03-17 2020-07-03 汉海信息技术(上海)有限公司 一种身份验证的方法及装置
CN111935173A (zh) * 2020-08-25 2020-11-13 南方电网科学研究院有限责任公司 一种路由器登录验证方法和装置

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105100096B (zh) * 2015-07-17 2018-07-31 小米科技有限责任公司 验证方法和装置
CN105162775A (zh) * 2015-08-05 2015-12-16 深圳市方迪科技股份有限公司 虚拟机登陆方法及装置
CN106127482A (zh) * 2016-06-30 2016-11-16 联想(北京)有限公司 一种信息处理方法及电子设备
CN107872440B (zh) * 2016-09-28 2020-09-08 腾讯科技（深圳）有限公司 身份鉴权方法、装置和系统
CN107995150B (zh) * 2016-10-27 2020-08-28 腾讯科技（深圳）有限公司 身份验证方法及装置
US10389731B2 (en) * 2016-11-22 2019-08-20 Microsoft Technology Licensing, Llc Multi-factor authentication using positioning data
CN107016042B (zh) * 2017-02-13 2023-07-04 南京安讯科技有限责任公司 一种基于用户位置日志的地址信息校验系统
CN107147687A (zh) * 2017-03-02 2017-09-08 周逸杨 一种云存储系统及方法
CN107734277B (zh) * 2017-09-15 2020-12-15 西北工业大学 一种溯源系统及方法
CN108737360B (zh) * 2017-09-29 2021-05-14 北京猎户星空科技有限公司 机器人的控制方法、装置、机器人设备和存储介质
CN109936525B (zh) 2017-12-15 2020-07-31 阿里巴巴集团控股有限公司 一种基于图结构模型的异常账号防控方法、装置以及设备
RU2724713C1 (ru) * 2018-12-28 2020-06-25 Акционерное общество "Лаборатория Касперского" Система и способ смены пароля учетной записи при наличии угрозы получения неправомерного доступа к данным пользователя
CN113472716B (zh) * 2020-03-30 2023-09-19 中移互联网有限公司 系统访问方法、网关设备、服务器、电子设备及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101626295A (zh) * 2008-07-08 2010-01-13 中国移动通信集团公司 一种网络登录的安全保障方法及其装置和系统
CN101686164A (zh) * 2008-09-24 2010-03-31 华为技术有限公司 无线接入设备的定位方法和位置验证方法及无线接入设备
WO2011006320A1 (zh) * 2009-07-17 2011-01-20 中兴通讯股份有限公司 Ngn中身份标识和位置分离的附着方法及系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7503074B2 (en) * 2004-08-27 2009-03-10 Microsoft Corporation System and method for enforcing location privacy using rights management
JP4676018B2 (ja) * 2007-06-11 2011-04-27 富士通株式会社 移動通信システム、位置登録方法、端末およびホームエージェント

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101626295A (zh) * 2008-07-08 2010-01-13 中国移动通信集团公司 一种网络登录的安全保障方法及其装置和系统
CN101686164A (zh) * 2008-09-24 2010-03-31 华为技术有限公司 无线接入设备的定位方法和位置验证方法及无线接入设备
WO2011006320A1 (zh) * 2009-07-17 2011-01-20 中兴通讯股份有限公司 Ngn中身份标识和位置分离的附着方法及系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111368273A (zh) * 2020-03-17 2020-07-03 汉海信息技术(上海)有限公司 一种身份验证的方法及装置
CN111368273B (zh) * 2020-03-17 2023-06-20 汉海信息技术(上海)有限公司 一种身份验证的方法及装置
CN111935173A (zh) * 2020-08-25 2020-11-13 南方电网科学研究院有限责任公司 一种路由器登录验证方法和装置

Also Published As

Publication number Publication date
CN104468463A (zh) 2015-03-25
CN104468463B (zh) 2019-05-28

Similar Documents

Publication Publication Date Title
WO2015035936A1 (zh) 身份验证方法、身份验证装置和身份验证系统
US11159501B2 (en) Device identification scoring
CN105306204B (zh) 安全验证方法、装置及系统
CN109600223B (zh) 验证方法、激活方法、装置、设备及存储介质
EP2761429B1 (en) Policy compliance-based secure data access
CN111475841B (zh) 一种访问控制的方法、相关装置、设备、系统及存储介质
US9628482B2 (en) Mobile based login via wireless credential transfer
US9325687B2 (en) Remote authentication using mobile single sign on credentials
KR101214839B1 (ko) 인증 방법 및 그 시스템
CN110300083B (zh) 一种获取身份信息的方法、终端及验证服务器
WO2017084288A1 (zh) 身份验证方法及装置
US20230353363A1 (en) Login authentication method, apparatus, and system
US11017066B2 (en) Method for associating application program with biometric feature, apparatus, and mobile terminal
WO2015062425A1 (en) User identity verification method and system, password protection apparatus and storage medium
US20120297470A1 (en) Access authentication method for multiple devices and platforms
WO2020024929A1 (zh) 对电子身份证的业务适用范围进行升级的方法和终端设备
CN106255102B (zh) 一种终端设备的鉴定方法及相关设备
WO2018161777A1 (zh) 一种身份验证的方法、终端设备、服务器和存储介质
CN110418311A (zh) 一种基于多个终端的互联方法、装置及终端
WO2018153288A1 (zh) 数值转移方法、装置、设备及存储介质
US20230063417A1 (en) System and method for forwarding authentication requests to a nearby authenticator
CN108234113A (zh) 身份验证方法、装置与系统
CN108234409A (zh) 身份验证方法与装置
CN106534149A (zh) Dns防劫持方法和装置、以及终端和服务器
EP2645275A1 (en) Method, device and system for accessing a service

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14844945

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC ( EPO FORM 1205A DATED 29/07/2016 )

122 Ep: pct application non-entry in european phase

Ref document number: 14844945

Country of ref document: EP

Kind code of ref document: A1