WO2016062204A1 - 一种可信终端验证方法、装置 - Google Patents

一种可信终端验证方法、装置 Download PDF

Info

Publication number
WO2016062204A1
WO2016062204A1 PCT/CN2015/091694 CN2015091694W WO2016062204A1 WO 2016062204 A1 WO2016062204 A1 WO 2016062204A1 CN 2015091694 W CN2015091694 W CN 2015091694W WO 2016062204 A1 WO2016062204 A1 WO 2016062204A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
login
user
trusted
login account
Prior art date
Application number
PCT/CN2015/091694
Other languages
English (en)
French (fr)
Inventor
梁建国
蒋佩伶
Original Assignee
阿里巴巴集团控股有限公司
梁建国
蒋佩伶
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 梁建国, 蒋佩伶 filed Critical 阿里巴巴集团控股有限公司
Priority to JP2017521133A priority Critical patent/JP6715242B2/ja
Priority to SG11201703304TA priority patent/SG11201703304TA/en
Priority to EP15851892.8A priority patent/EP3211825B1/en
Priority to KR1020177014021A priority patent/KR102167602B1/ko
Publication of WO2016062204A1 publication Critical patent/WO2016062204A1/zh
Priority to US15/495,894 priority patent/US10673851B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/316—User authentication by observing the pattern of computer usage, e.g. typical user behaviour
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M1/00—Substation equipment, e.g. for use by subscribers
    • H04M1/72—Mobile telephones; Cordless telephones, i.e. devices for establishing wireless links to base stations without route selection
    • H04M1/724—User interfaces specially adapted for cordless or mobile telephones
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2129—Authenticate client device independently of the user
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2135—Metering

Definitions

  • the present application relates to the field of terminal technologies, and in particular, to a trusted terminal verification method and apparatus.
  • the modification information involved in the sensitive operation is mostly User private information, so the user identity authentication process will be more strict when users are sensitive.
  • the user when the user is performing a sensitive operation, the user can upload the document information and answer the generated reservation question on the page, and then the customer service personnel manually check the user-updated document information and then make a telephone return visit. Only the above authentication is performed. After passing, the user will be allowed to perform the above sensitive operations.
  • the login terminal used by the user can be authenticated.
  • the login terminal through which the authentication is passed is a trusted terminal for the user.
  • the user may not repeat the user. Certification or only simpler certification.
  • the authentication of the user's login terminal is performed by the user's transaction information, the IP address, and the login time period.
  • the above method is used. Can not meet user needs.
  • the present application provides a method and apparatus for authenticating a trusted terminal.
  • the application provides a trusted terminal verification method, where the method includes:
  • the method further includes:
  • the trusted terminal When the trusted terminal is identified as a handheld terminal, the trusted terminal is locally classified as a handheld trusted terminal;
  • the trusted terminal When it is determined that the trusted terminal is a PC terminal, determining whether the common time period of the trusted terminal is an office time period or a home time period;
  • the trusted terminal When the common time period of the trusted terminal is an office time period, the trusted terminal is locally classified as an office trusted terminal;
  • the trusted terminal When the common time period of the trusted terminal is a home time period, the trusted terminal is locally classified as a home trusted terminal.
  • the method further includes:
  • the login terminal is a non-trusted terminal of the user.
  • determining whether the login account of the user is associated with the common login account of the login terminal includes:
  • the common login account is a login account whose login number reaches a threshold in the historical login account of the login terminal;
  • the same trusted terminal is the same home trusted terminal.
  • the application provides a trusted terminal verification apparatus, where the apparatus includes:
  • a first determining module configured to determine whether the login terminal of the user matches the trusted terminal of the local record
  • a second determining module configured to determine, when the login terminal does not match the trusted terminal of the local record, whether the login account of the user is associated with a common login account of the login terminal; if yes, determining the login terminal A trusted terminal for the user.
  • the device further includes:
  • a categorization module configured to identify, according to hardware information of the trusted terminal, a terminal type of the trusted terminal, before the first determining module determines whether the login terminal of the user matches the trusted terminal of the user recorded locally;
  • the trusted terminal When the trusted terminal is identified as a handheld terminal, the trusted terminal is locally classified as a handheld trusted terminal;
  • the trusted terminal When it is determined that the trusted terminal is a PC terminal, determining whether the common time period of the trusted terminal is an office time period or a home time period;
  • the trusted terminal When the common time period of the trusted terminal is an office time period, the trusted terminal is locally classified as an office trusted terminal;
  • the trusted terminal When the common time period of the trusted terminal is a home time period, the trusted terminal is locally classified as a home trusted terminal.
  • the second determining module is specifically configured to:
  • determining whether the login account of the user is associated with the common login account of the login terminal determining whether the login number of the login account of the user on the login terminal reaches a threshold
  • the login terminal is a non-trusted terminal of the user.
  • the second determining module is specifically configured to:
  • the common login account is a login account whose login number reaches a threshold in the historical login account of the login terminal;
  • the same trusted terminal is the same home trusted terminal.
  • the application provides a trusted terminal verification apparatus, including:
  • processor a memory for storing the processor executable instructions
  • processor is configured to:
  • the login terminal is a trusted terminal of the user.
  • the present application is based on the authentication scheme of the login terminal in the existing implementation.
  • the association between the login account and the commonly used login account of the login terminal is introduced.
  • it is determined that the login account of the user is associated with the common login account of the login terminal it is determined that the login terminal is a trusted terminal of the user.
  • the application scenario in which the login terminal is used between users is avoided, and the login terminal is prevented from being complicated. Repeated certification.
  • FIG. 1 is a flowchart of a method for verifying a trusted terminal according to an embodiment of the present application
  • FIG. 2 is a flowchart of another trusted terminal verification method according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a server providing authentication to a login terminal of a user according to an embodiment of the present application
  • FIG. 4 is a process flowchart of a terminal analysis system according to an embodiment of the present application.
  • FIG. 5 is a flowchart of processing of a user authentication system according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a logical structure of a trusted terminal verification apparatus according to an embodiment of the present application.
  • first, second, third, etc. may be used to describe various information in this application, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information without departing from the scope of the present application.
  • second information may also be referred to as the first information.
  • word "if” as used herein may be interpreted as "when” or “when” or “response” For confirmation.”
  • the current implementation is still performed by the server, and the login terminal is authenticated by the hardware information of the login terminal.
  • the terminal records the login terminal as the trusted terminal of the user locally.
  • the login terminal of the user is not repeatedly authenticated or only simple authentication is performed.
  • a common login terminal uses a common login terminal to log in to a payment account
  • the login terminal is authenticated according to the above method, it is usually based on the user's login information, such as the user's transaction information, IP address, and login time period. The authentication is performed. Therefore, when different family members use the same login terminal to log in to their own payment account, the server authenticates the login terminal one by one for different family members.
  • the server does not need to authenticate the login terminals one by one for different family members.
  • the present application is based on the technical solution for authenticating a login terminal in the prior art, by introducing a determination of the association between the login account and the commonly used login account of the login terminal in the process of authenticating the login terminal.
  • the login account of the user is associated with the common login account of the login terminal, it is determined that the login terminal is a trusted terminal of the user.
  • the application scenario in which the login terminal is used by the user is used.
  • the association between the login account of the user and the common login account of the login terminal is used to determine whether the login terminal is the trusted terminal of the user. Therefore, complicated repeated authentication of the login terminal is avoided.
  • FIG. 1 is a method for verifying a trusted terminal according to an embodiment of the present disclosure.
  • the method may include a server.
  • the method includes the following steps:
  • Step 101 Determine whether the login terminal of the user matches the trusted terminal of the user recorded locally;
  • the server may obtain the hardware information of the login terminal, and then the hardware information of the terminal and the user record recorded in the database.
  • the hardware information of the terminal is matched in sequence. If the matching is performed, it indicates that the login terminal is a trusted terminal for the user; on the contrary, if there is no match, it indicates that the login terminal is a non-trusted terminal for the user, and the server
  • the untrusted terminal can record only the hardware information of the terminal and the number of times the user uses the terminal to log in.
  • the server When the server authenticates the login terminal for the user, the server can still perform authentication according to the login information of the user, such as the transaction information, the IP address, and the login time period of the user. After the authentication is passed, the login terminal can be locally used. Recorded as the user's trusted terminal. In addition, the server can also classify trusted terminals that have been recorded locally according to the terminal type.
  • the server can divide the locally recorded trusted terminal into a handheld trusted terminal, a home trusted terminal, and an office available terminal according to the terminal type and the common time period of the trusted terminal. If the trusted terminal is a handheld terminal, the server can directly classify the trusted terminal as a handheld trusted terminal. When the trusted terminal is identified as a PC terminal, the server can further determine the Whether the common time period of the trusted terminal is the office time period or the home time period; if it is the home time period, the server can directly classify the trusted terminal as a home trusted terminal; if it is the office time period, The server can directly classify the trusted terminal as an office trusted terminal.
  • the hardware information of the login terminal may include different information according to the type of the terminal of the login terminal; for example, if the login terminal is a PC terminal, the hardware information may include a motherboard MAC of the PC, a network card MAC, and an operating system. And the like; if the login terminal is a mobile phone terminal, the hardware information may include hardware information of the mobile phone accessory, a mobile phone system, and the like.
  • Step 102 When it is determined that the login terminal does not match the trusted terminal of the user recorded locally, it is determined whether the login account of the user is associated with a common login account of the login terminal.
  • Step 103 if yes, determining that the login terminal is a trusted terminal of the user.
  • the login terminal of the user when the login terminal of the user is the trusted terminal of the user recorded locally by the server, the login terminal may not perform complex duplicate authentication or simple authentication; instead, when the login terminal of the user is not When the server locally records the trusted terminal of the user, the service The server can further obtain the login account of the user, and the historical login account of the login terminal, and further determine whether the login terminal is associated with the historical login account of the login terminal, and further confirm whether the login terminal is the user. Trusted terminal.
  • the server can determine the commonly used login account in the obtained historical login account; for example, the login account whose number of logins in the historical login account reaches the threshold can be used as the common login account.
  • the server can query the local database to determine whether the common login account has been logged in with the login account used by the user for the current login, and the number of logins reaches the threshold; If yes, it indicates that the login account used by the user for the current login is highly correlated with the common login account of the login terminal, and the server can directly determine that the login terminal is the trusted terminal of the user.
  • the same trusted terminal when it is determined whether the common login account and the login account used by the user for the current login have been logged in on the same trusted terminal, the same trusted terminal may be the same household. Letter terminal.
  • the common login account and the login account used by the user for the current login are logged in on the same home trusted terminal, and the number of logins reaches the threshold, the user corresponding to the common login account is very It may be a family relationship, so for this case, it can be directly determined that the login terminal is a trusted terminal of the user.
  • the server can separately obtain the commonly used login account of each home trusted terminal, and then establish the family relationship data according to the obtained common login account.
  • the server can directly query the established login. Family relationship data to confirm whether the currently logged in user is a family relationship with the user who frequently uses the logged in terminal.
  • the same trusted terminal may also be the same handheld trusted terminal or office. Trusted terminal.
  • the server may further perform screening on the user to determine the common users of the login terminal, and perform association between the login accounts only for the common users. Sexual judgment.
  • the server can also determine the login of the login account of the user on the login terminal. Whether the number of times reaches the threshold; if yes, it indicates that the user is a common user, and can continue to determine whether the login account of the user is associated with a common login account of the login terminal; if not, indicating that the user is a very useful user, It is determined that the login terminal is a non-trusted terminal of the user. For example, if the same trusted terminal is the same home trusted terminal, if the number of logins by the user using the home trusted login terminal is less than the threshold, for example, only once, the user is likely to be only visiting. For the user, the server does not make sense to perform the association determination between the login accounts. Therefore, the login terminal can be directly determined to be the non-trusted terminal of the user.
  • the server introduces the association between the login account and the commonly used login account of the login terminal in the process of authenticating the login terminal, and determines the login account and the common login terminal of the user.
  • the login account is associated, it is determined that the login terminal is a trusted terminal of the user.
  • the application scenario in which the login terminal is used by the user is used.
  • the association between the login account of the user and the common login account of the login terminal is used to determine whether the login terminal is the trusted terminal of the user. Therefore, complicated repeated authentication of the login terminal is avoided.
  • FIG. 2 is a method for verifying a trusted terminal according to an embodiment of the present disclosure.
  • the method may include a server.
  • the method includes the following steps:
  • Step 201 Determine whether the login terminal of the user matches the trusted terminal of the user recorded locally;
  • step 202 when it is determined that the login terminal does not match the trusted terminal of the local record, the common login account of the login terminal is queried; wherein the common login account is the historical login account of the login terminal.
  • the login account whose number reaches the threshold;
  • Step 203 Determine whether the login account of the user and the common login account have been logged in on the same trusted terminal, and the number of logins reaches a threshold; if yes, determine that the login account of the user is related to the commonly used login account. Linking, and locally storing the association relationship between the login account of the user and the historical login account.
  • Step 204 When it is determined that the login account of the user is associated with the common login account, It is determined that the login terminal is a trusted terminal of the user.
  • the server may obtain the hardware information of the login terminal, and then the hardware information of the terminal and the user record recorded in the database.
  • the hardware information of the terminal is matched in sequence. If the matching is successful, the current login terminal is a trusted terminal for the user; if not, the login terminal is a non-trusted terminal for the user.
  • the server can only record the hardware information of the terminal and the number of times the user uses the terminal to log in.
  • the server can still perform the authentication scheme for logging in to the user in the existing implementation. For example, the server can still authenticate the login terminal of the user according to the login information of the user, such as the transaction information, the IP address, and the login time of the user. After the authentication is passed, the login terminal can be locally recorded as the user. Letter terminal.
  • the server can complete the above process of authenticating the login terminal of the user by dividing the local authentication system into different subsystems and the different subsystems cooperate with each other.
  • the subsystem after the authentication system of the server is completed may include a user operating system, a user authentication system, and a terminal analysis system. It should be noted that the above division of the authentication system of the server is merely exemplary and is not intended to limit the present invention.
  • the user operating system is configured to record operations of the user, such as login, logout, transfer, user information modification, login times, etc. of the user logging in to the Alipay system, and save the recorded user operations to the database; the user operating system It is also used to obtain the user's operating environment, such as the hardware information of the user's login terminal, and transmit the acquired hardware information of the user's login terminal to the terminal analysis system for analysis.
  • the user operating system can analyze the user's operating environment when the user operates, obtain the hardware information of the user's login terminal, perform modeling according to the acquired hardware information, and transmit the modeled hardware information model to the terminal analysis system. Analyze.
  • the hardware information of the login terminal may include different information according to the type of the terminal of the login terminal; for example, if the login terminal is a PC terminal, the hardware information may include information such as a motherboard MAC, a network card MAC, an operating system, and the like of the PC; if the login terminal is a mobile terminal, the hardware information may include hardware information of the mobile phone accessory, and the mobile phone Information such as the system.
  • the terminal analysis system is configured to analyze the login terminal of the user according to the hardware information model transmitted by the user operating system, authenticate the login terminal of the user according to the analysis result, and authenticate the authenticated terminal of the user in the database. Save in.
  • the terminal analysis system can also classify the trusted terminals recorded in the database according to the terminal type.
  • the terminal analysis system can still analyze the login terminal according to the login information of the user, such as the transaction information, the IP address, and the login time period of the user, and authenticate the login terminal of the user according to the analysis result.
  • the login terminal can be locally recorded in the local database as the trusted terminal of the user.
  • the terminal analysis system may be divided into a handheld trusted terminal, a home trusted terminal, and an office available terminal according to the terminal type.
  • the terminal analysis system may directly classify the trusted terminal as a handheld trusted terminal; if the trusted device is identified according to the hardware information When the terminal is a PC terminal, the terminal analysis system may further determine whether the common time period of the trusted terminal is an office time period or a home time period; if it is a home time period, the terminal analysis system may directly directly locate the trusted terminal. It is classified as a home trusted terminal; if it is an office time period, the terminal analysis system can directly classify the trusted terminal locally as an office trusted terminal.
  • the login terminal For the login terminal that is not affiliated with any one of the home trusted terminal, the office trusted terminal, and the handheld trusted terminal, the login terminal can be classified as another terminal locally. Since the other terminals are not trusted terminals at this time, they may not be stored in the database.
  • the user authentication system is configured to invoke the database to authenticate the login terminal of the user.
  • the user authentication system can invoke the database to connect the hardware of the user's login terminal.
  • the information is matched with the hardware information of the trusted terminal of the user recorded in the database. If the corresponding information is matched, the login terminal may be determined as the trusted terminal of the user, and the user may not log in to the login terminal. Repeat certification or just simple authentication.
  • the user authentication system may further call the database, obtain the login account of the user, and the historical login account of the login terminal, and determine the login of the user. Whether the account is associated with the historical login account of the login terminal to determine whether the login terminal is a trusted terminal of the user.
  • the user authentication system may use the login account whose number of logins in the historical login account reaches the threshold as a common login account, and then query the database to determine whether the commonly used login account is the login account used by the user to log in this time. Whether the login has been performed on the same trusted terminal, and the number of logins reaches the threshold; if yes, it indicates that the login account used by the user for this login has a very high correlation with the commonly used login account of the login terminal, then the server can directly It is determined that the login terminal is the trusted terminal of the user. When the user logs in through the terminal and performs a sensitive operation, the user may not be repeatedly authenticated or simply authenticated.
  • the same trusted terminal when it is determined whether the common login account and the login account used by the user for the current login have been logged in on the same trusted terminal, the same trusted terminal may be the same household. Letter terminal.
  • the user authentication system can directly determine that the login terminal is a trusted terminal of the user.
  • the user authentication system can separately query the database for the commonly used login account of each home trusted terminal, and then obtain the obtained home account relationship between the user and the common login account.
  • the common login account is used to establish family relationship data.
  • the established family relationship data can be directly queried to confirm the current login. Whether the user is a family member with the user who frequently uses the login terminal.
  • the same trusted terminal may also be the same handheld trusted terminal or an office trusted terminal.
  • the user authentication system may notify the terminal analysis system that the login terminal is recorded in the database as the The trusted terminal of the user is classified into a handheld trusted terminal or an office trusted terminal in the database, and will not be described again.
  • the server determines the association between the login account and the common login account of the login terminal in the process of authenticating the login terminal, and determines the login account of the user and the common login of the login terminal.
  • the account is associated, it is determined that the login terminal is a trusted terminal of the user.
  • the application scenario in which the login terminal is used by the user is used.
  • the association between the login account of the user and the common login account of the login terminal is used to determine whether the login terminal is the trusted terminal of the user. Therefore, complicated repeated authentication of the login terminal is avoided.
  • the server before the server performs the association determination between the login accounts, the server may further perform screening on the user to determine the login terminal. Commonly used users only perform the correlation judgment between the above login accounts for common users.
  • the user authentication system may further determine whether the login number of the login account of the user on the login terminal reaches a threshold; if yes, indicating that the user is a common user, may continue to determine whether the login account of the user is The common login account of the login terminal is associated; if not, the user is a very useful user, and the user authentication system can directly determine that the login terminal is a non-trusted terminal of the user.
  • the same trusted terminal is the same home trusted terminal
  • a threshold for example, only once
  • the user authentication system it is meaningless for the user authentication system to perform the association determination between the login accounts. Therefore, the user authentication system can directly determine that the login terminal is the non-trusted terminal of the user.
  • the present application also provides an embodiment of a trusted terminal verification apparatus.
  • the device may be run on a server as a running carrier of the device of the present application.
  • the server usually includes at least a CPU, a memory, and a non-volatile memory, and may also include hardware such as an I/O interface.
  • FIG. 6 is a schematic diagram of a logical structure of a trusted terminal verification apparatus according to an exemplary embodiment of the present application.
  • the apparatus 60 includes:
  • the first determining module 601 is configured to determine whether the login terminal of the user matches the trusted terminal that is locally recorded;
  • the second determining module 602 is configured to determine, when the login terminal does not match the trusted terminal that is locally recorded, whether the login account of the user is associated with the common login account of the login terminal; if yes, determine the login The terminal is a trusted terminal of the user.
  • the device 60 further includes:
  • the categorization module 603 is configured to identify, according to the hardware information of the trusted terminal, the terminal type of the trusted terminal, before the first determining module determines whether the login terminal of the user matches the locally recorded trusted terminal of the user;
  • the trusted terminal When the trusted terminal is identified as a handheld terminal, the trusted terminal is locally classified as a handheld trusted terminal;
  • the trusted terminal When it is determined that the trusted terminal is a PC terminal, determining whether the common time period of the trusted terminal is an office time period or a home time period;
  • the trusted terminal When the common time period of the trusted terminal is an office time period, the trusted terminal is locally classified as an office trusted terminal;
  • the trusted terminal When the common time period of the trusted terminal is a home time period, the trusted terminal is locally classified as a home trusted terminal.
  • the second determining module 602 is specifically configured to:
  • determining whether the login account of the user is associated with the common login account of the login terminal determining whether the login number of the login account of the user on the login terminal reaches a threshold
  • the login terminal is a non-trusted terminal of the user.
  • the second determining module 602 is specifically configured to:
  • the common login account is a login account whose login number reaches a threshold in the historical login account of the login terminal;
  • the same trusted terminal may be the same home trusted terminal.
  • the device embodiment since it basically corresponds to the method embodiment, reference may be made to the partial description of the method embodiment.
  • the device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separate, and the components displayed as modules may or may not be physical modules, ie may be located A place, or it can be distributed to multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the objectives of the present application. Those of ordinary skill in the art can understand and implement without any creative effort.
  • the application also provides an embodiment of a server.
  • the server includes: a processor, and a memory for storing the processor executable instructions;
  • the server may also include an input/output interface, a network interface, various hardware, and the like.
  • the server can be configured to:
  • the login terminal is a trusted terminal of the user.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Power Engineering (AREA)
  • General Health & Medical Sciences (AREA)
  • Social Psychology (AREA)
  • Health & Medical Sciences (AREA)
  • Human Computer Interaction (AREA)
  • Information Transfer Between Computers (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Storage Device Security (AREA)

Abstract

本申请提供一种可信终端验证方法，所述方法包括：判断用户的登录终端是否匹配本地记录的该用户的可信终端；当判断出所述登录终端不匹配本地记录的该用户的可信终端时，判断所述用户的登录账号与所述登录终端的常用登录账号是否相关联；如果是，判定所述登录终端为该用户的可信终端。通过本申请的技术方案可以实现在用户之间交叉使用登录终端的应用场景中，避免对该登录终端进行复杂的重复认证。

Description

一种可信终端验证方法、装置 技术领域
本申请涉及终端技术领域，尤其涉及一种可信终端验证方法和装置。
背景技术
对于像类似于支付宝这样的安全性要求较高的支付应用中，当用户需要进行重置密码，修改用户预留的联系手机，修改登录名等敏感操作时，由于敏感操作涉及的修改信息多为用户私密信息，因此用户在进行敏感操作时，用户身份认证过程将会更加严格。
例如，当用户在进行敏感操作时，可以由用户上传证件信息，并在页面上回答生成的预留问题，然后再由客服人员对用户上传的证件信息进行人工审核后做电话回访，只有上述认证都通过后才会允许用户进行上述的敏感操作。
然而在上述方案中，如果所有用户进行敏感操作时都需要执行上述严格的身份认证过程，那么对用户上传的证件进行审核以及电话回访都需要较大的人力成本。而且，如果用户每进行一次敏感操作都需要重新进行一次较为严格的身份认证的话，会影响用户体验。
为了解决上述问题，可以对用户所使用的登录终端进行认证，认证通过的登录终端对于该用户来说是可信终端，当用户使用可信终端登录并进行敏感操作时，可以不对该用户进行重复认证或者只进行较简单的认证。
当前对用户的登录终端进行认证，多是通过用户的交易信息、IP地址、登录时间段进行认证，然而对一些特殊的应用场景，比如用户之间交叉使用登录终端的应用场景中，上述方法已不能满足用户需求。
发明内容
为克服背景技术中存在的问题，本申请提供一种在可信终端验证方法和装置。
根据本申请实施例的第一方面，本申请提出一种可信终端验证方法，所述方法包括：
判断用户的登录终端是否匹配本地记录的该用户的可信终端；
当判断出所述登录终端不匹配本地记录的该用户的可信终端时，判断所述用户的登录账号与所述登录终端的常用登录账号是否相关联；
如果是，判定所述登录终端在本地记录为该用户的可信终端。
可选的，所述判断用户的登录终端是否匹配本地记录的该用户的可信终端之前，所述方法还包括：
根据所述可信终端的硬件信息识别所述可信终端的终端类型；
当识别出所述可信终端为手持终端时，将所述可信终端在本地归类为手持可信终端；
当识别出所述可信终端为PC终端时，判断所述可信终端的常用时间段是否为办公时间段或家用时间段；
当所述可信终端的常用时间段为办公时间段时，将所述可信终端在本地归类为办公可信终端；
当所述可信终端的常用时间段为家用时间段时，将所述可信终端在本地归类为家用可信终端。
可选的，所述判断用户的登录账号是否与所述登录终端的常用登录账号相关联之前，所述方法还包括：
判断所述用户的登录账号在所述登录终端上的登入次数是否达到阈值；
如果是，继续判断所述用户的登录账号是否与所述登录终端的常用登录账号相关联；
如果否，判定所述登录终端为该用户的非可信终端。
可选的，所述判断用户的登录账号与所述登录终端的常用登录账号是否相关联包括：
查询所述登录终端的常用登录账号；其中所述常用登录账号为所述登录终端的历史登录账号中登入次数达到阈值的登录账号；
判断所述用户的登录账号与所述常用登录账号是否曾在同一可信终端上登录，并且登录次数均达到阈值；
如果是，确定所述用户的登录账号与所述常用登录账号相关联，并在本地保存所述用户的登录账号与所述历史登录账号之间的关联关系。
可选的，所述同一可信终端为同一家用可信终端。
根据本申请实施例的第二方面，本申请提出一种可信终端验证装置，所述装置包括：
第一判断模块，用于判断用户的登录终端是否匹配本地记录的可信终端；
第二判断模块，用于在判断出所述登录终端不匹配本地记录的可信终端时，判断用户的登录账号与所述登录终端的常用登录账号是否相关联；如果是，判定所述登录终端为该用户的可信终端。
可选的，所述装置还包括：
归类模块，用于在第一判断模块判断用户的登录终端是否匹配本地记录的该用户的可信终端之前，根据所述可信终端的硬件信息识别所述可信终端的终端类型；
当识别出所述可信终端为手持终端时，将所述可信终端在本地归类为手持可信终端；
当识别出所述可信终端为PC终端时，判断所述可信终端的常用时间段是否为办公时间段或家用时间段；
当所述可信终端的常用时间段为办公时间段时，将所述可信终端在本地归类为办公可信终端；
当所述可信终端的常用时间段为家用时间段时，将所述可信终端在本地归类为家用可信终端。
可选的，所述第二判断模块具体用于：
在判断用户的登录账号与所述登录终端的常用登录账号是否相关联之前，判断所述用户的登录账号在所述登录终端上的登入次数是否达到阈值；
如果是，继续判断所述用户的登录账号是否与所述登录终端的常用登录账号相关联；
如果否，判定所述登录终端为该用户的非可信终端。
可选的，所述第二判断模块具体用于：
查询所述登录终端的常用登录账号；其中所述常用登录账号为所述登录终端的历史登录账号中登入次数达到阈值的登录账号；
判断所述用户的登录账号与所述常用登录账号是否曾在同一可信终端上登录，并且登录次数均达到阈值；
如果是，确定所述用户的登录账号与所述常用登录账号相关联，并在本地保存所述用户的登录账号与所述历史登录账号之间的关联关系。
可选的，所述同一可信终端为同一家用可信终端。
根据本申请实施例的第三方面，本申请提出一种可信终端验证装置，包括：
处理器；用于存储所述处理器可执行指令的存储器；
其中，所述处理器被配置为：
判断用户的登录终端是否匹配本地记录的该用户的可信终端；
当判断出所述登录终端不匹配本地记录的该用户的可信终端时，判断用户的登录账号与所述登录终端的常用登录账号是否相关联；
如果是，判定所述登录终端为该用户的可信终端。
本申请基于现有实现中对登录终端的认证方案，通过在判断用户的登录终端是否为该用户的可信终端时，引入了对登录账号与登录终端的常用登录账号之间的关联性判断，当判断出用户的登录账号与登录终端的常用登录账号相关联时，则判定该登录终端为该用户的可信终端。通过该方案，可以实现在用户之间交叉使用登录终端的应用场景中，避免对该登录终端进行复杂 的重复认证。
附图说明
图1是本申请一实施例提供的一种可信终端验证方法的流程图；
图2是本申请一实施例提供的另一种可信终端验证方法的流程图；
图3是本申请一实施例提供的服务器对用户的登录终端进行认证的示意图；
图4是本申请一实施例提供的终端分析系统的处理流程图；
图5是本申请一实施例提供的用户认证系统的处理流程图；
图6是本申请一实施例提供的一种可信终端验证装置的逻辑结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在本申请使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请。在本申请和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应 于确定”。
对于用户之间交叉使用登录终端登录支付账号的应用场景中，目前的实现方式仍然是通过服务端，结合该登录终端的硬件信息对所有的用户的登录终端分别进行认证，当认证成功后，服务端在本地将该登录终端记录为该用户的可信终端，当用户使用可信终端进行敏感操作时，不对该用户的登录终端进行重复认证或者只进行简单的认证。
然而，上述方案中会存在如下问题：
例如，以家人之间使用共同的登录终端登录支付账号的应用场景为例，按照上述方法对登录终端进行认证时，通常是基于用户的登录信息，比如用户的交易信息、IP地址以及登录时间段等进行认证，因此不同的家庭成员使用同一个登录终端登录自己的支付账号时，服务端会对不同的家庭成员逐一进行登录终端的认证。
然而，由于家庭成员之间的信任程度通常很高，因此当家庭成员之间使用同一个登录终端登录自己的支付账号时，服务端对不同的家庭成员对逐一进行登录终端的认证完全没有必要。
有鉴于此，本申请基于现有技术中对登录终端进行认证的技术方案，通过在对登录终端进行认证的过程中，引入对登录账号与登录终端的常用登录账号之间的关联性的判断，当判断出用户的登录账号与登录终端的常用登录账号相关联时，则判定该登录终端为该用户的可信终端。
通过该方案，实现了在用户之间交叉使用登录终端的应用场景中，可以通过用户的登录账号与登录终端的常用登录账号之间的关联性来判断该登录终端是否为该用户的可信终端，从而避免了对该登录终端进行复杂的重复认证。
下面通过具体实施例并结合不同应用实例对本申请进行描述。
请参考图1，图1是本申请一实施例提供的一种可信终端验证方法，该方法的执行主体可以为服务端；所述方法包括以下步骤：
步骤101，判断用户的登录终端是否匹配本地记录的该用户的可信终端；
在该步骤中，在判断该用户的登录终端是否为该用户的可信终端时，服务端可以通过获取该登录终端的硬件信息，然后将该终端的硬件信息与数据库中记录的该用户的可信终端的硬件信息依次进行匹配，如果匹配上了，表明当前该登录终端对于该用户为可信终端；相反，如果没有匹配上，表明该登录终端对于该用户为非可信终端，服务端对于非可信终端可以只记录该终端的硬件信息以及用户使用该终端进行登录的次数。
其中，服务端在针对用户进行登录终端的认证时，仍然可以根据用户的登录信息，比如用户的交易信息、IP地址以及登录时间段等进行认证，当认证通过后，可以在本地将该登录终端记录为用户的可信终端。另外，服务端对于已在本地记录的可信终端，还可以根据终端类型进行分类。
例如，服务端可以根据终端类型以及该可信终端的常用时间段，将本地记录的可信终端划分为手持可信终端，家用可信终端和办公可用终端。如果所述可信终端为手持终端时，服务端可以直接将该类可信终端在本地归类为手持可信终端；当识别出所述可信终端为PC终端时，服务端可以进一步判断该类可信终端的常用时间段是否为办公时间段或家用时间段；如果为家用时间段，服务端可以直接将该类可信终端在本地归类为家用可信终端；如果为办公时间段，服务端可以直接将该类可信终端在本地归类为办公可信终端。
所述登录终端的硬件信息，根据登录终端的终端类型的不同可以包含不同的信息；例如，如果所述登录终端为PC终端，那么所述硬件信息可以包括PC的主板MAC，网卡MAC，操作系统等信息；如果所述登录终端为手机终端，那么所述硬件信息可以包括手机配件的硬件信息，手机系统等信息。
步骤102，当判断出所述登录终端不匹配本地记录的该用户的可信终端时，判断所述用户的登录账号与所述登录终端的常用登录账号是否相关联；
步骤103，如果是，判定所述登录终端为该用户的可信终端。
在以上步骤中，当用户的登录终端为服务端在本地记录的该用户的可信终端时，可以不对该登录终端进行复杂的重复认证或者只进行简单的认证；相反，当用户的登录终端不是服务端在本地记录的该用户的可信终端时，服 务端可以进一步获取该用户的登录账号，以及所述登录终端的历史登陆账号，通过判断该用户的登录账号与该登录终端的历史登录账号是否关联，来进一步确认该登录终端是否为该用户的可信终端。
具体的，服务端可以在获取到的历史登录账号中确定出常用登录账号；例如，可以将所述历史登录账号中登录次数达到阈值的登录账号作为常用登录账号。当确认出常用登录账号时，服务端可以通过查询本地的数据库，判断该常用登录账号是否与该用户本次登录所使用的登录账号是否曾在同一可信终端上登录，并且登录次数达到阈值；如果是，表明该用户本次登录所使用的登录账号与该登录终端的常用登录账号具有极高的关联性，那么服务端可以直接判定该登录终端为该用户可信终端。
在一种优选的实施方式中，在判断所述常用登录账号与所述用户本次登录所使用的登录账号是否曾在同一可信终端上登录时，所述同一可信终端可以为同一家用可信终端。当所述常用登录账号与所述用户本次登录所使用的登录账号曾在同一家用可信终端上登录，并且登录次数达到阈值时，所述用户与所述常用登录账号对应的用户之间很可能是家人关系，因此对于这种情况，可以直接判定所述登录终端为该用户的可信终端。
在实现时，服务端可以分别获取本地记录的各家用可信终端的常用登录账号，然后根据获取到的常用登录账号来建立家人关系数据，当对登入用户进行认证时，可以直接查询已建立的家人关系数据来确认当前登入的用户与经常使用该登录终端的用户之间是否为家人关系。
当然，在具体应用中，在判断该常用登录账号与该用户本次登录所使用的登录账号曾在同一可信终端上登录时，所述同一可信终端也可以是同一手持可信终端或办公可信终端。
另外，服务端在进行上述登录账号之间的关联性判断之前，服务端还可以对用户进行进一步的筛选以确定出所述登录终端的常用用户，只针对常用用户进行上述登录账号之间的关联性判断。
例如，服务端还可以判断所述用户的登录账号在所述登录终端上的登入 次数是否达到阈值；如果是，表明该用户为常用用户，可以继续判断所述用户的登录账号是否与所述登录终端的常用登录账号相关联；如果否，表明该用户为非常用用户，可以直接判定所述登录终端为该用户的非可信终端。例如，以所述同一可信终端为同一家用可信终端为例，如果某一用户使用所述家用可信登录终端的登录次数小于阈值时，比如只有一次，那么该用户很可能仅仅是造访的访客，对于这类用户，服务端执行上述登录账号之间的关联性判断没有意义，因此可以直接判定所述登录终端为该用户的非可信终端。
在本实施例中，服务端通过在对登录终端进行认证的过程中，引入对登录账号与登录终端的常用登录账号之间的关联性的判断，当判断出用户的登录账号与登录终端的常用登录账号相关联时，则判定该登录终端为该用户的可信终端。
通过该方案，实现了在用户之间交叉使用登录终端的应用场景中，可以通过用户的登录账号与登录终端的常用登录账号之间的关联性来判断该登录终端是否为该用户的可信终端，从而避免了对该登录终端进行复杂的重复认证。
请参考图2，图2是本申请一实施例提供的一种可信终端验证方法，该方法的执行主体可以为服务器；所述方法包括以下步骤：
步骤201、判断用户的登录终端是否匹配本地记录的该用户的可信终端；
步骤202、当判断出所述登录终端不匹配本地记录的该用户的可信终端时，查询所述登录终端的常用登录账号；其中所述常用登录账号为所述登录终端的历史登录账号中登入次数达到阈值的登录账号；
步骤203，判断所述用户的登录账号与所述常用登录账号是否曾在同一可信终端上登录，并且登录次数均达到阈值；如果是，确定所述用户的登录账号与所述常用登录账号相关联，并在本地保存所述用户的登录账号与所述历史登录账号之间的关联关系。
步骤204、当确定所述用户的登录账号与所述常用登录账号相关联时， 判定所述登录终端为该用户的可信终端。
在本实施例中，服务器在判断该用户的登录终端是否为该用户的可信终端时，可以通过获取该登录终端的硬件信息，然后将该终端的硬件信息与数据库中记录的该用户的可信终端的硬件信息依次进行匹配，如果匹配上了，表明当前该登录终端对于该用户为可信终端；相反，如果没有匹配上，表明该登录终端对于该用户为非可信终端。对于非可信终端，服务器可以只记录该终端的硬件信息以及用户使用该终端进行登录的次数。
其中，服务器在针对用户进行登录终端的认证时，仍然可以基于现有实现中对用户进行登录终端的认证方案。例如，服务器仍然可以根据用户的登录信息，比如用户的交易信息、IP地址以及登录时间段等信息对用户的登录终端进行认证，当认证通过后，可以在本地将该登录终端记录为用户的可信终端。
在实现时，服务器可以通过将本地的认证系统划分为不同的子系统，不同的子系统互相配合，来完成以上对用户的登录终端的认证的过程。
例如，请参见图3，服务器的认证系统划分完成后的子系统可以包括用户操作系统、用户认证系统和终端分析系统。值得说明的是，以上对服务器的认证系统进行子系统的划分仅为示例性，并不用于限定本发明。
1)用户操作系统
所述用户操作系统，用于记录用户的操作，比如用户登录支付宝系统的登录、退出、转账、用户信息修改、登入次数等操作，并将记录的用户操作保存到数据库中；所述用户操作系统还用于获取用户的操作环境，比如用户的登录终端的硬件信息，并将获取到的用户的登录终端的硬件信息传给终端分析系统进行分析。
例如，用户操作系统可以在用户操作的时候分析用户的操作环境，获取用户的登录终端的硬件信息，根据获取到的硬件信息进行建模，并将建模完成的硬件信息模型传给终端分析系统进行分析。其中，所述登录终端的硬件信息，根据登录终端的终端类型的不同可以包含不同的信息；例如，如果所 述登录终端为PC终端，那么所述硬件信息可以包括PC的主板MAC，网卡MAC，操作系统等信息；如果所述登录终端为手机终端，那么所述硬件信息可以包括手机配件的硬件信息，手机系统等信息。
2)终端分析系统
所述终端分析系统，用于根据用户操作系统传来的硬件信息模型对用户的登录终端进行分析，根据分析结果对用户的登录终端进行认证，并将认证出的该用户的可信终端在数据库中进行保存。同时，终端分析系统还可以根据终端类型对数据库中记录的可信终端进行分类。
例如，请参见图3和图4，终端分析系统仍然可以根据用户的登录信息，比如用户的交易信息、IP地址以及登录时间段等对登录终端进行分析，根据分析结果对用户的登录终端进行认证，当认证通过后，可以在本地将该登录终端在本地的数据库中记录为用户的可信终端。对于数据库中记录的可信终端，还可以由终端分析系统根据终端类型划分为手持可信终端，家用可信终端和办公可用终端。
具体的，如果根据硬件信息识别出所述可信终端为手持终端时，终端分析系统可以直接将该类可信终端在本地归类为手持可信终端；如果根据硬件信息识别出所述可信终端为PC终端时，终端分析系统可以进一步判断该类可信终端的常用时间段是否为办公时间段或家用时间段；如果为家用时间段，终端分析系统可以直接将该类可信终端在本地归类为家用可信终端；如果为办公时间段，终端分析系统可以直接将该类可信终端在本地归类为办公可信终端。
其中，对于不隶属于家用可信终端、办公可信终端以及手持可信终端中任何一种的登录终端，可以在本地将此类登录终端归类为其他终端。由于此时所述其他终端还不是可信终端，因此可以不存入所述数据库。
3)用户认证系统
所述用户认证系统，用于调用所述数据库，对用户的登录终端进行认证。
具体的，用户认证系统可以调用所述数据库，将用户的登录终端的硬件 信息与所述数据库中记录的该用户的可信终端的硬件信息进行匹配，如果匹配到了对应的信息，可以确定该登录终端为该用户的可信终端，那么该用户登录时可以不对该登录终端进行重复认证或只进行简单认证。
请参见图5，如果未匹配到任何信息，可以进一步确定该登录终端是否匹配由终端分析系统记录的所述其他终端。如果通过查询获悉，该登录终端为终端分析系统记录的所述其他终端，用户认证系统可以进一步调用数据库，获取该用户的登录账号，以及所述登录终端的历史登陆账号，通过判断该用户的登录账号与该登录终端的历史登录账号是否关联来判断该登录终端是否为该用户的可信终端。
具体的，用户认证系统可以将所述历史登录账号中登录次数达到阈值的登录账号作为常用登录账号，然后通过向数据库查询，来判断该常用登录账号是否与该用户本次登录所使用的登录账号是否曾在同一可信终端上登录，并且登录次数达到阈值；如果是，表明该用户本次登录所使用的登录账号与该登录终端的常用登录账号具有极高的关联性，那么服务端可以直接判定该登录终端为该用户可信终端，当该用户通过该终端登录后，进行敏感操作时，可以不对该用户进行重复认证或者只进行简单认证。
在一种优选的实施方式中，在判断所述常用登录账号与所述用户本次登录所使用的登录账号是否曾在同一可信终端上登录时，所述同一可信终端可以为同一家用可信终端。
当所述常用登录账号与所述用户本次登录所使用的登录账号曾在同一家用可信终端上登录，并且登录次数达到阈值时，所述用户与所述常用登录账号对应的用户之间很可能是家人关系，因此对于这种情况，用户认证系统可以直接判定该登录终端为该用户的可信终端。
其中，判断所述用户与所述常用登录账号对应的用户之间是否为家人关系，在具体实现时，用户认证系统可以分别向数据库查询各家用可信终端的常用登录账号，然后根据获取到的常用登录账号建立家人关系数据，当对登录用户进行认证时，可以直接查询已建立的家人关系数据来确认当前登入的 用户与经常使用该登录终端的用户之间是否为家人关系。
另外，在判断所述常用登录账号与所述用户的登录账号是否曾在同一可信终端上登录时，所述同一可信终端也可以是同一手持可信终端或办公可信终端。当判断初所述常用登录账号与所述用户的登录账号曾在同一手持可信终端或者办公可信终端上登录时，用户认证系统可以通知终端分析系统，将该登录终端在数据库中记录为该用户的可信终端，同时将该终端在数据库中归类为手持可信终端或者办公可信终端，不再赘述。
通过以上实施例可知，服务器通过在对登录终端进行认证的过程中，引入对登录账号与登录终端的常用登录账号之间的关联性的判断，当判断出用户的登录账号与登录终端的常用登录账号相关联时，则判定该登录终端为该用户的可信终端。
通过该方案，实现了在用户之间交叉使用登录终端的应用场景中，可以通过用户的登录账号与登录终端的常用登录账号之间的关联性来判断该登录终端是否为该用户的可信终端，从而避免了对该登录终端进行复杂的重复认证。
在另一个可选的实施例中，在以上实施例的基础上，服务器在进行上述登录账号之间的关联性判断之前，服务端还可以对用户进行进一步的筛选以确定出所述登录终端的常用用户，只针对常用用户进行上述登录账号之间的关联性判断。
例如，用户认证系统还可以判断所述用户的登录账号在所述登录终端上的登入次数是否达到阈值；如果是，表明该用户为常用用户，可以继续判断所述用户的登录账号是否与所述登录终端的常用登录账号相关联；如果否，表明该用户为非常用用户，用户认证系统可以直接判定所述登录终端为该用户的非可信终端。
例如，以所述同一可信终端为同一家用可信终端为例，如果某一用户使用所述家用可信登录终端的登录次数小于阈值时，比如只有一次，那么该用 户很可能仅仅是造访的访客，对于这类用户，用户认证系统执行上述登录账号之间的关联性判断没有意义，因此用户认证系统可以直接判定该登录终端为该用户的非可信终端。
与上述方法实施例相对应，本申请还提供了一种可信终端验证装置的实施例。以软件实现为例，所述装置可以运行在服务器上，作为本申请装置的运行载体，所述服务器通常至少包括有CPU、内存以及非易失性存储器，还可能包括I/O接口等硬件。请参考图6，图6为本申请一种示例性实施例中提供的可信终端验证装置的逻辑结构示意图，所述装置60包括：
第一判断模块601，用于判断用户的登录终端是否匹配本地记录的可信终端；
第二判断模块602，用于在判断出所述登录终端不匹配本地记录的可信终端时，判断用户的登录账号与所述登录终端的常用登录账号是否相关联；如果是，判定所述登录终端为该用户的可信终端。
在本实施例中，所述装置60还包括：
归类模块603，用于在第一判断模块判断用户的登录终端是否匹配本地记录的该用户的可信终端之前，根据所述可信终端的硬件信息识别所述可信终端的终端类型；
当识别出所述可信终端为手持终端时，将所述可信终端在本地归类为手持可信终端；
当识别出所述可信终端为PC终端时，判断所述可信终端的常用时间段是否为办公时间段或家用时间段；
当所述可信终端的常用时间段为办公时间段时，将所述可信终端在本地归类为办公可信终端；
当所述可信终端的常用时间段为家用时间段时，将所述可信终端在本地归类为家用可信终端。
在本实施例中，所述第二判断模块602具体用于：
在判断用户的登录账号与所述登录终端的常用登录账号是否相关联之前，判断所述用户的登录账号在所述登录终端上的登入次数是否达到阈值；
如果是，继续判断所述用户的登录账号是否与所述登录终端的常用登录账号相关联；
如果否，判定所述登录终端为该用户的非可信终端。
在本实施例中，所述第二判断模块602具体用于：
查询所述登录终端的常用登录账号；其中所述常用登录账号为所述登录终端的历史登录账号中登入次数达到阈值的登录账号；
判断所述用户的登录账号与所述常用登录账号是否曾在同一可信终端上登录，并且登录次数均达到阈值；
如果是，确定所述用户的登录账号与所述常用登录账号相关联，并在本地保存所述用户的登录账号与所述历史登录账号之间的关联关系。
在本实施例中，所述同一可信终端可以为同一家用可信终端。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络模块上。可以根据实际的需要选择其中的部分或者全部模块来实现本申请方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明保护的范围之内。
本申请还提供了一种服务器的实施例。
该服务器包括：处理器，以及用于存储所述处理器可执行指令的存储器；
进一步，该服务器还可以包括输入/输出接口，网络接口，各种硬件等。
所述服务器可以被配置为：
判断用户的登录终端是否匹配本地记录的该用户的可信终端；
当判断出所述登录终端不匹配本地记录的该用户的可信终端时，判断所述用户的登录账号与所述登录终端的常用登录账号是否相关联；
如果是，判定所述登录终端为该用户的可信终端。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本申请的其它实施方案。本申请旨在涵盖本申请的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本申请的一般性原理并包括本申请未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本申请的真正范围和精神由下面的权利要求指出。
应当理解的是，本申请并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本申请的范围仅由所附的权利要求来限制。

Claims (11)

  1. 一种可信终端验证方法，应用在服务端，其特征在于，所述方法包括：
    判断用户的登录终端是否匹配本地记录的该用户的可信终端；
    当判断出所述登录终端不匹配本地记录的该用户的可信终端时，判断所述用户的登录账号与所述登录终端的常用登录账号是否相关联；
    如果是，判定所述登录终端为该用户的可信终端。
  2. 根据权利要求1所述的方法，其特征在于，所述判断用户的登录终端是否匹配本地记录的该用户的可信终端之前，所述方法还包括：
    根据所述可信终端的硬件信息识别所述可信终端的终端类型；
    当识别出所述可信终端为手持终端时，将所述可信终端在本地归类为手持可信终端；
    当识别出所述可信终端为PC终端时，判断所述可信终端的常用时间段是否为办公时间段或家用时间段；
    当所述可信终端的常用时间段为办公时间段时，将所述可信终端在本地归类为办公可信终端；
    当所述可信终端的常用时间段为家用时间段时，将所述可信终端在本地归类为家用可信终端。
  3. 根据权利要求1所述的方法，其特征在于，所述判断用户的登录账号是否与所述登录终端的常用登录账号相关联之前，所述方法还包括：
    判断所述用户的登录账号在所述登录终端上的登入次数是否达到阈值；
    如果是，继续判断所述用户的登录账号是否与所述登录终端的常用登录账号相关联；
    如果否，判定所述登录终端为该用户的非可信终端。
  4. 根据权利要求1所述的方法，其特征在于，所述判断用户的登录账号与所述登录终端的常用登录账号是否相关联包括：
    查询所述登录终端的常用登录账号；其中所述常用登录账号为所述登录 终端的历史登录账号中登入次数达到阈值的登录账号；
    判断所述用户的登录账号与所述常用登录账号是否曾在同一可信终端上登录，并且登录次数均达到阈值；
    如果是，确定所述用户的登录账号与所述常用登录账号相关联，并在本地保存所述用户的登录账号与所述历史登录账号之间的关联关系。
  5. 根据权利要求4所述的方法，其特征在于，所述同一可信终端为同一家用可信终端。
  6. 一种终端验证装置，应用在服务端，其特征在于，所述装置包括：
    第一判断模块，用于判断用户的登录终端是否匹配本地记录的可信终端；
    第二判断模块，用于在判断出所述登录终端不匹配本地记录的可信终端时，判断用户的登录账号与所述登录终端的常用登录账号是否相关联；如果是，判定所述登录终端为该用户的可信终端。
  7. 根据权利要求6所述的装置，其特征在于，所述装置还包括：
    归类模块，用于在第一判断模块判断用户的登录终端是否匹配本地记录的该用户的可信终端之前，根据所述可信终端的硬件信息识别所述可信终端的终端类型；
    当识别出所述可信终端为手持终端时，将所述可信终端在本地归类为手持可信终端；
    当识别出所述可信终端为PC终端时，判断所述可信终端的常用时间段是否为办公时间段或家用时间段；
    当所述可信终端的常用时间段为办公时间段时，将所述可信终端在本地归类为办公可信终端；
    当所述可信终端的常用时间段为家用时间段时，将所述可信终端在本地归类为家用可信终端。
  8. 根据权利要求6所述的装置，其特征在于，所述第二判断模块具体用于：
    在判断用户的登录账号与所述登录终端的常用登录账号是否相关联之 前，判断所述用户的登录账号在所述登录终端上的登入次数是否达到阈值；
    如果是，继续判断所述用户的登录账号是否与所述登录终端的常用登录账号相关联；
    如果否，判定所述登录终端为该用户的非可信终端。
  9. 根据权利要求6所述的装置，其特征在于，所述第二判断模块具体用于：
    查询所述登录终端的常用登录账号；其中所述常用登录账号为所述登录终端的历史登录账号中登入次数达到阈值的登录账号；
    判断所述用户的登录账号与所述常用登录账号是否曾在同一可信终端上登录，并且登录次数均达到阈值；
    如果是，确定所述用户的登录账号与所述常用登录账号相关联，并在本地保存所述用户的登录账号与所述历史登录账号之间的关联关系。
  10. 根据权利要求9所述的装置，其特征在于，所述同一可信终端为同一家用可信终端。
  11. 一种可信终端验证装置，其特征在于，包括：
    处理器；用于存储所述处理器可执行指令的存储器；
    其中，所述处理器被配置为：
    判断用户的登录终端是否匹配本地记录的该用户的可信终端；
    当判断出所述登录终端不匹配本地记录的该用户的可信终端时，判断用户的登录账号与所述登录终端的常用登录账号是否相关联；
    如果是，判定所述登录终端为该用户的可信终端。
PCT/CN2015/091694 2014-10-24 2015-10-10 一种可信终端验证方法、装置 WO2016062204A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
JP2017521133A JP6715242B2 (ja) 2014-10-24 2015-10-10 信頼される端末を検証するための方法及び装置
SG11201703304TA SG11201703304TA (en) 2014-10-24 2015-10-10 Method and device for verifying a trusted terminal
EP15851892.8A EP3211825B1 (en) 2014-10-24 2015-10-10 Trusted terminal verification method and apparatus
KR1020177014021A KR102167602B1 (ko) 2014-10-24 2015-10-10 신뢰된 단말기 검증 방법 및 장치
US15/495,894 US10673851B2 (en) 2014-10-24 2017-04-24 Method and device for verifying a trusted terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410579074.5 2014-10-24
CN201410579074.5A CN105592014B (zh) 2014-10-24 2014-10-24 一种可信终端验证方法、装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/495,894 Continuation US10673851B2 (en) 2014-10-24 2017-04-24 Method and device for verifying a trusted terminal

Publications (1)

Publication Number Publication Date
WO2016062204A1 true WO2016062204A1 (zh) 2016-04-28

Family

ID=55760284

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/091694 WO2016062204A1 (zh) 2014-10-24 2015-10-10 一种可信终端验证方法、装置

Country Status (7)

Country Link
US (1) US10673851B2 (zh)
EP (1) EP3211825B1 (zh)
JP (1) JP6715242B2 (zh)
KR (1) KR102167602B1 (zh)
CN (2) CN105592014B (zh)
SG (2) SG11201703304TA (zh)
WO (1) WO2016062204A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109801092A (zh) * 2017-11-16 2019-05-24 腾讯科技（武汉）有限公司 资源安全管理方法、装置、计算机设备和存储介质

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105592014B (zh) * 2014-10-24 2019-02-15 阿里巴巴集团控股有限公司 一种可信终端验证方法、装置
CN107645482B (zh) * 2016-07-22 2020-08-07 创新先进技术有限公司 一种针对业务操作的风险控制方法及装置
CN107689936B (zh) * 2016-08-03 2021-07-06 阿里巴巴集团控股有限公司 登录账户的安全性验证系统、方法及装置
CN108243145B (zh) * 2016-12-23 2019-04-26 中科星图股份有限公司 一种多源身份认证方法
CN106790129A (zh) * 2016-12-27 2017-05-31 中国银联股份有限公司 一种身份认证的方法及装置
US10652342B2 (en) 2018-05-08 2020-05-12 Daon Holdings Limited Methods and systems for identifying a client computer system
CN110011992B (zh) * 2019-03-25 2022-07-26 联想(北京)有限公司 系统登录方法及电子设备
CN110264210B (zh) * 2019-05-06 2023-08-08 创新先进技术有限公司 账号正确性的检测方法和装置
CN110365657A (zh) * 2019-06-21 2019-10-22 北京奇艺世纪科技有限公司 远程协助方法、装置及可读存储介质
US11030299B1 (en) 2020-01-27 2021-06-08 Capital One Services, Llc Systems and methods for password managers
CN111311285A (zh) * 2020-02-21 2020-06-19 深圳壹账通智能科技有限公司 一种防止用户非法登录的方法、装置、设备和存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101674183A (zh) * 2009-03-19 2010-03-17 庞己人 一种通过通讯电话传送帐户密码登陆帐户的系统及方法
US20100199338A1 (en) * 2009-02-04 2010-08-05 Microsoft Corporation Account hijacking counter-measures
CN102047709A (zh) * 2008-06-02 2011-05-04 微软公司 可信设备专用认证
CN103001826A (zh) * 2012-11-29 2013-03-27 北京奇虎科技有限公司 用于监测用户登录的设备和方法
US8495716B1 (en) * 2007-12-31 2013-07-23 Symantec Corporation Systems and methods for facilitating online authentication from untrusted computing devices
US8627438B1 (en) * 2011-09-08 2014-01-07 Amazon Technologies, Inc. Passwordless strong authentication using trusted devices

Family Cites Families (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7174454B2 (en) * 2002-11-19 2007-02-06 America Online, Inc. System and method for establishing historical usage-based hardware trust
US7376838B2 (en) * 2003-07-17 2008-05-20 Jp Morgan Chase Bank Method for controlled and audited access to privileged accounts on computer systems
EP1664687A4 (en) * 2003-09-12 2009-01-14 Rsa Security Inc SYSTEM AND METHOD FOR AUTHENTICATION TO RISK BASIS
US7784089B2 (en) * 2004-10-29 2010-08-24 Qualcomm Incorporated System and method for providing a multi-credential authentication protocol
JP3878975B1 (ja) * 2006-07-18 2007-02-07 クオリティ株式会社 管理サーバおよび管理プログラム
JP2008059222A (ja) 2006-08-30 2008-03-13 Matsushita Electric Ind Co Ltd サービス提供システム
JP4708379B2 (ja) 2007-03-28 2011-06-22 パナソニック株式会社 コンテンツ利用システム
US8793758B2 (en) * 2009-01-28 2014-07-29 Headwater Partners I Llc Security, fraud detection, and fraud mitigation in device-assisted services systems
US20100268557A1 (en) * 2009-04-17 2010-10-21 Patrick Faith Enrollment server
US8352218B2 (en) * 2009-07-08 2013-01-08 Graphisoft Active building information modeling apparatus and method
US9619664B2 (en) * 2009-11-17 2017-04-11 International Business Machines Corporation Systems and methods for handling electronic messages
CN102158465B (zh) * 2010-02-11 2013-10-16 上海博泰悦臻网络技术服务有限公司 车载设备、车载系统及车载登录方法
US20120209735A1 (en) * 2010-10-20 2012-08-16 Peruvemba Subramanian Federated third-party authentication apparatuses, methods and systems
US8955078B2 (en) * 2011-06-30 2015-02-10 Cable Television Laboratories, Inc. Zero sign-on authentication
CN102325026A (zh) * 2011-07-14 2012-01-18 易讯天空计算机技术（深圳）有限公司 账号密码安全加密系统
US9183415B2 (en) * 2011-12-01 2015-11-10 Microsoft Technology Licensing, Llc Regulating access using information regarding a host machine of a portable storage drive
CN102413146B (zh) * 2011-12-23 2014-02-19 杭州数盾信息技术有限公司 基于动态码的客户端授权登录方法
WO2013108121A2 (en) * 2012-01-17 2013-07-25 IPalive AB A device, software module, system or business method for global real-time telecommunication
CN102595213B (zh) * 2012-02-22 2014-10-29 深圳创维－Rgb电子有限公司 可信电视终端安全认证方法和系统
US9529993B2 (en) * 2012-03-02 2016-12-27 International Business Machines Corporation Policy-driven approach to managing privileged/shared identity in an enterprise
US8863243B1 (en) * 2012-04-11 2014-10-14 Google Inc. Location-based access control for portable electronic device
US9497623B2 (en) * 2012-05-25 2016-11-15 Nokia Technologies Oy Method and apparatus for guest access sharing
CN103581108B (zh) * 2012-07-19 2017-05-03 阿里巴巴集团控股有限公司 一种登录验证方法、客户端、服务器及系统
CN103577978A (zh) * 2012-07-20 2014-02-12 苏州工业园区讯贝智能系统有限公司 一种应用二维码提供电子交易的方法
US8856894B1 (en) * 2012-11-28 2014-10-07 Consumerinfo.Com, Inc. Always on authentication
US8959583B2 (en) * 2013-02-05 2015-02-17 Ca, Inc. Access to vaulted credentials using login computer and mobile computing device
EP3661159A1 (en) * 2013-07-08 2020-06-03 SSH Communications Security Oyj Trust relationships in a computerized system
US9319419B2 (en) * 2013-09-26 2016-04-19 Wave Systems Corp. Device identification scoring
CN103532797B (zh) * 2013-11-06 2017-07-04 网之易信息技术（北京）有限公司 一种用户登录异常监测方法和装置
US9992207B2 (en) * 2014-09-23 2018-06-05 Qualcomm Incorporated Scalable authentication process selection based upon sensor inputs
CN110489952A (zh) * 2014-09-30 2019-11-22 华为技术有限公司 身份认证的方法、装置及用户设备
CN105592014B (zh) * 2014-10-24 2019-02-15 阿里巴巴集团控股有限公司 一种可信终端验证方法、装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8495716B1 (en) * 2007-12-31 2013-07-23 Symantec Corporation Systems and methods for facilitating online authentication from untrusted computing devices
CN102047709A (zh) * 2008-06-02 2011-05-04 微软公司 可信设备专用认证
US20100199338A1 (en) * 2009-02-04 2010-08-05 Microsoft Corporation Account hijacking counter-measures
CN101674183A (zh) * 2009-03-19 2010-03-17 庞己人 一种通过通讯电话传送帐户密码登陆帐户的系统及方法
US8627438B1 (en) * 2011-09-08 2014-01-07 Amazon Technologies, Inc. Passwordless strong authentication using trusted devices
CN103001826A (zh) * 2012-11-29 2013-03-27 北京奇虎科技有限公司 用于监测用户登录的设备和方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109801092A (zh) * 2017-11-16 2019-05-24 腾讯科技（武汉）有限公司 资源安全管理方法、装置、计算机设备和存储介质
CN109801092B (zh) * 2017-11-16 2023-09-08 腾讯科技（武汉）有限公司 资源安全管理方法、装置、计算机设备和存储介质

Also Published As

Publication number Publication date
CN109951436A (zh) 2019-06-28
CN105592014B (zh) 2019-02-15
CN105592014A (zh) 2016-05-18
SG11201703304TA (en) 2017-06-29
EP3211825A4 (en) 2017-08-30
SG10201903580QA (en) 2019-05-30
KR102167602B1 (ko) 2020-10-20
KR20170074959A (ko) 2017-06-30
JP2017533511A (ja) 2017-11-09
CN109951436B (zh) 2021-04-27
US20170230366A1 (en) 2017-08-10
EP3211825A1 (en) 2017-08-30
US10673851B2 (en) 2020-06-02
JP6715242B2 (ja) 2020-07-01
EP3211825B1 (en) 2019-11-20

Similar Documents

Publication Publication Date Title
WO2016062204A1 (zh) 一种可信终端验证方法、装置
US11190527B2 (en) Identity verification and login methods, apparatuses, and computer devices
CN106105139B (zh) 由网关进行的自动检测的认证方法及系统
US20180060868A1 (en) Systems and methods for remote verification of users
US10503888B2 (en) Authentication system
US9032217B1 (en) Device-specific tokens for authentication
WO2017000829A1 (zh) 一种基于生物特征的安全校验方法及客户端、服务器
KR102698459B1 (ko) 디바이스로의 보안 자격증명 전송을 인증하는 방법 및 시스템
US9225744B1 (en) Constrained credentialed impersonation
US11539526B2 (en) Method and apparatus for managing user authentication in a blockchain network
US10375177B1 (en) Identity mapping for federated user authentication
KR20170041729A (ko) 보안 전송 프로토콜을 사용하여 신뢰를 설정하기 위한 시스템 및 방법
US11824850B2 (en) Systems and methods for securing login access
JP2013508854A (ja) クラウド認証を使用する認証
US20170279798A1 (en) Multi-factor authentication system and method
US10997141B2 (en) Anonymous device operation
CN109815684A (zh) 一种身份认证方法、系统及服务器和存储介质
WO2019011187A1 (zh) 电子账户的挂失、解挂、业务管理方法、装置及设备
CN105337739B (zh) 安全登录方法、装置、服务器及终端
CN104836777B (zh) 身份验证方法和系统
US20140237567A1 (en) Authentication method
US9300625B1 (en) Network address verification
CN114221782A (zh) 一种认证鉴权方法、设备、芯片及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15851892

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2017521133

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 11201703304T

Country of ref document: SG

REEP Request for entry into the european phase

Ref document number: 2015851892

Country of ref document: EP