WO2016176832A1 - 鉴权方法和接入设备 - Google Patents

鉴权方法和接入设备 Download PDF

Info

Publication number
WO2016176832A1
WO2016176832A1 PCT/CN2015/078346 CN2015078346W WO2016176832A1 WO 2016176832 A1 WO2016176832 A1 WO 2016176832A1 CN 2015078346 W CN2015078346 W CN 2015078346W WO 2016176832 A1 WO2016176832 A1 WO 2016176832A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
terminal
access device
security
result
Prior art date
Application number
PCT/CN2015/078346
Other languages
English (en)
French (fr)
Inventor
饶超
桂亦慧
张晟
田春长
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201580071544.XA priority Critical patent/CN107113308A/zh
Priority to PCT/CN2015/078346 priority patent/WO2016176832A1/zh
Publication of WO2016176832A1 publication Critical patent/WO2016176832A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present invention relates to communication technologies, and in particular, to an authentication method and an access device.
  • the traditional authentication method is to verify the identity of the user by a combination of a username and a password.
  • the premise of this approach is that each user who obtains the password is already authorized in the system, and after the user registration is completed, the user name and password need to be kept by the user himself. Once the user forgets the password, the login cannot be performed by the above authentication method.
  • the secret security problem is selected in a fixed "problem set", the scope of the problem is fixed, the selectivity is poor, and the others are easy to guess, and there is a security risk; in addition, the secret question answer is fixed and needs Exact match, and over time, users may forget the answer to the secret question, resulting in the user not being able to retrieve the password.
  • the authentication method and the access device provided by the embodiments of the present invention are used to solve the technical problem that the scope of the security problem in the prior art is fixed, the selectivity is poor, and the security is low; and the prior art is also solved.
  • the answer to the secret question is fixed and needs to be matched exactly. When the user forgets the answer to the secret question, the user cannot find the password, and the human-computer interaction is not intelligent enough.
  • an embodiment of the present invention provides an authentication method, which is applicable to an authentication system, where the authentication system includes a first terminal of a first user, a second terminal of a second user, an access device, and a network side.
  • the device accesses the network side device by using the access network element; the method includes:
  • the access device receives an authentication request sent by the first terminal;
  • the authentication request includes a network side account that needs to retrieve a password, and the authentication request is used to request the access device to be the first
  • the user provides a user interface for modifying the password
  • the access device determines, according to the authentication request, a second user that can assist the legal first user to modify the password, and establish an audio and video call connection between the first terminal and the second terminal, where the tone
  • the video call connection is used to enable the second user to confirm, by the second terminal, whether the first user is a legitimate first user;
  • the access device After receiving the acknowledgement message sent by the second terminal, the access device generates a password for modifying the password according to the collected user behavior data of the first user on the first terminal. a first result of the security issue and the security policy; the confirmation message is used to indicate to the access device that the first user is the legal first user;
  • the access device sends the security policy and the first prompt information to the first terminal; the first prompt information is used to assist the legal first user to obtain a second result;
  • the access device receives the second result sent by the first terminal, and determines whether the matching degree between the second result and the first result is greater than a preset first threshold; if yes, the access The device sends an authentication success message to the first terminal, and provides an interface for modifying the password to the legal first user.
  • the access device sends the security policy and the first prompt information to the first terminal, including:
  • the access device sends the first prompt information to the first terminal, and sends the secret security problem to the first terminal by using the second terminal.
  • the access device is configured to be able to assist the first user to modify the location
  • the second user of the password including:
  • the access device is configured according to the legal A user behavior data on the first terminal generates a security policy for modifying the password and a first result of the security issue, including:
  • the access device acquires at least one security policy template; wherein different security policy templates correspond to different security levels;
  • the access device generates the first result of the security policy and the security policy according to the user behavior data, any one of the security policy template, and the security level of the security policy template.
  • the access device according to the user behavior data, any one of the security policy templates, and the security The security level of the problem template, the first result of generating the security issue and the security issue, specifically including:
  • the access device generates the security policy and the first result according to the first secret question template and the first data.
  • the access device generates, according to the first security question template and the first data, The secret issue and the first result, including:
  • the access device generates multiple first security issues according to the first secret question template and the first data
  • the access device determines whether each of the first security issues meets a preset difficulty coefficient
  • the access device determines the first security question that satisfies the difficulty coefficient as the security issue, and determines the first result.
  • an embodiment of the present invention provides an access device, which is applicable to an authentication system, where the authentication system includes a first terminal of a first user, a second terminal of a second user, an access device, and a network side device.
  • the terminal accesses the network side device by using the access network element;
  • the access device includes:
  • a receiving module configured to receive an authentication request sent by the first terminal, where the authentication request includes a network side account that needs to retrieve a password, and the authentication request is used to request the access device to be the first
  • the user provides a user interface for modifying the password
  • a determining module configured to determine, according to the authentication request, a second user that can assist the legal first user to modify the password, and establish an audio-video call connection between the first terminal and the second terminal, where the tone
  • the video call connection is used to enable the second user to confirm, by the second terminal, whether the first user is a legitimate first user
  • a generating module configured to: after the receiving module receives the confirmation message sent by the second terminal, generate, according to the collected user behavior data of the first user on the first terminal, a modification The security policy of the password and the first result of the security policy; the confirmation message is used to indicate to the access device that the first user is the legal first user;
  • a sending module configured to send the security policy and the first prompt information to the first terminal; the first prompt information is used to assist the legal first user to obtain a second result;
  • the receiving module is further configured to receive the second result sent by the first terminal;
  • a determining module configured to determine whether a matching degree between the second result and the first result is greater than a preset first threshold; if yes, providing an interface for modifying the password to the legal first user, and indicating
  • the sending module sends a verification success message to the first terminal.
  • the sending module is configured to send the first prompt information to the first terminal, and the second terminal The secret question is sent to the first terminal.
  • the determining module includes: a first acquiring unit and a determining unit;
  • the first obtaining unit is configured to acquire first contact information related to the first user on the first terminal according to the authentication request and a preset screening policy;
  • the ingress device is determined according to the historical communication record of the first terminal;
  • the sending module is further configured to send the first contact information to the first terminal;
  • the receiving module is further configured to receive an identity identifier of the second user that is sent by the first terminal;
  • the determining unit is configured to determine the second user according to the identity of the second user.
  • the generating module includes:
  • a second acquiring unit configured to acquire at least one security question template; wherein different security question templates correspond to different security levels;
  • a generating unit configured to generate the security policy and the first result of the security policy according to the user behavior data, the security policy template, and the security level of the security policy template.
  • the generating unit includes:
  • Obtaining a sub-unit configured to obtain a first secret question template from the at least one security question template according to a security level of the at least one security question template;
  • Determining a subunit configured to determine a data extraction policy according to the first secret question template, and determine first data from the user behavior data according to the data extraction policy;
  • Generating a subunit configured to generate the secret question and the first result according to the first secret question template and the first data.
  • the generating subunit specifically, according to the first security question template and the first Generating a plurality of first secret security questions, and determining whether each of the first secret security questions satisfies a preset difficulty coefficient; if yes, determining a first secret security problem that satisfies the difficulty coefficient as the security guarantee Problem and determine the first result.
  • an embodiment of the present invention provides an access device, which is applicable to an authentication system, where the authentication system includes a first terminal of a first user, a second terminal of a second user, an access device, and a network side device.
  • the terminal accesses the network side device by using the access network element;
  • the access device includes:
  • a receiver configured to receive an authentication request sent by the first terminal;
  • the authentication request includes a network side account that needs to retrieve a password, and the authentication request is used to request the access device to be the first
  • the user provides a user interface for modifying the password
  • a processor configured to determine, according to the authentication request, a second user that can assist the legal first user to modify the password, and establish an audio and video call connection between the first terminal and the second terminal, and After receiving the confirmation message sent by the second terminal, the receiver generates a security policy for modifying the password according to the collected user behavior data of the first user on the first terminal. a first result of the security issue; the audio-video call connection is used to enable the second user to confirm, by the second terminal, whether the first user is a legitimate first user; the confirmation The message is used to indicate to the access device that the first user is the legal first user;
  • a transmitter configured to send the secret question and the first prompt information to the first terminal; the first prompt information is used to assist the legal first user to obtain a second result;
  • the receiver is further configured to receive the second result sent by the first terminal
  • the processor is further configured to determine whether a matching degree between the second result and the first result is greater than a preset first threshold; if yes, provide an interface for modifying the password to the legal first user, And instructing the sender to send a verification success message to the first terminal.
  • the transmitter is configured to send the first prompt information to the first terminal, and The secret question is sent to the first terminal.
  • the processor is specifically configured to perform screening according to the authentication request and preset a policy, acquiring first contact information related to the first user on the first terminal, and determining, according to the identity identifier of the second user received by the receiver, the second user; Determining, for the access device, according to the historical communication record of the first terminal;
  • the transmitter is further configured to send the first contact information to the first terminal;
  • the receiver is further configured to receive an identity identifier of the second user that is sent by the first terminal.
  • the processor is specifically configured to obtain at least one security issue a template, and generating, according to the user behavior data, any security question template, and a security level of the security question template, the first result of the security issue and the security issue; wherein, different security The problem template corresponds to a different level of security.
  • the processor is specifically configured to: according to a security level of the at least one security question template, Obtaining a first secret question template in the at least one secret question template, determining a data extraction policy according to the first secret question template, and determining first data from the user behavior data according to the data extraction policy, And generating the security issue and the first result according to the first secret question template and the first data.
  • the processor is specifically configured to use the first secret question template and the first number And generating a plurality of first security issues, and determining whether each of the first security issues meets a preset difficulty coefficient; if yes, determining a first security problem that satisfies the difficulty coefficient as the security Problem and determine the first result.
  • the access device determines, according to the authentication request sent by the first terminal, the second user that can assist the legal first user to change the password, and establishes the first terminal and the second terminal.
  • the audio and video call connection enables the second user to confirm whether the current first user is a legitimate first user; after receiving the confirmation message sent by the second terminal, the access device is based on the collected legal first user.
  • the user behavior data on a terminal generates a security policy for modifying a password and a first result of the security policy, and sends the security policy and the first prompt information to the first terminal, and then receives the first The second result sent by the terminal, and determining whether the matching degree between the second result and the first result is greater than a preset first threshold; if yes, the access device sends a verification success message to the first terminal, and The legal first user provides an interface to modify the password.
  • the secret security problem is not selected from the fixed problem preset by the user, but the access device is generated by the user behavior data, so it has a certain randomness, and the illegal user is not easy to guess, and the security is high.
  • the verification method of the answer to the secret security problem adds a fuzzy matching function, that is, as long as the user's answer contains the necessary elements in the correct answer, the verification can be passed, and the legal first user who forgot the password is Further, the method provided by the embodiment of the present invention avoids complicated manual operations and a large amount of data filling, and is a second user determined by the access device, and no longer needs to manually select a friend.
  • the audio and video call established by the access device is the first terminal and the second terminal online. Call between, thus avoiding the legal situation of the first user to wait a long time on the second line user to perform the next step occurs, it increases the efficiency of the first legitimate users to retrieve passwords.
  • FIG. 1 is a schematic structural diagram of an authentication system according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of Embodiment 1 of an authentication method according to an embodiment of the present disclosure
  • FIG. 3 is a schematic flowchart of Embodiment 2 of an authentication method according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of Embodiment 3 of an authentication method according to an embodiment of the present disclosure
  • FIG. 5 is a schematic flowchart of Embodiment 4 of an authentication method according to an embodiment of the present disclosure
  • FIG. 6 is a schematic structural diagram of Embodiment 1 of an access device according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of Embodiment 2 of an access device according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of Embodiment 3 of an access device according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of Embodiment 4 of an access device according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of Embodiment 5 of an access device according to an embodiment of the present disclosure.
  • the method of the embodiment of the present invention is applicable to an authentication system, where the authentication system includes a first terminal of a first user, a second terminal of a second user, an access device, and a network side device.
  • the first terminal or the second terminal can access the network side device through the access device, that is, the access device can be a barrier or a verification level of the first terminal or the second terminal.
  • the architecture diagram of the authentication system can be seen in Figure 1.
  • the first terminal and the second terminal involved in the embodiments of the present invention may be any portable mobile terminal, including but not limited to a mobile phone, a mobile computer, a tablet computer, a personal digital assistant (PDA), a media player, Smart TVs, smart watches, smart glasses, smart bracelets, and the like, and also include an automatic teller machine (ATM), etc., are not limited in the embodiment of the present invention.
  • PDA personal digital assistant
  • ATM automatic teller machine
  • any user who uses the first terminal may be referred to as a first user.
  • the first terminal communicates with the second terminal, the first user is actually communicating with the second user, that is, the first A terminal can be understood as a first user itself, and a second terminal can be understood as a second user itself.
  • the access device in the embodiment of the present invention may be an entity network element integrated with the aggregation cloud platform.
  • the network side device involved in the embodiment of the present invention integrates a mobile virtualization unit.
  • the mobile virtualization unit includes a virtual machine (Virtual User Equipment, VUE for short) and a lightweight server (Lite Server).
  • VUE Virtual User Equipment
  • Lite Server lightweight server
  • the virtual machine provides virtual machine services for the end user.
  • the Lite Server can be used as a lightweight server for the application, providing some functions of the Internet application server, or can also be used as an application server deployed by the developer on the platform to provide complete users.
  • Internet service The user can use his own mobile terminal device to connect to the virtual machine in the above mobile virtualization unit through the above access device, thereby using the virtual machine service.
  • multiple applications in the virtual machine can interact with the corresponding Lite Server to use the applications provided by the Internet application service provider.
  • the method provided by the embodiment of the present invention is to solve the technical problem that the scope of the security problem in the prior art is fixed, the selectivity is poor, and the others are easy to guess, and there is a security risk; and, in the prior art, Because the answer to the secret security question is fixed and needs to be accurately matched, when the user forgets the answer to the secret security question, the user cannot find the password, and the human-computer interaction is not intelligent enough.
  • FIG. 2 is a schematic flowchart of Embodiment 1 of an authentication method according to an embodiment of the present invention. This method is applicable to the authentication system shown in Fig. 1 above. As shown in FIG. 1, the method includes the following steps:
  • the access device receives the authentication request sent by the first terminal, where the authentication request includes a network side account that needs to retrieve a password, and the authentication request is used to request the access device to be the first
  • the user provides a user interface to modify the password.
  • the first user sends an authentication request to the access device by using the first terminal, that is, the authentication request includes a network side account that needs to retrieve the password, that is, the authentication request may be a password retrieval request, and is used for the request.
  • the access device provides a first user with a user interface that modifies the password.
  • the user interface may be a password recovery service or a password recovery interface provided by the access device for the first user.
  • the first user may be a legal first user corresponding to the network side account, or may be another illegal user.
  • the access device determines, according to the authentication request, that the first user can be assisted by the legal modification. a second user of the password, and establishing an audio-video call connection between the first terminal and the second terminal, the audio-video call connection being used to enable the second user to confirm the number by using the second terminal Whether a user is a legitimate first user.
  • the access device determines, according to the authentication request, a second user that can assist the legal first user to modify the password.
  • the access device determines that the second user that can assist the first user to modify the password of the network side account may obtain the second user online by directly accessing the address book of the first terminal or the instant messaging software.
  • the second user is associated with the legal first user, but when the illegal first user sends an authentication request to the access device by using the first terminal, the access device still needs to determine that the legal first user can modify the password.
  • the second user helps the access device to confirm that the current first user is an illegal first user, for example, a legitimate first user's friend, relative, colleague, etc. In short, the second user is a legitimate first user trusted.
  • the access device determines that the second user may further provide the first terminal with some relatively reliable online contacts on the first terminal, and then the first user (whether legal or illegal, the first user, The second user can be selected autonomously from the reliable contacts, and the second user can be notified to the access device through the first terminal; or the access device can obtain the legal number from the device on the core network side.
  • the selection policy of selecting the second user from the reliable contacts may be the selection basis of the user preset on the access device.
  • the second user may be one user or multiple users.
  • the access device does not recognize the function at this time, so the access device still needs to determine the second user for the illegal first user, but the second user is Assisting the user of the legal first user to change the password. Therefore, in the following audio and video call phase, the second user can notify the illegal first user to the access device through the audio and video call, so that the access device rejects the illegal The authentication request of the first user.
  • the access device After the access device determines the second user, the access device sends a request for establishing an audio-video call to the second terminal to establish an audio-video call between the first terminal and the second terminal. After the second user selects to accept the request for the audio and video call, the access device establishes an audio and video call between the first terminal of the first user and the second terminal of the second user, thereby enabling the first user and the first user.
  • the second user can perform audio and video communication, so that the second user can pass the audio and video through the determination Whether the first user is a legal first user, that is, whether the first user is the correct user who uses the network side account.
  • the audio and video call mentioned above may be a simple audio call, a simple video call (there may be no audio information such as sound), or a normal call with both audio and video.
  • the second terminal After the second user determines that the first user is a legal first user, the second terminal sends an acknowledgement message to the access device by using the second terminal.
  • the second terminal When the second user is multiple, the multiple second users send an acknowledgment message through the second terminal of the second user.
  • the access device may consider the The first user is a legitimate first user, and all second users are not required to send an acknowledgement message to the access device.
  • the access device After receiving the acknowledgement message sent by the second terminal, the access device generates a password for modifying the password according to the collected user behavior data of the first user on the first terminal. And a first result of the security policy; the confirmation message is used to indicate to the access device that the first user is the legal first user.
  • the access device performs data collection on the user behavior of the first user on the first terminal according to the capability of extracting the user data behavior, and the user behavior data is collected.
  • the user behavior data refers to the user behavior data of the first user on the first terminal.
  • the user behavior data may be a legal first user using the historical usage record of the application software (APP) in the first terminal, or may be a legal first user using the specific behavior information of the APP (such as online shopping, payment, The social friend or the like) can also obtain the location information and the acquisition time of the first terminal acquired by the access device.
  • the first two types of information are related to the behavior of the legal first user using the APP.
  • the third type of information relies on the positioning capability of the access device or the network side device to collect the daily trajectory of the legitimate first user.
  • the access device can be obtained by using the system log of the operating system of the network side device.
  • the access device can obtain its preferences from the Internet log for a specific user, and even obtain a very detailed specific behavior, such as what items are purchased online; it should be noted that the access device platform needs to obtain this type of information.
  • a consensus agreement is reached with a legitimate first user, service provider, or operator.
  • the security problem may be that the access device is configured to rely on the legal user behavior data of the first user on the first terminal, or the access device may be combined with the legal first user on the first terminal. User behavior data and preset problem templates are generated.
  • the security problem generated by the embodiment of the present invention is based on the legal user behavior data of the first user on the first terminal, which may be randomly generated, and because the user's behavior data is a change.
  • the security policy generated by the embodiment of the present invention may be different from the fixed problem preset by the user, but has a certain randomness. It is highly selective, and illegal users are not easy to guess and have strong security.
  • the access device sends the security policy and the first prompt information to the first terminal, where the first prompt information is used to assist the legal first user to obtain the second result.
  • the access device when the access device generates the first result of the security policy and the secret security problem (the first result is the correct answer to the security policy), the security policy and the first authorized user obtain the The first prompt information of the first result of the secret security problem is sent to the first terminal.
  • the access device may directly send the secret security problem and the first prompt information to the first terminal, or the access device may send the secret security problem and the first prompt information to the first terminal by using another device.
  • the manner in which the access device sends the secret security problem and the first prompt information to the first terminal is not limited in the embodiment of the present invention.
  • the foregoing first prompt information may be auxiliary information for selecting a first type of the first result obtained by the legal first user who forgot the network side account password, for example, may be provided to the legal first user for several secrets.
  • the choice of the answer to the question (these choices may be in the form of a picture, a text, an icon, or a voice), allowing the legitimate first user to select the correct first result from the choices; or, the first prompt
  • the information may be non-selection information that gives a legal user implicit hint, for example, when the secret question is "what is your favorite music," the first prompt information may be the name of the singer, etc.
  • the existence of the first prompt information can facilitate the legitimate first user to quickly find the answer to the secret question, instead of relying solely on the legitimate first user's memory, thereby improving the intelligence of human-computer interaction.
  • the first terminal After receiving the secret security problem and the first prompt information sent by the access device, the first terminal obtains the second result according to the two, and sends the second result to the access device.
  • the access device receives the second result sent by the first terminal, and determines whether a matching degree between the second result and the first result is greater than a preset first threshold; if yes, the access The device sends an authentication success message to the first terminal, and provides an interface for modifying the password to the legal first user.
  • the second result may be converted into a specific secret answer format in the access device (eg, voice form, text form, etc.) ), convenient to match the first result.
  • the access device determines whether the matching degree between the second result and the first result reaches a preset first threshold, where the first threshold is a preset minimum value that determines a first result and a second result, the first threshold The value of the first threshold is 100%.
  • the form of the first threshold may be other modes. The embodiment of the present invention does not do this. limited.
  • the verification method of the answer to the security question provided by the embodiment of the present invention adds a fuzzy matching function, that is, as long as the legal first user's answer contains the necessary elements in the correct answer, the verification can be passed, and the password is forgotten.
  • the first user provided further convenience when retrieving the password.
  • the access device After the access device determines that the matching degree between the second result and the first result reaches a preset first threshold, and the access device determines that the second result is correct, sends an authentication success message to the first terminal, and The legal first user provides an interface to change the password.
  • the authentication method provided by the embodiment of the present invention may also be applied to a conventional user login application, that is, when the access device confirms that the second result is correct (that is, the answer that the user answers the secret question is correct)
  • the access device can directly log in to the application through the first terminal (that is, directly access the network side device), and the legal first user does not need to input the user name and password again, which simplifies the operation of the user.
  • the access device determines, according to the authentication request sent by the first terminal, the second user that can assist the legal first user to change the password, and establishes the audio and video call of the first terminal and the second terminal. Connecting, so that the second user confirms whether the current first user is a legitimate first user; after receiving the confirmation message sent by the second terminal, the access device is based on the collected legal first user on the first terminal.
  • the user behavior data generates a security policy for modifying the password and a first result of the security policy, and after the secret security problem and the first prompt information are sent to the first terminal, receiving the first terminal, Determining, by the second result, whether the matching degree between the second result and the first result is greater than a preset first threshold; if yes, the access device sends a verification success message to the first terminal, and the legal A user provides an interface to modify the password.
  • the secret security problem is not selected from a fixed problem preset by the user, but the access device passes User behavior data is generated, so it has a certain randomness. Illegal users are not easy to guess and have high security.
  • the verification method of the answer to the security question adds a fuzzy matching function, that is, as long as the user's answer includes The necessary elements in the correct answer can be verified, and the first user who has forgotten the password is further provided with the convenience of retrieving the password.
  • the method provided by the embodiment of the present invention avoids complicated manual operations and a large number of The information is filled in, and is a second user determined by the access device, no longer needs to manually select a friend and fill in a friend account; the audio and video call established by the access device is a call between the first terminal and the second terminal online. Therefore, it is avoided that the legitimate first user waits for the second user to go online in order to perform the next step. It occurs, it improves the efficiency of the first legitimate users to retrieve passwords.
  • the embodiment relates to a specific process in which the access device sends the foregoing confidentiality problem and the first prompt information to the first terminal. That is, the foregoing S104 specifically includes: the access device sends the first prompt information to the first terminal, and sends the secret security problem to the first terminal by using the second terminal.
  • the access device may send the first prompt information to the first terminal, and send the security issue to the second terminal, where the second terminal sends the security issue to the first terminal.
  • the second terminal may directly forward the secret security problem to the first terminal, and may perform the format conversion on the security policy and then send the same to the first terminal, and finally the second terminal answers the legal first user. The result is sent to the access device.
  • the process of the first prompt information and the security policy reaching the first terminal goes through three links, which are an access device to the first terminal, an access device to the second terminal, and a second terminal to the first terminal.
  • the communication link separates the confidentiality problem from the transmission of the second result by the first user, which reduces the possibility of the malicious user intercepting the secret security question and the secret security answer, further ensuring the security of the user's privacy.
  • FIG. 3 is a schematic flowchart of Embodiment 2 of an authentication method according to an embodiment of the present invention.
  • the embodiment relates to a specific process of determining, by the access device, the second user from the contact information of the first terminal by using an authentication request and a preset screening policy.
  • the foregoing S102 specifically includes:
  • the access device acquires the first end according to the authentication request and a preset screening policy. First contact information related to the first user on the end; the screening policy is determined by the access device according to the historical communication record of the first terminal.
  • the access device after receiving the authentication request sent by the first terminal, the access device is configured from the contact information stored by the first terminal according to a preset screening policy (for example, in a phone address book, an address book of an instant messaging software, some The address book of the non-instant messaging software such as mail is medium) determining the first contact information related to the legitimate first user.
  • the screening policy may be determined by the access device according to the historical communication record of the first user that is legal on the first terminal.
  • the basis for determining the screening policy may be: compared with the legal time of the first user.
  • the screening policy may be configured by the developer to the access device, or may be determined by the access device through a corresponding algorithm.
  • the foregoing screening policy may be “contacts whose call frequency is about 5% or so”, or “contacts that have multiple calls with a duration of more than 10 minutes”, and may also be “no obvious regularity of the call period”
  • Contacts can also be “contacts with legal first users at a certain geographic distance of more than 1 km”, and can also be “records with legal first users can be traced back to half a year ago or even longer Contact.” Therefore, the access device can obtain the first contact information related to the legal first user from the first terminal according to the foregoing screening policy.
  • the first contact may be a legitimate first user-closed contact.
  • S202 The access device sends the first contact information to the first terminal.
  • S203 The access device receives the identity identifier of the second user that is sent by the first terminal, so that the access device determines the second user according to the identity identifier of the second user.
  • the access device sends the determined first contact information to the first terminal, where the information of the first contact may be the identity of the first contact, the network nickname of the first contact, and the first contact. Image information of people, etc.
  • the first terminal presents the first contact information to the current first user (ie, the user currently using the first terminal), and the first user selects from the first contact information as the second The first contact of the user, and the identity of the selected second user is sent to the access device by using the first terminal, so that the access device determines the second user according to the identifier of the second user.
  • the second user itself is the user of the first terminal's address book to assist the legitimate first user to retrieve the password, that is, the second user itself is a legitimate first user. a trusted or reliable person, so even if the illegal first user obtains the first contact information, the second user is selected from the first contact information, but the second user can still identify the current first through the audio and video call. Whether the user is a legitimate first user.
  • FIG. 4 is a schematic flowchart of Embodiment 3 of an authentication method according to an embodiment of the present invention.
  • This embodiment relates to a specific process in which an access device generates a security policy and a first result according to user behavior data and a secret question template.
  • the security level of the security policy template and the security policy template may be applied to the intimate person of the first user who is legal, and the first user determined by the illegal first user and the access device.
  • the second user colludes and maliciously retrieves the password of the legal first-user network-side account.
  • the foregoing S103 specifically includes:
  • S301 The access device acquires at least one security policy template, where different security policy templates correspond to different security levels.
  • the confidentiality problem template involved in the embodiment of the present invention may be configured by the system administrator or the developer to the access device, or may be obtained by the access device from other core network elements.
  • the secret question template may be one or multiple, and different secret question templates may correspond to different security levels.
  • the definition of the security level of the security policy is determined by the degree of intimacy with the first user. The more intimate the relationship, the higher the security level of the security policy (because the more intimate the relationship with the legitimate first user gets the user's The easier the behavior data is, the more familiar the user's habits are.
  • the secret security problem generated by the security policy template with a lower security level is difficult to prevent the intimate user from maliciously logging into the legitimate first-user network side account.
  • the security level of the secret question template can be divided into three levels (of course, it can also be divided into more detailed levels, here only divided into three levels as an example), assuming that the three levels are: Low, medium and high, corresponding to three groups of people: strangers, people who know, and close people. That is to say, the security policy template with low security level can only be used to block strangers from maliciously retrieving the password of the legal first-user network-side account; the security-level secret protection template can block strangers from maliciously searching.
  • the password of the network-side account of the first user can be blocked, and the password of the network-side account of the first user can be blocked by the recognized person.
  • the security-related template with high security level can prevent the stranger from recovering maliciously.
  • the password of the legal first-user network-side account can also block the malicious person from retrieving the password of the legal first-user network-side account, and can also block the intimate person from maliciously retrieving the legitimate first-user network side.
  • the password for the account can be divided into three levels
  • the secret question template in Table 1 is just some examples. Specifically:
  • this secret question template can effectively protect the three types of people. Which apps are used regularly by a legitimate first user for a certain period of time, only the legitimate first user knows it himself, and others do not. In such problems, it is necessary to remove the high-frequency APP that the public uses every day, such as WeChat, QQ, etc., otherwise others are easy to guess. Then, the remaining APPs are sorted according to the usage duration and frequency, and several APPs are extracted from the higher frequency, the intermediate frequency, and the low frequency, so that the first user who is currently recovering the password is sorted (the first user who currently retrieves the password) It may be legal or illegal.)
  • this type of secret security problem template is mainly set for the specific behavior of the legitimate first user using the APP on the network side device, and the online shopping behavior is only one of them. It is very good for strangers and people who know.
  • This type of question can ask the current first user: which website the legal first user bought at a certain time, what items were purchased on a website.
  • this type of secret security problem is set for the legal first user's time-location information, which can protect the stranger and the recognized person. .
  • this template of confidentiality protection can effectively protect the three types of people. Usually only the legal first user can clearly know the time-position information of his day.
  • the private information of the legal first user mainly refers to some personal information of the legitimate first user when opening an account and handling relevant business, such as the legal ID card information of the first user, real name, and the like.
  • the secret protection problem generated by this type of information can make the first user who is not using the APP for a long time, and can also answer the answer to the secret question.
  • the access device generates the first result of the security policy and the security policy according to the user behavior data, the security policy template, and the security level of the security policy template.
  • the user behavior data related to the embodiment refers to the user behavior data of the first user on the first terminal.
  • a security question template with the highest or the second highest security level may be selected by default (ie, any one of strangers, recognized people, and intimate persons may be blocked). Colliding with the second user, maliciously retrieving the secret password template of the legal account of the first user, and combining the security level template with the high security level and the user behavior data determined above to generate the security issue and the The first result of the secret security issue.
  • the security problem and the first result may be generated in the manner of FIG. 5, and refer to Embodiment 4 shown in FIG. 5:
  • the access device acquires the first secret question template from the at least one security question template according to the security level of the at least one security question template.
  • the first secret security problem may be one or multiple. That is, the access device determines, according to the security level of the at least one security question template, a security policy template with the highest security level as the first security problem template, and may also determine two security levels according to the security level of the at least one security problem template.
  • One or more secret question templates are used as the first secret question template.
  • the two or more secret question templates can block any one of the above three groups of people from colluding with the second user, malicious Recovering the password of the legal first-user network-side account; for example, according to Table 1 above, the determined first secret question template may be “legitimate first-user online shopping behavior” and “right” The order of the APP used by the first legitimate user in a certain period of time", because the "legitimate online shopping behavior of the first user” can only block strangers and people who know, but "for a certain The APP sorting used by the first user in the period can block the above three types of people, so the combination of the two can also prevent the above three types of people from colluding with the second user to maliciously retrieve the password of the legitimate first user.
  • the access device determines a data extraction policy according to the first secret question template, and determines first data from the user behavior data according to the data extraction policy.
  • the access device may determine the data extraction policy according to the type of the first secret question template, where the data extraction policy is used to indicate, by the access device, which data is extracted from the user behavior data stored in the data center of the core network. For example, if the first secret question template is "the first user who regularly uses the APP for a certain period of time", the determined data extraction policy is "the use of a legitimate first user from the data center of the core network. The first data of a certain period of time is extracted from the history record of the APP.
  • the access device extracts the first data from the user behavior data according to the determined data extraction policy.
  • S403 The access device generates the security issue and the first result according to the first secret question template and the first data.
  • the access device may generate multiple first security issues according to the first secret question template and the first data, and some of the multiple first security issues may be the same type of security issue, for example,
  • the determined first secret question template is “sort of the first user regularly used by the APP for a certain period of time”
  • the plurality of first secrets determined according to the first secret question template and the first data The problem may include "sorting the APP used by the legitimate first user within 5s” and “sequencing the application of the legitimate first user within 5s from small to large”.
  • the access device can filter out some similar problems by determining whether each first secret question satisfies a preset difficulty coefficient (similar difficulty coefficients of the first secret question are different); the setting of the difficulty coefficient is completely dependent on The difficulty coefficient is suitable for the legitimate first user, which is set by the legal first user's own behavior and life track. If yes, the access device determines the first security question that satisfies the difficulty coefficient as the security issue and determines the first result of the security issue.
  • the access device determines The first secret question template is "usually used by the first user who is legal for a certain period of time.”
  • the data extraction policy determined by the access device according to the first security question template may be “Querying the APP history recorded by the first user in the T time, and counting the duration and frequency of the APP in the T time”. Then, the data extraction policy of the access device extracts the first data from the data center of the core network, and generates a plurality of first security issues according to the first secret question template and the first data. Further, the access device According to the preset difficulty coefficient, the first security problem of the first user who is difficult and difficult to use is not applicable, and the remaining first secret security problem is used as the final security problem, thereby generating the security problem. The first result.
  • the security level of the security policy template and the security policy template is set to prevent the illegal first user from colluding with the second user determined by the access device, and maliciously retrieving the password of the legal first network user account. That is, the secret security problem template acquired by the access device is not controlled by the second user. Therefore, even if the second user determines the other illegal first user to determine the legal first user, the security problem set by the access device is The template can still prevent the illegal first user from maliciously retrieving the password of the legitimate first user's network side account, thereby further improving the security of the user to retrieve the password.
  • the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
  • the foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.
  • FIG. 6 is a schematic structural diagram of Embodiment 1 of an access device according to an embodiment of the present disclosure.
  • the access device is applicable to the authentication system shown in FIG. 1.
  • the authentication system includes a first terminal of a first user, a second terminal of a second user, an access device, and a network side device, where the terminal passes through
  • the access network element accesses the network side device.
  • the access device includes: a receiving module 10, a determining module 11, a generating module 12, a sending module 13, and a determining module 14.
  • the receiving module 10 is configured to receive an authentication request sent by the first terminal, where the authentication request includes a network side account that needs to retrieve a password, and the authentication request is used to request the access device to Said first user providing a user interface for modifying said password;
  • the determining module 11 is configured to determine, according to the authentication request, a second user that can assist the legal first user to modify the password, and establish an audio-video call connection between the first terminal and the second terminal, The audio-video call connection is used to enable the second user to confirm, by the second terminal, whether the first user is a legitimate first user;
  • a generating module 12 configured to receive, by the receiving module 10, a confirmation sent by the second terminal After the message, generating, according to the collected user behavior data of the first user on the first terminal, a secret question for modifying the password and a first result of the secret question; the confirming The message is used to indicate to the access device that the first user is the legal first user;
  • the sending module 13 is configured to send the security policy and the first prompt information to the first terminal, where the first prompt information is used to assist the legal first user to obtain a second result;
  • the receiving module 10 is further configured to receive the second result sent by the first terminal;
  • the determining module 14 is configured to determine whether the matching degree of the second result and the first result is greater than a preset first threshold; if yes, provide the legal first user with an interface for modifying the password, and indicate The sending module 13 sends a verification success message to the first terminal.
  • the access device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects are similar, and details are not described herein again.
  • the sending module 13 is specifically configured to send the first prompt information to the first terminal, and use the second terminal to The security question is sent to the first terminal.
  • FIG. 7 is a schematic structural diagram of Embodiment 2 of an access device according to an embodiment of the present disclosure.
  • the determining module 11 includes: a first acquiring unit 111 and a determining unit 112;
  • the first obtaining unit 111 is configured to acquire, according to the authentication request and the preset screening policy, first contact information related to the first user on the first terminal, where the screening policy is The access device is determined according to the historical communication record of the first terminal;
  • the sending module 13 is further configured to send the first contact information to the first terminal;
  • the receiving module 10 is further configured to receive an identity identifier of the second user that is sent by the first terminal;
  • the determining unit 112 is configured to determine the second user according to the identity of the second user.
  • the access device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects are similar, and details are not described herein again.
  • FIG. 8 is a schematic structural diagram of Embodiment 3 of an access device according to an embodiment of the present disclosure.
  • the generating module 12 specifically includes:
  • the second obtaining unit 121 is configured to obtain at least one security question template, where different secret question templates correspond to different security levels;
  • the generating unit 122 is configured to generate the confidentiality problem and the first result of the security question according to the user behavior data, any one of the security question template, and the security level of the security question template.
  • FIG. 8 is only based on a case of the embodiment shown in FIG. 7.
  • FIG. 8 can also be shown based on the structure shown in FIG.
  • FIG. 9 is a schematic structural diagram of Embodiment 4 of an access device according to an embodiment of the present disclosure.
  • the generating unit 122 specifically includes: an obtaining subunit 1221, a determining subunit 1222, and a generating subunit 1223;
  • the obtaining sub-unit 1221 is configured to obtain a first secret question template from the at least one security question template according to the security level of the at least one security question template, and determine the sub-unit 1222, according to the first
  • the security policy template determines a data extraction policy, and determines first data from the user behavior data according to the data extraction policy;
  • the generating subunit 1223 is configured to generate the security issue and the first result according to the first secret question template and the first data.
  • the generating sub-unit 1223 is configured to generate a plurality of first secret security questions according to the first secret question template and the first data, and determine whether each of the first secret security issues satisfies a difficulty coefficient set; if yes, determining a first security question that satisfies the difficulty coefficient as the security issue and determining the first result.
  • the access device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects are similar, and details are not described herein again.
  • FIG. 10 is a schematic structural diagram of Embodiment 5 of an access device according to an embodiment of the present disclosure.
  • the access device is applicable to the authentication system shown in FIG. 1.
  • the authentication system includes a first terminal of a first user, a second terminal of a second user, an access device, and a network side device, where the terminal passes through The access network element accesses the network side device.
  • the access device includes a receiver 20, a transmitter 22, and a processor 21.
  • the receiver 20 is configured to receive an authentication request sent by the first terminal, where the authentication request includes a network side account that needs to retrieve a password, and the authentication request is used to request the access device to Said first user providing a user interface for modifying said password;
  • the processor 21 is configured to determine, according to the authentication request, a first user that can assist the legal modification a second user of the password, and establishing an audio-video call connection between the first terminal and the second terminal, and after the receiver 20 receives the confirmation message sent by the second terminal, according to the collected Generating, by the legal first user, user behavior data on the first terminal, a first result of modifying a secret question of the password and the secret question; the audio and video call connection is used to make Determining, by the second terminal, whether the first user is a legal first user by using the second terminal; the confirmation message is used to indicate to the access device that the first user is the legal first user ;
  • the transmitter 22 is configured to send the security policy and the first prompt information to the first terminal, where the first prompt information is used to assist the legal first user to obtain a second result;
  • the receiver 20 is further configured to receive the second result sent by the first terminal;
  • the processor 21 is further configured to determine whether a matching degree between the second result and the first result is greater than a preset first threshold; if yes, provide an interface for modifying the password to the legal first user. And instructing the sender 22 to send an authentication success message to the first terminal.
  • the access device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects are similar, and details are not described herein again.
  • the transmitter 22 is specifically configured to send the first prompt information to the first terminal, and send the secret security problem to the first terminal by using the second terminal.
  • the processor 21 is configured to acquire first contact information related to the first user on the first terminal according to the authentication request and a preset screening policy, and receive the first contact information according to the The identity of the second user received by the device 20 determines the second user; the screening policy is determined by the access device according to the historical communication record of the first terminal;
  • the transmitter 22 is further configured to send the first contact information to the first terminal, and the receiver 20 is further configured to receive the identity of the second user sent by the first terminal. .
  • the processor 21 is specifically configured to acquire at least one secret question template, and generate the secret according to the user behavior data, any secret question template, and a security level of the secret question template.
  • the first result of the security issue and the security policy wherein different security policy templates correspond to different security levels.
  • the processor 21 is configured to obtain, according to the security level of the at least one security question template, the first secret question template from the at least one security question template, and according to the first
  • the secret question template determines a data extraction policy, and determines first data from the user behavior data according to the data extraction policy, and according to the first secret question template and the The first data generates the secret question and the first result.
  • the processor 21 is configured to generate, according to the first secret question template and the first data, a plurality of first secret security issues, and determine whether each of the first secret security issues is met. a preset difficulty coefficient; if yes, determining a first security question that satisfies the difficulty coefficient as the security issue and determining the first result.
  • the access device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects are similar, and details are not described herein again.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明提供一种鉴权方法和接入设备。该方法包括：接入设备根据接收到的鉴权请求确定能够协助合法的第一用户修改密码的第二用户，并建立第一终端和第二终端的音视频通话连接，接入设备根据所采集的合法的第一用户在第一终端上的用户行为数据生成用于修改密码的密保问题和密保问题的第一结果，提高了用户修改密码的安全性。

Description

鉴权方法和接入设备 技术领域
本发明涉及通信技术，尤其涉及一种鉴权方法和接入设备。
背景技术
传统的鉴权方式，是通过用户名和密码的组合进行来验证用户身份的。这种方式的前提是每个获得密码的用户在系统中都已经被授权，并且在用户注册结束后，用户名和密码需要由用户自己来保管。一旦用户忘记密码，则无法通过上述鉴权方式进行登陆。
针对如上的问题，开发者往往会在设置账号系统的同时，加入“找回密码”功能，即通过某种非“用户名-密码”的技术手段，验证用户身份，并重新设置密码。目前与“找回密码”功能相关的技术主要是在用户注册账号的同时，指示用户预设一些密保问题和密保问题对应的答案。这些密保问题大多与用户的私密信息相关，具有一定的保密性，若用户忘记密码，则可以通过回答这些预设的密保问题，当用户输入的答案与之前预设答案相同后，系统自动进入密码重置阶段，供用户使用。
但是，现有技术中，密保问题在一个固定的“问题集”中选择，问题的范围固定，可选择性很差，导致他人容易猜测，存在安全风险；另外，密保问题答案固定且需要精确匹配，而随着时间的增长，用户有可能忘记密保问题的答案，导致用户无法找回密码。
发明内容
本发明实施例提供的鉴权方法和接入设备，用以解决现有技术中密保问题的范围固定，可选择性很差，安全性低的技术问题；并且，还用以解决现有技术中因密保问题答案固定且需要精确匹配，当用户忘记密保问题的答案时，导致用户无法找回密码，人机交互不够智能性的技术问题。
第一方面，本发明实施例提供一种鉴权方法，适用于鉴权系统，所述鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧 设备，所述终端通过所述接入网元接入所述网络侧设备；所述方法包括：
所述接入设备接收所述第一终端发送的鉴权请求；所述鉴权请求包括需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口；
所述接入设备根据所述鉴权请求确定能够协助合法的第一用户修改所述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户；
所述接入设备在接收到所述第二终端发送的确认消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述确认消息用于向所述接入设备指示所述第一用户为所述合法的第一用户；
所述接入设备将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果；
所述接入设备接收所述第一终端发送的所述第二结果，并判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则所述接入设备向所述第一终端发送验证成功消息，并向所述合法的第一用户提供修改所述密码的接口。
结合第一方面，在第一方面的第一种可能的实施方式中，所述接入设备将所述密保问题和第一提示信息发送给所述第一终端，包括：
所述接入设备将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
结合第一方面或第一方面的第一种可能的实施方式，在第一方面的第二种可能的实施方式中，所述接入设备根据所述鉴权请求确定能够协助第一用户修改所述密码的第二用户，包括：
所述接入设备根据所述鉴权请求和预设的筛选策略，获取所述第一终端上的与第一用户相关的第一联系人信息；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的；
所述接入设备向所述第一终端发送所述第一联系人信息；
所述接入设备接收所述第一终端发送的所述第二用户的身份标识，并根 据所述第二用户的身份标识确定所述第二用户。
结合第一方面至第一方面的第二种可能的实施方式中的任一项，在第一方面的第三种可能的实施方式中，所述接入设备根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果，包括：
所述接入设备获取至少一个密保问题模板；其中，不同的密保问题模板对应不同的安全等级；
所述接入设备根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果。
结合第一方面的第三种可能的实施方式，在第一方面的第四种可能的实施方式中，所述接入设备根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果，具体包括：
所述接入设备根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板；
所述接入设备根据所述第一密保问题模板确定数据提取策略，并根据所述数据提取策略从所述用户行为数据中确定第一数据；
所述接入设备根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果。
结合第一方面的第四种可能的实施方式，在第一方面的第五种可能的实施方式中，所述接入设备根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果，包括：
所述接入设备根据所述第一密保问题模板和所述第一数据生成多个第一密保问题；
所述接入设备判断每个所述第一密保问题是否满足预设的难度系数；
若是，则所述接入设备将满足所述难度系数的第一密保问题确定为所述密保问题，并确定所述第一结果。
第二方面，本发明实施例提供一种接入设备，适用于鉴权系统，所述鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧设备，所述终端通过所述接入网元接入所述网络侧设备；所述接入设备包括：
接收模块，用于接收所述第一终端发送的鉴权请求；所述鉴权请求包括需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口；
确定模块，用于根据所述鉴权请求确定能够协助合法的第一用户修改所述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户；
生成模块，用于在所述接收模块接收到所述第二终端发送的确认消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述确认消息用于向所述接入设备指示所述第一用户为所述合法的第一用户；
发送模块，用于将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果；
所述接收模块，还用于接收所述第一终端发送的所述第二结果；
判断模块，用于判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则向所述合法的第一用户提供修改所述密码的接口，并指示所述发送模块向所述第一终端发送验证成功消息。
结合第二方面，在第二方面的第一种可能的实施方式中，所述发送模块，具体用于将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
结合第二方面或第二方面的第一种可能的实施方式，在第二方面的第二种可能的实施方式中，所述确定模块，包括：第一获取单元和确定单元；
所述第一获取单元，用于根据所述鉴权请求和预设的筛选策略，获取所述第一终端上的与第一用户相关的第一联系人信息；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的；
所述发送模块，还用于向所述第一终端发送所述第一联系人信息；
所述接收模块，还用于接收所述第一终端发送的所述第二用户的身份标识；
所述确定单元，用于根据所述第二用户的身份标识确定所述第二用户。
结合第二方面至第二方面的第二种可能的实施方式中的任一项，在第二 方面的第三种可能的实施方式中，所述生成模块，包括：
第二获取单元，用于获取至少一个密保问题模板；其中，不同的密保问题模板对应不同的安全等级；
生成单元，用于根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果。
结合第二方面的第三种可能的实施方式，在第二方面的第四种可能的实施方式中，所述生成单元，具体包括：
获取子单元，用于根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板；
确定子单元，用于根据所述第一密保问题模板确定数据提取策略，并根据所述数据提取策略从所述用户行为数据中确定第一数据；
生成子单元，用于根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果。
结合第二方面的第四种可能的实施方式，在第二方面的第五种可能的实施方式中，所述生成子单元，具体用于根据所述第一密保问题模板和所述第一数据生成多个第一密保问题，并判断每个所述第一密保问题是否满足预设的难度系数；若是，则将满足所述难度系数的第一密保问题确定为所述密保问题，并确定所述第一结果。
第三方面，本发明实施例提供一种接入设备，适用于鉴权系统，所述鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧设备，所述终端通过所述接入网元接入所述网络侧设备；所述接入设备包括：
接收器，用于接收所述第一终端发送的鉴权请求；所述鉴权请求包括需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口；
处理器，用于根据所述鉴权请求确定能够协助合法的第一用户修改所述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，并在所述接收器接收到所述第二终端发送的确认消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户；所述确认 消息用于向所述接入设备指示所述第一用户为所述合法的第一用户；
发送器，用于将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果；
所述接收器，还用于接收所述第一终端发送的所述第二结果；
所述处理器，还用于判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则向所述合法的第一用户提供修改所述密码的接口，并指示所述发送器向所述第一终端发送验证成功消息。
结合第三方面，在第三方面的第一种可能的实施方式中，所述发送器，具体用于将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
结合第三方面或第三方面的第一种可能的实施方式，在第三方面的第二种可能的实施方式中，所述处理器，具体用于根据所述鉴权请求和预设的筛选策略，获取所述第一终端上的与第一用户相关的第一联系人信息，并根据所述接收器接收到的所述第二用户的身份标识确定所述第二用户；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的；
所述发送器，还用于向所述第一终端发送所述第一联系人信息；
所述接收器，还用于接收所述第一终端发送的所述第二用户的身份标识。
结合第三方面至第三方面的第二种可能的实施方式中的任一项，在第三方面的第三种可能的实施方式中，所述处理器，具体用于获取至少一个密保问题模板，并根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果；其中，不同的密保问题模板对应不同的安全等级。
结合第三方面的第三种可能的实施方式，在第三方面的第四种可能的实施方式中，所述处理器，具体用于根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板，并根据所述第一密保问题模板确定数据提取策略，以及根据所述数据提取策略从所述用户行为数据中确定第一数据，并根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果。
结合第三方面的第四种可能的实施方式，在第三方面的第五种可能的实施方式中，所述处理器，具体用于根据所述第一密保问题模板和所述第一数 据生成多个第一密保问题，并判断每个所述第一密保问题是否满足预设的难度系数；若是，则将满足所述难度系数的第一密保问题确定为所述密保问题，并确定所述第一结果。
本发明实施例提供的鉴权方法和接入设备，接入设备根据第一终端发送的鉴权请求确定能够协助合法的第一用户修改密码的第二用户，并建立第一终端和第二终端的音视频通话连接，使第二用户确认当前的第一用户是否为合法的第一用户；接入设备在接收到第二终端发送的确认消息后，根据所采集的合法的第一用户在第一终端上的用户行为数据生成用于修改密码的密保问题和所述密保问题的第一结果，并将所述密保问题和第一提示信息发送给所述第一终端后，接收第一终端发送的所述第二结果，并判断第二结果与第一结果的匹配度是否大于预设第一阈值；若是，则接入设备向所述第一终端发送验证成功消息，并向所述合法的第一用户提供修改所述密码的接口。本发明实施例中，密保问题并不是从用户预设的固定问题集中选择的，而是接入设备通过用户行为数据生成的，故具有一定的随机性，非法用户不容易猜测，安全性高；并且由于第一提示信息的存在，可以方便合法的第一用户快速找到密保问题的答案，而不是单纯的依靠合法的第一用户的记忆力，从而提高了人机交互的智能性；进一步地，本发明实施例提供的密保问题的答案的验证方式加入了模糊匹配功能，即只要用户的答案包含了正确答案中的必要元素，即可通过验证，为忘记密码的合法的第一用户在找回密码时进一步提供了方便；另外，本发明实施例提供的方法，避免了复杂的人工操作以及大量的资料填写，且是由接入设备确定的第二用户，不再需要人工选择好友以及填写好友账号；接入设备所建立的音视频通话是第一终端和在线的第二终端之间的通话，因此避免了合法的第一用户长时间等待第二用户上线才能执行下个步骤的情况发生，故提高了合法的第一用户找回密码的效率。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附 图。
图1为本发明实施例提供的鉴权系统的结构示意图；
图2为本发明实施例提供的鉴权方法实施例一的流程示意图；
图3为本发明实施例提供的鉴权方法实施例二的流程示意图；
图4为本发明实施例提供的鉴权方法实施例三的流程示意图；
图5为本发明实施例提供的鉴权方法实施例四的流程示意图；
图6为本发明实施例提供的接入设备实施例一的结构示意图；
图7为本发明实施例提供的接入设备实施例二的结构示意图；
图8为本发明实施例提供的接入设备实施例三的结构示意图；
图9为本发明实施例提供的接入设备实施例四的结构示意图；
图10为本发明实施例提供的接入设备实施例五的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例涉及的方法，适用于鉴权系统，该鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧设备。第一终端或第二终端可以通过接入设备接入到网络侧设备上，也就是说接入设备可以为第一终端或者第二终端能够顺利接入网络侧设备的一个屏障或者验证关卡。该鉴权系统架构图可以参见图1所示。
本发明实施例所涉及的第一终端和第二终端，可以是任何便携式移动终端，包括但不限于移动电话、移动电脑、平板电脑、个人数字助理(Personal Digital Assistant,PDA)、媒体播放器、智能电视、智能手表、智能眼镜、智能手环等，也包括自动柜员机(Automatic Teller Machine，简称ATM)等设备，本发明实施例并不限定。另外，本实施例中中，凡是使用第一终端的用户都可以称为第一用户。当第一终端与第二终端进行通信时，实际上也就是第一用户与第二用户在进行通信，即，第一 终端可以理解为第一用户本身，第二终端可以理解为第二用户本身。
本发明实施例的涉及的接入设备，可以为集成了聚合云平台的实体网元，本发明实施例涉及的网络侧设备，其内部集成了一种移动虚拟化单元。该移动虚拟化单元中包含虚拟机(Virtual User Equipment，简称VUE)及轻量级服务器(Lite Server)。其中，虚拟机为终端用户提供虚拟机服务，Lite Server可作为应用的轻量级服务器，提供互联网应用服务器的部分功能，或者也可以作为开发者部署在平台上的应用服务器，为用户提供完整的互联网服务。用户可以使用自身的移动终端设备通过上述接入设备与上述移动虚拟化单元中的虚拟机相连接，从而使用虚拟机服务。在移动虚拟化单元内部，虚拟机中的多种应用可以分别与对应的Lite Server交互，从而使用互联网应用服务商提供的应用。
本发明实施例提供的方法，旨在解决现有技术中密保问题的范围固定，可选择性很差，导致他人容易猜测，存在安全风险的技术问题；并且，还可以为解决现有技术中因密保问题答案固定且需要精确匹配，当用户忘记密保问题的答案时，导致用户无法找回密码，人机交互不够智能性的技术问题。
下面以具体地实施例对本发明的技术方案进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例不再赘述。
图2为本发明实施例提供的鉴权方法实施例一的流程示意图。该方法适用于上述图1所示的鉴权系统。如图1所示，该方法包括如下步骤：
S101：接入设备接收所述第一终端发送的鉴权请求；所述鉴权请求包括需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口。
具体的，第一用户通过第一终端向接入设备发送鉴权请求，即该鉴权请求包括需要找回密码的网络侧账号，即该鉴权请求可以为一密码找回请求，用于请求上述接入设备向第一用户提供修改所述密码的用户接口。可选的，该用户接口可以为接入设备为该第一用户提供的密码找回服务或者密码找回界面。可选的，该第一用户可以是网络侧账号对应的合法的第一用户，也可以是其他的非法用户。
S102：接入设备根据所述鉴权请求确定能够协助合法的第一用户修改所 述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户。
具体的，接入设备在接收到上述鉴权请求后，根据该鉴权请求确定能够协助合法的第一用户修改所述密码的第二用户。可选的，接入设备确定能够协助第一用户修改上述网络侧账号的密码的第二用户，可以是通过从第一终端的通讯录或者即时通信软件上直接获取在线的第二用户(该第二用户是与合法的第一用户相关的，但是当非法的第一用户通过第一终端向接入设备发送鉴权请求时，接入设备仍然需要确定出可以协助合法的第一用户修改密码的第二用户，帮助接入设备确认当前的第一用户是非法的第一用户)，例如，合法的第一用户的朋友、亲人、同事等，总之第二用户就是合法的第一用户可信任的，并且愿意帮助合法的第一用户找回密码的人。可选的，接入设备确定第二用户还可以为接入设备预先向第一终端提供一些第一终端上比较可靠的在线联系人，然后由第一用户(无论合法还是非法的第一用户，都可以选择)从这些可靠联系人中自主选择第二用户，并通过第一终端将第二用户告知给接入设备即可；还可以是接入设备从核心网侧的设备上获取合法的第一用户预设的一些可靠联系人，并从这些预设的可靠联系人中依据一定的选择策略选择能够协助合法的第一用户找回密码的第二用户。需要说明的是，上述从可靠联系人中选择第二用户的选择策略，可以是用户预设在接入设备上的选择依据。可选的，第二用户可以为一个用户，也可以为多个用户。另外，当上述第一用户为非法的第一用户时，接入设备此时并没有辨别功能，因此接入设备仍然需要为该非法的第一用户确定第二用户，只不过该第二用户是协助合法的第一用户修改密码的用户，故，在下述的音视频通话阶段中，第二用户就可以通过音视频通话将非法的第一用户告知给接入设备，使得接入设备拒绝该非法的第一用户的鉴权请求。
当上述接入设备确定了第二用户后，该接入设备会向第二终端发送建立音视频通话的请求，以建立第一终端和第二终端之间的音视频通话。当第二用户选择接受该音视频通话的请求后，接入设备就建立起上述第一用户的第一终端与第二用户的第二终端之间的音视频通话，从而使得第一用户和第二用户可以进行音视频通信，进而使得第二用户可以通过该音视频通过确定上 述第一用户是否为合法的第一用户，即确定第一用户是否为使用上述网络侧账号的正确用户。需要说明的是，上述涉及的音视频通话，可以为单纯的音频通话，也可以为单纯的视频通话(可以没有声音等音频信息)，还可以为普通的既有音频又有视频的通话。
当第二用户确定上述第一用户为合法的第一用户后，通过其自身的第二终端向接入设备发送确认消息。可选的，当第二用户为多个时，多个第二用户均会通过其自身的第二终端发送确认消息，当确认消息的个数达到预设阈值时，接入设备就可以认为该第一用户是合法的第一用户，而无需所有的第二用户均向接入设备发送确认消息。
S103：接入设备在接收到所述第二终端发送的确认消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述确认消息用于向所述接入设备指示所述第一用户为所述合法的第一用户。
一般的，第一用户在使用第一终端的过程中，接入设备会根据自身提取用户数据行为的能力对合法的第一用户在第一终端上的用户行为进行数据采集，并将用户行为数据存入核心网的数据中心。本实施例中，用户行为数据均指的是合法的第一用户在第一终端上的用户行为数据。可选的，用户行为数据可以为合法的第一用户使用第一终端中的应用软件(APP)的历史使用记录，也可以为合法的第一用户使用APP的具体行为信息(如网购、支付、社交好友等)，还可以为接入设备获取的第一终端的位置信息和获取时间。前两类信息和合法的第一用户使用APP的行为有关，第三类信息依靠接入设备或者网络侧设备的定位能力收集合法的第一用户的日常生活轨迹。对于合法的第一用户使用APP的历史记录，接入设备可以借助网络侧设备的操作系统通过系统日志的方式获取。接入设备可以针对特定的用户，从其上网日志中获取其偏好，甚至获取其某次非常详细的具体行为，比如网购了什么物品；需要注意的是，接入设备平台要获取这一类信息需要和合法的第一用户、服务提供商、运营商达成一致协议。
当接入设备接收到上述第二终端发送的确认消息后，即确认第一用户为合法的第一用户后，会根据上述所采集的所述合法的第一用户在第一终端上的用户行为数据生成用于修改上述网络侧账号的密码的密保问题和所述密保 问题的第一结果。可选的，上述密保问题可以是接入设备单纯依赖合法的第一用户在第一终端上的用户行为数据生成的，也可以是接入设备结合合法的第一用户在第一终端上的用户行为数据和预设的问题模板生成的。无论是哪一种，本发明实施例生成的密保问题均是基于合法的第一用户在第一终端上的用户行为数据，其可以是随机生成的，并且由于用户的行为数据是一个变化的状态，因此不同时刻生成的密保问题也可以是不同的，故本发明实施例提供的方法，密保问题并不是从用户预设的固定问题集中选择的，而是具有一定的随机性，因此可选择性强，非法用户不容易猜测，具有较强的安全性。
S104：接入设备将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果。
具体的，当接入设备生成密保问题和密保问题的第一结果(该第一结果即就是密保问题的正确答案)后，会将该密保问题和辅助合法的第一用户获取该密保问题的第一结果的第一提示信息发送给第一终端。可选的，可以是接入设备直接将密保问题和第一提示信息发送给第一终端，还可以是接入设备通过其他的设备将密保问题和第一提示信息发送给第一终端的，本发明实施例对接入设备如何将密保问题和第一提示信息发送给第一终端的方式并不做限定。
需要说明的是，上述第一提示信息可以为辅助忘记上述网络侧账号密码的合法的第一用户找到第一结果的选择类型的辅助信息，例如，可以是提供给合法的第一用户几个密保问题的答案的选择项(这些选择项可以是图片形式、文字形式、图标或者语音等形式)，让合法的第一用户从这些选择项中选择正确的第一结果；或者，该第一提示信息可以为给出合法的用户隐含提示的非选择项信息，例如：当密保问题是“你最喜欢的音乐是哪一首”，该第一提示信息就可以是歌手的名字等，总之第一提示信息的存在，可以方便合法的第一用户快速找到该密保问题的答案，而不是单纯的依靠合法的第一用户的记忆力，从而提高了人机交互的智能性。
当第一终端接收到接入设备发送的密保问题和第一提示信息后，会根据这二者得到第二结果，并将第二结果发送给接入设备。
S105：接入设备接收所述第一终端发送的所述第二结果，并判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则所述接入 设备向所述第一终端发送验证成功消息，并向所述合法的第一用户提供修改所述密码的接口。
具体的，接入设备接收到合法的第一用户确定的第二结果后，可选的，可以将该第二结果转换为接入设备中的特定密保答案格式(例如语音形式、文字形式等)，方便后面与第一结果进行匹配。接入设备判断该第二结果与第一结果的匹配度是否达到预设的第一阈值，该第一阈值是预设的确定第一结果和第二结果匹配的最低限值，该第一阈值可以是一个百分比值，当第一结果和第二结果相同时，该第一阈值就为100％，当然，该第一阈值的形式还可以是其他的方式，本发明实施例对此并不做限定。因此，本发明实施例提供的密保问题的答案的验证方式加入了模糊匹配功能，即只要合法的第一用户的答案包含了正确答案中的必要元素，即可通过验证，为忘记密码的合法的第一用户在找回密码时进一步提供了方便。
当接入设备确定上述第二结果与第一结果的匹配度达到预设的第一阈值后，接入设备确定该第二结果是正确的，则就向第一终端发送验证成功消息，并向合法的第一用户提供修改密码的接口。
可选的，本发明实施例提供的鉴权方法也可以应用在常规的用户登陆应用中，即当接入设备确认上述第二结果正确后(即说明用户回答密保问题的答案是正确的)，则接入设备就可以让该合法的用户通过第一终端直接登录应用(即直接接入网络侧设备)，合法的第一用户无需再次输入用户名和密码，简化了用户的操作。
本发明实施例提供的鉴权方法，接入设备根据第一终端发送的鉴权请求确定能够协助合法的第一用户修改密码的第二用户，并建立第一终端和第二终端的音视频通话连接，使第二用户确认当前的第一用户是否为合法的第一用户；接入设备在接收到第二终端发送的确认消息后，根据所采集的合法的第一用户在第一终端上的用户行为数据生成用于修改密码的密保问题和所述密保问题的第一结果，并将所述密保问题和第一提示信息发送给所述第一终端后，接收第一终端发送的所述第二结果，并判断第二结果与第一结果的匹配度是否大于预设第一阈值；若是，则接入设备向所述第一终端发送验证成功消息，并向所述合法的第一用户提供修改所述密码的接口。本发明实施例中，密保问题并不是从用户预设的固定问题集中选择的，而是接入设备通过 用户行为数据生成的，故具有一定的随机性，非法用户不容易猜测，安全性高；并且由于第一提示信息的存在，可以方便合法的第一用户快速找到密保问题的答案，而不是单纯的依靠合法的第一用户的记忆力，从而提高了人机交互的智能性；进一步地，本发明实施例提供的密保问题的答案的验证方式加入了模糊匹配功能，即只要用户的答案包含了正确答案中的必要元素，即可通过验证，为忘记密码的合法的第一用户在找回密码时进一步提供了方便；另外，本发明实施例提供的方法，避免了复杂的人工操作以及大量的资料填写，且是由接入设备确定的第二用户，不再需要人工选择好友以及填写好友账号；接入设备所建立的音视频通话是第一终端和在线的第二终端之间的通话，因此避免了合法的第一用户长时间等待第二用户上线才能执行下个步骤的情况发生，故提高了合法的第一用户找回密码的效率。
作为本发明实施例的一种可能的实施方式，本实施例涉及的是接入设备将上述密保问题和第一提示信息发送给第一终端的具体过程。即上述S104具体包括：接入设备将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
具体的，接入设备可以将上述第一提示信息发送给第一终端，并将上述密保问题发送给第二终端，由第二终端将该密保问题发送给所述第一终端。可选的，第二终端可以将密保问题直接转发给第一终端，还可以将密保问题进行格式转换后发送给第一终端，最后由第一终端将合法的第一用户作答的第二结果发送给接入设备。
本实施例，第一提示信息和密保问题到达第一终端的过程经历了三条链路，分别是接入设备到第一终端、接入设备到第二终端、第二终端到第一终端的通信链路，由于三条链路将密保问题和第一用户作答的第二结果的传输分开，降低了被恶意用户截获密保问题和密保答案的可能，进一步保证了用户隐私的安全。
图3为本发明实施例提供的鉴权方法实施例二的流程示意图。本实施例涉及的是接入设备通过鉴权请求和预设的筛选策略从第一终端的联系人信息中确定第二用户的具体过程。在上述图2所示实施例的基础上，上述S102具体包括：
S201：接入设备根据所述鉴权请求和预设的筛选策略，获取所述第一终 端上的与第一用户相关的第一联系人信息；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的。
具体的，接入设备接收到第一终端发送的鉴权请求后，根据预设的筛选策略从第一终端存储的联系人信息中(例如电话通讯录中、即时通讯软件的通讯录中、一些邮件等非即时通讯软件的通讯录中等)确定与合法的第一用户相关的第一联系人信息。该筛选策略可以是接入设备根据所述第一终端上合法的第一用户的历史通信记录确定的，可选的，确定该筛选策略的依据可以为：与合法的第一用户的通话时间较长、与合法的第一用户的通话频次较多、与合法的第一用户通话的通话时段分布无明显规律、与合法的第一用户进行通话的地理位置等信息，即就是筛选策略根据这些信息来确定。该筛选策略可以是开发人员配置给接入设备的，也可以是接入设备通过相应的算法确定的。
可选的，上述筛选策略可以为“通话频次在前5％左右的联系人”，也可以为“存在多次时长超过10分钟的通话的联系人”，还可以为“通话时段无明显规律的联系人”，还可以为“与合法的第一用户在该某一刻的地理距离超过1公里的联系人”，还可以为“与合法的第一用户的通话记录可追溯到半年前甚至更久的联系人”。因此，接入设备就可以根据上述筛选策略从第一终端中获取到与合法的第一用户相关的第一联系人信息。可选的，该第一联系人可以为合法的第一用户关系紧密的联系人。
S202：接入设备向所述第一终端发送所述第一联系人信息。
S203：接入设备接收所述第一终端发送的所述第二用户的身份标识，以使所述接入设备根据所述第二用户的身份标识确定所述第二用户。
具体的，接入设备将上述所确定的第一联系人信息发送给第一终端，该第一联系人的信息可以为第一联系人的身份标识、第一联系人的网络昵称、第一联系人的图像信息等。第一终端在获取到第一联系人信息后，会将其呈现给当前的第一用户(即当前使用第一终端的用户)，由第一用户从第一联系人信息中选择可以作为第二用户的第一联系人，并将所选择的第二用户的身份标识通过第一终端发送给接入设备，使得接入设备根据该第二用户的标识确定第二用户。需要说明的是，由于第二用户本身是第一终端的通讯录中协助合法的第一用户找回密码的用户，即第二用户本身是合法的第一用户可 信任或者可靠的人，因此即使非法的第一用户获取到第一联系人信息后，从第一联系人信息中选择第二用户，但该第二用户仍然可以通过音视频通话辨别当前的第一用户是不是合法的第一用户。
图4为本发明实施例提供的鉴权方法实施例三的流程示意图。本实施例涉及的是接入设备根据用户行为数据和密保问题模板生成密保问题和第一结果的具体过程。本发明实施例设置密保问题模板和密保问题模板的安全级别，可以适用于非法的第一用户是合法的第一用户的亲密的人，且非法的第一用户与接入设备确定的第二用户串通，恶意找回合法的第一用户的网络侧账号的密码的场景。在上述实施例的基础上，进一步地，上述S103具体包括：
S301：接入设备获取至少一个密保问题模板；其中，不同的密保问题模板对应不同的安全等级。
具体的，本发明实施例涉及的密保问题模板可以是系统管理员或者开发者配置给接入设备的，也可以是接入设备从其他的核心网网元中的获取的。该密保问题模板可以是一个，也可以是多个，不同的密保问题模板可以对应不同的安全等级。密保问题的安全级别的定义是由与第一用户的关系亲密程度而定的，关系越亲密，密保问题的安全级别越高(因为与合法的第一用户关系越亲密的人获得用户的行为数据就为越容易，对用户的习惯也就越了解，根据安全级别较低的密保问题模板生成的密保问题就难以阻挡该亲密用户恶意登录合法的第一用户的网络侧账号)。
可选的，密保问题模板的安全级别可以划分为3个等级(当然，也可以划分为更细致的等级，此处仅以划分为3个等级为例)，假设这3个等级分别为：低、中、高，分别对应三个人群：陌生人、认识的人、亲密的人。也就是说，安全级别低的密保问题模板仅能用于阻挡陌生人恶意找回合法的第一用户的网络侧账号的密码；安全级别为中的密保问题模板既可以阻挡陌生人恶意找回合法的第一用户的网络侧账号的密码，也可以阻挡认识的人恶意找回合法的第一用户的网络侧账号的密码；安全级别高的密保问题模板既可以阻挡陌生人恶意找回合法的第一用户的网络侧账号的密码，也可以阻挡认识的人恶意找回合法的第一用户的网络侧账号的密码，还可以阻挡亲密的人恶意找回合法的第一用户的网络侧账号的密码。
上述密保问题模板的安全级别与陌生人、认识的人以及亲密的人之间的对应关系参见表1所示的例子，表1中的密保问题模板只是一些示例。具体为：
表1
Figure PCTCN2015078346-appb-000001
上述表1中，“√”表示相应的密保问题模板可以阻挡该类非法用户恶意找回合法的第一用户的网络侧账号的密码，“——”表示相应的密保问题模板无法阻挡该类非法用户恶意找回合法的第一用户的网络侧账号的密码。对于表1的解释可以参见下述描述：
对“某段时间内合法的第一用户经常使用APP排序”，这一密保问题模板对三类人群都能有效防护。合法的第一用户在某段时间内经常使用哪些APP，只有合法的第一用户自己清楚，其他人并不知道。在这类问题中，需要将大众每天都在使用的高频APP去掉，如微信、QQ等，否则其他人易于猜测。然后将余下的APP按照使用时长、频次等综合排序，分别从较高频、中频、低频中抽取几款APP，让当前正在找回密码的第一用户进行排序(当前找回密码的第一用户可能是合法的，也可能是非法的)。
对“合法的第一用户网购行为”，这一类密保问题模板主要是针对合法的第一用户使用网络侧设备上的APP的具体行为来设定的，网购行为只是其中的一种。对陌生人和认识的人能很好的防护。这一类问题可以询问当前的第一用户：合法的第一用户某段时间内在哪个网站购物，在某网站购买了什么物品。
对“合法的第一用户在确定时间段去过某地”，这一类密保问题针对合法的第一用户的时间-位置信息而设定，对陌生人和认识的人能很好的防护。
对“合法的第一用户去确定地点的时间段”，这一密保问题模板对三类人群都能有效防护。通常只有合法的第一用户本人才能清楚的知道自己一天的时间-位置信息。
对“合法的第一用户私密信息”，这一密保问题模板对三类人群都能有效防护。合法的第一用户的私密信息主要是指合法的第一用户在开户、办理相关业务时的一些个人信息，比如合法的第一用户的身份证信息、真实姓名等。由这一类信息产生的密保问题可以让长时间不用APP的合法的第一用户，也能回答出密保问题答案。
S302：接入设备根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果。
具体的，本实施例涉及的用户行为数据，均指的是合法的第一用户在第一终端上的用户行为数据。
当接入设备获取到上述密保问题模板后，可选的，可以默认选择一个安全级别最高或者次高的密保问题模板(即可以阻挡陌生人、认识的人以及亲密的人中的任一个与第二用户串通，恶意找回合法的第一用户的账号密码的密保问题模板)，并结合该安全级别高的密保问题模板和上述所确定的用户行为数据，生成密保问题和该密保问题的第一结果。
当接入设备获取到上述密保问题模板后，可选的，可以通过图5的方式生成密保问题和第一结果，参见图5所示的实施例四：
S401：接入设备根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板。
可选的，该第一密保问题可以为一个，也可以为多个。即接入设备根据上述至少一个密保问题模板的安全等级确定出一个安全等级最高的密保问题模板作为第一密保问题模板，也可以根据上述至少一个密保问题模板的安全等级确定出两个或者多个密保问题模板作为第一密保问题模板，只要确定出这两个或者多个密保问题模板相互结合以后，能够阻挡上述三类人群中任一人群与第二用户串通，恶意找回合法的第一用户的网络侧账号的密码即可；例如，按照上述表1所示，所确定出的第一密保问题模板可以为“合法的第一用户的网购行为”和“对某段时间内合法的第一用户使用的APP排序”，由于“合法的第一用户的网购行为”只能阻挡陌生人和认识的人，但“对某 段时间内合法的第一用户使用的APP排序”可以阻挡上述三类人群，因此二者结合也是可以阻挡上述三类人群与第二用户串通恶意找回合法的第一用户的密码的。
S402：接入设备根据所述第一密保问题模板确定数据提取策略，并根据所述数据提取策略从所述用户行为数据中确定第一数据。
可选的，接入设备可以根据第一密保问题模板的类型确定数据提取策略，该数据提取策略的作用就是指示接入设备从核心网的数据中心中存储的用户行为数据中提取哪些数据。例如，假设第一密保问题模板是“对某段时间内合法的第一用户经常使用APP排序”，则确定的数据提取策略就是“从核心网的数据中心存储的合法的第一用户使用某款APP上历史记录中提取某段时间内的第一数据”。
之后，接入设备根据所确定的数据提取策略从用户行为数据中提取第一数据。
S403：接入设备根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果。
具体的，接入设备可以根据上述第一密保问题模板和上述第一数据生成多个第一密保问题，这多个第一密保问题中部分可能是同一类的密保问题，例如，当确定的第一密保问题模板为“对某段时间内合法的第一用户经常使用APP排序”，则根据该第一密保问题模板以及上述第一数据确定出来的多个第一密保问题就可能包括“在5s内对合法的第一用户所使用的APP进行排序”、“在5s内对合法的第一用户所使用的APP进行从小到大排序”等相似问题”
因此，接入设备可以通过判断每个第一密保问题是否满足预设的难度系数过滤掉一些类似问题(类似的第一密保问题难度系数是不同的)；该难度系数的设定完全依赖于合法的第一用户自身的行为和生活轨迹设定的，难度系数适合于合法的第一用户。若满足，则接入设备将满足所述难度系数的第一密保问题确定为所述密保问题，并确定该密保问题的第一结果。
为了更好的理解接入设备根据第一密保问题模板以及第一数据生成所述密保问题和所述第一结果的过程，此处举一个简单的例子来说明：假设接入设备确定的第一密保问题模板为“对某段时间内合法的第一用户经常使用APP 排序”，接入设备根据该第一密保问题模板确定出的数据提取策略可以为“查询T时间内合法的第一用户使用过的APP历史记录，统计T时间内APP使用时长和频次”。然后，接入设备该数据提取策略从核心网的数据中心中去提取第一数据，并根据第一密保问题模板和该第一数据生成多个第一密保问题。进一步地，接入设备根据预设的难度系数过滤掉难度较易以及难度较大不适用于合法的第一用户的第一密保问题，余下的第一密保问题作为最终的密保问题，进而生成该密保问题的第一结果。
本发明实施例设置密保问题模板和密保问题模板的安全级别，可以防止非法的第一用户与接入设备确定的第二用户串通，恶意找回合法的第一用户的网络侧账号的密码，即接入设备所获取的密保问题模板是不受第二用户控制的，因此，即使第二用户将其他非法的第一用户确定合法的第一用户，接入设备所设置的密保问题模板仍然可以阻挡非法的第一用户恶意找回合法的第一用户的网络侧账号的密码，进一步提高了用户找回密码的安全性。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
图6为本发明实施例提供的接入设备实施例一的结构示意图。该接入设备适用于图1所示的鉴权系统，所述鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧设备，所述终端通过所述接入网元接入所述网络侧设备。如图6所示，该接入设备包括：接收模块10、确定模块11、生成模块12、发送模块13和判断模块14。
其中，接收模块10，用于接收所述第一终端发送的鉴权请求；所述鉴权请求包括需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口；
确定模块11，用于根据所述鉴权请求确定能够协助合法的第一用户修改所述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户；
生成模块12，用于在所述接收模块10接收到所述第二终端发送的确认 消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述确认消息用于向所述接入设备指示所述第一用户为所述合法的第一用户；
发送模块13，用于将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果；
所述接收模块10，还用于接收所述第一终端发送的所述第二结果；
判断模块14，用于判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则向所述合法的第一用户提供修改所述密码的接口，并指示所述发送模块13向所述第一终端发送验证成功消息。
本发明实施例提供的接入设备，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
进一步地，在上述图6所示实施例的基础上，所述发送模块13，具体用于将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
图7为本发明实施例提供的接入设备实施例二的结构示意图。在上述图6所示实施例的基础上，进一步地，如图7所示，上述确定模块11，具体包括：第一获取单元111和确定单元112；
所述第一获取单元111，用于根据所述鉴权请求和预设的筛选策略，获取所述第一终端上的与第一用户相关的第一联系人信息；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的；
所述发送模块13，还用于向所述第一终端发送所述第一联系人信息；
所述接收模块10，还用于接收所述第一终端发送的所述第二用户的身份标识；
所述确定单元112，用于根据所述第二用户的身份标识确定所述第二用户。
本发明实施例提供的接入设备，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
图8为本发明实施例提供的接入设备实施例三的结构示意图。在上述图6或图7所示实施例的基础上，进一步地，如图8所示，上述生成模块12，具体包括：
第二获取单元121，用于获取至少一个密保问题模板；其中，不同的密保问题模板对应不同的安全等级；
生成单元122，用于根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果。
需要说明的是，图8所示出的结构仅是基于图7所示的实施例的一种情况，当然，图8还可以基于图6所示的结构示出。
图9为本发明实施例提供的接入设备实施例四的结构示意图。在上述图8所示实施例的基础上，进一步地，如图9所示，上述生成单元122，具体包括：获取子单元1221、确定子单元1222和生成子单元1223；其中，
获取子单元1221，用于根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板；确定子单元1222，用于根据所述第一密保问题模板确定数据提取策略，并根据所述数据提取策略从所述用户行为数据中确定第一数据；
生成子单元1223，用于根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果。
进一步地，上述生成子单元1223，具体用于根据所述第一密保问题模板和所述第一数据生成多个第一密保问题，并判断每个所述第一密保问题是否满足预设的难度系数；若是，则将满足所述难度系数的第一密保问题确定为所述密保问题，并确定所述第一结果。
本发明实施例提供的接入设备，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
图10为本发明实施例提供的接入设备实施例五的结构示意图。该接入设备适用于图1所示的鉴权系统，所述鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧设备，所述终端通过所述接入网元接入所述网络侧设备。如图10所示，该接入设备包括：接收器20、发送器22和处理器21。
其中，接收器20，用于接收所述第一终端发送的鉴权请求；所述鉴权请求包括需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口；
处理器21，用于根据所述鉴权请求确定能够协助合法的第一用户修改所 述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，并在所述接收器20接收到所述第二终端发送的确认消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户；所述确认消息用于向所述接入设备指示所述第一用户为所述合法的第一用户；
发送器22，用于将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果；
所述接收器20，还用于接收所述第一终端发送的所述第二结果；
所述处理器21，还用于判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则向所述合法的第一用户提供修改所述密码的接口，并指示所述发送器22向所述第一终端发送验证成功消息。
本发明实施例提供的接入设备，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
进一步地，所述发送器22，具体用于将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
进一步地，所述处理器21，具体用于根据所述鉴权请求和预设的筛选策略，获取所述第一终端上的与第一用户相关的第一联系人信息，并根据所述接收器20接收到的所述第二用户的身份标识确定所述第二用户；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的；
则所述发送器22，还用于向所述第一终端发送所述第一联系人信息；所述接收器20，还用于接收所述第一终端发送的所述第二用户的身份标识。
更进一步地，所述处理器21，具体用于获取至少一个密保问题模板，并根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果；其中，不同的密保问题模板对应不同的安全等级。
更进一步地，所述处理器21，具体用于根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板，并根据所述第一密保问题模板确定数据提取策略，以及根据所述数据提取策略从所述用户行为数据中确定第一数据，并根据所述第一密保问题模板和所述 第一数据生成所述密保问题和所述第一结果。
更进一步地，所述处理器21，具体用于根据所述第一密保问题模板和所述第一数据生成多个第一密保问题，并判断每个所述第一密保问题是否满足预设的难度系数；若是，则将满足所述难度系数的第一密保问题确定为所述密保问题，并确定所述第一结果。
本发明实施例提供的接入设备，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (18)

  1. 一种鉴权方法，其特征在于，适用于鉴权系统，所述鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧设备，所述终端通过所述接入网元接入所述网络侧设备；所述方法包括：
    所述接入设备接收所述第一终端发送的鉴权请求；所述鉴权请求包括需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口；
    所述接入设备根据所述鉴权请求确定能够协助合法的第一用户修改所述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户；
    所述接入设备在接收到所述第二终端发送的确认消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述确认消息用于向所述接入设备指示所述第一用户为所述合法的第一用户；
    所述接入设备将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果；
    所述接入设备接收所述第一终端发送的所述第二结果，并判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则所述接入设备向所述第一终端发送验证成功消息，并向所述合法的第一用户提供修改所述密码的接口。
  2. 根据权利要求1所述的方法，其特征在于，所述接入设备将所述密保问题和第一提示信息发送给所述第一终端，包括：
    所述接入设备将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
  3. 根据权利要求1或2所述的方法，其特征在于，所述接入设备根据所述鉴权请求确定能够协助第一用户修改所述密码的第二用户，包括：
    所述接入设备根据所述鉴权请求和预设的筛选策略，获取所述第一终端上的与第一用户相关的第一联系人信息；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的；
    所述接入设备向所述第一终端发送所述第一联系人信息；
    所述接入设备接收所述第一终端发送的所述第二用户的身份标识，并根据所述第二用户的身份标识确定所述第二用户。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述接入设备根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果，包括：
    所述接入设备获取至少一个密保问题模板；其中，不同的密保问题模板对应不同的安全等级；
    所述接入设备根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果。
  5. 根据权利要求4所述的方法，其特征在于，所述接入设备根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果，具体包括：
    所述接入设备根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板；
    所述接入设备根据所述第一密保问题模板确定数据提取策略，并根据所述数据提取策略从所述用户行为数据中确定第一数据；
    所述接入设备根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果。
  6. 根据权利要求5所述的方法，其特征在于，所述接入设备根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果，包括：
    所述接入设备根据所述第一密保问题模板和所述第一数据生成多个第一密保问题；
    所述接入设备判断每个所述第一密保问题是否满足预设的难度系数；
    若是，则所述接入设备将满足所述难度系数的第一密保问题确定为所述密保问题，并确定所述第一结果。
  7. 一种接入设备，其特征在于，适用于鉴权系统，所述鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧设备，所述终端通过所述接入网元接入所述网络侧设备；所述接入设备包括：
    接收模块，用于接收所述第一终端发送的鉴权请求；所述鉴权请求包括 需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口；
    确定模块，用于根据所述鉴权请求确定能够协助合法的第一用户修改所述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户；
    生成模块，用于在所述接收模块接收到所述第二终端发送的确认消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述确认消息用于向所述接入设备指示所述第一用户为所述合法的第一用户；
    发送模块，用于将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果；
    所述接收模块，还用于接收所述第一终端发送的所述第二结果；
    判断模块，用于判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则向所述合法的第一用户提供修改所述密码的接口，并指示所述发送模块向所述第一终端发送验证成功消息。
  8. 根据权利要求7所述的接入设备，其特征在于，所述发送模块，具体用于将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
  9. 根据权利要求7或8所述的接入设备，其特征在于，所述确定模块，包括：第一获取单元和确定单元；
    所述第一获取单元，用于根据所述鉴权请求和预设的筛选策略，获取所述第一终端上的与第一用户相关的第一联系人信息；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的；
    所述发送模块，还用于向所述第一终端发送所述第一联系人信息；
    所述接收模块，还用于接收所述第一终端发送的所述第二用户的身份标识；
    所述确定单元，用于根据所述第二用户的身份标识确定所述第二用户。
  10. 根据权利要求7-9任一项所述的接入设备，其特征在于，所述生成模块，包括：
    第二获取单元，用于获取至少一个密保问题模板；其中，不同的密保问题模板对应不同的安全等级；
    生成单元，用于根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果。
  11. 根据权利要求10所述的接入设备，其特征在于，所述生成单元，具体包括：
    获取子单元，用于根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板；
    确定子单元，用于根据所述第一密保问题模板确定数据提取策略，并根据所述数据提取策略从所述用户行为数据中确定第一数据；
    生成子单元，用于根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果。
  12. 根据权利要求11所述的接入设备，其特征在于，所述生成子单元，具体用于根据所述第一密保问题模板和所述第一数据生成多个第一密保问题，并判断每个所述第一密保问题是否满足预设的难度系数；若是，则将满足所述难度系数的第一密保问题确定为所述密保问题，并确定所述第一结果。
  13. 一种接入设备，其特征在于，适用于鉴权系统，所述鉴权系统包括第一用户的第一终端、第二用户的第二终端、接入设备和网络侧设备，所述终端通过所述接入网元接入所述网络侧设备；所述接入设备包括：
    接收器，用于接收所述第一终端发送的鉴权请求；所述鉴权请求包括需要找回密码的网络侧账号，所述鉴权请求用于请求所述接入设备向所述第一用户提供修改所述密码的用户接口；
    处理器，用于根据所述鉴权请求确定能够协助合法的第一用户修改所述密码的第二用户，并建立所述第一终端和所述第二终端的音视频通话连接，并在所述接收器接收到所述第二终端发送的确认消息后，根据所采集的所述合法的第一用户在所述第一终端上的用户行为数据生成用于修改所述密码的密保问题和所述密保问题的第一结果；所述音视频通话连接用于使所述第二用户通过所述第二终端确认所述第一用户是否为合法的第一用户；所述确认消息用于向所述接入设备指示所述第一用户为所述合法的第一用户；
    发送器，用于将所述密保问题和第一提示信息发送给所述第一终端；所述第一提示信息用于协助所述合法的第一用户获得第二结果；
    所述接收器，还用于接收所述第一终端发送的所述第二结果；
    所述处理器，还用于判断所述第二结果与所述第一结果的匹配度是否大于预设第一阈值；若是，则向所述合法的第一用户提供修改所述密码的接口，并指示所述发送器向所述第一终端发送验证成功消息。
  14. 根据权利要求13所述的接入设备，其特征在于，所述发送器，具体用于将所述第一提示信息发送给所述第一终端，并通过所述第二终端将所述密保问题发送给所述第一终端。
  15. 根据权利要求13或14所述的接入设备，其特征在于，所述处理器，具体用于根据所述鉴权请求和预设的筛选策略，获取所述第一终端上的与第一用户相关的第一联系人信息，并根据所述接收器接收到的所述第二用户的身份标识确定所述第二用户；所述筛选策略为所述接入设备根据所述第一终端的历史通信记录确定的；
    所述发送器，还用于向所述第一终端发送所述第一联系人信息；
    所述接收器，还用于接收所述第一终端发送的所述第二用户的身份标识。
  16. 根据权利要求13-15任一项所述的接入设备，其特征在于，所述处理器，具体用于获取至少一个密保问题模板，并根据所述用户行为数据、任一个密保问题模板和所述密保问题模板的安全等级，生成所述密保问题和所述密保问题的第一结果；其中，不同的密保问题模板对应不同的安全等级。
  17. 根据权利要求16所述的接入设备，其特征在于，所述处理器，具体用于根据所述至少一个密保问题模板的安全等级，从所述至少一个密保问题模板中获取第一密保问题模板，并根据所述第一密保问题模板确定数据提取策略，以及根据所述数据提取策略从所述用户行为数据中确定第一数据，并根据所述第一密保问题模板和所述第一数据生成所述密保问题和所述第一结果。
  18. 根据权利要求17所述的接入设备，其特征在于，所述处理器，具体用于根据所述第一密保问题模板和所述第一数据生成多个第一密保问题，并判断每个所述第一密保问题是否满足预设的难度系数；若是，则将满足所述难度系数的第一密保问题确定为所述密保问题，并确定所述第一结果。
PCT/CN2015/078346 2015-05-06 2015-05-06 鉴权方法和接入设备 WO2016176832A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201580071544.XA CN107113308A (zh) 2015-05-06 2015-05-06 鉴权方法和接入设备
PCT/CN2015/078346 WO2016176832A1 (zh) 2015-05-06 2015-05-06 鉴权方法和接入设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/078346 WO2016176832A1 (zh) 2015-05-06 2015-05-06 鉴权方法和接入设备

Publications (1)

Publication Number Publication Date
WO2016176832A1 true WO2016176832A1 (zh) 2016-11-10

Family

ID=57217429

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/078346 WO2016176832A1 (zh) 2015-05-06 2015-05-06 鉴权方法和接入设备

Country Status (2)

Country Link
CN (1) CN107113308A (zh)
WO (1) WO2016176832A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107911394A (zh) * 2017-12-29 2018-04-13 福建师范大学 智能手机短期使用数据的用户密保认证系统
CN108510290A (zh) * 2018-03-12 2018-09-07 平安科技（深圳）有限公司 通话中客户信息修改方法、装置、计算机设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101035116A (zh) * 2006-03-10 2007-09-12 腾讯科技（深圳）有限公司 一种基于即时通信的帐号安全管理系统及方法
US20080134317A1 (en) * 2006-12-01 2008-06-05 Boss Gregory J Method and apparatus for authenticating user identity when resetting passwords
CN102316205A (zh) * 2011-08-19 2012-01-11 上海华勤通讯技术有限公司 手机密码系统、手机及手机安全保护方法
US8844003B1 (en) * 2006-08-09 2014-09-23 Ravenwhite Inc. Performing authentication
CN104348786A (zh) * 2013-07-29 2015-02-11 腾讯科技（深圳）有限公司 密码找回方法、装置和系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5365311B2 (ja) * 2009-04-01 2013-12-11 富士通株式会社 認証情報管理プログラム、認証情報管理装置、認証方法
CN103138921B (zh) * 2011-11-22 2016-05-11 阿里巴巴集团控股有限公司 一种身份信息验证方法和系统
CN103179098B (zh) * 2011-12-23 2017-03-01 阿里巴巴集团控股有限公司 一种网络账号的密码找回方法和装置
CN103916244B (zh) * 2013-01-04 2019-05-24 深圳市腾讯计算机系统有限公司 验证方法及装置
CN104283862B (zh) * 2013-07-10 2018-10-19 深圳市腾讯计算机系统有限公司 找回帐号的方法、装置及系统
CN104348822B (zh) * 2013-08-09 2019-01-29 深圳市腾讯计算机系统有限公司 一种互联网账号身份验证的方法、装置及服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101035116A (zh) * 2006-03-10 2007-09-12 腾讯科技（深圳）有限公司 一种基于即时通信的帐号安全管理系统及方法
US8844003B1 (en) * 2006-08-09 2014-09-23 Ravenwhite Inc. Performing authentication
US20080134317A1 (en) * 2006-12-01 2008-06-05 Boss Gregory J Method and apparatus for authenticating user identity when resetting passwords
CN102316205A (zh) * 2011-08-19 2012-01-11 上海华勤通讯技术有限公司 手机密码系统、手机及手机安全保护方法
CN104348786A (zh) * 2013-07-29 2015-02-11 腾讯科技（深圳）有限公司 密码找回方法、装置和系统

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107911394A (zh) * 2017-12-29 2018-04-13 福建师范大学 智能手机短期使用数据的用户密保认证系统
CN108510290A (zh) * 2018-03-12 2018-09-07 平安科技（深圳）有限公司 通话中客户信息修改方法、装置、计算机设备及存储介质
CN108510290B (zh) * 2018-03-12 2019-08-06 平安科技（深圳）有限公司 通话中客户信息修改方法、装置、计算机设备及存储介质
WO2019174073A1 (zh) * 2018-03-12 2019-09-19 平安科技（深圳）有限公司 通话中客户信息修改方法、装置、计算机设备及存储介质

Also Published As

Publication number Publication date
CN107113308A (zh) 2017-08-29

Similar Documents

Publication Publication Date Title
US11044275B2 (en) Secure web container for a secure online user environment
US9967747B2 (en) Determining identity of individuals using authenticators
US20190109835A1 (en) User authentication using unique hidden identifiers
US8881227B2 (en) Secure web container for a secure online user environment
US8510319B2 (en) Location based information for emergency services systems and methods
US11075924B2 (en) Targeted authentication queries based on detected user actions
US8826398B2 (en) Password changing
US20120173582A1 (en) Location based access to financial information systems and methods
US20070055785A1 (en) Location based authorization of financial card transactions systems and methods
US20070053306A1 (en) Location based rules architecture systems and methods
JP2017519411A (ja) 異なるチャネル上で強力な認証イベントを伝えるシステム及び方法
TW201635181A (zh) 隨選密碼
US20240028755A1 (en) Image and message management and archiving for events
US20220100803A1 (en) System, method and application for matching profiles of users
US9025746B2 (en) System and method for visual caller identification
WO2016176832A1 (zh) 鉴权方法和接入设备
JP6325654B2 (ja) ネットワークサービス提供装置、ネットワークサービス提供方法、及びプログラム
US20160028724A1 (en) Identity Reputation
WO2015108823A1 (en) Identity reputation
JP7007501B1 (ja) サービス提供システム
JP2013020287A (ja) 認証装置、認証システム、認証方法、およびプログラム
US20150206266A1 (en) Identity Reputation
WO2015108790A1 (en) Identity reputation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15891084

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15891084

Country of ref document: EP

Kind code of ref document: A1