WO2017032261A1

WO2017032261A1 - Identity authentication method, device and apparatus

Info

Publication number: WO2017032261A1
Application number: PCT/CN2016/095801
Authority: WO
Inventors: 刘发章; 华锦芝
Original assignee: 中国银联股份有限公司
Priority date: 2015-08-21
Filing date: 2016-08-18
Publication date: 2017-03-02
Also published as: CN105933267A

Abstract

Disclosed are an identity authentication method, device and apparatus. The identity authentication method comprises: in the process from a user logging into an account to logging out of the account, calculating first feature data according to a keystroke behaviour of the user when inputting data; calculating a difference between the first feature data and second feature data, wherein the second feature data is used to represent the keystroke behaviour of a legitimate user corresponding to the account; and if the difference is greater than a pre-set threshold value, executing warning processing. In the present invention, a keystroke behaviour of a user is detected all the time in the process from the user logging into an account to logging out of the account, and identity authentication is performed in the whole process, so that the quantity of detected samples is larger. Even if a malicious user obtains login information and bypasses the authentication of a login level, the malicious user can still be identified due to the difference between the keystroke behaviour and the keystroke behaviour of a legitimate user in the process of use, and accordingly, warning processing is carried out, so that account security is prevented from being impaired, and the degree of accuracy is higher.

Description

Identity authentication method, device and device

cross reference

This application claims the priority of the Chinese invention patent whose application date is August 21, 2015, the application number is 201510519937.4, and the invention name is "identity authentication method and device".

Technical field

The present invention relates to the field of identity authentication technologies, and in particular, to an identity authentication method, apparatus, and device.

Background technique

The existing identity authentication is generally used for authentication at login. A malicious user obtains the account rights of a normal user through various attack means, and can masquerade as a normal user to log in to the system to perform an illegal operation, resulting in user loss.

The current identity authentication scheme based on keystroke behavior is a one-time behavior, which is only authenticated at login, and has shortcomings such as low accuracy and inability to learn autonomously.

Summary of the invention

The invention provides an identity authentication method and device, so as to at least solve the problem that the existing identity authentication misidentification rate is high.

According to an aspect of the present invention, an identity authentication method is provided, including:

During the process of logging in the account to the account, the user calculates the first feature data according to the keystroke behavior when the user inputs the data;

Calculating a difference between the first feature data and a second feature data; the second feature data is used to represent a keystroke behavior of a legitimate user corresponding to the account;

If the difference is greater than a predetermined threshold, an alarm process is performed.

According to another aspect of the present invention, an identity authentication apparatus is provided, comprising:

a first feature calculation module, configured to calculate first feature data according to a keystroke behavior when the user inputs data in a process of logging in to the account by the user;

a difference calculation module, configured to calculate a difference between the first feature data and a second feature data; the second feature data is used to represent a keystroke behavior of a legitimate user corresponding to the account;

The alarm processing module is configured to perform alarm processing when the difference is greater than a preset threshold.

According to still another aspect of the present invention, an identity authentication device is provided, including:

processor;

a memory coupled to the processor via a bus interface and configured to store programs and data used by the processor in performing operations;

The processor is configured to read a program in the memory and perform the following process:

Through the identity authentication method, device and device of the invention, the user's keystroke behavior is always detected during the process of logging in the account to the account, and the identity authentication is performed throughout the process, and the sample size detected is larger, even if the malicious user obtains the login information to bypass At the login level, the authentication is also recognized during the use process because the keystroke behavior is different from the legal user's keystroke behavior, so that the alarm processing is performed to avoid account security damage; in addition, by continuously storing the representation in the database The first feature data of the legal user keystroke behavior, and using the data to update the second feature data, can independently learn the change of the user's keystroke behavior over time, and ensure that the second feature data always represents the latest hit of the legitimate user. The characteristics of the key behavior, the accuracy of identity authentication is higher.

DRAWINGS

The drawings are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flow chart of an identity authentication method according to an embodiment of the present invention;

2 is a flow chart of an identity authentication method according to an embodiment of the present invention;

FIG. 3 is a structural block diagram of an identity authentication apparatus according to an embodiment of the present invention; FIG.

4 is a block diagram showing the structure of an identity authentication apparatus according to an embodiment of the present invention;

FIG. 5 is a structural block diagram of an identity authentication apparatus according to an embodiment of the present invention; FIG.

FIG. 6 is a structural block diagram of an identity authentication apparatus according to an embodiment of the present invention; FIG.

FIG. 7 is a structural block diagram of an identity authentication device according to an embodiment of the present invention; FIG.

FIG. 8 is a flowchart of a first login of a user according to an embodiment of the present invention; FIG.

9 is a flow diagram of a user's non-initial login in accordance with an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

At present, the identity authentication based on the keystroke behavior is only executed when the account is logged in. Since the information input by the user is small, the sample used for the identity authentication is also less, which often leads to an incorrect authentication result and a high error rate.

In order to solve the above problem, in some embodiments, the present disclosure provides an identity authentication method, as shown in FIG. 1, the process includes:

Step 1. During the process of logging in the account to the account, the user calculates the first feature data according to the keystroke behavior when the user inputs the data.

Specifically, the first feature data is data for characterizing the keystroke behavior of the user, and includes, for example, but not limited to, a frequency of a keystroke when the user inputs data, a time interval of the keystroke, and a duration of each keystroke. One or more.

The "account" referred to in the present invention includes, but is not limited to, a bank account, a website account, and the like.

In an embodiment, the identity authentication method further includes: prompting the user to input a preset data (for example, may be a text containing text and/or numbers and/or letters), and the step 1 is specifically based on the user. The first feature data is calculated by the keystroke behavior when the preset data is input.

Step 2: Calculate a difference between the first feature data and a second feature data.

Specifically, the second feature data is data for characterizing the keystroke behavior of the legal user corresponding to the account, and includes, for example, but not limited to, the frequency of the keystroke when the legal user inputs the data, the time interval of the keystroke, and each keystroke. One or more of the durations.

In an embodiment, the step 2 is specifically calculating a Mahalanobis distance of the first feature data and the second feature data.

In another embodiment, the step 2 is specifically calculating the Euclidean distance between the first feature data and the second feature data.

Step 3: If the difference between the first feature data and the second feature data is greater than a preset threshold, perform an alarm process.

Specifically, when it is determined that the difference between the first feature data and the second feature data is greater than the preset threshold, the user is likely to be an illegal user. To ensure the security of the bank account, the alarm processing performed in the step 3 includes: However, it is not limited to at least one of the following processes: (1) outputting alarm information; (2) blocking the operation of the user; (3) determining the user as an illegal user and alerting; (4) by registering the account The retained phone and/or email notifies the legitimate user to perform operation authentication for this login. The specific manner of the alarm processing in the step is not limited in the present invention. In the specific implementation, the appropriate alarm mode can be adopted according to the security requirements of the account.

Through the identity authentication method provided by the present invention, the identity authentication is performed throughout the process from the time the user logs in to the account, and even if the malicious user obtains the login information to bypass the login level authentication, the keystroke behavior and the legality are used during the use. The user's keystroke behavior is recognized and the alarm is processed to avoid account security damage.

The inventors have also discovered that the user's keystroke habits may change slowly over time, and the current identity authentication system cannot learn the changes of the user's keystroke habits autonomously, which may also result in a higher error rate of the authentication result.

In order to solve this problem, the identity authentication method provided by the present invention may further include the following steps:

Step 4: If the difference between the first feature data and the second feature data is less than or equal to the preset threshold, update the second feature data by using the first feature data.

In an embodiment, the step 4 may include:

Step 41: Store the first feature data into a database corresponding to the account.

The database stores the first feature data calculated by the keystroke behavior when the legitimate user inputs the data each time the legitimate user inputs the data.

As time goes by, the user's keystroke behavior may change. Correspondingly, the calculated first feature data will also change. By self-learning this change, the accuracy of identity authentication can be improved.

Step 42: Update the second feature data by using all data included in the database.

Since the data stored in the database are the first feature data representing the keystroke behavior of the legitimate user, the data can be used to calculate the second feature data for characterizing the legal user keystroke behavior, and the calculated new second is obtained. The feature data replaces the original second feature data for subsequent identity authentication.

In one embodiment, the process of updating the second feature data using all the data contained in the database includes:

Step 421: Calculate an expected value μ _i = E(X _i ) of the ιth element of each dimension in the training database and a covariance cov(X _i , X _j )=E[(X _i -μ _i ) of each dimension (X) _j -μ _j )].

In step 422, a new covariance matrix S = C _{n × n} = (C _{i, j} , C _{i, j} = cov (X _i , X _j )) is formed.

The identity authentication method can automatically learn the user's keystroke by continuously storing the first feature data representing the legitimate user keystroke behavior into the database and using the data to update the second feature data. The change of behavior automatically adapts to the subtle changes of the same user's habits, ensuring that the second feature data always characterizes the latest keystroke behavior of legitimate users, overcomes the problem that the authentication fails due to changes in user habits, and improves the accuracy of identity authentication.

As the number of user logins increases, the amount of data stored in the database will gradually increase. Considering the timeliness of the data and the storage capacity of the database, a data volume threshold can be set. When the total amount of data in the database exceeds the data threshold. All data in the database is sorted in order of storage time from morning to night, and one or more data in which the top is sorted is deleted.

In some embodiments, the specific implementation process of the identity authentication method is as shown in FIG. 2, and includes the following steps:

Step S101: When the user logs in to the account, it is detected whether the second feature data of the keystroke behavior of the legitimate user of the account is stored in the system.

If the second feature data of the keystroke behavior of the legitimate user of the account is not stored in the database corresponding to the account, and it is determined that the login is the first login, step S102 is performed.

If the second feature data of the keystroke behavior of the legitimate user of the account is already stored in the database corresponding to the account, and it is determined that the login is not the first login, step S103 is performed.

Step S102, prompting the user to input a series of preset data (for example, may include a piece of text), detecting a keystroke behavior when the user inputs the string of preset data, and calculating first feature data for characterizing the keystroke behavior of the user. (For example, the frequency of keystrokes when the user inputs the string of preset data, the time interval of keystrokes, the duration of each keystroke, etc.), since this login is the first login, the default user is a legitimate user, and the first A feature data is determined to be the first second feature data stored in a database corresponding to the account.

Step S103, in the process of the user logging in the account until the user withdraws from the account, calculating the first feature data according to the keystroke behavior when the user inputs the data, and calculating the second feature data corresponding to the first feature data and the current account. The difference between them.

When it is determined that the calculated difference is less than or equal to a preset threshold, the user is determined to be a legitimate user, and step S104 is performed.

When it is determined that the calculated difference is greater than the preset threshold, the user is determined to be an abnormal user, and step S105 is performed.

Step S104: The first feature data is stored in a database corresponding to the account, and a new second feature data is calculated by using all data included in the database to replace the original second feature data.

In step S105, an alarm process is performed. For example, for a bank account with higher security requirements, a method of blocking users may be adopted, and for a website account with lower security requirements, an alarm may be used.

Compared with the existing identity authentication method, the identity authentication method has higher accuracy. On the one hand, from the time the user logs in to the account, the user always detects the keystroke behavior of the user, and performs identity authentication and detection throughout. The sample size is larger. Even if the malicious user obtains the login information to bypass the login level authentication, it will be identified during the use process because the keystroke behavior is different from the legal user's keystroke behavior, thus performing alarm processing to avoid account security. Loss; on the other hand, by continuously storing the first feature data representing the legitimate user keystroke behavior into the database, and using the data to update the second feature data, the user can learn the keystroke behavior of the user over time. The change ensures that the second feature data always characterizes the latest keystroke behavior of the legitimate user, and the identity authentication is more accurate.

In some embodiments, calculating a difference between the first feature data and the second feature data currently corresponding to the account in step S103 may be calculating a Mahalanobis distance of the first feature data and the second feature data.

The Mahalanobis Distance is a statistic used to describe the distance between two data points. The Mahalanobis distance is commonly used to measure the similarity between known and unknown samples.

In general, if a random variable X obeys a (0,1) normal distribution, then any random variable R that follows a normal distribution can be defined by X, namely:

Where S is the covariance matrix and μ is the mean.

If a (0,1) normal distribution is to be defined by a random variable subject to a normal distribution, the solution (1) can be obtained:

Taking the square roots on both sides of equation (2), we can get the distance D between two variables (X and R):

Similarly, for a multivariate vector x = (x ₁ , x ₂ , x ₃ ..., x _N ) ^T and a set of mean values of μ, the Mahalanobis distance of the data set with covariance matrix S is defined as follows:

Specifically, for the present embodiment, the Mahalanobis distance can be calculated using the following formula:

Where D _M (x, μ, S) represents the Mahalanobis distance, x represents the first feature data, μ represents the mean value of the second feature data currently corresponding to the account, and S represents the second feature data currently corresponding to the account. Covariance matrix.

By calculating the Mahalanobis distance of the first feature data and the second feature data, it is simple and reliable to determine whether the user is a legitimate user.

Based on the same inventive concept, an embodiment of the present invention provides an identity authentication device, which can be used to implement the method described in the foregoing embodiments, as described in the following embodiments. Since the principle of the identity authentication device solving the problem is similar to the identity authentication method, the implementation of the device can be referred to the implementation of the identity authentication method, and the repeated description is not repeated. As used below, the term "module" can be implemented A combination of software and/or hardware for a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

In some embodiments, the present disclosure provides an identity authentication apparatus, and FIG. 3 is a structural block diagram of the identity authentication apparatus. As shown in FIG. 3, the identity authentication apparatus includes: a first feature calculation module 31, and a difference calculation module 32. The alarm processing module 33, which will be specifically described below.

The first feature calculation module 31 is configured to calculate the first feature data according to the keystroke behavior when the user inputs the data in the process of logging in the account to the account.

The difference calculation module 32 is configured to calculate a difference between the first feature data and a second feature data; and the second feature data is used to represent a keystroke behavior of a legitimate user corresponding to the account.

The alarm processing module 33 is configured to perform an alarm process when the difference is greater than a preset threshold.

In some embodiments, the difference calculation module 32 is configured to calculate a Mahalanobis distance of the first feature data and the second feature data.

In some embodiments, the difference calculation module 32 is configured to calculate an Euclidean distance of the first feature data and the second feature data.

In some embodiments, as shown in FIG. 4, the identity authentication apparatus further includes:

The updating module 34 is configured to update the second feature data by using the first feature data when the difference is less than or equal to the preset threshold.

In some embodiments, as shown in FIG. 5, the update module 34 further includes:

a storage module 341, configured to store the first feature data in a database corresponding to the account;

The operation module 342 is configured to update the second feature data by using all data included in the database.

In some embodiments, as shown in FIG. 6, the identity authentication apparatus further includes:

The prompting module 61 is configured to prompt the user to input a preset data before the first feature calculating module 31 calculates the first feature data according to the keystroke behavior when the user inputs data;

Then, the first feature calculation module 31 calculates the first feature data according to the keystroke behavior when the user inputs the preset data.

In some embodiments, the alert processing module 33 performs at least one of the following alerting processes:

Output alarm information;

Block the user's operation;

Identify the user as an illegal user and alert the user;

The legitimate user is notified of the operation and authentication of the login by the phone and/or email that is retained when the account is registered.

In some embodiments, the first feature data and the second feature data comprise at least one of: a frequency of keystrokes, a time interval of keystrokes, a duration of each keystroke.

Through the identity authentication device of the present invention, the user's keystroke behavior is always detected during the process of logging in the account to the account, and the identity authentication is performed throughout the process, and the sample size detected is larger, even if the malicious user obtains the login information to bypass the login level authentication. It will also be identified during the use process because the keystroke behavior is different from the keystroke behavior of the legitimate user, so that the alarm processing can be performed to avoid the account security damage; in addition, the legitimate user keystroke is characterized by continuously depositing into the database. The first feature data of the behavior, and using the data to update the second feature data, can independently learn the change of the user's keystroke behavior over time, and ensure that the second feature data always characterizes the latest keystroke behavior of the legitimate user. Identity authentication is more accurate.

The above identity authentication device may be separately stored in the computer for use by multiple systems, or may be separately integrated in each system. Of course, the above module division is only a schematic division, and the present invention is not limited thereto, and any module division that can achieve the object of the present invention should fall within the protection scope of the present invention.

Based on the same inventive concept, an identity authentication device is also provided in the embodiment of the present invention, which can be used to implement the identity authentication method described in the foregoing embodiments, as described in the following embodiments. Since the principle of the identity authentication device is similar to the identity authentication method, the implementation of the device can refer to the implementation of the identity authentication method, and the repeated description is not repeated.

In some embodiments, the present disclosure provides an identity authentication device, and FIG. 7 is a structural block diagram of the identity authentication device. As shown in FIG. 7, the identity authentication device includes:

Processor 71;

a memory 72, coupled to the processor 71 via a bus interface 73, and for storing programs and data used by the processor 71 in performing operations;

The processor 71 is configured to read a program in the memory 72 and perform the following process:

Through the identity authentication device of the present invention, the user's keystroke behavior is always detected during the process of logging in the account to the account, and the identity authentication is performed throughout the process, and the detected sample size is larger, even if the malicious user obtains the login information to bypass the login level authentication. It will also be identified during the use process because the keystroke behavior is different from the keystroke behavior of the legitimate user, so that the alarm processing can be performed to avoid the account security damage; in addition, the legitimate user keystroke is characterized by continuously depositing into the database. The first feature data of the behavior, and using the data to update the second feature data, can independently learn the change of the user's keystroke behavior over time, and ensure that the second feature data always characterizes the latest keystroke behavior of the legitimate user. Identity authentication is more accurate.

In order to explain the above-mentioned identity authentication method, device and device, the following description is made in conjunction with the specific embodiments, but it is noted that this embodiment is only for better illustration of the present invention and does not constitute the present invention. Improper restrictions.

(1) The user logs in to the system for the first time (that is, the initial training phase of the data)

As shown in Figure 8, the new user logs in to the system for the first time and detects that there is no behavior characteristic of the user in the system. It belongs to the new user and prompts the user to manually input a text or some commands. Record the keystroke behaviors of the user input (including the button frequency, the keystroke interval between the key and the key, the duration on a key, etc.). A covariance matrix for each input data is calculated, and the covariance matrix and the input data are saved as behavioral characteristics of the user. For example, a library of behavioral characteristics corresponding to the user can be established, wherein the input data and the corresponding covariance matrix are stored.

For example, for the input of the key value p, in the initial input training phase, the user's (press duration, button frequency, interval between two connected p) are respectively the following three sets of data: P, Q, R. The three sets of data (P, Q, R) are recorded, and the corresponding covariance matrix S is obtained through training, and the recorded data and the covariance matrix are stored as the behavior characteristic database of the user.

(2) The user is not the first time to log in to the system (ie identification and continuous training phase)

As shown in Figure 9, the system automatically records its keystroke behavior (including key frequency, keystroke interval, duration on a key, etc.) during user login, command operation, or text input throughout the process. For each stage of user input habits, the Mahalanobis distance is calculated by the Mahalanobis distance model to input the data in the habit and feature database. If the obtained distance is lower than or equal to the preset threshold, it is a legal user, and continues to calculate the distance and compare with the preset threshold; if the obtained distance is higher than the preset threshold, it is an abnormal user, according to the system configuration, Alert or block user actions.

An approximate recognition model based on the Mahalanobis distance calculates a covariance matrix of the training data during the training phase, and saves the covariance matrix and all training data.

In the recognition phase, the approximate recognition model calculates the Mahalano between each time feature vector and the test vector (ie, the data currently input by the user) in the training data using the covariance matrix saved during training. The distance is Bis, and returns the smallest Mahalanobis distance, and it is judged according to the preset threshold α whether the test vector and the training data are from the same user.

The approximate recognition model can be expressed in the following mathematical formula:

Where D _M is a function of calculating the Mahalanobis distance between two vectors according to the covariance matrix, t is the feature vector of the user's current input data, x is the saved training data, and COV is the covariance of the training data. The matrix, α is a preset threshold, and n represents the number of saved training data.

For example, in the recognition phase, when the user presses the key p (press duration, key frequency, interval between two connected p) is y (y1, y2, y3), then (y1, P), (y2, Q) is used. (y3, R) are substituted into (D _M (t, x[i], COV)) to obtain three Mahalanobis distances d1, d2, d3, and the minimum value d is determined. Where y1 represents the pressing duration vector, P is the mean vector of the pressing time duration, y2 represents the key frequency vector, Q is the mean vector of the key frequency, y3 represents the interval time vector of two connected p, and R is the two connected presses The mean vector of the interval time of the key p.

Among them, the formula for calculating the distance is:

Where x is the currently input data y(y1, y2, y3), and μ is the stored data (P, Q, R), that is, the pressing duration, the key frequency, and the initial interval of the two consecutive pressing keys p The value vector or the mean vector after continuous training, S is the initial covariance matrix.

After the user finishes using it, if there is no alarm, the system will exit normally. Record the behavior habits of the user during the current use, and input into the Mahalanobis distance model for training, dynamically learning and adjusting user behavior characteristics.

In addition, the maximum amount of sample data (for example, the last 100 use record data) can be set, and the overdue record data (for example, data before 100 times) can be deleted from the training data set.

In summary, the present invention provides an identity authentication method, apparatus, and device. The user always detects the user's keystroke behavior during the process of logging in to the account, and performs identity authentication throughout the process. The sample size is larger, even if malicious. The user obtains the login information to bypass the login level authentication, and is also identified during the use process because the keystroke behavior is different from the legal user's keystroke behavior, thereby performing alarm processing to avoid account security damage; The first feature data representing the legal user keystroke behavior is stored in the database, and the second feature data is updated by using the data, and the user's keystroke behavior is changed autonomously to ensure that the second feature data is always Characterizing the latest keystroke behavior of legitimate users, identity authentication is more accurate.

Any process or method description in the flowcharts or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a particular logical function or process. And the scope of the preferred embodiments of the invention includes additional implementations, in which the functions may be performed in a substantially simultaneous manner or in an opposite order depending on the functions involved, in the order shown or discussed. It will be understood by those skilled in the art to which the embodiments of the present invention pertain.

It should be understood that portions of the invention may be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

One of ordinary skill in the art can understand that all or part of the steps carried by the method of implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, one or a combination of the steps of the method embodiments is included.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. The integrated modules, if implemented in the form of software functional modules and sold or used as stand-alone products, may also be stored in a computer readable storage medium.

The above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

In the description of the present specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means a specific feature described in connection with the embodiment or example. A structure, material or feature is included in at least one embodiment or example of the invention. In the present specification, the schematic representation of the above terms does not necessarily mean the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples.

The above described specific embodiments of the present invention are further described in detail, and are intended to be illustrative of the embodiments of the present invention. All modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

An authentication method includes:

During the process of logging in the account to the account, the user calculates the first feature data according to the keystroke behavior when the user inputs the data;

Calculating a difference between the first feature data and a second feature data; the second feature data is used to represent a keystroke behavior of a legitimate user corresponding to the account;

If the difference is greater than a predetermined threshold, an alarm process is performed.
The identity authentication method according to claim 1, wherein the calculating the difference between the first feature data and a second feature data comprises:

Calculating a Mahalanobis distance of the first feature data and the second feature data.
The identity authentication method according to claim 1, wherein the calculating the difference between the first feature data and a second feature data comprises:

Calculating an Euclidean distance of the first feature data and the second feature data.
The identity authentication method according to claim 1, further comprising:

And if the difference is less than or equal to the preset threshold, updating the second feature data by using the first feature data.
The identity authentication method according to claim 4, wherein the updating the second feature data by using the first feature data comprises:

Depositing the first feature data into a database corresponding to the account;

The second feature data is updated with all of the data contained in the database.
The identity authentication method according to claim 1, wherein the calculating the first feature data according to the keystroke behavior when the user inputs the data further comprises: prompting the user to input a preset data;

Then calculating the first feature data according to the keystroke behavior when the user inputs data, including:

The first feature data is calculated according to a keystroke behavior when the user inputs the preset data.
The identity authentication method according to claim 1, wherein the performing alarm processing includes at least one of the following:

Output alarm information;

Block the user's operation;

Identify the user as an illegal user and alert the user;

The legitimate user is notified of the operation and authentication of the login by the phone and/or email that is retained when the account is registered.
The identity authentication method according to claim 1, wherein the first feature data and the second feature data comprise at least one of: a frequency of a keystroke, a time interval of a keystroke, and each hit The duration of the key.
An identity authentication device comprising:

a first feature calculation module, configured to calculate first feature data according to a keystroke behavior when the user inputs data in a process of logging in to the account by the user;

a difference calculation module, configured to calculate a difference between the first feature data and a second feature data; the second feature data is used to represent a keystroke behavior of a legitimate user corresponding to the account;

The alarm processing module is configured to perform alarm processing when the difference is greater than a preset threshold.
The identity authentication device of claim 9, wherein the difference calculation module is configured to calculate a Mahalanobis distance of the first feature data and the second feature data.
The identity authentication device according to claim 9, wherein said difference calculation module is configured to calculate an Euclidean distance of said first feature data and said second feature data.
The identity authentication device of claim 9, further comprising:

And an update module, configured to update the second feature data by using the first feature data when the difference is less than or equal to the preset threshold.
The identity authentication device of claim 12, wherein the update module comprises:

a storage module, configured to store the first feature data into a database corresponding to the account;

An operation module, configured to update the second feature data by using all data included in the database.
The identity authentication device of claim 9, further comprising:

a prompting module, configured to prompt the user to input a preset data before the first feature calculating module calculates the first feature data according to the keystroke behavior when the user inputs data;

Then, the first feature calculation module calculates the first feature data according to the keystroke behavior when the user inputs the preset data.
The identity authentication device according to claim 9, wherein the alarm processing module performs at least one of the following alarm processes:

Output alarm information;

Block the user's operation;

Identify the user as an illegal user and alert the user;

The legitimate user is notified of the operation and authentication of the login by the phone and/or email that is retained when the account is registered.
The identity authentication device according to claim 9, wherein said first feature data and said second feature data comprise at least one of: a frequency of keystrokes, a time interval of keystrokes, each hit The duration of the key.
An identity authentication device, including:

processor;

a memory coupled to the processor via a bus interface and configured to store programs and data used by the processor in performing operations;

The processor is configured to read a program in the memory and perform the following process:

During the process of logging in the account to the account, the user calculates the first feature data according to the keystroke behavior when the user inputs the data;

Calculating a difference between the first feature data and a second feature data; the second feature data is used to represent a keystroke behavior of a legitimate user corresponding to the account;

If the difference is greater than a predetermined threshold, an alarm process is performed.