WO2017140190A1 - 一种基于交易数据认证用户身份的方法和装置 - Google Patents

一种基于交易数据认证用户身份的方法和装置 Download PDF

Info

Publication number
WO2017140190A1
WO2017140190A1 PCT/CN2017/070223 CN2017070223W WO2017140190A1 WO 2017140190 A1 WO2017140190 A1 WO 2017140190A1 CN 2017070223 W CN2017070223 W CN 2017070223W WO 2017140190 A1 WO2017140190 A1 WO 2017140190A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
account
transaction data
authentication
test questions
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/070223
Other languages
English (en)
French (fr)
Inventor
万四爽
徐燕军
何朔
尹亚伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Publication of WO2017140190A1 publication Critical patent/WO2017140190A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • Embodiments of the present invention relate to identity authentication and, in particular, to methods and apparatus for authenticating a user identity based on transaction data.
  • the authentication server needs to rely on pre-prepared data for authentication.
  • data are, for example, a password set by the user at the time of registration of the authentication server, a registered mobile phone number, biometric information of the user such as a fingerprint, or data for authentication in the smart card assigned to the user.
  • the user can authenticate by sending the required data to the authentication server.
  • the authentication server receives data from the user and compares the data with data prepared in advance to determine whether the user has passed the authentication.
  • An authentication scheme using a static password which includes receiving the required data from the client, and then comparing the received data with a pre-stored password set by the user to authenticate the user.
  • An authentication scheme using a dynamic password including transmitting a dynamic password to a user's terminal (eg, a mobile phone), and receiving the required data from the client, and then authenticating the received data against the previously generated dynamic password for authentication user ID.
  • a user's terminal eg, a mobile phone
  • a biometric authentication scheme includes receiving required biometric information (eg, face, sound, iris, fingerprint) from a client, and then receiving the biometric information and pre-stored bio-derived creatures The feature information is compared to authenticate the user.
  • required biometric information eg, face, sound, iris, fingerprint
  • the above authentication scheme cannot authenticate users who are not registered with the authentication server.
  • a method for authenticating a user identity based on transaction data comprising: based on an account letter provided by a user Obtaining historical transaction data associated with the account, generating one or more test questions based on the historical transaction data, providing the one or more test questions to the user, receiving the one or more tests from the user The answer to the question, and based on the answer, determine whether the user has passed the authentication.
  • An authentication server for authenticating a user identity based on the transaction data, comprising: a first device, configured to obtain historical transaction data associated with the account according to account information provided by the user, and a second device, configured to generate one or more according to the historical transaction data a test problem, a third device for providing the one or more test questions to the user, a fourth device for receiving an answer from the user for the one or more test questions, and a fifth device And determining, according to the answer, whether the user passes the authentication.
  • FIG. 1 is a schematic diagram of a method of authenticating a user identity based on transaction data, in accordance with one embodiment of the present invention.
  • FIG. 2 is an example of a method of authenticating a user identity based on transaction data, in accordance with one embodiment of the present invention.
  • FIG 3 is an interface for presenting test questions in accordance with one embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a system for authenticating a user identity based on transaction data, in accordance with one embodiment of the present invention.
  • FIG. 1 is a schematic diagram of a method of authenticating a user identity based on transaction data, in accordance with one embodiment of the present invention.
  • the method includes the processing in blocks 110 through 150, which can be performed on the authentication server side.
  • historical transaction data associated with the account is obtained based on account information provided by the user.
  • the account is a bank account or a web payment application account.
  • the account information can be, for example, a bank card number Or the account of the online payment application.
  • Historical transaction data associated with the account can be obtained from the corresponding transaction database.
  • test questions are generated based on the historical transaction data.
  • the manner in which the test problem is generated and the form of the test problem will be described in detail.
  • the one or more test questions are provided to the user.
  • the one or more test questions may be provided to the user by transmitting textual information, picture information, or voice information of the one or more test questions to the user's terminal, or a combination thereof.
  • the user's terminal can be any electronic device capable of interacting with the authentication server, such as a cell phone, tablet, laptop, self-service terminal (eg, ATM).
  • the answer from the user is used to compare against the answer to the test question, and when the match is consistent, it is determined that the user has the same identity as the user to whom the historical transaction data points.
  • One advantage of the authentication scheme according to this embodiment is that the authentication server can perform identity authentication without any pre-prepared data, since historical transaction data can be obtained from the bank backend system.
  • Another advantage of the authentication scheme according to this embodiment is that the authentication server only needs account information to perform identity authentication, so the user does not have to worry about revealing sensitive information such as name, ID number, mobile number, etc. because he/she does not need to provide these information. At the same time, users do not need to carry any hardware devices with smart chips installed. Generating test questions based on the user's historical transaction data and authenticating the user's identity based on the test questions can improve the security and convenience of the authentication process.
  • Another advantage of the authentication scheme according to this embodiment is that the manner of authentication is specific to the transaction behavior of the user, and therefore it is difficult to pass authentication even if the other person knows the account information of the user.
  • the authentication scheme according to this embodiment is more reliable than the authentication scheme in the prior art.
  • the test problem can also be randomly generated, so the authentication scheme according to this embodiment can effectively prevent the replay attack.
  • Another advantage of the authentication scheme according to this embodiment is that when the historical transaction data is data generated by the bank account, the authentication server performs real-name authentication on the user without any pre-prepared data, because the bank account and the user's real Personal information binding.
  • the one or more test questions may include a multiple choice question, wherein the multiple choice question requires the user to select one or more transaction events associated with the account from among a plurality of options.
  • the multiple choice question asks the user to select one or more transaction events associated with the account from among a plurality of options based on one or more of the following factors: time, location, transaction amount.
  • the plurality of options can include one or more interference options generated from the historical transaction data.
  • FIG. 2 is an example of a method of authenticating a user identity based on transaction data, in accordance with one embodiment of the present invention. This example shows the flow of identity authentication based on bank account information.
  • bank account information is submitted from the client.
  • bank account information is received at the authentication server and the historical transaction data is looked up based on the account information.
  • the authentication server can send a request containing the bank account information to the bank backend system, and then receive historical transaction data from the bank backend system.
  • the historical transaction data may be historical transaction data for a specific time period.
  • a plurality of options including real transaction options and interference options are generated based on historical transaction data.
  • the real trading option is the business name included in the historical transaction data
  • the interference option may be the name of the merchant similar to the merchant included in the historical transaction data.
  • a transaction behavior that may occur is analyzed based on historical transaction data of the user, and then an interference option is generated based on the transaction behavior that may occur. For example, one or more merchants indicated by the possible transaction behavior are analyzed based on the user's historical transaction data, and then the one or more merchants are used as interference options.
  • the interference option can be generated by extracting characteristics of the transaction behavior from historical transaction data, including transaction type, transaction location, and merchant type. Then, merchants not included in the historical transaction data are generated as interference options based on some or all of these features.
  • the type of transaction can include dining, travel, shopping, and the like.
  • the merchant type may include Sichuan cuisine, Japanese cuisine, and the like. If the historical transaction data indicates that the user is spending at the Japanese cuisine A merchant at the location A, the authentication server can accordingly use the Japanese cuisine B near the location A as the interference item.
  • a plurality of options and authentication rules are sent to the client. Multiple options can include real trading options and interference options.
  • the authentication rules are presented to the user as part of the testing question.
  • the authentication rule requires the user to select from the plurality of options according to one or more of the following factors: One or more trading events of the joint: time, place, transaction amount.
  • an authentication rule may require a user to select a merchant from among a plurality of options in the order in which the transaction occurred.
  • the authentication rules may require the user to select a merchant that has traded at a particular location from among a plurality of options.
  • an authentication rule may require a merchant that has selected a transaction value greater than a certain value from among a plurality of options.
  • an option is selected in accordance with the authentication rules.
  • the selected option is received from the client.
  • block 226 it is determined whether the selected option conforms to the authentication rule, that is, whether the selected option satisfies the conditions defined by the authentication rule.
  • the process proceeds to block 227, the authentication is passed, and if the determination is no, the process proceeds to block 228 where the authentication is passed.
  • the authentication rule (or the answer rule) of the test question requires the user to select the six merchants that have been consumed in chronological order.
  • the authentication server finds that the users of the bank card are often consumed in Starbucks, Conrad restaurants, CHANNEL stores, and CP Lotus, whereby the authentication server can generate COSTA coffee and Coach stores according to such transaction behavior or consumption habits. , Metro and other interference options. Since the user's historical trading behavior is only known by him/herself, the user can select the correct merchant according to the rules.
  • the actual transaction sequence of the user occurs: Starbucks, CHANNEL, CP Lotus, Gangli Restaurant, Hao Ledi KTV, the whole family .
  • the user can click on the icon on the interface to generate an orderly option, and the sequence option is sent to the authentication server.
  • the authentication server determines that the option selected by the user is authentic and the transaction time of the authentication rule occurs, the identity authentication succeeds, otherwise, the identity authentication fails.
  • the one or more test questions may include a fill-in-the-blank question, wherein the fill-in-the-blank question provides the user with a transaction event associated with the account and asks the user to answer one of the following factors related to the transaction event or Multiple: time, location, transaction amount; or the fill-in-the-blank question provides the user with one or more of the following factors of a transaction event associated with the account: time, location, The transaction amount and the user is required to answer the transaction event.
  • the test question can be "Please enter the date of the last purchase at Merchant A" or "Please enter the amount of the last purchase at Merchant A”.
  • the test question can be "Please enter the name of the business that was consumed at location A yesterday.”
  • test question is a fill-in-the-blank question
  • the character from the user's answer is included in the character of the correct answer (ie, a partial match)
  • the user's answer is determined to be correct, or when from the user's
  • the value of the answer and the value of the correct answer are within a certain range, the user's answer is judged to be correct. In this way, the user does not need to remember all the transaction details.
  • the one or more test questions may include a judgment question based on the transaction event, and one or more of the following factors of the transaction event: time, location, transaction amount.
  • the system for authenticating a user identity based on transaction data includes a client 410, an authentication server 420, and a background system 430.
  • the backend system 430 includes a historical transaction database 431.
  • the authentication server 420 receives account information from the client 410 and extracts historical transaction data from the historical transaction database 431 of the background system 430 based on the account information. The authentication server 420 then generates a test question based on the extracted historical transaction data and sends the test question to the client 410.
  • the authentication server 420 then receives an answer from the client 410 and, based on the answer, authenticates whether the identity of the user at the client 410 is consistent with the identity of the user indicated by the historical transaction data. It can be understood that the authentication server 420 can simultaneously store the answers of the corresponding test questions when generating the test questions, so as to quickly verify the answers from the users.
  • the exemplary embodiments can be implemented in hardware, software, or a combination thereof.
  • some aspects of the invention may be implemented in hardware, while other aspects may be implemented in software.
  • the authentication server that authenticates the user based on the transaction data includes:
  • a first device configured to obtain historical transaction data associated with the account according to account information provided by the user
  • a second device for generating one or more test questions based on the historical transaction data
  • a third device for providing the one or more test questions to the user
  • a fourth device for receiving an answer from the user for the one or more test questions
  • a fifth device configured to determine, according to the answer, whether the user passes the authentication.
  • the account is a bank account or a web payment application account.
  • the one or more test questions generated by the second device include a multiple choice question, wherein the multiple choice question requires the user to select one or more transaction events associated with the account from among a plurality of options.
  • the multiple choice question asks the user to select one or more transaction events associated with the account from among a plurality of options based on one or more of the following factors: time, location, transaction amount.
  • the plurality of options includes one or more interference options generated from the historical transaction data.
  • the one or more test questions generated by the second device include a fill-in-the-blank question, wherein the fill-in-the-blank question provides the user with a transaction event associated with the account and asks the user to answer One or more of the following factors related to the transaction event: time, location, transaction amount; or the fill-in-the-money question provides the user with one or more of the following factors of a transaction event associated with the account: time, place, transaction Amount and ask the user to answer the transaction event.
  • the one or more test questions generated by the second device include a decision question based on one or more of a transaction event and the following factors of the transaction event: time, location ,Amount of the transaction.
  • the third device provides the one or the user with the text information, the picture information, or the voice information of the one or more test questions, or a combination thereof, to the user's terminal. Multiple test questions.
  • the fifth device is configured to determine that the user is authenticated when the answer from the user is all correct, or to determine that the user is authenticated when the correct rate of the answer from the user is above a predetermined value .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种基于交易数据认证用户身份的方法和装置。该方法包括：根据由用户提供的账户信息获得与该账户关联的历史交易数据，根据该历史交易数据产生一个或多个测试问题，向该用户提供所述一个或多个测试问题，接收来自该用户的针对所述一个或多个测试问题的回答，以及根据所述回答判断该用户是否通过认证。

Description

一种基于交易数据认证用户身份的方法和装置
技术领域
本发明的实施例涉及身份认证，并且具体涉及基于交易数据认证用户身份的方法和装置。
背景技术
目前，在认证用户身份时，认证服务器需要依靠预先准备的数据进行认证。这些数据例如是用户在认证服务器注册时设置的密码、登记的手机号码、诸如指纹等用户的生物特征信息，或者分配给用户的智能卡中的用于认证的数据。
在各种场景下，用户可以通过向认证服务器发送所要求的数据来进行身份认证。认证服务器接收来自用户的数据，并且将这些数据与预先准备的数据进行比对来判断用户是否通过认证。
现有技术包括以下几种认证方案：
使用静态密码的认证方案，其中，包括从用户端接收所要求的数据，然后将接收到的数据与预先存储的由用户设置的密码进行比对来认证用户身份。
使用动态口令的认证方案，其中，包括向用户的终端(例如，手机)发送动态口令，并且从用户端接收所要求的数据，然后将接收到的数据与先前生成的动态口令进行比对来认证用户身份。
使用生物特征的认证方案，其中，包括从用户端接收所要求的生物特征信息(例如，人脸、声音、虹膜、指纹)，然后将接收到的生物特征信息与预先存储的从用户得到的生物特征信息进行比对来认证用户身份。
然而，上述的认证方案无法对未在认证服务器注册的用户进行身份认证。
发明内容
一种基于交易数据认证用户身份的方法，包括：根据由用户提供的账户信 息获得与该账户关联的历史交易数据，根据该历史交易数据产生一个或多个测试问题，向该用户提供所述一个或多个测试问题，接收来自该用户的针对所述一个或多个测试问题的回答，以及根据所述回答判断该用户是否通过认证。
基于交易数据认证用户身份的认证服务器，包括：第一装置，用于根据由用户提供的账户信息获得与该账户关联的历史交易数据，第二装置，用于根据该历史交易数据产生一个或多个测试问题，第三装置，用于向该用户提供所述一个或多个测试问题，第四装置，用于接收来自该用户的针对所述一个或多个测试问题的回答，以及第五装置，用于根据所述回答判断该用户是否通过认证。
当结合附图阅读以下描述时也将理解本发明的实施例的其它特征和优势，其中附图借助于实例示出了本发明的实施例的原理。
附图说明
图1是根据本发明的一个实施例的基于交易数据认证用户身份的方法的示意图。
图2是根据本发明的一个实施例的基于交易数据认证用户身份的方法的实例。
图3是根据本发明的一个实施例的呈现测试问题的界面。
图4是根据本发明的一个实施例的基于交易数据认证用户身份的系统的示意图。
具体实施方式
在下文中，将结合实施例描述本发明的原理。应当理解的是，给出的实施例只是为了本领域技术人员更好地理解并且实践本发明，而不是限制本发明的范围。因此，本说明书中包含许多具体的实施细节不应被解释为对发明的范围或可能被要求保护的范围的限制，而是应该被视为特定于实施例的描述。
图1是根据本发明的一个实施例的基于交易数据认证用户身份的方法的示意图。该方法包括框110至150中的处理，这些处理可以在认证服务器端进行。
在框110中，根据由用户提供的账户信息获得与该账户关联的历史交易数据。该账户是银行账户或者网络支付应用账户。账户信息例如可以是银行卡卡号 或者网络支付应用的账号。与账户关联的历史交易数据可以从相应的交易数据库获得。
在框120中，根据该历史交易数据产生一个或多个测试问题。后文在其它实施例中，将详细描述产生测试问题的方式和测试问题的形式。
在框130中，向该用户提供所述一个或多个测试问题。可以通过向用户的终端发送所述一个或多个测试问题的文字信息、图片信息、或者语音信息，或者其结合，来向该用户提供所述一个或多个测试问题。用户的终端可以是能够与认证服务器交互的任何电子设备，例如手机、平板电脑、笔记本电脑、自助服务终端(例如，ATM)。
在框140中，接收来自该用户的针对所述一个或多个测试问题的回答。
在框150中，根据所述回答判断该用户是否通过认证。来自用户的回答被用来与测试问题的答案进行比对，当比对相一致时，确定该用户与历史交易数据所指向的用户具有相同的身份。
根据该实施例的认证方案的一个优势在于，认证服务器不需要任何预先准备的数据就可以进行身份认证，这是因为历史交易数据可以从银行后台系统请求获得。
根据该实施例的认证方案的另一个优势在于，认证服务器仅仅需要账户信息就能进行身份认证，因此用户不必担心泄露姓名、身份证号、手机号码等敏感信息，因为他/她不需要提供这些信息。同时，用户也不需要携带任何安装有智能芯片的硬件设备。基于用户的历史交易数据产生测试问题并且根据测试问题来认证用户的身份能够提高认证过程的安全性和便捷性。
根据该实施例的认证方案的另一个优势在于，认证的方式特定于用户的交易行为，因此，即使他人知晓用户的账户信息也难以通过认证。与现有技术中的认证方案相比，根据该实施例的认证方案更加可靠。同时，由于交易行为随时间发生变化，测试问题也可以随机产生，因此根据该实施例的认证方案可以有效的防止重放攻击。
根据该实施例的认证方案的另一个优势在于，当历史交易数据是银行账户产生的数据时，认证服务器不需要任何预先准备的数据就对用户进行实名认证，这是因为银行账户与用户的真实个人信息绑定。
现在描述产生测试问题的方式和测试问题的形式。
在一个实施例中，一个或多个测试问题可以包括选择题，其中该选择题要求该用户从多个选项中选择与该账户关联的一个或多个交易事件。该选择题要求该用户从多个选项中根据以下因素的一个或者多个选择与该账户关联的一个或多个交易事件：时间、地点、交易金额。所述多个选项可以包括从该历史交易数据产生的一个或多个干扰选项。
图2是根据本发明的一个实施例的基于交易数据认证用户身份的方法的实例。该实例示出了根据银行账户信息进行身份认证的流程。
在框211中，从用户端提交银行账户信息。
在框221中，在认证服务器端接收银行账户信息，并且根据该账户信息查找历史交易数据。认证服务器可以向银行后台系统发送包含该银行账户信息的请求，然后从银行后台系统接收历史交易数据。该历史交易数据可以是特定时间段的历史交易数据。
在框222中，根据历史交易数据产生包括真实交易选项和干扰选项的多个选项。例如，真实交易选项是历史交易数据中包含的商户名称，而干扰选项可以是与历史交易数据中包含的商户相类似的商户的名称。
在一个示例中，根据用户的历史交易数据分析得到可能发生的交易行为，然后根据所述可能发生的交易行为产生干扰选项。例如，根据用户的历史交易数据分析得到可能发生的交易行为所指示的一个或多个商户，然后将该一个或多个商户作为干扰选项。
示例性地，干扰选项可以通过以下方式产生：从历史交易数据提取交易行为的特征，包括交易类型、交易地点、商户类型。然后，根据这些特征中的一部分或者全部产生不包含在历史交易数据中的商户作为干扰选项。交易类型可以包括餐饮、旅游、购物等。在餐饮的交易类型中，商户类型可以包括四川料理、日本料理等。如果历史交易数据表明用户在地点A的日本料理A商户进行消费，那么认证服务器据此可将以在地点A附近的日本料理B作为干扰项。
在框223中，向用户端发送多个选项和认证规则。多个选项可以包括真实交易选项和干扰选项。认证规则作为测试问题的一部分被呈现给用户。这里，认证规则要求该用户从多个选项中根据以下因素的一个或者多个选择与该账户关 联的一个或多个交易事件：时间、地点、交易金额。例如，认证规则可以要求用户按照交易发生时间的顺序，从多个选项中选择商户。又例如，认证规则可以要求用户从多个选项中选择在特定地点进行过交易的商户。又例如，认证规则可以要求从多个选项中选择交易金额大于某个数值的进行过交易的商户。
在框212中，呈现多个选项和认证规则。
在框213中，根据认证规则选择选项。
在框213中，发送选择的选项。
在框224中，从用户端接收选择的选项。
在看225中，判断选择的选项是否为真实交易选项，即判断选择的选项是否符合历史交易数据，当判断为是时，进入框226，当判断为否时，进入框228，认证通过。
在框226中，判断选择的选项是否符合认认证规则，即选择的选项是否满足认证规则限定的条件。当判断为是时，进入框227，认证通过，当判断为否时，进入框228，认证通过。
图3是根据本发明的一个实施例的呈现测试问题的示例性的界面。如图3所示，该测试问题的认证规则(或者答题规则)要求用户按照时间先后顺序，选择曾经消费过的6个商户。认证服务器通过分析历史交易数据发现该银行卡的用户经常在星巴克、港丽餐厅、CHANNEL专卖店、卜蜂莲花消费，由此认证服务器可以根据这样的交易行为或者消费习惯产生COSTA咖啡、Coach专卖店、麦德龙等干扰选项。由于用户的历史交易行为只有他/她自己知道，所以用户能够按照规则选出正确的商户，比如用户的实际交易发生的顺序为：星巴克、CHANNEL、卜蜂莲花、港丽餐厅、好乐迪KTV、全家。用户可以点击界面上的图标产生按顺序的选项，并且该序列选项被发送至认证服务器。当认证服务器判断用户选择的选项是真实的的并且满足认证规则的交易时间发生顺序，则身份认证成功，否则，身份认证失败。
在一个实施例中，一个或多个测试问题可以包括填空题，其中，该填空题向该用户提供与该账户关联的一个交易事件并且要求该用户回答与该交易事件相关的以下因素的一个或者多个：时间、地点、交易金额；或者该填空题向该用户提供与该账户关联的一个交易事件的以下因素的一个或者多个：时间、地点、 交易金额，并且要求该用户回答该交易事件。例如，测试问题可以是“请输入上一次在商户A进行消费的日期”或者“请输入上一次在商户A进行消费的金额”。或者测试问题可以是“请输入昨天在地点A进行消费的商户名称”。
在有多个测试问题的情况下，当来自用户的回答全部正确时，判断该用户通过认证。优选地，当来自用户的回答的正确率在预定值(例如，90％)以上时，判断该用户通过认证。如此，用户不需要记得所有的交易细节。
在一些实施例中，在测试问题是填空题的情况下，当来自用户的回答的字符被包含在正确答案的字符中(即，部分匹配)时，判断用户的回答正确，或者当来自用户的回答的数值与正确答案的数值在一定范围内时时，判断用户的回答正确。如此，用户不需要记得所有的交易细节。
在一个实施例中，一个或多个测试问题可以包括判断题，该判断题基于交易事件、以及该交易事件的以下因素的一个或者多个：时间、地点、交易金额。
图1和图2所示的各个框可被视为方法步骤、和/或被视为由于运行计算机程序代码而导致的操作、和/或被视为构建为实施相关功能的多个耦合的逻辑电路元件。尽管操作按特定的顺序在图中被描绘，但这不应被理解为要求按照所示的特定顺序或按依次顺序来执行这些操作，或要求所有例示的操作被执行，以达到理想的结果。
图4是根据本发明的一个实施例的基于交易数据认证用户身份的系统的示意图。如图所示，基于交易数据认证用户身份的系统包括客户端410、认证服务器420、后台系统430。后台系统430包括历史交易数据库431。在一个典型的实施例中，认证服务器420从客户端410接收账户信息，并且根据该账户信息从后台系统430的历史交易数据库431中提取历史交易数据。然后，认证服务器420根据提取的历史交易数据产生测试问题，并且将该测试问题发送至客户端410。然后，认证服务器420从客户端410接收回答，并且根据该回答来认证在客户端410的用户的身份与历史交易数据所指示的用户的身份是否一致。可以理解的是，认证服务器420在产生测试问题时，可以同时存储对应的测试问题的答案，以便快速验证来自用户的回答。
示例性实施例可在硬件、软件或其组合中来实施。例如，本发明的某些方面可在硬件中实施，而其它方面则可在软件中实施。
在一个实施例中，基于交易数据认证用户身份的认证服务器，包括：
第一装置，用于根据由用户提供的账户信息获得与该账户关联的历史交易数据，
第二装置，用于根据该历史交易数据产生一个或多个测试问题，
第三装置，用于向该用户提供所述一个或多个测试问题，
第四装置，用于接收来自该用户的针对所述一个或多个测试问题的回答，
第五装置，用于根据所述回答判断该用户是否通过认证。
在另一个实施例中，该账户是银行账户或者网络支付应用账户。由所述第二装置产生的所述一个或多个测试问题包括选择题，其中该选择题要求该用户从多个选项中选择与该账户关联的一个或多个交易事件。该选择题要求该用户从多个选项中根据以下因素的一个或者多个选择与该账户关联的一个或多个交易事件：时间、地点、交易金额。所述多个选项包括从该历史交易数据产生的一个或多个干扰选项。
在另一个实施例中，由所述第二装置产生的所述一个或多个测试问题包括填空题，其中，该填空题向该用户提供与该账户关联的一个交易事件并且要求该用户回答与该交易事件相关的以下因素的一个或者多个：时间、地点、交易金额；或者该填空题向该用户提供与该账户关联的一个交易事件的以下因素的一个或者多个：时间、地点、交易金额，并且要求该用户回答该交易事件。
在另一个实施例中，由所述第二装置产生的所述一个或多个测试问题包括判断题，该判断题基于交易事件、以及该交易事件的以下因素的一个或者多个：时间、地点、交易金额。
在另一个实施例中，所述第三装置通过向用户的终端发送所述一个或多个测试问题的文字信息、图片信息、或者语音信息，或者其结合，来向该用户提供所述一个或多个测试问题。
在另一个实施例中，所述第五装置被配置成当来自用户的回答全部正确时，判断该用户通过认证，或者当来自用户的回答的正确率在预定值以上时，判断该用户通过认证。
尽管本发明的示例性实施例的方面可被示出和描述为框图、流程图，但很好理解的是，这里描述的这些装置、或方法可在作为非限制性实例的系统中被实现为功能模块。此外，上述装置不应被理解为要求在所有的实施例中进行这种分 离，而应该被理解为所描述的程序组件和系统通常可以被集成在单一的软件产品中或打包成多个软件产品。
相关领域的技术人员当结合附图阅读前述说明书时，对本发明的前述示例性实施例的各种修改和变形对于相关领域的技术人员会变得明显。因此，本发明的实施例不限于所公开的特定实施例，并且变形例和其它实施例意在涵盖在所附权利要求的范围内。

Claims (10)

  1. 一种基于交易数据认证用户身份的方法，其特征在于，包括：
    根据由用户提供的账户信息获得与该账户关联的历史交易数据，
    根据该历史交易数据产生一个或多个测试问题，
    向该用户提供所述一个或多个测试问题，
    接收来自该用户的针对所述一个或多个测试问题的回答，以及
    根据所述回答判断该用户是否通过认证。
  2. 如权利要求1所述的方法，其特征在于，
    该账户是银行账户或者网络支付应用账户。
  3. 如权利要求1所述的方法，其特征在于，
    所述一个或多个测试问题包括选择题，其中该选择题要求该用户从多个选项中选择与该账户关联的一个或多个交易事件。
  4. 如权利要求3所述的方法，其特征在于，
    该选择题要求该用户从多个选项中根据以下因素的一个或者多个选择与该账户关联的一个或多个交易事件：时间、地点、交易金额。
  5. 如权利要求3所述的方法，其特征在于，
    所述多个选项包括从该历史交易数据产生的一个或多个干扰选项。
  6. 一种基于交易数据认证用户身份的认证服务器，其特征在于，包括：
    根据由用户提供的账户信息获得与该账户关联的历史交易数据，
    根据该历史交易数据产生一个或多个测试问题，
    向该用户提供所述一个或多个测试问题，
    接收来自该用户的针对所述一个或多个测试问题的回答，以及
    根据所述回答判断该用户是否通过认证。
  7. 如权利要求6所述的认证服务器，其特征在于，
    该账户是银行账户或者网络支付应用账户。
  8. 如权利要求6所述的认证服务器，其特征在于，
    所述一个或多个测试问题包括选择题，其中该选择题要求该用户从多个选项中选择与该账户关联的一个或多个交易事件。
  9. 如权利要求8所述的认证服务器，其特征在于，
    该选择题要求该用户从多个选项中根据以下因素的一个或者多个选择与该账户关联的一个或多个交易事件：时间、地点、交易金额。
  10. 如权利要求8所述的认证服务器，其特征在于，
    所述多个选项包括从该历史交易数据产生的一个或多个干扰选项。
PCT/CN2017/070223 2016-02-18 2017-01-05 一种基于交易数据认证用户身份的方法和装置 Ceased WO2017140190A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610090879.2 2016-02-18
CN201610090879.2A CN105610865A (zh) 2016-02-18 2016-02-18 一种基于交易数据认证用户身份的方法和装置

Publications (1)

Publication Number Publication Date
WO2017140190A1 true WO2017140190A1 (zh) 2017-08-24

Family

ID=55990403

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/070223 Ceased WO2017140190A1 (zh) 2016-02-18 2017-01-05 一种基于交易数据认证用户身份的方法和装置

Country Status (3)

Country Link
CN (1) CN105610865A (zh)
TW (1) TWI685805B (zh)
WO (1) WO2017140190A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113868608A (zh) * 2021-09-17 2021-12-31 支付宝(杭州)信息技术有限公司 一种身份验证方法及装置

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105610865A (zh) * 2016-02-18 2016-05-25 中国银联股份有限公司 一种基于交易数据认证用户身份的方法和装置
CN106888201A (zh) * 2016-08-31 2017-06-23 阿里巴巴集团控股有限公司 一种校验方法及装置
CN106779716B (zh) * 2016-11-21 2021-06-04 江苏通付盾区块链科技有限公司 基于区块链账户地址的认证方法、装置及系统
CN106411950B (zh) * 2016-11-21 2019-10-18 江苏通付盾科技有限公司 基于区块链交易id的认证方法、装置及系统
TWI638307B (zh) * 2017-08-04 2018-10-11 台灣資服科技股份有限公司 多因子登入系統及其登入方法
CN108875514B (zh) * 2017-12-08 2021-07-30 北京旷视科技有限公司 人脸认证方法和系统、以及认证设备和非易失性存储介质
CN108391141B (zh) * 2018-03-19 2020-03-31 京东数字科技控股有限公司 用于输出信息的方法和装置
US11251963B2 (en) 2019-07-31 2022-02-15 Advanced New Technologies Co., Ltd. Blockchain-based data authorization method and apparatus
US11252166B2 (en) 2019-07-31 2022-02-15 Advanced New Technologies Co., Ltd. Providing data authorization based on blockchain
US11057189B2 (en) 2019-07-31 2021-07-06 Advanced New Technologies Co., Ltd. Providing data authorization based on blockchain
CN110473096A (zh) * 2019-07-31 2019-11-19 阿里巴巴集团控股有限公司 基于智能合约的数据授权方法及装置
CN110517021A (zh) * 2019-08-27 2019-11-29 出门问问信息科技有限公司 一种数据处理方法、装置、存储介质和电子设备
US11310051B2 (en) 2020-01-15 2022-04-19 Advanced New Technologies Co., Ltd. Blockchain-based data authorization method and apparatus
CN112767593B (zh) * 2020-12-31 2022-02-22 深圳市深圳通有限公司 交通卡属主辨别方法、装置、设备及存储介质
CN118797619A (zh) * 2024-09-11 2024-10-18 合肥珑驰量子科技有限公司 一种应用终端认证系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1776755A (zh) * 2005-07-05 2006-05-24 淘宝控股有限公司 一种互联网服务提供商确认用户身份的方法
CN101447051A (zh) * 2007-11-27 2009-06-03 联想(北京)有限公司 支付方法和支付装置
CN101473344A (zh) * 2006-06-19 2009-07-01 维萨美国股份有限公司 消费者认证系统和方法
US20150186880A1 (en) * 2013-12-26 2015-07-02 Tencent Technology (Shenzhen) Company Limited Systems and Methods for Safe Payments
CN105610865A (zh) * 2016-02-18 2016-05-25 中国银联股份有限公司 一种基于交易数据认证用户身份的方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
BR0112382A (pt) * 2000-06-28 2005-04-12 Patentek Inc Método e sistema para a coleta, armazenagem e transmissão seguras de informação
CN1910592A (zh) * 2004-01-23 2007-02-07 运通卡国际股份有限公司 用于安全电话和计算机交易的系统和方法
US9928358B2 (en) * 2013-12-09 2018-03-27 Mastercard International Incorporated Methods and systems for using transaction data to authenticate a user of a computing device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1776755A (zh) * 2005-07-05 2006-05-24 淘宝控股有限公司 一种互联网服务提供商确认用户身份的方法
CN101473344A (zh) * 2006-06-19 2009-07-01 维萨美国股份有限公司 消费者认证系统和方法
CN101447051A (zh) * 2007-11-27 2009-06-03 联想(北京)有限公司 支付方法和支付装置
US20150186880A1 (en) * 2013-12-26 2015-07-02 Tencent Technology (Shenzhen) Company Limited Systems and Methods for Safe Payments
CN105610865A (zh) * 2016-02-18 2016-05-25 中国银联股份有限公司 一种基于交易数据认证用户身份的方法和装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113868608A (zh) * 2021-09-17 2021-12-31 支付宝(杭州)信息技术有限公司 一种身份验证方法及装置

Also Published As

Publication number Publication date
CN105610865A (zh) 2016-05-25
TW201730829A (zh) 2017-09-01
TWI685805B (zh) 2020-02-21

Similar Documents

Publication Publication Date Title
TWI685805B (zh) 一種基於交易資料認證用戶身份的方法和裝置
US12231415B2 (en) Non-repeatable challenge-response authentication
US20220180231A1 (en) Processing Machine Learning Attributes
CA2945703C (en) Systems, apparatus and methods for improved authentication
EP3374953B1 (en) Server based biometric authentication
US12341771B2 (en) Context-based authentication of a user
US20180075438A1 (en) Systems and Methods for Transacting at an ATM Using a Mobile Device
US20170201518A1 (en) Method and system for real-time authentication of user access to a resource
US20160005038A1 (en) Enhanced user authentication platform
US20150161613A1 (en) Methods and systems for authentications and online transactions
US20170372304A1 (en) Systems, devices and methods for remote authentication of a user
US20170345003A1 (en) Enhancing electronic information security by conducting risk profile analysis to confirm user identity
US8752144B1 (en) Targeted biometric challenges
US11037146B2 (en) Managing product returns associated with a user device
CN107846393B (zh) 实人认证方法及装置
KR101874174B1 (ko) 네트워크 기반의 상거래에서 본인 인증 방법 및 장치
Kulat et al. Prevention of online transaction frauds using OTP generation based on dual layer security mechanism
HK1225527A1 (zh) 一種基於交易數據認證用戶身份的方法和裝置
HK1225527A (zh) 一种基於交易数据认证用户身份的方法和装置
KR20180073538A (ko) 네트워크 기반의 상거래에서 본인 인증 방법 및 장치
CA2982061A1 (en) Managing product returns associated with a user device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17752622

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17752622

Country of ref document: EP

Kind code of ref document: A1