WO2018019243A1

WO2018019243A1 - Verification method, apparatus and device, and storage medium

Info

Publication number: WO2018019243A1
Application number: PCT/CN2017/094399
Authority: WO
Inventors: 梁焯佳; 龙强; 张东何; 邓锦福; 李素宁; 孙骁; 古开元; 卢洪权
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2016-07-28
Filing date: 2017-07-25
Publication date: 2018-02-01
Also published as: CN107665301A; CN107665301B

Abstract

Disclosed in embodiments of the present invention are a verification method, apparatus and device, and a storage medium. The method comprises: verifying a login object according to first verification information and a first verification mode used for logging in to an instance; performing login anomaly analysis on login of the login object to the instance according to the verification result; making a decision on candidate verification modes according to the analysis result so as to obtain a second verification mode, the second verification mode being different from the first verification mode; and verifying the login object according to the second verification information and the second verification mode used for logging in to the instance.

Description

Authentication method, device, device and storage medium

Cross-reference to related applications

The present application is based on a Chinese patent application filed on Jan. 28, 2016, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present invention relates to security technologies in the field of communications, and in particular, to a verification method, apparatus, device, and storage medium.

Background technique

In the Internet age, there are more and more types of applications such as social applications, multimedia applications, online shopping applications, etc. The common feature of these applications is that they identify users based on the user's pre-registered accounts and provide targeted services. Before using the service, the user needs to submit the verification information of the registered account to the running application (client) of the terminal, such as a password, a short message verification code, etc., and the application submits the verification information to the corresponding background server, and the background server is based on the verification. After the information is successfully authenticated by the user, the login is performed for the corresponding account, and the status of the corresponding account in the application of the terminal is updated, and the account of the user is displayed as the logged in state in the terminal, and the user can use the service of the account.

At present, the related technology often uses one or two fixed verification methods to verify the user login application. Once the verification information is leaked, there is a risk of account leakage.

Summary of the invention

In order to solve the above technical problem, an embodiment of the present invention is to provide a verification method, device, device, and storage medium, which avoids attack by using a combination of fixed verification methods. The potential risks ensure the security of the account.

The technical solution of the embodiment of the present invention can be implemented as follows:

An embodiment of the present invention provides a verification method, where the method includes:

Verifying the login object based on the first verification information for the login instance and the first verification method;

Logging the instance to the login object for abnormality analysis based on the verification result;

Determining the candidate verification mode based on the analysis result to obtain a second verification mode; wherein the second verification mode is different from the first verification mode;

And verifying the login object based on the second verification information for the login instance and the second verification manner.

An embodiment of the present invention provides a verification apparatus, where the apparatus includes:

The authentication management part is configured to verify the login object based on the first verification information used for the login instance and the first verification manner;

The login abnormality analysis part is configured to perform login abnormality analysis on the login object by logging in to the instance according to the verification result;

a decision part, configured to determine a candidate verification mode based on the analysis result to obtain a second verification mode; wherein the second verification mode is different from the first verification mode;

The identity verification management part is further configured to verify the login object based on the second verification information for the login instance and the second verification mode.

An embodiment of the present invention provides a verification device, including:

a processor and a storage medium; the storage medium storing executable instructions for causing the processor to perform the following operations:

Embodiments of the present invention provide a computer readable storage medium, wherein the computer readable storage medium stores a machine instruction, and when the machine instruction is executed by one or more processors, the processor performs the following steps:

Based on the verification result, the login object is logged in to the instance for login abnormality analysis;

The login object is verified based on the second verification information for the login instance and the second verification method.

The verification method, the device, the device, and the storage medium provided by the embodiment of the present invention verify the login object based on the first verification information used for the login instance and the first verification manner, and log in to the instance to log in to the instance based on the verification result. The second verification mode is obtained by determining the candidate verification mode based on the analysis result, and the second verification mode is different from the first verification mode, and the login object is verified based on the second verification information used for the login instance and the second verification mode. The above-mentioned technical implementation scheme is used to verify the user of the login instance in a secondary verification manner, so as to avoid the problem of high risk of verifying the account at one time; when the login instance of the login object is abnormal for the first time, the intelligent dynamic decision-making verification method is performed. The second verification avoids the potential risk of being attacked by the combination of fixed verification methods. For hackers, it is necessary to break the dynamic different types of authentication methods, the difficulty of hacking is increased, and the account security is more secure; The legal login object of the account, even if the login object is verified for the first time for various reasons (such as forgetting By logging in and implementing the login, it is also possible to pass the verification based on the verification method of the subsequent decision to successfully log in.

DRAWINGS

1 is an optional schematic flowchart of a verification method in an embodiment of the present invention;

2 is a schematic diagram of an optional scenario of an authentication method according to an embodiment of the present invention;

3 is a schematic diagram of an implementation interface of a scenario of a verification method according to an embodiment of the present invention;

4 is a schematic diagram of a scenario of a verification method according to an embodiment of the present invention;

5-1 is a schematic diagram of an implementation interface of a scenario of the verification method provided by the embodiment of the present invention;

5-2 is a schematic diagram of an implementation interface of a scenario of an authentication method according to an embodiment of the present invention;

6 is a schematic flow chart of a verification method in an embodiment of the present invention;

7 is a schematic diagram of a hardware structure of a verification apparatus in an embodiment of the present invention;

8-1 is a schematic diagram showing a functional structure of a verification apparatus in an embodiment of the present invention;

8-2 is a schematic diagram showing the distribution of the functional structure of the verification apparatus in the embodiment of the present invention;

8-3 is a schematic diagram showing the distribution of the functional structure of the verification apparatus in the embodiment of the present invention;

9 is a schematic diagram of a framework of dual authentication based on intelligent decision in the embodiment of the present invention;

10 is a schematic diagram of a scenario of dual identity verification in an embodiment of the present invention;

FIG. 11 is a schematic diagram showing a functional structure of a verification device in an embodiment of the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is to be understood that the examples are provided to illustrate the invention and not to limit the invention. In addition, the embodiments provided below are part of the embodiments for implementing the present invention, and do not provide all the embodiments for implementing the present invention. In the case of no conflict, the technical solutions described in the embodiments of the present invention may be combined in any combination. Implementation.

It should be noted that the term “first\second” according to the embodiment of the present invention is merely an object that distinguishes similar objects, and does not represent a specific ordering for an object. It can be understood that “first\second” is allowed. In this case, a specific order or order can be interchanged. It is to be understood that the "first/second" distinguished objects may be interchanged as appropriate to enable the embodiments of the invention described herein to be carried out in a sequence other than those illustrated or described herein.

In the process of implementing the present invention, the inventors have found that the manner in which the related art provides a login application has at least the following problems:

1) Some applications only perform verification once for the user, such as one-time authentication methods such as account + password, and the risk of the account being stolen is high.

For example, in some cases, there is no multi-authentication for suspicious logins, resulting in a high risk of account theft. For example, a social application that does not have a device lock (for verifying the login terminal) can be logged in only by using an account and a password; some third-party payment applications do not need to perform secondary verification when logging in with the SMS verification code.

2) Part of the application adopts the method of double verification to reduce the risk of account theft. However, the strategy of the verification method used by the related technology is relatively fixed, and no intelligent decision is made according to the login environment, which results in low security strength.

For example, for a social application, the verification of the short message is a fixed policy when the device lock is enabled; when the third-party payment application uses the short message verification code to log in, no other way of verifying is a fixed strategy; this adopts a fixed verification method. The strategy has risks in the following areas:

The SMS function may be hijacked. There is still a risk trust SMS message by simply using the SMS authentication code to log in. Although there are other authentication methods for third-party payment applications, such as security verification, face recognition, etc., these authentication methods are listed in an optional form. For users to choose, once they break through one of the verification methods, they can log in.

3) The verification method of some applications is fixed. When the user cannot pass the fixed verification mode, there is no other verification method to replace the user to log in successfully.

For example, when a social application uses an account and password to authenticate, if the user forgets the password and tries repeatedly, the account lock cannot be logged in; when the third-party payment application uses the SMS verification code for the second verification, when the user's mobile phone is not around When you are unable to verify by logging in.

The embodiment of the present invention provides a verification method and a verification device for verifying a user login instance, and an application verification method. The embodiment of the present invention is not limited to being provided as a method and an apparatus, and may be various. Implementations, for example, are provided as computer readable storage media (which store instructions for performing the verification methods provided by embodiments of the present invention).

The following is an example of the different implementation methods of the verification method.

First, implementation on the server side, server applications and platforms

Embodiments of the present invention may provide application software designed in a programming language such as C/C++ or Java, or a dedicated software module in a large software system, running on a server (stored in a storage medium of a server in an executable instruction manner, and stored by a server The processor on the side runs, the user is authenticated when the end user submits the authentication information to log in to the instance, and the login initialization is performed for the user when the verification passes.

The instance can be run at the terminal (eg, the instance can be a social application), and the server acts as a back-end server for the instance to implement authentication and login control for the user. Of course, the instance can also be run on the server (for example, a cloud operating system). The terminal only provides an interface for interacting with the instance running by the server, and submits the verification information input by the user terminal to the server for verification.

The embodiment of the present invention can also be provided on a distributed, parallel computing platform composed of multiple servers, equipped with a customized, easy-to-interactive network (Web) interface or other user interface (UI) for submission by the end user. The verification information authenticates the user when the instance is logged in, and performs login initialization for the user when the verification passes.

Second, implemented on the terminal side, provided as an application or module

The embodiments of the present invention can be provided as an application or a module designed by using a programming language such as C/C++ or Java. The module can be embedded into various terminals based on an operating system such as Android (Android) or iOS. In an application (for example, a social application or the like, stored in a storage medium of the terminal with executable instructions, executed by a processor of the terminal), thereby directly verifying the user using the computing resources of the terminal itself, and performing login for the user when the verification is passed Initialization, the result of the verification can also be transmitted to the server through various network communication methods on a regular or irregular basis, or saved locally at the terminal.

Before the present invention is further described in detail, the nouns and terms involved in the embodiments of the present invention are explained, and the nouns and terms involved in the embodiments of the present invention are applied to the following explanations.

1) Terminals, including mobile terminals such as smart phones, tablet computers, and vehicle terminals, can also be desktop computers or similar computing terminals.

2) Examples, operating systems and applications with authentication mechanisms.

For example, the executable code of the instance can run entirely on the server, providing a graphical interface for logging into the management instance, such as a cloud operating system, at the terminal.

As another example, the executable code of the example can be run at the terminal, provided for various applications that can be installed through the installation package, such as social applications, third party payment applications, and the like.

3) Verification mode, verifying whether the behavior of the current login instance of the user is a technical means of the user.

Illustratively, the verification method includes:

Account + password verification method;

Account + SMS verification code verification method;

Verification of biological characteristics (such as fingerprints, voiceprints, irises, etc.);

The trusted terminal is authenticated, for example, by the scan code authorization of the trusted terminal to confirm that the current login of the user is legal; the trusted terminal is, for example, a terminal that has logged into the instance with the current login account, and the user's friend is recently active. Log in to the terminal.

The relationship chain verification mode confirms that the user's current login is legal by other legitimate users, for example, by means of friend assisted confirmation.

4) Verification information, used in conjunction with the authentication method, is a credential used to verify whether the behavior of the user login instance is legal, such as account + password, account + SMS verification code, biometric, trusted terminal Login confirmation, login confirmation of the relationship chain user, etc.

The verification method provided by the embodiment of the present invention is implemented on the server side, and the user is taken as an example of the login object. For example, FIG. 1 shows an optional flow diagram of the verification method, including the following steps:

Step 101: The terminal submits, to the server, first verification information used by the user to log in to the instance.

In one embodiment, as previously mentioned, the examples include the following types:

1) The operating system running in the terminal, when the user logs in to the operating system, the user needs to submit the verification information to the server via the terminal, and the server authenticates the user and activates the login initialization of the operating system in the terminal after the verification succeeds.

2) The application running in the terminal, the server is the background server of the application, and the user's authentication information is stored, or the server can read the verification information stored in the database server, and the user needs to submit the verification to the server via the terminal when the terminal logs in to the application. Information, the server authenticates the user and activates the login initialization of the application in the terminal after successful authentication, and provides relevant business support for the application.

3) An operating system (such as an operating system) running in the server (or a distributed computing platform formed by the server). When the user logs in to the operating system, the user needs to submit the verification information to the server via the terminal, and the server verifies and verifies the user. After successful, the login initialization of the cloud operating system in the server is activated for the user.

4) An application (such as a cloud computing service) running in the server (or a distributed computing platform formed by the server). When the user logs in to the application, the user needs to submit the verification information to the server via the terminal, and the server authenticates the user and after the verification succeeds. , activates the login initialization of the application in the server for the user.

In one embodiment, exemplarily, the first verification information is information that the user needs to submit when logging in to the target instance via the terminal, and the type of the verification information depends on the verification mode (also the first verification mode) adopted by the instance.

For example, when the authentication mode is the account and password authentication mode, the first authentication information is the account and the password submitted by the user for the login instance. When the authentication mode is the account + SMS verification code mode, the first authentication information is the login instance of the user. The submitted account number and the SMS verification code received by the terminal; when the verification mode is fingerprint verification, the first verification information is the fingerprint data entered by the user at the terminal.

Step 102: The server verifies the user based on the first verification information used by the user for logging in the instance and the first verification mode.

In an embodiment, the first verification information submitted by the user via the terminal is compared with the legal verification information of the first verification mode (stored locally by the server or read by the server from the verification information database server), according to whether A verification result is formed for success. When the comparison between the first verification information and the legal verification information of the first verification mode is successful, the verification result is successful; when the comparison between the first verification information and the legal verification information of the first verification mode fails, the verification result is a failure. .

Step 103: The server detects, according to the verification result, whether the user login instance has an abnormality. If no abnormality exists, step 104 is performed; otherwise, step 105 is performed.

When there is no abnormality in the login instance of the user, it indicates that the account used by the user login instance does not have a security threat. Therefore, login initialization can be performed for the user (step 104). The following describes how to detect the abnormality of the login instance.

Way 1)

In one embodiment, for the scenario in which the submitted verification information is incorrect, the server detects that there is an abnormality when the user fails to verify based on the first verification information used by the user for the login instance and the first verification manner.

For example, in the first verification mode, the account and password authentication mode is used as an example. When the account and the password submitted by the user are inconsistent with the password of the corresponding account queried by the server, it is determined that the user login instance is abnormal.

Way 2)

In another embodiment, for the scenario in which the user replaces the terminal used by the login instance, the server detects that the user is successfully authenticated based on the first verification information used by the user for the login instance, and the first verification manner, and the user is detected. When the login terminal of the login instance is different from the historical login terminal, it is determined that the login instance of the user is abnormal.

For example, when the user replaces the new mobile phone login instance, the first authentication mode is an account number (such as a mobile phone number) and a short message verification code mode. When the mobile phone number submitted by the user login instance and the short message verification code sent for the mobile phone number are the same, That is, the verification is successful, but it is detected that the mobile phone is different from the mobile phone used by the user to log in before, that is, it is determined that the user login instance is abnormal.

Way 3)

In another embodiment, for the scenario in which the terminal is injected with malicious code, when the server detects that the user is successfully authenticated based on the first verification information used by the user for the login instance and the first verification manner, and the user login instance is detected The login terminal runs a malicious code that acquires terminal information.

For example, the server detects that the user is successfully authenticated based on the first verification information used by the user to log in to the instance, and the first verification mode. Once the malicious code in the form of malware, malicious plugin, etc. is detected in the terminal, even if the user logs in, The login terminal of the instance has not changed. It is also determined that the login instance of the user is abnormal.

In step 104, the server performs login initialization for the user.

After the server performs the login initialization for the user, the user's account is in the login state in the instance, and the user is allowed to obtain various services in the instance.

Step 105: The server performs login abnormality analysis on the user login instance.

The login abnormality analysis will be described in combination with the aforementioned method of detecting an abnormality.

Following the foregoing manner 1), in one embodiment, the server analyzes that the number of times the user attempts to log in to the instance based on the first verification information is lower than a preset duration (eg, 1 day or 1 hour, according to the instance The maximum number of false logins within the full policy, forming a corresponding analysis result, which records the number of times the user attempts to log in to the instance based on the first authentication information. Usually, the potential number of logins exceeds the maximum number of incorrect logins due to potential security. The account is locked by the threat, and the account is temporarily unable to log in until the security threat is excluded.

Following the foregoing manners 2) and 3), in one embodiment, the server compares the login feature of the user login instance with the historical login feature of the user login instance, and determines the abnormal login feature of the user login instance based on the difference of the login features ( It is called the abnormal point) and the abnormality of the corresponding abnormal point. For example, a login feature in which the login feature of each dimension of the login example is different from the historical login feature (or there is a difference and the degree of difference exceeds the corresponding difference degree threshold) is recognized as an abnormal point.

Illustratively, the login feature can take the following dimensions:

Dimensions 1) Login method, such as login time, login location, type of login account (such as social application account, mobile phone number, email address, etc.), password type (such as social application password, SMS verification code, etc.).

Dimensions 2) Login history habits, common login locations, common login terminals, common login time, etc.

Dimension 3) The login environment mainly refers to the networking mode of the logged-in terminal.

Dimension 4) The abnormality of the login terminal. The terminal exception refers to, for example, the terminal is an emulator, and other suspicious stolen accounts attempt to log in. The system version of the terminal's operating system is too low, the operating system of the terminal and the user login instance. The operating system of the historical terminal is different. For example, the user of the iOS terminal always uses the iOS system. If the operating system of the login terminal is replaced with the Android system, the terminal is abnormal, and the abnormality is a quantitative representation of the abnormality of the terminal.

Dimension 5) The credibility of the login terminal. If the terminal trusts whether the terminal has a suspicious account login, the terminal that does not have the suspicious account login has a suspicious account login credibility, and the credibility of the terminal and the terminal are suspicious. The number of account logins is negatively correlated.

Dimensions 6) The login status of the account. The login status refers to whether the account is already in the login state before the user logs in to the instance based on the account. If the account is already in the login state, the current login instance of the user is abnormal.

For example, the login time of the current account of the user is 12 o'clock at night, the type of the login account is a social application account, the password of the login account is a password of the social application, and the historical login time of the account is always concentrated in the day, the type of the login account. For the mobile phone number, the password of the login account is the SMS verification code. Because the current user login instance and the user's historical login mode are quite different, there is a potential abnormality in the login mode.

For another example, if the terminal currently logged in by the user is detected to have a large number of suspicious account logins, there is an abnormal point in the dimension of the credibility of the logged-in terminal.

For example, if the account of the currently logged in instance of the user has been logged in and initialized on the server side, the user is currently logged in based on the account. The risk of logged in by the malicious user is high, and there is an abnormality in the dimension of the logged in state.

Step 106: The server determines the candidate verification mode based on the analysis result to obtain a second verification mode.

The foregoing method 1), in one embodiment, is applicable to a scenario in which the user continuously submits the error verification information of the login instance, and analyzes that the number of times the user attempts to log in the instance based on the first verification information is not higher than the maximum error within the preset duration. The number of logins indicates that the fashion does not need to perform account lockout on the account of the login instance, and it is determined that the user may have forgotten the verification information corresponding to the first verification mode. Therefore, the authentication method supported by the instance account that the user logs in is excluded. The candidate verification mode is obtained by a verification method, and the verification mode supported by the terminal in the candidate verification mode is the second verification mode.

Following the foregoing manners 2) and 3), it is applicable to a scenario in which the terminal is successfully authenticated based on the first verification mode but the terminal of the user login instance is a new terminal, or the terminal of the user login instance is implanted with malicious code.

In one embodiment, the server performs authentication feature analysis on different authentication modes, determines the types of login attacks that different candidate authentication modes support, and resolves the login features that are not used by the corresponding types of login attacks to the corresponding verification. The login feature protected by the mode.

For example, the authentication feature analysis of the account + SMS verification code verification method can obtain an attack that the verification method can be used against the login feature of the account + password verification (because the malicious user attempting to log in to the instance may not be able to obtain the SMS verification code).

For another example, an authentication feature analysis is performed on the fingerprint verification mode, and the verification mode can be used to attack the account + password verification attack and the login feature against the account + SMS verification code (because the malicious user attempting to log in to the instance cannot Get the fingerprint of the legitimate user of the account).

Following the foregoing method 2) and mode 3), the server selects the corresponding candidate verification mode in which the login feature does not involve the abnormal point based on the abnormal point of the user login instance and the login feature protected by the candidate verification mode, and the manner of re-authenticating the user is selected. (Second verification method).

For example, when the user authentication is successful using the account + password method, and the login terminal is abnormal, such as the login record of the suspicious account on the terminal, the login method that does not involve the abnormal point is selected, such as the account + SMS verification code verification mode and the fingerprint verification mode. For the second verification method.

In an embodiment, the server may determine two or more second verification manners, for example, when the abnormality degree of the abnormal point of the user login instance exceeds the abnormality threshold, two different candidate verification methods are selected as the second verification manner. . For example, for a highly abnormal login, two candidate verification methods different from the first verification mode (as the second verification method) are selected to sequentially verify the user to ensure the account security. The following is an exemplary illustration of selecting two or more modes.

Illustratively, following the foregoing manner 1), when the server detects that the first verification information for the login instance is used by the user and the first verification mode fails to verify the user, the server selects two scenarios for the scenario in which the submitted verification information is incorrect. The candidate verification mode different from the first verification mode (as the second verification mode) sequentially verifies the user, performs login initialization for the user when the verification is successful, and blocks the user login instance when the verification fails.

Exemplarily, the foregoing manners 2) and 3) are applied to the server that the verification succeeds based on the first verification mode but the terminal of the user login instance is a new terminal (first used for login instance), or the terminal of the user login instance is implanted maliciously. In the scenario of the code, the server selects two candidate authentication modes different from the first verification mode (as the second verification mode) based on the abnormal point of the user login instance and the login feature protected by the candidate verification mode. The user is authenticated in turn, and the login initialization is performed for the user when the verification is successful, and the user login instance is blocked when the verification fails.

As described above, the login feature includes different dimensions such as a login terminal, a login history habit, a login environment, and the following, in combination with a specific case, a candidate verification mode different from the first verification mode that does not involve an abnormal point is selected (as a second verification) Method) Description.

For example, when the abnormal point is that the login terminal (the terminal used by the current login instance of the user) is different from the historical login terminal, for example, when the user attempts to log in to the instance by using a new terminal, and the login terminal has a record of the suspicious account login, if it is detected The login terminal does not involve the use of the short message verification mode to log in, and then determines that the login terminal does not have the ability to steal the short message, and selects the short message verification login mode that does not involve the current abnormal point as the second verification mode.

For another example, when the abnormal point is that the user logs in to the instance with a new account name type in the new location (for example, the user has never logged in to the instance by email/password at the location), indicating that the login terminal is an abnormal login terminal, if the detection is detected If the abnormal login terminal does not have the login record using the voiceprint data, it is determined that the login terminal does not have the ability to steal the voiceprint data, and the voiceprint verification login mode that does not involve the current abnormal point is the second verification mode.

For another example, when the abnormal point is that the user is at the login location and the network connection used for the login has a suspicious account login, the current login terminal belongs to a highly abnormal situation, and the current login user is determined not to invade the friend account, and the selection is performed. The contact (friend) secondary authentication mode with the current abnormal point line performs login initialization when a predetermined number of friends are received to determine that the current user is legally logged in.

Step 107: The server verifies the user based on the second verification information used by the user for the login instance and the second verification manner.

Step 108: The server detects, according to the verification result, whether the user login instance has an abnormality. If no abnormality exists, step 104 is performed; otherwise, step 109 is performed.

In step 109, the server blocks the user login instance.

The beneficial effects of the foregoing method 1) are described. When an authentication method (first verification mode) is used, another alternative verification mode (second verification mode) is provided to verify the user login instance, thereby avoiding When the user cannot log in when the user confirms the verification information of the first verification method, the technical effect of facilitating the smooth login of the user when the verification information of the verification method is forgotten is realized.

The beneficial effects of the foregoing modes 2) and 3) are described in the scenario where the user logs in to the instance using the new terminal and the first verification is successful, and in the scenario where the first verification is successful and the login instance terminal is implanted with malicious code. The verification mode used for the second verification of the user is dynamically determined based on the login feature of the login instance that cannot be involved (attack), because the login feature involved in the second verification mode is independent of the abnormal point, and is fixed Compared with the secondary verification method, the difficulty of attacking the login by the malicious user is improved, because since the second verification method is unpredictable for the malicious user, the malicious user cannot attack the second verification at the root, and the accurate identification is realized. The technical effect of a malicious user logging in and effectively blocking is effective when the user logs in to the instance using the new terminal.

The verification processing on the server side of the above embodiment will be described below with reference to an example.

FIG. 2 is a schematic diagram of an optional scenario for verifying a user identity when a user logs in to a WeChat provided by the embodiment of the present invention, where the first verification mode is an account/password verification mode, and the second verification mode is that the login feature does not involve an abnormality. The two verification methods of the point are described as an example: In FIG. 2, when the terminal performs the WeChat login, the WeChat account + WeChat password can be used to try to log in to WeChat, and the server performs the WeChat password corresponding to the WeChat account to the user. First test In the actual login, as shown in a in Figure 3, the user first opens the WeChat application on the terminal to enter the login interface. At this time, the terminal will display the login that needs to be verified for the first time (ie, input WeChat account and WeChat password). Verification interface; the user inputs the corresponding WeChat account in the input box 1a of the login verification interface shown in FIG. 3 in FIG. 3 and inputs the WeChat password in the input box 1b, and then clicks the login button 1c, which assumes that the user forgets the WeChat password. Submitting the wrong WeChat password causes the first verification to fail. The server analyzes the abnormality of the login to determine the abnormal point of the login. This time, the server can determine that the abnormality of the first login is the WeChat password, and then analyze the account settings of the WeChat account to determine The verification mode of the user's WeChat account binding is based on the abnormal point (ie, WeChat password) to make a decision on the verification mode (except WeChat account + WeChat password verification mode), for example, including the following decision: the first verification is non-text message verification and the user's The login terminal does not have the medium message Trojan virus, so select the WeChat account + mobile phone SMS verification method. Underwent secondary verification. At the same time, as shown in the figure b in FIG. 3, after the first verification fails, the terminal displays a login verification interface that requires a second verification (ie, inputting a WeChat account and a mobile phone SMS verification code); the user is in FIG. Enter the corresponding WeChat account in the input box 2a of the login verification interface shown in the figure, enter the SMS verification code in the input box 2b, and click the button 2c to send the verification code, and then receive it on the mobile phone in the input box 2d. Enter the verification code sent by the operator and click the login button 2e. After that, the server performs the second verification on the user based on the verification code in the short message corresponding to the WeChat account sent by the operator. If the user enters the mobile phone SMS verification code and operation The verification code in the short message sent by the quotient is the same, indicating that the second verification is successful; at this time, the server performs login initialization for the WeChat account, and the terminal will display the interface of entering WeChat as shown in c in FIG. 3, that is, the figure can be The currently received WeChat information is displayed on the

positions

3a and 3b on the interface of the c picture in 3; if the mobile phone short message verification code input by the user is in the short message sent by the operator The verification code is different, indicating that the second verification fails. At this time, the server determines the third verification mode again based on the abnormal point of the login (ie, the SMS verification code), and sets the voiceprint verification mode; meanwhile, as shown in FIG. The figure shows that when the second verification fails, the terminal will display the login verification community that needs to perform the third verification (that is, collect voiceprint information). The user inputs the WeChat account in the input box 4a of the login verification interface shown in the figure d in FIG. 3, and inputs his own voice information through a voice collecting device such as the microphone 4b, for example, "Please perform authentication". Voice information, if the third verification is successful, the login initialization is performed for the WeChat account, and the WeChat interface shown in Figure 3 is displayed on the terminal. If the third verification fails, the WeChat account is blocked for a period of time. The login indicates that the WeChat account is abnormal. There may be a risk that the WeChat account is not used by the user.

In the first verification failure, the intelligent verification subsequent verification method (the second verification method and the third verification method), and the verification method of the decision is based on the verification method of the abnormal point selection to prevent the login attack, on the one hand, avoiding The user chooses the account risk caused by the authentication method, and on the other hand, the legitimate user of the account can log in successfully.

FIG. 4 is a schematic diagram of an optional scenario for verifying a user identity when a user logs in to a WeChat provided by the embodiment of the present invention. The first verification mode is an authentication mode of an account + password + a mobile phone short message verification code, and the second verification mode is The two verification methods of the login feature that do not involve the abnormal point are described as an example. In FIG. 4, when the terminal performs the WeChat login, the user can use the WeChat account + WeChat password + mobile phone short message to try to log in to the WeChat in the new terminal, and the server is based on the storage. The WeChat password corresponding to the WeChat account and the verification code sent by the operator corresponding to the WeChat account are verified for the first time; when actually logging in, the user first opens the terminal as shown in Figure 5-1. The WeChat application enters the login interface. At this time, the terminal will display the login verification interface that needs to be verified for the first time (ie, input WeChat account + WeChat password + mobile phone SMS verification code); the user is shown in Figure 5-1. Enter the corresponding WeChat account in the input box 5a of the login verification interface, enter the WeChat password in the input box 5b, enter the mobile phone number in the input box 5c, and click After sending the verification code button 5d, after receiving the verification code sent by the operator, the mobile phone short message verification code is input into the corresponding input box 5e, and after completion, the login button 5f is clicked, and it is assumed that the WeChat password input by the user corresponds to the account and the verification code Correctly, the first verification succeeds; but the abnormality of the WeChat account is detected. For example, the terminal currently logging in to the WeChat account is different from the terminal that the user has logged into the WeChat account, or The terminal is the terminal used by the user to log in to the WeChat account, but the terminal is embedded with malicious code.

The server performs abnormal analysis on the login to determine the abnormality of the login. The server can determine that the abnormality of the login is the abnormality of the commonly used login terminal or the login terminal, and then analyze the account setting of the WeChat account to determine the verification mode of the WeChat account binding of the user. . Make a decision based on the abnormal point (that is, the abnormality of the login terminal or the login terminal) and the abnormality (except for the WeChat account + WeChat password + mobile SMS verification code verification method), for example, when the abnormality exceeds the abnormality threshold Two verification methods are used (for the second verification and the third verification); wherein the second and third verification methods may include a trusted terminal scan code authorization, a user voiceprint verification or a friend auxiliary verification, etc. Of course, in the case of performing a complete login verification, the second verification mode and the third verification mode are different in order to ensure the security of the account; for example, the second verification mode can be a trusted terminal scanning code authorization, and is applicable to the trusted terminal. Online and recently, the trusted terminal has the behavior of logging in to the WeChat account; the third verification method can be used for friend-assisted verification, and is suitable for offline contact with friends online. At the same time, as shown in the figure b in Figure 5-1, when the abnormality exceeds the abnormality threshold, the terminal displays the login verification interface that needs to perform the second verification (that is, the terminal scan authorization); the user is in Figure 5-1. The login verification interface shown in Figure b scans the two-dimensional code 6a using the function of scanning the two-dimensional code in the WeChat of the trusted terminal, and then the server determines to scan the WeChat account corresponding to the two-dimensional code authorization to use the current scan code in the latest period of time. If the terminal has logged in, it indicates that the second verification is successful; at this time, the terminal displays the login interface that needs to perform the third verification (ie, friend-assisted verification) as shown in c in Figure 5-1, and the user clicks on the map. After the button 7a requesting the friend to be authenticated in the interface of the c map in 5-1, the terminal can jump to the friend interface and click the avatar of the friend to perform the third verification, and display the d diagram in FIG. 5-1. The interface shown; after the user clicks the WeChat avatar of the corresponding WeChat friend, click the confirmation button 8a; if the third verification is successful, the login initialization is performed for the WeChat account, and the terminal will appear as shown in Figure 5-2. Interface, you can 6a position on the interface of Figure 5-2, the micro-channel display information on the currently received 6b and 6c. It should be noted that the second verification method and the third verification method are adopted when the first verification fails. The sub-authentication method), and the verification method of the decision-making is based on the verification method of the abnormal point selection to prevent the login attack, on the one hand, avoiding the account risk caused by the user selecting the verification mode, and on the other hand, ensuring the account security through the secondary verification method. .

The foregoing verification method provided by the embodiment of the present invention is implemented on the server side as an example, that is, the verification of the user of the login instance is completed by the service, and the verification method provided by the embodiment of the present invention may also be implemented on the terminal side, that is, by The terminal completes the verification of the user who logs in to the instance.

The verification method is implemented on the server side. Compared with the implementation of the verification method on the terminal side, it is possible to prevent the verification processing logic on the terminal side from being maliciously cracked, thereby forging the authentication information to spoof the server to log in the instance. The server submits the verification information and cannot modify the verification logic (because the verification logic is on the server side), thus ensuring the reliability of the verification result.

The verification method is implemented on the terminal side. Compared with the verification method being implemented on the server side, since only the user needs to submit the verification information to the terminal during the verification process, the verification process is performed on the terminal side to verify the user login instance, and the verification process is performed. No need for network communication, that is, verification of the user can be completed without relying on network communication, suitable for user authentication in the absence of network communication capability, or adapted to a highly secure closed system (physically and without the Internet) Login verification of the connection, or login verification for a specific application running in a highly secure closed system.

The verification method provided by the embodiment of the present invention is described as an example on the terminal side. Unlike the verification method shown in FIG. 1 , the verification methods illustrated in FIG. 6 are all implemented on the terminal side, and are applicable to the terminal running the offline instance and need to be The scenario in which the user authenticates. See Figure 6 for an alternative flow diagram of the verification method, including the following steps:

Step 201: The terminal submits the first verification information submitted by the user for the login instance.

1) The operating system running in the terminal, when the user logs in to the operating system, it needs to be through the terminal pair. The user authenticates and activates the login initialization of the operating system in the terminal after successful authentication.

2) The application running in the terminal, and storing the user's authentication information, the user needs to submit the verification information to the terminal when the terminal logs in to the application, and the terminal user is authenticated and the login initialization of the application in the terminal is activated after the verification is successful, and The app provides relevant business support.

Step 202: The terminal verifies the user based on the first verification information used by the user for the login instance and the first verification manner.

In an embodiment, the terminal compares the first verification information submitted by the user to the terminal, and the legal verification information of the first verification mode, and successfully forms a verification result according to whether the comparison is successful.

Step 203: The terminal detects, according to the verification result, whether the user login instance has an abnormality. If there is no abnormality, the terminal performs step 204; otherwise, step 205 is performed.

When the user login instance does not have an abnormality, it indicates that the account used by the user login instance does not have a security threat. Therefore, login initialization can be performed for the user (step 205). The following describes the manner in which the login instance is abnormal.

Way 1)

In an embodiment, when the terminal detects that the first verification information for the login instance is used by the user and the first verification mode fails to verify the user, the terminal determines that there is an abnormality.

For example, in the first verification mode, the account and password authentication mode is used as an example. When the account and password submitted by the user are inconsistent with the password of the corresponding account queried by the terminal, it is determined that the user login instance is abnormal.

Way 2)

In another embodiment, for the scenario in which the user replaces the terminal used by the login instance, the terminal detects that the user is successfully authenticated based on the first verification information used by the user for the login instance, and the first verification manner, and the user is detected. When the login terminal of the login instance is different from the historical login terminal, it is determined that the login instance of the user is abnormal.

Way 3)

In another embodiment, for the scenario in which the terminal is injected with malicious code, when the terminal detects that the user is successfully authenticated based on the first verification information used by the user for the login instance, and the first verification manner, and the user login instance is detected The login terminal runs a malicious code that acquires terminal information.

For example, for the scenario in which the user replaces the terminal used by the login instance, the terminal detects that the user is successfully authenticated based on the first verification information used by the user for the login instance, and the first verification mode, and detects that the terminal is maliciously injected. In the case of malicious code in the form of software or malicious plug-ins, even if the login terminal of the user login instance does not change, it is determined that the user login instance is abnormal.

In step 204, the terminal performs login initialization for the user.

After the terminal performs the login initialization for the user, the user's account is in the login state in the instance, and the user is allowed to obtain various services in the instance.

Step 205: The terminal performs login abnormality analysis on the user login instance.

Following the foregoing manner 1), in one embodiment, the terminal analyzes the maximum error in the number of times the user attempts to log in to the instance based on the first verification information, which is lower than a preset duration (eg, 1 day or 1 hour, depending on the security policy of the instance). The number of logins forms a corresponding analysis result, in which the number of times the user attempts to log in to the instance based on the first verification information is recorded. Generally, when the number of attempts to log in exceeds the maximum number of incorrect logins, the account lock is performed due to a potential security threat, and the account is temporarily Unable to log in until the security threat is excluded.

Following the foregoing manners 2) and 3), in one embodiment, the terminal compares the login feature of the user login instance with the historical login feature of the user login instance, and determines the abnormal login feature of the user login instance based on the difference of the login feature ( It is called the abnormal point) and the abnormality of the corresponding abnormal point. For example, a login feature in which the login feature of each dimension of the login example is different from the historical login feature (or there is a difference and the degree of difference exceeds the corresponding difference degree threshold) is recognized as an abnormal point.

Illustratively, the login feature can take the following dimensions:

Dimensions 2) Login history habits, common login locations, common login times, etc.

Dimension 4) The login status of the account. The login status refers to whether the account is already in the login state before the user logs in to the instance based on the account. If the user is already in the login state, the current login instance of the user is abnormal.

Step 206: The terminal determines the candidate verification mode based on the analysis result to obtain a second verification mode.

In an embodiment, the terminal performs identity verification analysis on different authentication modes, determines the types of login attacks that different candidate authentication modes support, and parses out the login features that are not used by the corresponding types of login attacks. The login feature protected by the mode.

Following the foregoing method 2) and mode 3), the terminal selects the corresponding candidate verification mode in which the login feature does not involve the abnormal point based on the abnormal point of the user login instance and the login feature protected by the candidate verification mode, and the method for re-authenticating the user is selected. (Second verification method).

In an embodiment, the terminal may determine two or more second verification modes. For example, when the abnormality of the abnormal point of the user login instance exceeds the abnormality threshold, two different candidate verification modes are selected as the second verification mode. . For example, for a highly abnormal login, two candidate verification methods different from the first verification mode (as the second verification method) are selected to sequentially verify the user to ensure the account security. The following is an exemplary illustration of selecting two or more modes.

Illustratively, following the foregoing manner 1), when the terminal detects that the first verification information for the login instance is used by the user and the first verification mode fails to verify the user, the terminal selects two scenarios. The candidate verification mode different from the first verification mode (as the second verification mode) sequentially verifies the user, performs login initialization for the user when the verification is successful, and blocks the user login instance when the verification fails.

Exemplarily, the foregoing manners 2) and 3) are applicable to a scenario in which the terminal successfully authenticates based on the first verification mode but the terminal of the user login instance is a new terminal, or the terminal of the user login instance is implanted with malicious code, and the terminal is based on the user. The abnormality of the login instance and the login feature protected by the candidate verification mode, and selecting two candidate authentication modes different from the first verification mode (as the second verification mode) that the login feature does not involve the abnormal point, sequentially verify the user, The login initialization is performed for the user when the verification is successful, and the user login instance is blocked when the verification fails.

Step 207: The terminal verifies the user based on the second verification information used by the user for the login instance and the second verification manner.

Step 208: The terminal detects, according to the verification result, whether the user login instance has an abnormality. If there is no abnormality, the terminal performs step 204; otherwise, step 209 is performed.

Step 209: The terminal blocks the user login instance.

The beneficial effects of the foregoing method 1) are described. When an authentication method (first verification mode) is used, another alternative verification mode (second verification mode) is provided to verify the user login instance, thereby avoiding When the user cannot log in when forgetting the verification information of the first verification mode, the user is authenticated to forget the verification information of a verification method. In the case, you can successfully log in smoothly and smoothly.

The beneficial effects of the foregoing modes 2) and 3) are described in the scenario where the user logs in to the instance using the new terminal and the first verification is successful, and in the scenario where the first verification is successful and the login instance terminal is implanted with malicious code. The verification mode used for the second verification of the user is dynamically determined based on the login feature of the login instance that cannot be involved (attack), because the login feature involved in the second verification mode is independent of the abnormal point, and is fixed Compared with the secondary verification method, the difficulty of attacking the login by the malicious user is improved, because the second verification method is unpredictable for the malicious user, and the malicious user cannot completely verify the malicious user through the second verification. The technical effect of login and effective shielding ensures the security of the account when the user logs in to the instance using the new terminal.

The hardware structure and the logical function structure of the foregoing verification apparatus are described. Referring to an optional hardware structure diagram of the verification apparatus 10 shown in FIG. 7, the verification apparatus 10 includes:

The processor 11, the input/output interface 13, the storage medium 14, and the network interface 12, the components can communicate via a system bus connection.

The processor 11 can be a central processing unit (CPU), a microprocessor (Microcontroller Unit (MCU), an application specific integrated circuit (ASIC), or a field-programmable gate array (Field-Programmable Gate Array). FPGA) implementation.

The input/output interface 13 can be implemented using input/output devices such as a display screen, a touch screen, and a speaker.

The storage medium 14 may be implemented by using a non-volatile storage medium such as a flash memory, a hard disk, or an optical disk, or may be implemented by using a volatile storage medium such as a Double Data Rate (DDR) dynamic cache. For example, the storage medium 14 may be Other components in the hardware structure are set together on the same device, or remotely from other components in the hardware structure.

The network interface 12 provides the processor 11 with access to external data such as a remotely located storage medium 14. For example, the network interface 12 may be based on near field communication (NFC) technology, Bluetooth technology, ZigBee technology for short-range communication, and may also be implemented based on code. Communication systems such as Code Division Multiple Access (CDMA) and Wideband Code Division Multiple Access (WCDMA) and their evolutionary systems.

Referring to an optional functional structure diagram of the verification apparatus 10 shown in FIG. 8-1, the verification apparatus 10 includes:

The authentication management part 15 is configured to authenticate the user based on the first verification information used by the user for the login instance and the first verification manner;

The login abnormality analysis part 16 is configured to detect that the user login instance is abnormal based on the verification result, and perform login abnormality analysis on the user login instance.

The determining part 17 is configured to determine the candidate verification mode based on the analysis result to obtain a second verification mode; wherein the second verification mode is different from the first verification mode;

The authentication management section 15 is further configured to authenticate the user based on the second verification information used by the user for the login instance and the second verification mode.

In one embodiment, the login exception analysis section 16 is further configured to detect that the user fails to verify based on the first verification information used by the user for the login instance and the first verification manner;

It is analyzed whether the number of times the user attempts to log in to the instance based on the first verification information is higher than the maximum number of incorrect logins within the preset duration.

In one embodiment, the login exception analysis section 16 is further configured to detect that the user is successfully authenticated based on the first verification information and the first verification manner, and the terminal that detects the user login instance is different from the historical login terminal.

In one embodiment, the login exception analysis section 16 is further configured to detect that the user is successfully authenticated based on the first verification information used by the user for the login instance and the first verification mode, and the login terminal of the user login instance is detected. Run malicious code that gets terminal information.

In one embodiment, the login exception analysis section 16 is further configured to compare the login feature of the user login instance with the historical login feature of the user login instance, and determine the abnormal point of the user login instance based on the difference of the login feature.

In an embodiment, the decision portion 17 is further configured to select, according to the abnormal point of the user login instance and the login feature protected by the candidate verification mode, the corresponding candidate verification mode in which the login feature does not involve the abnormal point is the second verification mode.

In one embodiment, the verification device 10 further includes:

The authentication feature management part 18 is configured to parse the verification feature of the candidate verification mode to obtain the type of the login attack supported by the candidate verification mode, and parse the login feature that is not used by the corresponding type of login attack to be protected by the corresponding verification mode. feature.

In one embodiment, the verification device 10 further includes:

The account setting analysis part 19 is configured to analyze the verification mode supported by the user's instance account;

The decision part 17 is further configured to exclude the first verification mode from the verification mode supported by the instance account of the user, and obtain the candidate verification mode; and the verification mode supported by the terminal in the candidate verification mode is the second verification mode.

In an embodiment, the determining part 17 is further configured to select two candidate verification modes different from the first verification mode as the second verification mode when the abnormality degree of the abnormal point of the user login instance exceeds the abnormality threshold.

As described above, the identity verification method provided by the embodiment of the present invention may be implemented on the server side or on the terminal side. Accordingly, as shown in FIG. 8-2, the verification apparatus 10 may use hardware resources on the server side (such as the foregoing. The processor, the network interface, and the like are implemented to perform verification on the user who logs in through the terminal in the form of a server. Alternatively, as shown in FIG. 8-3, the verification apparatus 10 can be implemented using hardware resources on the terminal side, thereby verifying the user of the login instance without requiring network communication.

In the following, the verification device 10 is implemented on the server side, and the two-factor authentication is taken as an example. Bright.

See an alternative frame diagram of intelligent decision based dual authentication shown in FIG. 9, and an alternative scenario diagram of dual authentication shown in FIG. In FIG. 9, the function of identity verification includes five parts, namely, an account setting analysis part, a login abnormality analysis part, an authentication characteristic management part, a decision part, and an authentication management part.

When the user attempts to log in with the new terminal, the password or the mobile phone verification code is verified by the authentication management part, and then the relevant part of the framework is analyzed, and the identity verification method is used for the secondary identity verification based on the domain knowledge decision. The result of each authentication pass will be recorded in the terminal information saved by the server. If the terminal completes sufficient authentication, the terminal can be used as a trusted terminal.

The account setting analysis part of the user performs the judgment of the authentication mode supported by the terminal, for example, whether the account registered by the user supports the verification of the short message (whether the mobile phone number is bound), whether the voiceprint is set, and the relationship chain of the account is available for selecting a friend and a friend. Auxiliary verification (for example, whether there is a fixed frequent contact friend), whether the current status of the account supports scanning code authorization login, and the like.

The login exception analysis part is responsible for analyzing the abnormality of the user's current login, by analyzing the user history login habits (common login location, common login terminal, login time), current login mode (login time, location, account name type (micro signal, mobile phone). No., QQ number, Email) and password type (WeChat password, QQ password, SMS verification code). Compare the current login behavior with the login habits and login methods of the user history, and analyze the abnormal points. For example, the user has never been in a certain The local login status of the account used by the user, the abnormality and credibility of the current login terminal, the abnormality of the current login environment, etc., the abnormality of the login and The degree of abnormality.

The terminal abnormality refers to, for example, the terminal is an emulator terminal, the other suspicious stolen account on the terminal attempts to log in, the system version of the terminal is too low, and the system of the terminal is different from the system of the previous terminal of the user (for example, the system of the previously logged-in terminal) Is iOS, but the system currently logged in to the device is Android), the degree of anomaly is the quantification of terminal anomalies. The terminal abnormality may also refer to whether the terminal has a suspicious user login or the like. If there is a suspicious user login, the abnormality is higher than that of the terminal where the suspicious user does not log in.

Terminal trusted means that the terminal of the login instance does not have an abnormal point, and also has trusted features, such as long-term use of the frequently contacted friend account on the terminal, the name information of the terminal and the real name information of the account, etc., and the terminal credibility It is a credible quantification of the terminal.

The login environment mainly refers to the terminal that is logged in, the networking mode, and the type of client that is logged in. If the current login terminal and the networking mode (such as the wireless LAN used) already have other suspicious users, the login is very suspicious.

The Authentication Feature Management section is the management of which types of authentication methods are available against which attacks. For example, the SMS verification code authentication method is applicable to the case where the user first authenticates to non-sms authentication and the user history terminal does not have a medium-message Trojan virus. The trusted terminal scan code authorization method is applicable to the case where the trusted terminal is online and has recently acted. Friend assistance is suitable for high suspicious logins because it requires offline contact with friends for assistance, has certain operating thresholds and is highly secure.

The decision part is a comprehensive analysis of the result of the account setting analysis part, the login abnormality analysis part and the authentication part. The decision uses the appropriate authentication method, and the determined verification method is independent of the currently registered abnormal point, thus avoiding being The situation of malicious attacks. The specific decision-making methods in practical applications can be summarized through the characteristics of historical case analysis and identity verification, and the ABTest is continuously adjusted online.

The Authentication Management section is part of the implementation of various authentication methods, including the technical implementation of identity data provisioning and authentication. The authentication method may be mobile phone short message verification, trusted terminal authorization, relationship chain verification, biometric verification, and the like.

According to the example, when the user logs in to the new terminal by using the account name + password, the abnormal login analysis is triggered to perform the decision of the secondary verification mode. The account setting analysis section found that the account has The conditions for verifying the SMS (bound mobile number) and selecting the buddy avatar (relationship chain confirmation). The login abnormality analysis section finds that the login terminal is a malicious terminal, and there are a large number of remote account logins, and the terminal does not verify the SMS record. The decision-making part starts working. According to the domain-based knowledge decision-making, the secondary verification using SMS is based on the attacker using the account name to log in. The mobile phone number bound by the account may not be known. It is speculated that it is difficult to steal the user's short message, and the terminal is on the terminal. The lack of a short record also proves this. Therefore, although the attacker verified the password correctly, but encountered the way to verify the SMS verification code, the SMS verification code could not be obtained, so the login could not be successful.

In summary, the embodiments of the present invention achieve the following beneficial effects:

The intelligent or dynamic decision-making method of secondary or multiple verification avoids the potential risk of being attacked by a combination of fixed verification methods;

The verification method of the decision avoids the abnormal point of the current login. For the hacker attacker, it is necessary to break the dynamic different types of authentication methods, the difficulty of hacking is increased, and the account security is more secure;

For a legitimate user of an account, even if the user logs in for the first time for various reasons (such as forgetting the password), the verification method of the subsequent decision is the authentication method supported by the account (bind), so that the user can smoothly Pass verification to log in.

As shown in FIG. 11, in the actual application, the above-described identity verification management section 15, login abnormality analysis section 16, decision section 17, identity verification property management section 18, and account setting analysis section 19 are all available to the processor 21 located on the verification device. The server further includes a storage medium 22, and all preset contents and software codes thereof proposed in the embodiment of the present invention may be stored in the storage medium 22, and the storage medium 22 may be connected to the processor 21 through the system bus 23, wherein Storage medium 22 is configured to store executable program code, including computer operating instructions, storage medium 22 may include high speed RAM memory, and may also include nonvolatile memory, such as at least one disk memory.

In the embodiment of the present invention, if the above information pushing method is implemented in the form of a software function module, and is sold or used as an independent product, it may also be stored in a computer readable storage. In the storage medium. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk. Thus, embodiments of the invention are not limited to any specific combination of hardware and software.

An embodiment of the present invention provides a verification device, including: a storage medium, configured to store executable instructions;

A processor configured to execute the stored executable instructions, the executable instructions configured to perform the information push method described above.

Embodiments of the present invention provide a computer storage medium in which computer executable instructions are stored, the computer executable instructions being configured to perform the above information pushing method.

It is to be understood that the phrase "one embodiment" or "an embodiment" or "an" Thus, "in one embodiment" or "in an embodiment" or "an" In addition, these particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. It should be understood that, in various embodiments of the present invention, the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be taken to the embodiments of the present invention. The implementation process constitutes any limitation. The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

It is to be understood that the term "comprises", "comprising", or any other variants thereof, is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes those elements. It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, article, or device. No more In the case of a limitation, an element defined by the phrase "comprising a ..." does not exclude the presence of the same element in the process, method, article, or device that comprises the element.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.

The units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units; they may be located in one place or distributed on multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; The unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage medium includes: a mobile storage device, a random access memory (RAM), a read-only memory (ROM), a magnetic disk, or an optical disk. A medium that can store program code.

Alternatively, the above-described integrated unit of the present invention may be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a standalone product. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes various media that can store program codes, such as a mobile storage device, a ROM, a magnetic disk, or an optical disk.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Industrial applicability

In this embodiment, the user of the login instance is verified by the method of secondary verification to avoid the problem of high risk of verifying the account at one time; when the login instance of the login object is abnormal for the first time, the intelligent dynamic decision-making verification method is performed. The second verification eliminates the potential risk of being attacked by a combination of fixed authentication methods. For hacking attackers, it is necessary to break the dynamic different types of authentication methods, the difficulty of hacking is increased, and the account security is more secure; The legal login object, even if the login object is logged in for the first time for various reasons (such as forgetting the password), it can be verified to successfully log in based on the verification method of the subsequent decision.

Claims

A verification method, the method comprising:

Verifying the login object based on the first verification information for the login instance and the first verification method;

Logging the instance to the login object for abnormality analysis based on the verification result;

Determining the candidate verification mode based on the analysis result to obtain a second verification mode; wherein the second verification mode is different from the first verification mode;

The login object is verified based on the second verification information for the login instance and the second verification method.
The method according to claim 1, wherein the login abnormality analysis is performed on the user by logging in to the instance based on the verification result, including:

Based on the verification result, detecting whether the login object logs in the instance has an abnormality, and when there is an abnormality, logging the login object to the login object to perform login abnormality analysis.
The method according to claim 1, wherein the login abnormality analysis is performed on the login object by logging in to the instance based on the verification result, including:

When it is detected that the verification of the login object fails based on the first verification information and the first verification manner, it is determined that there is an abnormality in logging in the instance;

It is analyzed whether the number of times the login object attempts to log in to the instance based on the first verification information is higher than a maximum number of incorrect logins within a preset duration.
The method according to claim 1, wherein the login abnormality analysis is performed on the login object by logging in to the instance based on the verification result, including:

Detecting that the login object is successfully verified based on the first verification information and the first verification manner, and detecting that the login target is different from the historical login terminal, determining that the login object is logged in The instance has an exception.
The method of claim 1, the verifying result, the login pair Log in to the instance for login exception analysis, including:

Detecting that the login object is successfully verified based on the first verification information and the first verification manner, and detecting that the login object logs in to the instance of the terminal and runs a malicious code that acquires terminal information, determining that the The login object logs in to the instance with an exception.
The method according to claim 1, wherein the login object is logged in to the instance for login abnormality analysis, including:

Comparing the login feature of the login object to the instance and the historical login feature of the login object to the instance, and determining, according to the difference of the login feature, the login object logs in to the abnormal point of the instance.
The method of claim 6, the login object logging into the login feature of the instance comprises a dimension of one of:

Login mode; login history habit; login environment; abnormality of the login terminal; credibility of the login terminal; login status of the account logged into the instance.
The method according to claim 1, wherein the determining the candidate verification mode based on the analysis result to obtain the second verification mode comprises:

And selecting, according to the abnormality point of the login object to log in the instance, and the login feature protected by the candidate verification mode, selecting a candidate verification mode that the login feature does not involve the abnormal point is the second verification mode.
The method of claim 1 further comprising:

The verification feature of the candidate verification mode is obtained by the type of the login attack that is supported by the candidate verification mode, and the login feature that is not attacked by the corresponding type of login attack is parsed as the login feature protected by the corresponding verification mode.
The method according to claim 1, wherein the determining the candidate verification mode based on the analysis result to obtain the second verification mode comprises:

Excluding the first authenticator in the verification mode of the instance account binding of the login object To obtain the candidate verification method;

The verification mode supported by the login terminal that logs in to the instance by the login object is the second verification mode.
The method according to claim 1, wherein the determining the candidate verification mode based on the analysis result to obtain the second verification mode comprises:

When the abnormality degree of the abnormal point of the login object logging in the instance exceeds the abnormality threshold, two candidate verification modes different from the first verification mode are selected as the second verification mode.
A verification device, the device comprising:

The authentication management part is configured to verify the login object based on the first verification information used for the login instance and the first verification manner;

The login abnormality analysis part is configured to perform login abnormality analysis on the login object by logging in to the instance according to the verification result;

a decision part, configured to determine a candidate verification mode based on the analysis result to obtain a second verification mode; wherein the second verification mode is different from the first verification mode;

The identity verification management portion is further configured to verify the login object based on the second verification information for the login instance and the second verification mode.
The device according to claim 12, wherein the login abnormality analysis portion is further configured to detect, based on the verification result, whether the login object logs in to the instance for an abnormality, and when the abnormality exists, log in to the instance for logging in to the instance Login exception analysis.
The device according to claim 12, wherein the login abnormality analysis portion is further configured to: when detecting that the login object fails to be verified based on the first verification information and the first verification method, determine the login target login location The instance has an abnormality; and it is analyzed whether the number of times the login object attempts to log in to the instance based on the first verification information is higher than a maximum number of incorrect logins within a preset duration.
The device according to claim 12, wherein the login abnormality analysis portion is further configured to detect that the login object is successfully verified based on the first verification information and the first verification manner, and the login object is detected When the terminal that logs in to the instance is different from the historical login terminal, it is determined that the login object logs in the instance and there is an abnormality.
The device according to claim 12, wherein the login abnormality analysis portion is further configured to detect that the login object is successfully verified based on the first verification information and the first verification manner, and the login object is detected When the login terminal that logs in to the instance runs the malicious code that acquires the terminal information, it is determined that the login object logs in the instance and there is an abnormality.
The device according to claim 12, wherein the login abnormality analysis portion is further configured to compare the login feature of the login object to the instance and the historical login feature of the login object to log in the instance, based on the difference of the login feature Determining an abnormal point at which the login object logs into the instance.
The apparatus according to claim 12, wherein the determining portion is further configured to: based on the abnormality point of the login object logging in the instance, and the login feature protected by the candidate verification mode, selecting the login feature does not involve the abnormality The candidate verification mode of the point is the second verification mode.
The device of claim 12, the device further comprising:

The authentication feature management part is configured to parse the verification feature of the candidate verification mode to obtain the type of the login attack supported by the candidate verification mode, and parse out the login feature that is not used by the corresponding type of login attack as the corresponding verification mode. Protected login features.
The device of claim 12, the device further comprising:

The account setting analysis part is configured to analyze the verification mode supported by the instance account of the user;

The determining part is further configured to exclude the first verification mode from the verification mode supported by the instance account of the login object, to obtain the candidate verification mode; and in the candidate verification The verification mode supported by the login terminal that logs in to the instance by the login object is the second verification mode.
The apparatus according to claim 12, wherein the determining portion is further configured to: when the abnormality degree of the abnormal point of the login object logging in the instance exceeds an abnormality threshold, select two different manners from the first verification mode The candidate verification mode is used as the second verification mode.
A verification device comprising:

a storage medium configured to store executable instructions;

A processor configured to execute the stored executable instructions, the executable instructions configured to perform the following operations:

Verifying the login object based on the first verification information for the login instance and the first verification method;

Logging the instance to the login object for abnormality analysis based on the verification result;

Determining the candidate verification mode based on the analysis result to obtain a second verification mode; wherein the second verification mode is different from the first verification mode;

And verifying the login object based on the second verification information for the login instance and the second verification manner.
A computer readable storage medium storing machine instructions that, when executed by one or more processors, perform the following steps:

Verifying the login object based on the first verification information for the login instance and the first verification method;

Logging the instance to the login object for abnormality analysis based on the verification result;

Determining the candidate verification mode based on the analysis result to obtain a second verification mode; wherein the second verification mode is different from the first verification mode;

The login object is verified based on the second verification information for the login instance and the second verification method.