WO2018166142A1 - 验证处理方法及装置 - Google Patents

验证处理方法及装置 Download PDF

Info

Publication number
WO2018166142A1
WO2018166142A1 PCT/CN2017/098408 CN2017098408W WO2018166142A1 WO 2018166142 A1 WO2018166142 A1 WO 2018166142A1 CN 2017098408 W CN2017098408 W CN 2017098408W WO 2018166142 A1 WO2018166142 A1 WO 2018166142A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification
security level
security
operation flow
request information
Prior art date
Application number
PCT/CN2017/098408
Other languages
English (en)
French (fr)
Inventor
孙延均
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018166142A1 publication Critical patent/WO2018166142A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow

Definitions

  • the present application relates to, but is not limited to, the field of communications, and in particular, to a verification processing method and apparatus.
  • the terminal system generally performs security verification only when the application is started, that is, when the user clicks the application icon to start the application, a password verification interface pops up. And the current verification method is to take the exact same verification method for all applications without distinction.
  • the terminal system generally performs security verification only when the application is started, that is, when the user clicks the application icon to start the application, a password verification interface pops up, but after entering the application, it cannot provide a subsequent interface or operation.
  • Security verification mechanism And the current verification method is to take the exact same verification method for all applications without distinction. In this way, if the application does not add a verification interface to a specific interface or operation within the application, then a security verification mechanism for an interface or operation cannot be implemented. If each application is separately designed and implemented, the application is greatly increased. Difficulties in development, especially for biometric authentication interfaces that provide high security, due to limitations related to operating system permissions, third-party applications are basically impossible to implement on their own.
  • This document provides a verification processing method and device, which can prevent a certain interface or operation of the application from being securely verified if the security verification is performed only when the application is started.
  • An embodiment of the present disclosure provides a verification processing method, including: acquiring request information for requesting verification of an operation flow initiated by an application; and acquiring the operation flow according to the request information The security level should be verified; the operation process is verified according to the security level.
  • obtaining the request information for requesting verification of the operation flow initiated by the application includes: acquiring first request information for requesting verification of an operation flow initiated by the application, The first request information carries the security level corresponding to the current environment of the operation process; or the second request information for requesting verification of the operation flow initiated by the application, where the second request information is obtained.
  • the request information carries identification information of the operation flow initiated by the application.
  • acquiring a security level corresponding to the operation flow according to the second request information includes: Obtaining, according to the identifier information carried in the second request information, an operation flow initiated by the application; determining whether a security level corresponding to the operation flow exists in the current environment; and if the determination result is yes, acquiring the location The security level corresponding to the operational process.
  • the verifying the operation flow according to the security level comprises: determining a security verification sequence corresponding to the security level according to the security level; verifying the input by the determined security verification sequence The legality of the secret order; if the verification is legal, it is determined that the operation process is legal.
  • the method before acquiring the request information for requesting verification of the operation flow initiated by the application, the method further includes: selecting the operation flow that needs to be verified; configuring and saving the operation The security level of the process.
  • configuring and saving the security level of the operational flow includes: locally configuring and saving a security level of the operational flow; or configuring and saving a security level of the operational flow through a network side.
  • the embodiment of the present disclosure further provides a verification processing apparatus, including: a receiving module, configured to: obtain request information for requesting verification of an operation flow initiated by an application; and an acquiring module, configured to: acquire, according to the request information The security level corresponding to the operation process; the processing module is configured to: perform verification processing on the operation flow according to the security level.
  • a receiving module configured to: obtain request information for requesting verification of an operation flow initiated by an application
  • an acquiring module configured to: acquire, according to the request information The security level corresponding to the operation process
  • the processing module is configured to: perform verification processing on the operation flow according to the security level.
  • the receiving module is further configured to: acquire first request information for requesting verification of an operation flow initiated by the application, where the first request information carries the The corresponding security level in the current environment of the operation process; or, the acquisition is used to request the pair The second request information that is verified by the application-initiated operation process, where the second request information carries the identification information of the operation flow initiated by the application.
  • the acquiring module is further configured to: obtain an operation flow initiated by the application according to the identifier information carried by the second request information; and determine whether the current environment exists and the operation The security level corresponding to the process; if the determination result is yes, the security level corresponding to the operation flow is obtained.
  • the processing module is further configured to: determine a security verification sequence corresponding to the security level according to the security level; verify validity of the input password by the determined security verification sequence; If the verification is legal, it is determined that the operation process is legal.
  • the apparatus further includes: a selection module, configured to: select the operation flow that needs to be verified; and the determining module is further configured to: configure and save a security level of the operation flow.
  • the determining module is further configured to: locally configure and save a security level of the operation flow; or configure and save a security level of the operation flow through a network side.
  • Embodiments of the present disclosure also provide a storage medium.
  • the storage medium is configured to store program code for performing the following steps: obtaining request information for requesting verification of an application-initiated operation flow; acquiring a security level corresponding to the operation flow according to the request information; The level is verified by the operation flow.
  • the second request information where the second request information carries the identification information of the operation flow initiated by the application.
  • the storage medium is configured to store program code for performing the following steps: in the case of acquiring second request information for requesting verification of an operation flow initiated by the application, Obtaining the security level corresponding to the operation flow of the second request information includes: acquiring the operation flow initiated by the application according to the identifier information carried by the second request information And determining whether there is a security level corresponding to the operation flow in the current environment; and if the determination result is yes, acquiring a security level corresponding to the operation flow.
  • the storage medium is configured to store program code for performing the following steps: verifying the operational flow according to the security level comprises: determining the security level according to the security level Corresponding security verification sequence; verifying the legality of the input password by the determined security verification sequence; determining that the operation flow is legal if the verification is legal.
  • the storage medium is configured to store program code for performing the following steps: before acquiring the request information for requesting verification of the operation flow initiated by the application, the method further includes: selecting The operational flow that requires verification; configures and saves the security level of the operational flow.
  • the storage medium is configured to store program code for performing the following steps: configuring and saving the security level of the operational flow includes: locally configuring and saving a security level of the operational flow; or The security level of the operational process is configured and saved through the network side.
  • Embodiments of the present disclosure also provide a computer readable storage medium storing computer executable instructions that, when executed, implement the verification processing method described above.
  • Obtaining request information for requesting verification of an operation flow initiated by an application acquiring a security level corresponding to the operation flow according to the request information, and performing verification processing on the operation flow according to the security level . Since the application-initiated operation is verified according to the security level of the operation, different operations of the application may adopt a corresponding level of security verification. Therefore, it can be avoided that if the security verification is only performed when the application is started, it is impossible to perform security verification on one interface or operation of the application, and to avoid that if the verification method is a single security verification method, there is no security rating. Strategy; improved accuracy for application security verification.
  • FIG. 1 is a hardware structure block of a mobile terminal of a verification processing method according to an embodiment of the present disclosure.
  • FIG. 2 is a flowchart of a verification processing method according to an embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of an operational process security hierarchical protection framework in accordance with an embodiment of the present disclosure
  • FIG. 4 is a flow chart of an operational process security hierarchical protection method in accordance with an embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of a request flow of a security verification control module according to an embodiment of the present disclosure
  • FIG. 6 is a flow chart showing an execution flow of a security verification sequence according to an embodiment of the present disclosure
  • FIG. 7 is a flow chart showing the establishment of an operational process security level by a security policy module in accordance with an embodiment of the present disclosure
  • FIG. 8 is a block diagram showing the structure of a verification processing apparatus according to an embodiment of the present disclosure.
  • FIG. 9 is a structural block diagram of an optional verification processing apparatus in accordance with an embodiment of the present disclosure.
  • FIG. 1 is a hardware structural block diagram of a mobile terminal according to an authentication processing method according to an embodiment of the present disclosure.
  • mobile terminal 10 may include one or more (only one shown) processor 102 (processor 102 may include, but is not limited to, a Micro Controller Unit (MCU) or A processing device such as a programmable logic device FPGA (Field Programmable Gate Array), a memory 104 provided to store data, and a transmission device 106 provided as a communication function.
  • MCU Micro Controller Unit
  • FPGA Field Programmable Gate Array
  • memory 104 provided to store data
  • a transmission device 106 provided as a communication function.
  • the structure shown in FIG. 1 is merely illustrative and does not limit the structure of the above electronic device.
  • the mobile terminal 10 may also include more or fewer components than those shown in FIG. 1, or have a different configuration than that shown in FIG.
  • the memory 104 may be configured as: a software program and a module for storing application software, such as program instructions/modules corresponding to the verification processing method in the embodiment of the present disclosure, and the processor 102 may be configured to: run the software program stored in the memory 104 by Modules to perform various functional applications and numbers According to the processing, the above method is implemented.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may also include memory remotely located relative to processor 102, which may be connected to mobile terminal 10 over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 106 can be configured to receive or transmit data via a network.
  • the network instance described above may include a wireless network provided by a communication provider of the mobile terminal 10.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module configured to communicate with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • FIG. 2 is a flowchart of a verification processing method according to an embodiment of the present disclosure. As shown in FIG. 2, the flow includes the following steps:
  • Step S202 obtaining verification information for requesting verification of an operation flow initiated by the application
  • Step S204 acquiring a security level corresponding to the operation flow according to the request information
  • Step S206 performing verification processing on the operation flow according to the security level.
  • the foregoing operations include, but are not limited to, display, hiding of buttons, clicks of buttons or views, sliding, and the like, and controllable processing in all systems.
  • obtaining the request information for requesting the verification of the operation flow initiated by the application includes: acquiring first request information for requesting verification of the operation flow initiated by the application, where the first request information carries the current operation flow.
  • the corresponding security level in the environment For example, receiving an application Proactively request the security verification interface provided by the security verification control module and pass the required security level parameters to the security verification interface.
  • obtaining the request information for requesting verification of the operation flow initiated by the application includes: acquiring second request information for requesting verification of the operation flow initiated by the application, where the second request information carries the application-initiated Identification information of the operation process.
  • the current user's operation process satisfies the security policy set by the security policy library and requests verification of the operation process.
  • the security level corresponding to the second request information acquisition operation flow includes: obtaining, according to the identification information carried by the second request information.
  • the operation flow initiated by the application determines whether there is a security level corresponding to the operation flow in the current environment; if the determination result is yes, the security level corresponding to the operation flow is obtained.
  • the verifying the operation process according to the security level comprises: determining a security verification sequence corresponding to the security level according to the security level; verifying the legality of the input security order by the determined security verification sequence; and determining, in the case of verifying the legality, determining The operation process is legal.
  • different security levels may be provided according to different security sensitivity levels of the operation process, and different security levels correspond to different security verification sequences, and the security verification sequence may include multiple types of digital passwords, character passwords, fingerprints, voiceprints, and the like.
  • the serial verification process of the password can determine whether the operation is legal by judging whether the input password is consistent with the security verification sequence.
  • the password verification method is no longer single, and more than one type of verification method including digital password, character password, fingerprint, voiceprint, etc. can be used according to different security sensitivity levels to ensure security and avoid application protection manner. More single, basically only provide a password verification method for digital passwords, character passwords, gesture passwords, and so on.
  • the method before acquiring the request information for requesting verification of the application-initiated operation process, the method further includes: selecting an operation process that needs to be verified; and configuring and saving the security level of the operation process.
  • configuring and saving the security level of the operation process includes: locally configuring and saving the security level of the operation process; or configuring and saving the security level of the operation process through the network side.
  • the application security verification interface can be designed and implemented separately by each application, especially for the biometric verification interface. Due to the limitation of operating system permissions, third-party applications are basically impossible to realize their own voice, eye, and other creatures. Identify security verification.
  • the system framework level of the embodiment of the present disclosure provides a unified security verification interface, which is necessary for the mobile terminal, can enable all applications to have a unified verification mode, and can provide a unified and convenient call security verification interface for different applications.
  • FIG. 3 is a schematic diagram of an operational process security hierarchical protection framework according to an embodiment of the present disclosure.
  • the structure of the process security hierarchical protection framework (hereinafter referred to as the security hierarchical framework) and the interaction relationship with other related modules of the system in which the security hierarchical framework operates, wherein other related modules may include (1) an application layer composed of all applications in the system.
  • An operation flow processing module that processes various operational processes initiated by the application, and may include, but is not limited to, a sub-module that processes different types of operational processes in the system, such as an interface manager and an event distribution manager.
  • the operation process security hierarchical protection framework may include four modules: a security verification control module, a security policy module, an operation process security level setting module, and a secret verification module.
  • the security level setting module is set to: provide the user with an option to set the operation flow level, and receive the user's setting operation for the setting option value.
  • the security policy module is set to: save the security policy preset by the system and set by the user.
  • the password verification module is configured to: receive the request sent by the security verification control module, and display a corresponding type of password verification interface according to the request type, and return the password verification result input by the user.
  • the security verification control module is configured to: receive an operation flow verification request of the system currently running the security classification framework, and perform a security verification process of the corresponding security level according to the security level read from the security policy module.
  • the operation flow verification request may include an active request and a passive request, and the active request may refer to the application actively calling the security verification interface provided by the security verification control module, and passing the required security level parameter to the security verification interface; the passive request may be It means that the system currently running by the security grading framework requests the application to verify the operation process because the current user's operation process satisfies the security policy set by the security policy library.
  • FIG. 4 is a flow chart of an operation process security hierarchical protection method according to an embodiment of the present disclosure, which is a flow chart The following steps can be included:
  • Step S401 The application initiates an operation process; the application actively requests security verification, and directly executes step S404;
  • Step S402 The operation flow processing module requests the security verification control module to verify the legality of the operation;
  • Step S403 The security verification control module requests to query the security level defined by the operation in the security policy module;
  • Step S404 The security verification control module sends a serial security verification sequence to the password verification module according to the security level
  • Step S405 The security verification control module returns the result of the verification of the success or failure of the security verification sequence to the application or the operation flow control module;
  • Step S406 The application or operation flow control module continues or terminates the operation flow according to the result of the verification of the success or failure of the security verification sequence.
  • the security verification control module may be configured to: receive an active security verification request directly delivered by the application, or request a validity of the verification operation of the operation process processing module.
  • FIG. 5 is a schematic diagram of a request flow of a security verification control module according to an embodiment of the present disclosure, as shown in FIG. 5.
  • the request process can include:
  • the request process may include: the application invokes an external security verification application programming interface (API) of the module, and transmits the required information to the security verification API.
  • API application programming interface
  • the security level the security verification control module executes the security verification sequence corresponding to the security level according to the security level of the request, and then returns the result of the verification sequence verification success or not to the application.
  • the request process may include: the operation flow processing module calls the operation flow legality verification API of the security verification control module, and the security verification control module sends the request to the security policy module. Query the security level of the operation process. If the security policy module stores the security level record of the current operation process, return to the operation process. The security level, and then execute the security verification sequence corresponding to the security level, and then return the result of the verification sequence verification success or not to the operation process processing module; otherwise, the current operation process does not set any security verification policy, and directly returns the verification result to the operation successfully. Process processing module.
  • FIG. 6 is a schematic diagram of an execution flow of a security verification sequence according to an embodiment of the present disclosure.
  • the security level in the request process may be divided into any number according to actual conditions, and the security verification sequence corresponding to each level includes The secret combination is also freely selectable.
  • the verification process of the security verification sequence may be serially executed, that is, the password 1 authentication succeeds and enters the password 2 verification process, the password 2 is authenticated and then enters the password 3 verification process, and so on, until all the secrets in the security verification sequence are The result of the verification is successful until the verification is completed; otherwise, if any of the password verification fails, the result is a failure.
  • each security verification level having a corresponding security verification sequence.
  • the security verification sequence corresponding to the security verification level 1 only contains the character password;
  • the security verification sequence corresponding to the security verification level 2 includes the character password and the fingerprint password;
  • the security verification sequence corresponding to the security verification level 3 includes the character password, the fingerprint password, and the eye password.
  • the process steps of the secret verification module may include:
  • Various types of secret commands are stored in a local secure trusted partition. This area ensures that the data stored and processed in it is independent of the external environment, and this The zone can be a credit environment, which ensures the security of the secret storage.
  • the process steps of the operational process level setting module may include:
  • FIG. 7 is a schematic flowchart of establishing a security level of an operation process by a security policy module according to an embodiment of the present disclosure. As shown in FIG. 7, the process step may include:
  • the security policy module intelligent learning algorithm dynamically determines the security level of the operational process and returns the calculated security level.
  • the preset operation flow in this embodiment may be based on statistical analysis of big data users, and obtain a more commonly used operation process that requires security verification protection. And by connecting to the cloud security policy server, the preset operation flow in the local terminal system can be updated in real time, thereby ensuring the timeliness of the local security policy.
  • the intelligent learning algorithm described in this embodiment simply calculates the security level of the operation process by weighted average of the following three impact factors: the operation process status factor (including several consecutive executions of the operation process, the verification is not verified, and the payment is made. The payment amount in the process, etc.), the time factor (including the last usage time, etc.), the operating environment factor (including whether the commonly used network environment, whether the commonly used Subscriber Identification Module (SIM) card, etc.).
  • the operation process status factor including several consecutive executions of the operation process, the verification is not verified, and the payment is made.
  • the payment amount in the process, etc. the time factor (including the last usage time, etc.)
  • the operating environment factor including whether the commonly used network environment, whether the commonly used Subscriber Identification Module (SIM) card, etc.
  • the calculation formula is: Where P i is the weight of the i-th influence factor, satisfying 0 ⁇ P i ⁇ 1, ⁇ i is the i-th influence factor value, and satisfies 0 ⁇ ⁇ i ⁇ 1, wherein the set of values of i is, for example, ⁇ 1, 2, 3 ⁇ , and N is the number of influence factors, for example, 3.
  • the impact factor works. (1) For example, if the current user is in the payment interface, click the “Payment” button on the interface. At this time, the payment amount in the input box will be dynamically calculated. The proportion of the operational process status factor, when it is a small payment, will perform the security level 2 verification process.
  • the security level 3 verification process When it is a large payment, the security level 3 verification process will be performed.
  • the secure short message sending operation in the case of normal use, the security level 1 verification process is executed when the user clicks the send button, but when it is detected that the SIM card currently used by the user belongs to the new SIM card, , will increase the proportion of operating environment factors, and implement the security level 2 verification process.
  • the embodiment of the present disclosure provides a method for providing hierarchical protection for the operation process security.
  • the local pre-configurable security classification policy or the real-time update of the preset operation flow in the local terminal system by connecting to the cloud security policy server may be based on intelligent detection.
  • User settings, etc. to dynamically determine the security level of the current operation, so as to adopt a corresponding level of security verification.
  • the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware.
  • the essential or contributing portion of the technical solution of the embodiments of the present disclosure may be embodied in the form of a software product stored in a storage medium (eg, ROM/RAM, disk, CD).
  • the instructions include a plurality of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method described in the embodiments of the present disclosure.
  • the embodiment of the present disclosure further provides a verification processing device, which is configured to implement the foregoing embodiments and optional implementations, and has not been described again.
  • the term "module” may implement a combination of software of a predetermined function, or a combination of hardware, or a combination of software and hardware.
  • the devices described in the following embodiments may be implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 8 is a structural block diagram of a verification processing apparatus according to an embodiment of the present disclosure. As shown in FIG. 8, the apparatus includes:
  • the receiving module 82 is configured to: obtain request information for requesting verification of an operation flow initiated by the application;
  • the obtaining module 84 is connected to the receiving module 82, and is configured to: acquire a security level corresponding to the operation flow according to the request information;
  • the processing module 86 is connected to the obtaining module 84, and is configured to perform verification processing on the operation flow according to the security level.
  • the receiving module 82 is further configured to: obtain the first request information for requesting verification of the operation flow initiated by the application, where the first request information carries a security level corresponding to the current environment of the operation process; or Get the first to request verification of the application-initiated operational process The second request information, wherein the second request information carries the identification information of the operation flow initiated by the application.
  • the obtaining module 84 is further configured to: obtain an operation flow initiated by the application according to the identifier information carried in the second request information; determine whether there is a security level corresponding to the operation flow in the current environment; and if the judgment result is yes, , to obtain the security level corresponding to the operation process.
  • the processing module 86 is further configured to: determine a security verification sequence corresponding to the security level according to the security level; verify the legality of the input security command by using the determined security verification sequence; and determine that the operation process is legal if the verification is legal .
  • FIG. 9 is a structural block diagram of an optional verification processing apparatus according to an embodiment of the present disclosure. As shown in FIG. 9, the apparatus may include, in addition to all the modules shown in FIG.
  • the selecting module 92 is configured to: select an operation flow that needs to be verified;
  • the determining module 94 is connected to the selection module 92 and configured to: configure and save the security level of the operational flow.
  • the determining module 94 is further configured to: locally configure and save the security level of the operation process; or configure and save the security level of the operation process through the network side.
  • the foregoing modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or the foregoing modules are in any combination. They are located in different processors.
  • Embodiments of the present disclosure also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • S1 Obtain request information for requesting verification of an operation process initiated by an application
  • the storage medium is further configured to store program code for performing the following steps: obtaining request information for requesting verification of the application initiated operation flow includes:
  • S1 Acquire first request information for requesting verification of an operation process initiated by an application, where the first request information carries a security level corresponding to a current environment of the operation process;
  • the storage medium is further configured to store program code for performing the following steps: in the case of acquiring the second request information for requesting verification of the operation flow initiated by the application, acquiring the operation flow according to the second request information
  • the corresponding security levels include:
  • the storage medium is further configured to store program code for performing the following steps: verifying the operation flow according to the security level comprises:
  • the storage medium is further configured to store program code for performing the following steps: before obtaining the request information for requesting verification of the operation flow initiated by the application, the method further includes:
  • the storage medium is further configured to store program code for performing the following steps: configuring and saving the security level of the operational flow includes:
  • the foregoing storage medium may include, but not limited to, a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a medium that can store program code may include, but not limited to, a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.
  • the processor executes, according to the stored program code in the storage medium, acquiring request information for requesting verification of an operation flow initiated by the application; acquiring a security level corresponding to the operation flow according to the request information; and verifying the operation flow according to the security level. deal with.
  • the processor executes according to the stored program code in the storage medium: obtaining for the request
  • the request information for verifying the operation flow initiated by the application includes: acquiring the first request information for requesting verification of the operation flow initiated by the application, where the first request information carries a security level corresponding to the current environment of the operation process; or And obtaining second request information for requesting verification of the operation flow initiated by the application, where the second request information carries the identification information of the operation flow initiated by the application.
  • the processor executes, according to the stored program code in the storage medium, in the case of acquiring the second request information for requesting verification of the operation flow initiated by the application, acquiring the security corresponding to the operation flow according to the second request information.
  • the level includes: obtaining an operation flow initiated by the application according to the identifier information carried in the second request information; determining whether there is a security level corresponding to the operation flow in the current environment; and obtaining a security level corresponding to the operation flow if the determination result is yes.
  • the processor is executed according to the stored program code in the storage medium: the verifying the operation flow according to the security level comprises: determining a security verification sequence corresponding to the security level according to the security level; and verifying the input by the determined security verification sequence The legality of the secret order; in the case of legal verification, it is determined that the operation process is legal.
  • the processor executes according to the stored program code in the storage medium: before acquiring the request information for requesting verification of the operation flow initiated by the application, the method further includes: selecting an operation flow that needs to be verified; configuring and saving the operation flow. Security Level.
  • configuring and saving the security level of the operation process includes: locally configuring and saving the security level of the operation process; or configuring and saving the security level of the operation process through the network side .
  • Embodiments of the present disclosure also provide a computer readable storage medium storing computer executable instructions that, when executed, implement the verification processing method described above.
  • modules or steps of the embodiments of the present disclosure may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices. Alternatively, they may be implemented by program code executable by a computing device such that they may be stored in a storage device for execution by the computing device, and In some cases, the steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into different integrated circuit modules, or a plurality of modules or steps thereof may be fabricated into a single integrated circuit module. achieve. Thus, embodiments of the present disclosure are not limited to any specific combination of hardware and software.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • Obtaining request information for requesting verification of an operation flow initiated by an application acquiring a security level corresponding to the operation flow according to the request information, and performing verification processing on the operation flow according to the security level . Since the application-initiated operation is verified according to the security level of the operation, different operations of the application may adopt a corresponding level of security verification. Therefore, it can be avoided that if the security verification is only performed when the application is started, it is impossible to perform security verification on one interface or operation of the application, and to avoid that if the verification method is a single security verification method, there is no security rating. Strategy; improved accuracy for application security verification.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

一种验证处理方法包括：获取用于请求对应用发起的操作流程进行验证的验证信息；根据验证信息获取操作流程对应的安全等级；根据安全等级对操作流程进行验证处理。

Description

验证处理方法及装置 技术领域
本申请涉及但不限于通信领域，尤其是一种验证处理方法及装置。
背景技术
终端系统一般仅在应用程序启动时进行安全验证，也就是在用户点击应用图标想要启动应用的时候，会弹出一个密码验证界面。并且当前的验证方式是对于所有的应用都不加区别地采取完全一样的验证方式。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
终端系统一般仅在应用程序启动时进行安全验证，也就是在用户点击应用图标想要启动应用的时候，会弹出一个密码验证界面，但是进入应用程序后，无法提供对于后续某一个界面或者操作的安全验证机制。并且当前的验证方式是对于所有的应用都不加区别地采取完全一样的验证方式。这样，如果应用没有在应用内部针对某一特定界面或者操作增加验证界面，那么就无法实施针对某一界面或者操作的安全验证机制，假如每个应用分别设计和实现，那么就大大增加了应用的开发难度，特别是对于提供高安全性的生物识别验证的界面由于涉及到操作系统权限的限制，第三方应用程序基本上不可能自行实现。
因此，如果仅在应用程序启动时进行安全验证，则无法对该应用的某一个界面或者操作进行安全验证，使得无法对应用进行精确的验证。
本文提供了一种验证处理方法及装置，能够避免如果仅在应用程序启动时进行安全验证，则无法对该应用的某一个界面或者操作进行安全验证。
本公开实施例提供了一种验证处理方法，包括：获取用于请求对应用发起的操作流程进行验证的请求信息；根据所述请求信息获取所述操作流程对 应的安全等级；根据所述安全等级对所述操作流程进行验证处理。
在一种示例性实施方式中，获取用于请求对所述应用发起的操作流程进行验证的所述请求信息包括：获取用于请求对所述应用发起的操作流程进行验证的第一请求信息，其中，所述第一请求信息携带有所述操作流程当前环境下对应的安全等级；或者，获取用于请求对所述应用发起的操作流程进行验证的第二请求信息，其中，所述第二请求信息携带有所述应用发起的所述操作流程的标识信息。
在一种示例性实施方式中，在获取用于请求对所述应用发起的操作流程进行验证的第二请求信息的情况下，根据所述第二请求信息获取所述操作流程对应的安全等级包括：根据所述第二请求信息携带的所述标识信息获取所述应用发起的操作流程；判断当前环境下是否存在与所述操作流程对应的安全等级；在判断结果为是的情况下，获取所述操作流程对应的安全等级。
在一种示例性实施方式中，根据所述安全等级对所述操作流程进行验证处理包括：根据所述安全等级确定与所述安全等级对应的安全验证序列；通过确定的安全验证序列验证输入的密令的合法性；在验证合法的情况下，确定所述操作流程合法。
在一种示例性实施方式中，在获取用于请求对所述应用发起的操作流程进行验证的所述请求信息之前，还包括：选择需要进行验证的所述操作流程；配置并保存所述操作流程的安全等级。
在一种示例性实施方式中，配置并保存所述操作流程的安全等级包括：本地配置并保存所述操作流程的安全等级；或者，通过网络侧配置并保存所述操作流程的安全等级。
本公开实施例还提供了一种验证处理装置，包括：接收模块，设置为：获取用于请求对应用发起的操作流程进行验证的请求信息；获取模块，设置为：根据所述请求信息获取所述操作流程对应的安全等级；处理模块，设置为：根据所述安全等级对所述操作流程进行验证处理。
在一种示例性实施方式中，所述接收模块，还设置为：获取用于请求对所述应用发起的操作流程进行验证的第一请求信息，其中，所述第一请求信息携带有所述操作流程当前环境下对应的安全等级；或者，获取用于请求对 所述应用发起的操作流程进行验证的第二请求信息，其中，所述第二请求信息携带有所述应用发起的所述操作流程的标识信息。
在一种示例性实施方式中，所述获取模块，还设置为：根据所述第二请求信息携带的所述标识信息获取所述应用发起的操作流程；判断当前环境下是否存在与所述操作流程对应的安全等级；在判断结果为是的情况下，获取所述操作流程对应的安全等级。
在一种示例性实施方式中，所述处理模块，还设置为：根据所述安全等级确定与所述安全等级对应的安全验证序列；通过确定的安全验证序列验证输入的密令的合法性；在验证合法的情况下，确定所述操作流程合法。
在一种示例性实施方式中，上述装置还包括：选择模块，设置为：选择需要进行验证的所述操作流程；确定模块，还设置为：配置并保存所述操作流程的安全等级。
在一种示例性实施方式中，所述确定模块，还设置为：本地配置并保存所述操作流程的安全等级；或者，通过网络侧配置并保存所述操作流程的安全等级。
本公开实施例还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：获取用于请求对应用发起的操作流程进行验证的请求信息；根据所述请求信息获取所述操作流程对应的安全等级；根据所述安全等级对所述操作流程进行验证处理。
在一种示例性实施方式中，该存储介质设置为存储用于执行以下步骤的程序代码：获取用于请求对所述应用发起的操作流程进行验证的所述请求信息包括：获取对所述应用发起的操作流程进行验证的第一请求信息，其中，所述第一请求信息携带有所述操作流程当前环境下对应的安全等级；或者，获取用于请求对所述应用发起的操作流程进行验证的第二请求信息，其中，所述第二请求信息携带有所述应用发起的所述操作流程的标识信息。
在一种示例性实施方式中，该存储介质设置为存储用于执行以下步骤的程序代码：在获取用于请求对所述应用发起的操作流程进行验证的第二请求信息的情况下，根据所述第二请求信息获取所述操作流程对应的安全等级包括：根据所述第二请求信息携带的所述标识信息获取所述应用发起的操作流 程；判断当前环境下是否存在与所述操作流程对应的安全等级；在判断结果为是的情况下，获取所述操作流程对应的安全等级。
在一种示例性实施方式中，该存储介质设置为存储用于执行以下步骤的程序代码：根据所述安全等级对所述操作流程进行验证处理包括：根据所述安全等级确定与所述安全等级对应的安全验证序列；通过确定的安全验证序列验证输入的密令的合法性；在验证合法的情况下，确定所述操作流程合法。
在一种示例性实施方式中，该存储介质设置为存储用于执行以下步骤的程序代码：在获取用于请求对所述应用发起的操作流程进行验证的所述请求信息之前，还包括：选择需要进行验证的所述操作流程；配置并保存所述操作流程的安全等级。
在一种示例性实施方式中，该存储介质设置为存储用于执行以下步骤的程序代码：配置并保存所述操作流程的安全等级包括：本地配置并保存所述操作流程的安全等级；或者，通过网络侧配置并保存所述操作流程的安全等级。
本公开实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述验证处理方法。
通过本公开实施例，获取用于请求对应用发起的操作流程进行验证的请求信息；根据所述请求信息获取所述操作流程对应的安全等级；根据所述安全等级对所述操作流程进行验证处理。由于根据操作的安全等级对应用发起的操作进行验证处理，使得应用的不同操作可以采用相应等级的安全验证方式。因此，可以避免如果仅在应用程序启动时进行安全验证，则无法对该应用的某一个界面或者操作进行安全验证，以及避免如果验证的方式都是单一的安全验证方式，则没有一种安全分级策略；提高了对应用安全验证的精确度。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1是根据本公开实施例的一种验证处理方法的移动终端的硬件结构框 图；
图2是根据本公开实施例的验证处理方法的流程图；
图3是根据本公开实施例的操作流程安全分级保护框架示意图；
图4是根据本公开实施例的操作流程安全分级保护方法流程图；
图5是根据本公开实施例的安全验证控制模块的请求流程示意图；
图6是根据本公开实施例的安全验证序列的执行流程示意图；
图7是根据本公开实施例的安全策略模块确立操作流程安全等级的流程示意图；
图8是根据本公开实施例的验证处理装置的结构框图；
图9是根据本公开实施例的可选验证处理装置的结构框图。
本公开的较佳实施方式
下面结合附图对本公开的实施方式进行描述。
需要说明的是，本文中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
本申请实施例所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在移动终端上为例，图1是根据本公开实施例的一种验证处理方法的移动终端的硬件结构框图。如图1所示，移动终端10可以包括一个或多个(图中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU(Micro Controller Unit，微控制器单元)或可编程逻辑器件FPGA(Field Programmable Gate Array，现场可编程门阵列)等的处理装置)、设置为存储数据的存储器104、以及设置为通信功能的传输装置106。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，移动终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可设置为：存储应用软件的软件程序以及模块，如本公开实施例中的验证处理方法对应的程序指令/模块，处理器102可设置为：通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数 据处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104还可包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至移动终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106可设置为：经由一个网络接收或者发送数据。上述的网络实例可包括移动终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其设置为：通过无线方式与互联网进行通讯。
在本实施例中提供了一种运行于上述移动终端的验证处理方法，图2是根据本公开实施例的验证处理方法的流程图，如图2所示，该流程包括如下步骤：
步骤S202，获取用于请求对应用发起的操作流程进行验证的验证信息；
步骤S204，根据请求信息获取操作流程对应的安全等级；
步骤S206，根据安全等级对操作流程进行验证处理。
通过上述步骤，由于根据操作的安全等级对应用发起的操作进行验证处理，使得应用的不同操作可以采用相应等级的安全验证方式。因此，可以避免如果仅在应用程序启动时进行安全验证，则无法对该应用的某一个界面或者操作进行安全验证，以及避免如果验证的方式都是单一的安全验证方式，则没有一种安全分级策略；提高了对应用安全验证的精确度。可以支持对于更细粒度的操作的安全验证，可以更精确地保护敏感操作。
可选地，上述操作包括但不限于界面的显示、隐藏，按键或视图的点击、滑动等一切系统中可控的处理。
可选地，获取用于请求对应用发起的操作流程进行验证的请求信息包括：获取用于请求对应用发起的操作流程进行验证的第一请求信息，其中，第一请求信息携带有操作流程当前环境下对应的安全等级。例如，接收应用程序 主动请求安全验证控制模块提供的安全验证接口，并向该安全验证接口传入所需的安全等级参数。
可选地，获取用于请求对应用发起的操作流程进行验证的请求信息包括：获取用于请求对应用发起的操作流程进行验证的第二请求信息，其中，第二请求信息携带有应用发起的操作流程的标识信息。例如，由于当前用户的操作流程满足了安全策略库设置的安全策略而请求对操作流程进行验证的情况。
可选地，在获取用于请求对应用发起的操作流程进行验证的第二请求信息的情况下，根据第二请求信息获取操作流程对应的安全等级包括：根据第二请求信息携带的标识信息获取应用发起的操作流程；判断当前环境下是否存在与操作流程对应的安全等级；在判断结果为是的情况下，获取操作流程对应的安全等级。
可选地，根据安全等级对操作流程进行验证处理包括：根据安全等级确定与安全等级对应的安全验证序列；通过确定的安全验证序列验证输入的密令的合法性；在验证合法的情况下，确定操作流程合法。例如，可以根据操作流程的安全敏感程度的不同，提供不同的安全等级，不同安全等级对应不同的安全验证序列，而该安全验证序列可以包括对于数字密码、字符密码、指纹、声纹等多种密令的串行验证流程，可通过判断输入的密令是否与安全验证序列相一致，确定操作是否合法。通过上述步骤，使得密令验证方式不再单一，可以根据安全敏感程度的不同，使用包括数字密码、字符密码、指纹、声纹等多于一种的验证方式来确保安全，避免应用程序的保护方式比较单一，基本上都只是提供数字密码、字符密码、手势密码等的某一种密码验证方式。
可选地，在获取用于请求对应用发起的操作流程进行验证的请求信息之前，还包括：选择需要进行验证的操作流程；配置并保存操作流程的安全等级。通过上述步骤，使得可以根据用户需要选择需要进行验证的操作，确定并保存该操作的安全等级，提高了用户的体验度。
可选地，配置并保存操作流程的安全等级包括：本地配置并保存操作流程的安全等级；或者，通过网络侧配置并保存操作流程的安全等级。
应用程序安全验证界面可以由每个应用分别设计和实现，特别是对于生物识别验证的界面，由于涉及到操作系统权限的限制，第三方应用程序基本上不可能自行实现声纹、眼纹等生物识别安全验证。本公开实施例的系统框架层级提供一个统一的安全验证接口对于移动终端来说很有必要，可以让所有应用有统一的验证方式，能够为不同应用程序提供统一的、方便调用的安全验证接口。
图3是根据本公开实施例的操作流程安全分级保护框架示意图，为了方便理解上述实施例，以如图3所示的操作流程安全分级保护框架进行详细说明，如图3所示，显示了操作流程安全分级保护框架(以下简称安全分级框架)的结构，以及与该安全分级框架所运行系统的其他相关模块的交互关系，其中其他相关模块可包括(1)系统中所有应用程序组成的应用层；(2)对应用发起的各种操作流程进行处理的操作流程处理模块，可包括但不限于界面管理器、事件分发管理器等对系统中不同类型的操作流程进行处理的子模块。
如图3所示，操作流程安全分级保护框架可包括安全验证控制模块、安全策略模块、操作流程安全等级设置模块、密令验证模块四个模块。
(1)操作流程安全等级设置模块设置为：提供给用户设置操作流程等级的选项，并接收用户对于设置选项值的设定操作。
(2)安全策略模块设置为：保存系统预置的和用户设置的安全策略。
(3)密令验证模块设置为：接收安全验证控制模块发送的请求，并根据请求类型显示对应类型的密令验证界面，并返回用户输入的密令验证结果。
(4)安全验证控制模块设置为：接收当前该安全分级框架运行的系统的操作流程验证请求，并根据从安全策略模块读取到的安全等级，进行相应安全等级的密令验证流程。其中操作流程验证请求可包括主动请求和被动请求，主动请求可以是指应用程序主动调用安全验证控制模块提供的安全验证接口，并向该安全验证接口传入所需的安全等级参数；被动请求可以是指当前该安全分级框架运行的系统由于当前用户的操作流程满足了安全策略库设置的安全策略而向应用程序请求对该操作流程进行验证的情况。
图4是根据本公开实施例的操作流程安全分级保护方法流程图，该流程 可包括以下步骤：
步骤S401：应用发起操作流程；应用主动请求安全验证，直接执行步骤S404；
步骤S402：操作流程处理模块请求安全验证控制模块验证操作合法性；
步骤S403：安全验证控制模块请求查询该操作在安全策略模块中定义的安全等级；
步骤S404：安全验证控制模块根据安全等级，发送串行的安全验证序列给密令验证模块；
步骤S405：安全验证控制模块返回安全验证序列验证成功与否的结果给应用或者操作流程控制模块；
步骤S406：应用或者操作流程控制模块根据安全验证序列验证成功与否的结果来继续或终止操作流程。
为了更清楚地阐述如图3所示的操作流程安全分级保护框架中的安全验证控制模块、安全策略模块、操作流程安全等级设置模块、密令验证模块四个模块，下面分别对这四个模块进行详细的说明。
安全验证控制模块
安全验证控制模块大致可设置为：接收应用直接下发的主动安全验证请求，或者操作流程处理模块的验证操作合法性的请求。图5是根据本公开实施例的安全验证控制模块的请求流程示意图，如图5所示。请求流程可包括：
在应用主动下发安全验证请求的情况下，请求流程可包括：应用调用本模块的对外的安全验证应用程序编程接口(Application Programming Interface，简称为API)，并向该安全验证API传入所需的安全等级，安全验证控制模块根据请求传入的安全等级，执行安全等级对应的安全验证序列，然后将验证序列验证成功与否的结果返回给应用。
在操作流程处理模块下发验证操作合法性的请求的情况下，请求流程可包括：操作流程处理模块调用安全验证控制模块的操作流程合法性验证API，安全验证控制模块发送请求给安全策略模块，查询操作流程的安全等级，如果安全策略模块存储了当前操作流程的安全等级记录，返回该操作流程对应 的安全等级，然后执行安全等级对应的安全验证序列，然后将验证序列验证成功与否的结果返回给操作流程处理模块；否则说明当前操作流程没有设置任何安全验证策略，直接返回验证结果成功给操作流程处理模块。
图6是根据本公开实施例的安全验证序列的执行流程示意图，如图6所示，上述请求流程中安全等级可以根据实际情况划分为任意多的等级，每个等级所对应的安全验证序列包含的密令组合也是可以自由选择的。安全验证序列的验证流程可以是串行执行的，即密令1验证成功后进入密令2验证流程，密令2验证成功后进入密令3验证流程，以此类推，直至该安全验证序列中所有的密令被验证完成为止，返回结果为成功；否则只要其中任何的一个密令验证失败，返回结果为失败。
本实施例中提供了三个等级的安全验证的例子，每个安全验证等级都有一个相对应的安全验证序列。安全验证等级1对应的安全验证序列只包含字符密令；安全验证等级2对应的安全验证序列包含字符密令和指纹密令；安全验证等级3对应的安全验证序列包含字符密令、指纹密令、眼纹密令。
密令验证模块
密令验证模块的流程步骤可包括：
(1)接收安全验证控制模块发送的请求；
(2)根据请求类型显示对应类型的密令验证界面；
(3)返回用户输入的密令验证结果。
其中各种类型的密令(包括字符密码、指纹、眼纹等)都是存储在本地安全可信分区中的，此区域可保证在其内部存储、处理的数据是独立于外部环境的，并且此区域可以是一个授信环境，这样就确保了密令存储的安全性。
操作流程等级设置模块
操作流程等级设置模块的流程步骤可包括：
(1)用户选择想要设置安全验证的操作流程；
(2)用户设置该操作流程的安全等级；
(3)将设置结果保存至安全策略模块。
安全策略模块
图7是根据本公开实施例的安全策略模块确立操作流程安全等级的流程示意图，如图7所示，该流程步骤可包括：
(1)判断当前请求的操作流程是否加入了安全策略模块中，如果安全策略模块没有当前请求的操作流程的安全策略记录，就直接返回无安全等级标识。
(2)判断当前请求的操作流程，用户是否通过操作流程等级设置模块主动设置了安全等级，如果设置了，就返回用户设置的安全等级。
(3)对于用户没有主动设置安全等级的预置操作流程。通过安全策略模块智能学习算法来动态地确定操作流程的安全等级，并返回计算出的安全等级。
本实施例所述预置操作流程，可以是根据大数据用户统计分析，得出较常用的需要安全验证保护的操作流程。并且可以通过连接至云端安全策略服务器，实时更新本地终端系统中的预置操作流程，从而保证本地安全策略的时效性。
本实施例所述智能学习算法，简单的说，就是通过以下三种影响因子的加权平均计算得出操作流程的安全等级：操作流程状态因子(包括连续几次该操作流程验证未验证通过，付款流程中付款额度等)，时间因子(包括上次使用时间等)，操作环境因子(包括是否常用的网络环境，是否常用的客户识别模块(Subscriber Identification Module，简称为SIM)卡等)。计算公式为：
Figure PCTCN2017098408-appb-000001
其中Pi为第i个影响因子的权重，满足0<Pi<1，
Figure PCTCN2017098408-appb-000002
αi为第i个影响因子值，满足0≤αi≤1，其中i的取值集合例如为{1,2,3}，N为影响因子的个数，例如为3。此处举例说明一下影响因子是如何起作用的，(1)比如，当前用户处于支付界面，点击界面上的“付款”按钮，此时通过动态检测输入框中的付款金额，就会动态计算出操作流程状态因子的比重，当为小额付款时，会执行安全等级2的验证流程，当为大额付款时，会执行安全等级3的验证流程。(2)再比如，安全短信发送操作，在正常使用的情况下，会在用户点击发送按钮的时候执行安全等级1的验证流程，但是当检测到用户当前使用的SIM卡属于新的SIM卡时，会提高操 作环境因子的比重，执行安全等级2的验证流程。
本公开实施例提供了一种对于操作流程安全提供分级保护的方法，本地可预先配置安全分级策略或者通过连接至云端安全策略服务器，实时更新本地终端系统中的预置操作流程，可根据智能检测、用户设置等来动态决策当前操作的安全等级，从而采取相应等级的安全验证方式。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，本公开实施例的技术方案本质上或者说做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本公开实施例所述的方法。
本公开实施例还提供了一种验证处理装置，该装置设置为实现上述实施例及可选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件的组合、或者硬件的组合、或者软件和硬件的组合。尽管以下实施例所描述的装置可以以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图8是根据本公开实施例的验证处理装置的结构框图，如图8所示，该装置包括：
接收模块82，设置为：获取用于请求对应用发起的操作流程进行验证的请求信息；
获取模块84，连接至上述接收模块82，设置为：根据请求信息获取操作流程对应的安全等级；
处理模块86，连接至上述获取模块84，设置为：根据安全等级对操作流程进行验证处理。
可选地，接收模块82，还设置为：获取用于请求对应用发起的操作流程进行验证的第一请求信息，其中，第一请求信息携带有操作流程当前环境下对应的安全等级；或者，获取用于请求对应用发起的操作流程进行验证的第 二请求信息，其中，第二请求信息携带有应用发起的操作流程的标识信息。
可选地，获取模块84，还设置为：根据第二请求信息携带的标识信息获取应用发起的操作流程；判断当前环境下是否存在与操作流程对应的安全等级；在判断结果为是的情况下，获取操作流程对应的安全等级。
可选地，处理模块86，还设置为：根据安全等级确定与安全等级对应的安全验证序列；通过确定的安全验证序列验证输入的密令的合法性；在验证合法的情况下，确定操作流程合法。
图9是根据本公开实施例的可选验证处理装置的结构框图，如图9所示，该装置除包括图8所示的所有模块外，还可包括：
选择模块92，设置为：选择需要进行验证的操作流程；
确定模块94，连接至上述选择模块92，设置为：配置并保存操作流程的安全等级。
可选地，确定模块94，还设置为：本地配置并保存操作流程的安全等级；或者，通过网络侧配置并保存操作流程的安全等级。
需要说明的是，上述模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述模块以任意组合的形式分别位于不同的处理器中。
本公开的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，获取用于请求对应用发起的操作流程进行验证的请求信息；
S2，根据请求信息获取操作流程对应的安全等级；
S3，根据安全等级对操作流程进行验证处理。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：获取用于请求对应用发起的操作流程进行验证的请求信息包括：
S1，获取用于请求对应用发起的操作流程进行验证的第一请求信息，其中，第一请求信息携带有操作流程当前环境下对应的安全等级；或者
S2，获取用于请求对应用发起的操作流程进行验证的第二请求信息，其 中，第二请求信息携带有应用发起的操作流程的标识信息。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：在获取用于请求对应用发起的操作流程进行验证的第二请求信息的情况下，根据第二请求信息获取操作流程对应的安全等级包括：
S1，根据第二请求信息携带的标识信息获取应用发起的操作流程；
S2，判断当前环境下是否存在与操作流程对应的安全等级；
S3，在判断结果为是的情况下，获取操作流程对应的安全等级。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：根据安全等级对操作流程进行验证处理包括：
S1，根据安全等级确定与安全等级对应的安全验证序列；
S2，通过确定的安全验证序列验证输入的密令的合法性；
S3，在验证合法的情况下，确定操作流程合法。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：在获取用于请求对应用发起的操作流程进行验证的请求信息之前，还包括：
S1，选择需要进行验证的操作流程；
S2，配置并保存操作流程的安全等级。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：配置并保存操作流程的安全等级包括：
S1，本地配置并保存操作流程的安全等级；或者，
S2，通过网络侧配置并保存操作流程的安全等级。
可选地，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，处理器根据存储介质中已存储的程序代码执行：获取请求对应用发起的操作流程进行验证的请求信息；根据请求信息获取操作流程对应的安全等级；根据安全等级对操作流程进行验证处理。
可选地，处理器根据存储介质中已存储的程序代码执行：获取用于请求 对应用发起的操作流程进行验证的请求信息包括：获取用于请求对应用发起的操作流程进行验证的第一请求信息，其中，第一请求信息携带有操作流程当前环境下对应的安全等级；或者，获取用于请求对应用发起的操作流程进行验证的第二请求信息，其中，第二请求信息携带有应用发起的操作流程的标识信息。
可选地，处理器根据存储介质中已存储的程序代码执行：在获取用于请求对应用发起的操作流程进行验证的第二请求信息的情况下，根据第二请求信息获取操作流程对应的安全等级包括：根据第二请求信息携带的标识信息获取应用发起的操作流程；判断当前环境下是否存在与操作流程对应的安全等级；在判断结果为是的情况下，获取操作流程对应的安全等级。
可选地，处理器根据存储介质中已存储的程序代码执行：根据安全等级对操作流程进行验证处理包括：根据安全等级确定与安全等级对应的安全验证序列；通过确定的安全验证序列验证输入的密令的合法性；在验证合法的情况下，确定操作流程合法。
可选地，处理器根据存储介质中已存储的程序代码执行：在获取请求对应用发起的操作流程进行验证的请求信息之前，还包括：选择需要进行验证的操作流程；配置并保存操作流程的安全等级。
可选地，处理器根据存储介质中已存储的程序代码执行：配置并保存操作流程的安全等级包括：本地配置并保存操作流程的安全等级；或者，通过网络侧配置并保存操作流程的安全等级。
可选地，处理器根据存储介质中已存储的程序代码执行步骤流程的示例可以参考上述方法及装置实施例及可选实施方式中所描述的示例，在此不再赘述。
本公开实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述验证处理方法。
本领域的技术人员可以明白，上述的本公开实施例的模块或步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在 某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成不同集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本公开实施例不限制于任何特定的硬件和软件结合。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件、处理器等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
本领域的普通技术人员可以理解，可以对本申请的技术方案进行修改或者等同替换，而不脱离本申请技术方案的精神和范围。本申请的保护范围以权利要求所定义的范围为准。
工业实用性
通过本公开实施例，获取用于请求对应用发起的操作流程进行验证的请求信息；根据所述请求信息获取所述操作流程对应的安全等级；根据所述安全等级对所述操作流程进行验证处理。由于根据操作的安全等级对应用发起的操作进行验证处理，使得应用的不同操作可以采用相应等级的安全验证方式。因此，可以避免如果仅在应用程序启动时进行安全验证，则无法对该应用的某一个界面或者操作进行安全验证，以及避免如果验证的方式都是单一的安全验证方式，则没有一种安全分级策略；提高了对应用安全验证的精确度。

Claims (13)

  1. 一种验证处理方法，包括：
    获取用于请求对应用发起的操作流程进行验证的请求信息；
    根据所述请求信息获取所述操作流程对应的安全等级；
    根据所述安全等级对所述操作流程进行验证处理。
  2. 根据权利要求1所述的方法，获取用于请求对所述应用发起的操作流程进行验证的所述请求信息包括：
    获取用于请求对所述应用发起的操作流程进行验证的第一请求信息，其中，所述第一请求信息携带有所述操作流程当前环境下对应的安全等级；
    或者，
    获取用于请求对所述应用发起的操作流程进行验证的第二请求信息，其中，所述第二请求信息携带有所述应用发起的所述操作流程的标识信息。
  3. 根据权利要求2所述的方法，在获取用于请求对所述应用发起的操作流程进行验证的第二请求信息的情况下，根据所述第二请求信息获取所述操作流程对应的安全等级包括：
    根据所述第二请求信息携带的所述标识信息获取所述应用发起的操作流程；
    判断当前环境下是否存在与所述操作流程对应的安全等级；
    在判断结果为是的情况下，获取所述操作流程对应的安全等级。
  4. 根据权利要求1所述的方法，根据所述安全等级对所述操作流程进行验证处理包括：
    根据所述安全等级确定与所述安全等级对应的安全验证序列；
    通过确定的安全验证序列验证输入的密令的合法性；
    在验证合法的情况下，确定所述操作流程合法。
  5. 根据权利要求1至4中任一项所述的方法，在获取用于请求对所述应用发起的操作流程进行验证的所述请求信息之前，还包括：
    选择需要进行验证的所述操作流程；
    配置并保存所述操作流程的安全等级。
  6. 根据权利要求5所述的方法，配置并保存所述操作流程的安全等级包括：
    本地配置并保存所述操作流程的安全等级；或者，
    通过网络侧配置并保存所述操作流程的安全等级。
  7. 一种验证处理装置，包括：
    接收模块，设置为：获取用于请求对应用发起的操作流程进行验证的请求信息；
    获取模块，设置为：根据所述请求信息获取所述操作流程对应的安全等级；
    处理模块，设置为：根据所述安全等级对所述操作流程进行验证处理。
  8. 根据权利要求7所述的装置，所述接收模块，还设置为：获取用于请求对所述应用发起的操作流程进行验证的第一请求信息，其中，所述第一请求信息携带有所述操作流程当前环境下对应的安全等级；或者，获取用于请求对所述应用发起的操作流程进行验证的第二请求信息，其中，所述第二请求信息携带有所述应用发起的所述操作流程的标识信息。
  9. 根据权利要求8所述的装置，所述获取模块，还设置为：根据所述第二请求信息携带的所述标识信息获取所述应用发起的操作流程；判断当前环境下是否存在与所述操作流程对应的安全等级；在判断结果为是的情况下，获取所述操作流程对应的安全等级。
  10. 根据权利要求7所述的装置，所述处理模块，还设置为：根据所述安全等级确定与所述安全等级对应的安全验证序列；通过确定的安全验证序列验证输入的密令的合法性；在验证合法的情况下，确定所述操作流程合法。
  11. 根据权利要求7至10中任一项所述的装置，还包括：
    选择模块，设置为：选择需要进行验证的所述操作流程；
    确定模块，设置为：配置并保存所述操作流程的安全等级。
  12. 根据权利要求11所述的装置，所述确定模块，还设置为：本地配置并保存所述操作流程的安全等级；或者，通过网络侧配置并保存所述操作流程的安全等级。
  13. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现如权利要求1至6中任一权利要求所述的验证处理方法。
PCT/CN2017/098408 2017-03-16 2017-08-22 验证处理方法及装置 WO2018166142A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710157752.2A CN108629179A (zh) 2017-03-16 2017-03-16 验证处理方法及装置
CN201710157752.2 2017-03-16

Publications (1)

Publication Number Publication Date
WO2018166142A1 true WO2018166142A1 (zh) 2018-09-20

Family

ID=63522811

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/098408 WO2018166142A1 (zh) 2017-03-16 2017-08-22 验证处理方法及装置

Country Status (2)

Country Link
CN (1) CN108629179A (zh)
WO (1) WO2018166142A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111740938B (zh) * 2019-06-28 2022-12-02 北京京东尚科信息技术有限公司 信息处理方法、装置、客户端和服务器
CN110392058B (zh) * 2019-08-01 2021-09-03 中数智创科技有限公司 业务保护方法、系统及终端设备
CN111786936A (zh) * 2019-11-27 2020-10-16 北京沃东天骏信息技术有限公司 用于鉴权的方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102255913A (zh) * 2011-07-14 2011-11-23 北京百度网讯科技有限公司 一种用于基于验证安全等级提供语音验证码的方法与设备
CN102957682A (zh) * 2011-08-30 2013-03-06 北京百度网讯科技有限公司 一种用于基于验证安全等级提供图片验证码的方法与设备
CN105094996A (zh) * 2015-07-21 2015-11-25 电子科技大学 基于动态权限验证的Android系统安全增强方法及系统
CN105959317A (zh) * 2016-07-11 2016-09-21 深圳市金立通信设备有限公司 一种安全认证方法及终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102255913A (zh) * 2011-07-14 2011-11-23 北京百度网讯科技有限公司 一种用于基于验证安全等级提供语音验证码的方法与设备
CN102957682A (zh) * 2011-08-30 2013-03-06 北京百度网讯科技有限公司 一种用于基于验证安全等级提供图片验证码的方法与设备
CN105094996A (zh) * 2015-07-21 2015-11-25 电子科技大学 基于动态权限验证的Android系统安全增强方法及系统
CN105959317A (zh) * 2016-07-11 2016-09-21 深圳市金立通信设备有限公司 一种安全认证方法及终端

Also Published As

Publication number Publication date
CN108629179A (zh) 2018-10-09

Similar Documents

Publication Publication Date Title
US12058114B2 (en) Device identification scoring
US11270306B2 (en) Asset management method and apparatus, and electronic device
KR102396739B1 (ko) 자산 관리 방법 및 장치, 및 전자 디바이스
US10009327B2 (en) Technologies for secure storage and use of biometric authentication information
US9596232B2 (en) Managing sharing of wireless network login passwords
US8763077B2 (en) System and method for enforcing a policy for an authenticator device
US11277421B2 (en) Systems and methods for detecting and thwarting attacks on an IT environment
US20170214698A1 (en) Systems and methods for geolocation-based authentication and authorization
US11399045B2 (en) Detecting fraudulent logins
US11178136B2 (en) Systems and methods for data access control and account management
WO2019184122A1 (zh) 一种登录验证方法、装置、终端设备及存储介质
US10110578B1 (en) Source-inclusive credential verification
KR102118294B1 (ko) 무선 네트워크 유형 검출 방법과 장치, 및 전자 디바이스
US11438342B2 (en) Location-based identity authentication (LIA) system
CN106464502B (zh) 用于通信装置的认证的方法和系统
US9721087B1 (en) User authentication
WO2019214438A1 (zh) 一种射频卡功能调用方法及装置
WO2018166142A1 (zh) 验证处理方法及装置
US9560030B2 (en) Nodal random authentication
US20170032353A1 (en) Methods and systems for financial account access management

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17901297

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17901297

Country of ref document: EP

Kind code of ref document: A1