WO2019237950A1 - 安全验证方法和装置 - Google Patents

安全验证方法和装置 Download PDF

Info

Publication number
WO2019237950A1
WO2019237950A1 PCT/CN2019/089487 CN2019089487W WO2019237950A1 WO 2019237950 A1 WO2019237950 A1 WO 2019237950A1 CN 2019089487 W CN2019089487 W CN 2019089487W WO 2019237950 A1 WO2019237950 A1 WO 2019237950A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification
dynamic password
user
information
security verification
Prior art date
Application number
PCT/CN2019/089487
Other languages
English (en)
French (fr)
Inventor
彭展
季周
张晨
张燕锋
Original Assignee
京东数字科技控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京东数字科技控股有限公司 filed Critical 京东数字科技控股有限公司
Publication of WO2019237950A1 publication Critical patent/WO2019237950A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/385—Payment protocols; Details thereof using an alias or single-use codes

Definitions

  • the embodiments of the present application relate to the field of computer technology, and in particular, to a method and a device for security verification.
  • security verification can be applied to different systems, such as shopping systems, credit systems, and financial management systems. These systems usually call a risk control engine to determine whether to trigger user information verification. Moreover, the information verification logic and verification validity are usually completed by these systems according to their own needs. Therefore, the existing security verification methods usually cause a lot of repeated development and are not easy to maintain.
  • the embodiments of the present application provide a method and a device for security verification.
  • an embodiment of the present application provides a security verification method, which includes: receiving a security verification request, wherein the security verification request includes a user identifier and a category identifier of a sender of the security verification request; and forwarding the security verification request to The connected wind control terminal, so that the wind control terminal determines whether to perform information verification on the user indicated by the user identification based on the category identifier; in response to receiving the prompt message returned by the wind control terminal for instructing to perform information verification, based on The prompt information verifies the information of the user, generates the information verification result, and obtains the security verification result based on the information verification result.
  • the information verification includes dynamic password verification
  • the prompt information is information for instructing dynamic password verification
  • performing information verification on the user based on the prompt information includes: performing the following verification operation: generating a dynamic password, The generated dynamic password is sent to the user's client; the dynamic password sent by the client is received; it is determined whether the dynamic password sent by the client meets the preset conditions; if it is satisfied, the user is authenticated by the dynamic password; if the dynamic password sent by the client is If the password does not meet the preset conditions, the number of dynamic password verification failures is incremented to determine whether the current number of dynamic password verification failures is less than a preset value, and if it is less, the verification operation is continued.
  • verifying the information of the user based on the prompt information further includes: in response to determining that the dynamic password sent by the client does not meet a preset condition or the current number of dynamic password verification failures is not less than a preset value, determining that the user has not Pass dynamic password authentication.
  • the method after receiving prompt information for instructing information verification returned by the wind control terminal, the method further includes: setting corresponding identification information for the security verification request; and After the password is sent to the user's client, the method further includes: setting a corresponding dynamic password identifier for the generated dynamic password, forming the dynamic password and the dynamic password identifier into an information pair, and storing the information pair and the identification information in correspondence.
  • the preset conditions include: consistent with the last dynamic password sent to the client; and determining whether the dynamic password sent by the client meets the preset condition, including: determining whether the dynamic password sent by the client is the latest stored password.
  • the dynamic password in the information pair corresponding to the identification information is consistent. If they are the same, it is determined that the dynamic password sent by the user terminal meets a preset condition.
  • sending the generated dynamic password to the user terminal of the user includes: sending the generated dynamic password to the user terminal through a short message channel.
  • the above method before performing the verification operation for the first time, further includes: sending the address of the dynamic password verification page to the client, so that the client jumps to the dynamic password verification page based on the address for the user to verify the page through the dynamic password Send a dynamic password.
  • obtaining the security verification result based on the information verification result includes: if the information verification result is used to indicate that the user fails the information verification, generating a security verification result used to indicate that the user has failed the security verification.
  • obtaining the security verification result based on the information verification result further includes: if the information verification result is used to instruct the user to pass the information verification, sending the information verification result to the wind control terminal, so that The terminal further determines whether the user passes the security verification based on the category identification; and receives the security verification result returned by the risk control terminal.
  • the above method further includes: receiving the risk control terminal after determining that the user does not perform information verification, and determining whether the user passes the security verification based on the category identifier The returned security verification result.
  • the method further includes: returning the security verification result to the sender.
  • an embodiment of the present application provides a security verification device, which includes a receiving unit configured to receive a security verification request, wherein the security verification request includes a user identification and a category identifier of a sender of the security verification request;
  • the forwarding unit is configured to forward the security verification request to the connected wind control terminal, so that the wind control terminal determines whether to perform information verification on the user indicated by the user identification based on the category identifier;
  • the processing unit is configured to respond to receiving The prompt information that is returned to the wind control terminal and instructs to perform information verification, performs information verification on the user based on the prompt information, generates an information verification result, and obtains a security verification result based on the information verification result.
  • the information verification includes dynamic password verification
  • the prompt information is information for instructing dynamic password verification
  • the processing unit includes a first execution subunit configured to perform the following verification operation: generating a dynamic password, Send the generated dynamic password to the user's client; receive the dynamic password sent by the client; determine whether the dynamic password sent by the client meets the preset conditions; if it is satisfied, determine that the user has passed the dynamic password verification; the second execution subunit Is configured to increase the number of dynamic password verification failures if the dynamic password sent by the client does not meet the preset conditions, to determine whether the current number of dynamic password verification failures is less than the preset value, and if it is less, continue to perform the verification operation .
  • the processing unit further includes a determination subunit configured to determine that the user has failed the response in response to determining that the dynamic password sent by the client does not meet a preset condition or the current number of dynamic password verification failures is not less than a preset value. Dynamic password authentication.
  • the above device further includes: a first setting unit configured to identify identification information corresponding to the security verification request setting; and a storage unit configured to generate a dynamic password identification corresponding to the generated dynamic password setting,
  • the password and the dynamic password identifier form an information pair, and the information pair and the identification information are correspondingly stored.
  • the preset conditions include: consistent with the latest dynamic password sent to the client; and the first execution subunit is further configured to determine whether the dynamic password sent by the client corresponds to the latest stored identification information The dynamic passwords in the information pair are consistent. If they are consistent, it is determined that the dynamic password sent by the client meets a preset condition.
  • the first execution subunit is further configured to send the generated dynamic password to the user terminal through a short message channel.
  • the above device further includes: a first sending unit configured to send an address of the dynamic password verification page to the user terminal, so that the user terminal jumps to the dynamic password verification page based on the address for the user to pass dynamic password verification The page sends a dynamic password.
  • a first sending unit configured to send an address of the dynamic password verification page to the user terminal, so that the user terminal jumps to the dynamic password verification page based on the address for the user to pass dynamic password verification The page sends a dynamic password.
  • the processing unit further includes a generation subunit configured to generate a security verification result for indicating that the user fails the security verification if the information verification result is used to indicate that the user has failed the information verification.
  • the processing unit further includes: a sending subunit configured to send the information verification result to the wind control end if the information verification result is used to instruct the user to pass the information verification, so that the wind control end further Determine whether the user passes the security verification based on the category identification; receive the security verification result returned by the risk control terminal.
  • the above device further includes: a first receiving unit configured to receive a security verification result returned by the wind control end after determining that the user does not perform information verification and determining whether the user passes the security verification based on the category identifier.
  • the above device further includes: a second sending unit configured to return the security verification result to the sender.
  • an embodiment of the present application provides an electronic device.
  • the electronic device includes: one or more processors; a storage device on which one or more programs are stored; when the one or more programs are stored by the one
  • the execution by one or more processors causes the one or more processors to implement the method as described in any implementation of the first aspect.
  • an embodiment of the present application provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, implements the method as described in any implementation manner of the first aspect.
  • the security verification method and device receive a security verification request including a category identifier and a user identifier, and then forward the safety verification request to the connected risk control terminal, so that the risk control terminal determines whether to The user indicated by the user ID performs information verification. Then, in response to receiving the prompt message for instructing the information verification returned by the wind control terminal, the information verification is performed on the user to generate the information verification result, so as to obtain the security verification result based on the information verification result.
  • the security verification of the user is realized, and the interaction between the sender of the security verification request and the risk control end is avoided, so that the responsibility of the sender can be made single.
  • FIG. 1 is an exemplary system architecture diagram to which an embodiment of the present application can be applied;
  • FIG. 1 is an exemplary system architecture diagram to which an embodiment of the present application can be applied;
  • FIG. 2 is a flowchart of an embodiment of a security verification method according to the present application.
  • FIG. 3 is a schematic diagram of an application scenario of the security verification method according to the present application.
  • FIG. 4 is a flowchart of still another embodiment of a security verification method according to the present application.
  • FIG. 5 is a schematic structural diagram of an embodiment of a security verification device according to the present application.
  • FIG. 6 is a schematic structural diagram of a computer system suitable for implementing an electronic device according to an embodiment of the present application.
  • FIG. 1 illustrates an exemplary system architecture 100 to which an embodiment of a security verification method or a security verification device of the present application can be applied.
  • the system architecture 100 may include a requesting end 101, a management end 103, a wind control end 105, and networks 102 and 104.
  • the network 102 is used to provide a medium for a communication link between the requesting end 101 and the management end 103.
  • the network 104 is used to provide a medium for a communication link between the management end 103 and the risk control end 105.
  • the networks 102, 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, and so on.
  • the requesting end 101 can interact with the management end 103 through the network 102 to receive or send information and the like.
  • the requesting end 101 may be a terminal device or a server.
  • various communication client applications can be installed on the requesting terminal 101, such as a web browser application, a shopping application, a wealth management application, a credit application, a payment application, and so on.
  • the terminal device may be hardware or software.
  • the terminal device can be various electronic devices with a display screen, including but not limited to smart phones, tablet computers, e-book readers, laptop computers and desktop computers.
  • the terminal device is software, it can be installed in the electronic devices listed above. It can be implemented as multiple software or software modules (for example, to provide distributed services), or it can be implemented as a single software or software module. It is not specifically limited here.
  • the management end 103 may be a management server that provides various services.
  • the management server may process a security verification request sent by the requester 101 and obtain a processing result (for example, a security verification result).
  • the risk control terminal 105 may be a risk control server that provides various services.
  • the risk control server may receive a security verification request forwarded by the management terminal 103, analyze the security verification request, and process the processing result (such as Prompt information for instructing information verification is returned to the management terminal 103.
  • management terminal 103 and the risk control terminal 105 may be the same server or different servers.
  • the requesting end 101, the management end 103, and the risk control end 105 serving as the server may be hardware or software.
  • the requesting end 101, the management end 103, and the risk control end 105 are hardware, it can be implemented as a distributed server cluster composed of multiple servers, or as a single server.
  • the requesting end 101, the management end 103, and the risk control end 105 are software, they can be implemented as multiple software or software modules (for example, to provide distributed services), or can be implemented as a single software or software module. It is not specifically limited here.
  • the security verification method provided in the embodiment of the present application is generally executed by the management end 103. Accordingly, the security verification device is generally disposed in the management terminal 103.
  • the numbers of the requesting end, network, management end, and risk control end in FIG. 1 are only exemplary. According to the implementation requirements, there can be any number of requesting end, network, management end and risk control end.
  • the process 200 of the security verification method includes the following steps:
  • Step 201 Receive a security verification request.
  • an execution subject of the security verification method may receive the security verification request through a wired connection method or a wireless connection method.
  • the security verification request may include a user identification and a category identification of a sender (for example, the requester 101 shown in FIG. 1) of the security verification request.
  • the security verification request may be a security verification request sent by the sender to the execution subject in response to receiving a request from a user (for example, a payment request, a credit request, etc.).
  • a request from a user for example, a payment request, a credit request, etc.
  • the category of the sender may be, for example, a payment category
  • the category identifier of the sender may be, for example, a name or number of a payment category.
  • Step 202 Forward the security verification request to the connected risk control terminal.
  • the execution entity may forward the security verification request to the connected wind control terminal (for example, the wind control terminal 105 shown in FIG. 1), so that the wind control terminal It is determined whether to perform information verification on the user indicated by the user identifier based on the category identifier.
  • the information verification may include, for example, at least one of the following: dynamic password verification, payment password verification, fingerprint verification, and so on.
  • a dynamic password can be an unpredictable combination of random numbers generated according to a special algorithm. Each dynamic password can usually only be used once. It is currently widely used in application fields such as online banking, online games, telecommunications operators, e-commerce, and enterprises.
  • the risk control terminal may store, in advance, an inspection label corresponding to the category identifier.
  • the verification label can be used to indicate whether to add information verification to the target user.
  • the target user may be the user indicated by the user ID in the security verification request from the sender in the category indicated by the category ID.
  • the tag value of the above verification tag may include a first value for instructing to increase the information verification of the target user, and a second value for instructing not to increase the information verification of the target user.
  • the risk control end After receiving the security verification request forwarded by the execution body, the risk control end may first check whether the current tag value of the verification label corresponding to the category identifier in the security verification request is the first value.
  • the control end may determine to perform information verification on the user indicated by the user identification in the security verification request. At this time, the wind control end may send prompt information to the above-mentioned execution subject to instruct the information verification. If the current tag value of the verification tag is not the first value, the risk control end may determine that information verification is not performed on the user indicated by the user identification.
  • step 203 in response to receiving the prompt message indicating that information verification is returned from the wind control terminal, information verification is performed on the user, an information verification result is generated, and a security verification result is obtained based on the information verification result.
  • the above-mentioned execution subject may, in response to receiving the prompt message instructed to perform information verification returned by the wind control terminal, perform information verification on the user to generate an information verification result. Moreover, the above-mentioned execution subject may also obtain a security verification result based on the information verification result.
  • the above-mentioned execution subject may display to the user's client terminal an instruction for inputting the payment password Prompt message. Then, the execution body may, in response to receiving the payment password returned by the user terminal, compare the payment password previously associated with the user ID with the payment password returned by the user terminal. If the two payment passwords are the same, the above-mentioned execution subject may determine that the user is authenticated by the payment password.
  • the above-mentioned execution subject may generate an information verification result for instructing the user to pass the payment password verification, and may generate a verification result based on the information verification result
  • the security verification result used to indicate that the user passed the security verification. If the two payment passwords are inconsistent, the execution entity may determine that the user has not passed the payment password verification. At this time, the execution entity may generate an information verification result indicating that the user has not passed the payment password verification, and may then verify based on the information The result generates a security verification result indicating that the user has not passed the security verification.
  • the execution of the security verification method by the above-mentioned execution body can effectively reduce the dependence of the sender of the security verification request on the external system.
  • the sender only needs to rely on the above-mentioned execution subject, and does not need to rely on the risk control end, which can make the responsibility of the sender single.
  • the execution of the security verification method by the execution subject can also reduce the dependence of the risk control end on external systems.
  • the risk control terminal can avoid the dependence of the dynamic password authentication server, the payment password authentication server, and the fingerprint authentication server, so that the risk control terminal can only rely on the above-mentioned execution subject, which can reduce network interaction.
  • the execution of the security verification method by the above execution body can also effectively avoid problems such as redundant requests.
  • the prompt information used to instruct the information verification may be the prompt information used to instruct the dynamic password verification.
  • the execution body may perform the following verification operations: generate a dynamic password and send the generated dynamic password to the user terminal; receive the dynamic password sent by the user terminal; determine Whether the dynamic password sent by the user terminal meets a preset condition, and if it is satisfied, it is determined that the user to which the user terminal belongs passes the dynamic password verification. If the dynamic password sent by the client does not meet the preset conditions, the execution subject may increase the number of dynamic password verification failures to determine whether the current number of dynamic password verification failures is less than a preset value.
  • the subject can continue to perform the verification operation described above. If the dynamic password sent by the client does not meet the preset conditions or the current number of failed dynamic password verifications is not less than the preset value, the executing entity may determine that the user to which the client belongs belongs does not pass the dynamic password verification.
  • the preset condition may include, for example, that the preset condition is consistent with a dynamic password sent to the user terminal last time.
  • the above-mentioned preset conditions include that they are consistent with the last dynamic password sent to the user terminal, and may further include that the sending time is within a preset time period.
  • the preset time period may be a time period with a sending time of the last dynamic password sent to the user terminal as a starting time and a duration of a preset duration (for example, 60 seconds).
  • the number of failed dynamic password verifications corresponds to the security verification request received in step 201.
  • the initial value of the number of failed dynamic password verifications may be zero.
  • the above-mentioned execution body may send the generated dynamic password to the above-mentioned user terminal through a short message channel.
  • the execution subject may set corresponding identification information for the received security verification request.
  • different category identifiers can correspond to different first serial number generation algorithms.
  • the execution entity may generate a serial number by using the first serial number generation algorithm corresponding to the category identifier in the security verification request, and set the serial number as the identification information of the security verification request.
  • the execution body may also set a corresponding dynamic password identifier for the dynamic password.
  • the execution subject may form an information pair with the dynamic password and the dynamic password identification, and store the information pair with the identification information in correspondence.
  • the information pair and the identification information are stored correspondingly to the execution subject locally or to a data storage server connected to the execution subject.
  • different category identifiers may also correspond to different second serial number generation algorithms.
  • the execution body may generate a serial number by using the second serial number generation algorithm corresponding to the category identifier in the received security verification request, and set the serial number as the dynamic password identifier of the dynamic password.
  • each time the execution body verifies the dynamic password received from the user terminal may generate a corresponding verification record and store the verification record.
  • the verification record may include, but is not limited to, the dynamic password, the above identification information, a target information pair corresponding to the above identification information, a verification result, and the like.
  • the target information pair may be an information pair including a dynamic password that is compared with the dynamic password.
  • the verification result may include, for example, successful verification or failed verification.
  • the executing entity may determine whether the dynamic password sent by the client is the latest stored password. The dynamic password in the information pair corresponding to the above identification information is consistent. If they are the same, the execution subject may determine that the dynamic password sent by the client meets the preset condition.
  • the execution body may first send the address of the dynamic password verification page to the client, so that the client jumps to the dynamic based on the address.
  • Password verification page for users to send dynamic passwords through the dynamic password verification page.
  • the dynamic password verification page may be a page based on the HTML (HyperText Markup Language) 5 standard.
  • the above-mentioned execution subject may send the same dynamic password verification page address to the user end of the user indicated by the user ID in the security verification request.
  • the above-mentioned executive body can send a dynamic password to the user terminal through a unified short message channel. In this way, by adopting a unified dynamic password verification page and a unified short message channel, repeated development can be effectively avoided and maintenance can be facilitated.
  • the foregoing execution subject may return the security verification result to the sender of the security verification request.
  • FIG. 3 is a schematic diagram of an application scenario of the security verification method according to this embodiment.
  • a user's terminal device 301 can be installed with a shopping application, and the terminal device 301 can communicate with the payment server 302 that supports the shopping application.
  • the user may use the shopping application on the terminal device 301 for shopping, and the user may send a payment request to the payment server 302 by performing a preset payment operation during payment, where the payment request may include the user identification of the user.
  • the payment server 302 may send a security verification request to the connected management server 303, where the security verification request may include the user identifier and the category identifier of the payment server 302.
  • the management server 303 may forward the security verification request to the connected risk control server 304 in response to receiving the security verification request. Further, the risk control server 304 may respond to receiving the security verification request, determine whether to perform information verification on the user based on the category identifier, and return to the management server 303 for instructions after determining to perform information verification on the user. Prompt message for information verification. Then, the management server 303 may, in response to receiving the prompt information, perform information verification on the user and generate an information verification result, for example, an information verification result used to instruct the user to pass the information verification. Finally, the management server 303 may generate a security verification result for instructing the user to pass security verification in response to the information verification result being the information verification result for instructing the user to pass the information verification. In addition, the management server 303 may also return the security verification result to the payment server 302. In this way, the payment server 302 can return the payment result to the terminal device 301 based on the received security verification result.
  • the method provided by the foregoing embodiment of the present application receives a security verification request including a category identifier and a user identifier, and then forwards the safety verification request to the connected risk control terminal, so that the risk control terminal determines whether to the user based on the category identifier.
  • the user indicated by the identification performs information verification.
  • the information verification is performed on the user to generate the information verification result, so as to obtain the security verification result based on the information verification result.
  • the security verification of the user is realized, and the interaction between the sender of the security verification request and the risk control end is avoided, so that the responsibility of the sender can be made single.
  • FIG. 4 illustrates a process 400 of yet another embodiment of a security verification method.
  • the process 400 of the security verification method includes the following steps:
  • Step 401 Receive a security verification request.
  • an execution subject of the security verification method may receive the security verification request through a wired connection method or a wireless connection method.
  • the security verification request may include a user identification and a category identification of a sender (for example, the requester 101 shown in FIG. 1) of the security verification request.
  • Step 402 Forward the security verification request to the connected risk control terminal.
  • the execution entity may forward the security verification request to a connected wind control terminal (for example, the wind control terminal 105 shown in FIG. 1).
  • the wind control terminal may determine whether to perform information verification on the user indicated by the user identifier based on the category identifier. For a corresponding determination method, refer to related descriptions in the embodiment shown in FIG. 2, and details are not described herein again.
  • the information verification may include dynamic password verification.
  • a dynamic password can be an unpredictable combination of random numbers generated according to a special algorithm. Each dynamic password can usually only be used once. It is currently widely used in application fields such as online banking, online games, telecommunications operators, e-commerce, and enterprises.
  • the risk control end may further determine whether the user passes the security verification based on the category identifier.
  • the wind control terminal may locally store security verification instruction information corresponding to the category identifier, and the safety verification instruction information may be used to instruct the wind control terminal how to determine whether the user passes the security verification.
  • the security verification request may further include an IP (Internet Protocol) address of the user.
  • the security verification instruction information may include: if the IP address in the security verification request is consistent with the pre-stored IP address of the user, determining that the user passes the security verification; otherwise, determining that the user fails the security verification.
  • the security verification request may further include a face image of the user.
  • the security verification instruction information may include: if the face image in the security verification request matches a face image of the user stored in advance, determining that the user passes security verification; otherwise determining that the user fails the security verification.
  • the content of the security verification instruction information can be adjusted according to actual needs, and this embodiment does not limit this content in any way.
  • the wind control end may return to the above-mentioned execution subject a prompt message for instructing to perform dynamic password verification.
  • the subject may perform step 403.
  • the risk control end may return the corresponding security verification result to the execution subject.
  • the execution subject may perform step 405.
  • step 403 in response to receiving the prompt information indicating that the dynamic password verification is returned from the wind control terminal, the user is subjected to dynamic password verification, and an information verification result indicating whether the user passes the dynamic password verification is generated.
  • the above-mentioned execution subject may perform dynamic password verification on the user in response to receiving the prompt information for instructing dynamic password verification returned by the wind control terminal, and generate instructions for indicating whether the user passes the dynamic password. Verification information verification result. It should be noted that, for the dynamic password authentication method, reference may be made to related descriptions in the embodiment shown in FIG. 2, and details are not described herein again.
  • the execution subject may execute step 404. If the execution subject determines that the user has not passed the dynamic password verification, the information verification result generated by the execution subject may be used to indicate that the user has not passed the dynamic password verification. At this time, the execution subject may perform step 406.
  • Step 404 In response to the information verification result being used to instruct the user to pass dynamic password verification, the information verification result is sent to the wind control terminal.
  • the execution entity may send the information verification result to the wind control end, so that the wind control end is further determined based on the category identifier. Whether the above users pass security verification.
  • the risk control terminal can automatically determine whether the user passes security verification based on the category identifier after determining that the user is not checked for information.
  • the risk control end may determine whether the user passes the security verification based on the category identifier.
  • Step 405 Receive the security verification result returned by the wind control terminal.
  • the execution subject may receive the security verification result returned by the wind control terminal after executing step 402.
  • the above-mentioned execution subject may also receive the security verification result returned by the risk control terminal.
  • Step 406 In response to the information verification result being used to indicate that the user has failed the dynamic password verification, a security verification result used to indicate that the user has failed the security verification is generated.
  • the execution subject may determine that the user has not passed the security verification, and the execution subject may generate an application at this time.
  • the security verification result indicating that the above-mentioned user fails the security verification.
  • Step 407 Return the security verification result to the sender of the security verification request.
  • the execution subject may return the security verification result to the sender of the security verification request.
  • the process 400 of the security verification method in this embodiment highlights that after the security verification request is forwarded to the wind control end, the receiving wind control end determines that it is not correct.
  • the user performs information verification, and determines whether the user returns the security verification result after passing the security verification based on the category identification; and after generating the information verification result for instructing the user to pass the dynamic password verification, the information verification result is sent Steps to the wind control terminal, and then receiving the security verification result returned by the wind control terminal. Therefore, the solution described in this embodiment can implement diversified ways of obtaining security verification results, and can improve the effectiveness of the security verification results.
  • this application provides an embodiment of a security verification device.
  • the device embodiment corresponds to the method embodiment shown in FIG. 2.
  • the device may specifically Used in various electronic equipment.
  • the security verification apparatus 500 of this embodiment includes: a receiving unit 501 may be configured to receive a security verification request, wherein the security verification request may include a user identifier and a category identifier of a sender of the security verification request; a forwarding unit 502 may be configured to forward the security verification request to the connected wind control terminal, so that the wind control terminal determines whether to perform information verification on the user indicated by the user identification based on the category identifier; the processing unit 503 is configured to respond to receiving The prompt information returned by the wind control terminal for instructing the information verification is performed on the user based on the prompt information to generate an information verification result, and based on the information verification result, a security verification result is obtained.
  • a receiving unit 501 may be configured to receive a security verification request, wherein the security verification request may include a user identifier and a category identifier of a sender of the security verification request
  • a forwarding unit 502 may be configured to forward the security verification request to the connected wind control terminal, so that the wind control terminal
  • the specific processing of the receiving unit 501, the forwarding unit 502, and the processing unit 503 and the technical effects brought by them can refer to steps 201, 202, and 202 in the corresponding embodiment of FIG. 2, respectively.
  • the relevant description of step 203 is not repeated here.
  • the information verification may include dynamic password verification
  • the prompt information may be information for instructing dynamic password verification
  • the processing unit 503 may include: a first execution subunit (FIG. (Not shown in figure), and is configured to perform the following verification operations: generate a dynamic password, and send the generated dynamic password to the user's client; receive the dynamic password sent by the client; determine whether the dynamic password sent by the client meets a preset If the conditions are met, it is determined that the user passes the dynamic password verification; the second execution subunit (not shown in the figure) is configured to perform the number of dynamic password verification failures if the dynamic password sent by the client does not meet the preset conditions Increment operation to determine whether the current number of dynamic password verification failures is less than a preset value, and if it is less, the verification operation is continued.
  • a first execution subunit (FIG. (Not shown in figure)
  • the processing unit 503 may further include: a determining subunit (not shown in the figure) configured to respond to determining that the dynamic password sent by the user does not meet a preset condition or is currently The number of failed dynamic password verifications is not less than the preset value, and it is determined that the user fails the dynamic password verification.
  • a determining subunit (not shown in the figure) configured to respond to determining that the dynamic password sent by the user does not meet a preset condition or is currently The number of failed dynamic password verifications is not less than the preset value, and it is determined that the user fails the dynamic password verification.
  • the above device 500 may further include: a first setting unit (not shown in the figure) configured to identify identification information corresponding to a security verification request setting; and a storage unit (in the figure) (Not shown), configured to generate a dynamic password identifier corresponding to the generated dynamic password setting, form the dynamic password and the dynamic password identifier into an information pair, and store the information pair and the identification information in correspondence.
  • the preset conditions may include: consistent with the last dynamic password sent to the client; and the first execution subunit may be further configured to determine whether the dynamic password sent by the client is The dynamic password in the newly stored information pair corresponding to the identification information is consistent. If they are the same, it is determined that the dynamic password sent by the client meets a preset condition.
  • the first execution subunit may be further configured to: send the generated dynamic password to the user terminal through a short message channel.
  • the foregoing apparatus 500 may further include: a first sending unit (not shown in the figure) configured to send an address of a dynamic password verification page to the client, so that the client Jump to the dynamic password verification page based on the address for users to send dynamic passwords through the dynamic password verification page.
  • a first sending unit (not shown in the figure) configured to send an address of a dynamic password verification page to the client, so that the client Jump to the dynamic password verification page based on the address for users to send dynamic passwords through the dynamic password verification page.
  • the processing unit 503 may further include: a generating subunit (not shown in the figure) configured to, if the information verification result is used to indicate that the user fails the information verification, Generate a security verification result to indicate that the user failed security verification.
  • a generating subunit (not shown in the figure) configured to, if the information verification result is used to indicate that the user fails the information verification, Generate a security verification result to indicate that the user failed security verification.
  • the processing unit 503 may further include: a sending sub-unit (not shown in the figure) configured to, if the information verification result is used to instruct the user to pass the information verification, The information verification result is sent to the wind control terminal, so that the wind control terminal further determines whether the user passes the security verification based on the category identifier; and receives the security verification result returned by the wind control terminal.
  • a sending sub-unit (not shown in the figure) configured to, if the information verification result is used to instruct the user to pass the information verification, The information verification result is sent to the wind control terminal, so that the wind control terminal further determines whether the user passes the security verification based on the category identifier; and receives the security verification result returned by the wind control terminal.
  • the foregoing apparatus 500 may further include: a first receiving unit (not shown in the figure) configured to receive a risk control end that determines not to perform information verification on the user, and based on The category ID determines the security verification result returned after the user passed the security verification.
  • a first receiving unit (not shown in the figure) configured to receive a risk control end that determines not to perform information verification on the user, and based on The category ID determines the security verification result returned after the user passed the security verification.
  • the foregoing apparatus 500 may further include: a second sending unit (not shown in the figure) configured to return a security verification result to the sender.
  • a second sending unit (not shown in the figure) configured to return a security verification result to the sender.
  • the device provided by the foregoing embodiment of the present application receives a security verification request including a category identifier and a user identifier, and then forwards the security verification request to the connected risk control terminal, so that the risk control terminal determines whether to the user based on the category identifier
  • the user indicated by the identification performs information verification.
  • the information verification is performed on the user to generate the information verification result, so as to obtain the security verification result based on the information verification result.
  • the security verification of the user is realized, and the interaction between the sender of the security verification request and the risk control end is avoided, so that the responsibility of the sender can be made single.
  • FIG. 6 is a schematic structural diagram of a computer system 600 suitable for implementing an electronic device (such as the management terminal 103 shown in FIG. 1) in the embodiment of the present application.
  • the electronic device shown in FIG. 6 is only an example, and should not impose any limitation on the functions and scope of use of the embodiments of the present application.
  • the computer system 600 includes a central processing unit (CPU) 601, which can be loaded into a random access memory (RAM) 603 from a program stored in a read-only memory (ROM) 602 or from a storage portion 608. Instead, perform various appropriate actions and processes.
  • RAM random access memory
  • ROM read-only memory
  • various programs and data required for the operation of the system 600 are also stored.
  • the CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604.
  • An input / output (I / O) interface 605 is also connected to the bus 604.
  • the following components are connected to the I / O interface 605: an input portion 606 including a keyboard, a mouse, and the like; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage portion 608 including a hard disk and the like; a communication section 609 including a network interface card such as a LAN card, a modem, and the like.
  • the communication section 609 performs communication processing via a network such as the Internet.
  • the driver 610 is also connected to the I / O interface 605 as necessary.
  • a removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.
  • the process described above with reference to the flowchart may be implemented as a computer software program.
  • embodiments of the present disclosure include a computer program product including a computer program carried on a computer-readable medium, the computer program containing program code for performing a method shown in a flowchart.
  • the computer program may be downloaded and installed from a network through the communication section 609, and / or installed from a removable medium 611.
  • CPU central processing unit
  • the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the foregoing.
  • the computer-readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable Programming read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the foregoing.
  • a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in combination with an instruction execution system, apparatus, or device.
  • a computer-readable signal medium may include a data signal that is included in baseband or propagated as part of a carrier wave, and which carries computer-readable program code. Such a propagated data signal may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • the computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, and the computer-readable medium may send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device.
  • Program code embodied on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
  • Computer program code for performing the operations of this application may be written in one or more programming languages, or a combination thereof, including programming languages such as Java, Smalltalk, C ++, and also conventional Procedural programming language—such as "C" or a similar programming language.
  • the program code can be executed entirely on the user's computer, partly on the user's computer, as an independent software package, partly on the user's computer, partly on a remote computer, or entirely on a remote computer or server.
  • the remote computer can be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (such as through an Internet service provider) Internet connection).
  • LAN local area network
  • WAN wide area network
  • Internet service provider Internet service provider
  • each block in the flowchart or block diagram may represent a module, program segment, or part of code, which contains one or more of the logic functions used to implement the specified logic. Executable instructions.
  • the functions labeled in the blocks may also occur in a different order than those labeled in the drawings. For example, two blocks represented one after the other may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved.
  • each block in the block diagram or flowchart, and combinations of blocks in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with A combination of dedicated hardware and computer instructions.
  • the units described in the embodiments of the present application may be implemented by software or hardware.
  • the described unit may also be provided in a processor, for example, it may be described as: a processor includes a receiving unit, a forwarding unit, and a processing unit. Among them, the names of these units do not constitute a limitation on the unit itself in some cases.
  • the receiving unit may also be described as a “unit that receives a security verification request”.
  • the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or may exist separately without being assembled into the electronic device in.
  • the computer-readable medium carries one or more programs, and when the one or more programs are executed by an electronic device, the electronic device: receives a security verification request, where the security verification request may include a user identification and a security verification
  • the category identifier of the sender of the request forwards the security verification request to the connected wind control terminal, so that the wind control terminal determines whether to perform information verification on the user indicated by the user identification based on the category identification; in response to receiving the wind control terminal
  • the prompt information returned for instructing information verification is performed on the user based on the prompt information to generate an information verification result, and based on the information verification result, a security verification result is obtained.

Abstract

本申请实施例公开了安全验证方法和装置。该方法的一具体实施方式包括：接收安全验证请求，其中，安全验证请求包括用户标识和安全验证请求的发送方的类别标识；将安全验证请求转发至所连接的风控端，以使风控端基于类别标识确定是否对用户标识所指示的用户进行信息校验；响应于接收到风控端返回的用于指示进行信息校验的提示信息，基于提示信息对用户进行信息校验，生成信息校验结果，以及基于信息校验结果，得到安全验证结果。该实施方式实现了对用户的安全验证，而且避免了安全验证请求的发送方与风控端之间的交互，从而可以使该发送方的职责变得单一。

Description

安全验证方法和装置
本专利申请要求于2018年6月11日提交的、申请号为201810593528.2、申请人为北京京东金融科技控股有限公司、发明名称为“安全验证方法和装置”的中国专利申请的优先权，该申请的全文以引用的方式并入本申请中。
技术领域
本申请实施例涉及计算机技术领域，具体涉及安全验证方法和装置。
背景技术
目前，安全验证可以应用于不同的系统，例如购物类系统、信贷类系统、理财类系统等等。这些系统通常调用风控引擎来确定是否触发对用户的信息校验。而且，信息校验逻辑、验证有效性等通常是由这些系统按照自身需求去完成。因而现有的安全验证方法通常会造成大量的重复开发且不便于维护。
发明内容
本申请实施例提出了安全验证方法和装置。
第一方面，本申请实施例提供了一种安全验证方法，该方法包括：接收安全验证请求，其中，安全验证请求包括用户标识和安全验证请求的发送方的类别标识；将安全验证请求转发至所连接的风控端，以使风控端基于类别标识确定是否对用户标识所指示的用户进行信息校验；响应于接收到风控端返回的用于指示进行信息校验的提示信息，基于提示信息对用户进行信息校验，生成信息校验结果，以及基于信息校验结果，得到安全验证结果。
在一些实施例中，信息校验包括动态口令验证，提示信息是用于 指示进行动态口令验证的信息；以及基于提示信息对用户进行信息校验，包括：执行以下验证操作：生成动态口令，将所生成的动态口令发送至用户的用户端；接收用户端发送的动态口令；确定用户端发送的动态口令是否满足预设条件，若满足，则确定用户通过动态口令验证；如果用户端发送的动态口令不满足预设条件，则对动态口令验证失败次数进行递增操作，确定当前的动态口令验证失败次数是否小于预设值，若小于，则继续执行验证操作。
在一些实施例中，基于提示信息对用户进行信息校验，还包括：响应于确定用户端发送的动态口令不满足预设条件或当前的动态口令验证失败次数不小于预设值，确定用户未通过动态口令验证。
在一些实施例中，在响应于接收到风控端返回的用于指示进行信息校验的提示信息之后，上述方法还包括：为安全验证请求设置对应的标识信息；以及在将所生成的动态口令发送至用户的用户端之后，方法还包括：为所生成的动态口令设置对应的动态口令标识，将该动态口令和该动态口令标识组成信息对，以及将信息对和标识信息对应存储。
在一些实施例中，预设条件包括：与最近一次发送给用户端的动态口令一致；以及确定用户端发送的动态口令是否满足预设条件，包括：确定用户端发送的动态口令是否与最新存储的与标识信息对应的信息对中的动态口令一致，若一致，则确定用户端发送的动态口令满足预设条件。
在一些实施例中，将所生成的动态口令发送至用户的用户端，包括：通过短信通道将所生成的动态口令发送至用户端。
在一些实施例中，在首次执行验证操作之前，上述方法还包括：向用户端发送动态口令验证页面的地址，以使用户端基于地址跳转至动态口令验证页面，供用户通过动态口令验证页面发送动态口令。
在一些实施例中，基于信息校验结果，得到安全验证结果，包括：若信息校验结果用于指示用户未通过信息校验，则生成用于指示用户未通过安全验证的安全验证结果。
在一些实施例中，基于信息校验结果，得到安全验证结果，还包 括：若信息校验结果用于指示用户通过信息校验，则将信息校验结果发送至风控端，以使风控端进一步基于类别标识确定用户是否通过安全验证；接收风控端返回的安全验证结果。
在一些实施例中，在将安全验证请求转发至所连接的风控端之后，上述方法还包括：接收风控端在确定不对用户进行信息校验、以及基于类别标识确定用户是否通过安全验证后返回的安全验证结果。
在一些实施例中，上述方法还包括：将安全验证结果返回给发送方。
第二方面，本申请实施例提供了一种安全验证装置，该装置包括：接收单元，被配置成接收安全验证请求，其中，安全验证请求包括用户标识和安全验证请求的发送方的类别标识；转发单元，被配置成将安全验证请求转发至所连接的风控端，以使风控端基于类别标识确定是否对用户标识所指示的用户进行信息校验；处理单元，被配置成响应于接收到风控端返回的用于指示进行信息校验的提示信息，基于提示信息对用户进行信息校验，生成信息校验结果，以及基于信息校验结果，得到安全验证结果。
在一些实施例中，信息校验包括动态口令验证，提示信息是用于指示进行动态口令验证的信息；以及处理单元包括：第一执行子单元，被配置成执行以下验证操作：生成动态口令，将所生成的动态口令发送至用户的用户端；接收用户端发送的动态口令；确定用户端发送的动态口令是否满足预设条件，若满足，则确定用户通过动态口令验证；第二执行子单元，被配置成如果用户端发送的动态口令不满足预设条件，则对动态口令验证失败次数进行递增操作，确定当前的动态口令验证失败次数是否小于预设值，若小于，则继续执行验证操作。
在一些实施例中，处理单元还包括：确定子单元，被配置成响应于确定用户端发送的动态口令不满足预设条件或当前的动态口令验证失败次数不小于预设值，确定用户未通过动态口令验证。
在一些实施例中，上述装置还包括：第一设置单元，被配置成为安全验证请求设置对应的标识信息；以及存储单元，被配置成为所生成的动态口令设置对应的动态口令标识，将该动态口令和该动态口令 标识组成信息对，以及将信息对和标识信息对应存储。
在一些实施例中，预设条件包括：与最近一次发送给用户端的动态口令一致；以及第一执行子单元进一步被配置成：确定用户端发送的动态口令是否与最新存储的与标识信息对应的信息对中的动态口令一致，若一致，则确定用户端发送的动态口令满足预设条件。
在一些实施例中，第一执行子单元还进一步被配置成：通过短信通道将所生成的动态口令发送至用户端。
在一些实施例中，上述装置还包括：第一发送单元，被配置成向用户端发送动态口令验证页面的地址，以使用户端基于地址跳转至动态口令验证页面，供用户通过动态口令验证页面发送动态口令。
在一些实施例中，处理单元还包括：生成子单元，被配置成若信息校验结果用于指示用户未通过信息校验，则生成用于指示用户未通过安全验证的安全验证结果。
在一些实施例中，处理单元还包括：发送子单元，被配置成若信息校验结果用于指示用户通过信息校验，则将信息校验结果发送至风控端，以使风控端进一步基于类别标识确定用户是否通过安全验证；接收风控端返回的安全验证结果。
在一些实施例中，上述装置还包括：第一接收单元，被配置成接收风控端在确定不对用户进行信息校验、以及基于类别标识确定用户是否通过安全验证后返回的安全验证结果。
在一些实施例中，上述装置还包括：第二发送单元，被配置成将安全验证结果返回给发送方。
第三方面，本申请实施例提供了一种电子设备，该电子设备包括：一个或多个处理器；存储装置，其上存储有一个或多个程序；当该一个或多个程序被该一个或多个处理器执行，使得该一个或多个处理器实现如第一方面中任一实现方式描述的方法。
第四方面，本申请实施例提供了一种计算机可读介质，其上存储有计算机程序，该程序被处理器执行时实现如第一方面中任一实现方式描述的方法。
本申请实施例提供的安全验证方法和装置，通过接收包括类别标 识和用户标识的安全验证请求，之后将安全验证请求转发至所连接的风控端，以便风控端基于该类别标识确定是否对该用户标识所指示的用户进行信息校验。而后响应于接收到风控端返回的用于指示进行信息校验的提示信息，对用户进行信息校验，生成信息校验结果，以便基于信息校验结果得到安全验证结果。实现了对用户的安全验证，而且避免了安全验证请求的发送方与风控端之间的交互，从而可以使该发送方的职责变得单一。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1是本申请的一个实施例可以应用于其中的示例性系统架构图；
图2是根据本申请的安全验证方法的一个实施例的流程图；
图3是根据本申请的安全验证方法的一个应用场景的示意图；
图4是根据本申请的安全验证方法的又一个实施例的流程图；
图5是根据本申请的安全验证装置的一个实施例的结构示意图；
图6是适于用来实现本申请实施例的电子设备的计算机系统的结构示意图。
具体实施方式
下面结合附图和实施例对本申请作进一步的详细说明。可以理解的是，此处所描述的具体实施例仅仅用于解释相关发明，而非对该发明的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与有关发明相关的部分。
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。下面将参考附图并结合实施例来详细说明本申请。
图1示出了可以应用本申请的安全验证方法或安全验证装置的实施例的示例性系统架构100。
如图1所示，系统架构100可以包括请求端101，管理端103，风控端105和网络102、104。网络102用以在请求端101和管理端103之间提供通信链路的介质。网络104用以在管理端103和风控端105之间提供通信链路的介质。网络102、104可以包括各种连接类型，例如有线、无线通信链路或者光纤电缆等等。
请求端101可以通过网络102与管理端103交互，以接收或发送信息等。其中，请求端101可以是终端设备，也可以是服务器。当请求端101是终端设备时，请求端101上可以安装有各种通讯客户端应用，例如网络浏览器应用、购物类应用、理财类应用、信贷类应用、支付类应用等等。需要说明的是，终端设备可以是硬件，也可以是软件。当终端设备为硬件时，可以是具有显示屏的各种电子设备，包括但不限于智能手机、平板电脑、电子书阅读器、膝上型便携计算机和台式计算机等等。当终端设备为软件时，可以安装在上述所列举的电子设备中。其可以实现成多个软件或软件模块(例如用来提供分布式服务)，也可以实现成单个软件或软件模块。在此不做具体限定。
管理端103可以是提供各种服务的管理服务器，该管理服务器例如可以对请求端101发送的安全验证请求进行处理等，得到处理结果(例如安全验证结果)。
风控端105可以是提供各种服务的风控服务器，该风控服务器例如可以接收管理端103转发的安全验证请求，并对该安全验证请求进行分析等处理，以及将处理结果(例如用于指示进行信息校验的提示信息)返回给管理端103。
需要说明的是，管理端103和风控端105可以是同一个服务器，也可以是不同的服务器。
另外，作为服务器的请求端101、管理端103、风控端105可以是硬件，也可以是软件。当请求端101、管理端103、风控端105为硬件时，可以实现成多个服务器组成的分布式服务器集群，也可以实现成单个服务器。当请求端101、管理端103、风控端105为软件时，可以实现成多个软件或软件模块(例如用来提供分布式服务)，也可以实现成单个软件或软件模块。在此不做具体限定。
需要指出的是，本申请实施例所提供的安全验证方法一般由管理端103执行。相应地，安全验证装置一般设置于管理端103中。
应该理解，图1中的请求端、网络、管理端和风控端的数目仅仅是示意性的。根据实现需要，可以具有任意数目的请求端、网络、管理端和风控端。
继续参考图2，示出了根据本申请的安全验证方法的一个实施例的流程200。该安全验证方法的流程200，包括以下步骤：
步骤201，接收安全验证请求。
在本实施例中，安全验证方法的执行主体(例如图1所示的管理端103)可以通过有线连接方式或者无线连接方式接收安全验证请求。其中，安全验证请求可以包括用户标识和安全验证请求的发送方(例如图1所示的请求端101)的类别标识。
需要说明的是，上述安全验证请求可以是上述发送方响应于接收到用户的请求(例如支付请求、信贷请求等等)而向上述执行主体发送的安全验证请求。作为示例，假设上述发送方是用于提供支付能力的终端设备或服务器，那么上述发送方的类别例如可以是支付类别，上述发送方的类别标识例如可以是支付类别的名称或编号等。
步骤202，将安全验证请求转发至所连接的风控端。
在本实施例中，上述执行主体在接收到上述安全验证请求后，可以将上述安全验证请求转发至所连接的风控端(例如图1所示的风控端105)，以使风控端基于上述类别标识确定是否对上述用户标识所指示的用户进行信息校验。其中，信息校验例如可以包括以下至少一项：动态口令验证、支付密码验证、指纹验证等等。动态口令可以是根据专门的算法生成的不可预测的随机数字组合，每个动态口令通常只能使用一次，目前被广泛运用在网银、网游、电信运营商、电子商务、企业等应用领域。
需要说明的是，风控端本地例如可以预先存储有与上述类别标识对应的加验标签。该加验标签可以用于指示是否增加对目标用户的信息校验。其中，目标用户可以是来源于上述类别标识所指示的类别下的发送方的安全验证请求中的用户标识所指示的用户。另外，上述加 验标签的标签值可以包括用于指示增加对目标用户的信息校验的第一值，以及用于指示不增加对目标用户的信息校验的第二值。风控端在接收到上述执行主体转发的安全验证请求后，可以先查看该安全验证请求中的类别标识所对应的加验标签的当前标签值是否为第一值，若是第一值，则风控端可以确定对该安全验证请求中的用户标识所指示的用户进行信息校验，此时，风控端可以向上述执行主体发送用于指示进行信息校验的提示信息。若该加验标签的当前标签值不是第一值，则风控端可以确定不对该用户标识所指示的用户进行信息校验。
步骤203，响应于接收到风控端返回的用于指示进行信息校验的提示信息，对用户进行信息校验，生成信息校验结果，以及基于信息校验结果，得到安全验证结果。
在本实施例中，上述执行主体可以响应于接收到风控端返回的用于指示进行信息校验的提示信息，对用户进行信息校验，生成信息校验结果。而且，上述执行主体还可以基于信息校验结果，得到安全验证结果。
作为示例，对于在步骤201中接收到的安全验证请求中的用户标识所指示的用户，假设信息校验包括支付密码验证，上述执行主体可以向该用户的用户端展示用于指示输入支付密码的提示信息。而后上述执行主体可以响应于接收到上述用户端返回的支付密码，将该用户标识预先关联的支付密码与上述用户端返回的支付密码进行比较。如果这两个支付密码一致，则上述执行主体可以确定用户通过支付密码验证，此时上述执行主体可以生成用于指示用户通过支付密码验证的信息校验结果，而且可以基于该信息校验结果生成用于指示用户通过安全验证的安全验证结果。如果这两个支付密码不一致，则上述执行主体可以确定用户未通过支付密码验证，此时上述执行主体可以生成用于指示用户未通过支付密码验证的信息校验结果，进而可以基于该信息校验结果生成用于指示用户未通过安全验证的安全验证结果。
需要说明的是，通过上述执行主体来执行安全验证方法，可以有效地减少安全验证请求的发送方对外部系统的依赖。例如可以使该发送方只需依赖上述执行主体，而不需依赖风控端，可以使该发送方的 职责变得单一。另外，通过上述执行主体来执行安全验证方法，还可以减少风控端对外部系统的依赖。例如可以避免风控端对动态口令验证服务器、支付密码验证服务器、指纹验证服务器等的依赖，可以使风控端只需依赖上述执行主体，可以减少网络交互。此外，通过上述执行主体来执行安全验证方法，还可以有效地避免冗余请求等问题的出现。
在本实施例的一些可选的实现方式中，如果信息校验包括动态口令验证，则用于指示进行信息校验的提示信息可以是用于指示进行动态口令验证的提示信息。若上述执行主体从风控端接收到该提示信息，则上述执行主体可以执行以下验证操作：生成动态口令，将所生成的动态口令发送至上述用户端；接收上述用户端发送的动态口令；确定上述用户端发送的动态口令是否满足预设条件，若满足，则确定上述用户端所归属的用户通过动态口令验证。如果上述用户端发送的动态口令不满足上述预设条件，则上述执行主体可以对动态口令验证失败次数进行递增操作，确定当前的动态口令验证失败次数是否小于预设值，若小于，则上述执行主体可以继续执行上述验证操作。如果上述用户端发送的动态口令不满足上述预设条件或当前的动态口令验证失败次数不小于上述预设值，则上述执行主体可以确定上述用户端所归属的用户未通过动态口令验证。
其中，上述预设条件例如可以包括：与最近一次发送给上述用户端的动态口令一致。可选地，上述预设条件在包括与最近一次发送给上述用户端的动态口令一致的同时，还可以包括：发送时间处于预设时间段内。其中，预设时间段可以是以最近一次发送给上述用户端的动态口令的发送时间为起始时间、时长为预设时长(例如60秒)的时间段。另外，上述动态口令验证失败次数与在步骤201中接收到的安全验证请求相对应。上述动态口令验证失败次数的初始值可以是0。
在本实施例的一些可选的实现方式中，上述执行主体可以通过短信通道将所生成的动态口令发送至上述用户端。另外，上述执行主体在接收到用于指示进行信息校验的提示信息后，可以为接收到的安全验证请求设置对应的标识信息。实践中，不同的类别标识可以对应不 同的第一流水号生成算法。上述执行主体可以利用该安全验证请求中的类别标识所对应的第一流水号生成算法生成流水号，并将该流水号设置为该安全验证请求的标识信息。
此外，上述执行主体在将所生成的动态口令发送至上述用户端之后，上述执行主体还可以为该动态口令设置对应的动态口令标识。上述执行主体可以将该动态口令和该动态口令标识组成信息对，以及将该信息对和上述标识信息对应存储。例如将该信息对和上述标识信息对应存储至上述执行主体本地或上述执行主体所连接的数据存储用服务器。实践中，不同的类别标识还可以对应不同的第二流水号生成算法。上述执行主体可以利用接收到的安全验证请求中的类别标识所对应的第二流水号生成算法生成流水号，将该流水号设置为该动态口令的动态口令标识。
在本实施例的一些可选的实现方式中，上述执行主体每次对从上述用户端接收到的动态口令进行验证后，可以生成相应的验证记录，并对该验证记录进行存储。其中，该验证记录可以包括但不限于：该动态口令、上述标识信息、与上述标识信息对应的目标信息对、验证结果等等。其中，目标信息对可以是包括与该动态口令进行比较的动态口令的信息对。验证结果例如可以包括验证成功或验证失败。
在本实施例的一些可选的实现方式中，若上述预设条件包括与最近一次发送给所述用户端的动态口令一致，则上述执行主体可以确定上述用户端发送的动态口令是否与最新存储的与上述标识信息对应的信息对中的动态口令一致。若一致，则上述执行主体可以确定上述用户端发送的动态口令满足上述预设条件。
在本实施例的一些可选的实现方式中，上述执行主体在首次执行上述验证操作之前，可以先向上述用户端发送动态口令验证页面的地址，以使上述用户端基于该地址跳转至动态口令验证页面，供用户通过动态口令验证页面发送动态口令。需要说明的是，动态口令验证页面可以是基于HTML(HyperText Markup Language，超级文本标记语言)5标准的页面。实践中，对于来自不同类别的发送方的安全验证请求，上述执行主体可以向该安全验证请求中的用户标识所指示的用 户的用户端发送同一动态口令验证页面的地址。而且，上述执行主体可以通过统一的短信通道向该用户端发送动态口令。这样，通过采用统一的动态口令验证页面以及统一的短信通道，可以有效地避免重复开发，可以便于维护。
在本实施例的一些可选的实现方式中，上述执行主体可以将安全验证结果返回给安全验证请求的发送方。
继续参见图3，图3是根据本实施例的安全验证方法的应用场景的一个示意图。在图3的应用场景中，用户的终端设备301上可以安装有购物类应用，终端设备301可以与对该购物类应用提供支持的支付类服务器302通信连接。用户可以使用终端设备301上的购物类应用进行购物，在付款时用户可以通过执行预设付款操作来向支付类服务器302发送支付请求，其中，该支付请求可以包括上述用户的用户标识。而后，支付类服务器302可以响应于接收到该支付请求，向所连接的管理服务器303发送安全验证请求，其中，该安全验证请求可以包括上述用户标识和支付类服务器302的类别标识。接着，管理服务器303可以响应于接收到上述安全验证请求，将上述安全验证请求转发至所连接的风控服务器304。再接着，风控服务器304可以响应于接收到上述安全验证请求，基于上述类别标识确定是否对上述用户进行信息校验，以及在确定对上述用户进行信息校验后向管理服务器303返回用于指示进行信息校验的提示信息。然后，管理服务器303可以响应于接收到上述提示信息，对上述用户进行信息校验，生成信息校验结果，例如用于指示上述用户通过信息校验的信息校验结果。最后，管理服务器303可以响应于信息校验结果是用于指示上述用户通过信息校验的信息校验结果，生成用于指示上述用户通过安全验证的安全验证结果。此外，管理服务器303还可以将安全验证结果返回给支付类服务器302。这样，支付类服务器302可以基于接收到的安全验证结果，向终端设备301返回支付结果。
本申请的上述实施例提供的方法，通过接收包括类别标识和用户标识的安全验证请求，之后将安全验证请求转发至所连接的风控端，以便风控端基于该类别标识确定是否对该用户标识所指示的用户进行 信息校验。而后响应于接收到风控端返回的用于指示进行信息校验的提示信息，对用户进行信息校验，生成信息校验结果，以便基于信息校验结果得到安全验证结果。实现了对用户的安全验证，而且避免了安全验证请求的发送方与风控端之间的交互，从而可以使该发送方的职责变得单一。
进一步参考图4，其示出了安全验证方法的又一个实施例的流程400。该安全验证方法的流程400，包括以下步骤：
步骤401，接收安全验证请求。
在本实施例中，安全验证方法的执行主体(例如图1所示的管理端103)可以通过有线连接方式或者无线连接方式接收安全验证请求。其中，安全验证请求可以包括用户标识和安全验证请求的发送方(例如图1所示的请求端101)的类别标识。
步骤402，将安全验证请求转发至所连接的风控端。
在本实施例中，上述执行主体在接收到上述安全验证请求后，可以将上述安全验证请求转发至所连接的风控端(例如图1所示的风控端105)。其中，风控端可以基于上述类别标识确定是否对上述用户标识所指示的用户进行信息校验，相应的确定方法可参看图2所示实施例中的相关说明，在此不再赘述。需要说明的是，信息校验可以包括动态口令验证。动态口令可以是根据专门的算法生成的不可预测的随机数字组合，每个动态口令通常只能使用一次，目前被广泛运用在网银、网游、电信运营商、电子商务、企业等应用领域。
此外，风控端在确定不对上述用户进行信息校验时，还可以进一步基于上述类别标识确定上述用户是否通过安全验证。需要说明的是，风控端本地可以预先存储有与上述类别标识对应的安全验证指示信息，该安全验证指示信息可以用于指示风控端如何确定上述用户是否通过安全验证。
作为示例，上述安全验证请求还可以包括上述用户的IP(Internet Protocol，网络之间互连的协议)地址。上述安全验证指示信息可以包括：如果上述安全验证请求中的IP地址与预存的上述用户的IP地址一致，则确定上述用户通过安全验证；否则确定上述用户未通过安全 验证。
再例如，上述安全验证请求还可以包括上述用户的人脸图像。上述安全验证指示信息可以包括：如果上述安全验证请求中的人脸图像与预存的上述用户的人脸图像匹配，则确定上述用户通过安全验证；否则确定上述用户未通过安全验证。
需要指出的是，安全验证指示信息的内容是可以根据实际需要调整的，本实施例不对此方面内容做任何限定。
实践中，若风控端确定对上述用户进行信息校验，例如确定对上述用户进行动态口令验证，风控端可以向上述执行主体返回用于指示进行动态口令验证的提示信息，此时上述执行主体可以执行步骤403。此外，风控端在确定不对上述用户进行信息、以及基于上述类别标识确定上述用户是否通过安全验证后，可以向上述执行主体返回相应的安全验证结果，此时上述执行主体可以执行步骤405。
步骤403，响应于接收到风控端返回的用于指示进行动态口令验证的提示信息，对用户进行动态口令验证，生成用于指示用户是否通过动态口令验证的信息校验结果。
在本实施例中，上述执行主体可以响应于接收到风控端返回的用于指示进行动态口令验证的提示信息，而对上述用户进行动态口令验证，以及生成用于指示上述用户是否通过动态口令验证的信息校验结果。需要说明的是，对于动态口令验证方法，可参看图2所示实施例中的相关说明，在此不再赘述。
需要指出的是，若上述执行主体确定上述用户通过动态口令验证，则上述执行主体所生成的信息校验结果可以用于指示用户通过动态口令验证，此时上述执行主体可以执行步骤404。若上述执行主体确定上述用户未通过动态口令验证，则上述执行主体所生成的信息校验结果可以用于指示用户未通过动态口令验证，此时上述执行主体可以执行步骤406。
步骤404，响应于信息校验结果用于指示用户通过动态口令验证，将信息校验结果发送至风控端。
在本实施例中，响应于上述信息校验结果用于指示上述用户通过 动态口令验证，上述执行主体可以将上述信息校验结果发送至风控端，以使风控端进一步基于上述类别标识确定上述用户是否通过安全验证。
需要说明的是，风控端不仅可以在确定不对上述用户进行信息校验后，自动地基于上述类别标识确定上述用户是否通过安全验证。而且，风控端还可以在接收到上述执行主体发送的信息校验结果后，基于上述类别标识确定上述用户是否通过安全验证。
步骤405，接收风控端返回的安全验证结果。
在本实施例中，在风控端确定不对上述用户进行信息校验的情况下，上述执行主体在执行完步骤402后，可以接收风控端返回的安全验证结果。另外，上述执行主体在执行完步骤404后，也可以接收风控端返回的安全验证结果。
步骤406，响应于信息校验结果用于指示用户未通过动态口令验证，生成用于指示用户未通过安全验证的安全验证结果。
在本实施例中，若上述执行主体所生成的信息校验结果用于指示上述用户未通过动态口令验证，则上述执行主体可以确定上述用户未通过安全验证，此时上述执行主体便可以生成用于指示上述用户未通过安全验证的安全验证结果。
步骤407，将安全验证结果返回给安全验证请求的发送方。
在本实施例中，上述执行主体在执行完步骤405或步骤406后，可以将安全验证结果返回给上述安全验证请求的发送方。
从图4中可以看出，与图2对应的实施例相比，本实施例中的安全验证方法的流程400突出了在将安全验证请求转发至风控端后，接收风控端在确定不对用户进行信息校验、以及基于类别标识确定用户是否通过安全验证后返回的安全验证结果的步骤；以及在生成用于指示用户通过动态口令验证的信息校验结果后，将该信息校验结果发送至风控端，而后接收风控端返回的安全验证结果的步骤。由此，本实施例描述的方案可以实现安全验证结果的获取方式的多样性，而且可以提高安全验证结果的有效性。
进一步参考图5，作为对上述各图所示方法的实现，本申请提供 了一种安全验证装置的一个实施例，该装置实施例与图2所示的方法实施例相对应，该装置具体可以应用于各种电子设备中。
如图5所示，本实施例的安全验证装置500包括：接收单元501可以被配置成接收安全验证请求，其中，安全验证请求可以包括用户标识和安全验证请求的发送方的类别标识；转发单元502可以被配置成将安全验证请求转发至所连接的风控端，以使风控端基于类别标识确定是否对用户标识所指示的用户进行信息校验；处理单元503被配置成响应于接收到风控端返回的用于指示进行信息校验的提示信息，基于提示信息对用户进行信息校验，生成信息校验结果，以及基于信息校验结果，得到安全验证结果。
在本实施例中，安全验证装置500中：接收单元501、转发单元502和处理单元503的具体处理及其所带来的技术效果可分别参考图2对应实施例中的步骤201、步骤202和步骤203的相关说明，在此不再赘述。
在本实施例的一些可选的实现方式中，信息校验可以包括动态口令验证，提示信息可以是用于指示进行动态口令验证的信息；以及处理单元503可以包括：第一执行子单元(图中未示出)，被配置成执行以下验证操作：生成动态口令，将所生成的动态口令发送至用户的用户端；接收用户端发送的动态口令；确定用户端发送的动态口令是否满足预设条件，若满足，则确定用户通过动态口令验证；第二执行子单元(图中未示出)，被配置成如果用户端发送的动态口令不满足预设条件，则对动态口令验证失败次数进行递增操作，确定当前的动态口令验证失败次数是否小于预设值，若小于，则继续执行验证操作。
在本实施例的一些可选的实现方式中，处理单元503还可以包括：确定子单元(图中未示出)，被配置成响应于确定用户端发送的动态口令不满足预设条件或当前的动态口令验证失败次数不小于预设值，确定用户未通过动态口令验证。
在本实施例的一些可选的实现方式中，上述装置500还可以包括：第一设置单元(图中未示出)，被配置成为安全验证请求设置对应的标识信息；以及存储单元(图中未示出)，被配置成为所生成的动态口令 设置对应的动态口令标识，将该动态口令和该动态口令标识组成信息对，以及将信息对和标识信息对应存储。
在本实施例的一些可选的实现方式中，预设条件可以包括：与最近一次发送给用户端的动态口令一致；以及第一执行子单元可以进一步被配置成：确定用户端发送的动态口令是否与最新存储的与标识信息对应的信息对中的动态口令一致，若一致，则确定用户端发送的动态口令满足预设条件。
在本实施例的一些可选的实现方式中，第一执行子单元还可以进一步被配置成：通过短信通道将所生成的动态口令发送至用户端。
在本实施例的一些可选的实现方式中，上述装置500还可以包括：第一发送单元(图中未示出)，被配置成向用户端发送动态口令验证页面的地址，以使用户端基于地址跳转至动态口令验证页面，供用户通过动态口令验证页面发送动态口令。
在本实施例的一些可选的实现方式中，处理单元503还可以包括：生成子单元(图中未示出)，被配置成若信息校验结果用于指示用户未通过信息校验，则生成用于指示用户未通过安全验证的安全验证结果。
在本实施例的一些可选的实现方式中，处理单元503还可以包括：发送子单元(图中未示出)，被配置成若信息校验结果用于指示用户通过信息校验，则将信息校验结果发送至风控端，以使风控端进一步基于类别标识确定用户是否通过安全验证；接收风控端返回的安全验证结果。
在本实施例的一些可选的实现方式中，上述装置500还可以包括：第一接收单元(图中未示出)，被配置成接收风控端在确定不对用户进行信息校验、以及基于类别标识确定用户是否通过安全验证后返回的安全验证结果。
在本实施例的一些可选的实现方式中，上述装置500还可以包括：第二发送单元(图中未示出)，被配置成将安全验证结果返回给上述发送方。
本申请的上述实施例提供的装置，通过接收包括类别标识和用户标识的安全验证请求，之后将安全验证请求转发至所连接的风控端， 以便风控端基于该类别标识确定是否对该用户标识所指示的用户进行信息校验。而后响应于接收到风控端返回的用于指示进行信息校验的提示信息，对用户进行信息校验，生成信息校验结果，以便基于信息校验结果得到安全验证结果。实现了对用户的安全验证，而且避免了安全验证请求的发送方与风控端之间的交互，从而可以使该发送方的职责变得单一。
下面参考图6，其示出了适于用来实现本申请实施例的电子设备(例如图1所示的管理端103)的计算机系统600的结构示意图。图6示出的电子设备仅仅是一个示例，不应对本申请实施例的功能和使用范围带来任何限制。
如图6所示，计算机系统600包括中央处理单元(CPU)601，其可以根据存储在只读存储器(ROM)602中的程序或者从存储部分608加载到随机访问存储器(RAM)603中的程序而执行各种适当的动作和处理。在RAM 603中，还存储有系统600操作所需的各种程序和数据。CPU 601、ROM 602以及RAM 603通过总线604彼此相连。输入/输出(I/O)接口605也连接至总线604。
以下部件连接至I/O接口605：包括键盘、鼠标等的输入部分606；包括诸如阴极射线管(CRT)、液晶显示器(LCD)等以及扬声器等的输出部分607；包括硬盘等的存储部分608；以及包括诸如LAN卡、调制解调器等的网络接口卡的通信部分609。通信部分609经由诸如因特网的网络执行通信处理。驱动器610也根据需要连接至I/O接口605。可拆卸介质611，诸如磁盘、光盘、磁光盘、半导体存储器等等，根据需要安装在驱动器610上，以便于从其上读出的计算机程序根据需要被安装入存储部分608。
特别地，根据本公开的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本公开的实施例包括一种计算机程序产品，其包括承载在计算机可读介质上的计算机程序，该计算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信部分609从网络上被下载和安装，和/或从可拆卸介质611被安装。在该计算机程序被中央处理单元(CPU)601 执行时，执行本申请的系统中限定的上述功能。
需要说明的是，本申请所示的计算机可读介质可以是计算机可读信号介质或者计算机可读存储介质或者是上述两者的任意组合。计算机可读存储介质例如可以是——但不限于——电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。计算机可读存储介质的更具体的例子可以包括但不限于：具有一个或多个导线的电连接、便携式计算机磁盘、硬盘、随机访问存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑磁盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。在本申请中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。而在本申请中，计算机可读的信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了计算机可读的程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。计算机可读的信号介质还可以是计算机可读存储介质以外的任何计算机可读介质，该计算机可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。计算机可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于：无线、电线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言或其组合来编写用于执行本申请的操作的计算机程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、Smalltalk、C++，还包括常规的过程式程序设计语言—诸如”C”语言或类似的程序设计语言。程序代码可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络——包括局域网(LAN)或广域网(WAN)—连接到用户计算机，或者，可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。
附图中的流程图和框图，图示了按照本申请各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，上述模块、程序段、或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图或流程图中的每个方框、以及框图或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
描述于本申请实施例中所涉及到的单元可以通过软件的方式实现，也可以通过硬件的方式来实现。所描述的单元也可以设置在处理器中，例如，可以描述为：一种处理器包括接收单元、转发单元和处理单元。其中，这些单元的名称在某种情况下并不构成对该单元本身的限定，例如，接收单元还可以被描述为“接收安全验证请求的单元”。
作为另一方面，本申请还提供了一种计算机可读介质，该计算机可读介质可以是上述实施例中描述的电子设备中所包含的；也可以是单独存在，而未装配入该电子设备中。上述计算机可读介质承载有一个或者多个程序，当上述一个或者多个程序被一个该电子设备执行时，使得该电子设备：接收安全验证请求，其中，安全验证请求可以包括用户标识和安全验证请求的发送方的类别标识；将安全验证请求转发至所连接的风控端，以使风控端基于类别标识确定是否对用户标识所指示的用户进行信息校验；响应于接收到风控端返回的用于指示进行信息校验的提示信息，基于提示信息对用户进行信息校验，生成信息校验结果，以及基于信息校验结果，得到安全验证结果。
以上描述仅为本申请的较佳实施例以及对所运用技术原理的说明。本领域技术人员应当理解，本申请中所涉及的发明范围，并不限于上述技术特征的特定组合而成的技术方案，同时也应涵盖在不脱离上述发明构思的情况下，由上述技术特征或其等同特征进行任意组合 而形成的其它技术方案。例如上述特征与本申请中公开的(但不限于)具有类似功能的技术特征进行互相替换而形成的技术方案。

Claims (24)

  1. 一种安全验证方法，包括：
    接收安全验证请求，其中，所述安全验证请求包括用户标识和所述安全验证请求的发送方的类别标识；
    将所述安全验证请求转发至所连接的风控端，以使所述风控端基于所述类别标识确定是否对所述用户标识所指示的用户进行信息校验；
    响应于接收到所述风控端返回的用于指示进行信息校验的提示信息，基于所述提示信息对所述用户进行信息校验，生成信息校验结果，以及基于所述信息校验结果，得到安全验证结果。
  2. 根据权利要求1所述的方法，其中，信息校验包括动态口令验证，所述提示信息是用于指示进行动态口令验证的信息；以及
    所述基于所述提示信息对所述用户进行信息校验，包括：
    执行以下验证操作：生成动态口令，将所生成的动态口令发送至所述用户的用户端；接收所述用户端发送的动态口令；确定所述用户端发送的动态口令是否满足预设条件，若满足，则确定所述用户通过动态口令验证；
    如果所述用户端发送的动态口令不满足所述预设条件，则对动态口令验证失败次数进行递增操作，确定当前的动态口令验证失败次数是否小于预设值，若小于，则继续执行所述验证操作。
  3. 根据权利要求2所述的方法，其中，所述基于所述提示信息对所述用户进行信息校验，还包括：
    响应于确定所述用户端发送的动态口令不满足所述预设条件或当前的动态口令验证失败次数不小于所述预设值，确定所述用户未通过动态口令验证。
  4. 根据权利要求2所述的方法，其中，在所述响应于接收到所述 风控端返回的用于指示进行信息校验的提示信息之后，所述方法还包括：
    为所述安全验证请求设置对应的标识信息；以及
    在所述将所生成的动态口令发送至所述用户的用户端之后，所述方法还包括：
    为所生成的动态口令设置对应的动态口令标识，将该动态口令和该动态口令标识组成信息对，以及将所述信息对和所述标识信息对应存储。
  5. 根据权利要求4所述的方法，其中，所述预设条件包括：与最近一次发送给所述用户端的动态口令一致；以及
    所述确定所述用户端发送的动态口令是否满足预设条件，包括：
    确定所述用户端发送的动态口令是否与最新存储的与所述标识信息对应的信息对中的动态口令一致，若一致，则确定所述用户端发送的动态口令满足所述预设条件。
  6. 根据权利要求2所述的方法，其中，所述将所生成的动态口令发送至所述用户的用户端，包括：
    通过短信通道将所生成的动态口令发送至所述用户端。
  7. 根据权利要求2所述的方法，其中，在首次执行所述验证操作之前，所述方法还包括：
    向所述用户端发送动态口令验证页面的地址，以使所述用户端基于所述地址跳转至所述动态口令验证页面，供所述用户通过所述动态口令验证页面发送动态口令。
  8. 根据权利要求1所述的方法，其中，所述基于所述信息校验结果，得到安全验证结果，包括：
    若所述信息校验结果用于指示所述用户未通过信息校验，则生成用于指示所述用户未通过安全验证的安全验证结果。
  9. 根据权利要求1所述的方法，其中，所述基于所述信息校验结果，得到安全验证结果，包括：
    若所述信息校验结果用于指示所述用户通过信息校验，则将所述信息校验结果发送至所述风控端，以使所述风控端进一步基于所述类别标识确定所述用户是否通过安全验证；接收所述风控端返回的安全验证结果。
  10. 根据权利要求1所述的方法，其中，在所述将所述安全验证请求转发至所连接的风控端之后，所述方法还包括：
    接收所述风控端在确定不对所述用户进行信息校验、以及基于所述类别标识确定所述用户是否通过安全验证后返回的安全验证结果。
  11. 根据权利要求1-10之一所述的方法，其中，所述方法还包括：
    将安全验证结果返回给所述发送方。
  12. 一种安全验证装置，包括：
    接收单元，被配置成接收安全验证请求，其中，所述安全验证请求包括用户标识和所述安全验证请求的发送方的类别标识；
    转发单元，被配置成将所述安全验证请求转发至所连接的风控端，以使所述风控端基于所述类别标识确定是否对所述用户标识所指示的用户进行信息校验；
    处理单元，被配置成响应于接收到所述风控端返回的用于指示进行信息校验的提示信息，基于所述提示信息对所述用户进行信息校验，生成信息校验结果，以及基于所述信息校验结果，得到安全验证结果。
  13. 根据权利要求12所述的装置，其中，信息校验包括动态口令验证，所述提示信息是用于指示进行动态口令验证的信息；以及
    所述处理单元包括：
    第一执行子单元，被配置成执行以下验证操作：生成动态口令， 将所生成的动态口令发送至所述用户的用户端；接收所述用户端发送的动态口令；确定所述用户端发送的动态口令是否满足预设条件，若满足，则确定所述用户通过动态口令验证；
    第二执行子单元，被配置成如果所述用户端发送的动态口令不满足所述预设条件，则对动态口令验证失败次数进行递增操作，确定当前的动态口令验证失败次数是否小于预设值，若小于，则继续执行所述验证操作。
  14. 根据权利要求13所述的装置，其中，所述处理单元还包括：
    确定子单元，被配置成响应于确定所述用户端发送的动态口令不满足所述预设条件或当前的动态口令验证失败次数不小于所述预设值，确定所述用户未通过动态口令验证。
  15. 根据权利要求13所述的装置，其中，所述装置还包括：
    第一设置单元，被配置成为所述安全验证请求设置对应的标识信息；以及
    存储单元，被配置成为所生成的动态口令设置对应的动态口令标识，将该动态口令和该动态口令标识组成信息对，以及将所述信息对和所述标识信息对应存储。
  16. 根据权利要求15所述的装置，其中，所述预设条件包括：与最近一次发送给所述用户端的动态口令一致；以及
    所述第一执行子单元进一步被配置成：
    确定所述用户端发送的动态口令是否与最新存储的与所述标识信息对应的信息对中的动态口令一致，若一致，则确定所述用户端发送的动态口令满足所述预设条件。
  17. 根据权利要求13所述的装置，其中，所述第一执行子单元还进一步被配置成：
    通过短信通道将所生成的动态口令发送至所述用户端。
  18. 根据权利要求13所述的装置，其中，所述装置还包括：
    第一发送单元，被配置成向所述用户端发送动态口令验证页面的地址，以使所述用户端基于所述地址跳转至所述动态口令验证页面，供所述用户通过所述动态口令验证页面发送动态口令。
  19. 根据权利要求12所述的装置，其中，所述处理单元包括：
    生成子单元，被配置成若所述信息校验结果用于指示所述用户未通过信息校验，则生成用于指示所述用户未通过安全验证的安全验证结果。
  20. 根据权利要求12所述的装置，其中，所述处理单元包括：
    发送子单元，被配置成若所述信息校验结果用于指示所述用户通过信息校验，则将所述信息校验结果发送至所述风控端，以使所述风控端进一步基于所述类别标识确定所述用户是否通过安全验证；接收所述风控端返回的安全验证结果。
  21. 根据权利要求12所述的装置，其中，所述装置还包括：
    第一接收单元，被配置成接收所述风控端在确定不对所述用户进行信息校验、以及基于所述类别标识确定所述用户是否通过安全验证后返回的安全验证结果。
  22. 根据权利要求12-21之一所述的装置，其中，所述装置还包括：
    第二发送单元，被配置成将安全验证结果返回给所述发送方。
  23. 一种电子设备，包括：
    一个或多个处理器；
    存储装置，其上存储有一个或多个程序，
    当所述一个或多个程序被所述一个或多个处理器执行，使得所述 一个或多个处理器实现如权利要求1-11中任一所述的方法。
  24. 一种计算机可读介质，其上存储有计算机程序，其中，所述程序被处理器执行时实现如权利要求1-11中任一所述的方法。
PCT/CN2019/089487 2018-06-11 2019-05-31 安全验证方法和装置 WO2019237950A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810593528.2 2018-06-11
CN201810593528.2A CN108449186B (zh) 2018-06-11 2018-06-11 安全验证方法和装置

Publications (1)

Publication Number Publication Date
WO2019237950A1 true WO2019237950A1 (zh) 2019-12-19

Family

ID=63206945

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/089487 WO2019237950A1 (zh) 2018-06-11 2019-05-31 安全验证方法和装置

Country Status (2)

Country Link
CN (1) CN108449186B (zh)
WO (1) WO2019237950A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108449186B (zh) * 2018-06-11 2020-06-05 京东数字科技控股有限公司 安全验证方法和装置
CN110189452B (zh) * 2019-06-06 2022-07-12 广州小鹏汽车科技有限公司 车钥匙的接入处理方法、装置、系统及车辆
CN114817884A (zh) * 2020-03-25 2022-07-29 支付宝(杭州)信息技术有限公司 生物校验方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102147900A (zh) * 2011-03-14 2011-08-10 珠海飞讯科技有限公司 一种支付实现系统及方法
US20140025583A1 (en) * 2009-07-02 2014-01-23 Biometric Payment Solutions Electronic transaction verification system with biometric authentication
CN105933266A (zh) * 2015-08-20 2016-09-07 中国银联股份有限公司 一种验证方法及服务器
CN108449186A (zh) * 2018-06-11 2018-08-24 北京京东金融科技控股有限公司 安全验证方法和装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3213243B1 (en) * 2014-10-31 2020-09-09 Proofpoint, Inc. Systems and methods for privately performing application security analysis
CN106998315B (zh) * 2016-01-22 2020-04-28 阿里巴巴集团控股有限公司 一种注册认证的方法、装置及系统
CN107341384A (zh) * 2016-04-28 2017-11-10 苏宁云商集团股份有限公司 一种业务验证方法及系统
CN112769834B (zh) * 2016-08-30 2023-09-26 创新先进技术有限公司 身份验证系统、方法和平台
CN106845995B (zh) * 2017-01-19 2018-05-04 飞天诚信科技股份有限公司 一种蓝牙智能卡及其控制交易风险的方法
CN107395647A (zh) * 2017-09-05 2017-11-24 北京京东尚科信息技术有限公司 验证系统、方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140025583A1 (en) * 2009-07-02 2014-01-23 Biometric Payment Solutions Electronic transaction verification system with biometric authentication
CN102147900A (zh) * 2011-03-14 2011-08-10 珠海飞讯科技有限公司 一种支付实现系统及方法
CN105933266A (zh) * 2015-08-20 2016-09-07 中国银联股份有限公司 一种验证方法及服务器
CN108449186A (zh) * 2018-06-11 2018-08-24 北京京东金融科技控股有限公司 安全验证方法和装置

Also Published As

Publication number Publication date
CN108449186B (zh) 2020-06-05
CN108449186A (zh) 2018-08-24

Similar Documents

Publication Publication Date Title
US11762974B2 (en) Single sign-on solution using blockchain
US9699257B2 (en) Online business method, system and apparatus based on open application programming interface
US9378345B2 (en) Authentication using device ID
US8250627B2 (en) Transaction authorization
US8615794B1 (en) Methods and apparatus for increased security in issuing tokens
US8225387B2 (en) Method and system for access authentication
WO2019237950A1 (zh) 安全验证方法和装置
WO2015143855A1 (zh) 一种对数据资源进行访问的方法、装置和系统
CN112583834B (zh) 一种通过网关单点登录的方法和装置
US20220284072A1 (en) Methods and systems for providing authenticated one-click access to a customized user interaction-specific web page
CN111698312B (zh) 基于开放平台的业务处理方法、装置、设备和存储介质
US9830599B1 (en) Human interaction detection
CN110120952A (zh) 一种综合管理系统单点登录方法、装置、计算机设备以及存储介质
CN114584381A (zh) 基于网关的安全认证方法、装置、电子设备和存储介质
CN112383542B (zh) 一种用户登录的方法和系统、认证端以及用户端
CN114915462B (zh) 跨站请求伪造攻击防御方法及装置、电子设备及介质
US20230082711A1 (en) Efficient initiation of automated processes
CN114785560B (zh) 信息处理方法、装置、设备和介质
US20230379321A1 (en) Systems and methods for multi-stage, identity-based, digital authentication
TWI623895B (zh) 透過即時通訊完成下單委託之系統及其方法
TW201833848A (zh) 透過即時通訊進行交易時完成憑證申請之系統及其方法
CN117349821A (zh) 跨系统账户的关联管理方法、装置、设备、介质、程序产品
CN111832015A (zh) 异常请求识别方法、装置、系统、介质及电子设备
CN115834252A (zh) 一种服务访问方法及系统
CN114448715A (zh) 一种基于令牌的认证方法、装置、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19819444

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19819444

Country of ref document: EP

Kind code of ref document: A1