WO2021077825A1

WO2021077825A1 - Security authentication method and related apparatus

Info

Publication number: WO2021077825A1
Application number: PCT/CN2020/103594
Authority: WO
Inventors: 刘磊
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2019-10-25
Filing date: 2020-07-22
Publication date: 2021-04-29
Also published as: CN110795708A; TW202117567A

Abstract

A security authentication method and a related apparatus. The security authentication method comprises: a terminal device collecting a user behavior feature sequence (S102); the terminal device sending the user behavior feature sequence to a cloud server (S104); the cloud server performing anomaly detection on the user behavior feature sequence on the basis of an anomaly detection model, wherein the anomaly detection model is obtained through training based on a historical user behavior feature sequence of a user in at least one terminal device (S106); the cloud server sending an anomaly detection result of the anomaly detection model to the terminal device (S108); and the terminal device executing a security authentication process matching the anomaly detection result (S110).

Description

Safety authentication method and related device

Technical field

This document relates to the field of security technology, in particular to a security authentication method and related devices.

Background technique

Current terminal devices mainly adopt static security authentication methods, such as fingerprint authentication, facial authentication, and password authentication. In this way, static authentication information needs to be stored in the computer's memory and transmitted over the network, so there is a risk of being intercepted by Trojan horse programs or monitoring devices. In addition, this method also requires the user to cooperate with the operation. For example, password authentication requires the user to input password information, which is not convenient enough for the user, which affects the user experience.

In view of this, there is an urgent need for a more user-friendly and reliable security authentication method.

Summary of the invention

The purpose of the embodiments of this specification is to provide a safety authentication method and related devices, which can realize safety authentication more reliably and conveniently.

In order to achieve the above objectives, the embodiments of this specification are implemented as follows:

In a first aspect, a security authentication method is provided, including: a terminal device collects a user behavior characteristic sequence; the terminal device sends the user behavior characteristic sequence to a cloud server; the cloud server responds to the user behavior based on an anomaly detection model Feature sequence for anomaly detection, wherein the anomaly detection model is trained based on the user’s historical user behavior feature sequence in at least one terminal device; the cloud server sends the anomaly detection result of the anomaly detection model to the Terminal equipment; The terminal equipment executes a safety authentication process that matches the abnormality detection result.

In a second aspect, a security authentication method is provided, which includes: a terminal device collects a user behavior characteristic sequence; the terminal device sends the user behavior characteristic sequence to a cloud server, so that the cloud server performs a check on the user based on an anomaly detection model. The behavior feature sequence performs abnormality detection, and the abnormality detection result of the abnormality detection model is sent to the terminal device, wherein the abnormality detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device ; The terminal device executes a safety authentication process that matches the abnormality detection result.

In a third aspect, a security authentication method is provided, including: a cloud server obtains a user behavior characteristic sequence collected by a terminal device; the cloud server performs anomaly detection on the user behavior characteristic sequence based on an anomaly detection model, wherein the abnormality The detection model is trained based on the user’s historical user behavior feature sequence in at least one terminal device; the cloud server sends the abnormality detection result to the terminal device, so that the terminal device executes matching with the abnormality detection result Safety certification process.

In a fourth aspect, a security authentication device is provided, including:

Sequence collection module, based on terminal equipment to collect user behavior characteristic sequences;

A first sending module, which sends the user behavior characteristic sequence to a cloud server based on the terminal device;

An anomaly detection module, which performs anomaly detection on the user behavior feature sequence based on the cloud server based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device;

A second sending module, which sends the abnormality detection result of the abnormality detection model to the terminal device based on the cloud server;

The security authentication module executes a security authentication process matching the abnormal detection result based on the terminal device.

In a fifth aspect, a terminal device is provided, including:

Collection module, collect user behavior characteristic sequence;

The sending module sends the user behavior characteristic sequence to the cloud server, so that the cloud server performs anomaly detection on the user behavior characteristic sequence based on the anomaly detection model, and sends the abnormality detection result of the anomaly detection model to the A terminal device, wherein the anomaly detection model is obtained by training based on the historical user behavior feature sequence of the user in at least one terminal device;

The execution module executes the safety authentication process matching the abnormal detection result.

In a sixth aspect, a cloud server is provided, including:

The acquiring module acquires the user behavior characteristic sequence collected by the terminal device;

An anomaly detection module, which performs anomaly detection on the user behavior feature sequence based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device;

The sending module sends the abnormality detection result to the terminal device, so that the terminal device executes a safety authentication process matching the abnormality detection result.

In a seventh aspect, there is provided an electronic device including: a memory, a processor, and a computer program stored on the memory and running on the processor, the computer program being executed by the processor: collection based on terminal equipment User behavior feature sequence; based on the terminal device, the user behavior feature sequence is sent to a cloud server; based on the cloud server, anomaly detection is performed on the user behavior feature sequence based on an anomaly detection model, wherein the anomaly detection model is Based on the user’s historical user behavior feature sequence training in at least one terminal device; based on the cloud server sending the abnormality detection result of the abnormality detection model to the terminal device; based on the terminal device execution and the abnormality detection result Matching safety certification process.

In an eighth aspect, a computer-readable storage medium is provided, and a computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the following steps are implemented: collecting a user behavior characteristic sequence based on a terminal device; The terminal device sends the user behavior characteristic sequence to a cloud server; and performs anomaly detection on the user behavior characteristic sequence based on the cloud server based on an anomaly detection model, wherein the anomaly detection model is based on the user's presence in at least one terminal The device is obtained by training the historical user behavior feature sequence; based on the cloud server, the abnormality detection result of the abnormality detection model is sent to the terminal device; based on the terminal device, the security authentication process matching the abnormality detection result is executed.

Based on the solution of the embodiment of this specification, the terminal device collects the user behavior characteristic sequence during the use of the user, and uploads the user behavior characteristic sequence to the cloud server, and the cloud server trains the anomaly detection model. When the terminal device needs to authenticate the user safely, the cloud server performs anomaly detection on the current user behavior feature sequence based on the abnormality detection model, and feeds back the abnormality detection result to the terminal device, and the terminal device performs the matching with the abnormality detection result Safety certification process. Since the entire scheme uses a dynamic security authentication method, the authentication information changes over time, and even if it is leaked, the risk generated is low. In addition, anomaly detection can be performed without the user's perception, and will not affect the user's experience of using the terminal device.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of this specification or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some of the embodiments described in the embodiments of this specification. For those of ordinary skill in the art, other drawings can be obtained from these drawings without creative labor.

FIG. 1 is a schematic diagram of the first flow chart of the security authentication method provided by the embodiment of this specification.

FIG. 2 is a schematic diagram of the second flow of the security authentication method provided by the embodiment of this specification.

FIG. 3 is a schematic diagram of the third process of the security authentication method provided by the embodiment of this specification.

FIG. 4 is a schematic diagram of the fourth flow of the security authentication method provided by the embodiment of this specification.

FIG. 5 is a schematic diagram of the fifth flow of the security authentication method provided by the embodiment of this specification.

FIG. 6 is a schematic diagram of the structure of the security authentication device provided by the embodiment of this specification.

FIG. 7 is a schematic diagram of the structure of a terminal device provided by an embodiment of this specification.

FIG. 8 is a schematic diagram of the structure of the cloud server provided by the embodiment of this specification.

FIG. 9 is a schematic diagram of the structure of an electronic device provided by an embodiment of this specification.

Detailed ways

In order to enable those skilled in the art to better understand the technical solutions in this specification, the following will clearly and completely describe the technical solutions in the embodiments of this specification in conjunction with the drawings in the embodiments of this specification. Obviously, the described The embodiments are only a part of the embodiments in this specification, rather than all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this specification.

As mentioned earlier, current terminal devices mainly adopt static security authentication methods, such as fingerprint authentication, facial authentication, and password authentication. In this way, static authentication information needs to be transmitted in computer memory and the network, so there is a risk of being intercepted by Trojan horse programs or monitoring devices. In addition, this method also requires the user to cooperate with the operation. For example, fingerprint authentication requires the user to press the finger on the sensor, which is not convenient enough for the user, which affects the user experience.

In view of the above-mentioned problems, the embodiments of this specification aim to provide a safer authentication method that is more user-friendly and more reliable.

Fig. 1 is a flowchart of a safety authentication method according to an embodiment of this specification. The method shown in Figure 1 can be executed by the following corresponding devices, including:

Step S102: The terminal device collects the user behavior characteristic sequence.

Among them, the terminal device can include, but is not limited to, common user personal devices such as PCs, mobile phones, PADs, smart bracelets, and smart glasses. Obviously, this type of terminal equipment generally has the function of collecting user behavior characteristic sequences.

The user behavior characteristic sequence can reflect the habit characteristics of the user using the terminal device. As an exemplary introduction, the user behavior feature sequence may include, but is not limited to:

The user's dynamic motion trajectory sequence, for example, the user's usual walking pace, stride length, etc., are recognized by the gravity sensor, gyroscope sensor, etc. of the terminal device.

The user's dynamic touch sequence, such as the frequency and granularity of the user's touch on the screen of the terminal device, is recognized by the pressure sensor built into the terminal screen.

The user's dynamic application interaction sequence, for example, the user's usage habits and preferences for the application, can be obtained from the system log of the terminal device.

Step S104: The terminal device sends the user behavior characteristic sequence to the cloud server.

Among them, the terminal device can send the user behavior characteristic sequence to the cloud server based on any network standard (4G, 5G and other mobile networks), which is not specifically limited in the embodiment of this specification.

In addition, the user can also specify a target terminal device responsible for interacting with the cloud server. In this step, the terminal device may send the collected user behavior characteristic sequence to the target terminal device, and the target terminal device further forwards it to the cloud server.

Step S106: The cloud server performs anomaly detection on the user behavior feature sequence based on the anomaly detection model, and the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device.

Specifically, the terminal device sends an auxiliary authentication request to the cloud server during the resource processing process of the user. According to the auxiliary authentication request, the cloud server obtains the user behavior characteristic sequence within a predetermined period of time when the auxiliary authentication request is received, and inputs the user behavior characteristic sequence to the anomaly detection model.

It should be understood that the predetermined time period described here should be close to the time when the cloud server receives the auxiliary authentication request. That is to say, after the cloud server receives the auxiliary authentication request, it will determine the appearance from the acquired user behavior characteristic sequence. User behavior characteristic sequence. Of course, the predetermined time period may be the time after the cloud server receives the auxiliary authentication request, or it may be the time before the cloud server receives the auxiliary authentication request, which is not specifically limited in the embodiment of this specification.

In addition, the length of the predetermined time period can be flexibly set. For example, the time length of the predetermined time period is set according to the frequency with which user behavior characteristics are obtained from the terminal device. As an exemplary introduction, assuming that the cloud server obtains the user behavior characteristic sequence from the terminal device every 24 hours, the time length corresponding to the predetermined time period may be 24 hours. That is, when receiving the auxiliary authentication request initiated by the target terminal device, the cloud server determines the user behavior characteristic acquired in the last day as the current user behavior characteristic.

The anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device (the user can associate at least one terminal device to collect the user behavior feature sequence), and can compare the current user behavior feature sequence with the historical user behavior feature sequence , To determine whether an abnormality occurs. It should be noted that the implementation of the anomaly detection model is not unique, as long as it has a classification function, it can be applied to the solutions of the embodiments of this specification.

In step S108, the cloud server sends the abnormality detection result to the terminal device.

In this step, the cloud server can directly send the abnormality detection result to the terminal device. Alternatively, the cloud server may send the abnormality detection result to the target terminal device designated by the user, and the target terminal device further forwards the abnormality detection result to the aforementioned terminal device.

In step S110, the terminal device executes a safety authentication process matching the abnormality detection result.

Specifically, if the abnormality detection result indicates that there is no abnormality, the terminal device determines that the safety authentication is passed. If the abnormality detection result indicates abnormality, the terminal device determines that the safety authentication has not passed.

Or, if the abnormality detection result indicates abnormality, the terminal device initiates in-depth identity authentication to the user, such as biometric authentication, password authentication, USBKey authentication, etc. If the user of the terminal device fails the identity authentication, it is determined that the security authentication has not passed, otherwise it is determined Safety certification passed.

It can be known from the security authentication method shown in Figure 1 that based on the solution of the embodiment of this specification, the terminal device collects the user behavior characteristic sequence during the use of the user, and uploads the user behavior characteristic sequence to the cloud server, and the cloud server detects the abnormality model Conduct training. When the terminal device needs to authenticate the user safely, the cloud server performs anomaly detection on the current user behavior feature sequence based on the abnormality detection model, and feeds back the abnormality detection result to the terminal device, and the terminal device performs the matching with the abnormality detection result Safety certification process. Since the entire scheme uses a dynamic security authentication method, the authentication information changes over time, and even if it is leaked, the risk generated is low. In addition, anomaly detection can be performed without the user's perception, and will not affect the user's experience of using the terminal device.

The safety authentication method of the embodiment of this specification will be introduced in detail below.

The method of the embodiment of this specification aims to dynamically collect user behavior characteristic sequences through one or more terminal devices associated with the user, and based on the high-speed transmission capability of the network, analyze the user dynamic behavior in real time, and use artificial intelligence method to model and characterize User behavior attributes. If abnormal user behavior is found (inconsistent with the historically constructed user behavior attributes), a preset in-depth authentication process is initiated during the security authentication process.

Among them, the main process of the safety authentication method includes:

The terminal device periodically collects the user behavior characteristic sequence during the user's use according to the preset data synchronization rules, and sends the user behavior characteristic sequence to the cloud server.

Optionally, the message sent by the terminal device of the user behavior characteristic sequence not only carries the user behavior characteristic sequence, but also includes the collection time corresponding to the user behavior characteristic sequence, so as to conveniently indicate that the cloud server can collect based on the user behavior characteristic sequence. Time, to determine the appearance user behavior feature sequence, that is, the user behavior feature sequence within the preset time period described above.

After receiving the user behavior feature sequence, the cloud server adds the user behavior feature sequence as training data to the training data set, and when the training condition is triggered, trains the anomaly detection model based on the training data in the training data set.

Wherein, the training condition trigger may include but is not limited to at least one of the following:

Reach the preset training cycle of anomaly detection model. That is, the cloud server may periodically use the training data in the training data set to train the anomaly detection model.

The training data set reaches a preset threshold relative to the incremental training data of the last training anomaly detection model. That is, when the cloud server accumulates a certain amount of new training data in the training data set, it uses the training data in the training data set to train the anomaly detection model.

Obviously, based on the above training conditions, the cloud server can iteratively update the abnormal model in real time to dynamically portray user behavior attributes, which is also the basis for realizing dynamic authentication.

In the specific training process, the cloud server can use the user behavior feature sequence as the input of the anomaly detection model, and the user identification of the user as the output of the anomaly detection model to train the anomaly detection model. In the actual application after the training is completed, the current user behavior feature sequence collected by the terminal device can be input into the anomaly detection model. If the anomaly detection model does not output the user identification used in the original training process, it means that there is an abnormality; otherwise, it means that there is no abnormality.

Alternatively, the cloud server may simultaneously use the user behavior feature sequence and the corresponding user identification as the input of the anomaly detection model, and use the specified anomaly detection result as the output of the anomaly detection model to train the anomaly detection model. In the actual application after the training is completed, the current user behavior feature sequence collected by the terminal device and the corresponding user identification can be input into the anomaly detection model. If the anomaly detection model does not output the specified anomaly detection result used in the original training process, it means that there is an abnormality; otherwise, it means that there is no abnormality.

The above is the process of dynamic training of the anomaly detection model by the cloud server through the user behavior feature sequence uploaded by the terminal device. At the same time, if the terminal device needs to initiate security verification for the user, it can send an auxiliary authentication request to the cloud server.

After receiving the auxiliary authentication request, the cloud server determines the predetermined time period associated with the auxiliary authentication request time, and inputs the user behavior characteristic sequence obtained from the terminal device and belonging to the predetermined time period into the anomaly detection model, so that the anomaly detection model Perform anomaly detection on current user behavior characteristics.

After that, the cloud server feeds back the anomaly detection result of the anomaly detection model to the terminal device.

If the abnormality detection result indicates abnormality, it means that the current user behavior of the terminal device does not match the historical user behavior attributes portrayed by the model, and may not be a legitimate user. At this time, the terminal device can determine that the security authentication has failed, or further initiate in-depth identity authentication. If the abnormality detection result indicates that there is no abnormality, the terminal device determines that the safety authentication is passed.

In the following, in combination with different application scenarios, the method of the embodiment of this specification will be exemplarily introduced.

Application scenario one

In application scenario 1, the terminal device will perform security verification on the user when the user performs screen unlocking. As shown in Figure 2, the corresponding method flow includes:

Based on multi-dimensional sensors, the terminal device collects the strength distribution characteristics of the user's handheld terminal device (that is, the user behavior characteristic sequence described above), and sends the strength distribution characteristics to the cloud server.

The cloud server uses historically acquired strength distribution characteristics of the user's handheld terminal device as training data to train the anomaly detection model so that the anomaly detection model portrays the habitual attributes of the user's handheld terminal device.

When the user unlocks the terminal device, the terminal device collects the strength distribution characteristics of the handheld terminal device during the user's current unlocking process, and sends the strength distribution characteristics of the handheld terminal device during the user's current unlocking process to the cloud server through an auxiliary authentication request.

The cloud server inputs the strength distribution characteristics of the handheld terminal device during the user's current unlocking process carried in the auxiliary authentication request to the anomaly detection model to perform anomaly detection on the strength distribution characteristics of the handheld terminal device during the user's current unlocking process.

After that, the cloud server feeds back the abnormality detection result to the terminal device, and the terminal device initiates an appropriate security authentication process based on the abnormality detection result. For example, when the abnormality detection result indicates an abnormality, the terminal device initiates in-depth identity authentication, such as gesture unlock authentication, fingerprint unlock authentication, password unlock authentication, and so on. If the abnormality detection result indicates that there is no abnormality, the terminal device sends a judgment that the security authentication is passed and directly unlocks the screen.

In this application scenario 1, the cloud server determines that the legitimate user does not need to perform any specific operations, and can quickly unlock the terminal device, thereby obtaining a better user experience. For the cloud server to determine an illegal user, it is necessary to unlock the screen of the terminal device based on conventional unlock authentication. This process does not need to introduce additional user operations and will not affect the user experience.

Application scenario two

In the second application scenario, there are payment applications for the terminal device security. When the user of the terminal device uses the payment application for resource processing (such as transfer, expenditure, etc.), the payment application controls the terminal device to initiate security verification. As shown in Figure 3, the corresponding method flow includes:

According to preset data synchronization rules, the terminal device periodically collects the user behavior characteristic sequence in the resource processing process when the user uses the payment application, and sends the user behavior characteristic sequence to the cloud server. Among them, if the terminal device is a PC, the user behavior characteristic sequence may include, but is not limited to, characteristics such as the intensity distribution of the keyboard stroke, the mouse click behavior, and the mouse click law. If the terminal device is a mobile device, the user behavior feature sequence can include, but is not limited to: the intensity distribution of the user’s fingertip interaction with the mobile device, the click behavior pattern and other characteristics, and can also further include: mobile device sensors (gravity sensors, angular velocity Sensors, temperature sensors) some basic features collected.

The cloud server uses the user behavior feature sequence in the resource processing process as training data to train the anomaly detection model when the user uses the payment application obtained in the history, so that the anomaly detection model describes the user's habit of using the payment application for resource processing .

When the user uses the payment application of the terminal device for resource processing, the payment application controls the terminal device and initiates an auxiliary authentication request to its cloud server.

After receiving the auxiliary authentication request, the cloud server determines the predetermined time period associated with the auxiliary authentication request time, and uses the user behavior characteristic sequence belonging to the predetermined time period as the current user behavior characteristic sequence. After that, the cloud server inputs the current user behavior feature sequence into the anomaly detection model to perform anomaly detection on the user.

The cloud server feeds back the abnormality detection result to the terminal device. If the abnormality detection result indicates an abnormality, the payment application initiates the deep identity authentication configured by the terminal device, such as fingerprint authentication and password authentication. If the abnormality detection result indicates that there is no abnormality, the payment application determines that the security authentication is passed and the user is allowed to perform resource processing operations.

The above is an introduction to the method of the embodiment of this specification. It should be understood that appropriate changes can be made without departing from the foregoing principles herein, and these changes should also be regarded as the protection scope of the embodiments of this specification.

Fig. 4 is a schematic flowchart of the security verification method on the terminal device side of the embodiment of this specification, including:

Step S402, the terminal device collects the user behavior characteristic sequence.

In step S404, the terminal device sends the user behavior characteristic sequence to the cloud server, so that the cloud server performs anomaly detection on the user behavior characteristic sequence based on the anomaly detection model, and sends the anomaly detection result of the anomaly detection model to the terminal device. The anomaly detection model is based on Obtained by the user's historical user behavior feature sequence training in at least one terminal device.

In step S406, the terminal device executes a safety authentication process matching the abnormality detection result.

Based on the security authentication method shown in Figure 4, the terminal device collects the user behavior characteristic sequence during the user's use, and uploads the user behavior characteristic sequence to the cloud server, and the cloud server trains the anomaly detection model. When security authentication is required, the terminal device requests the cloud server to perform anomaly detection on the current user behavior characteristic sequence based on the anomaly detection model, and feeds back the anomaly detection result to the terminal device, and the terminal device performs security matching the anomaly detection result Certification process. Since the entire scheme uses a dynamic security authentication method, the risk of leakage of authentication information is low. In addition, anomaly detection can be performed without the user's perception, and will not affect the user's experience of using the terminal device.

Figure 5 is a schematic flow diagram of the security verification method on the cloud server side of the embodiment of this specification, including:

Step S502: The cloud server obtains the user behavior characteristic sequence collected by the terminal device.

Step S504: The cloud server performs anomaly detection on the user behavior feature sequence based on the anomaly detection model. The anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device.

In step S506, the cloud server sends the abnormality detection result to the terminal device, so that the terminal device executes a security authentication process matching the abnormality detection result.

Based on the security authentication method shown in FIG. 5, the cloud server uses the user behavior feature sequence collected by the terminal device during the use of the user to train the anomaly detection model, so that the anomaly detection model characterizes the user's user behavior attributes. When the terminal device needs to perform security authentication, the cloud server performs abnormality detection on the current user behavior characteristic sequence based on the abnormality detection model, and feeds back the abnormality detection result to the terminal device, and the terminal device performs the security authentication that matches the abnormality detection result Process. Since the entire scheme uses a dynamic security authentication method, the risk of leakage of authentication information is low. In addition, anomaly detection can be performed without the user's perception, and will not affect the user's experience of using the terminal device.

Fig. 6 is a safety authentication device 600 according to an embodiment of the present specification, including:

The sequence collection module 610 collects user behavior characteristic sequences based on the terminal device.

The first sending module 620 sends the user behavior characteristic sequence to the cloud server based on the terminal device.

An anomaly detection module 630 performs anomaly detection on the user behavior feature sequence based on the cloud server based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device .

The second sending module 640 sends the abnormality detection result of the abnormality detection model to the terminal device based on the cloud server.

The safety authentication module 650 executes a safety authentication process matching the abnormal detection result based on the terminal device.

It can be known from the security authentication device shown in FIG. 6 that based on the solution of the embodiment of this specification, the terminal device collects the user behavior characteristic sequence during the use of the user, and uploads the user behavior characteristic sequence to the cloud server, and the cloud server detects the abnormality model Conduct training. When the terminal device needs to authenticate the user safely, the cloud server performs anomaly detection on the current user behavior feature sequence based on the abnormality detection model, and feeds back the abnormality detection result to the terminal device, and the terminal device performs the matching with the abnormality detection result Safety certification process. Since the entire scheme uses a dynamic security authentication method, the risk of leakage of authentication information is low. In addition, anomaly detection can be performed without the user's perception, and will not affect the user's experience of using the terminal device.

Optionally, when the sequence collection module 610 is executed, it specifically collects the user behavior characteristic sequence of the user in the resource processing process, wherein the resource processing process requires security authentication.

Optionally, the safety authentication device in the embodiment of this specification further includes:

The auxiliary authentication request module sends an auxiliary authentication request to the cloud server during the resource processing process of the user. Wherein, the cloud server obtains the user behavior characteristic sequence within a predetermined time period at the moment when the auxiliary authentication request is received according to the auxiliary authentication request, and inputs the user behavior characteristic sequence within the predetermined time period into the anomaly detection model to perform abnormal detection.

Optionally, the terminal device is installed with a payment application, the cloud server is a cloud server of the payment application, and the auxiliary authentication request is that the payment application controls the terminal device when the user uses the payment application for payment processing Initiated.

Optionally, when the security authentication module 650 is specifically executed, if the abnormality detection result indicates that there is no abnormality, the terminal device determines that the security authentication is passed, otherwise, identity authentication is initiated to the user of the terminal device. If the identity authentication of the terminal device includes at least one of the following:

Optionally, the identity authentication includes at least one of the following: the biometric authentication, password authentication, and USBKey authentication.

Optionally, the user behavior characteristic sequence includes at least one of the following: a user dynamic motion trajectory sequence, a user dynamic positioning trajectory sequence, a user dynamic touch sequence, and a user dynamic application interaction sequence.

Obviously, the security authentication device of the embodiment of the present specification can be used as the execution subject of the security authentication method shown in FIG. 1 above, and therefore can realize the functions implemented by the security authentication method in FIG. 1. Since the principle is the same, this article will not repeat them.

FIG. 7 is a schematic structural diagram of a terminal device 700 according to an embodiment of the present specification, including:

The collection module 710 collects the user behavior characteristic sequence.

The sending module 720 sends the user behavior feature sequence to the cloud server, so that the cloud server performs anomaly detection on the user behavior feature sequence based on the anomaly detection model, and sends the abnormality detection result of the anomaly detection model to the cloud server. The terminal device, wherein the anomaly detection model is obtained by training based on the user's historical user behavior characteristic sequence in at least one terminal device;

The execution module 730 executes a safety authentication process matching the abnormal detection result.

The terminal device of the embodiment of the present specification can collect the user behavior characteristic sequence during the use of the user, and upload the user behavior characteristic sequence to the cloud server, and the cloud server trains the anomaly detection model. When security authentication is required, the terminal device requests the cloud server to perform anomaly detection on the current user behavior characteristic sequence based on the anomaly detection model, and feeds back the anomaly detection result to the terminal device, and the terminal device performs security matching the anomaly detection result Certification process. Since the entire scheme uses a dynamic security authentication method, the risk of leakage of authentication information is low. In addition, anomaly detection can be performed without the user's perception, and will not affect the user's experience of using the terminal device.

Obviously, the terminal device of the embodiment of the present specification can be used as the execution subject of the security authentication method shown in FIG. 4, and therefore can realize the functions implemented by the security authentication method in FIG. 4. Since the principle is the same, this article will not repeat them.

FIG. 8 is a schematic structural diagram of a cloud server 800 according to an embodiment of the present specification, including:

The obtaining module 810 obtains the user behavior characteristic sequence collected by the terminal device.

The anomaly detection module 820 performs anomaly detection on the user behavior feature sequence based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device.

The sending module 830 sends the abnormality detection result to the terminal device, so that the terminal device executes a safety authentication process matching the abnormality detection result.

The cloud server in the embodiment of the present specification uses the user behavior characteristic sequence collected by the terminal device during the use of the user to train the anomaly detection model, so that the anomaly detection model characterizes the user's user behavior attributes. When the terminal device needs to perform security authentication, the cloud server performs abnormality detection on the current user behavior characteristic sequence based on the abnormality detection model, and feeds back the abnormality detection result to the terminal device, and the terminal device performs the security authentication that matches the abnormality detection result Process. Since the entire scheme uses a dynamic security authentication method, the risk of leakage of authentication information is low. In addition, anomaly detection can be performed without the user's perception, and will not affect the user's experience of using the terminal device.

Obviously, the cloud reset in the embodiment of this specification can be used as the execution subject of the security authentication method shown in FIG. 5, and therefore can realize the functions implemented by the security authentication method in FIG. 5. Since the principle is the same, this article will not repeat them.

Fig. 9 is a schematic structural diagram of an electronic device according to an embodiment of the present specification. Please refer to FIG. 9. At the hardware level, the electronic device includes a processor, and optionally an internal bus, a network interface, and a memory. Among them, the memory may include memory, such as high-speed random access memory (Random-Access Memory, RAM), or may also include non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required by other services.

The processor, network interface, and memory can be connected to each other through an internal bus. The internal bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect, peripheral component interconnection standard) bus, or an EISA (Extended) bus. Industry Standard Architecture, extended industry standard structure) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of presentation, only one bidirectional arrow is used in FIG. 9, but it does not mean that there is only one bus or one type of bus.

Memory, used to store programs. Specifically, the program may include program code, and the program code includes computer operation instructions. The memory may include memory and non-volatile memory, and provide instructions and data to the processor.

The processor reads the corresponding computer program from the non-volatile memory to the memory and then runs it to form the above-mentioned security authentication device on a logical level. The processor executes the program stored in the memory, and is specifically used to perform the following operations:

Collect user behavior characteristic sequences based on terminal equipment.

Sending the user behavior characteristic sequence to a cloud server based on the terminal device.

Perform anomaly detection on the user behavior feature sequence based on the cloud server based on an anomaly detection model, where the anomaly detection model is obtained by training based on the user's historical user behavior feature sequence in at least one terminal device.

Based on the cloud server, the anomaly detection result of the anomaly detection model is sent to the terminal device.

Based on the terminal device, a security authentication process that matches the abnormality detection result is executed.

It can be known from the electronic device shown in FIG. 9 that based on the solution of the embodiment of this specification, the terminal device collects the user behavior characteristic sequence during the use of the user, and uploads the user behavior characteristic sequence to the cloud server, and the cloud server performs the abnormal detection model training. When the terminal device needs to authenticate the user safely, the cloud server performs anomaly detection on the current user behavior feature sequence based on the abnormality detection model, and feeds back the abnormality detection result to the terminal device, and the terminal device performs the matching with the abnormality detection result Safety certification process. Since the entire scheme uses a dynamic security authentication method, the risk of leakage of authentication information is low. In addition, anomaly detection can be performed without the user's perception, and will not affect the user's experience of using the terminal device.

The foregoing security authentication method disclosed in the embodiment shown in FIG. 1 of this specification may be applied to a processor or implemented by the processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or instructions in the form of software. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (Network Processor, NP), etc.; it may also be a digital signal processor (DSP), a dedicated integrated Circuit (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps, and logical block diagrams disclosed in the embodiments of this specification can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. The steps of the method disclosed in the embodiments of this specification can be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

It should be understood that the electronic device of the embodiment of the present specification can realize the functions of the embodiment of the security authentication apparatus shown in FIG. 1, and details are not described herein again.

Of course, in addition to the software implementation, the electronic equipment in this specification does not exclude other implementations, such as logic devices or a combination of software and hardware, etc. That is to say, the execution body of the following processing flow is not limited to each logic unit. It can also be a hardware or logic device.

In addition, the embodiment of this specification also proposes a computer-readable storage medium that stores one or more programs, and the one or more programs include instructions.

Optionally, when the instruction is executed by a portable electronic device including multiple application programs, the portable electronic device can execute the method of the embodiment shown in FIG. 1, and is specifically used to execute the following method:

Collect user behavior characteristic sequences based on terminal equipment.

Perform anomaly detection on the user behavior feature sequence based on the cloud server based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device.

It should be understood that, when the foregoing instructions are executed by a portable electronic device that includes multiple application programs, they can enable the security authentication apparatus described above to implement the functions of the embodiment shown in FIG. 1. Since the principle is the same, this article will not repeat them.

Those skilled in the art should understand that the embodiments of this specification can be provided as a method, a system or a computer program product. Therefore, this specification may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

The foregoing describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than in the embodiments and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The above are only examples of this specification, and are not intended to limit this specification. For those skilled in the art, this specification can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims of this specification. In addition, all other embodiments obtained by a person of ordinary skill in the art without creative work shall fall within the protection scope of this document.

Claims

A security authentication method, including:

Terminal equipment collects user behavior characteristic sequence;

Sending, by the terminal device, the user behavior characteristic sequence to a cloud server;

The cloud server performs anomaly detection on the user behavior feature sequence based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device;

Sending, by the cloud server, an abnormality detection result of the abnormality detection model to the terminal device;

The terminal device executes a safety authentication process that matches the abnormality detection result.
The method according to claim 1, further comprising:

When the terminal device is preparing to perform security verification, initiate an auxiliary authentication request to the cloud server;

The cloud server performs anomaly detection on the user behavior feature sequence based on an anomaly detection model, including:

Acquiring, by the cloud server, the user behavior characteristic sequence within a predetermined time period at the moment when the auxiliary authentication request is received;

The cloud server inputs the user behavior feature sequence within the predetermined time period into the anomaly detection model to perform abnormality detection on the user behavior feature sequence within the predetermined time period.
The method according to claim 1, further comprising:

The terminal device is installed with a payment application, and the auxiliary authentication request is initiated by the payment application controlling the terminal device when the user uses the payment application for resource processing.
According to the method of claim 3,

The terminal equipment collects user behavior characteristic sequences, including:

The terminal device collects the user behavior characteristic sequence of the user in the process of resource processing.
According to the method of claim 1,

The terminal device executing the safety authentication process matching the abnormal detection result includes:

If the abnormality detection result indicates that there is no abnormality, the terminal device determines that the security authentication is passed, otherwise, it initiates identity authentication to the user;

If the user passes the identity authentication, the terminal device determines that the security authentication is passed; otherwise, it determines that the security authentication fails.
The method according to claim 5, the identity authentication includes at least one of the following: biometric authentication, password authentication, and USBKey authentication.
The method according to any one of claims 1 to 6, wherein the user behavior characteristic sequence includes at least one of the following: a user motion trajectory characteristic sequence, a user positioning trajectory characteristic sequence, a user touch characteristic sequence, and a user application interaction characteristic sequence .
A security authentication method, including:

Terminal equipment collects user behavior characteristic sequence;

The terminal device sends the user behavior feature sequence to a cloud server, so that the cloud server performs anomaly detection on the user behavior feature sequence based on the anomaly detection model, and sends the abnormality detection result of the anomaly detection model to the cloud server. The terminal device, wherein the anomaly detection model is obtained by training based on the user's historical user behavior characteristic sequence in at least one terminal device;

The terminal device executes a safety authentication process that matches the abnormality detection result.
A security authentication method, including:

The cloud server obtains the user behavior characteristic sequence collected by the terminal device;

The cloud server performs anomaly detection on the user behavior feature sequence based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device;

The cloud server sends the abnormality detection result to a terminal device, so that the terminal device executes a security authentication process matching the abnormality detection result.
A safety authentication device includes:

Sequence collection module, based on terminal equipment to collect user behavior characteristic sequences;

A first sending module, which sends the user behavior characteristic sequence to a cloud server based on the terminal device;

An anomaly detection module, which performs anomaly detection on the user behavior feature sequence based on the cloud server based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device;

A second sending module, which sends the abnormality detection result of the abnormality detection model to the terminal device based on the cloud server;

The security authentication module executes a security authentication process matching the abnormal detection result based on the terminal device.
A terminal device, including:

Collection module, collect user behavior characteristic sequence;

The sending module sends the user behavior characteristic sequence to the cloud server, so that the cloud server performs anomaly detection on the user behavior characteristic sequence based on the anomaly detection model, and sends the abnormality detection result of the anomaly detection model to the A terminal device, wherein the anomaly detection model is obtained by training based on the historical user behavior feature sequence of the user in at least one terminal device;

The execution module executes the safety authentication process matching the abnormal detection result.
A cloud server including

The acquiring module acquires the user behavior characteristic sequence collected by the terminal device;

An anomaly detection module, which performs anomaly detection on the user behavior feature sequence based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device;

The sending module sends the abnormality detection result to the terminal device, so that the terminal device executes a safety authentication process matching the abnormality detection result.
An electronic device includes: a memory, a processor, and a computer program stored on the memory and capable of running on the processor, the computer program being executed by the processor:

Collect user behavior characteristic sequences based on terminal equipment;

Sending the user behavior characteristic sequence to a cloud server based on the terminal device;

Performing anomaly detection on the user behavior feature sequence based on the cloud server based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device;

Sending the abnormality detection result of the abnormality detection model to the terminal device based on the cloud server;

Based on the terminal device, a security authentication process that matches the abnormality detection result is executed.
A computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

Collect user behavior characteristic sequences based on terminal equipment;

Sending the user behavior characteristic sequence to a cloud server based on the terminal device;

Performing anomaly detection on the user behavior feature sequence based on the cloud server based on an anomaly detection model, where the anomaly detection model is trained based on the user's historical user behavior feature sequence in at least one terminal device;

Sending the abnormality detection result of the abnormality detection model to the terminal device based on the cloud server;

Based on the terminal device, a security authentication process that matches the abnormality detection result is executed.