WO2019114246A1 - Identity authentication method, server and client device - Google Patents

Abstract

Disclosed are an identity authentication method, a server and a client device. The method comprises: a server receiving first behavior attribute information sent by a client device, and carrying out similarity matching between the first behavior attribute information and legitimate samples in a legitimate sample set, and if the matching fails, sending an explicit identity authentication request message to the client device. By means of the method, since the first behavior attribute information is information generated when a user operates a client, even if a malicious user fraudulently uses account information of the user, as it is difficult for the malicious user to imitate or steal operation information of an original user, the malicious user is identified in the use process because the behavior attribute is different from that of the original user, thereby effectively avoiding the problem that the account information is fraudulently used, improving the reliability of identity authentication, and thus ensuring the information security of the user.

Description

Identity authentication method, server and client device

This application claims the priority of the Chinese patent application filed on December 13, 2017 by the Chinese Patent Office, application number 201711331515.X, and the invention name is "an authentication method, server and client device". The citations are incorporated herein by reference.

Technical field

The present invention relates to the field of communications technologies, and in particular, to an identity authentication method, a server, and a client device.

Background technique

With the development of the Internet and e-commerce, computer network applications have penetrated into all walks of life, and global informationization has become a major trend in human development. In recent years, network security problems have been particularly serious. Users have been frequently attacked by hackers, Trojans, and malware. Bank accounts have been stolen, funds have been stolen, and user identities have been fraudulently used. Therefore, ensuring the reliability of user identity on the Internet has become an important issue.

At present, commonly used identity authentication methods include static passwords, smart cards, dynamic passwords, short message passwords, digital signatures, biometrics, etc., in view of these authentication methods, the user identity is usually identified during the user login process, and after the user logs in, User identity will not continue to be recognized. Taking a static password as an example, when a user logs in using a static password, the account name and the corresponding static password are required. The authentication system can identify the user identity by the account name entered by the user and the corresponding static password. However, with this authentication method, once the user's mobile phone is lost and the account that the user is logged in is still in the login state, the malicious user can fraudulently use the user's account information.

Based on this, there is a need for an identity authentication method for solving the problem that the account information is fraudulent after the terminal is lost in the prior art.

Summary of the invention

The embodiments of the present invention provide an identity authentication method, a server, and a client device, to solve the technical problem that the account information is fraudulent after the terminal is lost in the prior art.

In a first aspect, the present invention provides an identity authentication method, the method comprising:

Receiving, by the server, the first behavior attribute information sent by the client device, where the first behavior attribute information is information generated by the user equipment that the client device collects in the preset time period to operate the client device;

The server performs the similarity matching between the first behavior attribute information and the legal sample in the legal sample set, and if the matching fails, sends an explicit identity authentication request message to the client device; A set of behavior attribute information collected by the client device after identity authentication.

Optionally, the method further includes:

The server receives an explicit identity authentication response message sent by the client device;

The server determines, according to the explicit identity authentication response message, that the first behavior attribute information is used as a special sample after the explicit identity authentication is passed, and adds the special sample to the legal sample set.

Optionally, the server performs similarity matching between the first behavior attribute information and a legal sample in the legal sample set, including:

The server determines that the matching fails when the first behavior attribute information satisfies the following conditions:

Determining, by the server, that the first similarity value is smaller than a first threshold, where the first similarity value is a similarity value between the first behavior attribute information and an average value of legal samples in the legal sample set;

And,

The server determines that the second similarity value is less than a second threshold, and the second similarity value is a similarity value between the first behavior attribute information and each special sample in the legal sample set.

Optionally, the method further includes:

If the matching is successful, the server adds the first behavior attribute information as a legal sample to the legal sample set.

In a second aspect, an embodiment of the present invention provides an identity authentication method, where the method includes:

The client device sends the first behavior attribute information to the server; the first behavior attribute information is information generated by the user equipment that the client device collects in the preset time period to operate the client device;

The client device receives an explicit identity authentication request message sent by the server, where the explicit identity authentication request message is that the server performs similarity matching between the first behavior attribute information and a legal sample in a legal sample set. When the packet is sent, the legal sample set is a set of behavior attribute information collected by the client device after the identity authentication.

A third method, the embodiment of the present invention provides a server, where the server includes:

a receiving unit, configured to receive first behavior attribute information sent by the client device, where the first behavior attribute information is information generated by the user equipment that the client device collects in a preset time period to operate the client device;

a processing unit, configured to perform similarity matching on the first behavior attribute information with a legal sample in the legal sample set; the legal sample set is a set of behavior attribute information collected by the client device after the identity authentication;

And a sending unit, configured to send an explicit identity authentication request message to the client device after the processing unit determines that the matching fails.

Optionally, the receiving unit is further configured to:

Receiving an explicit identity authentication response message sent by the client device;

The processing unit is further configured to determine, according to the explicit identity authentication response message, that the first behavior attribute information is used as a special sample after the explicit identity authentication is passed, and add the special sample to the legal sample set. in.

Optionally, the processing unit is specifically configured to:

Determining that the matching fails when the first behavior attribute information satisfies the following conditions:

Determining that the first similarity value is less than a first threshold, and the first similarity value is a similarity value between the first behavior attribute information and an average value of legal samples in the legal sample set;

And,

Determining that the second similarity value is less than a second threshold, the second similarity value being a similarity value between the first behavior attribute information and each of the special samples in the legal sample set.

Optionally, the processing unit is further configured to:

If it is determined that the matching is successful, the first behavior attribute information is added as a legal sample to the legal sample set.

In a fourth aspect, an embodiment of the present invention provides a client device, where the client device includes:

a sending unit, configured to send first behavior attribute information to the server; the first behavior attribute information is information generated by the user equipment collected by the client device in a preset time period to operate the client device;

a receiving unit, configured to receive an explicit identity authentication request message sent by the server, where the explicit identity authentication request message is that the server performs similarity matching between the first behavior attribute information and a legal sample in a legal sample set When the packet is sent, the legal sample set is a set of behavior attribute information collected by the client device after the identity authentication.

In a fifth aspect, an embodiment of the present invention provides an authentication device, including:

a memory for storing program instructions;

And a processor, configured to invoke a program instruction stored in the memory, and execute the above method according to the obtained program.

In a sixth aspect, an embodiment of the present invention provides a computer readable storage medium, where the storage medium stores instructions that, when executed on a computer, cause a computer to implement the method of the first aspect described above.

In a seventh aspect, an embodiment of the present invention provides a computer program product, the computer program product comprising a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instruction is The computer, when executed, causes the computer to perform any of the methods described above.

In the embodiment of the present invention, the server receives the first behavior attribute information sent by the client device, and performs similarity matching between the first behavior attribute information and the legal sample in the legal sample set. If the matching fails, the server sends the information to the client. The end device sends an explicit identity authentication request message. The first behavior attribute information is information generated by the user equipment collected by the client device in a preset time period, and the legal sample collection is collected by the client device after the identity authentication is performed. A collection of behavioral attribute information. In the embodiment of the present invention, after the user successfully logs in, the server continues to receive the information generated by the user operating the client device, and matches the received information with the legal sample, so that the malicious user spoofs the user. The account information is difficult for the malicious user to imitate or steal the operation information of the original user. Therefore, the malicious user is identified because the behavior attribute is different from the original user during use, thereby effectively preventing the account information from being fraudulently used. The problem is to improve the reliability of identity authentication, and thus to ensure the security of users' information.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying for inventive labor.

1 is a schematic structural diagram of a system used in an embodiment of the present invention;

2 is a schematic flowchart of an identity authentication method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a preset time period according to an embodiment of the present disclosure;

4 is a schematic diagram of an overall process involved in an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a server according to an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of a client device according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of an authentication device according to another embodiment of the present invention;

FIG. 8 is a schematic structural diagram of an authentication device according to another embodiment of the present invention.

Detailed ways

The present invention will be further described in detail with reference to the accompanying drawings, in which . All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

FIG. 1 is a schematic diagram showing a system architecture used in an embodiment of the present invention. As shown in FIG. 1 , a system architecture applicable to an embodiment of the present invention includes a server 101 and one or more client devices, such as shown in FIG. 1 . Client device 102, client device 103, and client device 104 are shown. The server and the client device 102, the client device 103, and the client device 104 can communicate through the network. For example, the server 101 can send the display to any of the client device 102, the client device 103, and the client device 104. Identity authentication request message, any client device can return an explicit identity authentication response message according to the explicit identity authentication request message.

In the embodiment of the present invention, the client device may be multiple types of devices, such as a smart phone, a tablet computer, a notebook computer, and the like.

Based on the system architecture shown in FIG. 1, FIG. 2 is a schematic flowchart of an identity authentication method according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps:

Step 201: The client device sends the first behavior attribute information to the server.

Step 202: The server receives the first behavior attribute information sent by the client device.

Step 203: The server performs similarity matching between the first behavior attribute information and the legal sample in the legal sample set. If the matching fails, the server sends an explicit identity authentication request message to the client device.

Step 204: The client device receives an explicit identity authentication request message sent by the server.

In the embodiment of the present invention, after the user successfully logs in, the server continues to receive the information generated by the user operating the client device, and matches the received information with the legal sample, so that the malicious user spoofs the user. The account information is difficult for the malicious user to imitate or steal the operation information of the original user. Therefore, the malicious user is identified because the behavior attribute is different from the original user during use, thereby effectively preventing the account information from being fraudulently used. The problem is to improve the reliability of identity authentication, and thus to ensure the security of users' information.

Before performing step 201, the embodiment of the present invention needs to generate a legal sample set in advance, wherein the legal sample set is a set of behavior attribute information collected by the client device after explicit identity authentication. Specifically, after the user is authenticated by the user, for example, by using an explicit identity authentication method, the client device collects the behavior attribute information of the user in the login process, and uses the collected behavior attribute information as a legal sample. The explicit identity authentication is an authentication method that requires the user to input a password, such as an account name and a corresponding static password, a card number and a corresponding static password, a mobile phone number, and a corresponding short message verification code.

In an example, when a user logs in to an application by using a client device, for example, when the user logs in to the mobile banking by using the smart phone, the bank card number and password need to be input first, and when the input bank card number and password are correct, the identity authentication is determined. Then, the smart phone can collect behavior attribute information during the user login process, and take the collected behavior attribute information as a legal sample.

In the embodiment of the present invention, the behavior attribute information is information generated by the user operating the client device. Further, in consideration of the information generated by the user operating the client device, there may be information that has less influence on the identity authentication. Therefore, the information generated by the user operating the client device may be filtered, and the identity authentication may be greatly affected. The information is used as the behavior attribute information, so that the behavior attribute information is more in line with the user's behavior characteristics, and the accuracy of the behavior attribute information can be improved.

As shown in Table 1, the information generated by the user operating the client device may include behavior elements such as the user's IP address, the location of the client device, the user's reading speed, and the web page address. Wherein, for the same user, the location of the user's IP address is relatively fixed, and thus can be used as a behavior element in the behavior attribute information; similarly, the user's reading speed is a usage habit of the user, and thus can also be used as behavior attribute information. The behavioral element in the webpage; the webpage address can be changed according to the user's needs. Therefore, the webpage address may not be included in the behavior attribute information.

Table 1: An example of whether the information generated by the user operating the client device is used as the behavior attribute information.

User-generated information generated by the client device	Whether as behavior attribute information
User's IP address	Yes
Where the client device is located	Yes
User reading speed	Yes
website link	no
......	......

In step 201, the first behavior attribute information is information generated by the user equipment collected by the client device in the preset time period.

In the embodiment of the present invention, the preset time period is any one of the N time periods before the user logs in to the account, and the time period is the next time. The time period diagram can be equally divided into N time periods after the user logs in successfully to the next login period, and the client device can collect information generated by the user operating the client device in the ith time period, and collect the information. The information is used as the first behavior attribute information. The attribute included in the first behavior attribute information is consistent with the attribute included in the behavior attribute in the legal sample.

It should be noted that the content shown in FIG. 3 is only one possible implementation manner, and a preset time period may be determined by a person skilled in the art according to experience and actual conditions, and is not limited thereto.

In step 202 and step 203, after receiving the first behavior attribute information sent by the client device, the server may perform the similarity matching between the first behavior attribute information and the legal sample in the legal sample set. A possible implementation manner is to obtain a first similarity value between the first behavior attribute information and each legal sample for any legal sample in the legal sample set.

After the first similarity value is obtained by the foregoing method, the method for determining the matching failure is different. For example, if it is determined that the first similarity value between the first behavior attribute information and each legal sample is smaller than the pre-predetermined value. If the similarity threshold is set, the matching fails; or if the first similarity value between the first behavior attribute information and each legal sample is determined to be greater than or equal to the preset similarity threshold, the number is less than the preset threshold. , the match failed. The preset similarity threshold and the preset number threshold may be determined by a person skilled in the art according to experience and actual conditions, and are not specifically limited.

Another possibility is that the average value of the legal samples in the legal sample set is determined, and the first similarity value between the first behavior attribute information and the average value of the legal samples in the legal sample set is obtained, and It is determined whether the similarity value is less than the first threshold, and if it is less, the matching fails. The first threshold value may be determined by a person skilled in the art according to experience and actual conditions, and is not limited thereto. The following describes the method of similarity matching using the average value of legal samples, including the following steps:

Step 301: Determine an average value of legal samples in the legal sample set.

Specifically, the legal sample is the behavior attribute information collected by the client, and each legal sample includes at least one behavior element. Among them, according to the attribute value of the behavioral element, the behavioral element can be divided into a numerical behavioral element and a textual behavioral element, for example, the user's reading speed is "88.75 lines/min", due to "user reading speed" The attribute value of the behavior element is “88.75 lines/min”, and the attribute value is a numerical value. Therefore, “user reading speed” can be used as a numerical behavior element; the location of the client device is “Ningxiu Qingxiu District” due to The attribute value of the behavior element of "the location where the client device is located" is "Qingxiu District of Nanning City", and the attribute value is text. Therefore, "the location where the client device is located" can be used as a text type behavior element.

For numerical behavioral elements, the average of the attribute values of the numeric behavioral elements can be used as the average of the behavioral elements. Taking the user's reading speed as an example, as shown in Table 2, the legal sample set includes three legal samples, wherein in the legal sample 1, the user's reading speed is "88.75 lines/min"; in the legal sample 2, the user's reading The speed is “80.75 lines/min”; in the legal sample 3, the user's reading speed is “84.75 lines/min”, which can be obtained by using the average calculation formula. In the legal sample set, the average reading speed of the user is “84.75 lines”. /min".

Table 2: An example of the average of numerical behavioral elements

Legal sample collection	User reading speed
Legal sample 1	88.75 lines/min
Legal sample 2	80.75 lines/min
Legal sample 3	84.75 lines/min
average value	84.75 lines/min

For text-based behavioral elements, the average of textual behavioral elements can be determined based on the probability distribution of the attribute values of the textual behavioral elements. As shown in Table 3, the legal sample set includes three legal samples. In the legal sample 1, the IP address of the user is “172.18.19.20”, the city where the client device is located is “Nanning”, and the city where the client device is located is located. "Qingxiu District"; in the legal sample 2, the user's IP address is "172.18.19.20", the city where the client device is located is "Nanning", and the city where the client device is located is "Qingxiu District"; legal sample 3 The IP address of the user is “172.18.19.20”, the city where the client device is located is “Nanning”, and the city where the client device is located is “Jiangnan District”. It can be seen that in the above three legal samples, the probability that the user's IP address is "172.18.19.20" is three times, and the probability distribution of the user's IP address can be recorded as {172.18.19.20, 3}; where the client device is located The probability of the city appearing as “Nanning” is 3 times, and the probability distribution of the city where the client device is located can be recorded as {Nanning, 3}; the probability of the occurrence of the “Qixiu District” in the urban area where the client device is located is 2 times. The probability that the urban area where the client device is located is “Jiangnan District” is one time. The probability distribution of the urban area where the client device is located can be recorded as {Qingxiu District, 2; Jiangnan District, 1}.

Table 3: An example of the probability distribution of text-type behavioral elements

Legal sample collection	User's IP address	The city where the client device is located	The city where the client device is located
Legal sample 1	172.18.19.20	Nanning	Qingxiu District
Legal sample 2	172.18.19.20	Nanning	Qingxiu District
Legal sample 3	172.18.19.20	Nanning	Jiangnan District
Probability distributions	{172.18.19.20,3}	{Nanning, 3}	{青秀区, 2; Jiangnan District, 1}

Step 302: Determine a weight value of the behavior element for each behavior element of the legal sample.

In the embodiment of the present invention, the assignment of the weight value of the behavior element directly leads to the reliability and accuracy of the identity authentication. There are two main methods for the assignment of the existing weight value, one is subjective weighting based on the subjective judgment of the decision maker. The law, the other is the objective weighting method based on the decision matrix. The embodiment of the present invention takes the subjective weighting method as an example to determine the weight value of the behavioral element, and adopts the subjective weighting method to avoid the influence of the decision matrix, thereby ensuring the consistency of the decision thinking and improving the rationality of the weight value distribution.

In one example, as shown in Table 4, an example of the assignment of weight values for behavioral elements, the behavioral elements of the legal sample include the user's IP address, the city where the client device is located, the city where the client device is located, and the user's reading. speed. The weight value of the user's IP address can be set to 0.2, the weight value of the city where the client device is located is set to 0.3, the weight value of the urban area where the client device is located is set to 0.2, and the weight value of the user's reading speed is set. Is 0.3.

Table 4: An example of weight value assignment for behavioral elements

Behavioral element	Weights
User's IP address	0.2
The city where the client device is located	0.3
The city where the client device is located	0.2
User reading speed	0.3

Table 4 is only an example, and those skilled in the art can modify the content shown in Table 4 according to experience and actual situation, and are not limited thereto.

Step 303: Determine, according to an average value of the legal sample and a weight value of the behavior element, a first similarity value between the first behavior attribute information and an average value of the legal sample.

In the embodiment of the present invention, after determining the average value of the numerical behavior element for the numerical behavior element, the attribute value of the numerical behavior element and the numerical behavior element in the first sample attribute information may be in the legal sample set. The average value determines the degree of difference between the numerical behavioral element and the legal sample in the first behavior attribute information, thereby determining the similarity value between the numerical behavioral element and the legal sample. Specifically, for the numerical behavior element, the similarity value between the first behavior attribute information and the average value of the legal sample can be calculated by the following formula:

Where T _s is the similarity value between the numerical behavior element in the first behavior attribute information and the average value of the corresponding numerical behavior element in the legal sample; x is the numerical behavior element in the first behavior attribute information Attribute value

Is the average of the corresponding numeric behavioral elements in the legal sample.

In one example, the numerical behavioral element is a reading speed of the user. In the legal sample set, the average reading speed of the user is 84.75 lines/min; in the first behavior attribute information, the reading speed of the user is 50 lines. /min, according to the above calculation formula, the similarity value between the reading speed of the user in the first behavior attribute and the average reading speed of the user in the legal sample set is 0.59.

In the embodiment of the present invention, after determining the probability distribution of the text-type behavior element, the attribute value of the text-type behavior element and the text-type behavior element may be in the legal sample set according to the first behavior attribute information. The probability distribution determines the similarity value between the text-type behavioral element and the legal sample in the first behavior attribute information. Specifically, for the text type behavior element, the first behavior attribute information and the similarity value of the legal sample can be calculated by the following formula:

Where T _w is the similarity value between the text-type behavior element in the first behavior attribute information and the corresponding text-type behavior element in the legal sample; y is the text type in the legal sample set and the first behavior attribute information The number of samples with the same attribute value of the behavioral element; N is the total number of samples in the legal sample set. y is an integer greater than or equal to 0, and N is an integer greater than or equal to 1.

In an example, the text-type behavior element is an urban area where the client device is located. In the legal sample set, the probability distribution of the urban area where the client device is located is {Qingxiu District, 2; Jiangnan District, 1}; In the behavior attribute information, the urban area where the client device is located is Qingxiu District, and according to the above calculation formula, the similarity between the urban area where the client device is located in the first behavior attribute and the urban area where the client device in the legal sample set is located is obtained. The value is 0.67.

Further, after obtaining the similarity value between each behavior element in the first behavior attribute information and the corresponding behavior element in the legal sample set by using the method described above, the first value may be determined according to the weight value of each behavior element. The first similarity value between the behavior attribute information and the average value of the legal sample can be calculated by the following formula:

Where T is the first similarity value between the first behavior attribute information and the average of the legal samples,

a similarity value between the i-th numerical behavior element and the legal sample in the first behavior attribute information; ω _i is a weight value of the i-th numerical behavior element in the first behavior attribute information;

The similarity value between the jth text-type behavior element and the legal sample in the first behavior attribute information; ω _j is the weight value of the j-th text-type behavior element in the first behavior attribute information. i is an integer greater than or equal to 1, and j is an integer greater than or equal to 1.

The calculation method based on the first similarity value between the first behavior attribute information and the average value of the legal samples described above is exemplified below.

In one example, as shown in Table 5, as an example of the first similarity value between the first behavior attribute information and the average value of the legal samples, if it is determined that the user's IP address has a weight value of 0.2, the client device The weight of the city where the city is located is 0.3, the weight of the urban area where the client device is located is 0.2, the weight of the user's reading speed is 0.3, and the probability distribution of the user's IP address in the legal sample set is determined to be {172.18. 19.20,3}, the probability distribution of the city where the client device is located is {Nanning, 3}, and the probability distribution of the urban area where the client device is located is {Qingxiu District, 2; Jiangnan District, 1}, the average reading speed of the user The value is 84.75 lines/min, and according to the above calculation formula, the first similarity value between the first behavior attribute information and the average value of the legal samples is 0.798.

Table 5: An example of the first similarity value

Behavioral element	Weights	Average of legal samples	The attribute value in the first behavior attribute
User's IP address	0.2	{172.18.19.20,3}	172.18.19.20
The city where the client device is located	0.3	{Nanning, 3}	Nanning

The city where the client device is located	0.2	{青秀区, 2; Jiangnan District, 1}	Jiangnan District
User reading speed	0.3	84.75 lines/min	64.75 lines/min

It should be noted that the above-mentioned calculation method is only an example provided by the embodiment of the present invention, and those skilled in the art may modify the above method according to experience and actual conditions, and are not limited thereto.

Step 304: Determine whether the first similarity value is less than the first threshold. If the value is smaller than the first threshold, the matching fails; otherwise, the matching is successful.

Further, after performing the foregoing step 204, the server determines, according to the received explicit identity authentication response message sent by the client device, that the first behavior attribute information is used as a special sample and the special sample is passed after the identity authentication is passed. Adding to the legal sample set, and determining whether the number of legal samples in the legal sample set is greater than a preset sample number threshold. If greater than, deleting legal samples with a longer storage time in the legal sample set, until The number of legal samples in the deleted legal sample set is not greater than the preset sample number threshold. The preset sample number threshold may be determined by a person skilled in the art according to experience and actual conditions, and is not limited. In this way, the legal sample set is updated, because the legal sample stored for a long time may not conform to the current user behavior, so the first behavior attribute information of each identity authentication is added to the legal sample set, and The legal sample with a long storage time in the legal sample set is deleted, thereby improving the referenceability of the legal sample set.

The embodiment of the present invention provides another method for similarity matching, which specifically includes the following steps:

Step 1: After determining that the first behavior attribute information fails to match the legality sample in the legal sample set, the server determines whether there is a special sample. If yes, step 2 is performed; if not, step 3 is performed.

Step 2: The server matches the first behavior attribute information with a special sample for similarity.

Specifically, if the server determines that only one special sample exists, determining, according to the first behavior attribute information and the special sample, a second similarity value of the first behavior attribute information and the special sample; And determining whether the second similarity value is less than a second threshold, and if it is less than the second threshold, the matching fails.

If the server determines that there are multiple special samples, determining, for each special sample, the first behavior attribute information and the second similarity value of each special sample; and determining whether there is a second threshold or more The second similarity value, if not present, the match fails.

In the embodiment of the present invention, the method for calculating the second similarity value may refer to the foregoing method for calculating the first similarity value, and details are not described herein again. A person skilled in the art can also determine the calculation method of the second similarity value according to the experience and the actual situation, which is not limited.

Step 3: If the server determines that the matching fails, the server sends an explicit identity authentication request message to the client device.

In order to introduce the above-mentioned identity authentication method more clearly, the flow involved in the embodiment of the present invention will be described in detail below with reference to FIG. As shown in FIG. 4, the following steps may be included:

Step 401: The server receives the first behavior attribute information sent by the client device.

Step 402: The server performs the similarity matching between the first behavior attribute information and the legal sample in the legal sample set. If the matching fails, step 403 is performed; if the matching is successful, step 404 is performed.

In step 403, the server determines whether there is a special sample. If yes, step 405 is performed; if not, step 406 is performed.

Step 404: The server adds the first behavior attribute information to the legal sample set, and returns to step 401.

Step 405: The server performs the similarity matching between the first behavior attribute information and the special sample. If the matching fails, step 406 is performed; if the matching is successful, step 409 is performed.

Step 406: The server sends an explicit identity authentication request message to the client device.

Step 407: The server receives an explicit identity authentication response message sent by the client device.

Step 408: The server determines whether the explicit identity authentication is passed. If yes, step 409 is performed; if not, step 410 is performed.

Step 409: The server takes the first behavior attribute information as a special sample, and adds the special sample to the legal sample set, and returns to step 401.

Step 410: The server determines that the identity authentication fails, and returns to step 401.

In the embodiment of the present invention, after the user successfully logs in, the server can continuously determine whether the user operating the client device is a malicious user according to the information generated by the received user operation client device. In this way, even if a malicious user spoofs the user's account information, it is difficult for the malicious user to imitate or steal the operation information of the original user. Therefore, the malicious user is identified because the behavior attribute is different from the original user during use. Therefore, the problem that the account information is fraudulently used can be effectively avoided, the reliability of the identity authentication is improved, and the information security of the user can be ensured.

Based on the same concept, a server provided by an embodiment of the present invention, as shown in FIG. 5, includes a receiving unit 501, a processing unit 502, and a sending unit 503.

The receiving unit 501 is configured to receive first behavior attribute information that is sent by the client device, where the first behavior attribute information is information generated by the user equipment that the client device collects in a preset time period to operate the client device;

The processing unit 502 is configured to perform the similarity matching between the first behavior attribute information and the legal sample in the legal sample set; the legal sample set is a set of behavior attribute information collected by the client device after the identity authentication;

The sending unit 503 is configured to send an explicit identity authentication request message to the client device after the processing unit determines that the matching fails.

Optionally, the receiving unit 501 is further configured to:

Receiving an explicit identity authentication response message sent by the client device;

The processing unit is further configured to determine, according to the explicit identity authentication response message, that the first behavior attribute information is used as a special sample after the explicit identity authentication is passed, and add the special sample to the legal sample set. in.

Optionally, the processing unit 502 is specifically configured to:

Determining that the matching fails when the first behavior attribute information satisfies the following conditions:

Determining that the first similarity value is less than a first threshold, and the first similarity value is a similarity value between the first behavior attribute information and an average value of legal samples in the legal sample set;

And,

Determining that the second similarity value is less than a second threshold, the second similarity value being a similarity value between the first behavior attribute information and each of the special samples in the legal sample set.

Optionally, the processing unit 502 is further configured to:

If it is determined that the matching is successful, the first behavior attribute information is added as a legal sample to the legal sample set.

Based on the same inventive concept, the embodiment of the present invention further provides a client device. As shown in FIG. 6, the client device 600 includes a receiving unit 602 and a sending unit 601.

The sending unit 601 is configured to send the first behavior attribute information to the server, where the first behavior attribute information is information generated by the user equipment collected by the client device in a preset time period to operate the client device;

The receiving unit 602 is configured to receive an explicit identity authentication request message sent by the server, where the explicit identity authentication request message is that the server compares the first behavior attribute information with a legal sample in a legal sample set. When the matching fails, the legal sample set is a set of behavior attribute information collected by the client device after identity authentication.

Embodiments of the present invention provide a computer readable storage medium storing instructions that, when executed on a computer, cause a computer to implement the method described above.

Embodiments of the present invention also provide a computer program product comprising a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer Having the computer perform the method of any of the above claims.

Based on the same principle, the present invention further provides an authentication device, as shown in FIG. 7, including a processor 701, a memory 702, a transceiver 703, and a bus interface 704, wherein the processor 701, the memory 702, and the transceiver 703 pass through Bus interface 704 is connected;

The processor 701 is configured to read a program in the memory 702, and execute the following method: receiving, by the transceiver 703, first behavior attribute information sent by the client device; the first behavior attribute information is the client The user generated by the device in the preset time period operates the information generated by the client device;

The first behavior attribute information is matched with the legal sample in the legal sample set, and if the matching fails, the explicit identity authentication request message is sent to the client device by the transceiver 703; the legal sample set is a set of behavior attribute information collected by the client device after identity authentication;

The memory 702 is configured to store one or more executable programs, and may store data used by the processor 701 when performing operations;

The bus interface 704 is configured to provide an interface.

Further, the processor 701 receives the explicit identity authentication response message sent by the client device by using the transceiver 703, and determines that the first identity is determined after the explicit identity authentication is passed according to the explicit identity authentication response message. The behavior attribute information is taken as a special sample, and the special sample is added to the legal sample set.

Further, the processor 701 performs similarity matching on the first behavior attribute information with a legal sample in the legal sample set, including:

Determining that the matching fails when the first behavior attribute information satisfies the following conditions:

Determining that the first similarity value is less than a first threshold, and the first similarity value is a similarity value between the first behavior attribute information and an average value of legal samples in the legal sample set;

And,

The server determines that the second similarity value is less than a second threshold, and the second similarity value is a similarity value between the first behavior attribute information and each special sample in the legal sample set.

Further, the processor 701 is further configured to:

If the matching is successful, the first behavior attribute information is added as a legal sample to the legal sample set.

Based on the same principle, the present invention further provides an authentication device, as shown in FIG. 8, including a processor 801, a memory 802, a transceiver 803, and a bus interface 804, wherein the processor 801, the memory 802, and the transceiver 803 pass through Bus interface 804 is connected;

The processor 801 is configured to read a program in the memory 802, and execute the following method: sending, by the transceiver 803, first behavior attribute information to a server; the first behavior attribute information is that the client device is pre- Setting, by the user, the information generated by the client device during the time period; receiving, by the transceiver 803, an explicit identity authentication request message sent by the server, where the explicit identity authentication request message is that the server When the behavior attribute information fails to be matched with the legal sample in the legal sample set, the legal sample set is a set of behavior attribute information collected by the client device after the identity authentication;

The memory 802 is configured to store one or more executable programs, and may store data used by the processor 801 when performing an operation;

The bus interface 804 is configured to provide an interface.

In the embodiment of the present invention, the server receives the first behavior attribute information sent by the client device, and performs similarity matching between the first behavior attribute information and the legal sample in the legal sample set. If the matching fails, the server sends the information to the client. The end device sends an explicit identity authentication request message. The first behavior attribute information is information generated by the user equipment collected by the client device in a preset time period, and the legal sample collection is collected by the client device after the identity authentication is performed. A collection of behavioral attribute information. In the embodiment of the present invention, after the user successfully logs in, the server continues to receive the information generated by the user operating the client device, and matches the received information with the legal sample, so that the malicious user spoofs the user. The account information is difficult for the malicious user to imitate or steal the operation information of the original user. Therefore, the malicious user is identified because the behavior attribute is different from the original user during use, thereby effectively preventing the account information from being fraudulently used. The problem is to improve the reliability of identity authentication, and thus to ensure the security of users' information.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. The computer program instructions can be provided to a general purpose computer, a special purpose computer, an embedded processor, or a processor of other programmable data processing device such that instructions executed by a processor of the computer or other programmable data processing device can be implemented in a flowchart The function specified in one or more processes and/or block diagrams in one or more blocks.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims (14)

1. An identity authentication method, characterized in that the method comprises:

   Receiving, by the server, the first behavior attribute information sent by the client device, where the first behavior attribute information is information generated by the user equipment that the client device collects in the preset time period to operate the client device;

   The server performs the similarity matching between the first behavior attribute information and the legal sample in the legal sample set, and if the matching fails, sends an explicit identity authentication request message to the client device; A set of behavior attribute information collected by the client device after identity authentication.
2. The method of claim 1 further comprising:

   The server receives an explicit identity authentication response message sent by the client device;

   The server determines, according to the explicit identity authentication response message, that the first behavior attribute information is used as a special sample after the explicit identity authentication is passed, and adds the special sample to the legal sample set.
3. The method according to claim 2, wherein the server matches the first behavior attribute information with a legal sample in the legal sample set, including:

   The server determines that the matching fails when the first behavior attribute information satisfies the following conditions:

   Determining, by the server, that the first similarity value is smaller than a first threshold, where the first similarity value is a similarity value between the first behavior attribute information and an average value of legal samples in the legal sample set;

   And,

   The server determines that the second similarity value is less than a second threshold, and the second similarity value is a similarity value between the first behavior attribute information and each special sample in the legal sample set.
4. The method according to any one of claims 1 to 3, wherein the method further comprises:

   If the matching is successful, the server adds the first behavior attribute information as a legal sample to the legal sample set.
5. An identity authentication method, characterized in that the method comprises:

   The client device sends the first behavior attribute information to the server; the first behavior attribute information is information generated by the user equipment that the client device collects in the preset time period to operate the client device;

   The client device receives an explicit identity authentication request message sent by the server, where the explicit identity authentication request message is that the server performs similarity matching between the first behavior attribute information and a legal sample in a legal sample set. When the packet is sent, the legal sample set is a set of behavior attribute information collected by the client device after the identity authentication.
6. A server, wherein the server comprises:

   a receiving unit, configured to receive first behavior attribute information sent by the client device, where the first behavior attribute information is information generated by the user equipment that the client device collects in a preset time period to operate the client device;

   a processing unit, configured to perform similarity matching on the first behavior attribute information with a legal sample in the legal sample set; the legal sample set is a set of behavior attribute information collected by the client device after the identity authentication;

   And a sending unit, configured to send an explicit identity authentication request message to the client device after the processing unit determines that the matching fails.
7. The server according to claim 6, wherein the receiving unit is further configured to:

   Receiving an explicit identity authentication response message sent by the client device;

   The processing unit is further configured to determine, according to the explicit identity authentication response message, that the first behavior attribute information is used as a special sample after the explicit identity authentication is passed, and add the special sample to the legal sample set. in.
8. The server according to claim 7, wherein the processing unit is specifically configured to:

   Determining that the matching fails when the first behavior attribute information satisfies the following conditions:

   Determining that the first similarity value is less than a first threshold, and the first similarity value is a similarity value between the first behavior attribute information and an average value of legal samples in the legal sample set;

   And,

   Determining that the second similarity value is less than a second threshold, the second similarity value being a similarity value between the first behavioral attribute information and each of the special samples in the set of legal samples.
9. The server according to any one of claims 6 to 8, wherein the processing unit is further configured to:

   If it is determined that the matching is successful, the first behavior attribute information is added as a legal sample to the legal sample set.
10. A client device, the client device comprising:

    a sending unit, configured to send first behavior attribute information to the server; the first behavior attribute information is information generated by the user equipment collected by the client device in a preset time period to operate the client device;

    a receiving unit, configured to receive an explicit identity authentication request message sent by the server, where the explicit identity authentication request message is that the server performs similarity matching between the first behavior attribute information and a legal sample in a legal sample set When the packet is sent, the legal sample set is a set of behavior attribute information collected by the client device after the identity authentication.
11. A computer readable storage medium, characterized in that the storage medium stores instructions that, when executed on a computer, cause the computer to perform the method of any one of claims 1 to 4.
12. A computer program product, comprising: a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, The computer performs the method of any of claims 1-5.
13. An authentication device, comprising: a processor, a memory, a transceiver, and a bus interface, wherein a processor, a memory and a transceiver are connected by a bus interface;

    The processor is configured to read a program in the memory, and execute the following method: receiving, by the transceiver, first behavior attribute information sent by the client device; the first behavior attribute information is that the client device is pre- Setting, by the user collected during the time period, the information generated by the client device;

    The first behavior attribute information is matched with the legal sample in the legal sample set, and if the matching fails, the explicit identity authentication request message is sent to the client device by using the transceiver; the legal sample set is passed a set of behavior attribute information collected by the client device after the identity authentication;

    The memory is configured to store one or more executable programs, and may store data used by the processor when performing operations;

    The bus interface is for providing an interface.
14. An authentication device, comprising:

    a processor, a memory, a transceiver, a bus interface, wherein the processor, the memory and the transceiver are connected by a bus interface;

    Transmitting, by the transceiver, the first behavior attribute information to the server by using the transceiver; the first behavior attribute information is information generated by the user equipment acquired by the client device in the preset time period, and being sent and received by the user equipment; Receiving an explicit identity authentication request message sent by the server, where the explicit identity authentication request message is sent when the server fails to match the first behavior attribute information with a legal sample in the legal sample set. The legal sample set is a set of behavior attribute information collected by the client device after identity authentication;

    The memory is configured to store one or more executable programs, and may store data used by the processor when performing operations;

    The bus interface is for providing an interface.

Images