A human-machine identification method and device

Abstract

The embodiment of the present invention provides a method for human-computer identification, including: the terminal device blocks the current operation of the operator according to the verification message from the server, or blocks the current operation of the operator according to the occurrence of a specific operation behavior; requests the server to dynamically obfuscate the key business code, and the dynamic obfuscation key business code includes the game verification logic and the encryption method of data reporting; obtains the sensor type on the terminal device, and selects a game matching the sensor type for the operator to execute according to the game verification logic obtained by the request; identifies the operator type according to the operator's execution result of the game. The present invention adopts a technical means of actively blocking the operation of suspicious users in the client or web environment, combined with various sensors integrated on the mobile device. The simulation cost of this type of operation is extremely high, so it achieves the maximum technical effect of ensuring that only real-life behavior can pass.

Description

Technical Field

[0001] The present invention relates to the technical field of human-machine identification for Internet applications, and in particular to a human-machine identification method and device. Background Art

[0002] CAPTCHA helps protect users from spam and password cracking attempts by asking users to complete a simple test to prove it's a human and not a computer trying to break into a password-protected account.

[0003] At present, client software or web pages on the market use various verification codes to identify normal users or machine users, and prevent machines from cheating on the client or web page. This method is passively triggered after the user takes action, and various verification codes such as "text" and "slider" pop up. After the user makes the corresponding correct response, he can continue to perform subsequent operations and finally complete the entire business process. Therefore, the human-machine recognition of the existing technology can only be passively triggered. When we screen out suspicious users through data analysis and mining, we cannot actively block the suspicious users' operations in the client or web environment.

[0004] Then, the existing verification codes of "text", "slider" and other styles have fixed patterns and are easy to crack. It is easy to pass or bypass these verification codes by using various "coding platforms" or brute force cracking the client. They do not require real human behavior to pass the verification as expected. Therefore, the effect of identifying cheating users and protecting clients or web pages is very limited.

[0005] In the process of implementing the present invention, the applicant discovered that there are at least the following problems in the prior art: the human-machine recognition technology has a fixed trigger mode and is easy to crack. Summary of the invention

[0006] The embodiments of the present invention need to solve the problem that the trigger mode of human-machine recognition technology is fixed and easy to crack.

[0007] To achieve the above object, on the one hand, an embodiment of the present invention provides a human-machine identification method, comprising the following steps:

[0008] The terminal device blocks the current operation of the operator according to the verification message from the server, or blocks the current operation of the operator according to the occurrence of a specific operation behavior;

[0009] Requesting a server for a dynamic obfuscation key business code, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting;

[0010] Obtaining the sensor type on the terminal device, and selecting a game matching the sensor type for the operator to execute according to the game verification logic obtained by the request;

[0011] The operator type is identified according to the operator's execution result of the game. If the execution result is passed, the operator type is identified as a human; if the execution result is failed, the operator type is identified as a machine, and the identified operator type is reported to the server in an encrypted manner through the requested data reporting.

[0012] On the other hand, an embodiment of the present invention provides a method for human-machine identification, comprising the following steps:

[0013] The server pushes a verification message to the terminal device that meets the active triggering verification policy through a real-time message channel, and the verification message is used to block the current operation of the operator on the terminal device;

[0014] Receiving a request for a dynamic obfuscated key business code sent by a terminal device, generating a dynamic obfuscated key business code according to the request and returning the code to the terminal device, wherein the dynamic obfuscated key business code includes game verification logic and encryption method for data reporting;

[0015] The receiving terminal device identifies and reports the operator type based on the dynamically obfuscated key business code.

[0016] On the other hand, an embodiment of the present invention provides a human-machine identification device, comprising:

[0017] A trigger unit, wherein the terminal device blocks the current operation of the operator according to the verification message from the server, or blocks the current operation of the operator according to the occurrence of a specific operation behavior;

[0018] Requesting a dynamic obfuscation unit to request a dynamic obfuscation key business code from a server, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting;

[0019] A game selection unit, used to obtain the sensor type on the terminal device, and select a game matching the sensor type for execution by the operator according to the game verification logic obtained by the request;

[0020] The human-machine identification unit is used to identify the operator type according to the operator's execution result of the game. If the execution result is passed, the operator type is identified as human; if the execution result is not passed, the operator type is identified as machine, and the identified operator type is reported to the server in an encrypted manner through the requested data reporting.

[0021] On the other hand, an embodiment of the present invention provides a human-machine identification device, comprising:

[0022] An active blocking unit, used to push a verification message to the terminal device through a real-time message channel to block the current operation of the operator on the terminal device;

[0023] A dynamic obfuscation code generation unit, used to receive a request for a dynamic obfuscation key business code sent by a terminal device, generate a dynamic obfuscation key business code according to the request and return it to the terminal device, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting;

[0024] The identification result receiving unit is used to receive the operator type identified and reported by the terminal device according to the dynamically obfuscated key business code.

[0025] The above technical scheme has the following beneficial effects: when suspicious users are screened out through data analysis and mining, the present invention adopts technical means to actively block the suspicious users' operations in the client or web environment, combines various sensors integrated on the mobile device, and uses small games driven by physical characteristics to perform game verification. Only by pressing, flipping, tilting and other physical operations on the device, the data generated by the sensor can complete the game verification. The game verification result depends on the return data of the sensor. The simulation cost of such operations is extremely high, so the technical effect of ensuring that only real-life behavior can pass is achieved to the greatest extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 A flowchart of a first implementation method of a human-machine identification method provided by an embodiment of the present invention;

[0028] Figure 2 A flow chart of a second implementation of a human-machine identification method provided by an embodiment of the present invention;

[0029] Figure 3 A schematic diagram of the structure of a first implementation of a human-machine identification device provided by an embodiment of the present invention;

[0030] Figure 4 A schematic diagram of the structure of a second implementation of a human-machine identification device provided by an embodiment of the present invention;

[0031] Figure 5 A flowchart of a human-machine identification method according to an application example of the present invention;

[0032] Figure 6 A flow chart of interaction between a server and a client of a human-machine identification method in an application example of the present invention;

[0033] Figure 7 The present invention is a flowchart of a server sending an active verification instruction in a human-machine identification method of an application example of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] In an embodiment of the present invention, a human-machine identification method is provided, such as Figure 1 As shown, the following steps are included:

[0036] S201: The terminal device blocks the current operation of the operator according to the verification message from the server, or blocks the current operation of the operator according to the occurrence of a specific operation behavior;

[0037] S202: Requesting a dynamic obfuscation key business code from a server, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting;

[0038] S203: Acquire the sensor type on the terminal device, and select a game matching the sensor type for the operator to execute according to the game verification logic obtained by the request;

[0039] S204: Identify the operator type according to the execution result of the operator on the game. If the execution result is passed, the operator type is identified as a human; if the execution result is failed, the operator type is identified as a machine, and the identified operator type is reported to the server in an encrypted manner through the requested data reporting.

[0040] In S201, Figure 1 As shown, the terminal device blocks the operator's current operation according to the verification message from the server (actively triggers verification), or blocks the operator's current operation according to the occurrence of specific operation behavior (passively triggers verification). The server sends an active verification instruction (verification message), that is, actively triggers the verification logic, which is that the background (server) actively pushes a message to the client or web page (terminal device) through the message channel to block the operation of the current environment. The active verification instruction is automatically issued by the background or manually issued by business-related personnel to trigger the verification logic. Furthermore, the passive triggering of the verification logic is, for example, in scenarios such as "voting", "liking", "commenting", etc., when it is necessary to verify whether the user is a cheating user, the verification logic is passively triggered after certain user behaviors occur, that is, user-triggered verification. Figure 5 Some of the user behaviors shown may be clicking a voting button, clicking a comment button, clicking a login button, clicking a like button, etc.

[0041] In S202, if Figure 6 As shown, the terminal device requests the server to dynamically obfuscate the key business code, and the dynamic obfuscation key business code includes the game verification logic and the encryption method of data reporting.

[0042] The terminal device requests the server for the dynamic obfuscation key business code, which is generated by the backend (server). This business code contains game-related logic and the encryption method when reporting data. This business code is difficult to read and is a piece of obfuscated encrypted js code that can be executed normally. The client or web page requests the server for the dynamic obfuscation key business code.

[0043] The encryption method and the secret required for the encryption will change dynamically each time it is obtained. The server will randomly select the encryption method to be used and then generate the required secret. The server records the corresponding relationship between the encryption method and secret used at that time and the current user, and uses the encryption method corresponding to the user to verify the data after receiving the reported data. In this case, even if the encryption is cracked this time, it will only affect the data reporting this time, and will not affect the overall verification effect.

[0044] The obfuscated code is configured through crontab in the background. At regular intervals, the javascript-obfuscator code obfuscation library is used to generate the base code, which is updated to the online server in real time through distributed key-value storage such as etcd. Then, when there is a real business request, after the specific encryption method is determined, the parameters required for encryption are written into the base code. In this way, a complete obfuscated code is generated to prevent brute force cracking.

[0045] The code implementation continuously receives input from sensor data to determine whether the game has passed. If passed, the data is reported to obtain a token for verification. If not, subsequent business behaviors cannot be continued, including voting, liking, commenting, logging in, etc.

[0046] The extremely poor readability of the obfuscated code, coupled with the constantly changing online data, greatly increases the difficulty of cracking.

[0047] In S203, the sensor type on the terminal device is obtained, and a game matching the sensor type is selected for execution by the operator according to the game verification logic obtained by the request.

[0048] The sensor types include: gravity sensor, acceleration sensor, direction sensor or gyroscope;

[0049] When the sensor type is a gravity sensor, the selected game is a click or press type operation game; when the sensor type is an acceleration sensor, a direction sensor or a gyroscope, the selected game is a tilt or flip type operation game.

[0050] In S204, the operator type is identified according to the operator's execution result of the game. If the execution result is passed, the operator type is identified as human; if the execution result is failed, the operator type is identified as machine, and the identified operator type is reported to the server in an encrypted manner through the requested data reporting.

[0051] Execute the game and get the execution result, which is pass or fail. Currently available sensors and games include: using a gravity sensor, the "flappy bird" game, click the screen to keep the bird in the air without falling to the ground, and complete the game after passing through n checkpoints. Using an acceleration sensor, a direction sensor or a gyroscope: the "ball maze" game, by tilting the device, the ball passes through the maze and enters the hole to complete the game.

[0052] After the game is successfully completed, the data is encrypted using the encryption method used when reporting the data, and the result of the game success is reported. At the same time, a token bound to the current user is obtained. The token is used to verify the verification result. After obtaining the token, the token can be used in subsequent actions to verify whether the verification is successful. The token has a validity period, and when the validity period expires, it needs to be verified again.

[0053] The game verification result depends on the return data of the sensor. The simulation cost of this type of operation is extremely high, which ensures to the greatest extent that only real-life behavior can pass. That is, by using device sensors to force real-life behavior, the reliability of anti-cheating is improved, and it can be highly certain that the user using the device is a human rather than a machine.

[0054] The above-mentioned terminal device can be a mobile device or a PC device.

[0055] Furthermore, for a very small number of devices that do not have any sensors, after confirming that the device does not have any usable sensors through manual customer service feedback, the corresponding device is added to the whitelist and can skip game verification later. The user's "manual feedback" also proves that the user using the device is not a machine.

[0056] The game verification result depends on the return data of the sensor. The simulation cost of this type of operation is extremely high, which ensures to the greatest extent that only real-life behavior can pass. That is, by using device sensors to force real-life behavior, the reliability of anti-cheating is improved, and it can be highly certain that the user using the device is a human rather than a machine.

[0057] The present invention combines various sensors integrated on mobile devices and performs verification through small games driven by physical characteristics, which ensures to the greatest extent that only real-life behaviors can pass; dynamic obfuscation encryption is performed on key business logic to prevent brute force cracking; and real-time message channels are used to push messages to actively block suspicious users' operations on the client or web page.

[0058] In the embodiment of the present invention, Figure 2 , and also provides a human-machine identification method, including:

[0059] S301: The server pushes a verification message to a terminal device that meets the active triggering verification policy through a real-time message channel, wherein the verification message is used to block the current operation of the operator on the terminal device;

[0060] like Figure 7 As shown, the server actively pushes messages to the client or web page through the message channel to block the operation of the client's current environment, and automatically issues or business-related personnel manually issue active verification instructions to trigger the verification logic.

[0061] S302: receiving a request for a dynamic obfuscated key business code sent by a terminal device, generating a dynamic obfuscated key business code according to the request and returning the code to the terminal device, wherein the dynamic obfuscated key business code includes game verification logic and encryption method for data reporting;

[0062] The encryption method includes an encryption method and a secret required for related encryption;

[0063] Generating a dynamic obfuscated key business code according to the request includes:

[0064] The server uses configuration commands to confuse the original business code at set time intervals to generate a base code, and updates and stores the generated base code in real time on the server, wherein the original business code includes game verification logic; when the server receives a request for dynamically obfuscated key business code sent by a terminal device, it randomly selects an encryption method and generates the secret required for the relevant encryption, and adds the encryption method corresponding to this request to the currently stored base code to generate the dynamically obfuscated key business code.

[0065] S303: The receiving terminal device identifies and reports the operator type according to the dynamically obfuscated key business code.

[0066] Dynamic obfuscation of key business codes includes game-related logic and encryption methods for data reporting. This business code is difficult to read and is a section of obfuscated and encrypted js code that can be executed normally.

[0067] In the process of the server generating the dynamic obfuscation key business code according to the request, after randomly selecting the encryption method and generating the secret required for the relevant encryption, the server records the correspondence between the encryption method of this data reporting and the terminal device; and when the server receives the operator type reported by the terminal device, the server determines the encryption method of this data reporting according to the recorded correspondence, and performs data verification on the operator type reported by the terminal device.

[0068] The encryption method and the secret required for the encryption will change dynamically each time it is obtained. The server will randomly select the encryption method to be used and then generate the required secret, record the corresponding relationship between the encryption method and secret used at that time and the current user, and use the encryption method corresponding to the user to verify the data after obtaining the reported data. In this case, even if the encryption is cracked this time, it will only affect the data reporting this time, and will not affect the overall verification effect.

[0069] After the game is successfully completed, the recognition result reported by the client is received, the reported result is verified, and the token bound to the current user is returned to the client.

[0070] In the embodiment of the present invention, Figure 3 , provides a human-machine identification device, which includes:

[0071] Triggering unit 101, the terminal device blocks the current operation of the operator according to the verification message from the server, or blocks the current operation of the operator according to the occurrence of a specific operation behavior;

[0072] Requesting a dynamic obfuscation unit 102 to request a dynamic obfuscation key business code from a server, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting;

[0073] The game selection unit 103 is used to obtain the sensor type on the terminal device and select a game matching the sensor type for the operator to execute according to the game verification logic obtained by the request;

[0074] The human-machine identification unit 104 is used to identify the operator type according to the operator's execution result of the game. If the execution result is passed, the operator type is identified as human; if the execution result is failed, the operator type is identified as machine, and the identified operator type is reported to the server in an encrypted manner through the requested data reporting.

[0075] The working method and principle of the human-machine identification device have been described in detail in the human-machine identification method embodiment, so they will not be repeated here.

[0076] In the embodiment of the present invention, Figure 4 , and also provides a human-machine identification device, which includes:

[0077] An active blocking unit 201 is used to push a verification message to a terminal device through a real-time message channel to block the current operation of the operator on the terminal device;

[0078] The dynamic obfuscation code generation unit 202 is used to receive a request for a dynamic obfuscation key business code sent by a terminal device, generate a dynamic obfuscation key business code according to the request and return it to the terminal device, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting;

[0079] The identification result receiving unit 203 is used to receive the operator type identified and reported by the terminal device according to the dynamically obfuscated key business code.

[0080] Also includes:

[0081] The log analysis unit is used to receive user log data sent by all terminal devices, analyze the received user log data, and filter out abnormal user log data;

[0082] The verification message sending unit is used to push the verification message to the corresponding terminal device according to the screened abnormal user log data.

[0083] The encryption method includes an encryption method and a secret required for related encryption;

[0084] The dynamic obfuscation code generation unit comprises:

[0085] A code obfuscation subunit, configured to generate a base code by obfuscating the original business code at set intervals through a configuration command, and to update and store the generated base code in a server in real time, wherein the original business code includes a game verification logic;

[0086] The dynamic generation sub-unit is used to randomly select an encryption method and generate the secret required for the relevant encryption when receiving a request for a dynamic obfuscated key business code sent by a terminal device, and add the encryption method corresponding to this request to the currently stored base code to generate the dynamic obfuscated key business code.

[0087] When the server receives a request from a terminal device for dynamically obfuscating a key business code, it randomly selects an encryption method and generates the secret required for the relevant encryption, and records the corresponding relationship between the encryption method reported this time and the terminal device;

[0088] When the server receives the operator type reported by the terminal device, it determines the encryption method for this data reporting according to the recorded corresponding relationship and performs data verification on the operator type reported by the terminal device.

[0089] The dynamic obfuscation of key business codes is performed through the server configuration crontab, and the javascript-obfuscator code obfuscation library is used to generate the base code, and the code is stored and updated in real time to the online server.

[0090] The dynamic generation subunit is further used to record the corresponding relationship between the encryption method reported this time and the terminal device after randomly selecting the encryption method and generating the secret required for the relevant encryption;

[0091] The identification result receiving unit is further used to determine the encryption method of the data reporting according to the corresponding relationship recorded by the dynamic generation subunit when receiving the operator type reported by the terminal device, and perform data verification on the operator type reported by the terminal device.

[0092] The working method and principle of the human-machine identification device have been described in detail in the human-machine identification method embodiment, so they will not be repeated here.

[0093] The game verification result depends on the return data of the sensor. The simulation cost of such operation is extremely high, which guarantees that only real-life behavior can pass to the greatest extent. That is, by using the device sensor, real-life behavior is forced to be generated, which improves the reliability of anti-cheating and can greatly ensure that the user using the device is a human rather than a machine. The above device can be a mobile device or a PC device.

[0094] Furthermore, for a very small number of devices that do not have any sensors, after confirming that the device does not have any usable sensors through manual customer service feedback, the corresponding device is added to the whitelist and can skip game verification later. The user's "manual feedback" also proves that the user using the device is not a machine.

[0095] The above technical solution of the embodiment of the present invention is described in detail below in conjunction with specific application examples. For technical details not introduced during the implementation process, please refer to the relevant description in the previous text.

[0096] Embodiment 1:

[0097] When processing the logs generated by the app on a daily basis, it is found that some specific devices or users only visit one page regularly, or the frequency of visits in a short period of time is too high. Such users are determined to be abnormal users. When the abnormal users browse the feed stream, the background automatically issues active verification instructions through the message channel or the business-related personnel manually issues active verification instructions. The app background receives the instructions, and the game verification pops up directly without the user triggering the verification behavior, blocking the user's current behavior. The front-end web page or client obtains the sensor on the device where the client or web browser is located. For example, when the sensor is a gravity sensor, the "flappy bird" game verification is performed. The user (human) clicks the screen to make the bird stay in the air without falling to the ground. After passing n checkpoints, the game is completed. Only after the verification is passed can the subsequent business process continue. If the game verification fails, the subsequent business process cannot be continued. Because the game requires the use of sensors, and the cost of simulating sensors by simulators is very high, so as long as the game can be completed, we can have a great deal of confidence that the user using the device is a human, not a machine.

[0098] Embodiment 2:

[0099] When voting on a project on a mobile client, such as the "Celebrity Influence List", there are vote-rigging companies that use simulators to swipe votes, thereby improving the rankings of certain options on the list. When you use the simulator to click "Vote" to swipe votes, a passive verification instruction will be issued. The background receives the verification instruction, performs game verification, and obtains the sensor on the device where the client or web browser is located. For example, when the sensor is an acceleration sensor, orientation sensor, or gyroscope, a "small ball maze" game verification is performed. The user tilts the device to make the ball pass through the maze and enter the hole to complete the game. The user can continue with the subsequent business process only after the verification is passed, because the game requires the use of sensors, and the cost of simulating sensors with simulators is very high. In this way, as long as the game can be completed, we can be very sure that the user using the device is a human being rather than a machine, which effectively prevents the behavior of swiping votes to increase the number of votes.

[0100] Embodiment 3:

[0101] When processing the logs generated by the app daily, it is found that some specific devices or users only visit one page fixedly, or the frequency of access in a short period of time is too high. Such users are determined to be abnormal users. When the abnormal user browses the feed stream, the verification module is actively triggered through the message channel, and the background automatically issues an active verification instruction or the business-related personnel manually issues an active verification instruction. The dynamic obfuscation key business code generation module receives the active verification instruction and generates a dynamic obfuscated key business code; the game verification module obtains the dynamic obfuscated key business code, without the user generating the behavior of triggering verification, calling the game verification, blocking the user's current behavior, and obtaining the sensor on the device where the client or web browser is located from the front page or client. For example, when the sensor is a gravity sensor, the "flappy bird" game verification is performed, and the user (person) clicks the screen to make the bird stay in the air without falling to the ground. After passing n checkpoints, the game is completed. Only after the verification is passed can the subsequent business process continue. If the game verification is not passed, the subsequent business process cannot be continued. Because the game requires the use of sensors, and the cost of simulating sensors by simulators is very high, as long as the game can be completed, we can have a great deal of confidence that the user using the device is a person rather than a machine.

[0102] Embodiment 4:

[0103] 1. Overall process

[0104] Actively trigger the verification logic or passively trigger the verification logic. First, obtain the key business code of dynamic obfuscation, then call the game. After the user completes the game, report the game completion information and assign a token to the current user. Subsequent user behavior can be verified by the token to see if it has passed the verification.

[0105] 2. Actively trigger verification logic

[0106] Actively push messages to the client or web page through the message channel to block any operations in the client's current environment and trigger the verification logic.

[0107] 3. Passive triggering verification logic

[0108] In certain scenarios such as "voting", "liking", and "commenting", when it is necessary to verify whether the user is a cheating user, the verification logic is passively triggered after the specific behavior occurs.

[0109] 4. Generation and implementation of key business codes with dynamic obfuscation

[0110] This section of business code contains game-related logic and the encryption method for data reporting.

[0111] The code implementation continuously receives input from sensor data to determine whether the game has passed. If passed, the data is reported to obtain a token for verification. If not, subsequent business activities cannot be continued.

[0112] The encryption method and the secret required for the encryption will change dynamically each time it is obtained. The server randomly selects the encryption method to be used and generates the required secret, records the corresponding relationship between the encryption method and secret used at that time and the current user, and uses the encryption method corresponding to the user to verify the data after obtaining the reported data. In this case, even if the encryption is cracked this time, it will only affect the data reporting this time, and will not affect the overall verification effect.

[0113] The obfuscated code is configured through crontab in the background (server). At regular intervals, the javascript-obfuscator code obfuscation library is used to generate the base code, which is updated to the online server in real time through distributed key-value storage such as etcd. Then, when there is a real business request, after the specific encryption method is determined, the parameters required for encryption are written into the base code, thus generating a complete obfuscated code.

[0114] The extremely poor readability of the obfuscated code, coupled with the constantly changing online data, greatly increases the difficulty of cracking.

[0115] 5. Game module

[0116] Most modern mobile devices contain one or more sensors. In the game module, we first obtain the sensors on the device where the client or web browser is located, and use different game verifications for the available sensors.

[0117] Currently available sensors and games:

[0118] a) Gravity sensor: In the "flappy bird" game, click the screen to keep the bird in the air without falling to the ground. After passing n checkpoints, the game is completed.

[0119] b) Acceleration sensor, orientation sensor, gyroscope: "Ball maze" game, by tilting the device, the ball passes through the maze and enters the hole to complete the game.

[0120] Because the game requires the use of sensors, and the cost of simulating sensors with simulators is very high, so as long as the game can be completed, we can be highly confident that the user using the device is a human and not a machine.

[0121] Furthermore, for a very small number of devices that do not have any sensors, after confirming that the device does not have any usable sensors through manual customer service feedback, the corresponding device is added to the whitelist and can skip game verification later. The user's "manual feedback" also proves that the user using the device is not a machine.

[0122] 6. Game result reporting and token acquisition

[0123] After the game is successfully completed, the data is encrypted using the encryption method mentioned in 4 when reporting data, the result of the successful game is reported, and the token bound to the current user is obtained at the same time.

[0124] 7. Use token verification to verify the results

[0125] After obtaining the token, you can use the token to verify whether the verification is successful in subsequent actions. The token has a validity period. When the validity period expires, you need to re-verify and obtain it.

[0126] It should be understood that the specific order or hierarchy of steps in the disclosed process is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process can be rearranged without departing from the scope of protection of the present disclosure. The attached method claims present the elements of the various steps in an exemplary order and are not intended to be limited to the specific order or hierarchy described.

[0127] In the above detailed description, various features are grouped together in a single embodiment to simplify the disclosure. This method of disclosure should not be interpreted as reflecting an intention that the embodiments of the claimed subject matter require more features than are clearly stated in each claim. On the contrary, as reflected in the appended claims, the invention is in a state of having less than all the features of the disclosed individual embodiments. Therefore, the appended claims are hereby expressly incorporated into the detailed description, with each claim standing on its own as a separate preferred embodiment of the invention.

[0128] The disclosed embodiments are described above to enable any person skilled in the art to implement or use the present invention. Various modifications of these embodiments are obvious to those skilled in the art, and the general principles defined herein may also be applied to other embodiments without departing from the spirit and scope of the present disclosure. Therefore, the present disclosure is not limited to the embodiments given herein, but is consistent with the broadest scope of the principles and novel features disclosed in this application.

[0129] The above description includes examples of one or more embodiments. Of course, it is impossible to describe all possible combinations of components or methods for the purpose of describing the above embodiments, but it should be recognized by those skilled in the art that the various embodiments may be further combined and arranged. Therefore, the embodiments described herein are intended to cover all such changes, modifications and variations that fall within the scope of protection of the appended claims. In addition, with respect to the term "comprising" used in the specification or claims, the word is covered in a manner similar to the term "including", just as "including," is explained as a transitional word in the claims. In addition, any term "or" used in the specification of the claims is intended to mean "non-exclusive or".

[0130] Those skilled in the art may also understand that the various illustrative logical blocks, units, and steps listed in the embodiments of the present invention may be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly demonstrate the interchangeability of hardware and software, the various illustrative components, units, and steps described above have generally described their functions. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementation should not be understood as exceeding the scope of protection of the embodiments of the present invention.

[0131] The various illustrative logic blocks or units described in the embodiments of the present invention can be implemented or operated by a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or any combination of the above. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any conventional processor, controller, microcontroller or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.

[0132] The steps of the method or algorithm described in the embodiments of the present invention can be directly embedded in hardware, a software module executed by a processor, or a combination of the two. The software module can be stored in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or other storage media of any form in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be arranged in an ASIC, and the ASIC can be arranged in a user terminal. Optionally, the processor and the storage medium can also be arranged in different components in the user terminal.

[0133] In one or more exemplary designs, the above functions described in the embodiments of the present invention can be implemented in hardware, software, firmware or any combination of the three. If implemented in software, these functions can be stored on a computer-readable medium, or transmitted in the form of one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media that facilitate the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by any general or special computer. For example, such computer-readable media can include but are not limited to RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store program codes in the form of instructions or data structures and other forms that can be read by general or special computers, or general or special processors. In addition, any connection can be appropriately defined as a computer-readable medium, for example, if the software is transmitted from a website site, server or other remote resource through a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wirelessly, such as infrared, wireless and microwave, it is also included in the defined computer-readable medium. The disk and disc include compact disk, laser disk, optical disk, DVD, floppy disk and blue-ray disk. Disks usually copy data magnetically, while discs usually copy data optically with lasers. The above combination can also be included in computer readable media.

[0134] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A human-machine identification method, characterized in that: The steps include: The terminal device blocks the current operation of the operator according to the verification message from the server, or blocks the current operation of the operator according to the occurrence of a specific operation behavior; Requesting a server for a dynamic obfuscation key business code, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting; Obtaining the sensor type on the terminal device, and selecting a game matching the sensor type for the operator to execute according to the game verification logic obtained by the request; Identify the operator type according to the execution result of the operator on the game, if the execution result is passed, identify the operator type as a human; if the execution result is not passed, identify the operator type as a machine, and report the identified operator type to the server in an encrypted manner of requesting data reporting; The dynamic obfuscation key business code is obtained by the following steps: The server generates a base code by obfuscating the original business code at set intervals through a configuration command, and updates and stores the generated base code in real time, wherein the original business code includes game verification logic; When the server receives a request for dynamically obfuscated key business codes sent by a terminal device, it randomly selects an encryption method and generates the secret required for the relevant encryption, and adds the encryption method corresponding to this request to the currently stored base code to generate the dynamically obfuscated key business code.

2. A human-machine identification method according to claim 1, characterized in that: The sensor types include: gravity sensor, acceleration sensor, direction sensor or gyroscope; When the sensor type is a gravity sensor, the selected game is a click or press type operation game; when the sensor type is an acceleration sensor, a direction sensor or a gyroscope, the selected game is a tilt or flip type operation game.

3. A human-machine identification method, characterized in that: The steps include: The server pushes a verification message to the terminal device that meets the active triggering verification policy through a real-time message channel, and the verification message is used to block the current operation of the operator on the terminal device; Receiving a request for a dynamic obfuscated key business code sent by a terminal device, generating a dynamic obfuscated key business code according to the request and returning the code to the terminal device, wherein the dynamic obfuscated key business code includes game verification logic and encryption method for data reporting; The receiving terminal device identifies and reports the operator type according to the dynamically obfuscated key service code; The encryption method includes an encryption method and a secret required for related encryption; Generating a dynamic obfuscated key business code according to the request includes: The server generates a base code by obfuscating the original business code at set intervals through a configuration command, and updates and stores the generated base code in real time, wherein the original business code includes game verification logic; When the server receives a request for dynamically obfuscated key business codes sent by a terminal device, it randomly selects an encryption method and generates the secret required for the relevant encryption, and adds the encryption method corresponding to this request to the currently stored base code to generate the dynamically obfuscated key business code.

4. A human-machine identification method according to claim 3, characterized in that: Before pushing the verification message to the terminal device that meets the active triggering verification strategy through the real-time message channel, the method further includes: Receive user log data sent by all terminal devices, analyze the received user log data, and filter out abnormal user log data; Determine the corresponding terminal device meets the active trigger verification strategy based on the screened abnormal user log data.

5. A human-machine identification method according to claim 3, characterized in that: Also includes: In the process of the server generating the dynamic obfuscated key business code according to the request, after randomly selecting an encryption method and generating the secret required for the relevant encryption, the corresponding relationship between the encryption method reported this time and the terminal device is recorded; as well as When the server receives the operator type reported by the terminal device, it determines the encryption method for this data reporting according to the recorded corresponding relationship and performs data verification on the operator type reported by the terminal device.

6. A human-machine identification device, characterized in that: include: A trigger unit, wherein the terminal device blocks the current operation of the operator according to the verification message from the server, or blocks the current operation of the operator according to the occurrence of a specific operation behavior; Requesting a dynamic obfuscation unit to request a dynamic obfuscation key business code from a server, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting; A game selection unit, used to obtain the sensor type on the terminal device, and select a game matching the sensor type for execution by the operator according to the game verification logic obtained by the request; A human-machine identification unit is used to identify the operator type according to the execution result of the operator on the game. If the execution result is passed, the operator type is identified as a human; if the execution result is not passed, the operator type is identified as a machine, and the identified operator type is reported to the server in an encrypted manner through the requested data reporting; The dynamically obfuscated key business code is generated by the server when it receives a request for the dynamically obfuscated key business code sent by the terminal device. Specifically, the server generates a base code by performing code obfuscation on the original business code at set intervals through configuration commands, and updates and stores the generated base code in real time. The server randomly selects an encryption method and generates the secret required for the relevant encryption, and adds the encryption method corresponding to this request to the currently stored base code to generate the dynamically obfuscated key business code; the original business code includes game verification logic.

7. A human-machine identification device according to claim 6, characterized in that: The sensor types include: gravity sensor, acceleration sensor, direction sensor or gyroscope; When the sensor type is a gravity sensor, the selected game is a click or press type operation game; when the sensor type is an acceleration sensor, a direction sensor or a gyroscope, the selected game is a tilt or flip type operation game.

8. A human-machine identification device, characterized in that: include: An active blocking unit, used to push a verification message to the terminal device through a real-time message channel to block the current operation of the operator on the terminal device; A dynamic obfuscation code generation unit, used to receive a request for a dynamic obfuscation key business code sent by a terminal device, generate a dynamic obfuscation key business code according to the request and return it to the terminal device, wherein the dynamic obfuscation key business code includes game verification logic and encryption method for data reporting; A recognition result receiving unit, used for receiving the operator type identified and reported by the terminal device according to the dynamic obfuscated key service code; The encryption method includes an encryption method and a secret required for related encryption; The dynamic obfuscation code generation unit comprises: A code obfuscation subunit, configured to generate a base code by obfuscating the original business code at set intervals through a configuration command, and to update and store the generated base code in real time, wherein the original business code includes a game verification logic; The dynamic generation sub-unit is used to randomly select an encryption method and generate the secret required for the relevant encryption when receiving a request for a dynamic obfuscated key business code sent by a terminal device, and add the encryption method corresponding to this request to the currently stored base code to generate the dynamic obfuscated key business code.

9. A human-machine identification device according to claim 8, characterized in that: Also includes: The log analysis unit is used to receive user log data sent by all terminal devices, analyze the received user log data, and filter out abnormal user log data; The verification message sending unit is used to push the verification message to the corresponding terminal device according to the screened abnormal user log data.

10. The human-machine identification device according to claim 8, characterized in that: The dynamic generation subunit is further used to record the corresponding relationship between the encryption method reported this time and the terminal device after randomly selecting the encryption method and generating the secret required for the relevant encryption; The identification result receiving unit is further used to determine the encryption method of the data reporting according to the corresponding relationship recorded by the dynamic generation subunit when receiving the operator type reported by the terminal device, and perform data verification on the operator type reported by the terminal device.

Images