User identity verification method and system

Abstract

The present application discloses a user identity authentication method and system, the method comprising: a risk control end receives a first request sent by a business backend; the first request is sent by the business backend in response to a business application of a target user submitted by a business frontend; the risk control end performs a risk assessment on the business application according to the first request and obtains an assessment result; when the assessment result is that the assessment fails, the risk control end determines the verification method of the target user; the risk control end sends a first message to the verification frontend so that the verification frontend obtains the identity information of the target user based on the verification method, the first information includes the verification method; the risk control end receives a second message sent by the verification backend, the second message includes a verification result, and the verification result is obtained by the verification backend verifying the identity information; the risk control end sends the verification result to the business backend. The implementation of the present application realizes the decoupling of the business module and the verification module, and improves the reuse rate of the business module and the verification module.

Description

Technical Field

[0001] The present application relates to the field of financial security, and in particular to a user identity authentication method and system. Background Art

[0002] In the financial Internet industry, after the business front end submits a business application to the business back end based on user operations, the business back end notifies the verification module. The verification module will first perform risk verification on the user's identity. Only when the verification is passed will the business back end respond to the business application submitted by the business front end. In this way, the security of the user's business transaction process can be improved.

[0003] However, although the above method can achieve secure verification of user identity during financial transactions, due to the tight coupling of the business module and the verification module, if you want to modify or add verification strategies for security verification, in addition to updating the verification module, you also need to spend a lot of manpower and time to maintain the business module. Summary of the invention

[0004] The embodiment of the present application discloses a user identity authentication method and system, which realizes the decoupling of the business module and the verification module, improves the reuse rate of the business module and the verification module, and improves the development efficiency of the system.

[0005] In the first aspect, the present application provides a user identity authentication method, which is applied to a system including a business front end, a verification front end, a business back end, a verification back end and a risk control end, the method including: the risk control end receives a first request sent by the business back end; the first request is sent by the business back end in response to a business application of a target user submitted by the business front end; the risk control end performs a risk assessment on the business application according to the first request to obtain an assessment result; when the assessment result is that the assessment fails, the risk control end determines a verification method for the target user; the risk control end sends first information to the verification front end so that the verification front end obtains the identity information of the target user based on the verification method, the first information including the verification method; the risk control end receives second information sent by the verification back end, the second information including the verification result, and the verification result is obtained by the verification back end verifying the identity information; the risk control end sends the verification result to the business back end.

[0006] In the above method, the communication between the business module (including the business front end and the business back end) and the verification module (including the verification front end and the verification back end) is realized through the risk control end, that is, the risk control end informs the verification front end of the verification method and the risk control end informs the business back end of the verification result of the verification back end, so that the verification module only needs to verify the user identity, and the business module only needs to process the business, which realizes the decoupling of the business module and the verification module, improves the reuse rate of the business module and the verification module, facilitates the update of the verification module, and improves the development efficiency of the system.

[0007] In a possible implementation of the first aspect, the first information also includes a first identifier determined by the risk control end, and the first identifier corresponds to the target user and the business application; the second information also includes the first identifier; after the risk control end receives the second information sent by the verification backend, and before the risk control end sends the verification result to the business backend, the method also includes: the risk control end adds a mapping relationship between the first identifier and the verification result to the mapping information; the risk control end receives a second request sent by the business backend, and the second request includes the first identifier; the second request is sent by the business backend in response to the business request submitted by the business frontend and the first identifier; accordingly, the risk control end sends the verification result to the business backend, including: the risk control end searches for the verification result corresponding to the first identifier from the mapping information; the risk control end sends the verification result corresponding to the first identifier to the business backend.

[0008] By implementing the above implementation method, the risk control end allocates a first identifier for the target user's business application, the first identifier corresponds to the target user and the target user's business application, and the risk control end performs a second identity authentication on the target user based on the first identifier, thereby improving the security of the interaction process.

[0009] In a possible implementation manner of the first aspect, the first identifier is a token.

[0010] By implementing the above implementation method and using token as the first identifier, the efficiency of allocating the first identifier is improved, which can effectively improve the security of the interaction process.

[0011] In a possible implementation manner of the first aspect, when the evaluation result is passed, the method further includes: sending third information to the business backend so that the business backend processes the business application, and the third information indicates that the evaluation result is passed.

[0012] By implementing the above implementation method, when the evaluation result is passed, the business backend can process the business application, which speeds up the response speed to the business application and improves the processing efficiency of the business application.

[0013] In the second aspect, the present application provides a device, which includes: a receiving unit, used to receive a first request sent by a business backend; the first request is sent by the business backend in response to a business application of a target user submitted by a business frontend; a processing unit, used to perform a risk assessment on the business application according to the first request to obtain an assessment result; the processing unit is also used to determine a verification method for the target user when the assessment result is that the assessment fails; a sending unit, used to send first information to the verification frontend so that the verification frontend obtains the identity information of the target user based on the verification method, the first information includes the verification method; the receiving unit is also used to receive second information sent by the verification backend, the second information includes a verification result, and the verification result is obtained by the verification backend verifying the identity information; the sending unit is also used to send the verification result to the business backend.

[0014] On the third aspect, the present application provides a system for user identity authentication, which includes a business front end, which is used to generate a business application based on the operation of a target user and send the business application to a business back end; the business back end is used to send a first request to a risk control end after receiving the business application, and the first request is used to instruct the risk control end to perform a risk assessment on the business application; the risk control end is used to perform a risk assessment on the business application to obtain an assessment result, and when the assessment result is that the assessment fails, determine the verification method of the target user; send first information to the verification front end, and the first information includes the verification method; the verification front end is used to obtain the identity information of the target user based on the verification method, and send the identity information to the verification back end; the verification back end is used to verify the identity information to obtain a verification result, and send second information to the risk control end, and the second information includes the verification result; the risk control end is also used to send the verification result to the business back end after receiving the second information; the business back end is also used to process the business application to obtain a processing result and send the processing result to the business front end when the verification result is a successful verification.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable medium stores a program code for execution by a device, wherein the program code includes instructions for executing the method in the first aspect or any possible implementation of the first aspect.

[0016] In a fifth aspect, an embodiment of the present application provides a device comprising a processor and a memory, wherein the processor and the memory are connected or coupled together via a bus; wherein the memory is used to store program instructions; and the processor calls the program instructions in the memory to execute the method in the first aspect or any possible implementation of the first aspect.

[0017] In a sixth aspect, an embodiment of the present application provides a computer software product, the computer program software product includes program instructions, and when the computer software product is executed by a device, the device executes the method in the first aspect or any possible embodiment of the first aspect. The computer software product can be a software installation package, and when it is necessary to use the method provided by any possible design of the first aspect, the computer software product can be downloaded and executed on the device to implement the method in the first aspect or any possible embodiment of the first aspect.

[0018] It can be seen that by implementing the embodiments of the present application, the communication between the business module (including the business front end and the business back end) and the verification module (including the verification front end and the verification back end) is realized through the risk control end, thereby realizing the decoupling of the business module and the verification module, improving the reuse rate of the business module and the verification module, facilitating the update of the verification module, and improving the development efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 It is an architectural diagram of a trading system;

[0021] Figure 2 It is an architecture diagram of a system provided by an embodiment of the present application;

[0022] Figure 3 is a flow chart of a user identity authentication method provided in an embodiment of the present application;

[0023] Figure 4 This is a flowchart of another user identity authentication method provided in an embodiment of the present application;

[0024] Figure 5 is a schematic diagram of a system provided in an embodiment of the present application;

[0025] Figure 6 It is a structural diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0027] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0028] It should be noted that the terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms of "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0029] See also Figure 1 , Figure 1 It is an architectural diagram of a transaction system, which includes a business module and a verification module, wherein the business module includes a business front end and a business back end. Under this system architecture, the transaction process is generally as follows: the business front end submits the business application generated by the user operation to the business back end, and after receiving the business application, the business back end sends a verification request to the verification module, and the verification request includes a verification method (for example, one or more of a transaction code, face verification, voice verification, etc.). After receiving the verification request, the verification module obtains the user's relevant information based on the verification method to perform a verification result, and returns the verification result to the business back end. When the verification result is that the verification is passed, the business back end responds to the business application, performs relevant processing on the business application to obtain the processing result, and sends the processing result to the business front end; when the verification result is that the verification is not passed, the business back end ignores the business application and sends the verification result to the business front end.

[0030] It can be seen from this that in the above process, the verification module and the business module are tightly coupled. When the verification method needs to be modified or added, not only the relevant code of the verification module needs to be updated, but also the relevant code of the business module related to the verification method needs to be updated. The update process is complicated, time-consuming and labor-intensive, which greatly reduces the development efficiency of the verification module.

[0031] See also Figure 2 , Figure 2 This is an architecture diagram of a system provided by the present application, which includes: a business front end, a business back end, a verification front end, a verification back end and a risk control end. Among them, the business front end and the business back end constitute a business module, and the verification front end and the verification back end constitute a verification module.

[0032] In the business module, the business front-end and the business back-end can communicate wirelessly; in the verification module, the verification front-end and the verification back-end can communicate wirelessly. The communication between the business module and the verification module can be achieved through the risk control end.

[0033] Among them, the business module is only used to process business. Specifically, the business front end is used to generate business applications based on user operations and submit the business applications to the business back end. The business back end is used to process the business applications accordingly when the user identity verification is passed, and return the processing results to the business front end. The risk control end is used to evaluate the risks of business applications generated based on user operations to determine whether to verify the user's identity and the verification method (when it is determined that the user's identity needs to be verified). In some possible embodiments, the risk control end is also used to receive the verification results sent by the verification module and return the verification results to the business back end of the business module, and the verification module performs user identity verification based on the verification method determined by the risk control end. The verification module is used to verify the user's identity. Specifically, the verification front end collects the user's identity information based on the verification method determined by the risk control end and sends the collected user's identity information to the verification back end. The verification module is used to verify the received user's identity information, obtain the verification result, and return the verification result to the risk control end.

[0034] It should be noted that the business front end and the verification front end are located on the first server, and the server where the business back end, the verification back end and the risk control end are located is different from the first server. For example, in one specific implementation, the business back end, the verification back end and the risk control end are all located on the second server. In another specific implementation, the business back end and the verification back end are located on the second server, and the risk control end is located on the third server. However, any two of the business back end, the verification back end and the risk control end can be located on the same server or on different servers, and this application does not make specific restrictions. It can be seen from this that the risk control end, the business back end, and the verification back end have a variety of deployment methods, which makes the deployment of the risk control end, the business back end, and the verification back end diverse.

[0035] Based on the system architecture described above, the following describes a user identity authentication method provided by this application. Figure 3 , Figure 3 This is a flowchart of a user identity authentication method provided by the present application, which method includes but is not limited to the following steps:

[0036] S101. The service front end generates a service application in response to an operation of a target user.

[0037] In the embodiment of the present application, the target user performs corresponding operations on the display interface of the user device to select the corresponding service, and the service front end of the user device detects the target user's operation of selecting the service, and generates a service application in response to the operation. The service application includes the target user's identity document (ID), the user device identifier, the service identifier and the service content, and the service identifier corresponds to the service one by one. The service includes any one of account login, transfer, fund purchase, fund redemption, points exchange, phone charge recharge, water and electricity payment, credit card repayment, etc., which is not specifically limited in the present application.

[0038] For example, the target user clicks the "transfer" button of a bank app on the display interface of the user device (e.g., mobile phone, tablet, smart watch, etc.) and sets the transfer amount to RMB 50,000, the other party's account to account B, and the transfer method to real-time arrival. In response to the operation, the business front end in the user device generates a business application, which includes the target user ID, the user device identifier, the identifier corresponding to the transfer business, and the transfer content, wherein the conversion content is "RMB 50,000 is transferred to account B and arrives in real time". It should be noted that the target user's operation can also be sliding, inputting, selecting and dragging, etc.

[0039] S102: The service front end sends a service application to the service back end.

[0040] In the embodiment of the present application, the service front end sends the generated service application to the service back end. Correspondingly, the service back end receives the service application sent by the service front end.

[0041] S103: The business backend sends a first request to the risk control end.

[0042] In an embodiment of the present application, after the business backend receives the business application from the business frontend, it sends a first request to the risk control end. The first request is used to instruct the risk control end to perform a risk assessment on the target user's business application to determine whether the target user's business application requires user identity verification and the verification method (if user identity verification is required).

[0043] The first request at least includes service application information, such as a target user ID, a user equipment identifier, and a service identifier.

[0044] S104. The risk control end performs a risk assessment on the business application and obtains the assessment result.

[0045] Specifically, after receiving the first request, the risk control terminal includes the target user ID, user device identifier, service identifier, and service content. The risk control terminal obtains relevant information of the target user ID from a pre-established risk assessment database, such as the target user ID's commonly used devices, credit score, user operation habit information, etc., and performs a risk assessment on the target user's service application based on the relevant information of the target user ID to obtain an assessment result. The assessment result includes one of a passed assessment and a failed assessment.

[0046] It should be noted that when the evaluation result is passed, it means that the business application of the target user has no risk or low risk; when the evaluation result is failed, it means that the business application of the target user has certain risks.

[0047] In a specific implementation, the risk control end evaluates the risk of the business application based on the relevant information of the target user ID to obtain the score of the business application, and then obtains the evaluation result according to the score of the business application. The score of the business application can be a weighted sum of the first parameter, the second parameter and the third parameter, wherein the first parameter is used to indicate the stability of the user device used by the target user. When the user device identifier in the business application does not belong to the commonly used device of the target user ID, the first parameter is recorded as 0. When the user device identifier in the business application belongs to the commonly used device of the target user ID, the first parameter is expressed as the ratio of 1 to the number of commonly used devices of the target user ID. The larger the first parameter, the higher the stability of the user device; the second parameter is used to indicate the credit of the target user. The second parameter can be the ratio of the credit score of the target user to the preset credit threshold. The larger the second parameter, the greater the credit of the target user; the third parameter is used to indicate the operation similarity of the target user. The third parameter can be calculated based on the business content and the user operation habit information of the target user. The larger the third parameter, the more similar the business content is to the historical operation habit. It can be seen that the higher the score of the business application, the lower the risk of the business application. Therefore, when the score of the business application is greater than or equal to the first threshold, the evaluation result is determined to be passed; when the score of the business application is less than the first threshold, the evaluation result is determined to be failed. It should be noted that the first threshold is determined by manual experience.

[0048] In some possible embodiments, the risk control end can use an artificial intelligence model to evaluate the risk of a business application based on relevant information of the target user ID to output the risk probability corresponding to the business application. The higher the risk probability corresponding to the business application, the greater the risk of the business application. In this case, when the risk probability corresponding to the business application is less than or equal to the second threshold, the evaluation result is determined to be a passed evaluation; when the risk probability corresponding to the business application is greater than the second threshold, the evaluation result is determined to be a failed evaluation. It should be noted that the second threshold is determined by artificial experience. The artificial intelligence model can be a random forest algorithm, a convolutional neural network, a support vector machine, etc., which is not specifically limited in this application.

[0049] S105. The risk control end determines whether the assessment result is "assessment passed".

[0050] In the embodiment of the present application, the risk control end determines whether the evaluation result is "evaluation passed". When the evaluation result is "evaluation passed", S106 is executed; when the evaluation result is "evaluation failed", S109 is executed.

[0051] S106. The risk control end sends the third information to the business backend.

[0052] In the embodiment of the present application, when the evaluation result is "evaluation passed", the risk control end sends the third information to the business backend, and the third information is used to indicate that the evaluation result is "evaluation passed". Correspondingly, the business backend receives the third information.

[0053] S107: The business backend processes the business application and obtains a processing result.

[0054] In the embodiment of the present application, after the business backend receives the third information, in response to the business application submitted by the business frontend, the business backend processes the business application and obtains a processing result.

[0055] For example, if the business application submitted by the business front end is a business application for transfer, used to instruct to transfer RMB 50,000 from local account A to account B, when the business back end receives the third information sent by the risk control end, the third information indicates that the risk assessment result of the business application is passed. Only then will the business back end process the business application submitted by the business front end, that is, transfer RMB 50,000 from local account A to account B, and send the processing result to the business front end. The processing result is used to indicate that this business application has been successfully processed.

[0056] S108: The business backend sends the processing result to the business frontend.

[0057] In an embodiment of the present application, after obtaining the processing result, the business backend sends the processing result to the business frontend, and the processing result is used to indicate that the business application has been successfully processed.

[0058] S109: The risk control end determines the verification method for the target user.

[0059] In the embodiment of the present application, when the evaluation result is that the evaluation fails, it means that the target user's business application has certain risks and needs to undergo subsequent identity verification, so the risk control end determines a verification method for the target user. The verification method includes at least one of fingerprint verification, face verification, transaction code verification, iris verification, and voice verification.

[0060] In a specific implementation, the risk control end can determine the verification method for the target user based on the score of the business application. For example, based on the evaluation method provided in S104, the score of the business application can be obtained, and the score of the business application is less than the first threshold value. The risk control end can determine at least one verification method for the target user based on the score of the business application, and the lower the score of the business application, the more verification methods the risk control end determines for it. In some possible embodiments, the risk control end can also set a level for each verification method in advance. The higher the level, the higher the credibility of the verification method. For example, the level setting can be: iris verification> face verification> voice verification, etc. When the score of the business application is lower, the risk control end can select one or more verification methods with a higher level as the verification method for the target user.

[0061] For example, when the score of the business application is less than the first threshold, the lower the score of the business application, the greater the risk of the business application. If the score of the business application is p1, which is less than the first threshold, the verification method of the target user determined by the risk control end is transaction code verification; if the score of the business application is p2, and p2 is less than p1, the verification method of the target user determined by the risk control end includes: transaction code verification and face verification.

[0062] In another specific implementation, the risk control end may determine a verification method for the target user based on the risk probability of the business application. For example, based on the evaluation method provided in S104, the risk probability of the business application can be obtained, and the risk probability of the business application is greater than the second threshold value. The risk control end may determine at least one verification method for the target user based on the risk probability of the business application, and the higher the risk probability of the business application, the more verification methods the risk control end determines for it.

[0063] S110. The risk control end sends first information to the verification front end.

[0064] In the embodiment of the present application, after the risk control end determines the verification method of the target user, the risk control end sends the first information to the verification front end, where the first information includes the verification method. Correspondingly, the verification front end receives the first information from the risk control end.

[0065] In some possible embodiments, since the business front end and the verification front end are located in the same server, after the risk control end determines the verification method of the target user, the risk control end can send first information to the business back end, and the first information includes the verification method. After the business back end receives the first information, the business back end sends the first information to the business front end. After the business front end receives the first information, the business front end invokes the verification front end so that the verification front end obtains the identity information of the target user based on the verification method.

[0066] S111. The verification front end obtains the identity information of the target user based on the verification method.

[0067] In the embodiment of the present application, the verification front end obtains the identity information of the target user based on the verification method. The identity information includes at least one of a face image, fingerprint information, transaction code, iris information, and voice information. It can be understood that the identity information of the target user corresponds to the verification method.

[0068] For example, when the verification method is transaction code verification, the verification front end retrieves the transaction code input interface and displays it on the user device to prompt the target user to enter the transaction code (e.g., password). Thus, the verification front end can obtain the transaction code of the target user.

[0069] For example, when the verification method is transaction code verification and face verification, in addition to calling the transaction code input interface to obtain the transaction code of the target user, the verification front end also turns on the front camera of the user's device. Accordingly, a photo frame is displayed on the display interface of the user's device to prompt the target user to align his face with the photo frame. The verification front end can obtain the face image of the target user.

[0070] S112: The verification front end sends identity information to the verification back end.

[0071] In the embodiment of the present application, the verification front end sends the collected identity information of the target user to the verification back end so that the verification back end verifies the identity information. Correspondingly, the verification back end receives the identity information sent by the verification front end.

[0072] S113, verify the identity information of the backend to obtain the verification result.

[0073] In an embodiment of the present application, after the verification backend receives the identity information sent by the verification frontend, the verification backend compares the identity information with the associated information in a preset verification comparison database. If the two are consistent, the verification result is verification passed; if the two are inconsistent, the verification result is verification failed.

[0074] It should be noted that there are multiple libraries in the verification comparison database, for example, face comparison library, fingerprint comparison library, transaction code comparison library, iris comparison library, etc. The verification backend can select the corresponding library from the verification comparison database according to the verification method to verify the identity information and obtain the verification result.

[0075] For example, if the identity information is a facial image, the verification backend obtains the standard facial image of the target user ID from the facial comparison library in the verification and comparison database, and then uses an algorithm (for example, a neural network algorithm) to calculate the degree of match between the facial image collected by the verification front end and the standard facial image. When the degree of match is greater than or equal to a third threshold, it is determined that the facial image and the standard facial image are consistent, so the verification result is verification passed; when the degree of match is less than the third threshold, it is determined that the facial image and the standard facial image are inconsistent, so the verification result is verification failed.

[0076] S114. The verification backend sends the second information to the risk control end.

[0077] In the embodiment of the present application, after obtaining the verification result, the verification backend sends the second information to the risk control end, wherein the second information includes the verification result. Accordingly, the risk control end receives the second information sent by the verification backend.

[0078] S115. The risk control end sends the verification result to the business backend.

[0079] S116. When the verification result is that the verification is passed, the business backend processes the business application to obtain a processing result.

[0080] In the embodiment of the present application, when the verification result is that the verification is passed, the business backend processes the business application to obtain a processing result. The specific steps can be referred to the relevant description of S107, which will not be repeated here.

[0081] In one embodiment of the present application, when the verification result is verification failure, the service backend sends a prompt message to the service frontend, and the prompt message is used to indicate that the service application request of the target user has failed.

[0082] S117, the business backend sends the processing result to the business frontend. For details of this step, please refer to the relevant description of S108, which will not be repeated here.

[0083] It can be seen that by implementing the embodiments of the present application, the communication between the business module (including the business front end and the business back end) and the verification module (including the verification front end and the verification back end) is realized through the risk control end, thereby realizing the decoupling of the business module and the verification module, improving the reuse rate of the business module and the verification module, facilitating the update of the verification module, and improving the development efficiency of the system.

[0084] See also Figure 4 , Figure 4This is a flowchart of another user identity authentication method provided in an embodiment of the present application. It should be noted that: Figure 4 The embodiments may be independent of Figure 3 Embodiments may also be Figure 3 Supplement to the embodiment. The method includes but is not limited to the following steps:

[0085] S201: The service front end generates a service application in response to the operation of the target user. For details of this step, please refer to the relevant description of S101, which will not be repeated here.

[0086] S202: The service front end sends a service application to the service back end. For details of this step, please refer to the relevant description of S102, which will not be repeated here.

[0087] S203: The business backend sends a first request to the risk control end. For details of this step, please refer to the relevant description of S103, which will not be repeated here.

[0088] S204: The risk control terminal performs risk assessment on the business application and obtains the assessment result. For details of this step, please refer to the relevant description of S104, which will not be repeated here.

[0089] S205. The risk control end determines whether the assessment result is "assessment passed".

[0090] In the embodiment of the present application, the risk control end determines whether the evaluation result is "evaluation passed". When the evaluation result is "evaluation passed", S206 is executed; when the evaluation result is "evaluation failed", S209 is executed.

[0091] S206: The risk control end sends the third information to the business backend. For details of this step, please refer to the relevant description of S106, which will not be repeated here.

[0092] S207: The business backend processes the business application and obtains a processing result. For details of this step, please refer to the relevant description of S107, which will not be repeated here.

[0093] S208, the business backend sends the processing result to the business frontend. For details of this step, please refer to the relevant description of S108, which will not be repeated here.

[0094] S209: The risk control end determines the verification method and the first identifier of the target user.

[0095] In an embodiment of the present application, when the evaluation result is that the evaluation fails, the risk control end needs to determine the verification method of the target user. For the specific method of the risk control end determining the verification method of the target user, please refer to the relevant description of S109. For the sake of brevity of the specification, it will not be repeated here.

[0096] In addition, when the evaluation result is that the evaluation fails, the risk control end also needs to determine the first identifier corresponding to the target user's business application. In a specific implementation, the risk control end assigns a first identifier to the target user's business application, and the first identifier corresponds to the target user and the business application. In other words, the first identifier uniquely represents the target user and the business application.

[0097] In some possible embodiments, the first identifier may be a token, which may be a string of characters generated by the risk control end, so that the business front end can carry the token when resubmitting the current business application. In another possible embodiment, the first identifier may also be a random number generated by the risk control end to uniquely represent the target user and the target user's business application.

[0098] S210. The risk control end sends the first information to the verification front end via the business back end and the business front end.

[0099] In the embodiment of the present application, different from S110, the first information includes not only the verification method but also the first identifier. Specifically, since the business front end and the verification front end are located in the same server, the risk control end sends the first information to the business back end, and the first information includes the verification method and the first identifier. After the business back end receives the first information, the business back end sends the first information to the business front end. In response to the first information, the business front end invokes the verification front end so that the verification front end obtains the identity information of the target user based on the verification method.

[0100] S211, the verification front end obtains the identity information of the target user based on the verification method. For details of this step, please refer to the relevant description of S111, which will not be repeated here.

[0101] S212: The verification front end sends the identity information and the first identifier to the verification back end.

[0102] S213: Verify the back-end identity information to obtain a verification result. For details of this step, please refer to the relevant description of S113, which will not be repeated here.

[0103] S214. The verification backend sends the second information to the risk control end and the verification frontend respectively.

[0104] In the embodiment of the present application, after the verification backend obtains the verification result, the verification backend sends the second information to the risk control end and the verification frontend respectively. Different from S114, the second information includes the first identifier in addition to the verification result. The verification backend sends the second information to the risk control end in order to synchronize the verification result to the risk control end, and the verification backend sends the second information to the verification frontend in order to feed back the verification result to the verification frontend to reawaken the business frontend. Accordingly, the risk control end receives the second information from the verification backend, and the verification frontend receives the second information from the verification backend.

[0105] It should be noted that after the verification front end receives the second information sent by the verification back end, the verification process initiated by the verification front end is completed. Since the verification front end and the business front end are located on the same server, the business front end is re-awakened.

[0106] In some possible embodiments, in addition to sending the second information to the verification backend and the verification frontend at the same time, the verification backend can also first send the second information to the risk control end and then send the second information to the verification frontend. This application does not make specific limitations.

[0107] S215. The risk control end adds the mapping relationship between the first identifier and the verification result to the mapping information.

[0108] In the embodiment of the present application, upon receiving the second information sent by the verification backend, the risk control end adds the mapping relationship between the first identifier in the second information and the verification result in the second information to the mapping information, wherein the mapping information records the historically assigned identifier and the verification result of the target user corresponding to the identifier.

[0109] In some possible embodiments, the mapping information may be a mapping information table. For example, assuming that the first identifier in the second information is "a53r2e" and the verification result in the second information is "verification passed", the mapping relationship "a53re-verification passed" is added to the mapping relationship table shown in Table 1. As shown in Table 1, the two mapping relationships listed in Table 1, one "a53r2e-verification passed" is just added, and the other "qwe243-verification failed" has been added historically, where "qwe243" is an identifier historically assigned by the risk control end, which corresponds to a certain user and a certain business application of the user, and "verification failed" is the verification result of the user corresponding to "qwe243".

[0110] Table 1

[0111] Serial number Logo Verify the results 1 qwe243 Verification failed 2 a53r2e Verification passed … … …

[0112] S216: The service front end sends the service application and the first identifier to the service back end.

[0113] In an embodiment of the present application, after the business front end is re-awakened, the business front end determines that the verification front end has received the second information. If the business application does not receive a response from the business back end, the business front end re-sends the business application to the business back end, and this time the transmission also carries the first identifier.

[0114] S217: The business backend sends a second request to the risk control end.

[0115] In an embodiment of the present application, after receiving the business application and the first identifier sent by the business front end, the business back end sends a second request to the risk control end, where the second request includes the first identifier and is used to instruct the risk control end to determine the verification result corresponding to the first identifier.

[0116] S218: The risk control end searches for the verification result corresponding to the first identifier from the mapping information.

[0117] In an embodiment of the present application, after the risk control end receives the second request sent by the business backend, since the mapping information records the identifier historically assigned by the risk control end and the verification result of the target user corresponding to the identifier, the verification result corresponding to the first identifier can be found from the mapping information based on the first identifier.

[0118] For example, assuming that the first identifier in the second request is "a53r2e", the mapping information is the mapping relationship table shown in Table 1 above, and it is found from Table 1 that the verification result corresponding to the first identifier "a53r2e" is "verification passed".

[0119] In some possible embodiments, the risk control end fails to find the first identifier from the mapping information (for example, the first identifier is maliciously tampered with during the process of the business front end sending the first identifier). In this case, the risk control end sends fourth information to the business back end, and the fourth information is used to indicate that the first identifier is invalid. Accordingly, after the business back end receives the fourth information sent by the risk control end, the business back end sends a prompt message to the business front end, and the prompt message is used to indicate that the business application request of the target user has failed.

[0120] S219: The risk control end sends the verification result corresponding to the first identifier to the business backend.

[0121] S220: When the verification result corresponding to the first identifier is verification passed, the business backend processes the business application to obtain a processing result.

[0122] In the embodiment of the present application, when the verification result corresponding to the first identifier is verification passed, the business backend processes the business application to obtain a processing result. For specific steps, reference may be made to the relevant description of S107, which will not be repeated here.

[0123] In an embodiment of the present application, when the verification result corresponding to the first identifier is verification failure, the service backend sends a prompt message to the service frontend, and the prompt message is used to indicate that the service application request of the target user fails.

[0124] S221, the business backend sends the processing result to the business frontend. For details of this step, please refer to the relevant description of S108, which will not be repeated here.

[0125] It can be seen that by implementing the embodiment of the present application, the communication between the business module (including the business front end and the business back end) and the verification module (including the verification front end and the verification back end) is realized through the risk control end, the decoupling of the business module and the verification module is realized, the reuse rate of the business module and the verification module is improved, the update of the verification module is facilitated, and the development efficiency of the system is improved. In addition, the risk control end performs a second identity verification on the target user based on the identifier assigned to the user, which improves the security of the interaction process.

[0126] See also Figure 5 , Figure 5 1 is a schematic diagram of a system provided in an embodiment of the present application, wherein the system 100 includes at least a plurality of servers, and the minimum number of the plurality of servers is 2, and the maximum number of the plurality of servers is 4. The above-mentioned verification front end, business front end, business back end, verification back end and risk control end can be respectively deployed in the servers of the system 100, wherein the business front end and the verification front end need to be deployed in the same server.

[0127] It is worthy to take the case where the number of multiple servers is 4 as an example, but the present application does not limit the number of multiple servers to only 4. When the number of multiple servers is 4, the system 100 includes server 1, server 2, server 3 and server 4. Among them, the above-mentioned business front end and verification front end can be deployed in server 1, the business back end can be deployed in server 2, the verification back end can be deployed in server 3, and the risk control end can be deployed in server 4. It should be noted that server 1 where the business front end and verification front end are located is a user device, such as a mobile phone, tablet, notebook and other devices that can support wireless communication, and server 2, server 3 and server 4 can all be edge computers or service center computers, and the present application does not make specific limitations.

[0128] In some possible embodiments, if the system 100 includes only two servers, for example, server 1 and server 2, in this case, the above-mentioned business front end and verification front end can be deployed in server 1, and the business back end, verification back end and risk control end can all be deployed in server 2.

[0129] In some possible embodiments, if the number of servers included in system 100 is 3, for example, server 1, server 2 and server 3, wherein the above-mentioned business front end and verification front end can be deployed in server 1, and any two of the business back end, verification back end and risk control end can be deployed in server 2. It is assumed that the business back end and verification back end are deployed in server 2, and the risk control end is deployed in server 3.

[0130] See also Figure 6 , Figure 630 is a schematic diagram of a computing device provided in an embodiment of the present application. The computing device 30 at least includes a processor 301, a memory 302, a receiver 303 and a transmitter 304. The receiver 303 and the transmitter 304 can also be replaced by a communication interface for providing information input and / or output to the processor 301. Optionally, the memory 302, the receiver 303, the transmitter 304 and the processor 301 are connected or coupled via a bus. The computing device 30 can be Figure 5 It is assumed that only the risk control terminal is deployed on the computing device 30 for exemplary description.

[0131] The receiver 303 is used to receive the first request sent by the service backend and the verification result sent by the verification backend. In some possible embodiments, the receiver 303 is also used to receive the second information sent by the verification backend and the second request sent by the service backend. The transmitter 304 is used to send the third information and the verification result to the service backend. The receiver 303 and the transmitter 304 may include an antenna and a chipset for communicating with other entity devices directly or through an air interface. The transmitter 304 and the transceiver 303 constitute a communication module, and the communication module can be configured to receive and send information according to one or more other types of wireless communications (e.g., protocols), such as Bluetooth, IEEE 802.11 communication protocol, cellular technology, Worldwide Interoperability for Microwave Access (WiMAX) or LTE (Long Term Evolution), ZigBee protocol, Dedicated Short Range Communications (DSRC) and RFID (Radio Frequency Identification) communication, etc.

[0132] The specific implementation of each operation performed by the processor 301 can refer to the specific operations in the above method embodiment, such as risk assessment of the business application, determination of the verification method of the target user, determination of the first identifier, and recording the correspondence between the first identifier and the verification result. The processor 301 can be composed of one or more general-purpose processors, such as a central processing unit (CPU), or a combination of a CPU and a hardware chip. The above hardware chip can be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above PLD can be a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0133] The memory 302 may include a volatile memory, such as a random access memory (RAM); the memory 302 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); the memory 302 may also include a combination of the above types. The memory 302 may store programs and data, wherein the stored programs include: risk assessment programs (e.g., artificial intelligence algorithms, etc.), judgment programs, etc., and the stored data include: a first identifier, a target user ID, relevant information of a business application, etc. The memory 302 may exist independently or may be integrated into the processor 301.

[0134] In some possible embodiments, when the computing device 30 is the above Figure 5 When the server of the business front end and the verification front end is deployed in the computing device 30, the programs stored in the memory 302 of the computing device 30 include: identity information collection program, business application generation program, etc., and the stored data include: first identification, target user ID, identity information, etc. It should be noted that the programs and data stored in the memory 302 of the computing device 30 are related to the modules deployed on the computing device 30, and this application does not make specific limitations.

[0135] In some possible embodiments, when the computing device 30 is a server deployed with a service front end and a verification front end, the computing device 30 further includes a display screen 305 for displaying a service selection interface and an interface for displaying the verification front end to collect the identity information of the target user. The display screen 305 can be a liquid crystal display (LCD), an organic or inorganic light-emitting diode (OLED), an active matrix organic light-emitting diode panel (AMOLED), etc.

[0136] In the embodiment of the present application, when the computing device 30 is only Figure 5 When only the risk control end server is deployed, the computing device 30 is used to implement the above Figure 3 The method and Figure 4 The method of the risk control end described in the embodiment.

[0137] An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any method recorded in the above method embodiments.

[0138] The embodiment of the present application also provides a computer program product, the computer program product includes a non-transitory computer-readable storage medium storing a computer program, the computer program is operable to cause a computer to execute some or all of the steps of any method described in the method embodiment. The computer program product may be a software installation package, and the computer includes an electronic device.

[0139] It should be noted that, a person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0140] In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0141] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0142] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0143] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0144] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, or all or part of the technical solution. The computer software product is stored in a storage medium, including several instructions to enable a device (which can be a personal computer, server, or network device, robot, single-chip microcomputer, chip, robot, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories, random access memories, magnetic disks or optical disks.

[0145] The above is a detailed introduction to the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A system for user identity authentication, It is characterized in that The system includes: a business front end, which is used to generate a business application based on the operation of a target user and send the business application to a business back end; the business back end is used to send a first request to a risk control end after receiving the business application, wherein the first request is used to instruct the risk control end to perform a risk assessment on the business application; the risk control end implements communication between a business module and a verification module; is used to perform a risk assessment on the business application to obtain an assessment result, and when the assessment result is that the assessment fails, determines the verification method of the target user; sends first information to the verification front end, wherein the first information includes the verification method; the verification front end is used to obtain the identity information of the target user based on the verification method, and send the identity information to the verification back end; the verification back end is used to verify the identity information to obtain a verification result, and send second information to the risk control end, wherein the second information includes the verification result; after receiving the second information, the risk control end is also used to send the verification result to the business back end; the business back end is also used to process the business application to obtain a processing result when the verification result is that the verification is successful, and send the processing result to the business front end.

2. The system according to claim 1, It is characterized in that The business front end and the verification front end are located on a first server, and the business back end, the verification back end and the risk control end are located on a second server.

3. The system according to claim 2, It is characterized in that The first information also includes a first identifier determined by the risk control end, and the first identifier corresponds to the target user and the business application; the second information also includes the first identifier; after receiving the second information, the risk control end is also used to add a mapping relationship between the first identifier and the verification result to the mapping information; after obtaining the verification result, the verification backend is also used to send the second information to the verification frontend; when the business frontend determines that the verification frontend has received the second information and the business application has not received a response from the business backend, it is also used to send the business application and the first identifier to the business backend; after receiving the business application and the first identifier, the business backend is also used A second request is sent to the risk control end, wherein the second request includes the first identifier; the risk control end is also used to send the verification result to the business backend, specifically including: the risk control end searches for the verification result corresponding to the first identifier from the mapping information according to the second request, and sends the verification result corresponding to the first identifier to the business backend; the business backend is also used to process the business application to obtain a processing result when the verification result is successful, and send the processing result to the business frontend, specifically including: the business backend processes the business application to obtain a processing result when the verification result corresponding to the first identifier is successful, and sends the processing result to the business frontend.

4. The system according to claim 3, It is characterized in that The first identifier is a token.

5. A system according to any one of claims 1 to 4, It is characterized in that The risk control end is also used to send third information to the business backend when the evaluation result is passed, and the third information indicates that the evaluation result is passed; the business backend is also used to respond to the business application after receiving the third information, process the business application to obtain the processing result, and send the processing result to the business front end.

6. A user identity verification method, It is characterized in that Applied to a system including a business front end, a verification front end, a business back end, a verification back end and a risk control end, the method includes: the risk control end receives a first request sent by the business back end; the first request is sent by the business back end in response to a business application of a target user submitted by the business front end; the risk control end performs a risk assessment on the business application according to the first request to obtain an assessment result; when the assessment result is that the assessment fails, the risk control end determines a verification method for the target user; the risk control end sends first information to the verification front end so that the verification front end obtains the identity information of the target user based on the verification method, the first information including the verification method; the risk control end receives second information sent by the verification back end, the second information including a verification result, the verification result being obtained by the verification back end verifying the identity information; the risk control end sends the verification result to the business back end.

7. The method according to claim 6, It is characterized in that The business front end and the verification front end are located on a first server, and the business back end, the verification back end and the risk control end are located on a second server.

8. The method according to claim 7, It is characterized in that The first information also includes a first identifier determined by the risk control end, and the first identifier corresponds to the target user and the business application; the second information also includes the first identifier; after the risk control end receives the second information sent by the verification backend, before the risk control end sends the verification result to the business backend, the method further includes: the risk control end adds a mapping relationship between the first identifier and the verification result to the mapping information; the risk control end receives a second request sent by the business backend, and the second request includes the first identifier; The second request is sent by the business backend in response to the business application and the first identifier submitted by the business frontend; accordingly, the risk control end sends the verification result to the business backend, including: the risk control end searches for the verification result corresponding to the first identifier from the mapping information; the risk control end sends the verification result corresponding to the first identifier to the business backend.

9. The method according to claim 8, It is characterized in that The first identifier is a token.

10. The method according to any one of claims 6 to 9, It is characterized in that When the evaluation result is that the evaluation is passed, the method further includes: sending third information to the business backend so that the business backend processes the business application, and the third information indicates that the evaluation result is that the evaluation is passed.

Images