An identity authentication method and device

Abstract

This specification provides one or more embodiments of a method for constructing a knowledge graph for authentication and an authentication method. Based on explicit association information between users and explicit association information between users and associated objects, an association graph is constructed. Implicit association information between users and between users and associated objects is inferred from the constructed association graph, resulting in a knowledge graph containing implicit association information. When any user needs to authenticate, in the knowledge graph, starting from the vertex representing the user, a preset number of correct descriptions (at least one of which is an implicit association information description) and a preset number of incorrect descriptions are determined as options for user authentication. Since at least one correct option among the authentication options for any user is a description of implicit association information about the user, at least one option has high security.

Description

Technical Field

[0001] This specification relates to the field of identity authentication technology, and in particular to an identity authentication method and apparatus. Background Technology

[0002] As the internet has developed to this point, numerous security risks have emerged for users, and identity verification is one of the most important means of addressing these risks.

[0003] In related technologies, knowledge-based authentication (KBA) is an important component of identity verification. It is an authentication mechanism that authenticates users by requiring them to answer at least one "secret question." The "secret question" is typically information provided by the user (with a specified answer for each question) or determined based on data collected from a public database (the user's actual behavior, such as contacts, purchase history, etc.).

[0004] However, the former is difficult to verify if the user has not set it in advance, while the latter, such explicit information (recorded information), is at risk of being obtained, such as the contact list friends and purchase records mentioned above. Therefore, the user's identity verification problem is at great risk of being cracked. Summary of the Invention

[0005] In view of this, one or more embodiments of this specification provide a method for constructing a knowledge graph for authentication, and an authentication method.

[0006] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions:

[0007] According to a first aspect of one or more embodiments of this specification, a method for constructing a knowledge graph for authentication is provided, the knowledge graph being an association graph, for determining authentication options for any user, the method comprising:

[0008] Obtain user-related data, as well as explicit association information between users; the related data includes at least one associated object, and explicit association information between a user and that associated object;

[0009] Using the associated data and the explicit association information between users, an initial association graph is constructed; wherein, any vertex in the association graph is used to represent a user or an associated object, and any edge is used to represent the association information between two connected vertices; all edges in the initial graph are used to represent the explicit association information between two connected vertices.

[0010] Using a preset graph knowledge reasoning algorithm, implicit association information is inferred for each vertex of the initial association graph;

[0011] The edges between each vertex, used to represent the implicit association information obtained through reasoning, are added to the initial association graph to obtain a knowledge graph for determining authentication options for any user.

[0012] According to a second aspect of one or more embodiments of this specification, a method for authentication is provided, the method comprising:

[0013] Receive authentication requests sent by users;

[0014] Determine the number M of correct authentication options that need to be generated, and the number N of incorrect authentication options;

[0015] Obtain the constructed knowledge graph and determine the target vertices used to represent the user; the knowledge graph is as described above.

[0016] Find at least M vertices directly connected to the target vertex, and use the descriptions of the association information represented by the M different edges between the target vertex and the directly connected vertices as the M correct authentication options for the user; among the M descriptions, at least one is a description of implicit association information.

[0017] The incorrect descriptions of the association information represented by the edge between any two vertices in the knowledge graph, or the correct authentication options for other users, are selected as N incorrect authentication options for the user; at least one of the two vertices is used to represent the user;

[0018] The M correct authentication options and the N incorrect authentication options are sent to the user so that the user can complete the authentication.

[0019] According to a third aspect of one or more embodiments of this specification, an apparatus for constructing a knowledge graph for authentication is provided, the knowledge graph being an association graph, for generating authentication options for any user, the apparatus comprising:

[0020] The acquisition module is used to acquire user-related data and explicit association information between users; the related data includes at least one associated object and explicit association information between a user and that associated object;

[0021] The construction module is used to construct an initial association graph using the associated data and explicit association information between users; wherein, any vertex in the association graph is used to represent a user or an associated object, and any edge is used to represent the association information between two connected vertices; all edges in the initial graph are used to represent the explicit association information between two connected vertices.

[0022] The reasoning module is used to reason about the implicit association information of each vertex of the initial association graph using a preset graph knowledge reasoning algorithm.

[0023] An addition module is used to add the edges between each vertex that represent the implicit association information obtained through reasoning to the initial association graph, thereby obtaining a knowledge graph for generating authentication options for any user.

[0024] According to a fourth aspect of one or more embodiments of this specification, an authentication apparatus is provided, the apparatus comprising:

[0025] The receiving module is used to receive authentication requests sent by users;

[0026] The determination module is used to determine the number M of correct authentication options that need to be generated and the number N of incorrect authentication options;

[0027] An acquisition module is used to acquire the constructed knowledge graph and determine the target vertices used to represent the user; the knowledge graph is as described above.

[0028] The correct option determination module is used to find at least M vertices directly connected to the target vertex, and to use the descriptions of the association information represented by the M different edges between the target vertex and the directly connected vertices as the M correct authentication options for the user; among the M descriptions, at least one is a description of implicit association information.

[0029] The error option determination module is used to select N incorrect descriptions of the association information represented by the edge between any two vertices in the knowledge graph, or correct authentication options for other users, as the incorrect authentication options for the user; at least one of the two vertices is used to represent the user;

[0030] The sending module is used to send the M correct authentication options and the N incorrect authentication options to the user so that the user can complete the authentication.

[0031] According to a fifth aspect of one or more embodiments of this specification, an electronic device is provided, comprising:

[0032] processor;

[0033] Memory used to store processor-executable instructions;

[0034] The processor implements any of the methods described above by running the executable instructions.

[0035] According to a sixth aspect of one or more embodiments of this specification, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the steps of any of the methods described above.

[0036] One or more embodiments of this specification construct an association graph based on explicit association information between users and explicit association information between users and associated objects. Based on the constructed association graph, implicit association information between users and between users and associated objects is inferred to obtain a knowledge graph containing implicit association information. When any user needs to authenticate, in the knowledge graph, starting from the vertex represented by the user, a preset number of correct descriptions (at least one of which is an implicit association information description) and a preset number of incorrect descriptions are determined as options for the user's authentication.

[0037] Through one or more embodiments of this specification, since at least one correct option among the authentication options for any user is a description of implicitly associated information about the user, at least one option has high security; that is, at least one option is difficult for anyone other than the user to determine. Furthermore, authentication does not rely on information pre-provided by the user, avoiding the problem of authentication failure in some situations. Attached Figure Description

[0038] Figure 1 This is a flowchart illustrating a method for constructing a knowledge graph for authentication, provided in an exemplary embodiment.

[0039] Figure 2 This is a schematic diagram of an association diagram provided in an exemplary embodiment.

[0040] Figure 3 This is a flowchart illustrating an authentication method provided in an exemplary embodiment.

[0041] Figure 4 This is a schematic diagram of a specific association diagram provided in an exemplary embodiment.

[0042] Figure 5 This is a schematic diagram of an authentication process provided in an exemplary embodiment.

[0043] Figure 6This is a schematic diagram of the structure of a knowledge graph construction apparatus for authentication provided in an exemplary embodiment.

[0044] Figure 7 This is a schematic diagram of the structure of an authentication device provided in an exemplary embodiment.

[0045] Figure 8 This is a schematic diagram of the structure of a device provided in an exemplary embodiment. Detailed Implementation

[0046] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0047] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0048] In related technologies, the question bank for knowledge-based identity verification is relatively fixed. Taking Alipay KBA as an example, if the question is "Which of the following items have you purchased?", the options are several item names, including those the user has purchased and those the user has not purchased. If the question is "Which of the following users is your friend?", then the options are several users, including those who are your friends and those who are not. Adobe Sign's KBA, for example, uses a public database of questions, such as "From whom did you purchase this property {address}?", providing several names, one of which is the correct option.

[0049] Among the technologies mentioned above, the problem with Alipay KBA is that friends and family are likely to know the answers to KBA questions. This is because KBA questions and answers contain information about users' daily behavior, even though the information comes from a private database (internal database, not accessible externally), making it relatively easy for friends and family to access. The problem with Adobe Sign's KBA is that its database is part of a public database (external database, accessible externally), which can also be exploited by malicious individuals to crack the answers.

[0050] Based on this, this specification proposes an authentication method. A relationship graph is constructed based on explicit associations between users and between users and associated objects. Implicit associations between users and between users and associated objects are inferred from the constructed relationship graph, resulting in a knowledge graph containing implicit associations. When any user needs to authenticate, a preset number of correct descriptions (at least one of which is implicit association information) and a preset number of incorrect descriptions are determined in the knowledge graph, starting from the vertex representing the user, as options for user authentication.

[0051] In one or more embodiments of this specification, since at least one correct option among the authentication options for any user is a description of implicitly related information about the user, at least one option has high security; that is, at least one option is difficult for anyone other than the user to determine. Furthermore, authentication does not rely on information pre-provided by the user, avoiding the problem of authentication failure in some situations.

[0052] This specification provides a method for constructing a knowledge graph for authentication, and a method for authenticating users using the constructed knowledge graph. These methods will be described in detail below.

[0053] First, we will discuss in detail the methods for constructing knowledge graphs used for identity verification.

[0054] like Figure 1 The diagram shown is a flowchart illustrating the method for constructing a knowledge graph for authentication as described in this specification, including the following steps:

[0055] Step 101: Obtain user-related data and explicit relationship information between users.

[0056] The associated data includes at least one associated object and explicit association information between a user and that associated object.

[0057] Related data is typically structured data (e.g., stored data with a first column for username and a second column for the most recently purchased item; or data from a user's request with a fixed position for username and login location). The process involves extracting related objects from the related data, as well as the relationship information between the user and these objects. For example, a related object could be a user's behavior object, with the relationship being the user's behavior information on that object. For instance, if the behavior object is a product name, the behavior information could be the most recently purchased item; or if the behavior object is city B, the behavior information could be the most recently logged-in location. Alternatively, related objects could be user attribute information, with the relationship between the user and the attribute information. For example, if the attribute information is a phone model, the relationship could be the phone model used by the user.

[0058] As can be seen from the above, associated data includes at least one associated object and explicit association information between a user and that associated object. For example, if user A's most recent login address is city B, then the associated object is city B, and the relationship between user A and the associated object city B is the most recent login address. Similarly, if user C's most frequently searched product type is JK, then the associated object is JK, and the relationship between user C and the associated object JK is the most frequently searched product type.

[0059] Explicit connections between users are generally determined through interactions between them, such as whether the users are friends in each other's address books, or whether they have interactions such as money transfers or activities.

[0060] It should be noted that the association information in this specification is user-centric, including associations between users and between users and associated objects. Associations between associated objects may be disregarded (for example, the relationship between product X and location Z does not need to be considered).

[0061] Step 103: Utilize user association data and explicit association information between users to construct an initial association graph.

[0062] In this graph, any vertex represents a user or an associated object, and any edge represents the association information between two connected vertices. All edges in the initial graph represent the explicit association information between two connected vertices.

[0063] like Figure 2 The diagram shown is a schematic representation of the relationship diagram in this specification, including user vertices, associated object vertices, and different relationships between users and between users and associated objects.

[0064] In the association diagram, each associated object is an object that has an explicit relationship with the user. For example, it can be an address, product name, product type, device address, etc., and is generally a noun.

[0065] The edges between user vertices represent the relationship between two users. They are generally bidirectional (e.g., user A is in user B's address book, and user B is also in user A's address book), but they can also be unidirectional (user A deletes user B, user A is in user B's address book, but user B is not in user A's address book). The relationship between user vertices and object vertices is generally unidirectional (e.g., the associated object C is a device name, which is user A's most recently logged-in device).

[0066] It should be noted that user vertices may not have edges with each other, or they may have multiple relationships, such as user A having a transfer relationship, an interaction relationship, or a contact friend relationship. A user vertex and its associated object vertex are generally connected by an edge, and the relationship is relatively fixed. An associated object can be associated with multiple users; for example, user X and user Y's most recent login location is both location Z. Associated objects generally do not have relationships with each other; that is, there are generally no edges between the vertices represented by associated objects.

[0067] As can be seen above, the association graph in this specification is a heterogeneous association graph, that is, the vertex type is not uniform, there are user vertices representing users and object vertices representing associated objects, and the edge type is not uniform, there are edges between user vertices and edges between user vertices and object vertices.

[0068] Generally, the constructed association graph is a directed association graph. The relationships between users are usually bidirectional, while the relationships between users and associated objects are unidirectional. For example, if user A and user B are friends, they are friends with each other, so it is a bidirectional relationship. If user A transfers money to user C, then user A to user C is a transfer relationship, and user C to user A is a receiving relationship. If user A's last viewed item is product D, then user A to product D is a last viewed relationship, while the relationship between product D and user A does not need to be considered.

[0069] Step 105: Using a preset graph knowledge reasoning algorithm, reason about the implicit association information of each vertex of the initial association graph.

[0070] Knowledge reasoning is performed based on the constructed association graph. There are many algorithms for knowledge reasoning. For example, the PRA path ranking algorithm can be used to use the relationship paths in the association graph as features for reasoning to predict whether there are implicit associations between each vertex. Alternatively, a graph neural network can be used to take the association graph as input to obtain the implicit association information between each vertex.

[0071] The knowledge reasoning process involves inferring whether there are other relationships between the vertices of an existing directed graph, that is, adding edges to the existing directed graph.

[0072] For example, users A and B are not contacts in each other's address books (users A and B do not have a direct connection edge), but they share the same login location, login device, and browsing preferences. After knowledge reasoning, it is believed that users A and B have a high degree of correlation (i.e., add an edge between users A and B).

[0073] For example, if user A and user B exhibit highly consistent behaviors, possess the same password, login location, and login device, then user A and user B are considered to be the same user. It is assumed that the associated data of user A and user B can be shared. Therefore, it is assumed that the object vertex directly connected to user A also has an association relationship with user B (i.e., add an edge to the object vertex directly connected to user B and user A, for example, the added relationship information is the purchase record of another account).

[0074] In one implementation, during knowledge reasoning, a preset graph knowledge reasoning algorithm is used to reason about the implicit association information between any two vertices with a path length of 2.

[0075] Generally, two vertices with a path length of 2 (i.e., two vertices that are connected to the same vertex but not directly connected are likely to be related) are likely to be related, while the probability of two vertices with a path length greater than 2 being related is low. Therefore, in one embodiment, when performing knowledge reasoning, implicit association information can be reasoned for any two vertices with a path length of 2.

[0076] Step 107: Add the edges between each vertex that represent the implicit association information obtained through reasoning to the initial association graph to obtain a knowledge graph for determining authentication options for any user.

[0077] After performing knowledge reasoning on the association graph, the implicit association information between each vertex is obtained. The edges used to represent the implicit association information obtained by reasoning are added to the association graph to obtain a knowledge graph used to determine the authentication options for any user.

[0078] In this specification, the role of knowledge reasoning is primarily to infer the implicit relationships between vertices. This inferred implicit relationship information is then added to the aforementioned directed association graph, resulting in a directed association graph after knowledge reasoning (a knowledge graph used to determine authentication options for any user). This directed association graph contains both explicit and implicit relationships between vertices. In other words, in this specification, implicit relationship information refers to the relationships between vertices inferred from the knowledge graph (edges added during knowledge reasoning), while explicit relationship information refers to the relationships between vertices before knowledge reasoning (existing edges before knowledge reasoning). Corresponding to practical meaning, explicit information refers to information that can be directly obtained from a user's association data, such as user A and user B being contacts in their address books. Implicit information refers to information that cannot be directly obtained from a user's association data. For example, user C and user D are not contacts in their address books, but because their behaviors are highly consistent, user C and user D are considered to have a strong correlation. Therefore, the information that user C and user D have a strong correlation is implicit information.

[0079] It can be observed that the implicit association information in the association graph is all inferred from the explicit association information.

[0080] Furthermore, as users' actual behavior or usage frequency increases, new related data will be generated. Therefore, when any user adds new related data, the knowledge graph is updated by adding edges between the vertex represented by the user and the vertex represented by the new related object in the newly added related data to represent the explicit related information in the newly added related data.

[0081] In this way, the knowledge graph can be updated as users use it, making the information included in the knowledge graph more comprehensive, and thus generating more authentication options.

[0082] Furthermore, after determining that the knowledge graph has been updated, a preset graph knowledge reasoning algorithm is used to reason about the implicit association information of each vertex in the updated knowledge graph, and then the implicit association information between each vertex obtained by reasoning is added to the updated knowledge graph.

[0083] In this way, more implicit related information can be inferred from the newly added related data, further enriching the content contained in the knowledge graph.

[0084] Furthermore, to further guarantee user privacy and security, as well as ensure the security of authentication options, all associated data uses data from internal databases. For example, only data generated by users within the Alipay system is used. This data can only be accessed by Alipay's operators and cannot be accessed by others. In this way, the security of the generated options during Alipay's authentication process is further enhanced.

[0085] The above describes a method for constructing a knowledge graph for identity verification. It utilizes explicit associations between users and between users and associated objects to build an association graph, and then infers implicit associations between users and between users and associated objects. This results in a knowledge graph that includes both explicit and implicit associations between users and between users and associated objects. In other words, the knowledge graph contains information that can be directly obtained from relevant data, as well as information that cannot be directly obtained from relevant data. Furthermore, all of this information is user-centric.

[0086] Next, the authentication method will be explained in detail. When authenticating users, interactive authentication is used. That is, the user to be authenticated is given some options to choose from, and then the user's choice is used to determine whether the user is the real user.

[0087] In related technologies, authentication questions generally correspond to options; that is, the question represents the relationship, and the option represents the associated object. For example, if the question is "Which of the following items have you purchased?", the option is several item names; if the question is "Which of the following users is your friend?", then the option is several users.

[0088] The authentication method provided in this manual has relatively fixed questions, while the options are combinations of associated objects and associated information, and are not fixed. For example, the question could be "Which of the following descriptions about you are correct?" or "Which of the following are correct?" The options are several descriptions about the user, and these descriptions are from different perspectives. For example, the options could be: the most recent login location is location X, the most frequently searched product is product D, another account is user B, etc. The user needs to select the correct description for themselves. If the selection is correct, it is confirmed that the user being authenticated is the user themselves; if the selection is incorrect, it is confirmed that the user being authenticated is not the user themselves.

[0089] like Figure 3 The diagram shown is a flowchart illustrating the authentication method described in this specification, including the following steps:

[0090] Step 301: Receive the authentication request sent by the user;

[0091] Among them, "user" refers to the user whose identity needs to be verified. This user may or may not be the user themselves.

[0092] Step 303: Determine the number M of correct authentication options that need to be generated and the number N of incorrect authentication options.

[0093] In practical applications, the difficulty of authentication varies depending on the application scenario. Therefore, different numbers of authentication options and incorrect authentication options are set. For example, three incorrect options and one correct option are set, and the user needs to choose one of them. The user's choice must be the correct option for authentication to be successful. Another example is five incorrect options and three correct options, and the user needs to choose two of them. The user's choice of two options must be both correct for authentication to be successful. Yet another example is six incorrect options and four correct options, and the user needs to choose three of them. At least two of the user's choices of three options must be correct for authentication to be successful.

[0094] Step 305: Obtain the constructed knowledge graph and determine the target vertex used to represent the user.

[0095] The acquired knowledge graph is constructed using the knowledge graph construction method described above. The knowledge graph includes vertices representing users, vertices representing associated objects, and edges representing the association information between each vertex. The association information includes both explicit and implicit association information.

[0096] In other words, the knowledge graph can be a knowledge graph constructed using the above construction method, or it can be a knowledge graph constructed using other construction methods. As long as the constructed knowledge graph includes the association information between users and the relationship information between users and associated objects, the association information includes both explicit association information and implicit association information.

[0097] Step 307: Determine the M correct authentication options for this user.

[0098] Find at least M vertices directly connected to the target vertex, and use the descriptions of the association information represented by the M different edges between the target vertex and the directly connected vertices as the M correct authentication options for the user. Among the M descriptions, at least one is a description of implicit association information.

[0099] like Figure 2 As shown, there is a relationship 5 between user 3 and associated object 2, a relationship 3 between user 3 and associated object 1, and a relationship 4 between user 1. Therefore, the descriptions generated based on user 3 are: the associated object of relationship 3 is associated object 1, the associated user of relationship 4 is user 1, and the associated object of relationship 5 is associated object 5.

[0100] More specifically, such as Figure 4 As shown, the vertices representing users include Tom, Jerry, and Spike, while the vertices representing associated objects include cat beds, meat, dog food, and cheese. Spike has relationships with Tom, dog food, and meat: a product sharing relationship with Tom, a frequently searched product relationship with dog food, and a recent purchase relationship with meat. Therefore, the description generated based on Spike is: frequently searched product is dog food, the most recent purchase is meat, and there is a product sharing relationship with Tom.

[0101] Among the M different related information descriptions, at least one implicit related information description is included, ensuring that at least one answer is something that friends and family are unlikely to know. For example, User A's User B is a very close friend, User B and User C are very close friends, User A and User D are very close friends, and Users B, C, and D do not know each other. After reasoning, it is assumed that User A knows that User B's close friend is User C (as implicit related information). Therefore, when User A selects User C as the correct option, User D is likely unaware of this.

[0102] For example, if user A and user B are inferred to be the same user, with user A being the primary account and user B being the secondary account, then the associated data between user A and user B is interconnected (user B also knows user A's associated data). The information between user A and user B that is inferred (as implicit associated information) would likely be unknown to their relatives and friends.

[0103] Step 309: Determine N incorrect authentication options for this user.

[0104] The incorrect descriptions of the association information represented by the edge between any two vertices in the knowledge graph, or the correct authentication options for other users, are selected as N incorrect authentication options for the user; at least one of the two vertices is used to represent the user;

[0105] The generation method can be negative sampling, where two unrelated vertices are described as related vertices (for example, if user A's most recent login location is X, which has no relation to location Z, then the incorrect description could be "user A's most recent login location is Z"). That is, any two vertices in the knowledge graph without a direct connection are selected and described as having a direct connection. The resulting incorrect description is then used as the user's incorrect authentication option. Figure 4The diagram shows that Jerry is not directly connected to dog food, but it is described as a directly connected vertex. Jerry's favorite treat is dog food.

[0106] Alternatively, it can be generated using adversarial learning. When generating the description of the association between vertices, other factors are added (for example, two vertices that should originally be considered related are considered unrelated due to interference from other factors), making the generated description inaccurate. That is, when selecting any two directly connected vertices in the knowledge graph and generating a description of the association information between these two vertices, an anti-interference factor is added, making the description of the association information between these two vertices an incorrect description. The resulting incorrect description is then used as an incorrect authentication option for the user.

[0107] Alternatively, it can be generated according to certain rules, for example, using correct authentication options for other users as incorrect authentication options for this user, such as... Figure 4 As shown, when Spike generates an incorrect description, the correct description for Jerry (the correct authentication option) "History search records as cheese" is used as Spike's incorrect authentication option.

[0108] Specifically, when a valid authentication option for another user is used as an invalid authentication option for this user, the vertex represented by the other user is not directly connected to the target vertex. This ensures that relevant information between two related users appears in each other's options, thereby increasing the security of user information.

[0109] Step 311: Send the confirmed authentication options to the user.

[0110] M correct authentication options and N incorrect authentication options are sent to the user to enable the user to complete authentication.

[0111] After step 311, the system receives the user's selection of authentication options and determines whether the user to be authenticated has passed the authentication (determining whether the user to be authenticated is the user himself / herself). For example, if there are three incorrect options and two correct options, the user needs to select two correct options to pass the authentication. Alternatively, if there are four incorrect options and three correct options, the user can select any number of options. Authentication will only pass if the user selects two or more correct options and one or more incorrect options.

[0112] Therefore, in step 303, the total number of authentication options Sum is determined, the number of correct authentication options M is determined, and the number of incorrect authentication options N = Sum - M is determined. Simultaneously, the number of options K that the user needs to select also needs to be determined, and the conditions for successful authentication need to be set, such as a minimum number of correct options or a minimum number of incorrect options.

[0113] The following is a detailed description of a specific embodiment of this specification, such as... Figure 5 The diagram illustrates the authentication process described in this specification.

[0114] The user sends an authentication request to the authentication platform.

[0115] The authentication platform can determine the scenario of a user authentication request and then determine the generation conditions for setting authentication options for that scenario. These conditions may or may not be present (i.e., the generation condition is none). For example, in the scenario of user authentication but in a logged-in state, since a logged-in user can directly view historical orders, the information described in the generated authentication options cannot be information that can be viewed in a logged-in state (information that the user to be authenticated can view). On the other hand, in the scenario of user authentication but in a non-login state, the user to be authenticated cannot directly view historical orders, so there are no restrictions on the generation of authentication options.

[0116] After determining the conditions for generating authentication options, the authentication platform sends the conditions for the generated authentication options to the generation platform. The generation platform uses the completed knowledge graph and the method described above for determining correct and incorrect authentication options. Based on the determined conditions for generating authentication options, the generation platform filters out suitable authentication options, including correct and incorrect authentication options.

[0117] The generation platform sends the generated authentication options to the verification platform, which then renders them into the final authentication product based on the generated authentication options and pushes it to the user.

[0118] Users answer authentication questions and send their answers to the authentication platform.

[0119] The identity verification platform determines whether the user's identity verification is successful based on the user's answer and sends the answer result to the generation platform.

[0120] The platform generates records of the user's responses to each option. It can generate verified options based on the user's past responses, for example, it can update options based on the user's past responses (the previously verified option will not appear in the next response).

[0121] The above describes the construction method of the knowledge graph used for identity verification and the identity verification method. Using the above method, on the one hand, implicit association information is inferred from the explicit association information related to the user, and when generating authentication options for any user, the question bank is expanded (the number of options that can be generated increases). Furthermore, since the security of implicit association information is higher than that of explicit association information, the security of identity verification is also improved.

[0122] Furthermore, as mentioned above, the authentication options in this manual are multifaceted and random, not one-dimensional, making them more difficult to crack. For example, relatives and friends may only know some of the user's daily information, not all of it. Therefore, when relatives and friends crack the user's authentication answers, they can only determine the options they are familiar with, and cannot crack the other options.

[0123] The apparatus corresponding to the above method will now be described in detail.

[0124] An apparatus for constructing a knowledge graph for identity verification, such as Figure 6 As shown, the knowledge graph is a relational graph used to generate authentication options for any user, and the device includes:

[0125] The acquisition module 601 is used to acquire user-related data and explicit association information between users; the related data includes at least one associated object and explicit association information between a user and the associated object;

[0126] The construction module 603 is used to construct an initial association graph using the association data and the explicit association information between users; wherein, any vertex in the association graph is used to represent a user or to represent an associated object, and any edge is used to represent the association information between two connected vertices; all edges in the initial graph are used to represent the explicit association information between two connected vertices.

[0127] The reasoning module 605 is used to reason about the implicit association information of each vertex of the initial association graph using a preset graph knowledge reasoning algorithm.

[0128] Add module 607 to add the edges between each vertex that represent the implicit association information obtained by reasoning to the initial association graph to obtain a knowledge graph for generating authentication options for any user.

[0129] The associated data can be behavioral data. In this case, the associated object in the behavioral data is the user's behavioral object, and the explicit associated information in the behavioral data is the user's behavioral information on the behavioral object.

[0130] The above reasoning module can also be specifically used for:

[0131] Using a pre-defined graph knowledge reasoning algorithm, for any two vertices with a path length of 2, the implicit association information between the two vertices is inferred.

[0132] The above-mentioned device may further include:

[0133] The update module is used to update the knowledge graph when it is determined that any user has added new associated data: add an edge between the vertex represented by the user and the vertex represented by the new associated object in the newly added associated data to represent the explicit association information in the newly added associated data.

[0134] The above-mentioned device may further include:

[0135] The re-inference module is used to infer implicit association information of each vertex in the updated knowledge graph based on the updated knowledge graph and using a preset graph knowledge inference algorithm; and to add the implicit association information between each vertex obtained by inference to the updated knowledge graph.

[0136] This specification also provides an authentication device, such as Figure 7 As shown, the device includes:

[0137] The receiving module 701 is used to receive authentication requests sent by users;

[0138] Module 703 is used to determine the number M of correct authentication options that need to be generated and the number N of incorrect authentication options;

[0139] The acquisition module 705 is used to acquire the constructed knowledge graph and determine the target vertex used to represent the user; the knowledge graph is any of the knowledge graphs described above.

[0140] The correct option determination module 707 is used to find at least M vertices directly connected to the target vertex, and to use the description of the association information represented by the M different edges between the target vertex and the directly connected vertices as the M correct authentication options for the user; among the M descriptions, at least one is a description of implicit association information.

[0141] The error option determination module 709 is used to select N incorrect descriptions of the association information represented by the edge between any two vertices in the knowledge graph, or correct authentication options for other users, as the incorrect authentication options for the user; at least one of the two vertices is used to represent the user;

[0142] The sending module 711 is used to send the M correct authentication options and the N incorrect authentication options to the user so that the user can complete the authentication.

[0143] The error option determination module can also be specifically used to: perform negative sampling on the knowledge graph, select any two vertices that do not have a directly connected edge, describe them as having a directly connected edge, and use the resulting error description as the user's incorrect authentication option; or

[0144] In the knowledge graph, any two directly connected vertices are selected. When generating a description of the association information between these two vertices, an anti-interference factor is added to make the description of the association information between these two vertices incorrect. The resulting incorrect description is then used as the user's incorrect authentication option.

[0145] The vertices represented by the other users are not directly connected to the target vertex.

[0146] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0147] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0148] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0149] This specification also provides an electronic device, including:

[0150] processor;

[0151] Memory used to store processor-executable instructions;

[0152] The processor implements any of the methods described above by running the executable instructions.

[0153] Figure 8This diagram illustrates a more specific hardware structure of a computing device provided in an embodiment of this specification. The device may include a processor 810, a memory 820, an input / output interface 830, a communication interface 840, and a bus 850. The processor 810, memory 820, input / output interface 830, and communication interface 840 are interconnected internally via the bus 850.

[0154] The processor 810 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0155] The memory 820 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 820 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 820 and is called and executed by the processor 810.

[0156] The input / output interface 830 is used to connect input / output modules to enable information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0157] The communication interface 840 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (e.g., USB, Ethernet cable) or wireless means (e.g., mobile network, Wi-Fi, Bluetooth).

[0158] Bus 850 includes a pathway for transmitting information between various components of the device, such as processor 810, memory 820, input / output interface 830, and communication interface 840.

[0159] It should be noted that although the above-described device only shows the processor 810, memory 820, input / output interface 830, communication interface 840, and bus 850, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0160] This specification also provides a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the steps of any of the methods described above.

[0161] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0162] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0163] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0164] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” used in one or more embodiments of this specification and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0165] It should be understood that although the terms first, second, third, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of one or more embodiments of this specification, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."

[0166] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit the scope of one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this specification should be included within the protection scope of one or more embodiments of this specification.

Claims

1. A method for constructing a knowledge graph for authentication, wherein the knowledge graph is an association graph used to determine authentication options for any user, the method comprising: Obtain user-related data, as well as explicit relationship information between users; The associated data includes at least one associated object and explicit association information between a user and that associated object; Using the associated data and explicit association information between users, an initial association graph is constructed; wherein, any vertex in the association graph is used to represent a user or an associated object, and any edge is used to represent the association information between two connected vertices; all edges in the initial association graph are used to represent the explicit association information between two connected vertices. Using a preset graph knowledge reasoning algorithm, implicit association information is inferred for each vertex of the initial association graph; The edges between each vertex, used to represent the implicit association information obtained through reasoning, are added to the initial association graph to obtain a knowledge graph for determining the authentication options for any user. The authentication options for any user include: M correct authentication options and N incorrect authentication options for that user; the M correct authentication options include at least one description of implicit association information; the N incorrect authentication options include: incorrect descriptions of association information represented by the edge between any two vertices in the knowledge graph, or correct authentication options for other users.

2. The method as described in claim 1, wherein the associated data is behavioral data, the associated object in the behavioral data is the user's behavioral object, and the explicit associated information in the behavioral data is the user's behavioral information on the behavioral object.

3. The method as described in claim 1, wherein the step of using a preset graph knowledge reasoning algorithm to perform implicit association information reasoning on each vertex of the initial association graph includes: Using a pre-defined graph knowledge reasoning algorithm, for any two vertices with a path length of 2, the implicit association information of the two vertices is inferred.

4. The method of claim 1, further comprising: If any user adds new associated data, the knowledge graph is updated by adding an edge between the vertex represented by the user and the vertex represented by the new associated object in the newly added associated data to represent explicit association information in the newly added associated data.

5. The method of claim 4, further comprising, after updating the knowledge graph: Based on the updated knowledge graph, a preset graph knowledge reasoning algorithm is used to reason about the implicit association information of each vertex in the updated knowledge graph. The implicit association information between the vertices obtained through reasoning is added to the updated knowledge graph.

6. A method for authentication, the method comprising: Receive authentication requests sent by users; Determine the number M of correct authentication options that need to be generated, and the number N of incorrect authentication options; Obtain the constructed knowledge graph and determine the target vertices used to represent the user; the knowledge graph is any one of claims 1-5; Find at least M vertices directly connected to the target vertex, and use the descriptions of the association information represented by the M different edges between the target vertex and the directly connected vertices as the M correct authentication options for the user; among the M descriptions, at least one is a description of implicit association information. The incorrect descriptions of the association information represented by the edge between any two vertices in the knowledge graph, or the correct authentication options for other users, are selected as N incorrect authentication options for the user; at least one of the two vertices is used to represent the user; The M correct authentication options and N incorrect authentication options are sent to the user so that the user can complete the authentication.

7. The method of claim 6, wherein the description of the erroneous association information between any two vertices in the knowledge graph is used as the user's erroneous authentication option, includes: Negative sampling is performed on the knowledge graph, and any two vertices that do not have a directly connected edge are selected as if they have a directly connected edge for description. The resulting incorrect description is used as the user's incorrect authentication option. or In the knowledge graph, any two directly connected vertices are selected. When generating a description of the association information between these two vertices, an anti-interference factor is added to make the description of the association information between these two vertices incorrect. The resulting incorrect description is then used as the user's incorrect authentication option.

8. The method of claim 6, wherein the vertex represented by the other user is not directly connected to the target vertex.

9. An apparatus for constructing a knowledge graph for authentication, the knowledge graph being an association graph, for generating authentication options for any user, the apparatus comprising: The acquisition module is used to acquire users' associated data, as well as explicit association information between users; The associated data includes at least one associated object and explicit association information between a user and that associated object; The construction module is used to construct an initial association graph using the associated data and explicit association information between users; wherein, any vertex in the association graph is used to represent a user or an associated object, and any edge is used to represent the association information between two connected vertices; all edges in the initial association graph are used to represent the explicit association information between two connected vertices. The reasoning module is used to reason about the implicit association information of each vertex of the initial association graph using a preset graph knowledge reasoning algorithm. An addition module is used to add the edges between each vertex that represent the implicit association information obtained by reasoning to the initial association graph, so as to obtain a knowledge graph for generating authentication options for any user; The authentication options for any user include: M correct authentication options and N incorrect authentication options for that user; the M correct authentication options include at least one description of implicit association information; the N incorrect authentication options include: incorrect descriptions of association information represented by the edge between any two vertices in the knowledge graph, or correct authentication options for other users.

10. The apparatus of claim 9, wherein the associated data is behavioral data, the associated object in the behavioral data is a user's behavioral object, and the explicit associated information in the behavioral data is the user's behavioral information on the behavioral object.

11. The apparatus of claim 9, wherein the inference module is specifically used for: Using a pre-defined graph knowledge reasoning algorithm, for any two vertices with a path length of 2, the implicit association information between the two vertices is inferred.

12. The apparatus of claim 9, further comprising: The update module is used to update the knowledge graph when it is determined that any user has added new associated data: add an edge between the vertex represented by the user and the vertex represented by the new associated object in the newly added associated data to represent the explicit association information in the newly added associated data.

13. The apparatus of claim 12, further comprising: The re-inference module is used to infer implicit association information of each vertex in the updated knowledge graph based on the updated knowledge graph and using a preset graph knowledge inference algorithm; and to add the implicit association information between each vertex obtained by inference to the updated knowledge graph.

14. An authentication device, the device comprising: The receiving module is used to receive authentication requests sent by users; The determination module is used to determine the number M of correct authentication options that need to be generated and the number N of incorrect authentication options; An acquisition module is used to acquire the constructed knowledge graph and determine the target vertex used to represent the user; the knowledge graph is the knowledge graph as described in any one of claims 1-5; The correct option determination module is used to find at least M vertices directly connected to the target vertex, and to use the descriptions of the association information represented by the M different edges between the target vertex and the directly connected vertices as the M correct authentication options for the user; among the M descriptions, at least one is a description of implicit association information. The error option determination module is used to select N incorrect descriptions of the association information represented by the edge between any two vertices in the knowledge graph, or correct authentication options for other users, as the user's incorrect authentication options; At least one of the two vertices is used to represent the user; The sending module is used to send the M correct authentication options and N incorrect authentication options to the user so that the user can complete the authentication.

15. The apparatus of claim 14, wherein the error option determination module is specifically configured to: perform negative sampling on the knowledge graph, select any two vertices that do not have a directly connected edge, describe them as having a directly connected edge, and use the obtained error description as the user's incorrect authentication option; or In the knowledge graph, any two directly connected vertices are selected. When generating a description of the association information between these two vertices, an anti-interference factor is added to make the description of the association information between these two vertices incorrect. The resulting incorrect description is then used as the user's incorrect authentication option.

16. The apparatus of claim 14, wherein the vertex represented by the other user is not directly connected to the target vertex.

17. An electronic device comprising: processor; Memory used to store processor-executable instructions; The processor implements the method as described in any one of claims 1-8 by executing the executable instructions.

18. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method as claimed in any one of claims 1-8.

Images