Risk identification method and device, and electronic equipment

Abstract

A risk identification method is applied to a client running on a terminal device; the method comprises: obtaining a target event triggered by a user on the client; wherein the target event comprises a virtual resource claiming event corresponding to a marketing business initiated by a server; in response to the target event, generating a device ID of the terminal device based on user behavior data related to the user behavior performed by the user on the client; and sending the generated device ID to the server, so that the server performs fraud risk identification related to the virtual resource claiming event based on the device ID. This solution can reduce the privacy leakage and security risks faced by device ID exposure.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of privacy protection, and in particular, to a risk identification method and device, and an electronic device. Background Art

[0002] The device ID of a terminal device usually refers to identification information that can uniquely identify the terminal device. In some scenarios, when a user interacts with a server through a client (such as an APP application) running on a terminal device (such as a mobile phone) to complete some specific business implementations, the client may need to obtain the device ID of the terminal device and send the device ID of the terminal device to the server. Summary of the invention

[0003] This specification proposes a risk identification method, which is applied to a client running on a terminal device; the method comprises:

[0004] Acquire a target event triggered by a user on the client; wherein the target event includes a virtual resource claiming event corresponding to a marketing business initiated by the server;

[0005] In response to the target event, generating a device ID of the terminal device based on user behavior data related to a user behavior performed by a user on the client;

[0006] The generated device ID is sent to the server, so that the server performs fraud risk identification related to the virtual resource claiming event based on the device ID.

[0007] Optionally, a trusted execution environment is installed on the terminal device; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment;

[0008] Generating a device ID of the terminal device based on user behavior data related to a user behavior performed by a user on the terminal device includes:

[0009] Sending a device ID acquisition request to the trusted application, so that the trusted application generates a device ID of the terminal device for the client based on user behavior data related to user behavior performed by the user on the terminal device in response to the device ID acquisition request;

[0010] The device ID generated by the trusted application is obtained.

[0011] Optionally, the device ID is an electronic certificate generated by the trusted application based on the user behavior data.

[0012] Optionally, the trusted application generates a device ID for the client based on the user behavior data in response to the device ID acquisition request, including:

[0013] The trusted application clears the device ID generated for the client in response to the device ID acquisition request, and regenerates the device ID for the client based on the user behavior data.

[0014] Optionally, the device ID includes an electronic credential generated by the trusted application by encrypting and calculating the user behavior data based on an encryption key of the server maintained in the trusted execution environment, so that the server can decrypt the user behavior data from the electronic credential based on a decryption key corresponding to the encryption key, and perform fraud risk identification related to the virtual resource collection event based on the user behavior data.

[0015] Optionally, the encryption key is a public key of the server; the decryption key is a private key of the server.

[0016] Optionally, the user behavior includes user risk behavior.

[0017] Optionally, the virtual resource is a user reward related to a marketing campaign initiated by the server.

[0018] Optionally, the user risk behavior includes a user's behavior of resetting the terminal device; and the user behavior data includes data for determining whether the terminal device is frequently reset by the user during a distribution cycle of the virtual resource.

[0019] Optionally, the risk behavior data includes:

[0020] The number of times the terminal device is reset by the user; and

[0021] The timestamp corresponding to the moment when the device was reset.

[0022] Optionally, the trusted execution environment maintains a count of device resets occurring on the terminal device;

[0023] The method further comprises:

[0024] Obtaining an event that a device reset occurs on the terminal device;

[0025] In response to an event in which a device reset occurs on the terminal device, a count of device resets occurring on the terminal device maintained by the trusted execution environment is increased by 1, and a timestamp corresponding to a time when the device reset occurs on the terminal device is collected.

[0026] Optionally, the trusted execution environment includes an execution environment built based on TEE security hardware mounted on the terminal device.

[0027] This specification also proposes a risk identification method, which is applied to the server; the method includes:

[0028] Receiving a device ID sent by a client running on a terminal device; wherein the device ID is a device ID generated by the client in response to a target event triggered by a user based on user behavior data related to a user behavior performed by the user on the client; the target event includes a virtual resource claiming event corresponding to a marketing business initiated by a server;

[0029] Fraud risk identification associated with the virtual resource claiming event is performed based on the device ID.

[0030] Optionally, a trusted execution environment is installed on the terminal device; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment; the device ID includes a device ID generated for the client by the trusted application in response to a device ID acquisition request sent by the client, based on user behavior data related to user behavior performed by the user on the terminal device.

[0031] Optionally, the device ID is an electronic certificate generated by the trusted application based on the user behavior data.

[0032] Optionally, the electronic credential includes an electronic credential generated by the trusted application by performing encryption calculation on the user behavior data based on an encryption key of the server maintained in the trusted execution environment;

[0033] Performing fraud risk identification related to the virtual resource claiming event based on the device ID includes:

[0034] The user behavior data is decrypted from the electronic voucher based on a decryption key corresponding to the encryption key, and fraud risk identification related to the virtual resource claiming event is performed based on the user behavior data.

[0035] Optionally, the encryption key is a public key of the server; the decryption key is a private key of the server.

[0036] Optionally, the user behavior includes user risk behavior.

[0037] Optionally, the virtual resource is a user reward related to a marketing campaign initiated by the server.

[0038] Optionally, the user risk behavior includes a user's behavior of resetting the terminal device; and the user behavior data includes data for determining whether the terminal device is frequently reset by the user during a distribution cycle of the virtual resource.

[0039] Optionally, the user behavior data includes:

[0040] The number of times the terminal device is reset by the user; and the timestamp corresponding to the time when the device is reset;

[0041] Performing fraud risk identification related to the virtual resource claiming event based on the user behavior data includes:

[0042] Based on the number of times the terminal device is reset by the user; and the timestamp corresponding to the time of the device reset, determining whether the number of times the terminal device is reset by the user within the virtual resource issuance cycle reaches a preset threshold;

[0043] If so, it is determined that the user has a fraud risk associated with claiming the virtual resource.

[0044] Optionally, the trusted execution environment includes an execution environment built based on TEE security hardware mounted on the terminal device.

[0045] This specification also proposes a risk identification device, which is applied to a client running on a terminal device; the device includes:

[0046] An acquisition module is used to acquire a target event triggered by a user on a client; wherein the target event includes a virtual resource claiming event corresponding to a marketing business initiated by a server;

[0047] a generating module, in response to the target event, generating a device ID of the terminal device based on user behavior data related to a user behavior performed by a user on the client;

[0048] The sending module sends the generated device ID to the server, so that the server performs fraud risk identification related to the virtual resource collection event based on the device ID.

[0049] Optionally, a trusted execution environment is installed on the terminal device; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment;

[0050] The generation module:

[0051] Sending a device ID acquisition request to the trusted application, so that the trusted application generates a device ID of the terminal device for the client based on user behavior data related to user behavior performed by the user on the terminal device in response to the device ID acquisition request;

[0052] The device ID generated by the trusted application is obtained.

[0053] Optionally, the device ID is an electronic certificate generated by the trusted application based on the user behavior data.

[0054] Optionally, the trusted application generates a device ID for the client based on the user behavior data in response to the device ID acquisition request, including:

[0055] The trusted application clears the device ID generated for the client in response to the device ID acquisition request, and regenerates the device ID for the client based on the user behavior data.

[0056] Optionally, the device ID includes an electronic credential generated by the trusted application by encrypting and calculating the user behavior data based on an encryption key of the server maintained in the trusted execution environment, so that the server can decrypt the user behavior data from the electronic credential based on a decryption key corresponding to the encryption key, and perform fraud risk identification related to the virtual resource collection event based on the user behavior data.

[0057] Optionally, the encryption key is a public key of the server; the decryption key is a private key of the server.

[0058] Optionally, the user behavior includes user risk behavior.

[0059] Optionally, the virtual resource is a user reward related to a marketing campaign initiated by the server.

[0060] Optionally, the user risk behavior includes a user's behavior of resetting the terminal device; and the user behavior data includes data for determining whether the terminal device is frequently reset by the user during a distribution cycle of the virtual resource.

[0061] Optionally, the risk behavior data includes:

[0062] The number of times the terminal device is reset by the user; and

[0063] The timestamp corresponding to the moment when the device was reset.

[0064] Optionally, the trusted execution environment maintains a count of device resets occurring on the terminal device;

[0065] The device also includes:

[0066] The acquisition module obtains the event of device reset of the terminal device; in response to the event of device reset of the terminal device, increases the count of device reset of the terminal device maintained by the trusted execution environment by 1, and acquires the timestamp corresponding to the moment when the device reset of the terminal device occurs.

[0067] Optionally, the trusted execution environment includes an execution environment built based on TEE security hardware mounted on the terminal device.

[0068] This specification also proposes a risk identification device, which is applied to a server; the device comprises:

[0069] A receiving module receives a device ID sent by a client running on a terminal device; wherein the device ID is a device ID generated by the client in response to a target event triggered by a user, based on user behavior data related to a user behavior performed by the user on the client; the target event includes a virtual resource claiming event corresponding to a marketing business initiated by a server;

[0070] An identification module is configured to perform fraud risk identification related to the virtual resource claiming event based on the device ID.

[0071] Optionally, a trusted execution environment is installed on the terminal device; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment; the device ID includes a device ID generated for the client by the trusted application in response to a device ID acquisition request sent by the client, based on user behavior data related to user behavior performed by the user on the terminal device.

[0072] Optionally, the device ID is an electronic certificate generated by the trusted application based on the user behavior data.

[0073] Optionally, the electronic credential includes an electronic credential generated by the trusted application by performing encryption calculation on the user behavior data based on an encryption key of the server maintained in the trusted execution environment;

[0074] The identification module:

[0075] The user behavior data is decrypted from the electronic voucher based on a decryption key corresponding to the encryption key, and fraud risk identification related to the virtual resource claiming event is performed based on the user behavior data.

[0076] Optionally, the encryption key is a public key of the server; the decryption key is a private key of the server.

[0077] Optionally, the user behavior includes user risk behavior.

[0078] Optionally, the virtual resource is a user reward related to a marketing campaign initiated by the server.

[0079] Optionally, the user risk behavior includes a user's behavior of resetting the terminal device; and the user behavior data includes data for determining whether the terminal device is frequently reset by the user during a distribution cycle of the virtual resource.

[0080] Optionally, the user behavior data includes:

[0081] The number of times the terminal device is reset by the user; and the timestamp corresponding to the time when the device is reset;

[0082] The identification module:

[0083] Based on the number of times the terminal device is reset by the user; and the timestamp corresponding to the time of the device reset, determining whether the number of times the terminal device is reset by the user within the virtual resource issuance cycle reaches a preset threshold;

[0084] If so, it is determined that the user has a fraud risk associated with claiming the virtual resource.

[0085] Optionally, the trusted execution environment includes an execution environment built based on TEE security hardware mounted on the terminal device.

[0086] In the above technical solution, since the device ID of the terminal device obtained by the server is a device ID independently generated by the client based on the user behavior data related to the user behavior performed by the user on the client, and is no longer the real device ID of the terminal device; therefore, the client sends the generated device ID as the real device ID of the terminal device to the server, and does not expose the real device ID of the terminal device to the server, thereby reducing the privacy leakage and security risks faced by the exposure of the device ID. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 is a flow chart of a risk identification method provided by an exemplary embodiment;

[0088] Figure 2 is a schematic structural diagram of an electronic device provided by an exemplary embodiment;

[0089] Figure 3 is a block diagram of a risk identification device provided by an exemplary embodiment;

[0090] Figure 4It is a block diagram of another risk identification device provided by an exemplary embodiment. DETAILED DESCRIPTION

[0091] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0092] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0093] The device ID of a terminal device usually refers to identification information that can uniquely identify the terminal device. For example, if the terminal device is a mobile phone, the IMEI code of the mobile phone can be used as the device ID. Alternatively, the IMEI code of the mobile phone and other information that can uniquely identify the mobile phone can be calculated together to generate the device ID. For example, the IMEI code of the mobile phone and hardware information such as the MAC address of the terminal device can be hashed together to obtain a hash value as the device ID.

[0094] In some application scenarios, when a user interacts with a server through a client running on a terminal device to complete some specific business implementations, the client may need to obtain the device ID of the terminal device and send the device ID of the terminal device to the server.

[0095] For example, taking the above-mentioned terminal device as a mobile phone and the above-mentioned client as an APP running on the mobile phone, it is assumed that the user interacts with the server through the APP to receive user rewards related to the marketing activities initiated by the server. In order to avoid fraud in the process of users participating in receiving user rewards, the APP usually needs to send the device ID of the mobile phone to the server, and the server will perform relevant risk identification on the user based on the device ID.

[0096] However, exposing the real device ID of the terminal device to the server may cause the terminal device to face certain privacy leaks and security risks.

[0097] Based on this, this specification aims to propose a technical solution to avoid privacy leakage and security risks by proposing a scenario in which the client sends the device ID to the server, in which the client autonomously generates the device ID based on user behavior data related to the user behavior performed by the user on the client.

[0098] During implementation, the above-mentioned client can obtain the target event triggered by the user on the client; wherein, the target event can specifically include an event that can trigger the acquisition of the device ID of the terminal device; for example, the target event can be a collection event of a user reward related to a marketing campaign initiated by the server.

[0099] When the client obtains the target event, it can respond to the target event, collect user behavior data related to the user behavior performed by the user on the client, and generate a device ID of the terminal device based on the user behavior data; then, the generated device ID is sent to the server, and the server performs risk identification related to the target event based on the device ID.

[0100] In the above technical solution, since the device ID of the terminal device obtained by the server is a device ID independently generated by the client based on the user behavior data related to the user behavior performed by the user on the client, and is no longer the real device ID of the terminal device; therefore, the client sends the generated device ID as the real device ID of the terminal device to the server, and does not expose the real device ID of the terminal device to the server, thereby reducing the privacy leakage and security risks faced by the exposure of the device ID.

[0101] See also Figure 1 , Figure 1 This is a flowchart of a method for generating a terminal device ID provided by an exemplary embodiment. The method is applied to a client running on a terminal device, and performs the following steps:

[0102] Step 102, obtaining a target event triggered by a user on the client; wherein the target event includes a virtual resource claiming event corresponding to a marketing service initiated by the server;

[0103] Step 104, in response to the target event, generating a device ID of the terminal device based on user behavior data related to a user behavior performed by the user on the client;

[0104] Step 106: Send the generated device ID to the server, so that the server performs fraud risk identification related to the virtual resource claiming event based on the device ID.

[0105] The above-mentioned target event may specifically include any form of event that can trigger the acquisition of the device ID of the terminal device.

[0106] In this specification, during the development of the above-mentioned client, several types of the above-mentioned target events can be predefined; among them, the above-mentioned target events can specifically include any form of events that can trigger the client to obtain the device ID of the terminal device.

[0107] For example, in practical applications, when a user interacts with a server through a client running on a terminal device to complete some specific business implementations, if such business implementations may face security risks, the server usually also needs to obtain the device ID of the terminal device and perform further risk identification for such business implementations based on the device ID; in such a business scenario, the above-mentioned target events can specifically include user events related to such business implementations that may face security risks and require reporting the device ID to the server for further risk identification.

[0108] For example, in one scenario, the above-mentioned target event can specifically be a virtual resource collection event triggered by the user on the client related to the virtual resource distribution service initiated by the server; for example, the above-mentioned virtual resource can specifically be a user reward related to a marketing campaign initiated by the server; then the above-mentioned target event can specifically be an event that the user triggers on the client to collect the user reward related to this marketing campaign.

[0109] In this case, in order to prevent fraud when the user participates in collecting the user reward, the client usually needs to report the device ID of the terminal to the server as well, and the server performs relevant risk identification on the user based on the device ID to determine whether the user has a fraud risk (commonly known as "wool pulling").

[0110] In another scenario, the above-mentioned target event can specifically also be a user account registration event triggered by the user on the client related to the user registration service on the server side; in this case, when the user registers a user account on the client, the device ID of the terminal usually needs to be sent to the server as the registration environment information for this registration, and the server performs relevant risk identification on the user's registration environment based on the device ID to determine whether the user's registration environment has risks; if it is determined through risk identification that the user's registration environment has no risks, the user account registration process can be continued; otherwise, the user account registration process initiated by the user this time can be aborted.

[0111] In another scenario, the above-mentioned target event can specifically also be a service verification event triggered by the user on the client related to the user verification service on the server side; for example, the service verification event can specifically include a user identity verification event related to the user identity verification service on the server side, a payment verification event related to the payment service on the server side, and so on.

[0112] In this case, after the user triggers the above-mentioned business verification event on the client, it is usually necessary to send the device ID of the terminal as the hardware environment information of the terminal device where this verification is located to the server, and the server also performs risk verification on the hardware environment of the terminal device where this verification is located based on the device ID;

[0113] If the risk verification of the hardware environment of the terminal device where this verification is located passes, the business verification processing corresponding to the above-mentioned business verification event can be further performed at this time; for example, taking the business verification event as a user identity verification event related to the user identity verification business on the server side as an example, when the risk verification of the hardware environment of the terminal device based on the device ID passes, the user identity verification corresponding to the user identity verification event is further performed. For another example, taking the business verification event as a payment verification event related to the payment business on the server side as an example, when the risk verification of the hardware environment of the terminal device based on the device ID passes, the payment verification corresponding to the payment verification event is further performed.

[0114] If the risk verification of the hardware environment of the terminal device where this verification is performed fails, it indicates that there may be certain risks in the hardware environment of the terminal device. At this time, the server can further send an identity authentication prompt to the above-mentioned client to trigger the client to perform additional identity authentication on the user in response to the prompt, and after the additional identity authentication passes, further perform the business verification processing corresponding to the above-mentioned business verification event.

[0115] In this specification, during the process of the client running on the terminal device, when the user triggers the defined target event on the terminal device, the client can obtain the triggered target event; wherein the specific manner in which the client obtains the target event triggered by the user on the terminal device is not particularly limited in this specification;

[0116] For example, in one implementation, the client may monitor events triggered by the user on the terminal device through the event monitoring mechanism in the operating system of the terminal device, and obtain the target event in the monitored event by matching the monitored event with the defined target event.

[0117] When the above-mentioned client obtains the above-mentioned target event, it can respond to the target event, collect user behavior data related to the user behavior performed by the user on the terminal device, and then autonomously generate the device ID of the terminal device based on the collected user behavior data.

[0118] The above user behavior may specifically include any form of user behavior performed by the user on the terminal device; for example, in one embodiment shown, the above user behavior data may include any form of user risk behavior performed by the user on the terminal; for example, the user frequently resets the terminal device, the user frequently initiates new user registration to the server on the client running on the terminal device, frequently switches the login account of the client, etc. Of course, in actual applications, the above user behavior may be other forms of daily operation behavior in addition to user risk behavior, which is not particularly limited in this specification.

[0119] In one embodiment shown, when the client autonomously generates a device ID for the terminal device based on user behavior data related to user behavior performed by the user on the terminal device, in order to reduce the security risks of the process of generating the device ID, the process of generating the device ID can be specifically completed in the TEE (Trusted Execution Environment) carried by the terminal device.

[0120] In actual applications, the device manufacturer of the terminal device can build a trusted execution environment in the hardware environment of the terminal device during the production of the terminal device based on the specific needs of the operator of the client.

[0121] It should be noted that the above-mentioned trusted execution environment may specifically include a trusted execution environment built in the above-mentioned terminal device based on software, or a trusted execution environment built in the above-mentioned terminal device based on TEE security hardware; or, it may be a trusted execution environment built in the above-mentioned terminal device in a combination of software and hardware;

[0122] For example, in one embodiment shown, the trusted execution environment built based on TEE security hardware has a higher security characteristic than the trusted execution environment built based on software; therefore, in this specification, the above-mentioned trusted execution environment can adopt a trusted execution environment built based on TEE security hardware; for example, the above-mentioned trusted execution environment can adopt a trusted execution environment solution of TEE+SE (Secure Element); under this solution, the SE security chip can be used to store and maintain user privacy data involved in the trusted execution environment.

[0123] Among them, the specific implementation process of building a trusted execution environment on the above-mentioned terminal device will not be described in detail in this specification. When technical personnel in this field implement the technical solution recorded in this specification, they can refer to the records in the relevant technology.

[0124] In one embodiment shown, a trusted application (TA) can also be run in the trusted execution environment carried by the above-mentioned terminal; the trusted application can be specifically used to generate a device ID for the above-mentioned client; the above-mentioned client can send a request to the above-mentioned trusted application, and the above-mentioned trusted application will generate a device ID for the client in the trusted execution environment.

[0125] The above-mentioned trusted application may specifically include any form of trusted application running in the trusted execution environment carried by the above-mentioned terminal device, which is not particularly limited in this specification;

[0126] For example, in actual applications, the device manufacturer of the terminal device may also develop the trusted application based on the specific needs of the client operator, and run the trusted application in the trusted execution environment of the terminal device during the production process of the terminal device.

[0127] The specific form of the device ID generated by the trusted application is not particularly limited in this specification; for example, in one embodiment shown, the device ID can be in the form of an electronic token. Of course, it can also be in other forms besides an electronic token.

[0128] By running the above-mentioned trusted application in the trusted execution environment carried by the above-mentioned terminal device, since the trusted execution environment is usually an independent operating environment independent of the operating system of the above-mentioned terminal device; therefore, when the above-mentioned terminal device is reset; for example, the operating system of the above-mentioned terminal device is restored to factory settings, the above-mentioned terminal device is installed with a new operating system (commonly known as flashing), other hardware on the terminal device except the hardware corresponding to the above-mentioned trusted execution environment is damaged or replaced; the trusted application running in the above-mentioned trusted execution environment will usually not be affected in any way.

[0129] In this case, when the client autonomously generates the device ID of the terminal device based on the user behavior data, it may send a device ID acquisition request to the trusted application.

[0130] For example, during implementation, the client may communicate with the trusted execution environment through a communication channel corresponding to the trusted execution environment defined in the operating system of the terminal device, and transmit the device ID acquisition request to the trusted application running in the trusted execution environment.

[0131] After receiving the device ID acquisition request, the trusted application can respond to the device ID acquisition request and generate a device ID for the client based on the user behavior data in the secure environment of TEE.

[0132] It should be noted that, in actual applications, the operating system of the terminal device can monitor events triggered by user behaviors performed by the user on the terminal device, and record the monitored events in the system files of the operating system.

[0133] In one implementation, the collection of the above user behavior data can be completed autonomously by the client. In this case, after obtaining the above target event, the client can respond to the target event, further read the event triggered by the user behavior performed by the user on the terminal device recorded by the terminal device from the system file of the terminal device, and collect relevant data from the read event as the user behavior data related to the user behavior performed by the user on the terminal device;

[0134] After the client completes the collection of the above user behavior data, it can carry the collected user behavior data in the above device ID acquisition request and further submit it to the above trusted application. The above trusted application generates a device ID for the client based on the above user behavior data collected by the client in the secure environment of TEE.

[0135] In another embodiment, the collection of the user behavior data may also be completed by the trusted application running in the trusted execution environment; in this case, after receiving the device ID acquisition request sent by the client, the trusted application may respond to the device ID acquisition request, read events triggered by user behaviors performed by the user on the terminal device recorded by the terminal device from the system file of the terminal device, and collect relevant data from the read events as user behavior data related to the user behaviors performed by the user on the terminal device;

[0136] After the trusted application completes the collection of the above user behavior data, it can generate a device ID for the client based on the collected user behavior data in the secure environment of TEE.

[0137] The specific form of the data collected from the read events described above is not particularly limited in this specification; for example, in one example, the data collected from the read events can specifically be a statistical indicator obtained by performing statistical analysis on the read events.

[0138] In one embodiment shown, in order to improve the security of using the electronic credential as the device ID, the trusted application may regenerate the device ID each time when generating the electronic credential as the device ID for the client.

[0139] It should be noted that the so-called regeneration of device ID means that each time the trusted application receives a device ID acquisition request sent by the client, it will regenerate a device ID for the client; for example, the trusted application can first clear the device ID that has been generated for the client last time, and then regenerate a device ID for the client based on the user behavior data in the device ID acquisition request, so as to ensure that each time the client obtains the target event, the trusted application will regenerate a new device ID for the client at the request of the client. In this way, the security risks faced by using a fixed device ID can be avoided.

[0140] The above-mentioned device ID may include any form of device ID generated for the above-mentioned client by the above-mentioned trusted application based on a preset generation algorithm; wherein, the specific generation algorithm adopted by the above-mentioned trusted application when generating the device ID for the client is not specifically limited in this specification; for example, the above-mentioned generation algorithm may specifically be a specific encryption algorithm.

[0141] It should be noted that, in actual applications, the specific type of the generation algorithm used by the above-mentioned trusted application when calculating the above-mentioned device ID can be determined based on the type of user behavior data used when calculating the above-mentioned electronic certificate;

[0142] In one embodiment shown, if the above-mentioned user behavior data does not involve privacy data related to the above-mentioned terminal device, the above-mentioned generation algorithm can specifically adopt a specific encryption algorithm; in this case, the encryption key of the above-mentioned server can be maintained in the above-mentioned trusted execution environment; when the above-mentioned trusted application calculates the above-mentioned device ID, it can generate an electronic certificate by encrypting the user behavior data based on the encryption key of the above-mentioned server maintained in the above-mentioned trusted execution environment.

[0143] Among them, the above-mentioned encryption algorithm can be a symmetric encryption algorithm or an asymmetric encryption algorithm; accordingly, the encryption key can be a symmetric encryption key or an asymmetric encryption key; for example, when the above-mentioned encryption algorithm is an asymmetric encryption algorithm, the above-mentioned encryption key can specifically be the public key of the server.

[0144] In another embodiment shown, if the above-mentioned user behavior data involves privacy data related to the above-mentioned terminal device, in order to avoid privacy data leakage, an irreversible generation algorithm can be used to generate the above-mentioned device ID; the so-called irreversible generation algorithm refers to an algorithm whose generation parameters cannot be restored through the generated electronic certificate; for example, in one example, if the above-mentioned user behavior data involves privacy data related to the above-mentioned terminal device, a hash algorithm can be selected as the above-mentioned generation algorithm.

[0145] In this specification, after the trusted application regenerates the device ID for the client, the device ID can be returned to the client, and the client further sends the device ID to the server. After receiving the device ID sent by the client, the server can perform risk identification related to the target event based on the device ID.

[0146] For example, in one example, when the device ID is generated by encrypting the user behavior data based on the encryption key of the server, the server can decrypt the user behavior data from the device ID based on the decryption key corresponding to the encryption key, and then perform risk identification related to the target event based on the decrypted user behavior data; for example, when the encryption algorithm is an asymmetric encryption algorithm, the encryption key can specifically be the public key of the server, and the decryption key can specifically be the private key of the server.

[0147] It should be noted that the risk identification related to the above-mentioned target events may specifically include any form of risk identification services related to the above-mentioned target events; for example, the above-mentioned identification services may specifically include fraud risk identification, registration environment risk identification, verification environment risk identification, etc. related to the above-mentioned target events, which will not be listed one by one in this specification; the specific content of further risk identification related to the above-mentioned target events performed by the server based on the device ID usually depends on the specific type of the above-mentioned target event.

[0148] For example, in the case where the target event is a virtual resource claiming event corresponding to a marketing business initiated by the server, in this scenario, the server performs further risk identification related to the target event based on the device ID, which may specifically include fraud risk identification related to virtual resource claiming for the user based on the device ID;

[0149] For another example, taking the above-mentioned target event as a user account registration event triggered by a user on the client, in this scenario, the server performs further risk identification related to the above-mentioned target event based on the device ID, which may specifically include identifying the registration environment risks related to the user account registration event for the above-mentioned user based on the device ID.

[0150] For another example, the target event is a business verification event triggered by a user on the client; for example, the business verification event may specifically include a user identity verification event, a payment verification event initiated by a user, and so on; in this scenario, the server performs further risk identification related to the target event based on the device ID, which may specifically include verification environment risk identification related to the business verification event for the user based on the device ID.

[0151] The following will take the above-mentioned target event as an example of a virtual resource collection event corresponding to a marketing business initiated by the server, and combine it with the virtual resource collection scenario corresponding to the marketing business initiated by the server to explain the technical solution of this specification in detail.

[0152] It should be emphasized that this scenario is taken as an example only for illustration and is not intended to be a specific limitation on the technical solution of this specification.

[0153] In this scenario, the user behavior data may be risk behavior data related to the risk behavior related to the fraud risk performed by the user on the terminal device. The generation algorithm may be an asymmetric encryption algorithm; and the device ID may be an electronic certificate obtained by encrypting and calculating the risk behavior data using a trusted application.

[0154] In this case, the encryption key of the server can be maintained as the public key of the server in the trusted execution environment; when the trusted application calculates the device ID, it can encrypt the risk behavior data based on the public key of the server maintained in the trusted execution environment to generate an electronic certificate as the device ID.

[0155] After receiving the electronic certificate as the device ID sent by the client, the server can decrypt the electronic certificate based on the private key corresponding to the public key of the server to obtain the risk behavior data, and then can identify the fraud risk related to the virtual resource collection for the user based on the decrypted risk behavior data and in combination with a certain risk identification strategy to determine whether the user has the fraud risk;

[0156] Among them, the above-mentioned risk identification strategy is not specifically limited in this specification. In practical applications, it can be defined based on the specific data type contained in the risk behavior data, and is no longer specifically limited in this specification.

[0157] It should be noted that the above-mentioned virtual resources may include any form of user rewards related to the marketing activities initiated by the above-mentioned server, such as points, electronic coupons, and the like.

[0158] It should be noted that the risk behaviors related to the above-mentioned fraud risks may specifically include any form of behaviors related to the above-mentioned fraud risks, which are not particularly limited in this specification;

[0159] In one embodiment shown, since the fraud risk identification of users is usually completed based on the device ID, in actual applications, users usually frequently reset the terminal device to change the device ID of the terminal device in order to repeatedly receive the virtual resources distributed by the server; therefore, the risk behavior related to the above-mentioned fraud risk may specifically include the behavior of the user resetting the terminal device;

[0160] The device reset for the above terminal devices includes but is not limited to the following actions:

[0161] Restoring the factory settings of the operating system of the above-mentioned terminal device; installing a new operating system on the above-mentioned terminal device (commonly known as flashing); destroying the terminal device and replacing the hardware.

[0162] In this case, the risk behavior data includes any form of data used to determine whether the terminal device is frequently reset by the user during the virtual resource distribution cycle. The virtual resource distribution cycle usually refers to the business cycle of the marketing business.

[0163] Correspondingly, after the server decrypts the risk behavior data from the electronic certificate based on the private key, it can identify whether the number of times the user resets the terminal device during the virtual resource issuance cycle reaches a preset threshold based on the risk behavior data; if so, it can be determined that the user has a fraud risk associated with the virtual resource collection;

[0164] In one implementation shown, the risk behavior data may specifically include: the number of times the terminal device is reset by the user; and the timestamp corresponding to the time of the device reset.

[0165] Among them, in actual applications, the timestamp corresponding to the moment when the above-mentioned device is reset may specifically include the timestamp corresponding to the moment when the above-mentioned terminal device is reset by the device each time, or it may only include the timestamp corresponding to the moment when the above-mentioned terminal device was most recently reset by the device; or, the timestamp corresponding to the moment when the device was reset for the most recent N times; in actual applications, it can be flexibly selected.

[0166] For example, in implementation, the above-mentioned trusted application can specifically carry a counting program (Count) for the number of device resets of the terminal device; accordingly, the above-mentioned trusted application can obtain the event of device reset of the terminal device. Whenever the above-mentioned trusted application obtains the event of device reset of the terminal device, it can respond to the device reset event, increase the program count of the above-mentioned counting program by 1, and collect the timestamp corresponding to the moment when the device reset of the terminal device occurs this time, so as to complete the collection of the above-mentioned risk behavior data. Of course, the collection process of risk behavior data described above can also be completed independently by the client, and will not be repeated here.

[0167] The specific method by which the trusted application obtains the event of a device reset occurring on the terminal device is not specifically limited in this specification;

[0168] For example, taking the terminal device as a mobile phone equipped with an Android operating system, every time the mobile phone restarts, the trusted application can read the system file named sys.boot.reason to obtain the event that caused the mobile phone to restart; if the mobile phone restart is caused by the user resetting the device for the mobile phone, then the trusted application can obtain the device reset event for the mobile phone.

[0169] When collecting the timestamp corresponding to the moment when the terminal device is reset, in order to ensure the accuracy of the collected timestamp, the terminal device may first perform a clock synchronization with the server to ensure that the terminal device and the server have the same clock.

[0170] In this case, after the server decrypts the non-privacy data from the electronic certificate based on the private key, it can determine whether the number of times the terminal device is reset by the user during the virtual resource issuance period reaches a preset threshold based on the number of times the terminal device is reset and the timestamp corresponding to the time when the terminal device is reset.

[0171] For example, in implementation, if the timestamp corresponding to the moment of device reset only includes the timestamp corresponding to the moment when the terminal device was reset N times in the last, the value of N can be set to a value not less than the preset threshold value; in this way, through the timestamp corresponding to the moment when the device was reset N times in the last, it can be determined whether the number of times the terminal device was reset by the user during the issuance cycle of the virtual resource has reached the preset threshold value; for example, if the timestamps corresponding to the moments when the device was reset N times in the last are all within the time range corresponding to the issuance cycle of the virtual resource, and the value of N is greater than or equal to the preset threshold value, it can be directly determined that the number of times the device was reset by the user has reached the preset threshold value,

[0172] If the number of times the user resets the terminal device during the issuance cycle of the virtual resources reaches a preset threshold, it can be considered that the user has performed the risky behavior of frequently resetting the terminal device during the issuance cycle of the virtual resources, and the user can be determined to have the above-mentioned fraud risk.

[0173] Of course, in addition to the user resetting the terminal device described above, the risky behaviors related to the above-mentioned fraud risks may also include other risky behaviors related to the above-mentioned fraud risks in actual applications; for example, frequent registration of user accounts, frequent switching of client login accounts, etc., which will not be listed one by one in this manual.

[0174] In the above technical solution, since the device ID of the terminal device obtained by the server is a device ID independently generated by the client based on the user behavior data related to the user behavior performed by the user on the client, and is no longer the real device ID of the terminal device; therefore, the client sends the generated device ID as the real device ID of the terminal device to the server, and does not expose the real device ID of the terminal device to the server, thereby reducing the privacy leakage and security risks faced by the exposure of the device ID.

[0175] Corresponding to the above method embodiments, the present application also provides device embodiments.

[0176] Corresponding to the above method embodiment, this specification also provides an embodiment of a risk identification device.

[0177] The embodiments of the risk identification device of this specification can be applied to electronic devices. The device embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the processor of the electronic device in which it is located reads the corresponding computer program instructions in the non-volatile memory into the memory and runs them.

[0178] From the hardware level, Figure 2 The figure is a hardware structure diagram of the electronic device where the risk identification device of this manual is located, except Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in which the device in the embodiment is located may also include other hardware according to the actual function of the electronic device, which will not be described in detail.

[0179] Figure 3 It is a block diagram of a risk identification device shown in an exemplary embodiment of this specification.

[0180] Please refer to Figure 3The risk identification device 30 can be applied to the aforementioned Figure 2 On a client running in the electronic device shown; the device 30 includes:

[0181] The acquisition module 301 acquires a target event triggered by a user on the client; wherein the target event includes a virtual resource claiming event corresponding to a marketing business initiated by the server;

[0182] A generating module 302 generates a device ID of the terminal device based on user behavior data related to a user behavior performed by a user on the client in response to the target event;

[0183] The sending module 303 sends the generated device ID to the server, so that the server performs fraud risk identification related to the virtual resource claiming event based on the device ID.

[0184] In this embodiment, the terminal device is equipped with a trusted execution environment; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment;

[0185] The generating module 302:

[0186] Sending a device ID acquisition request to the trusted application, so that the trusted application generates a device ID of the terminal device for the client based on user behavior data related to user behavior performed by the user on the terminal device in response to the device ID acquisition request;

[0187] The device ID generated by the trusted application is obtained.

[0188] In this embodiment, the device ID is an electronic certificate generated by the trusted application based on the user behavior data.

[0189] In this embodiment, the trusted application generates a device ID for the client based on the user behavior data in response to the device ID acquisition request, including:

[0190] The trusted application clears the device ID generated for the client in response to the device ID acquisition request, and regenerates the device ID for the client based on the user behavior data.

[0191] In this embodiment, the device ID includes an electronic credential generated by the trusted application by encrypting and calculating the user behavior data based on an encryption key of the server maintained in the trusted execution environment, so that the server can decrypt the user behavior data from the electronic credential based on a decryption key corresponding to the encryption key, and perform fraud risk identification related to the virtual resource collection event based on the user behavior data.

[0192] In this embodiment, the encryption key is the public key of the server; the decryption key is the private key of the server.

[0193] In this embodiment, the user behavior includes user risk behavior.

[0194] In this embodiment, the virtual resource is a user reward related to the marketing activity initiated by the server.

[0195] In this embodiment, the user risk behavior includes the user's behavior of resetting the terminal device; the user behavior data includes data for determining whether the terminal device is frequently reset by the user during the issuance cycle of the virtual resource.

[0196] In this embodiment, the risk behavior data includes:

[0197] The number of times the terminal device is reset by the user; and

[0198] The timestamp corresponding to the moment when the device was reset.

[0199] In this embodiment, the trusted execution environment maintains a count of device resets occurring on the terminal device;

[0200] The device 30 further comprises:

[0201] The acquisition module obtains the event of device reset of the terminal device; in response to the event of device reset of the terminal device, increases the count of device reset of the terminal device maintained by the trusted execution environment by 1, and acquires the timestamp corresponding to the moment when the device reset of the terminal device occurs.

[0202] In this embodiment, the trusted execution environment includes an execution environment built based on the TEE security hardware mounted on the terminal device.

[0203] Figure 4 It is a block diagram of another risk identification device shown in an exemplary embodiment of this specification.

[0204] Please refer to Figure 4 The risk identification device 40 can also be applied to the aforementioned Figure 2 On the electronic device shown; the electronic device serves as a server; the device 40 includes:

[0205] The receiving module 401 receives a device ID sent by a client running on a terminal device; wherein the device ID is a device ID generated by the client in response to a target event triggered by a user, based on user behavior data related to a user behavior performed by the user on the client; the target event includes a virtual resource claiming event corresponding to a marketing business initiated by a server;

[0206] The identification module 402 performs fraud risk identification related to the virtual resource claiming event based on the device ID.

[0207] In this embodiment, a trusted execution environment is installed on the terminal device; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment; the device ID includes a device ID generated for the client by the trusted application in response to a device ID acquisition request sent by the client, based on user behavior data related to user behavior performed by the user on the terminal device.

[0208] In this embodiment, the device ID is an electronic certificate generated by the trusted application based on the user behavior data.

[0209] In this embodiment, the electronic credential includes an electronic credential generated by the trusted application by encrypting and calculating the user behavior data based on the encryption key of the server maintained in the trusted execution environment;

[0210] The identification module 402:

[0211] The user behavior data is decrypted from the electronic voucher based on a decryption key corresponding to the encryption key, and fraud risk identification related to the virtual resource claiming event is performed based on the user behavior data.

[0212] In this embodiment, the encryption key is the public key of the server; the decryption key is the private key of the server.

[0213] In this embodiment, the user behavior includes user risk behavior.

[0214] In this embodiment, the virtual resource is a user reward related to the marketing activity initiated by the server.

[0215] In this embodiment, the user risk behavior includes the user's behavior of resetting the terminal device; the user behavior data includes data for determining whether the terminal device is frequently reset by the user during the issuance cycle of the virtual resource.

[0216] In this embodiment, the user behavior data includes:

[0217] The number of times the terminal device is reset by the user; and the timestamp corresponding to the time when the device is reset;

[0218] The identification module 402:

[0219] Based on the number of times the terminal device is reset by the user; and the timestamp corresponding to the time of the device reset, determining whether the number of times the terminal device is reset by the user within the virtual resource issuance cycle reaches a preset threshold;

[0220] If so, it is determined that the user has a fraud risk associated with claiming the virtual resource.

[0221] In this embodiment, the trusted execution environment includes an execution environment built based on the TEE security hardware mounted on the terminal device.

[0222] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0223] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0224] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0225] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0226] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0227] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0228] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0229] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0230] The above description is merely a preferred embodiment of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be included in the scope of protection of one or more embodiments of the present specification.

Claims

1. A method for obtaining a device ID, applied to a client running on a terminal device; the method comprises: Acquire a target event triggered by a user on a client; wherein the target event includes an event that triggers the client to acquire a device ID of the terminal device; In response to the target event, clearing the device ID generated for the client, and regenerating the device ID of the terminal device for the client based on user behavior data related to user behavior performed by the user on the terminal device; the user behavior includes user risk behavior; The generated device ID is sent to the server as the real device ID of the terminal device, so that the server performs risk identification based on the device ID.

2. According to the method of claim 1, the target event includes a virtual resource claiming event corresponding to the marketing business initiated by the server.

3. According to the method of claim 2, the device ID sent to the server is used to enable the server to perform fraud risk identification related to the virtual resource collection event based on the device ID.

4. The method according to claim 1, wherein a trusted execution environment is installed on the terminal device; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment; In response to the target event, clearing the device ID generated for the client, and regenerating the device ID of the terminal device for the client based on user behavior data related to the user behavior performed by the user on the terminal device, including: In response to the target event, sending a device ID acquisition request to the trusted application, so that the trusted application responds to the device ID acquisition request, clears the device ID generated for the client, and regenerates the device ID of the terminal device for the client based on user behavior data related to user behavior performed by the user on the terminal device; The device ID generated by the trusted application is obtained. 5 . The method according to claim 4 , wherein the device ID is an electronic credential generated by the trusted application based on the user behavior data.

6. According to the method described in claim 4, the device ID includes an electronic credential generated by the trusted application by encrypting and calculating the user behavior data based on the encryption key of the server maintained in the trusted execution environment, so that the server can decrypt the user behavior data from the electronic credential based on a decryption key corresponding to the encryption key, and perform fraud risk identification related to the virtual resource collection event based on the user behavior data.

7. According to the method of claim 6, the encryption key is the public key of the server; the decryption key is the private key of the server.

8. The method according to claim 2, wherein the virtual resource is a user reward related to a marketing activity initiated by the server.

9. According to the method of claim 1, the user risk behavior includes the user's behavior of resetting the terminal device; the user behavior data includes data for determining whether the terminal device is frequently reset by the user during the virtual resource issuance cycle.

10. The method according to claim 9, wherein the user behavior data comprises: The number of times the terminal device is reset by the user; as well as, The timestamp corresponding to the moment when the device was reset.

11. The method according to claim 4, wherein the trusted execution environment maintains a count of device resets occurring on the terminal device; The method further comprises: Obtaining an event that a device reset occurs on the terminal device; In response to an event in which a device reset occurs on the terminal device, a count of device resets occurring on the terminal device maintained by the trusted execution environment is increased by 1, and a timestamp corresponding to a time when the device reset occurs on the terminal device is collected.

12. According to the method of claim 4, the trusted execution environment includes an execution environment built based on the TEE security hardware mounted on the terminal device.

13. A method for obtaining a device ID, applied to a server; the method comprising: Receive a device ID as the real device ID of the terminal device sent by a client running on the terminal device, and perform risk identification based on the device ID; wherein the device ID is the client's response to a target event triggered by a user, clear the device ID generated for the client, and regenerate the device ID based on user behavior data related to user behavior performed by the user on the client; the target event includes an event that triggers the client to obtain the device ID of the terminal device; the user behavior includes user risk behavior.

14. The method according to claim 13, wherein the target event comprises a virtual resource claiming event corresponding to a marketing business initiated by the server.

15. The method according to claim 14, performing risk identification based on the device ID, comprising: Fraud risk identification associated with the virtual resource claiming event is performed based on the device ID.

16. According to the method according to claim 15, a trusted execution environment is installed on the terminal device; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment; the device ID includes the device ID generated for the client being cleared by the trusted application in response to a device ID acquisition request sent by the client to the trusted application based on the target event, and a device ID regenerated for the client based on user behavior data related to user behavior performed by the user on the terminal device. 17 . The method according to claim 16 , wherein the device ID is an electronic credential generated by the trusted application based on the user behavior data.

18. The method according to claim 17, wherein the electronic credential comprises an electronic credential generated by the trusted application by encrypting and calculating the user behavior data based on an encryption key of the server maintained in the trusted execution environment; Performing fraud risk identification related to the virtual resource claiming event based on the device ID includes: The user behavior data is decrypted from the electronic voucher based on a decryption key corresponding to the encryption key, and fraud risk identification related to the virtual resource claiming event is performed based on the user behavior data.

19. The method according to claim 18, wherein the encryption key is a public key of the server; and the decryption key is a private key of the server.

20. The method according to claim 14, wherein the virtual resource is a user reward related to a marketing activity initiated by the server.

21. According to the method of claim 15, the user risk behavior includes the user's behavior of resetting the terminal device; the user behavior data includes data for determining whether the terminal device is frequently reset by the user during the issuance cycle of the virtual resource.

22. The method according to claim 21, wherein the user behavior data comprises: The number of times the terminal device is reset by the user; and, a timestamp corresponding to the moment when the device is reset; The step of performing fraud risk identification related to the virtual resource claiming event based on the user behavior data includes: Based on the number of times the terminal device is reset by the user; and the timestamp corresponding to the time of the device reset, determining whether the number of times the terminal device is reset by the user within the virtual resource issuance cycle reaches a preset threshold; If so, it is determined that the user has a fraud risk associated with claiming the virtual resource.

23. According to the method of claim 16, the trusted execution environment includes an execution environment built based on the TEE security hardware mounted on the terminal device.

24. A device for obtaining a device ID, applied to a client running on a terminal device; the device comprises: An acquisition module, which acquires a target event triggered by a user on a client; wherein the target event includes an event that triggers the client to acquire a device ID of the terminal device; A generating module, in response to the target event, clears the device ID generated for the client, and regenerates the device ID of the terminal device for the client based on user behavior data related to user behavior performed by the user on the terminal device; the user behavior includes user risk behavior; The sending module sends the generated device ID as the real device ID of the terminal device to the server, so that the server performs risk identification based on the device ID.

25. The device according to claim 24, wherein the target event comprises a virtual resource claiming event corresponding to a marketing business initiated by the server.

26. The apparatus according to claim 25, wherein the device ID sent to the server is used to enable the server to perform fraud risk identification related to the virtual resource collection event based on the device ID.

27. The apparatus according to claim 24, wherein a trusted execution environment is mounted on the terminal device; a trusted application for generating a device ID of the terminal device is run in the trusted execution environment; The generation module: In response to the target event, sending a device ID acquisition request to the trusted application, so that the trusted application responds to the device ID acquisition request, clears the device ID generated for the client, and regenerates the device ID of the terminal device for the client based on user behavior data related to user behavior performed by the user on the terminal device; The device ID generated by the trusted application is obtained.

28. The apparatus according to claim 27, wherein the device ID is an electronic credential generated by the trusted application based on the user behavior data.

29. According to the apparatus according to claim 27, the device ID includes an electronic credential generated by the trusted application by encrypting and calculating the user behavior data based on the encryption key of the server maintained in the trusted execution environment, so that the server can decrypt the user behavior data from the electronic credential based on a decryption key corresponding to the encryption key, and perform fraud risk identification related to the virtual resource collection event based on the user behavior data.

30. The device according to claim 29, wherein the encryption key is a public key of the server; and the decryption key is a private key of the server.

31. The device according to claim 25, wherein the virtual resource is a user reward related to a marketing activity initiated by the server.

32. According to the apparatus according to claim 24, the user risk behavior includes the user's behavior of resetting the terminal device; the user behavior data includes data for determining whether the terminal device is frequently reset by the user during the issuance cycle of virtual resources.

33. The apparatus according to claim 32, wherein the user behavior data comprises: The number of times the terminal device is reset by the user; as well as, The timestamp corresponding to the moment when the device was reset.

34. The apparatus according to claim 27, wherein the trusted execution environment maintains a count of device resets occurring on the terminal device; The device also includes: A collection module, for acquiring an event that a device reset occurs on the terminal device; In response to an event in which a device reset occurs on the terminal device, a count of device resets occurring on the terminal device maintained by the trusted execution environment is increased by 1, and a timestamp corresponding to a time when the device reset occurs on the terminal device is collected.

35. According to the apparatus of claim 27, the trusted execution environment comprises an execution environment built based on TEE security hardware mounted on the terminal device.

36. A device for obtaining a device ID, applied to a server; the device comprises: A receiving module, receiving a device ID sent by a client running on a terminal device as a real device ID of the terminal device; An identification module performs risk identification based on the device ID; wherein the device ID is the target event triggered by the user in response to the client, clears the device ID generated for the client, and regenerates the device ID based on user behavior data related to the user behavior performed by the user on the client; the target event includes an event that triggers the client to obtain the device ID of the terminal device; the user behavior includes user risk behavior.

37. The device according to claim 36, wherein the target event comprises a virtual resource claiming event corresponding to a marketing business initiated by the server.

38. The apparatus according to claim 37, wherein the identification module: Fraud risk identification associated with the virtual resource claiming event is performed based on the device ID.

39. According to the apparatus according to claim 38, a trusted execution environment is installed on the terminal device; a trusted application for generating a device ID of the terminal device is running in the trusted execution environment; the device ID includes the device ID generated for the client being cleared by the trusted application in response to a device ID acquisition request sent by the client to the trusted application based on the target event, and a device ID regenerated for the client based on user behavior data related to user behavior performed by the user on the terminal device.

40. The apparatus according to claim 39, wherein the device ID is an electronic credential generated by the trusted application based on the user behavior data.

41. The apparatus according to claim 40, wherein the electronic credential comprises an electronic credential generated by the trusted application by performing encryption calculation on the user behavior data based on an encryption key of the server maintained in the trusted execution environment; The identification module: The user behavior data is decrypted from the electronic voucher based on a decryption key corresponding to the encryption key, and fraud risk identification related to the virtual resource claiming event is performed based on the user behavior data.

42. According to the device described in claim 41, the encryption key is the public key of the server; the decryption key is the private key of the server.

43. The device according to claim 37, wherein the virtual resource is a user reward related to a marketing campaign initiated by the server.

44. According to the apparatus of claim 38, the user risk behavior includes the user's behavior of resetting the terminal device; the user behavior data includes data for determining whether the terminal device is frequently reset by the user during the issuance cycle of the virtual resource.

45. The apparatus according to claim 44, wherein the user behavior data comprises: The number of times the terminal device is reset by the user; and, a timestamp corresponding to the moment when the device is reset; The identification module: Based on the number of times the terminal device is reset by the user; and the timestamp corresponding to the time of the device reset, determining whether the number of times the terminal device is reset by the user within the virtual resource issuance cycle reaches a preset threshold; If so, it is determined that the user has a fraud risk associated with claiming the virtual resource.

46. ​​According to the apparatus according to claim 39, the trusted execution environment includes an execution environment built based on the TEE security hardware mounted on the terminal device.

47. An electronic device comprising: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1-12 or claims 13-23 by running the executable instructions.

48. A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the method as claimed in any one of claims 1 to 12 or claims 13 to 23.

Images