Identity authentication method, device, computer equipment, storage medium and program product

Abstract

The present application relates to an identity authentication method, device, computer equipment, storage medium and program product, and belongs to the field of information security technology. The method comprises: obtaining device information related to identity authentication of a target device; performing credibility identification processing on the target device according to the device information to obtain an identification result; according to the identification result, determining a target identity authentication method that matches the target device from a plurality of preset identity authentication methods, and performing identity authentication on the user operating the target device according to the target identity authentication method. The use of this method can achieve high security and ease of use of identity authentication.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an identity authentication method, apparatus, computer equipment, storage medium and program product. Background Art

[0002] With the rapid development of network information technology and the sudden increase in the number of Internet users in recent years, information security issues have become increasingly prominent. In the field of information security, identity authentication is used to confirm the authenticity of the user's identity, and as the first door for access control and authorization, it is the basis of all trust, and its importance is self-evident. The identity authentication methods in the prior art mainly include SMS verification codes, static passwords, biometric information such as faces, U shields, and password devices. However, although identity authentication methods such as SMS verification codes, static passwords, and biometric information such as faces are easy to use, they are less secure. Although identity authentication methods such as U shields and password devices are more secure, they are less easy to use. Therefore, providing a highly easy-to-use and highly secure identity authentication method has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] Based on this, it is necessary to provide an identity authentication method, device, computer equipment, storage medium and program product to address the above technical problems.

[0004] In a first aspect, the present application provides an identity authentication method, the method comprising: obtaining device information of a target device related to identity authentication; performing credibility identification processing on the target device based on the device information to obtain an identification result; based on the identification result, determining a target identity authentication method that matches the target device from a plurality of preset identity authentication methods, and authenticating a user operating the target device based on the target identity authentication method.

[0005] In one of the embodiments, based on the recognition result, a target identity authentication method matching the target device is determined from a plurality of preset identity authentication methods, including: based on the recognition result, a target trusted type corresponding to the target device is determined from a plurality of preset trusted types, wherein different trusted types correspond to different identity authentication methods; and the identity authentication method corresponding to the target trusted type is used as the target identity authentication method.

[0006] In one of the embodiments, multiple trusted types include a highly trusted type, a generally trusted type, and an untrusted type. The identity authentication method corresponding to the highly trusted type is empty, the identity authentication method corresponding to the generally trusted type is some of the multiple identity authentication methods, and the identity authentication method corresponding to the untrusted type includes all of the multiple identity authentication methods.

[0007] In one of the embodiments, the recognition result is a credibility value, different credibility types correspond to different credibility value intervals, and a target credibility type corresponding to the target device is determined from a plurality of preset credibility types based on the recognition result, including: determining the target credibility value interval in which the recognition result is located; and taking the credibility type corresponding to the target credibility value interval as the target credibility type.

[0008] In one embodiment, the device information includes: identification information of the target device, historical authentication information of the target device, and the cumulative number of days in which the user successfully passes authentication through the target device. The historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each historical authentication method.

[0009] In one of the embodiments, credibility identification processing is performed on the target device based on the device information to obtain an identification result, including: determining a credibility loss value of the target device based on the identification information of the target device, the credibility loss value is used to characterize the threat level of the target device; obtaining a historical authentication value of the target device based on multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method; and determining the identification result based on the credibility loss value, the historical authentication value, and the historical accumulated days.

[0010] In one of the embodiments, determining a credibility loss value of a target device based on identification information of the target device includes: determining whether identification information of the target device exists in a threat intelligence library, the threat intelligence library including a plurality of threat lists of different threat levels; if identification information of the target device exists in the threat intelligence library, determining a credibility loss value based on the threat list to which the identification information of the target device belongs; if identification information of the target device exists in the threat intelligence library, using a preset value as the credibility loss value.

[0011] In one of the embodiments, the threat list in the threat intelligence library includes a device gray list and a device black list. The device gray list includes identification information of multiple devices with a tendency to commit financial fraud, and the device black list includes identification information of devices that have committed financial fraud.

[0012] In one of the embodiments, the process of creating a threat intelligence library includes: obtaining multiple candidate devices to be divided into a list; determining whether each candidate device has ever been involved in a financial fraud incident, and adding the identification information of the candidate device where the financial fraud incident has occurred to the device blacklist; for each candidate device that has not been involved in a financial fraud incident, obtaining the number of first users who have used the candidate device for identity authentication within a preset time period, and obtaining the number of second users who have used the candidate device for identity authentication within a preset time period and have successfully authenticated; adding the identification information of the candidate device where the number of first users is greater than a first threshold or the number of second users is greater than a second threshold to the device graylist.

[0013] In one of the embodiments, a historical authentication value of a target device is obtained based on multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method, including: determining the weight values ​​corresponding to each historical authentication method based on a preset credibility weight table, the credibility weight table including multiple authentication methods and the weight values ​​corresponding to each authentication method; performing a weighted sum operation based on the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain the historical authentication value.

[0014] In one embodiment, the multiple identity authentication methods include a static authentication method, a dynamic authentication method, a biometric authentication method, and a media authentication method.

[0015] In the second aspect, the present application also provides an identity authentication device, which includes: a first acquisition module, used to obtain device information of the target device related to identity authentication; a second acquisition module, used to perform credibility identification processing on the target device based on the device information to obtain an identification result; a determination module, used to determine a target identity authentication method that matches the target device from a plurality of preset identity authentication methods based on the identification result, and authenticate the user operating the target device according to the target identity authentication method.

[0016] In one of the embodiments, the determination module is specifically used to: determine a target trusted type corresponding to the target device from a plurality of preset trusted types according to the identification result, wherein different trusted types correspond to different identity authentication methods; and use the identity authentication method corresponding to the target trusted type as the target identity authentication method.

[0017] In one of the embodiments, multiple trusted types include a highly trusted type, a generally trusted type, and an untrusted type. The identity authentication method corresponding to the highly trusted type is empty, the identity authentication method corresponding to the generally trusted type is some of the multiple identity authentication methods, and the identity authentication method corresponding to the untrusted type includes all of the multiple identity authentication methods.

[0018] In one embodiment, the recognition result is a credibility value, and different credibility types correspond to different credibility value intervals. The determination module is specifically used to: determine the target credibility value interval in which the recognition result is located; and use the credibility type corresponding to the target credibility value interval as the target credibility type.

[0019] In one embodiment, the device information includes: identification information of the target device, historical authentication information of the target device, and the cumulative number of days in which the user successfully passes authentication through the target device. The historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each historical authentication method.

[0020] In one of the embodiments, the second acquisition module is specifically used to: determine the credibility loss value of the target device based on the identification information of the target device, the credibility loss value is used to characterize the threat level of the target device; obtain the historical authentication value of the target device based on multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method; determine the identification result based on the credibility loss value, the historical authentication value and the historical accumulated days.

[0021] In one of the embodiments, the second acquisition module is specifically used to: determine whether there is identification information of the target device in the threat intelligence library, the threat intelligence library includes multiple threat lists of different threat levels; if there is identification information of the target device in the threat intelligence library, determine the credibility loss value based on the threat list to which the identification information of the target device belongs; if there is identification information of the target device in the threat intelligence library, use a preset value as the credibility loss value.

[0022] In one of the embodiments, the threat list in the threat intelligence library includes a device gray list and a device black list. The device gray list includes identification information of multiple devices with a tendency to commit financial fraud, and the device black list includes identification information of devices that have committed financial fraud.

[0023] In one of the embodiments, the device also includes a creation module, which is used to obtain multiple candidate devices to be divided into lists; determine whether each candidate device has ever had a financial fraud incident, and add the identification information of the candidate device that has had a financial fraud incident to the device blacklist; for each candidate device that has not had a financial fraud incident, obtain the number of first users who use the candidate device for identity authentication within a preset time period, and obtain the number of second users who use the candidate device for identity authentication within a preset time period and have successfully authenticated; add the identification information of the candidate device whose number of first users is greater than a first threshold or whose number of second users is greater than a second threshold to the device graylist.

[0024] In one of the embodiments, the second acquisition module is specifically used to: determine the weight values ​​corresponding to each historical authentication method based on a preset credibility weight table, the credibility weight table including multiple authentication methods and the weight values ​​corresponding to each authentication method; perform weighted sum operation according to the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain the historical authentication value.

[0025] In one embodiment, the multiple identity authentication methods include a static authentication method, a dynamic authentication method, a biometric authentication method, and a media authentication method.

[0026] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0027] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects above.

[0028] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods described in the first aspect are implemented.

[0029] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0030] In the embodiment of the present application, first, the device information related to the identity authentication of the target device is obtained; secondly, the target device is subjected to credibility identification processing according to the device information to obtain an identification result; finally, according to the identification result, a target identity authentication method matching the target device is determined from a plurality of preset identity authentication methods, and the user operating the target device is authenticated according to the target identity authentication method. That is, the embodiment of the present application can determine the target identity authentication method matching the target device based on the identification result of the target device. For example, when the identification result shows that the target device has low security, a target identity authentication method with high security can be determined; when the identification result shows that the target device has high security, a target identity authentication method with high ease of use can be determined. In this way, the embodiment of the present application provides an identity authentication method that is easy to use and highly secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A schematic diagram of an implementation environment provided for an embodiment of the present application;

[0032] Figure 2 A flowchart of an identity authentication method provided in an embodiment of the present application;

[0033] Figure 3 A flowchart of a technical process for determining a target identity authentication method provided in an embodiment of the present application;

[0034] Figure 4 A flowchart of a technical process for obtaining an identification result of a target device provided in an embodiment of the present application;

[0035] Figure 5 A flowchart of a process for creating a threat intelligence library provided in an embodiment of the present application;

[0036] Figure 6 A flowchart of an identity authentication method provided in an embodiment of the present application;

[0037] Figure 7 A block diagram of an identity authentication device provided in an embodiment of the present application;

[0038] Figure 8 A block diagram of another identity authentication device provided in an embodiment of the present application;

[0039] Fig. 9 An internal structure diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] With the rapid development of network information technology and the sudden increase in the number of Internet users in recent years, information security issues have become increasingly prominent. In the field of information security, identity authentication, as the first door to access control and authorization, is the basis of all trust. Its importance is self-evident, especially for commercial banks. Lax user identity authentication may lead to the target person breaking through the authentication defense line, logging into the customer's electronic banking and stealing the customer's funds, causing serious economic losses.

[0042] Identity authentication technology in the network is used to confirm the authenticity of the visitor's identity and allow the identified user to perform access operations. Identity authentication mainly includes what the customer knows (authentication based on what the customer knows, such as static passwords), what the customer has (authentication based on what the customer has, such as downlink SMS verification codes, dynamic verification codes of password devices, first-generation USB shields, etc.), what the customer is (authentication based on the customer's unique physical characteristics, such as face, fingerprint, voiceprint, iris, etc.), what the customer does (authentication based on customer behavior, such as uplink SMS verification codes, second-generation USB shields, etc.). Strong identity authentication uses two or more different types of identity authentication methods, which can improve the accuracy and security of identity authentication. At present, the Internet industry generally uses static passwords, SMS verification codes, face information and other identity authentication methods. However, with the continuous development of black industry technology and customers' increasing requirements for product experience, the shortcomings of different identity authentication technologies are becoming more and more prominent. Static passwords and SMS verification codes are easily obtained by target personnel through database collision, phishing, social engineering fraud, GSM SMS hijacking, etc. or leaked through third parties. Target personnel can obtain biometric information such as face information on social networking sites such as Weibo and WeChat Moments and then bypass it through malicious program attacks, device hijacking, brute force cracking, etc. Although U shields and password devices are very secure, they are not easy to use. How to make identity authentication more secure and effective, prevent attacks from target personnel and target teams, protect customer transaction security while being transparent to customers, and provide a highly easy-to-use and highly secure identity authentication method has become a technical problem that needs to be solved urgently.

[0043] In view of this, the embodiments of the present application provide an identity authentication method, apparatus, computer device, storage medium and program product, by which high security and ease of use of identity authentication can be achieved.

[0044] The identity authentication method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1 As shown, the execution subject of the identity authentication method provided in the embodiment of the present application can be a terminal device, or a terminal device cluster composed of multiple terminal devices. Among them, the terminal device can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Different terminal devices can communicate with each other through wired or wireless methods. The wireless method can be achieved through WIFI, operator networks, NFC (near field communication) or other technologies.

[0045] See also Figure 2, which shows a flow chart of an identity authentication method provided by an embodiment of the present application, the identity authentication method can be applied to Figure 1 In the terminal device shown in FIG. 1 , the terminal device may be a target device. Figure 2 As shown, the identity authentication method may include the following steps:

[0046] Step 201: Obtain device information related to identity authentication of the target device.

[0047] Optionally, the device information may include: identification information of the target device, historical authentication information of the target device, and the cumulative number of days in which the user successfully passed authentication through the target device, and the historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each historical authentication method.

[0048] Among them, the identification information of the target device can be a unique ID of the target device. Optionally, the unique ID of the target device can be generated by the local area network address, device identification code (International Mobile Equipment Identity, IMEI for short) and CPU serial number of the target device. Optionally, the process of generating a unique ID may include: first, obtaining data of the target device including but not limited to the local area network address, IMEI and CPU serial number; second, generating a unique ID based on salted hashing according to the obtained data. Optionally, the identification information of the target device can also be other information, which is not limited in the embodiment of the present application, as long as the identification information can identify the target device.

[0049] The historical authentication method may include but is not limited to static authentication method, dynamic authentication method, biometric authentication method and media authentication method, among which the static authentication method may include but is not limited to login password authentication method, card password authentication method and payment password authentication method, the dynamic authentication method may include but is not limited to uplink SMS authentication method, downlink SMS authentication method and password device authentication method, the biometric authentication method may include but is not limited to face biometric authentication method, fingerprint biometric authentication method and voiceprint biometric authentication method, and the media authentication method may include but is not limited to second-generation U shield authentication method, SIM authentication method and mobile gateway authentication method. The number of historical authentication times is the number of times the user uses the historical authentication method to operate the target device for identity authentication. For example, assuming that a certain target device in an actual application, the historical authentication method includes two types of historical downlink SMS authentication method and historical face biometric authentication method, the number of times the target device is operated for identity authentication using the downlink SMS authentication method is two times, and the number of times the target device is operated for identity authentication using the face biometric authentication method is three times, then the number of historical authentication times corresponding to the historical downlink SMS authentication method is two times, and the number of historical authentication times corresponding to the historical face biometric authentication method is three times.

[0050] The cumulative number of days that a user has successfully passed authentication on a target device, where authentication means passing identity authentication, and successful authentication means that the user has successfully logged into the target device. For example, if a user logged into the target device 7 days from August 1 to August 15, 2021, the cumulative number of days is 7 days.

[0051] Step 202: Perform credibility identification processing on the target device according to the device information to obtain an identification result.

[0052] Among them, the recognition result can characterize the credibility of the target device. Optionally, the recognition result can include but is not limited to the credibility interval of the target device, the credibility value of the target device and the credibility type of the target device, wherein the credibility interval, credibility value and credibility type can all be used to characterize the credibility of the target device.

[0053] Step 203: According to the recognition result, a target identity authentication method matching the target device is determined from a plurality of preset identity authentication methods, and an identity authentication is performed on the user operating the target device according to the target identity authentication method.

[0054] Optionally, the multiple identity authentication methods may include a static authentication method, a dynamic authentication method, a biometric authentication method, and a medium authentication method. Since the recognition result represents the credibility of the target device, a target identity authentication method matching the credibility of the target device may be determined based on the recognition result.

[0055] In the actual application of the target device, in the prior art, when operating the target device for identity authentication, the credibility level of the target device itself is not obtained. Instead, different applications in the target device usually use different identity authentication methods. For example, bank-related APPs usually use an authentication method that combines U-shield and static passwords, WeChat APP login usually uses a static password authentication method, and payment after logging into WeChat APP usually uses a payment password authentication method, a face biometric authentication method, or a fingerprint biometric authentication method. In the embodiment of the present application, the target device will be subjected to credibility identification processing through the collected device information related to identity authentication. That is, the embodiment of the present application will obtain the credibility of the target device itself, and according to the identification information, historical authentication information, historical cumulative days and other device information related to identity authentication of the target device, to An identification result characterizing the credibility of the target device is obtained, and then a target identity authentication method matching the target device is determined based on the identification result. For example, if the identification result of the target device characterizes that the target device has high credibility, then in this case, an appropriate inclination can be made between high-security and high-usability identity authentication methods, and the high-usability identity authentication method is determined as the target identity authentication method. On the contrary, if the identification result of the target device characterizes that the target device has low credibility, then a high-security identity authentication method can be determined as the target identity authentication method. Assume that the target device has a history of fraud such as fund theft, and therefore has low credibility. In this case, all authentication methods such as static authentication methods, dynamic authentication methods, biometric authentication methods, and media authentication methods can be used as target identity authentication methods. In this way, the security of identity authentication is guaranteed.

[0056] In the embodiment of the present application, first, the device information related to the identity authentication of the target device is obtained; secondly, the target device is subjected to credibility identification processing according to the device information to obtain an identification result; finally, according to the identification result, a target identity authentication method matching the target device is determined from a plurality of preset identity authentication methods, and the user operating the target device is authenticated according to the target identity authentication method. That is, the embodiment of the present application can determine the target identity authentication method matching the target device based on the identification result of the target device. For example, when the identification result shows that the target device has low security, a target identity authentication method with high security can be determined; when the identification result shows that the target device has high security, a target identity authentication method with high ease of use can be determined. In this way, the embodiment of the present application provides an identity authentication method that is easy to use and highly secure.

[0057] See also Figure 3In the embodiment of the present application, a technical process for determining a target identity authentication method is provided, and the execution subject of the technical process may be the terminal device mentioned above, wherein the terminal device may be the target device. Figure 3 As shown, the technical process of determining the target identity authentication method may include the following steps:

[0058] Step 301: Determine a target trusted type corresponding to a target device from a plurality of preset trusted types according to the recognition result.

[0059] Among them, different trusted types correspond to different identity authentication methods. Optionally, multiple trusted types may include a highly trusted type, a generally trusted type and an untrusted type. Among them, the identity authentication method corresponding to the highly trusted type may be empty, the identity authentication method corresponding to the generally trusted type may be some of the multiple identity authentication methods, and the identity authentication method corresponding to the untrusted type may include all of the multiple identity authentication methods.

[0060] Optionally, the recognition result can be a credibility value, and different credibility types correspond to different credibility value intervals. Optionally, a highly credibility type corresponds to a highly credibility value interval, a generally credibility type corresponds to a generally credibility value interval, and an untrustworthy type corresponds to an untrustworthy value interval, wherein the lower bound of the highly credibility value interval is greater than the upper bound of the generally credibility value interval, and the lower bound of the generally credibility value interval is greater than the upper bound of the untrustworthy value interval. Optionally, the process of determining the target credibility type corresponding to the target device from a plurality of preset credibility types according to the recognition result may include: first, determining the target credibility value interval in which the recognition result is located; second, taking the credibility type corresponding to the target credibility value interval as the target credibility type. In order to make the process description clear, the process is further explained: credibility recognition processing is performed on the target device to obtain a credibility value, and the target credibility value interval in which the credibility value is located is determined, and the credibility type corresponding to the target credibility value interval is taken as the target credibility type.

[0061] Step 302: Use the identity authentication method corresponding to the target trusted type as the target identity authentication method.

[0062] Optionally, the target device is of a highly trusted type, indicating that the target device is completely trustworthy. In this case, the user can log in directly without identity authentication. Since the target device is of a highly trusted type and identity authentication is not performed, the identity authentication of the target device has high usability while ensuring high security.

[0063] Optionally, when the target device is a generally trusted type, some of the multiple authentication methods can be used as the target authentication method. For example, when the target device is a generally trusted type, one or two of the static authentication method, dynamic authentication method, biometric authentication method, and media authentication method can be used as the target authentication method.

[0064] Optionally, the target device is an untrusted type, which indicates that the target device has had fraud incidents such as fund theft in the past, and the threat level is high. In this case, in order to ensure the security of user transactions and prevent property from being stolen, all identity authentication methods such as static authentication, dynamic authentication, biometric authentication, and media authentication can be used as target identity authentication methods. If one of the identity authentication methods fails to authenticate successfully, the user identity authentication fails, and the target device cannot be logged in based on the user's information. Therefore, the security of user identity authentication is protected.

[0065] See also Figure 4 In the embodiment of the present application, a technical process for obtaining the identification result of the target device is provided. The execution subject of the technical process may be the terminal device mentioned above, wherein the terminal device may be the target device. Figure 4 As shown, the step of obtaining the recognition result of the target device may include the following steps:

[0066] Step 401: Determine the credibility loss value of the target device according to the identification information of the target device.

[0067] Optionally, determining the credibility loss value of the target device according to the identification information of the target device may include the following steps:

[0068] First, determine whether the target device's identification information exists in the threat intelligence library.

[0069] Among them, the threat intelligence library includes multiple threat lists of different threat levels. Optionally, the threat list may include a device gray list and a device black list. The device gray list includes identification information of multiple devices with a tendency to commit financial fraud, and the device black list includes identification information of devices that have committed financial fraud.

[0070] Secondly, if the identification information of the target device exists in the threat intelligence library, the credibility loss value is determined according to the threat list to which the identification information of the target device belongs.

[0071] Optionally, different threat lists may correspond to different credibility loss values, because the credibility loss value represents the threat level of the target device. Therefore, the credibility loss value corresponding to the device gray list is smaller than the credibility loss value corresponding to the device black list. Optionally, the credibility loss value may be a value obtained based on a large amount of experimental data and after conducting experiments on a certain platform, or it may be a fixed value set by the developer.

[0072] Step 402: Obtain a historical authentication value of the target device according to multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method.

[0073] Optionally, the step of obtaining the historical authentication value of the target device according to multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method may include:

[0074] First, based on a preset credibility weight table, the weight values ​​corresponding to each historical authentication method are determined.

[0075] The credibility weight table includes multiple authentication methods and the weight values ​​corresponding to each authentication method. Optionally, the credibility weight table can be shown in the following table:

[0076]

[0077] It should be noted that the weight value corresponding to each authentication method can be a value obtained based on a large amount of experimental data and after conducting experiments on a certain platform, or it can be a fixed value set by the developer, and is not limited to the values ​​in the above table.

[0078] Secondly, a weighted sum operation is performed based on the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain a historical authentication value. The calculation formula for the historical authentication value is as follows:

[0079]

[0080] Among them, x i For authentication method, Authentication method x i The weight value of Authentication method x i The number of authentications.

[0081] Step 403: Determine the recognition result according to the credibility loss value, the historical authentication value and the historical cumulative number of days.

[0082] The recognition result may be a credibility value, and the calculation formula of the recognition result is as follows:

[0083]

[0084] in,ID is the identification information, K ID is the recognition result, x i For authentication method, Authentication method x i The weight value of Authentication method x i The number of authentications, D is the cumulative number of historical days, g1 is the credibility loss value corresponding to the device gray list, g2 is the credibility loss value corresponding to the device black list, where g2>g1.

[0085] In the embodiment of the present application, according to the device information corresponding to the target device, the identification result corresponding to the target device can be obtained, and the identification result is used to characterize the credibility of the target device itself. Based on the identification result obtained in the embodiment of the present application, the target identity authentication method matching the target device can be flexibly determined to achieve high security and high usability of identity authentication.

[0086] See also Figure 5 In the embodiment of the present application, a process for creating a threat intelligence library is provided, and the execution subject of the creation process can be the terminal device mentioned above. Figure 5 As shown, the process of creating the threat intelligence library may include the following steps:

[0087] Step 501: Obtain multiple candidate devices for list division.

[0088] Step 502: Determine whether each candidate device has ever had a financial fraud incident, and add identification information of the candidate device that has had a financial fraud incident to a device blacklist.

[0089] Optionally, it is possible to manually determine whether a candidate device has experienced a financial fraud event, or the terminal device can automatically determine whether a candidate device has experienced a financial fraud event based on abnormal information of the candidate device, and this embodiment of the present application does not limit this. In the case of determining that a candidate device has experienced a financial fraud event, the identification information corresponding to the candidate device can be added to the device blacklist of the threat intelligence library, wherein the threat intelligence library can be stored in the database of the terminal device.

[0090] Step 503: For each candidate device that has not experienced any financial fraud, obtain the number of first users who have used the candidate device for identity authentication within a preset time period, and obtain the number of second users who have used the candidate device for identity authentication within the preset time period and have successfully authenticated.

[0091] Among them, the preset duration can be a value obtained after conducting experiments on a certain platform based on a large amount of experimental data, or it can be a fixed value set by the developer. In order to ensure the freshness of the threat intelligence library, the preset duration should not be too long, usually not more than three months. The number of first users who use the candidate device for identity authentication within the preset duration, where the identity authentication includes both successful and failed authentication. For example: Assume that the preset duration of the candidate device is within seven days before the current moment, and user A, user B, and user C use the candidate device for identity authentication within these seven days, then the number of first users is 3. If only user C successfully authenticates using the candidate device, then the number of second users is 1.

[0092] Step 504: Add identification information of candidate devices whose number of first users is greater than a first threshold or whose number of second users is greater than a second threshold to a device gray list.

[0093] The first threshold and the second threshold may be values ​​obtained based on a large amount of experimental data and after conducting experiments on a certain platform, or may be fixed values ​​set by developers.

[0094] In an embodiment of the present application, a process for creating a threat intelligence library is provided. The threat intelligence library obtained based on the creation process may include a device gray list and a device black list, wherein the device gray list and the device black list respectively include identification information of candidate devices. The threat intelligence library obtained in the embodiment of the present application provides a data basis for the subsequent device identification results.

[0095] See also Figure 6 , which shows a flow chart of an identity authentication method provided by an embodiment of the present application, the identity authentication method can be applied to the terminal device mentioned above, wherein the terminal device can be a target device. Figure 6 As shown, the identity authentication method may include the following steps:

[0096] Step 601: Obtain device information related to identity authentication of the target device.

[0097] Among them, the identification information of the target device, the historical authentication information of the target device and the historical cumulative number of days that the user successfully passed the authentication through the target device, the historical authentication information includes multiple historical authentication methods and the historical authentication times corresponding to each historical authentication method.

[0098] Step 602: Determine whether there is identification information of the target device in the threat intelligence library, where the threat intelligence library includes a plurality of threat lists of different threat levels.

[0099] Step 603: If the identification information of the target device exists in the threat intelligence library, the credibility loss value is determined according to the threat list to which the identification information of the target device belongs.

[0100] The credibility loss value is used to characterize the threat level of the target device.

[0101] Step 604: Determine the weight values ​​corresponding to each historical authentication method based on a preset credibility weight table, where the credibility weight table includes multiple authentication methods and the weight values ​​corresponding to each authentication method.

[0102] Step 605: Perform a weighted sum operation based on the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain a historical authentication value.

[0103] Step 606: Determine the recognition result according to the credibility loss value, the historical authentication value and the historical cumulative number of days.

[0104] Step 607: Determine a target trusted type corresponding to the target device from a plurality of preset trusted types according to the identification result.

[0105] Among them, different trust types correspond to different identity authentication methods.

[0106] Step 608: Use the identity authentication method corresponding to the target trusted type as the target identity authentication method.

[0107] Step 609: Authenticate the user operating the target device according to the target identity authentication method.

[0108] In the embodiment of the present application, the user's identity is indirectly authenticated by performing credibility identification processing on the target device used by the user. The recognition result of the target device is obtained through the credibility loss value, historical authentication value and historical cumulative days, and the target credibility type corresponding to the target device is determined according to the recognition result, and the user's identity authentication is controlled through different credibility types. The identity authentication method is flexibly selected according to the credibility type to achieve high security and high usability of user identity authentication.

[0109] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0110] See also Figure 7 , which shows a block diagram of an identity authentication device 700 provided in an embodiment of the present application, and the identity authentication device can be configured in the above-mentioned terminal device. Figure 7 As shown, the identity authentication device 700 includes a first acquisition module 701 , a second acquisition module 702 and a determination module 703 .

[0111] Among them, the first acquisition module 701 is used to obtain device information related to identity authentication of the target device; the second acquisition module 702 is used to perform credibility identification processing on the target device according to the device information to obtain an identification result; the determination module 703 is used to determine a target identity authentication method that matches the target device from a plurality of preset identity authentication methods according to the identification result, and authenticate the user operating the target device according to the target identity authentication method.

[0112] In an optional embodiment of the present application, the determination module 701 is specifically used to: determine the target trusted type corresponding to the target device from multiple preset trusted types based on the identification result, wherein different trusted types correspond to different identity authentication methods; and use the identity authentication method corresponding to the target trusted type as the target identity authentication method.

[0113] In an optional embodiment of the present application, multiple trusted types include a highly trusted type, a generally trusted type, and an untrusted type. The identity authentication method corresponding to the highly trusted type is empty, the identity authentication method corresponding to the generally trusted type is some of the multiple identity authentication methods, and the identity authentication method corresponding to the untrusted type includes all of the multiple identity authentication methods.

[0114] In an optional embodiment of the present application, the recognition result is a credibility value, and different credibility types correspond to different credibility value intervals. The determination module 701 is specifically used to: determine the target credibility value interval in which the recognition result is located; and use the credibility type corresponding to the target credibility value interval as the target credibility type.

[0115] In an optional embodiment of the present application, the device information includes: identification information of the target device, historical authentication information of the target device, and the cumulative number of days in which the user has successfully passed authentication through the target device. The historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each historical authentication method.

[0116] In an optional embodiment of the present application, the second acquisition module 702 is specifically used to: determine the credibility loss value of the target device based on the identification information of the target device, the credibility loss value is used to characterize the threat level of the target device; obtain the historical authentication value of the target device based on multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method; determine the identification result based on the credibility loss value, the historical authentication value and the historical accumulated days.

[0117] In an optional embodiment of the present application, the second acquisition module 702 is specifically used to: determine whether there is identification information of the target device in the threat intelligence library, the threat intelligence library includes multiple threat lists of different threat levels; if there is identification information of the target device in the threat intelligence library, determine the credibility loss value according to the threat list to which the identification information of the target device belongs; if there is identification information of the target device in the threat intelligence library, use a preset value as the credibility loss value.

[0118] In an optional embodiment of the present application, the threat list in the threat intelligence library includes a device gray list and a device black list. The device gray list includes identification information of multiple devices with a tendency to commit financial fraud, and the device black list includes identification information of devices in which financial fraud incidents have occurred.

[0119] In an optional embodiment of the present application, the second acquisition module 702 is specifically used to: determine the weight values ​​corresponding to each historical authentication method based on a preset credibility weight table, the credibility weight table including multiple authentication methods and the weight values ​​corresponding to each authentication method; perform weighted sum operation according to the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain the historical authentication value.

[0120] See also Figure 8 , which shows a block diagram of another identity authentication device 800 provided in an embodiment of the present application. In addition to the modules of the identity authentication device 700, the identity authentication device 800 also includes a creation module 704.

[0121] The creation module 704 is used to obtain multiple candidate devices to be divided into lists; determine whether each candidate device has ever had a financial fraud incident, and add the identification information of the candidate device that has had a financial fraud incident to the device blacklist; for each candidate device that has not had a financial fraud incident, obtain the number of first users who use the candidate device for identity authentication within a preset time period, and obtain the number of second users who use the candidate device for identity authentication within a preset time period and have successfully authenticated; add the identification information of the candidate device whose number of first users is greater than a first threshold or whose number of second users is greater than a second threshold to the device graylist.

[0122] In an optional embodiment of the present application, the multiple identity authentication methods include a static authentication method, a dynamic authentication method, a biometric authentication method, and a media authentication method.

[0123] The identity authentication device provided in the embodiment of the present application can implement the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0124] Each module in the above-mentioned identity authentication device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0125] In one embodiment, a computer device is provided. The computer device may be a terminal device, and its internal structure diagram may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an identity authentication method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0126] Those skilled in the art will understand that Fig. 9The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0127] In one embodiment of the present application, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: obtaining device information related to identity authentication of a target device; performing credibility identification processing on the target device based on the device information to obtain an identification result; determining a target identity authentication method that matches the target device from a plurality of preset identity authentication methods based on the identification result, and authenticating a user operating the target device based on the target identity authentication method.

[0128] In one embodiment of the present application, the processor also implements the following steps when executing the computer program: determining a target trusted type corresponding to the target device from a plurality of preset trusted types based on the identification result, wherein different trusted types correspond to different identity authentication methods; and using the identity authentication method corresponding to the target trusted type as the target identity authentication method.

[0129] In one embodiment of the present application, multiple trusted types include a highly trusted type, a generally trusted type, and an untrusted type. The identity authentication method corresponding to the highly trusted type is empty, the identity authentication method corresponding to the generally trusted type is some of the multiple identity authentication methods, and the identity authentication method corresponding to the untrusted type includes all of the multiple identity authentication methods.

[0130] In one embodiment of the present application, the recognition result is a credibility value, and different credibility types correspond to different credibility value intervals. When the processor executes the computer program, it also implements the following steps: determining the target credibility value interval in which the recognition result is located; and taking the credibility type corresponding to the target credibility value interval as the target credibility type.

[0131] In one embodiment of the present application, the device information includes: identification information of the target device, historical authentication information of the target device, and the cumulative number of days in which the user has successfully passed authentication through the target device. The historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each historical authentication method.

[0132] In one embodiment of the present application, the processor also implements the following steps when executing the computer program: determining a credibility loss value of the target device based on the identification information of the target device, the credibility loss value being used to characterize the threat level of the target device; obtaining a historical authentication value of the target device based on multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method; and determining an identification result based on the credibility loss value, the historical authentication value, and the historical accumulated days.

[0133] In one embodiment of the present application, the processor also implements the following steps when executing the computer program: determining whether there is identification information of the target device in the threat intelligence library, the threat intelligence library including multiple threat lists of different threat levels; if there is identification information of the target device in the threat intelligence library, determining the credibility loss value based on the threat list to which the identification information of the target device belongs; if there is identification information of the target device in the threat intelligence library, using a preset value as the credibility loss value.

[0134] In one of the embodiments, the threat list in the threat intelligence library includes a device gray list and a device black list. The device gray list includes identification information of multiple devices with a tendency to commit financial fraud, and the device black list includes identification information of devices that have committed financial fraud.

[0135] In one embodiment of the present application, the processor also implements the following steps when executing the computer program: obtaining multiple candidate devices to be divided into lists; determining whether each candidate device has ever had a financial fraud incident, and adding the identification information of the candidate device where the financial fraud incident has occurred to the device blacklist; for each candidate device that has not had a financial fraud incident, obtaining the number of first users who have used the candidate device for identity authentication within a preset time period, and obtaining the number of second users who have used the candidate device for identity authentication within a preset time period and have successfully authenticated; adding the identification information of the candidate device where the number of first users is greater than a first threshold or the number of second users is greater than a second threshold to the device graylist.

[0136] In one embodiment of the present application, the processor also implements the following steps when executing the computer program: based on a preset credibility weight table, determining the weight values ​​corresponding to each historical authentication method, the credibility weight table includes multiple authentication methods and the weight values ​​corresponding to each authentication method; performing a weighted sum operation according to the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain a historical authentication value.

[0137] In one embodiment, the multiple identity authentication methods include a static authentication method, a dynamic authentication method, a biometric authentication method, and a media authentication method.

[0138] The computer device provided in the embodiment of the present application has similar implementation principles and technical effects to those of the above-mentioned method embodiment, and will not be described in detail here.

[0139] In one embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: obtaining device information related to identity authentication of a target device; performing credibility identification processing on the target device based on the device information to obtain an identification result; based on the identification result, determining a target identity authentication method that matches the target device from a plurality of preset identity authentication methods, and authenticating a user operating the target device based on the target identity authentication method.

[0140] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: determining a target trusted type corresponding to the target device from a plurality of preset trusted types based on the identification result, wherein different trusted types correspond to different identity authentication methods; and using the identity authentication method corresponding to the target trusted type as the target identity authentication method.

[0141] In one embodiment of the present application, multiple trusted types include a highly trusted type, a generally trusted type, and an untrusted type. The identity authentication method corresponding to the highly trusted type is empty, the identity authentication method corresponding to the generally trusted type is some of the multiple identity authentication methods, and the identity authentication method corresponding to the untrusted type includes all of the multiple identity authentication methods.

[0142] In one embodiment of the present application, the recognition result is a credibility value, different credibility types correspond to different credibility value intervals, and when the computer program is executed by the processor, the following steps are also implemented: determining the target credibility value interval in which the recognition result is located; and taking the credibility type corresponding to the target credibility value interval as the target credibility type.

[0143] In one embodiment of the present application, the device information includes: identification information of the target device, historical authentication information of the target device, and the cumulative number of days in which the user has successfully passed authentication through the target device. The historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each historical authentication method.

[0144] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: determining a credibility loss value of the target device based on the identification information of the target device, the credibility loss value being used to characterize the threat level of the target device; obtaining a historical authentication value of the target device based on multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method; and determining an identification result based on the credibility loss value, the historical authentication value, and the historical accumulated days.

[0145] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: determining whether there is identification information of the target device in the threat intelligence library, the threat intelligence library including a plurality of threat lists of different threat levels; if there is identification information of the target device in the threat intelligence library, determining a credibility loss value based on the threat list to which the identification information of the target device belongs; if there is identification information of the target device in the threat intelligence library, using a preset value as the credibility loss value.

[0146] In one of the embodiments, the threat list in the threat intelligence library includes a device gray list and a device black list. The device gray list includes identification information of multiple devices with a tendency to commit financial fraud, and the device black list includes identification information of devices that have committed financial fraud.

[0147] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: obtaining multiple candidate devices to be divided into lists; determining whether each candidate device has ever had a financial fraud incident, and adding the identification information of the candidate device where the financial fraud incident has occurred to the device blacklist; for each candidate device that has not had a financial fraud incident, obtaining the number of first users who have used the candidate device for identity authentication within a preset time period, and obtaining the number of second users who have used the candidate device for identity authentication within a preset time period and have successfully authenticated; adding the identification information of the candidate device where the number of first users is greater than a first threshold or the number of second users is greater than a second threshold to the device graylist.

[0148] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: based on a preset credibility weight table, the weight values ​​corresponding to each historical authentication method are determined, the credibility weight table includes multiple authentication methods and the weight values ​​corresponding to each authentication method; a weighted sum operation is performed according to the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain a historical authentication value.

[0149] In one embodiment, the multiple identity authentication methods include a static authentication method, a dynamic authentication method, a biometric authentication method, and a media authentication method.

[0150] The computer-readable storage medium provided in this embodiment has similar implementation principles and technical effects to those of the above method embodiments, and will not be described in detail here.

[0151] In one embodiment of the present application, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor:

[0152] Obtain device information related to identity authentication of the target device; perform credibility identification processing on the target device according to the device information to obtain an identification result; based on the identification result, determine a target identity authentication method that matches the target device from multiple preset identity authentication methods, and authenticate the user operating the target device according to the target identity authentication method.

[0153] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: determining a target trusted type corresponding to the target device from a plurality of preset trusted types based on the identification result, wherein different trusted types correspond to different identity authentication methods; and using the identity authentication method corresponding to the target trusted type as the target identity authentication method.

[0154] In one embodiment of the present application, multiple trusted types include a highly trusted type, a generally trusted type, and an untrusted type. The identity authentication method corresponding to the highly trusted type is empty, the identity authentication method corresponding to the generally trusted type is some of the multiple identity authentication methods, and the identity authentication method corresponding to the untrusted type includes all of the multiple identity authentication methods.

[0155] In one embodiment of the present application, the recognition result is a credibility value, different credibility types correspond to different credibility value intervals, and when the computer program is executed by the processor, the following steps are also implemented: determining the target credibility value interval in which the recognition result is located; and taking the credibility type corresponding to the target credibility value interval as the target credibility type.

[0156] In one embodiment of the present application, the device information includes: identification information of the target device, historical authentication information of the target device, and the cumulative number of days in which the user has successfully passed authentication through the target device. The historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each historical authentication method.

[0157] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: determining a credibility loss value of the target device based on the identification information of the target device, the credibility loss value being used to characterize the threat level of the target device; obtaining a historical authentication value of the target device based on multiple historical authentication methods and the number of historical authentications corresponding to each historical authentication method; and determining an identification result based on the credibility loss value, the historical authentication value, and the historical accumulated days.

[0158] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: determining whether there is identification information of the target device in the threat intelligence library, the threat intelligence library including a plurality of threat lists of different threat levels; if there is identification information of the target device in the threat intelligence library, determining a credibility loss value based on the threat list to which the identification information of the target device belongs; if there is identification information of the target device in the threat intelligence library, using a preset value as the credibility loss value.

[0159] In one of the embodiments, the threat list in the threat intelligence library includes a device gray list and a device black list. The device gray list includes identification information of multiple devices with a tendency to commit financial fraud, and the device black list includes identification information of devices that have committed financial fraud.

[0160] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: obtaining multiple candidate devices to be divided into lists; determining whether each candidate device has ever had a financial fraud incident, and adding the identification information of the candidate device where the financial fraud incident has occurred to the device blacklist; for each candidate device that has not had a financial fraud incident, obtaining the number of first users who have used the candidate device for identity authentication within a preset time period, and obtaining the number of second users who have used the candidate device for identity authentication within a preset time period and have successfully authenticated; adding the identification information of the candidate device where the number of first users is greater than a first threshold or the number of second users is greater than a second threshold to the device graylist.

[0161] In one embodiment of the present application, when the computer program is executed by the processor, the following steps are also implemented: based on a preset credibility weight table, the weight values ​​corresponding to each historical authentication method are determined, the credibility weight table includes multiple authentication methods and the weight values ​​corresponding to each authentication method; a weighted sum operation is performed according to the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain a historical authentication value.

[0162] In one embodiment, the multiple identity authentication methods include a static authentication method, a dynamic authentication method, a biometric authentication method, and a media authentication method.

[0163] The implementation principle and technical effects of the computer program product provided in this embodiment are similar to those of the above method embodiments and will not be described in detail here.

[0164] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0165] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0166] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An identity authentication method, characterized in that: The method comprises: Obtain device information related to identity authentication of the target device; the device information includes: identification information of the target device, historical authentication information of the target device, and the cumulative number of historical days that users have successfully passed authentication through the target device, the historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each of the historical authentication methods; Determining whether identification information of the target device exists in a threat intelligence library, wherein the threat intelligence library includes a plurality of threat lists of different threat levels; If the identification information of the target device exists in the threat intelligence library, determining the credibility loss value according to the threat list to which the identification information of the target device belongs; Based on the preset credibility weight table, determine the weight value corresponding to each historical authentication method; Perform a weighted sum operation based on the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain a historical authentication value; Determine the identification result based on the credibility loss value, historical authentication value and historical cumulative days; According to the recognition result, a target identity authentication method matching the target device is determined from a plurality of preset identity authentication methods, and an identity authentication is performed on a user operating the target device according to the target identity authentication method; a target device with a high credibility is matched with an identity authentication method with a high ease of use; a target device with a low credibility is matched with an identity authentication method with a high security.

2. The method according to claim 1, characterized in that: The step of determining a target identity authentication method that matches the target device from a plurality of preset identity authentication methods according to the recognition result includes: Determining a target trusted type corresponding to the target device from a plurality of preset trusted types according to the identification result, wherein different trusted types correspond to different identity authentication methods; The identity authentication method corresponding to the target trusted type is used as the target identity authentication method.

3. The method according to claim 2, characterized in that The multiple trusted types include a highly trusted type, a generally trusted type and an untrusted type. The identity authentication method corresponding to the highly trusted type is empty, the identity authentication method corresponding to the generally trusted type is a part of the multiple identity authentication methods, and the identity authentication method corresponding to the untrusted type includes all of the multiple identity authentication methods.

4. The method according to claim 2, characterized in that: The recognition result is a credibility value, different credibility types correspond to different credibility value intervals, and determining a target credibility type corresponding to the target device from a plurality of preset credibility types according to the recognition result includes: Determining a target confidence value interval for the recognition result; The trust type corresponding to the target trust value interval is used as the target trust type.

5. The method according to any one of claims 1 to 4, characterized in that: The threat list in the threat intelligence library includes a device gray list and a device black list. The device gray list includes identification information of multiple devices with a tendency to commit financial fraud, and the device black list includes identification information of devices that have committed financial fraud.

6. The method according to claim 5, characterized in that The process of creating the threat intelligence library includes: Acquire multiple candidate devices to be divided into a list; Determine whether each candidate device has ever had a financial fraud incident, and add identification information of the candidate device that has had a financial fraud incident to the device blacklist; For each candidate device that has not had any financial fraud incidents, obtain the number of first users who use the candidate device for identity authentication within a preset time period, and obtain the number of second users who use the candidate device for identity authentication within the preset time period and whose identity authentication is successful; Add identification information of candidate devices whose number of the first users is greater than a first threshold or whose number of the second users is greater than a second threshold to the device gray list.

7. The method according to any one of claims 1 to 4, characterized in that: The multiple identity authentication methods include a static authentication method, a dynamic authentication method, a biometric authentication method and a medium authentication method.

8. An identity authentication device, characterized in that: The device comprises: A first acquisition module is used to acquire device information related to identity authentication of a target device; the device information includes: identification information of the target device, historical authentication information of the target device, and the cumulative number of historical days that a user successfully passes authentication through the target device, the historical authentication information includes multiple historical authentication methods and the number of historical authentication times corresponding to each of the historical authentication methods; The second acquisition module is used to determine whether the identification information of the target device exists in the threat intelligence library, and the threat intelligence library includes a plurality of threat lists of different threat levels; if the identification information of the target device exists in the threat intelligence library, the credibility loss value is determined according to the threat list to which the identification information of the target device belongs; based on a preset credibility weight table, the weight values ​​corresponding to each historical authentication method are determined; a weighted sum operation is performed according to the weight values ​​corresponding to each historical authentication method and the number of historical authentications corresponding to each historical authentication method to obtain a historical authentication value; and an identification result is determined according to the credibility loss value, the historical authentication value, and the historical cumulative number of days; A determination module is used to determine, based on the recognition result, a target identity authentication method that matches the target device from a plurality of preset identity authentication methods, and authenticate a user operating the target device based on the target identity authentication method; a target device with a high credibility is matched with an identity authentication method with high ease of use; a target device with a low credibility is matched with an identity authentication method with high security.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images