Account detection method and device, terminal, storage medium and program product

Abstract

Embodiments of the present application disclose a kind of account detection method, device, terminal, storage medium and program product, belong to network security field.The method comprises: in response to the current login account belongs to account to be detected, display detection prompt pop-up window;In response to the detection trigger operation in detection prompt pop-up window, terminal environment detection, face recognition detection and certificate detection are carried out for the current login account, and detection result is obtained;The login state of the current login account is controlled based on the detection result.The abnormal account obtained by leasing, stealing and other ways is detected from multiple dimensions in the embodiments of the present application, which can defend against a variety of black production attack means, and prevent black production from bypassing detection, thereby improving the interception rate of abnormal account.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an account detection method, device, terminal, storage medium, and program product. Background Technology

[0002] Most current game applications have parental control platforms that automatically log out minors from gaming when they reach their playtime limit within a certain period, preventing them from becoming addicted. However, some minors use adults' ID cards to register accounts or rent or buy accounts from the black market.

[0003] In related technologies, the parental guardian platform guides users to verify their identity, such as through facial recognition, when registering an account, in order to determine whether the user is a certificate holder.

[0004] However, current facial detection technology is limited by device hardware, and some black market operators can still bypass identity verification by forging facial masks, fake videos, etc., resulting in a low interception rate for abnormal accounts. Summary of the Invention

[0005] This application provides an account detection method, device, terminal, storage medium, and program product, which can detect account theft and rental by minors from multiple dimensions and improve the interception rate of abnormal accounts. The technical solution is as follows:

[0006] On the one hand, this application provides an account detection method, the method comprising:

[0007] If the currently logged-in account is the account to be tested, a test prompt pop-up will be displayed.

[0008] In response to the detection trigger operation in the detection prompt pop-up window, terminal environment detection, face recognition detection, and document detection are performed on the currently logged-in account to obtain the detection result, which is either that the currently logged-in account is a normal account or that the currently logged-in account is an abnormal account.

[0009] The login status of the currently logged-in account is controlled based on the detection results.

[0010] On the other hand, this application provides an account detection device, the device comprising:

[0011] The display module is used to display a detection prompt pop-up window in response to the current logged-in account belonging to the account to be detected;

[0012] The detection module is used to respond to the detection trigger operation in the detection prompt pop-up window, perform terminal environment detection, face recognition detection and document detection for the currently logged-in account, and obtain the detection result, wherein the detection result is that the currently logged-in account is a normal account or the currently logged-in account is an abnormal account;

[0013] The control module is used to control the login status of the currently logged-in account based on the detection results.

[0014] On the other hand, this application provides a terminal, the terminal including a processor and a memory; the memory stores at least one program, the at least one program being loaded and executed by the processor to implement the account detection method as described above.

[0015] On the other hand, this application provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the account detection method as described above.

[0016] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A terminal's processor reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the terminal to perform an account detection method provided in various alternative implementations of the above aspect.

[0017] The technical solutions provided in this application have at least the following beneficial effects:

[0018] In this embodiment, by combining terminal environment detection, facial recognition detection, and document detection, abnormal accounts obtained through rental, theft, and other means are detected from multiple dimensions. This can defend against various black market attack methods and prevent black market operators from bypassing detection, thereby increasing the interception rate of abnormal accounts, making it more difficult for black market operators to bypass account detection, and thus reducing the phenomenon of minors renting and stealing accounts, and enhancing the security management of minors' online activities. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of an implementation environment provided by an exemplary embodiment of this application;

[0020] Figure 2 This is a flowchart of an exemplary embodiment of the account detection method provided in this application;

[0021] Figure 3 This is a flowchart of an account detection method provided in another exemplary embodiment of this application;

[0022] Figure 4 This is a schematic diagram of an account detection process provided in an exemplary embodiment of this application;

[0023] Figure 5 This is a flowchart illustrating the interaction between an account detection application, an account detection backend, and a terminal system to perform terminal environment detection, provided in an exemplary embodiment of this application.

[0024] Figure 6 This is a flowchart illustrating how a user installs an account detection application, provided in an exemplary embodiment of this application.

[0025] Figure 7 This is a flowchart of an account detection method provided in another exemplary embodiment of this application;

[0026] Figure 8 This is a flowchart illustrating the interaction between a child protection platform, an account detection application, an account detection backend, and a third-party platform for account detection, provided in an exemplary embodiment of this application.

[0027] Figure 9 This is a structural block diagram of an account detection device provided in an exemplary embodiment of this application;

[0028] Figure 10 This is a structural block diagram of a terminal provided in an exemplary embodiment of this application. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0030] In this article, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0031] Please refer to Figure 1 The diagram illustrates an implementation environment provided by an exemplary embodiment of this application. This implementation environment includes: a terminal 110, an account detection server 120, and a parental control backend 130.

[0032] Terminal 110 runs a game application 111 and an account detection application 112. When the parental control plugin in the game application 111 detects abnormal behavior in user 113 (such as a minor renting someone else's account), it launches the account detection application 112 to perform an account detection. The account detection application 112 combines terminal environment detection, facial recognition detection, and document detection to determine whether the currently logged-in account is abnormal, and uploads the detection results to the account detection server 120.

[0033] Account detection application 112 sends the detection result keywords (key) to the Growth Guardian interface, enabling the Growth Guardian interface to indirectly query the detection result from the account detection server through the Growth Guardian backend based on the detection result key. Game application 111 controls the login status of the currently logged-in account based on the detection result. For abnormal accounts, measures such as forced offline and controlling offline time are taken to intercept abnormal accounts.

[0034] Please refer to Figure 2 This document illustrates a flowchart of an account detection method provided in an exemplary embodiment of this application. This embodiment describes the method as being executed by a terminal. The method includes the following steps:

[0035] Step 201: In response to the fact that the currently logged-in account belongs to the account to be tested, a test prompt pop-up window is displayed.

[0036] In one possible implementation, when the application detects that the currently logged-in account belongs to the account to be checked, a detection prompt pop-up is displayed within the application. This pop-up contains an account detection message, such as "The current account is at risk; please verify," to guide the user to perform an account check.

[0037] As an illustration, game applications typically have parental control mechanisms in place to prevent minors from becoming addicted to games. When the terminal detects that the current user is suspected to be a minor, it determines that the currently logged-in account belongs to the account to be detected, displays a detection prompt pop-up, and guides the user to complete identity verification, thereby detecting cases where minors are impersonating others to use someone else's account.

[0038] Step 202: In response to the detection trigger operation in the detection prompt pop-up window, perform terminal environment detection, face recognition detection, and document detection for the currently logged-in account, and obtain the detection result, which is either the current logged-in account is a normal account or the current logged-in account is an abnormal account.

[0039] Upon receiving a detection trigger operation in the detection prompt pop-up window (such as triggering the account detection control in the detection prompt pop-up window), the terminal performs account detection based on the detection content and obtains the detection result.

[0040] In one possible implementation, the terminal combines three methods—terminal environment detection, facial recognition detection, and document detection—to perform account detection, preventing malicious actors from bypassing the detection from multiple dimensions. This improves the interception rate of abnormal accounts while also preventing false positives that could restrict legitimate accounts from logging in.

[0041] Terminal environment detection primarily aims to prevent malicious actors from modifying terminal hardware data to circumvent detection by gaining administrator privileges. For example, it checks whether the terminal can obtain super administrator privileges or is connected to external devices to determine if a user has logged in through illegitimate means. Facial recognition detection prevents malicious actors from bypassing detection by replacing verification videos with forged videos using virtual cameras. For instance, it detects forged verification videos or fake face masks by capturing dynamic facial images and simultaneously judging whether the terminal's movement direction matches the face's changing direction. Document verification uses Near Field Communication (NFC) technology to guide users through document verification, ensuring that the current user is the registered user corresponding to the currently logged-in account.

[0042] If the currently logged-in account fails the above checks, it means that the account has been stolen or borrowed, and the current user belongs to a restricted login group (such as minors targeted by game applications).

[0043] Step 203: Control the login status of the currently logged-in account based on the detection results.

[0044] In one possible implementation, the terminal controls the login status of the currently logged-in account based on the detection results. If the account is normal, it can continue to be used online; if the account is abnormal, the terminal can log the account offline.

[0045] In summary, this embodiment combines terminal environment detection, facial recognition detection, and document detection to detect abnormal accounts obtained through leasing, theft, and other means from multiple dimensions. This can defend against various black market attack methods and prevent black market operators from bypassing detection, thereby increasing the interception rate of abnormal accounts, making it more difficult for black market operators to bypass account detection, and thus reducing the phenomenon of minors renting and stealing accounts, and enhancing the security management of minors' online activities.

[0046] In one possible implementation, with user authorization, the terminal verifies account anomalies by collecting multiple data points and combining them with terminal environment detection, facial recognition detection, and document verification. Please refer to [link / reference]. Figure 3 This document illustrates a flowchart of an account detection method provided in an exemplary embodiment of this application. This embodiment describes the method as being executed by a terminal. The method includes the following steps:

[0047] Step 301: In response to the fact that the currently logged-in account belongs to the account to be tested, a test prompt pop-up window is displayed.

[0048] The specific implementation of step 301 can be referred to step 201 above, and will not be repeated here in the embodiments of this application.

[0049] Step 302: In response to the detection trigger operation in the detection prompt pop-up window, perform terminal environment detection.

[0050] In one possible implementation, the terminal performs account checks in the following order: terminal environment detection, facial recognition detection, and document detection. If any one of these checks fails, the account is confirmed as abnormal, eliminating the need for further checks and thus improving detection efficiency.

[0051] Indicative Figure 4 The flowchart illustrates a terminal's detection process for game accounts, which includes the following steps:

[0052] Step 401: Perform terminal environment detection.

[0053] The purpose of terminal environment detection is to detect whether the terminal hardware has been modified and whether there is a possibility that camera data has been replaced to bypass facial recognition. For example, it detects whether superuser management privileges have been obtained, whether risky software has been installed, whether external devices are connected, and whether the system is running on an emulator, thereby detecting whether there are any anomalies in the terminal environment.

[0054] Step 402: Determine whether the terminal environment detection has passed.

[0055] If yes, proceed to step 403; otherwise, proceed to step 408. If the terminal environment is normal, the terminal continues to the next detection step to check for other anomalies. If the terminal environment is abnormal, it means that the currently logged-in account is an abnormal account, so the terminal directly jumps to step 408 without performing any further detection steps.

[0056] Step 403: Perform face recognition detection.

[0057] The face recognition detection in this embodiment combines liveness detection technology, which can determine whether a face mask or a forged image is used to pass the face recognition while performing face comparison.

[0058] Step 404: Determine whether the face recognition detection has passed.

[0059] If yes, proceed to step 405; otherwise, proceed to step 408. Similarly, if the face recognition detection is normal, the terminal continues to the next detection step. If the face recognition detection result is abnormal, it indicates that the currently logged-in account is an abnormal account, and the terminal directly jumps to step 408 without performing other detection steps.

[0060] Step 405: Perform document verification.

[0061] The document verification uses NFC technology to check whether the current user's ID matches the ID used to register the account, in order to determine whether there is any account theft or rental.

[0062] Step 406: Determine whether the document verification has passed.

[0063] If yes, proceed to step 407; otherwise, proceed to step 408. If the ID verification passes, the currently logged-in account is a legitimate account; if the ID verification fails, the currently logged-in account is an abnormal account.

[0064] Step 407, detection successful, player continues game.

[0065] Step 408, detection failed, player cannot continue the game.

[0066] In one possible implementation, players using their accounts normally can continue playing after their accounts pass the verification. However, accounts with abnormal verification results will be forcibly logged out and unable to log in again for a period of time to prevent minors from renting or stealing their accounts.

[0067] Step 409: Detection complete, results returned.

[0068] In other possible implementations, the terminal may perform account detection in a different order. For example, the terminal may first perform document detection, then terminal environment detection, and finally facial recognition detection. This application does not limit this approach.

[0069] In one possible implementation, when performing terminal environment detection, step 302 specifically includes the following steps:

[0070] Step 302a: Retrieve the list of risky applications and the installation status of risky software on the detection terminal. The list of risky applications contains the software identifiers of the risky software.

[0071] One method of cybercrime is to trick users who have rented or stolen accounts into installing specific software on their devices to evade account detection. Developers can then record this software as malicious software on a backend server. The device can then retrieve a list of these malicious applications and check if any of the listed applications are installed on the device to determine if the currently logged-in account is suspicious.

[0072] Step 302b: Detect the superuser privilege status of the system. The superuser privilege status includes whether the user has acquired privileges or not.

[0073] Superuser privileges allow end users to modify devices beyond the limitations imposed by the device manufacturer, such as uninstalling pre-installed programs or adding or disabling hardware—operations requiring system privileges. For example, the superuser privileges (root) in Android systems.

[0074] Cybercriminal attacks also involve tricking users into gaining superuser privileges and then injecting specific code. This code causes the camera data stream to be replaced during verification processes that require video capture, such as facial recognition. The application then receives replaced video or image data instead. Under normal circumstances, users do not need and cannot obtain superuser privileges.

[0075] Therefore, the terminal can determine whether an account is abnormal by detecting whether superuser privileges have been obtained. In one possible implementation, the terminal can detect whether superuser privileges have been obtained in various ways, and step 302b may specifically include the following steps:

[0076] Step 1: Check the execution status of system management commands. Step 2: If the system management command is executable, confirm that the superuser privileges are granted.

[0077] In other words, the terminal determines whether it has obtained superuser privileges by detecting whether there are commands within the system that require superuser privileges to execute and whether those commands can be executed. For example, in the Android system, the terminal can determine whether it has obtained superuser privileges by detecting whether the `su` or `busybox` commands exist in the system and can be executed.

[0078] or,

[0079] Step 3: Detect the installation of risky software on the terminal. Step 4: In response to the presence of risky software on the terminal, confirm that the superuser privileges are granted.

[0080] The second detection method involves checking whether any commercially available applications designed to obtain superuser privileges are installed on the terminal, thus determining whether superuser privileges have been obtained. This process can also be completed through step 302a above and does not need to be repeated.

[0081] or,

[0082] Step 5: Identify the system version corresponding to the system information field. Step 6: In response to the system version being a non-default version, determine that the superuser privilege status is "permissions have been obtained".

[0083] The third detection method involves obtaining specific information fields from the system to check if the system version is an officially released version. For example, for Android systems, the terminal can obtain the system's android.os.Build.TAGS field and see if it is "test-keys". Generally, if it is not "release-keys", it is a non-official release version of the system, which poses a risk, meaning that the user may have changed the system version by obtaining superuser privileges.

[0084] or,

[0085] Step 7: Check the file access status of high-privilege system files. Step 8: In response to the file access status being accessible, determine that the superuser privilege status is "permissions have been acquired".

[0086] The fourth detection method is to check whether certain folders that require high privileges to access can be accessed, such as the "data / data / " directory. If access is possible, it is determined that the superuser privilege status has been obtained.

[0087] Step 302c: Read the debug bridge switch status, which includes whether the switch is on or off.

[0088] Debug bridges assist users in debugging programs on their devices. Malicious actors can trick users into connecting their devices to external devices and using these devices to input debug bridge commands, thereby modifying terminal information. For example, the Android Debug Bridge (ADB). Therefore, the terminal can determine if its environment is abnormal by checking the debug bridge's on / off status.

[0089] Step 302d: Detect the system simulator status, which includes simulator running and non-simulator running.

[0090] Cybercriminals can also use emulators to set up virtual cameras on user terminals, writing pre-set video or image data without obtaining superuser privileges, thus replacing data captured by real cameras. Therefore, terminals can also detect abnormalities in their environment by determining whether the system is running as an emulator.

[0091] In one possible implementation, the terminal can detect the simulator status in various ways, and step 302d specifically includes the following steps:

[0092] Step 9: Read the terminal's Central Processing Unit (CPU) information. Step 10: In response to the CPU information indicating that the terminal CPU is in an emulator environment, determine that the system emulator is running.

[0093] If the CPU information begins with the emulator's name, it indicates that the current system is in an emulator environment. Therefore, the terminal can determine whether the system is running as an emulator by reading the CPU information.

[0094] or,

[0095] Step 11: Detect the terminal's optical sensor setting status. Step 12: In response to the optical sensor setting status being "not set," determine that the system simulator is running.

[0096] Typically, a terminal system has a built-in light sensor to acquire data from a real camera. If it lacks a light sensor, it indicates the system is running as a simulator, acquiring fake video or image data through a virtual camera. Therefore, the terminal can determine whether the system is running as a simulator by checking the status of its light sensor.

[0097] or,

[0098] Step 13: Load the system dynamic library. Step 14: In response to the successful loading of the system dynamic library, confirm that the system emulator is running.

[0099] Because the system architecture of the terminal is different from that of the emulator, the system dynamic library, such as the .so dynamic library, can be loaded to check whether the dynamic library is loaded successfully and determine whether it is running on the emulator.

[0100] Most emulators on the market have some anti-cheat measures to simulate real devices, but they often miss some system information or sensor information. Therefore, the above methods can be used for detection.

[0101] Step 302e: Detect the charging status of the terminal. The charging status includes not charging, DC charging, non-DC charging, and not only charging.

[0102] The terminal can detect the charging status to determine whether it is currently charging via DC. If the terminal is not charging via DC or is not charging at all, it indicates that the terminal is connected to an external device and there is an abnormality in the terminal environment.

[0103] Step 302f: In response to the terminal having installed risky software, or the super user privilege status being "permissions can be obtained", or the debug bridge switch status being "on", or the system simulator status being "emulator running", or the charging status being "non-DC charging" or "not just charging", it is determined that the terminal environment detection has failed.

[0104] In conjunction with the above defense measures, if the terminal has risky software installed, or the super user privilege status is "accessible", or the debug bridge switch status is "on", or the system emulator status is "emulator running", or the charging status is "non-DC charging" or "not just charging", then the terminal's environment is risky. Therefore, it is determined that the terminal environment detection failed.

[0105] Step 302g: In response to the fact that the terminal does not have any risky software installed, the super user privilege status is unobtainable, the debug bridge switch status is off, the system emulator status is non-emulator running, and the charging status is DC charging or not charging, it is determined that the terminal environment detection has failed.

[0106] Correspondingly, if the terminal does not have any risky software installed, the superuser privileges are in an unobtainable state, the debug bridge switch is in a closed state, the system emulator is not running, and the charging status is DC charging or not charging, the terminal environment is determined to be relatively safe, and the possibility of black market attacks is low. Therefore, the terminal environment detection is passed.

[0107] In one possible implementation, an account detection application is installed in the terminal. The terminal interacts with the account detection backend and the terminal system through the account detection application to complete the terminal environment detection.

[0108] Figure 5 This demonstrates a process for detecting the terminal environment:

[0109] Step 501: Retrieve the list of risky applications.

[0110] Step 502: Return to the list of risky applications.

[0111] The account detection application sends a request to the backend to retrieve a list of risky applications. Risky software refers to software capable of modifying device hardware and system information; malicious users often use such software to bypass authentication, such as customized ROMs. This list of risky software contains software identifiers corresponding to the risky software, such as the package name. The account detection backend returns the list of risky software to the account detection application based on the request.

[0112] Step 503: Check whether the system has obtained superuser privileges.

[0113] Step 504: Return the superuser privilege status detection result.

[0114] Since malicious users often use superuser privileges (such as root access on Android systems) to launch attacks and evade detection, it is necessary to determine whether the current system has obtained superuser privileges to detect whether there are any anomalies in the device environment. In this embodiment, the terminal can detect whether the system has obtained superuser privileges by checking whether commands requiring superuser privileges can be executed, whether applications with superuser privileges are installed, whether the system version is the officially released version, and whether certain folders requiring advanced privileges can be accessed.

[0115] Step 505: Read the status of the debug bridge switch.

[0116] Step 506: Return to the test bridge switch status detection result.

[0117] The debug bridge is a system tool used for troubleshooting. This tool can directly operate and manage system simulators or real system devices. Therefore, if the debug bridge switch is on during game operation, it indicates abnormal behavior and may be controlling the terminal system through external devices.

[0118] Step 507: Check if the current system is an emulator.

[0119] Step 508: Return the simulator detection results.

[0120] Cybercriminal attacks also include using emulators to set up virtual cameras, thereby replacing camera video with pre-recorded fake video to circumvent authentication. Therefore, the presence of a cybercriminal attack can be determined by checking whether the current system is an emulator. In this embodiment, the terminal can determine whether it is in an emulator environment by detecting whether its central processing unit is an emulator, whether the terminal has a light sensor, and whether it can successfully load dynamic libraries.

[0121] Step 509: Check the charging status.

[0122] Step 510: Return the charging broadcast result.

[0123] The terminal captures the system's charging broadcast to identify whether the current charging status is DC charging. If the terminal is charging but not DC charging, or if the USB status is not charging, it indicates that the terminal is connected to an external device.

[0124] Step 511: Check if NFC is supported.

[0125] Step 512, return to NFC available status.

[0126] The terminal reads system settings to check if it supports NFC and whether the NFC switch is turned on. If the terminal does not support NFC, document verification will not be performed. If the NFC switch is off, the user will be prompted to turn it on.

[0127] Step 513: Check if the risky software is installed.

[0128] Step 303: In response to the successful detection of the terminal environment, face recognition detection is performed.

[0129] If the terminal environment detection passes, the face recognition detection will continue; if the terminal environment detection fails, the subsequent detection can be skipped, and the account can be determined to be abnormal.

[0130] Face detection in related technologies is easily bypassed by malicious actors due to limitations in device hardware. While some face recognition plugins can perform liveness detection using infrared detection to identify forged face masks, most front-facing cameras on terminals lack infrared detection hardware, thus rendering this function unusable. In one possible implementation, the terminal, while collecting video data for face recognition, combines the phone's gyroscope and magnetic field direction to determine whether a forged video is being played. The solution provided in this application embodiment can perform liveness detection simultaneously with face recognition. Step 303 specifically includes the following steps:

[0131] Step 303a: Capture facial images using a camera.

[0132] Step 303b: In response to the face being directly facing the camera, record the first orientation information of the terminal, which includes first gyroscope data and first magnetic field direction.

[0133] When performing facial recognition, the terminal first prompts the user to take a picture of their face through the detection interface, and the user faces the screen. At this time, the terminal records the direction of the gyroscope and magnetic field for the first time as the initial state of the terminal.

[0134] Step 303c: Compare the collected facial image with the registration information of the currently logged-in account.

[0135] After the terminal obtains a frontal facial image, it can first perform facial recognition. Based on the collected facial image, it compares the information with the registration information of the currently logged-in account to determine whether the current user is the same person as the registered person who has been verified by real name for the currently logged-in account.

[0136] In step 303d, in response to face matching and with the face facing the camera from the side, the terminal's second orientation information is recorded. The second orientation information includes second gyroscope data and the direction of the second magnetic field.

[0137] After facial recognition is successful, liveness detection is performed. The terminal guides the user to continue holding the terminal, keeping their head still, and slowly moving the terminal to one side (left or right) through on-screen prompts or voice prompts, while keeping the camera facing the user throughout the movement. When the terminal stops moving or the face is turned to the side of the camera, the terminal records the data from the second gyroscope and the direction of the second magnetic field.

[0138] In one possible implementation, the second orientation information includes two sets of information: the second gyroscope data and the second magnetic field direction when the terminal moves to the left side of the face, and the second gyroscope data and the second magnetic field direction when the terminal moves to the right side of the face.

[0139] If the face matching fails, the subsequent liveness detection step can be skipped, and the face recognition detection can be directly determined as having failed.

[0140] Step 303e: Determine the change in the terminal's orientation based on the first orientation information and the second orientation information.

[0141] The terminal determines the change in its orientation based on the first and second orientation information, and judges whether the changes in the image are consistent with the changes in the terminal's orientation.

[0142] Step 303f: In response to the face image matching the registration information and the terminal's orientation change matching the face orientation change, the face recognition detection is determined to be successful.

[0143] Step 303g: In response to a mismatch between the face image and the registration information, or a mismatch between the terminal's orientation change and the face's orientation change, it is determined that the face recognition detection has failed.

[0144] If both face recognition and liveness detection are normal, the face recognition test is considered successful. If the face does not match or the change in the terminal's orientation does not match the change in the face's orientation, the face recognition test is considered unsuccessful.

[0145] Step 304: In response to the successful face recognition detection, proceed with document verification.

[0146] After the facial recognition detection is successful, the terminal proceeds to the document verification stage. In one possible implementation, step 304 specifically includes the following steps:

[0147] Step 304a: Read the document verification information using the Near Field Communication (NFC) function.

[0148] In one possible implementation, during the aforementioned terminal environment detection, the terminal can pre-detect whether its NFC function is enabled; if not, it prompts the user to manually enable it. The terminal then uses the NFC function to read the encrypted verification information from the ID card.

[0149] Step 304b: Send the document verification information to the document management party, which uses the document management party to obtain document information based on the document verification information.

[0150] Step 304c: Receive the document information sent by the document management party.

[0151] In one possible implementation, the developer can collaborate with a document management authority, which would be responsible for decrypting and verifying the document based on the verification information, and providing the corresponding document information. This would verify whether the document held by the current user matches the document used to register the account.

[0152] Step 304d: In response to the document information matching the registration information of the currently logged-in account, the document check is confirmed to be successful.

[0153] Step 304e: In response to the mismatch between the document information and the registration information of the currently logged-in account, it is determined that the document detection has failed.

[0154] If the identification information matches the registration information of the currently logged-in account, it means that the identification document held by the current user is consistent with the registrant's identification document, and the risk of the current login account being stolen is low. Conversely, if the identification document held by the current user does not match the registrant's identification document, the risk of the current login account being stolen is high.

[0155] Step 305: In response to the successful verification of the identification document, the verification result is confirmed that the currently logged-in account is a legitimate account.

[0156] Step 306: In response to the failure of terminal environment detection, liveness detection, or document detection, determine that the current login account is an abnormal account.

[0157] If all three checks pass, the terminal determines that the current account is normal. If any one check fails, the terminal determines that the current account is abnormal.

[0158] Step 307: Control the login status of the currently logged-in account based on the detection results.

[0159] The specific implementation of step 307 can be referred to step 203 above, and will not be repeated here in the embodiments of this application.

[0160] In this embodiment, the terminal detects the terminal environment based on information such as the installation status of risky software, the status of super user privileges, the status of the emulator, and the charging status. While performing face recognition, it also performs liveness detection based on magnetic field direction and gyroscope data, and uses NFC technology for document detection. This multi-dimensional approach detects abnormal account situations, increasing the difficulty of black market attacks and the interception rate of abnormal accounts.

[0161] In one possible implementation, the terminal performs the aforementioned detection process through an account detection application. During account detection, the terminal first checks whether an account detection application is installed; if not, it guides the user to complete the installation. This process is as follows: Figure 6 As shown:

[0162] Step 601: A detection prompt pop-up window is displayed.

[0163] Once the terminal determines that the currently logged-in account belongs to the account to be checked, a check prompt pop-up window is displayed within the game application, reminding the user that an account check is required. This pop-up window contains an account check message, such as "The current account is at risk; please verify," to guide the user through the account check.

[0164] Step 602: Determine if an account detection application is installed.

[0165] If yes, proceed to step 605; otherwise, proceed to step 603. In one possible implementation, since the account detection step needs to be performed by an account detection application running on the terminal, the terminal determines whether the account detection application is currently installed after displaying the detection prompt pop-up (or after receiving a detection trigger operation). If the terminal does not have the account detection application installed, account detection cannot be performed, so the terminal proceeds to step 603 to guide the user to install it.

[0166] Step 603: Guide the installation of the account detection application.

[0167] In one possible implementation, the terminal displays an application installation guide such as "Please proceed to install the account detection application" via a detection prompt pop-up, and provides an application installation link so that the user can quickly install the account detection application.

[0168] Step 604: Determine if the program was installed successfully.

[0169] If yes, proceed to step 608; otherwise, proceed to step 609. If the account detection application is successfully installed, the terminal can perform the account detection step. The installed application is usually the latest version provided by the official website, therefore the application update step described below is unnecessary. If the account detection application fails to install, the terminal cannot perform the account detection step and will directly jump to step 609 to confirm the detection failure.

[0170] Step 605: Determine if the program supports account detection.

[0171] If yes, proceed to step 608; otherwise, proceed to step 606. The application will release a new version after updating its functionality, but users may not actively update the application. If the application version installed on the terminal is too old and does not have the account detection function in this embodiment, account detection will also fail. Therefore, the terminal also needs to check whether the current version of the account detection application can support the account detection function in this embodiment. If the program supports account detection, the program is directly enabled, and the account detection steps are performed. If the program does not support account detection, the terminal first guides the user to update the application.

[0172] Step 606 guides you through updating the account detection application.

[0173] Step 607: Determine if the program update was successful.

[0174] If yes, proceed to step 608; otherwise, proceed to step 609. If the program update is successful, the terminal will enable the program to perform account verification. If the program update fails, the terminal will be unable to perform account verification, skip the account verification step, and display relevant information about the verification failure in a pop-up window.

[0175] Step 608: Enable the account detection application and turn on the parental control plugin.

[0176] Step 609: Return to the game application; a message indicates detection failed.

[0177] Because the terminal did not perform account verification, it could not determine whether the current account was legitimate. Normally, legitimate users would complete application installation and updates, as well as account verification, to continue playing the game; users who refuse account verification are often suspected of being involved in illegal activities. Therefore, in the event of account verification failure, the terminal directly identifies the currently logged-in account as abnormal.

[0178] In one possible implementation, the account detection application interacts with the parental control platform and backend corresponding to the application being detected to jointly complete the account detection. Please refer to [link / reference]. Figure 7 This document illustrates a flowchart of an account detection method provided in an exemplary embodiment of this application. This embodiment describes the method as being executed by a terminal. The method includes the following steps:

[0179] Step 701: Obtain liveness data through liveness detection. Liveness data includes the height of the terminal's location and the user's operating habits.

[0180] When minors use the device, they typically exhibit characteristics such as a low device height, relatively fixed usage times, and specific operating habits. The device uses the aforementioned liveness data to determine whether the current user is suspected to be a minor.

[0181] Step 702: Obtain the IP address of the currently logged-in account.

[0182] Currently, black market operators can rent accounts through cloud gaming. Cloud gaming devices and IPs are usually fixed, so it's possible to determine if an account might be suspicious by checking if its IP address is high-risk.

[0183] Step 703: In response to the liveness data indicating that the currently logged-in account corresponds to a restricted user and that the account's IP is within an abnormal IP range, determine that the currently logged-in account belongs to the account to be detected.

[0184] As an illustration, the in-game child protection plugin has liveness detection capabilities. By acquiring data such as the device's height and the player's operating habits, it determines whether the device is suspected of being used by a minor. It also combines this with IP detection to check if the player's IP address is a high-risk IP address for account theft or rental. If the above conditions are met, the device determines the game account is abnormal and falls under the category of accounts to be detected.

[0185] Step 704: In response to the fact that the currently logged-in account belongs to the account to be tested, a test prompt pop-up window is displayed in the test application application.

[0186] The specific implementation of step 704 can be referred to step 201 above, and will not be repeated here in the embodiments of this application.

[0187] Step 705: In response to the detection trigger operation, enable the account detection application and display the detection page through the account detection application.

[0188] In one possible implementation, upon receiving a detection trigger, the terminal switches from the game application to an account detection application, which then displays the detection interface. This detection interface is in Hyper Text Markup Language 5.0 (H5). Simultaneously, the account detection application activates an account detection plugin to perform account detection.

[0189] Step 706: Establish an encrypted connection between the account detection application and the detection server, and query the package information of the detection application and the domain name of the detection page.

[0190] In one possible implementation, the application requesting account verification (i.e., the application requesting account verification, such as a game application) sends data such as package name and channel number to the account verification plugin. During initialization, the account verification application queries the corresponding package information from the verification server (i.e., the background of the account verification application). Based on the package information, the verification server checks whether the application requesting verification has been modified, i.e., whether the program is legitimate, using methods such as MD5 verification and APK signature verification.

[0191] In addition, the account detection server also verifies the domain name of the detection page to prevent malicious users from using fake domain names to maliciously call the account detection application for detection and consume the inspection cost of the detection backend.

[0192] Step 707: In response to the packet information indicating that the application for detection has not been modified and the domain name indicating that the detection page is normal, account detection is performed based on the detection content to obtain the detection result.

[0193] Once the application for account verification is confirmed to be legitimate and the domain name passes the verification, the account verification application continues to communicate with the backend to execute subsequent account verification steps.

[0194] Step 708: In response to the packet information indicating that the application for detection has been modified, or the domain name indicating that the detection page is abnormal, determine that the detection result is that the currently logged-in account is an abnormal account.

[0195] If the account detection application determines, based on the verification results returned from the backend, that the application requesting the detection has been modified, or that the page domain is a fake domain, the account detection application will directly determine that the currently logged-in account is an abnormal account, without needing to perform subsequent account detection steps.

[0196] Step 709: In response to the current login account being a normal account, maintain the login status of the current login account.

[0197] For example, if the terminal determines that the currently logged-in account is a legitimate account, it displays the account detection result on the H5 page of the account detection application. When it receives a return operation from the application within the H5 page, the terminal redirects to the detection application, maintains the login status of the currently logged-in account, and continues to execute user operations within the application.

[0198] Step 710: In response to the current login account being an abnormal account, switch the login status of the current login account from online to offline and set the offline duration.

[0199] The terminal determines that the currently logged-in account is an abnormal account and displays the account detection result through the H5 page of the account detection application. The detection application forces the account with the abnormal detection result offline and sets the account to be unable to log in again for a period of time (e.g., three days).

[0200] Figure 8 This illustrates the interaction process between a game's growth protection platform, an account detection application, and its backend:

[0201] Step 801: Launch the account detection application and display the H5 interface through the parental control plugin.

[0202] For example, if a game application detects abnormal player behavior through a minor protection plugin, a reminder pop-up will appear, guiding the player to the account detection application and displaying the parental control H5 interface.

[0203] Step 802: The account detection application sends the page domain name to the account detection backend.

[0204] During initialization, the account detection application establishes an encrypted connection with the account detection server. Based on the package name, channel number, and other information of the application requesting account detection, it queries the account detection backend for corresponding package information to check whether the application has been modified. It also requests backend verification of the page domain to prevent malicious users from using fake domains to maliciously call the account detection application and consume backend detection resources.

[0205] Step 803: The account detection backend sends the domain verification result to the account detection application.

[0206] Step 804, verification successful. The account detection application requests a token from the account detection backend.

[0207] Step 805, verification failed, the account detection application notified the Growth Guardian H5 interface of the result.

[0208] Step 806: The account detection backend returns a token to the account detection application.

[0209] Once the account detection application obtains the token, it can continue to interact with the account detection backend and perform account detection steps without repeating the above detection process.

[0210] Step 807: The account detection application retrieves a list of risky applications from the account detection backend.

[0211] Step 808: The account detection backend returns a list of risky applications to the account detection application.

[0212] Step 809: The account detection application performs terminal environment detection.

[0213] The terminal enters the environment detection phase, which sequentially performs checks including superuser privilege detection, Universal Serial Bus (USB) debugging detection, external device connection detection, and risk software detection. The superuser privilege detection is primarily to prevent malicious actors from gaining access and modifying hardware data, or setting up virtual cameras to bypass detection. The USB debugging and external device connection detection are to prevent malicious users from connecting the terminal to external devices and using those devices to input commands to modify terminal information.

[0214] Step 810: The account detection application requests a third-party platform to perform facial recognition detection and NFC document detection.

[0215] Step 811: The third-party platform returns the detection results to the account detection application.

[0216] Step 812: The account detection application uploads the detection results to the account detection backend.

[0217] The final account detection result is obtained based on the results of the device environment detection conducted by the user and the facial recognition and NFC certificate detection results sent by the third-party platform.

[0218] Step 813: The account detection backend generates result keywords and transmits the detection results to the growth guardian backend.

[0219] Step 814: The account detection backend returns the result key to the account detection application.

[0220] Step 815: The test is complete. The account testing application returns the result key to the Parental Guardian H5 interface.

[0221] The account detection application returns a result key to the Parent Guardian H5 interface, which then uses this result key to query the detection results from the backend.

[0222] Step 816: The Growth Guardian H5 interface queries the detection results from the Growth Guardian backend based on the result key.

[0223] Step 817: The Growth Guardian backend retrieves the detection results from the Account Detection backend based on the result key.

[0224] Step 818: The account detection backend returns the detection results to the growth guardian backend.

[0225] Step 819: The Parent Guardian backend returns the detection results to the Parent Guardian H5 interface.

[0226] In this embodiment, the terminal makes a preliminary judgment based on user operating habits, account IP and other data, and detects suspected abnormal accounts. While improving the interception rate of abnormal accounts, it can reduce the need to detect normal users' accounts and save detection resources.

[0227] Figure 9 This is a structural block diagram of an account detection device provided in an exemplary embodiment of this application. The device includes the following structure:

[0228] Display module 901 is used to display a detection prompt pop-up window in response to the current logged-in account belonging to the account to be detected;

[0229] The detection module 902 is used to respond to the detection trigger operation in the detection prompt pop-up window, perform terminal environment detection, face recognition detection and document detection for the currently logged-in account, and obtain the detection result. The detection content includes terminal environment detection, face recognition detection and document detection. The detection result is that the currently logged-in account is a normal account or the currently logged-in account is an abnormal account.

[0230] The control module 903 is used to control the login status of the currently logged-in account based on the detection results.

[0231] Optionally, the detection module 902 is further configured to:

[0232] In response to the detection trigger operation in the detection prompt pop-up window, the terminal environment detection is performed;

[0233] Upon successful detection of the terminal environment, the face recognition detection is performed.

[0234] Upon successful facial recognition detection, the document detection is performed.

[0235] Upon successful verification of the identification document, the detection result is determined to indicate that the currently logged-in account is a legitimate account.

[0236] In response to the failure of the terminal environment detection, the failure of the face recognition detection, or the failure of the document detection, the detection result is determined to be that the currently logged-in account is an abnormal account.

[0237] Optionally, the detection module 902 is further configured to:

[0238] The system retrieves a list of risky applications and detects the installation status of risky software on the terminal. The list of risky applications includes the software identifiers of the risky software.

[0239] The system detects the superuser privilege status, which includes whether privileges have been acquired or not.

[0240] Read the debug bridge switch status, which includes switch on and switch off;

[0241] Detect the system simulator status, which includes simulator running and non-simulator running;

[0242] The charging status of the terminal is detected, including not charging, DC charging, non-DC charging, and not only charging;

[0243] In response to the terminal having the risky software installed, or the super user privilege status being "acquired", or the debug bridge switch status being "on", or the system simulator status being "running", or the charging status being "non-DC charging" or "not just charging", it is determined that the terminal environment detection has failed.

[0244] In response to the fact that the terminal does not have the risky software installed, the super user privilege status is "not granted", the debug bridge switch status is "off", the system simulator status is "not running", and the charging status is "DC charging" or "not charging", it is determined that the terminal environment detection has passed.

[0245] Optionally, the detection module 902 is further configured to:

[0246] Detect the execution status of system management commands; in response to the system management command being an executable command, determine that the super user privilege status is that privileges have been acquired.

[0247] or,

[0248] Detect the installation status of risky software on the terminal; in response to the fact that the terminal has the risky software installed, determine that the super user privilege status is "permission has been obtained";

[0249] or,

[0250] Identify the system version corresponding to the system information field; in response to the system version being a non-default version, determine that the super user permission status is "permissions have been obtained";

[0251] or,

[0252] Detect the file access status of high-privilege system files; in response to the file access status being accessible, determine that the superuser privilege status is that permissions have been acquired.

[0253] Optionally, the detection module 902 is further configured to:

[0254] Read the CPU information of the terminal's central processing unit; in response to the CPU information indicating that the terminal CPU is in an emulator environment, determine that the system emulator status is emulator running;

[0255] or,

[0256] Detect the optical sensor setting status of the terminal; in response to the optical sensor setting status being not set, determine that the system simulator status is simulator running;

[0257] or,

[0258] Load the system dynamic library; in response to the successful loading of the system dynamic library, determine that the system simulator status is simulator running.

[0259] Optionally, the detection module 902 is further configured to:

[0260] Facial images are captured via a camera;

[0261] In response to a person's face being directly facing the camera, the terminal records its first orientation information, which includes first gyroscope data and first magnetic field direction.

[0262] The collected facial images are compared with the registration information of the currently logged-in account.

[0263] In response to face matching, and with the face facing the camera, the terminal records second orientation information, which includes second gyroscope data and second magnetic field direction.

[0264] The location change of the terminal is determined based on the first location information and the second location information;

[0265] In response to the face image matching the registration information, and the positional change of the terminal matching the positional change of the face, it is determined that the face recognition detection has passed;

[0266] In response to a mismatch between the face image and the registration information, or a mismatch between the orientation change of the terminal and the orientation change of the face, it is determined that the face recognition detection has failed.

[0267] Optionally, the detection module 902 is further configured to:

[0268] Read document verification information using Near Field Communication (NFC) function;

[0269] The document verification information is sent to the document management authority, which uses the document management authority to obtain document information based on the document verification information.

[0270] Receive the document information sent by the document management party;

[0271] In response to the document information matching the registration information of the currently logged-in account, it is determined that the document detection has passed;

[0272] If the document information does not match the registration information of the currently logged-in account, it is determined that the document detection has failed.

[0273] Optionally, the display module 901 is further configured to:

[0274] In response to the fact that the currently logged-in account belongs to the account to be tested, the test prompt pop-up window is displayed in the test application application;

[0275] The detection module 902 is also used for:

[0276] In response to the detection trigger operation, the account detection application is enabled, and the detection page is displayed through the account detection application;

[0277] The account detection application establishes an encrypted connection with the account detection server and queries the package information of the detection application and the domain name of the detection page.

[0278] In response to the packet information indicating that the detection application application has not been modified, and the domain name indicating that the detection page is normal, an account detection is performed based on the detection content to obtain the detection result;

[0279] In response to the packet information indicating that the detection application has been modified, or the domain name indicating that the detection page is abnormal, the detection result is determined to be that the currently logged-in account is an abnormal account.

[0280] Optionally, the detection module 902 is further configured to:

[0281] Liveness data is obtained through liveness detection, and the liveness data includes the height of the terminal's location and the user's operating habits;

[0282] Obtain the Internet Protocol IP address of the currently logged-in account;

[0283] In response to the liveness data indicating that the currently logged-in account corresponds to a login-restricted user, and that the account's IP address is within an abnormal IP range, it is determined that the currently logged-in account belongs to the account to be detected.

[0284] Optionally, the control module 903 is further configured to:

[0285] In response to the fact that the currently logged-in account is a normal account, the login status of the currently logged-in account is maintained;

[0286] In response to the current login account being an abnormal account, the login status of the current login account is switched from online to offline, and the offline duration is set.

[0287] In summary, this embodiment combines terminal environment detection, facial recognition detection, and document detection to detect abnormal accounts obtained through leasing, theft, and other means from multiple dimensions. This can defend against various black market attack methods and prevent black market operators from bypassing detection, thereby increasing the interception rate of abnormal accounts, making it more difficult for black market operators to bypass account detection, and thus reducing the phenomenon of minors renting and stealing accounts, and enhancing the security management of minors' online activities.

[0288] Please refer to Figure 10This diagram illustrates a structural block diagram of a terminal 1000 provided in an exemplary embodiment of this application. The terminal 1000 may be a portable mobile terminal, such as a smartphone, tablet computer, Moving Picture Experts Group Audio Layer III (MP3) player, or Moving Picture Experts Group Audio Layer IV (MP4) player. The terminal 1000 may also be referred to as a user device, portable terminal, or other names.

[0289] Typically, terminal 1000 includes a processor 1001 and a memory 1002.

[0290] Processor 1001 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 1001 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). Processor 1001 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 1001 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 1001 may also include an Artificial Intelligence (AI) processor, which is used to handle computational operations related to machine learning.

[0291] The memory 1002 may include one or more computer-readable storage media, which may be tangible and non-transitory. The memory 1002 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1002 are used to store at least one instruction, which is executed by the processor 1001 to implement the method provided in the embodiments of this application.

[0292] In some embodiments, the terminal 1000 may also optionally include a peripheral device interface 1003.

[0293] Peripheral interface 1003 can be used to connect at least one input / output (I / O) related peripheral device to processor 1001 and memory 1002. In some embodiments, processor 1001, memory 1002 and peripheral interface 1003 are integrated on the same chip or circuit board; in some other embodiments, any one or two of processor 1001, memory 1002 and peripheral interface 1003 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0294] This application also provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the account detection method described in the above embodiments.

[0295] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the account detection method provided in various alternative implementations of the above aspect.

[0296] Those skilled in the art will recognize that the functions described in the embodiments of this application in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable storage medium or transmitted as one or more instructions or code on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0297] It should be noted that all information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application have been authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, CPU information, facial images, gyroscope data, magnetic field direction, registration information, document information, domain names, etc. involved in this application were all obtained with full authorization.

[0298] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An account detection method, characterized in that, The method includes: In response to the fact that the currently logged-in account belongs to the account to be tested, a test prompt pop-up window will be displayed within the test application application; In response to the detection trigger operation in the detection prompt pop-up window, the account detection application is enabled, and the detection page is displayed through the account detection application; The account detection application establishes an encrypted connection with the account detection server and queries the package information of the detection application and the domain name of the detection page. In response to the packet information indicating that the detection application application has not been modified, and the domain name indicating that the detection page is normal, terminal environment detection, face recognition detection, and document detection are performed on the currently logged-in account to obtain the detection result, which is either that the currently logged-in account is a normal account or that the currently logged-in account is an abnormal account. In response to the packet information indicating that the detection application has been modified, or the domain name indicating that the detection page is abnormal, the detection result is determined to be that the currently logged-in account is an abnormal account; The login status of the currently logged-in account is controlled based on the detection results.

2. The method according to claim 1, characterized in that, The detection trigger operation in response to the detection prompt pop-up window performs terminal environment detection, face recognition detection, and document detection on the currently logged-in account to obtain detection results, including: In response to the detection trigger operation in the detection prompt pop-up window, the terminal environment detection is performed; Upon successful detection of the terminal environment, the face recognition detection is performed. In response to the successful facial recognition detection, the document detection is performed; Upon successful verification of the identification document, the detection result is determined to indicate that the currently logged-in account is a legitimate account. In response to the failure of the terminal environment detection, the failure of the face recognition detection, or the failure of the document detection, the detection result is determined to be that the currently logged-in account is an abnormal account.

3. The method according to claim 2, characterized in that, The terminal environment detection includes: The system retrieves a list of risky applications and detects the installation status of risky software on the terminal. The list of risky applications includes the software identifiers of the risky software. The system detects the superuser privilege status, which includes whether privileges have been acquired or not. Read the debug bridge switch status, which includes switch on and switch off; Detect the system simulator status, which includes simulator running and non-simulator running; The charging status of the terminal is detected, including not charging, DC charging, non-DC charging, and not only charging; In response to the terminal having the risky software installed, or the super user privilege status being "acquired", or the debug bridge switch status being "on", or the system simulator status being "running", or the charging status being "non-DC charging" or "not just charging", it is determined that the terminal environment detection has failed. In response to the fact that the terminal does not have the risky software installed, the super user privilege status is "not granted", the debug bridge switch status is "off", the system simulator status is "not running", and the charging status is "DC charging" or "not charging", it is determined that the terminal environment detection has passed.

4. The method according to claim 3, characterized in that, The superuser privilege status of the detection system includes: Detect the execution status of system management commands; in response to the system management command being an executable command, determine that the super user privilege status is that privileges have been acquired. or, Detect the installation status of risky software on the terminal; in response to the fact that the terminal has the risky software installed, determine that the super user privilege status is "permission has been obtained"; or, Identify the system version corresponding to the system information field; in response to the system version being a non-default version, determine that the super user permission status is "permissions have been obtained"; or, Detect the file access status of high-privilege system files; in response to the file access status being accessible, determine that the superuser privilege status is that permissions have been acquired.

5. The method according to claim 3, characterized in that, The state of the detection system simulator includes: Read the CPU information of the terminal's central processing unit; in response to the CPU information indicating that the terminal CPU is in an emulator environment, determine that the system emulator status is emulator running; or, Detect the optical sensor setting status of the terminal; in response to the optical sensor setting status being not set, determine that the system simulator status is simulator running; or, Load the system dynamic library; in response to the successful loading of the system dynamic library, determine that the system simulator status is simulator running.

6. The method according to claim 2, characterized in that, The face recognition detection includes: Facial images are captured via a camera; In response to a person's face being directly facing the camera, the terminal records its first orientation information, which includes first gyroscope data and first magnetic field direction. The collected facial images are compared with the registration information of the currently logged-in account. In response to face matching, and with the face facing the camera, the terminal records second orientation information, which includes second gyroscope data and second magnetic field direction. The location change of the terminal is determined based on the first location information and the second location information; In response to the face image matching the registration information, and the positional change of the terminal matching the positional change of the face, it is determined that the face recognition detection has passed; In response to a mismatch between the face image and the registration information, or a mismatch between the orientation change of the terminal and the orientation change of the face, it is determined that the face recognition detection has failed.

7. The method according to claim 2, characterized in that, The document inspection includes: Read document verification information using Near Field Communication (NFC) function; The document verification information is sent to the document management authority, which uses the document management authority to obtain document information based on the document verification information. Receive the document information sent by the document management party; In response to the document information matching the registration information of the currently logged-in account, it is determined that the document detection has passed; If the document information does not match the registration information of the currently logged-in account, it is determined that the document detection has failed.

8. The method according to any one of claims 1 to 7, characterized in that, Before the detection prompt pop-up is displayed in response to the currently logged-in account belonging to the account to be detected, the method includes: Liveness data is obtained through liveness detection, and the liveness data includes the height of the terminal's location and the user's operating habits; Obtain the Internet Protocol IP address of the currently logged-in account; In response to the liveness data indicating that the currently logged-in account corresponds to a login-restricted user, and that the account's IP address is within an abnormal IP range, it is determined that the currently logged-in account belongs to the account to be detected.

9. The method according to any one of claims 1 to 7, characterized in that, The step of controlling the login status of the currently logged-in account based on the detection result includes: In response to the fact that the currently logged-in account is a normal account, the login status of the currently logged-in account is maintained; In response to the current login account being an abnormal account, the login status of the current login account is switched from online to offline, and the offline duration is set.

10. An account detection device, characterized in that, The device includes: The display module is used to display a detection prompt pop-up window within the detection application in response to the current logged-in account belonging to the account to be detected; The detection module is used to respond to the detection trigger operation in the detection prompt pop-up window, enable the account detection application, and display the detection page through the account detection application; The account detection application establishes an encrypted connection with the account detection server and queries the package information of the detection application and the domain name of the detection page. In response to the packet information indicating that the detection application application has not been modified, and the domain name indicating that the detection page is normal, terminal environment detection, face recognition detection, and document detection are performed on the currently logged-in account to obtain the detection result, which is either that the currently logged-in account is a normal account or that the currently logged-in account is an abnormal account. In response to the packet information indicating that the detection application has been modified, or the domain name indicating that the detection page is abnormal, the detection result is determined to be that the currently logged-in account is an abnormal account; The control module is used to control the login status of the currently logged-in account based on the detection results.

11. A terminal, characterized in that, The terminal includes a processor and a memory; the memory stores at least one program, which is loaded and executed by the processor to implement the account detection method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the account detection method as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium; the processor of the terminal reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the terminal to perform the account detection method as described in any one of claims 1 to 9.

Images