Identity authentication method and device, equipment, storage medium and program product

Abstract

The invention provides an identity authentication method and device, equipment, a storage medium and a program product. Relates to the technical field of computers. The method comprises the following steps: in response to a trigger operation of a client for a target business page, sending an authorization request to the client to request equipment data and user data acquisition permission from the client; receiving an authorization response sent by the client, and obtaining the device data, the user data and the service data when the authorization response is allowed; risk scores corresponding to the equipment data, the user data and the business data are determined respectively, and the risk score corresponding to each data is input into a preset weight determination model to obtain a weighted risk score corresponding to each data; and determining a risk level of the trigger operation according to the weighted risk score corresponding to each data, and performing identity authentication on the client according to the risk level. The security of identity authentication is improved, and the user experience is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an identity authentication method, apparatus, device, storage medium and program product. Background Art

[0002] With the continuous development of the Internet and computer technology, many businesses can be handled online, and user identity authentication is required to ensure the security of online business.

[0003] Currently, when authenticating users, the risk level of each business scenario is generally determined based on the sensitivity of the data involved in each business, and then the user is authenticated using one or more of the following methods: password, SMS verification code, and facial recognition according to different risk levels.

[0004] However, in the above identity authentication process, the risk level determined solely based on the sensitivity of the business data is not accurate enough, thereby reducing the security of identity authentication and affecting the user experience. Summary of the invention

[0005] The present application provides an identity authentication method, apparatus, device, storage medium and program product to solve the problem that the risk level determined in the prior art is not accurate enough, thereby reducing the security of identity authentication and affecting the user experience.

[0006] In a first aspect, the present application provides an identity authentication method, comprising: in response to a trigger operation of a client on a target business page, sending an authorization request to the client; the authorization request is used to request the client for device data acquisition permission and user data acquisition permission;

[0007] Receive an authorization response sent by the client, and obtain device data, user data, and service data when the authorization response is allowed;

[0008] Determine the risk scores corresponding to the device data, user data and business data respectively, and input the risk scores corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is obtained by training the historical risk scores corresponding to each data with the marked weights until convergence;

[0009] The risk level of the triggering operation is determined according to the weighted risk score corresponding to each data, and the identity of the client is authenticated according to the risk level.

[0010] In one possible design, the risk scores corresponding to the device data, user data and business data are determined separately, including: searching the device score determination rule for the risk score with the strongest association with the device data; the device score determination rule is used to specify preset device tags corresponding to different risk scores; the device data includes at least one device tag; searching the user score determination rule for the risk score with the strongest association with the user data; the user score determination rule is used to specify preset user tags corresponding to different risk scores; the user data includes at least one user tag; searching the business score determination rule for the risk score with the strongest association with the business data; the business score determination rule is used to specify preset business tags corresponding to different risk scores; the business data includes at least one business tag.

[0011] In one possible design, the risk scores corresponding to the device data, user data and business data are determined separately, including: using a device score determination model to extract at least one device feature from the device data, and outputting the risk score corresponding to the device data based on each device feature; the device score determination model is trained until convergence using preset device features marked with risk scores; using a user score determination model to extract at least one user feature from the user data, and outputting the risk score corresponding to the user data based on each user feature; the user score determination model is trained until convergence using preset user features marked with risk scores; using a business score determination model to extract at least one business feature from the business data, and outputting the risk score corresponding to the business data based on each business feature; the business score determination model is trained until convergence using preset business features marked with risk scores.

[0012] In one possible design, the risk level of the triggering operation is determined based on the weighted risk scores corresponding to each data, including: adding the weighted risk scores corresponding to the device data, user data and business data to obtain a total weighted risk score; obtaining a preset level determination rule; the preset level determination rule is used to specify the score thresholds corresponding to different risk levels; searching the preset level determination rule for the score threshold of the total weighted risk score, and determining the risk level to which the score threshold belongs as the risk level of the triggering operation.

[0013] In one possible design, the client is authenticated according to the risk level, including: if the risk level is low, a static password or a dynamic verification code is used to authenticate the client; if the risk level is medium, biometric recognition and a static password, or biometric recognition and a dynamic verification code are used to authenticate the client; if the risk level is high, identity document verification, biometric recognition and a static password, or identity document verification, biometric recognition and a dynamic verification code are used to authenticate the client.

[0014] In a possible design, it also includes: receiving identity authentication information sent by the client and verifying the identity authentication information; when the verification is successful, sending the target business details page to the client; when the verification fails, generating identity authentication failure information, and sending the identity authentication failure information to the client.

[0015] In a possible design, it also includes: receiving target adjustment information sent by the management end; the target adjustment information is used to adjust each score determination rule, each score determination model and one or more of the preset weight determination models; using the target adjustment information to adjust each score determination rule, each score determination model and one or more of the preset weight determination models.

[0016] In a second aspect, the present application provides an identity authentication method, comprising: in response to currently entering a target business page, receiving an authorization request sent by a server; the authorization request is used to request device data acquisition authority and user data acquisition authority;

[0017] receiving an authorization response triggered by the user in response to the authorization request, and collecting device data and user data when the authorization response is allowed;

[0018] The authorization response is sent to the server so that the server obtains device data, user data and business data when the authorization response is allowed; the risk scores corresponding to the device data, user data and business data are determined respectively, and the risk scores corresponding to each data are input into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is trained until convergence using historical risk scores corresponding to each data with marked weights; the risk level of the trigger operation is determined according to the weighted risk score corresponding to each data, and the client is authenticated according to the risk level.

[0019] In a possible design, it also includes: according to the identity authentication method provided by the server, receiving the identity authentication information input by the user, and sending the identity authentication information to the server; when the verification is successful, receiving the target business details page sent by the server, and displaying the target business details page on the corresponding operation interface; when the verification fails, receiving the identity authentication failure information sent by the server, and displaying the identity authentication failure information on the corresponding operation interface.

[0020] In a third aspect, the present application provides an identity authentication device, including: a sending module, configured to send an authorization request to a client in response to a trigger operation of a client on a target business page; the authorization request is used to request device data acquisition permission and user data acquisition permission from the client;

[0021] A receiving module, used to receive the authorization response sent by the client;

[0022] An acquisition module, used for acquiring device data, user data and service data when the authorization response is allowed;

[0023] A determination module, used to determine risk scores corresponding to device data, user data, and business data respectively;

[0024] An input module, used to input the risk score corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is obtained by training the historical risk score corresponding to each data with the marked weight until convergence;

[0025] The determination module is further used to determine the risk level of the triggering operation according to the weighted risk score corresponding to each data;

[0026] An authentication module is used to perform identity authentication on the client according to the risk level.

[0027] In a fourth aspect, the present application provides an identity authentication device, comprising: a receiving module, configured to receive an authorization request sent by a server in response to currently entering a target business page; the authorization request is used to request device data acquisition authority and user data acquisition authority;

[0028] The receiving module is further used to receive an authorization response triggered by the user in response to the authorization request;

[0029] A collection module, used for collecting device data and user data when the authorization response is allowed;

[0030] A sending module is used to send the authorization response to the server so that the server can obtain device data, user data and business data when the authorization response is allowed; determine the risk scores corresponding to the device data, user data and business data respectively, and input the risk scores corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is trained until convergence using the historical risk scores corresponding to each data with marked weights; determine the risk level of the trigger operation according to the weighted risk scores corresponding to each data, and authenticate the client according to the risk level.

[0031] In the fifth aspect, an embodiment of the present application provides an electronic device, comprising: a transceiver, at least one processor and a memory; the transceiver is used to send and receive data; the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the identity authentication method described in the first aspect, various possible designs of the first aspect, and the second aspect, various possible designs of the second aspect.

[0032] In the sixth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer execution instructions. When the processor executes the computer execution instructions, the identity authentication method described in the first aspect, various possible designs of the first aspect, and the second aspect, various possible designs of the second aspect is implemented.

[0033] In the seventh aspect, an embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the identity authentication method described in the first aspect, various possible designs of the first aspect, and the second aspect, various possible designs of the second aspect.

[0034] The present application provides an identity authentication method, apparatus, device, storage medium and program product, the method comprising: in response to a trigger operation of a client on a target business page, sending an authorization request to the client; the authorization request is used to request the client for device data acquisition authority and user data acquisition authority; receiving an authorization response sent by the client, and acquiring device data, user data and business data when the authorization response is allowed; respectively determining risk scores corresponding to device data, user data and business data, and inputting the risk scores corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is obtained by training the historical risk scores corresponding to each data with marked weights until convergence; determining the risk level of the trigger operation according to the weighted risk scores corresponding to each data, and performing identity authentication on the client according to the risk level. Since the preset weight determination model is obtained by training the historical risk scores corresponding to each data with marked weights in advance until convergence, when it is determined that the client has performed a trigger operation on the target business page, the device data acquisition permission and the user data acquisition permission can be requested from the client by sending an authorization request to the client, and by receiving the authorization response sent by the client, the device data, user data and pre-stored business data can be obtained when the authorization response is allowed, so that by respectively determining the risk scores corresponding to the device data, user data and business data, the risk scores corresponding to each data can be input into the preset weight determination model to obtain the weighted risk scores corresponding to each data, and then by determining the risk level of the trigger operation according to the weighted risk scores corresponding to each data, the client can be authenticated according to the risk level, thereby further considering the potential risks that may be brought by the client device and the user holding the client device on the basis of considering the sensitivity of the business data, improving the accuracy of the determined risk level, thereby improving the security of identity authentication and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0036] Figure 1 This is an application scenario diagram of the identity authentication method of an embodiment of the present application;

[0037] Figure 2 The process of the identity authentication method provided in the embodiment of the present application Figure 1 ;

[0038] Figure 3 The process of the identity authentication method provided in the embodiment of the present application Figure 2 ;

[0039] Figure 4 A signaling interaction diagram of the identity authentication method provided in an embodiment of the present application;

[0040] Figure 5 A schematic diagram of the structure of the identity authentication device provided in the embodiment of the present application Figure 1 ;

[0041] Figure 6 A schematic diagram of the structure of the identity authentication device provided in the embodiment of the present application Figure 2 ;

[0042] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0043] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0044] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0045] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0046] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0047] In the prior art, user identity authentication generally involves obtaining business data corresponding to each business scenario, and classifying each business scenario into risk levels according to the sensitivity of the corresponding business data, such as whether it involves encryption and decryption, whether it involves user privacy, etc., to obtain low-risk business scenarios and high-risk business scenarios, so as to authenticate the user's identity according to different risk levels by using one or more of passwords, SMS verification codes, and face recognition. For example, in low-risk business scenarios, the user's identity is authenticated by using passwords or SMS verification codes, and in high-risk business scenarios, the user's identity is authenticated by using face recognition plus passwords or SMS verification codes. This makes the determined risk level inaccurate, reduces the security of identity authentication, and affects the user experience.

[0048] In response to the above technical problems, this application proposes the following technical concept: In order to improve the security of identity authentication and improve user experience, instead of dividing each business scenario into risk levels according to the sensitivity of the corresponding business data, on this basis, further consider the potential risks that may be brought by users with business needs and the devices held by the users, and divide the risk levels of each business scenario according to the corresponding business data, the user data that triggers the business, and the device data. Then, when a user triggers a certain business, an authorization request is sent to the device held by the user for the trigger operation to request the user to obtain the device data and user data. When the authorization is passed, the device data and user data are obtained, and the pre-stored business data is obtained. Then, based on the data of these three dimensions, the risk preferences of each data are determined respectively, and the risk level corresponding to the trigger operation for the business is comprehensively determined based on each risk preference, thereby authenticating the user according to the risk level. Improve the accuracy of the determined risk level, thereby improving the security of identity authentication and improving user experience.

[0049] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0050] Figure 1 FIG. 1 is an application scenario diagram of the identity authentication method of the embodiment of the present application. Figure 1As shown, the application scenario includes: client device 1, server device 2 and database 3. Among them, client device 1 is a terminal where a user with business handling needs is located. Server device 2 is a device that provides business services. Database 2 is a database corresponding to server device 2. Among them, server device 2 is connected to client device 1 and database 3 in communication. First, the user triggers the target business page through client device 1, then server device 2 responds to the trigger operation of client device 1 on the target business page, sends an authorization request to client device 1, and receives the authorization response sent by client device 1, so that when the authorization response is allowed, device data and user data are obtained through client device 1, and business data is obtained through database 3, and further, the risk scores corresponding to device data, user data and business data are determined respectively, and the risk scores corresponding to each data are input into the preset weight determination model to obtain the weighted risk scores corresponding to each data, so as to determine the risk level of the triggering operation according to the weighted risk scores corresponding to each data, and perform identity authentication on client device 1 according to the risk level. The authorization request is used to request the client device 1 for device data acquisition authority and user data acquisition authority, and the preset weight determination model is obtained by training the historical risk scores corresponding to each data with the marked weight until convergence.

[0051] based on Figure 1 In the application scenario shown, an embodiment of the present application also provides an identity authentication method.

[0052] Figure 2 The process of the identity authentication method provided in the embodiment of the present application Figure 1 .like Figure 2 As shown, the execution subject of the identity authentication method is an identity authentication device, which is located in an electronic device, specifically in a server device. The identity authentication method provided in this embodiment includes:

[0053] S201. In response to a trigger operation of a client on a target business page, an authorization request is sent to the client; the authorization request is used to request the client for device data acquisition permission and user data acquisition permission.

[0054] The client is any client device held by a user with business needs, for example, it can be a mobile phone, tablet, computer, etc. held by the user. This embodiment does not limit the specific form of the client.

[0055] The target business page is an operation interface corresponding to the target business, and the user performs corresponding operations on the corresponding operation interface to handle the target business. The target business is any business provided, such as a transfer business, a financial management business, etc. This embodiment does not limit the specific functions of the target business.

[0056] The authorization request is a request for the user to grant relevant permissions. The authorization request sent to the client in this implementation is specifically a request for the user to grant the device data acquisition permission and the user data acquisition permission. The device data acquisition permission is the permission to obtain device data, and the user data acquisition permission is the permission to obtain user data. The device data is the data related to the client device held by the user, and the user data is the basic data that represents the user's identity.

[0057] For example, the device data mentioned above may specifically be the device model, device IP address, and data indicating whether the device is rooted, etc., and this embodiment does not limit the specific content of the device data. The user data mentioned above may specifically be the user name, user contact information, user occupation, and user age, etc., and this embodiment does not limit the specific content of the user data.

[0058] In this embodiment, the user can click the button where the target service is located through the client device to enter the target service page. Then, in response to the client's trigger operation on the target service page, an authorization request is generated based on the need to obtain device data and user data and sent to the client.

[0059] S202: Receive an authorization response sent by the client, and obtain device data, user data, and service data when the authorization response is allowed.

[0060] The authorization response is a response returned for the authorization request, which is used to inform whether the device data acquisition permission and the user data acquisition permission are allowed.

[0061] The business data refers to data related to target business activities, and is specifically pre-stored by business management personnel in the early stages of developing the target business.

[0062] In this embodiment, after sending the authorization request to the client, the client displays the content of the authorization request to allow the user to decide whether to allow the device data acquisition permission and the user data acquisition permission and trigger the corresponding button, and then generates and sends the authorization response based on the user's feedback. Then, in response to receiving the authorization response sent by the client, it is determined whether the authorization response is allowed. If so, the device data and user data are obtained through the network communication connection with the client, and the pre-stored business data is obtained.

[0063] When the client displays the authorization request, it may be displayed in the form of a pop-up window or a sub-page, or may be displayed in other forms. This embodiment does not limit the specific display form of the authorization request.

[0064] S203. Determine the risk scores corresponding to the device data, user data and business data respectively, and input the risk scores corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is obtained by training the historical risk scores corresponding to each data with marked weights until convergence.

[0065] Among them, the risk score is a score that characterizes the risk preference of relevant data.

[0066] The preset weight determination model is used to determine the weight of relevant data under a certain risk preference, which is obtained by training the historical risk scores corresponding to each data with the marked weight until convergence. The historical risk score is the risk score determined by the relevant data collected in the past, and the relevant data is the device data, user data and business data mentioned above.

[0067] Among them, the weighted risk score is the risk score with the corresponding weight added.

[0068] In this embodiment, the historical risk scores corresponding to the device data, the historical risk scores corresponding to the user data, and the historical risk scores corresponding to the business data can be obtained in advance, and the corresponding weights can be determined and marked for the historical risk scores corresponding to each data according to historical experience or expert analysis results, so as to obtain the historical risk scores corresponding to each data with marked weights, and then use this as a training sample to train the model through a machine learning method to obtain a preset weight determination model.

[0069] Based on this, after obtaining the device data, user data and business data, the possible risks of each data are determined respectively, and the risk score corresponding to each data is determined based on the above possible risks, so that the risk score corresponding to each data is input into the preset weight determination model, and the weight of each data under the corresponding risk score is output based on the preset weight determination model. Further, the product between the risk score corresponding to each data and the corresponding weight is calculated to obtain the weighted risk score corresponding to each data.

[0070] S204: Determine the risk level of the triggering operation according to the weighted risk score corresponding to each data, and perform identity authentication on the client according to the risk level.

[0071] The risk level is used to characterize the risk level corresponding to the trigger operation for the target business.

[0072] In this embodiment, associations between multiple preset risk levels and weighted risk scores corresponding to each preset risk level can be pre-established. After the weighted risk scores corresponding to each data are determined, the preset risk level associated with the weighted risk scores corresponding to each data is determined based on the weighted risk scores corresponding to each data, and the preset risk level is determined as the risk level for triggering the operation, and the client is authenticated based on the risk level. The preset risk level is a risk level determined in advance based on specific needs.

[0073] Among them, when authenticating the client according to the risk level, it can be specifically: pre-set multiple identity authentication methods, and establish an association between each identity authentication method and the corresponding preset risk level. After determining the risk level of the triggering operation, based on the above association, find the identity authentication method associated with the risk level of the triggering operation, and use the identity authentication method to authenticate the client.

[0074] The identity authentication method provided in this embodiment uses the historical risk scores corresponding to each data with marked weights to train until convergence to obtain a preset weight determination model. Therefore, when it is determined that the client has performed a trigger operation on the target business page, the device data acquisition permission and the user data acquisition permission can be requested from the client by sending an authorization request to the client, and the device data, user data and pre-stored business data can be acquired when the authorization response is allowed by receiving the authorization response sent by the client. Therefore, by respectively determining the risk scores corresponding to the device data, user data and business data, the risk scores corresponding to each data can be input into the preset weight determination model to obtain the weighted risk scores corresponding to each data. Then, by determining the risk level of the trigger operation according to the weighted risk scores corresponding to each data, the client can be authenticated according to the risk level. Therefore, on the basis of considering the sensitivity of the business data, the potential risks that may be brought by the client device and the user holding the client device are further considered, and the accuracy of the determined risk level is improved, thereby improving the security of the identity authentication and improving the user experience.

[0075] As an optional embodiment, based on the above embodiment, this embodiment further refines the risk scores corresponding to the device data, user data and business data respectively. When determining the risk scores corresponding to the device data, user data and business data respectively, this embodiment specifically includes the following steps:

[0076] Step a1: searching the risk score with the strongest correlation with the device data in the device score determination rule; the device score determination rule is used to specify preset device tags corresponding to different risk scores; the device data includes at least one device tag.

[0077] In this embodiment, the device data may include at least one device tag, which is a tag related to the device data and is specifically used to characterize the key information of the device data. For example, if the device data is "A model and rooted mobile phone, IP address is B province B city", then the at least one device tag included in the device data may be: "A model", "rooted", "B province", "B city".

[0078] The device score determination rule is a rule for determining the risk score corresponding to the device data, and is specifically used to specify preset device labels corresponding to different risk scores. The preset device label is any pre-set device label.

[0079] In this embodiment, multiple risk scores can be set in advance based on the need to determine the risk score corresponding to the device data, and a corresponding preset device label can be assigned to each risk score to form a device score determination rule. For example, multiple risk scores can be set as: 20; 40; 60, and a corresponding preset device label can be assigned to each risk score: 20 is assigned "A model, no root, C province", 40 is assigned "B model, rooted, B province", and 60 is assigned "C model, rooted, D province".

[0080] Based on this, in response to respectively determining the risk scores corresponding to the device data, user data, and business data, a device score determination rule is obtained, and at least one device tag included in the device data is obtained, so that based on the device score determination rule, at least one preset device tag that is the same as the above-mentioned at least one device tag is searched in the preset device tags corresponding to each risk level, and the risk score containing the most identical preset device tags is determined as the risk score with the strongest degree of association with the device data, that is, the risk score corresponding to the device data. For example, if the device score determination rule is: "Risk score 20: Model A, no root, Province C; Risk score 40: Model B, rooted, Province B; Risk score 60: Model C, rooted, Province D", and at least one device tag included in the device data is: "Model A", "rooted", "Province B", "City B", then the risk score 40 can be determined as the risk score with the strongest degree of association with the device data, that is, the risk score corresponding to the device data is 40.

[0081] It should be understood that the above examples are only for illustrative purposes and should not constitute any limitation to the present application.

[0082] Step a2: searching the user score determination rule for the risk score that is most closely associated with the user data; the user score determination rule is used to specify preset user tags corresponding to different risk scores; the user data includes at least one user tag.

[0083] The user score determination rule is a rule for determining the risk score corresponding to the user data, and is specifically used to specify preset user tags corresponding to different risk scores. The preset user tag is any pre-set user tag. The user tag is a tag related to the user data, and is specifically used to characterize the key information of the user data.

[0084] In this embodiment, in response to respectively determining the risk scores corresponding to the device data, user data, and business data, the risk score with the strongest correlation with the user data is searched in the user score determination rule, and the risk score is determined as the risk score corresponding to the user data. The specific determination process is similar to step a1 and will not be repeated here.

[0085] Exemplarily, if the user score determination rule is: "Risk score 40: age less than 60, employed employee; risk score 60: age greater than 60, self-employed", and the user data includes at least one user tag: "age greater than 60", "retired worker", then it can be determined that the risk score 60 is the risk score with the highest degree of association with the user data, that is, the risk score corresponding to the user data is 60.

[0086] It should be understood that the above examples are only for illustrative purposes and should not constitute any limitation to the present application.

[0087] Step a3: searching the business score determination rules for the risk score that is most closely associated with the business data; the business score determination rules are used to specify preset business tags corresponding to different risk scores; and the business data includes at least one business tag.

[0088] Among them, the business score determination rule is a rule for determining the risk score corresponding to the business data, which is specifically used to specify the preset business tags corresponding to different risk scores. The preset business tag is any pre-set business tag. The business tag is a tag related to the business data, which is specifically used to characterize the key information of the business data.

[0089] In this embodiment, in response to respectively determining the risk scores corresponding to the device data, user data, and business data, the risk score with the strongest correlation with the business data is searched in the business score determination rule, and the risk score is determined as the risk score corresponding to the business data. The specific determination process is similar to step a1 and will not be repeated here.

[0090] Exemplarily, if the business score determination rule is: "Risk score 20: social business, customer information; risk score 40: financial management business, customer related information; risk score 60: transfer business, customer asset information", and the business data includes at least one business tag: "social business", "customer information", "customer related information", then it can be determined that the risk score 20 is the risk score with the strongest correlation with the business data, that is, the risk score corresponding to the business data is 20.

[0091] It should be understood that the above examples are only for illustrative purposes and should not constitute any limitation to the present application.

[0092] The identity authentication method provided in this embodiment forms device score determination rules, user score determination rules, and business score determination rules based on preset device tags, preset user tags, and preset business tags corresponding to different risk scores in advance. Therefore, by determining at least one device tag included in the device data, the risk score with the strongest degree of association with the device data can be found in the device score determination rules. Similarly, by determining at least one user tag included in the user data, the risk score with the strongest degree of association with the user data can be found in the user score determination rules. Similarly, by determining at least one business tag included in the business data, the risk score with the strongest degree of association with the business data can be found in the business score determination rules. In this way, the risk score corresponding to each data can be quickly determined, and the efficiency of determining the risk score can be improved.

[0093] As an optional embodiment, in this embodiment Figure 2 On the basis of the corresponding embodiment, the risk scores corresponding to the device data, user data and business data are further refined. When the risk scores corresponding to the device data, user data and business data are determined respectively, the embodiment specifically includes the following steps:

[0094] Step b1: extract at least one device feature from the device data using a device score determination model, and output a risk score corresponding to the device data based on each device feature; the device score determination model is trained until convergence using preset device features marked with risk scores.

[0095] Among them, the equipment score determination model is a model for determining the risk score corresponding to the equipment data.

[0096] Among them, device features are various attributes or indicators extracted from device data that can describe the device status, behavior or performance.

[0097] In this embodiment, a large number of preset device features can be obtained in advance, and the corresponding risk score can be determined and marked for each preset device feature according to historical experience or expert analysis results, so as to obtain the preset device features with marked risk scores, and then use this as a training sample to train the model through a machine learning method to obtain a device score determination model. The preset device feature is any preset device feature.

[0098] Based on this, in response to respectively determining the risk scores corresponding to the device data, user data and business data, the device data is input into the device score determination model, and the device score determination model is used to extract at least one device feature from the device data, and based on the extracted device features, the risk score corresponding to each device feature is calculated, so that according to the risk scores corresponding to each device feature, the overall risk score of the device data is comprehensively calculated and output, that is, the risk score corresponding to the device data.

[0099] Step b2: extract at least one user feature from the user data using a user score determination model, and output a risk score corresponding to the user data based on each user feature; the user score determination model is trained until convergence using preset user features marked with risk scores.

[0100] The user score determination model is a model for determining the risk score corresponding to the user data. User features are various indicators or attributes extracted from user data that can describe user behavior or status. Preset user features are any pre-set user features.

[0101] In this embodiment, in response to respectively determining the risk scores corresponding to the device data, user data, and business data, the user data is input into the user score determination model, and the risk score corresponding to the user data is output based on the user score determination model. The specific execution process is similar to step b1 and will not be repeated here.

[0102] Step b3: Use the business score determination model to extract at least one business feature from the business data, and output the risk score corresponding to the business data based on each business feature; the business score determination model is trained until convergence using preset business features marked with risk scores.

[0103] The business score determination model is a model for determining the risk score corresponding to the business data. Business features are various indicators or attributes extracted from business data that can describe business activities, processes or states. Preset business features are any pre-set business features.

[0104] In this embodiment, in response to respectively determining the risk scores corresponding to the device data, user data and business data, the business data is input into the business score determination model, and the risk score corresponding to the business data is output based on the business score determination model. The specific execution process is similar to step b1 and will not be repeated here.

[0105] The identity authentication method provided in this embodiment is pre-trained based on preset device features, preset user features, and preset business features to obtain a device score determination model, a user score determination model, and a business score determination model. Therefore, by using the device score determination model to extract at least one device feature from the device data, the risk score corresponding to the device data can be output based on each device feature. Similarly, by using the user score determination model to extract at least one user feature from the user data, the risk score corresponding to the user data can be output based on each user feature. Similarly, by using the business score determination model to extract at least one business feature from the business data, the risk score corresponding to the business data can be output based on each business feature. In this way, the risk score corresponding to each data can be quickly determined, the efficiency of determining the risk score can be further improved, and the flexibility in determining the risk score can be improved.

[0106] As an optional embodiment, this embodiment further refines the risk level of the trigger operation determined according to the weighted risk score corresponding to each data on the basis of any of the above embodiments. When determining the risk level of the trigger operation according to the weighted risk score corresponding to each data, this embodiment specifically includes the following steps:

[0107] Step c1: summing up the weighted risk scores corresponding to the device data, user data and business data to obtain a total weighted risk score.

[0108] Among them, the total weighted risk score is used to characterize the overall risk level of this triggered operation.

[0109] It can be understood that the device data, user data and business data are obtained based on this trigger operation, and the weighted risk score corresponding to each data is also determined based on this trigger operation. Therefore, in response to determining the risk level of the trigger operation according to the weighted risk score corresponding to each data, the weighted risk scores corresponding to the device data, user data and business data are added to obtain a total weighted risk score that can characterize the overall risk level of this trigger operation.

[0110] Step c2: Obtain preset level determination rules; the preset level determination rules are used to specify score thresholds corresponding to different risk levels.

[0111] The preset level determination rule is a rule for determining the risk level of the current trigger operation, and is specifically used to specify the score thresholds corresponding to different risk levels. The score threshold is used to represent a certain weighted risk score range.

[0112] In this embodiment, multiple risk levels can be pre-set, and a score threshold can be specified for each risk level to obtain a preset level determination rule. For example, the risk level can be set as low, medium, and high, and the score threshold can be specified as "50-69" for the low risk level, "70-89" for the medium risk level, and "90-109" for the high risk level.

[0113] In this embodiment, after the total weighted risk score is obtained, a preset level determination rule is obtained to determine the risk level of the current triggering operation according to the total weighted risk score and the preset level determination rule.

[0114] It should be understood that the above examples are only for illustrative purposes and should not constitute any limitation to the present application.

[0115] Step c3: Find the score threshold of the total weighted risk score in the preset level determination rule, and determine the risk level to which the score threshold belongs as the risk level for triggering the operation.

[0116] In this embodiment, after obtaining the total weighted risk score and the preset level determination rule, based on the preset level determination rule, the score threshold of the total weighted risk score is searched among the score thresholds corresponding to each risk level, and the risk level to which the score threshold belongs is determined as the risk level of this trigger operation.

[0117] For example, if the score threshold corresponding to the low risk level is "50-69", the score threshold corresponding to the medium risk level is "70-89", the score threshold corresponding to the high risk level is "90-109", and the total weighted risk score is 77, then it can be determined that the risk level of this trigger operation is a medium risk level.

[0118] It should be understood that the above examples are only for illustrative purposes and should not constitute any limitation to the present application.

[0119] The identity authentication method provided in this embodiment forms a preset level determination rule based on the score thresholds corresponding to different risk levels in advance. Therefore, the total weighted risk score is obtained by adding up the weighted risk scores corresponding to each data. By obtaining the preset level determination rule, the score threshold where the total weighted risk score is located can be quickly found in the preset level determination rule, and the risk level to which the score threshold belongs can be determined as the risk level for triggering the operation, thereby improving the efficiency of determining the risk level.

[0120] As an optional embodiment, this embodiment further refines the identity authentication of the client according to the risk level on the basis of any of the above embodiments. When the identity authentication of the client according to the risk level is performed in this embodiment, the following steps are specifically included:

[0121] Step d1: If the risk level is low, a static password or a dynamic verification code is used to authenticate the client.

[0122] Among them, the static password refers to the fixed password set by the user. The dynamic verification code refers to the code dynamically verified through the user's contact information.

[0123] In this embodiment, in response to authenticating the client according to the risk level, if the risk level is low, it means that the risk of the triggered operation is low and it is more likely to be performed by the user himself, so a static password or a dynamic verification code is used to authenticate the client.

[0124] Step d2: If the risk level is medium, biometric identification and a static password, or biometric identification and a dynamic verification code are used to authenticate the client.

[0125] Among them, biometric recognition refers to identification through user's facial features, fingerprint features and other biometric features.

[0126] In this embodiment, in response to authenticating the client according to the risk level, if the risk level is medium, it means that the risk of this triggered operation is moderate. In order to further verify whether it is performed by the user himself, the client is authenticated in combination with biometric recognition, that is, biometric recognition and static password are used, or biometric recognition and dynamic verification code are used to authenticate the client.

[0127] Step d3: If the risk level is high, the client is authenticated using identity document verification, biometric identification and a static password, or identity document verification, biometric identification and a dynamic verification code.

[0128] Among them, identity document verification refers to verification through the user's identity card.

[0129] In this embodiment, in response to identity authentication of the client according to the risk level, if the risk level is high, it means that the risk of the triggered operation is high and there is a high possibility that it is not performed by the user himself, then identity authentication of the client is performed by identity document verification, biometric recognition and static password, or identity document verification, biometric recognition and dynamic verification code.

[0130] The identity authentication method provided in this embodiment can set corresponding identity authentication methods for different risk levels, so that when the risk level is determined to be low, a static password or a dynamic verification code can be used to authenticate the client, when the risk level is determined to be medium, biometric identification and a static password, or biometric identification and a dynamic verification code can be used to authenticate the client, and when the risk level is determined to be high, identity document verification, biometric identification and a static password, or identity document verification, biometric identification and a dynamic verification code can be used to authenticate the client. In this way, corresponding authentication can be flexibly performed according to the risk level of the user, the security of authentication can be improved, and the user experience can be improved.

[0131] As an optional embodiment, this embodiment, based on any of the above embodiments, further includes the following steps:

[0132] Step e1: Receive the identity authentication information sent by the client and verify the identity authentication information.

[0133] The identity authentication information is information fed back by the user according to a specific identity authentication method, which is any identity authentication method provided in step d1 to step d3.

[0134] In this embodiment, in response to authenticating the client, the adopted authentication method is sent to the client, and the authentication information sent by the client based on the authentication method is received, so as to verify the authenticity of the authentication information.

[0135] Specifically, if the identity authentication information is information returned based on a static password or a dynamic verification code, the identity authentication information should include a fixed password or verification code entered by the user, then the fixed password set by the user when registering for the service is obtained, or a verification code generated based on the user's contact information is obtained, and the two fixed passwords or two verification codes are compared to determine whether the two fixed passwords or two verification codes are the same. If so, the verification is successful, otherwise, the verification fails.

[0136] Optionally, if the identity authentication information is based on biometric identification and a static password, or the information returned by biometric identification and a dynamic verification code, the identity authentication information should include the fixed password entered by the user and the user's biometrics, or the verification code entered by the user and the user's biometrics, then obtain the fixed password set by the user when registering for the service and the user's biometrics collected when registering for the service, or the verification code generated based on the user's contact information and the user's biometrics collected when registering for the service. Compare the two fixed passwords and the two biometrics, or the two verification codes and the two biometrics, to determine whether the two fixed passwords and the two biometrics, or the two verification codes and the two biometrics are the same. If so, the verification is successful, if not, the verification fails.

[0137] Optionally, if the identity authentication information is based on identity document verification, biometric identification and static password, or identity document verification, biometric identification and information returned by dynamic verification code, then the identity authentication information should include the fixed password entered by the user, the user's biometrics and the identity document information entered by the user through NFC, or the verification code entered by the user, the user's biometrics and the identity document information entered by the user through NFC, then obtain the fixed password set by the user when registering for the service, the user's biometrics collected when registering for the service and the identity document information entered by the user when registering for the service, or the verification code generated based on the user's contact information, the user's biometrics collected when registering for the service and the identity document information entered by the user when registering for the service. Compare the two fixed passwords, two biometrics and two identity document information, or the two verification codes, two biometrics and two identity document information, to determine whether the two fixed passwords, two biometrics and two identity document information, or the two verification codes, two biometrics and two identity document information are the same. If so, the verification is successful, if not, the verification fails.

[0138] Step e2: When the verification is successful, the target business details page is sent to the client.

[0139] The target business details page is a page that displays the details of the target business.

[0140] In this embodiment, after the identity authentication information is verified, if the verification is successful, it means that the trigger operation is performed by the user himself, and the target business details page is obtained and sent to the client.

[0141] Step e3: When verification fails, identity authentication failure information is generated and sent to the client.

[0142] The identity authentication failure information is information generated based on the result of the identity authentication failure, and is specifically used to inform the user that the identity authentication information entered by the user is incorrect.

[0143] In this embodiment, after the identity authentication information is verified, if the verification fails, it means that the trigger operation may not be performed by the user himself, and identity authentication failure information is generated based on the incorrect identity authentication information, and the identity authentication failure information is sent to the client.

[0144] The identity authentication method provided in this embodiment, since the user will input the corresponding identity authentication information according to the provided identity authentication method, the identity authentication information can be verified by receiving the identity authentication information sent by the client, so that when the verification is successful, the target business details page is sent to the client, so that the user can smoothly handle the business based on the page, further improving the user experience, and when the verification fails, identity authentication failure information is generated and sent to the client, so that the user can successfully learn the result that the input identity authentication information is incorrect, further improving the user experience.

[0145] As an optional embodiment, this embodiment, based on any of the above embodiments, further includes the following steps:

[0146] Step f1: receiving target adjustment information sent by the management end; the target adjustment information is used to adjust one or more of the score determination rules, the score determination models and the preset weight determination model.

[0147] The management terminal is any terminal device where a business manager is located. The business manager is a person who manages the operation of the business.

[0148] The target adjustment information is information for optimizing the identity authentication process, and is specifically used to adjust one or more of the score determination rules, score determination models, and preset weight determination models. The score determination rules may be device score determination rules, user score determination rules, and service score determination rules. The score determination models may be device score determination models, user score determination models, and service score determination models.

[0149] It is understandable that in order to ensure that identity authentication can be effectively performed under the above models and rules, the above models and rules may be regularly adjusted during subsequent use.

[0150] Specifically, the business management personnel may manually verify the risk level confirmation results regularly to determine whether each score determination rule, each score determination model, and the preset weight determination model have reached the standard for accurate determination, and for the models that have not reached the standard, obtain the relevant data of their misjudgment and add it to their corresponding sample library, and use the latest sample library for retraining to obtain a retrained model. Then, for the rules that have not reached the standard, the risk score and corresponding label specified in the rules are adjusted according to the misjudgment results to obtain the adjusted rules. Furthermore, based on the retrained model and / or the adjusted rules, the business management personnel trigger a button to confirm the adjustment through the management end. Then, in response to the triggering of the above button, the management end forms target adjustment information according to the retrained model and / or the adjusted rules, and sends it to the server.

[0151] Based on this, the target adjustment information sent by the receiving management end is received.

[0152] Step f2: using the target adjustment information to adjust one or more of the score determination rules, the score determination models, and the preset weight determination model.

[0153] In this embodiment, after obtaining the target adjustment information, the retrained model and / or the adjusted rules contained therein are obtained, and the retrained model is used to update and iterate the currently used model, and the adjusted rules are used to replace the currently used rules, thereby completing the adjustment.

[0154] In the identity authentication method provided by this embodiment, since the management end can determine the use effect of each model and / or rule according to the risk level confirmation result, by receiving the target adjustment information sent by the management end, the target adjustment information can be used to adjust one or more of the score determination rules, the score determination models, and the preset weight determination model, thereby improving the accuracy of the determined risk level and further improving the security of identity authentication.

[0155] Figure 3 The process of the identity authentication method provided in the embodiment of the present application Figure 2 .like Figure 3 As shown, the execution subject of the identity authentication method is an identity authentication device, and the identity authentication device is located in an electronic device, specifically in a client device. The identity authentication method provided in this embodiment includes:

[0156] S301. In response to currently entering a target business page, receiving an authorization request sent by a server; the authorization request is used to request device data acquisition authority and user data acquisition authority.

[0157] The server is any server device that provides target services, such as a server, computer, etc.

[0158] In this embodiment, based on the user clicking the button where the target business is located, the target business page is displayed on the operation interface, and an authorization request sent by the server is received, so that a sub-page or pop-up window is generated based on the authorization request to be displayed on the operation interface.

[0159] S302: Receive an authorization response triggered by the user to the authorization request, and collect device data and user data when the authorization response is allowed.

[0160] In this embodiment, the user can click a button to allow authorization or not allow authorization based on the authorization request in the sub-page or pop-up window. In response to the user's click operation, an authorization response is generated based on the result of allowing authorization or not allowing authorization, and when the authorization response is allowed, the device data and the user data entered by the user when using the client device are collected through the built-in collection component.

[0161] It is understandable that if the authorization response is not allowed, a corresponding prompt message can be generated to inform the user that the business cannot be handled normally.

[0162] S303. Send the authorization response to the server so that the server can obtain device data, user data and business data when the authorization response is allowed; determine the risk scores corresponding to the device data, user data and business data respectively, and input the risk scores corresponding to each data into the preset weight determination model to obtain the weighted risk score corresponding to each data; the preset weight determination model is trained until convergence using the historical risk scores corresponding to each data with marked weights; determine the risk level of the triggering operation according to the weighted risk scores corresponding to each data, and authenticate the client according to the risk level.

[0163] In this embodiment, based on the result that the authorization response is allowed, the authorization response is sent to the server, so that the server obtains device data, user data and business data when the authorization response is allowed, and determines the risk scores corresponding to the device data, user data and business data respectively, so that the risk score corresponding to each data is input into the preset weight determination model, and the weighted risk score corresponding to each data is obtained, and the risk level of the triggering operation is determined according to the weighted risk score corresponding to each data, thereby authenticating the client according to the risk level. The specific execution process is similar to S202-S204, and will not be repeated here.

[0164] In the identity authentication method provided in this embodiment, since the server sends an authorization request for obtaining device and user data, when it is determined that the current target business page is entered, by receiving the authorization request sent by the server, the user can decide whether to grant the server permission based on the authorization request, and thus by receiving the authorization response triggered by the user to the authorization request, the device data and user data can be collected when the authorization response is allowed, and the authorization response can be sent to the server, so that the server can smoothly execute the subsequent identity authentication process, thereby improving the success rate of subsequent identity authentication.

[0165] As an optional embodiment, this embodiment, based on the above embodiment, further includes the following steps:

[0166] Step A1: According to the identity authentication method provided by the server, receive the identity authentication information input by the user, and send the identity authentication information to the server.

[0167] In this embodiment, according to the identity authentication method provided by the server, the user is instructed to enter the corresponding identity authentication information. Specifically, according to the identity authentication method of static password or dynamic verification code provided by the server, the user can be instructed to enter the fixed password set by the user or the verification code obtained through the contact information.

[0168] Optionally, based on the biometrics and static password provided by the server, or the biometrics and dynamic verification code authentication method, the user can be instructed to enter his or her biometrics and a set fixed password, or the user can be instructed to enter his or her biometrics and a verification code obtained through his or her contact information.

[0169] Optionally, based on the identity authentication methods of identity document verification, biometric identification and static password, or identity document verification, biometric identification and dynamic verification code provided by the server, the user can be instructed to enter the identity document information through NFC, and enter his or her biometrics and a set fixed password, or the user can be instructed to enter the identity document information through NFC, and enter his or her biometrics and a verification code obtained through his or her contact information.

[0170] Based on this, the identity authentication information entered by the user is received and sent to the server.

[0171] Step A2: When the verification is successful, the target business details page sent by the server is received, and the target business details page is displayed on the corresponding operation interface.

[0172] In this embodiment, the identity authentication information is verified based on the server. When the verification is successful, the target business details page sent by the server is received and displayed on the corresponding operation interface so that the user can handle the target business through the target business details page.

[0173] Step A3: When the verification fails, the identity authentication failure information sent by the server is received, and the identity authentication failure information is displayed on the corresponding operation interface.

[0174] In this embodiment, the identity authentication information is verified based on the server. When the verification fails, the identity authentication failure information sent by the server is received and displayed on the corresponding operation interface so that the user can know the result of the identity authentication failure.

[0175] The identity authentication method provided in this embodiment provides an identity authentication method for authenticating the user's identity. Therefore, by receiving the identity authentication information input by the user, the identity authentication information can be sent to the server. When the authentication is successful, the target business details page sent by the server is received, and the target business details page is displayed on the corresponding operation interface. When the authentication fails, the identity authentication failure information sent by the server is received, and the identity authentication failure information is displayed on the corresponding operation interface, so that the user can know the result of authentication success or failure through the display content on the operation interface, thereby further improving the user experience.

[0176] Figure 4 The signaling flow chart of the identity authentication method provided in the embodiment of the present application. Figure 4 As shown, this embodiment is applied to a server device and a client device, and this embodiment specifically includes the following steps:

[0177] S401: The server responds to a trigger operation on a target business page and sends an authorization request to the client.

[0178] The authorization request is used to request the client for permission to obtain device data and user data.

[0179] S402: The client responds to entering the target business page and receives an authorization request.

[0180] S403: The client receives an authorization response triggered by the user to the authorization request, and collects device data and user data when the authorization response is allowed.

[0181] S404: The client sends an authorization response to the server.

[0182] S405: The server receives the authorization response and obtains device data, user data, and business data.

[0183] S406. The server searches for the risk scores with the strongest correlation with the device data, user data, and business data in the corresponding score determination rules; or, uses the corresponding score determination model to extract at least one feature corresponding to the device data, user data, and business data, and outputs the risk scores corresponding to the device data, user data, and business data based on each feature.

[0184] Among them, when searching for the risk scores with the strongest association with device data, user data and business data in the corresponding score determination rules respectively, it can be specifically as follows: searching for the risk score with the strongest association with device data in the device score determination rule; the device score determination rule is used to specify preset device tags corresponding to different risk scores; the device data contains at least one device tag; searching for the risk score with the strongest association with user data in the user score determination rule; the user score determination rule is used to specify preset user tags corresponding to different risk scores; the user data contains at least one user tag; searching for the risk score with the strongest association with business data in the business score determination rule; the business score determination rule is used to specify preset business tags corresponding to different risk scores; the business data contains at least one business tag.

[0185] Among them, when using the corresponding score determination model to respectively extract at least one feature corresponding to the device data, user data and business data, and output the risk scores corresponding to the device data, user data and business data based on each feature, it can be specifically: using the device score determination model to extract at least one device feature from the device data, and output the risk score corresponding to the device data based on each device feature; the device score determination model is trained until convergence using the preset device features marked with risk scores; using the user score determination model to extract at least one user feature from the user data, and output the risk score corresponding to the user data based on each user feature; the user score determination model is trained until convergence using the preset user features marked with risk scores; using the business score determination model to extract at least one business feature from the business data, and output the risk score corresponding to the business data based on each business feature; the business score determination model is trained until convergence using the preset business features marked with risk scores.

[0186] S407: The server inputs the risk score corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data.

[0187] Among them, the preset weight determination model is obtained by training the historical risk scores corresponding to each data with marked weights until convergence.

[0188] S408. The server adds up the weighted risk scores corresponding to the device data, user data, and business data to obtain a total weighted risk score.

[0189] S409: The server obtains a preset level determination rule.

[0190] Among them, the preset level determination rules are used to specify the score thresholds corresponding to different risk levels.

[0191] S410: The server searches for a score threshold of the total weighted risk score in a preset level determination rule, and determines the risk level to which the score threshold belongs as the risk level for triggering the operation.

[0192] S411. When the risk level is low, the server uses a static password or a dynamic verification code to authenticate the client; when the risk level is medium, the server uses biometric recognition and a static password, or biometric recognition and a dynamic verification code to authenticate the client; when the risk level is high, the server uses identity document verification, biometric recognition and a static password, or identity document verification, biometric recognition and a dynamic verification code to authenticate the client.

[0193] S412: The client receives the identity authentication information input by the user according to the provided identity authentication method, and sends the identity authentication information to the server.

[0194] S413. The server receives the identity authentication information, verifies the identity authentication information, and determines whether the verification is successful. If so, execute S414-S415; if not, execute S416-S417.

[0195] S414: The server sends the target business details page to the client.

[0196] S415: The client receives the target business details page and displays the target business details page on the corresponding operation interface.

[0197] S416: The server generates identity authentication failure information and sends the identity authentication failure information to the client.

[0198] S417: The client receives the identity authentication failure information and displays the identity authentication failure information on the corresponding operation interface.

[0199] S418: The server receives the target adjustment information sent by the management terminal.

[0200] The target adjustment information is used to adjust one or more of the score determination rules, the score determination models, and the preset weight determination models.

[0201] S419: The server uses the target adjustment information to adjust one or more of the score determination rules, the score determination models, and the preset weight determination model.

[0202] Figure 5 A schematic diagram of the structure of the identity authentication device provided in the embodiment of the present application Figure 1 .like Figure 5As shown, the identity authentication device 50 is located in the server device, and the identity authentication device 50 includes: a sending module 51, a receiving module 52, an acquisition module 53, a determination module 54, an input module 55, and an authentication module 56.

[0203] Among them, the sending module 51 is used to send an authorization request to the client in response to the client's trigger operation on the target business page; the authorization request is used to request the client for device data acquisition permissions and user data acquisition permissions; the receiving module 52 is used to receive the authorization response sent by the client; the acquisition module 53 is used to acquire device data, user data and business data when the authorization response is allowed; the determination module 54 is used to respectively determine the risk scores corresponding to the device data, user data and business data; the input module 55 is used to input the risk score corresponding to each data into the preset weight determination model to obtain the weighted risk score corresponding to each data; the preset weight determination model is obtained by training the historical risk scores corresponding to each data with marked weights until convergence; the determination module 54 is also used to determine the risk level of the trigger operation according to the weighted risk score corresponding to each data; the authentication module 56 is used to authenticate the client according to the risk level.

[0204] Optionally, the determination module 54, when determining the risk scores corresponding to the device data, the user data and the business data respectively, is specifically configured to:

[0205] Search the risk score with the strongest association with the device data in the device score determination rule; the device score determination rule is used to specify the preset device tags corresponding to different risk scores; the device data contains at least one device tag; search the risk score with the strongest association with the user data in the user score determination rule; the user score determination rule is used to specify the preset user tags corresponding to different risk scores; the user data contains at least one user tag; search the risk score with the strongest association with the business data in the business score determination rule; the business score determination rule is used to specify the preset business tags corresponding to different risk scores; the business data contains at least one business tag.

[0206] Optionally, the determination module 54, when determining the risk scores corresponding to the device data, the user data and the business data respectively, is specifically configured to:

[0207] A device score determination model is used to extract at least one device feature from the device data, and a risk score corresponding to the device data is output based on each device feature; the device score determination model is obtained by training until convergence using preset device features marked with risk scores; a user score determination model is used to extract at least one user feature from the user data, and a risk score corresponding to the user data is output based on each user feature; the user score determination model is obtained by training until convergence using preset user features marked with risk scores; a business score determination model is used to extract at least one business feature from the business data, and a risk score corresponding to the business data is output based on each business feature; the business score determination model is obtained by training until convergence using preset business features marked with risk scores.

[0208] Optionally, the determination module 54, when determining the risk level of the triggering operation according to the weighted risk score corresponding to each data, is specifically configured to:

[0209] The weighted risk scores corresponding to the device data, user data and business data are summed to obtain a total weighted risk score; a preset level determination rule is obtained; the preset level determination rule is used to specify the score thresholds corresponding to different risk levels; the score threshold of the total weighted risk score is searched in the preset level determination rule, and the risk level to which the score threshold belongs is determined as the risk level for triggering the operation.

[0210] Optionally, the authentication module 56, when performing identity authentication on the client according to the risk level, is specifically used to:

[0211] If the risk level is low, a static password or a dynamic verification code is used to authenticate the client; if the risk level is medium, biometric recognition and a static password, or biometric recognition and a dynamic verification code are used to authenticate the client; if the risk level is high, identity document verification, biometric recognition and a static password, or identity document verification, biometric recognition and a dynamic verification code are used to authenticate the client.

[0212] Optionally, the identity authentication device provided in this embodiment further includes: a verification module and a generation module.

[0213] Among them, the receiving module 52 is also used to receive the identity authentication information sent by the client, and the verification module is used to verify the identity authentication information; the sending module 51 is also used to send the target business details page to the client when the verification is successful; the generating module is used to generate the identity authentication failure information when the verification fails, and the sending module 51 is also used to send the identity authentication failure information to the client.

[0214] Optionally, the identity authentication device provided in this embodiment further includes: an adjustment module.

[0215] Among them, the receiving module 52 is also used to receive the target adjustment information sent by the management end; the target adjustment information is used to adjust one or more of the score determination rules, the score determination models and the preset weight determination models; the adjustment module is used to use the target adjustment information to adjust one or more of the score determination rules, the score determination models and the preset weight determination models.

[0216] The identity authentication device provided in the embodiment of the present application can be used to execute the technical solution of the identity authentication method executed by the server in the above embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0217] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in the form of hardware. For example, the sending module 51 can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The function of the above sending module 51. The implementation of other modules is similar. In addition, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0218] Figure 6 A schematic diagram of the structure of the identity authentication device provided in the embodiment of the present application Figure 2 .like Figure 6 As shown, the identity authentication device 60 is located in the client device, and the identity authentication device 60 includes: a receiving module 61, a collection module 62, and a sending module 63.

[0219] Among them, the receiving module 61 is used to respond to the current entry into the target business page and receive the authorization request sent by the server; the authorization request is used to request device data acquisition permissions and user data acquisition permissions; the receiving module is also used to receive the authorization response triggered by the user for the authorization request; the collection module 62 is used to collect device data and user data when the authorization response is allowed; the sending module 63 is used to send the authorization response to the server, so that the server can obtain device data, user data and business data when the authorization response is allowed; determine the risk scores corresponding to the device data, user data and business data respectively, and input the risk scores corresponding to each data into the preset weight determination model to obtain the weighted risk scores corresponding to each data; the preset weight determination model is obtained by training the historical risk scores corresponding to each data with marked weights until convergence; determine the risk level of the triggering operation according to the weighted risk scores corresponding to each data, and authenticate the client according to the risk level.

[0220] Optionally, the identity authentication device provided in this embodiment further includes: a display module.

[0221] Among them, the receiving module 61 is also used to receive the identity authentication information input by the user according to the identity authentication method provided by the server, and the sending module 63 is also used to send the identity authentication information to the server; the receiving module 61 is also used to receive the target business details page sent by the server when the verification is successful, and the display module is used to display the target business details page on the corresponding operation interface; the receiving module 61 is also used to receive the identity authentication failure information sent by the server when the verification fails, and the display module is also used to display the identity authentication failure information on the corresponding operation interface.

[0222] The identity authentication device provided in the embodiment of the present application can be used to execute the technical solution of the identity authentication method executed by the client in the above embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0223] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the receiving module 61 can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The function of the above receiving module 61. The implementation of other modules is similar. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0224] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device 70 may specifically be a server device or a client device, and the electronic device 70 may include: a transceiver 71 , a processor 72 , and a memory 73 .

[0225] The processor 72 executes the computer execution instructions stored in the memory, so that the processor 72 executes the scheme in the above embodiment. The processor 72 can be a general-purpose processor, including a central processing unit CPU, a network processor (NP), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0226] The memory 73 is connected to the processor 72 via a system bus and completes communication between them. The memory 73 is used to store computer program instructions.

[0227] The transceiver 71 can be used to send and receive data.

[0228] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The transceiver is used to realize the communication between the database access device and other computers (such as clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory.

[0229] The client device provided in the embodiment of the present application may be the terminal device of the above embodiment.

[0230] An embodiment of the present application also provides a chip for running instructions, which is used to execute the technical solution of the identity authentication method in the above embodiment.

[0231] An embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the technical solution of the identity authentication method of the above embodiment.

[0232] An embodiment of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, the technical solution of the identity authentication method in the above embodiment can be implemented.

[0233] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0234] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0235] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0236] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0237] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0238] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0239] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0240] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0241] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic control unit or a main control device.

[0242] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0243] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. An identity authentication method, characterized in that: The method comprises: In response to a trigger operation of a client on a target business page, sending an authorization request to the client; the authorization request is used to request the client for device data acquisition permission and user data acquisition permission; Receive an authorization response sent by the client, and obtain device data, user data, and service data when the authorization response is allowed; Determine the risk scores corresponding to the device data, user data and business data respectively, and input the risk scores corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is obtained by training the historical risk scores corresponding to each data with the marked weights until convergence; The risk level of the triggering operation is determined according to the weighted risk score corresponding to each data, and the identity of the client is authenticated according to the risk level.

2. The method according to claim 1, characterized in that The determining risk scores corresponding to the device data, the user data, and the business data respectively includes: searching for the risk score with the strongest correlation with the device data in the device score determination rule; the device score determination rule is used to specify preset device tags corresponding to different risk scores; the device data includes at least one device tag; searching the risk score with the strongest association with the user data in the user score determination rule; the user score determination rule is used to specify preset user tags corresponding to different risk scores; the user data includes at least one user tag; The risk score with the strongest correlation with the business data is searched in the business score determination rule; the business score determination rule is used to specify preset business tags corresponding to different risk scores; and the business data includes at least one business tag.

3. The method according to claim 1, characterized in that The determining risk scores corresponding to the device data, the user data, and the business data respectively includes: A device score determination model is used to extract at least one device feature from the device data, and a risk score corresponding to the device data is output based on each device feature; the device score determination model is obtained by training the preset device features marked with risk scores until convergence; A user score determination model is used to extract at least one user feature from the user data, and a risk score corresponding to the user data is output based on each user feature; the user score determination model is obtained by training until convergence using preset user features marked with risk scores; A business score determination model is used to extract at least one business feature from the business data, and a risk score corresponding to the business data is output based on each business feature; the business score determination model is trained until convergence using preset business features marked with risk scores.

4. The method according to any one of claims 1 to 3, characterized in that: The determining the risk level of the triggering operation according to the weighted risk score corresponding to each data includes: The weighted risk scores corresponding to the device data, user data, and business data are summed up to obtain a total weighted risk score; Obtaining a preset level determination rule; the preset level determination rule is used to specify the score thresholds corresponding to different risk levels; The score threshold of the total weighted risk score is searched in the preset level determination rule, and the risk level to which the score threshold belongs is determined as the risk level of the triggering operation.

5. The method according to any one of claims 1 to 3, characterized in that: The performing identity authentication on the client according to the risk level includes: If the risk level is low, a static password or a dynamic verification code is used to authenticate the client; If the risk level is medium, biometric identification and a static password, or biometric identification and a dynamic verification code are used to authenticate the client; If the risk level is high, identity verification of the client is performed using identity document verification, biometric identification and a static password, or identity document verification, biometric identification and a dynamic verification code.

6. The method according to any one of claims 1 to 3, characterized in that: Also includes: Receiving identity authentication information sent by the client, and verifying the identity authentication information; When the verification is successful, the target business details page is sent to the client; When verification fails, identity authentication failure information is generated and sent to the client.

7. The method according to any one of claims 1 to 3, characterized in that: Also includes: Receive target adjustment information sent by the management end; The target adjustment information is used to adjust one or more of the score determination rules, the score determination models, and the preset weight determination model; The target adjustment information is used to adjust one or more of the score determination rules, the score determination models, and the preset weight determination model.

8. An identity authentication method, characterized in that: The method comprises: In response to currently entering the target business page, receiving an authorization request sent by the server; the authorization request is used to request device data acquisition authority and user data acquisition authority; receiving an authorization response triggered by the user in response to the authorization request, and collecting device data and user data when the authorization response is allowed; The authorization response is sent to the server so that the server obtains device data, user data and business data when the authorization response is allowed; the risk scores corresponding to the device data, user data and business data are determined respectively, and the risk scores corresponding to each data are input into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is trained until convergence using historical risk scores corresponding to each data with marked weights; the risk level of the trigger operation is determined according to the weighted risk score corresponding to each data, and the client is authenticated according to the risk level.

9. The method according to claim 8, characterized in that Also includes: According to the identity authentication method provided by the server, receiving the identity authentication information input by the user, and sending the identity authentication information to the server; When the verification is successful, receiving the target business details page sent by the server, and displaying the target business details page on the corresponding operation interface; When the verification fails, the identity authentication failure information sent by the server is received, and the identity authentication failure information is displayed on the corresponding operation interface.

10. An identity authentication device, characterized in that: The device comprises: A sending module, configured to send an authorization request to the client in response to a trigger operation of the client on a target business page; the authorization request is used to request the client to obtain device data and user data; A receiving module, used to receive the authorization response sent by the client; An acquisition module, used for acquiring device data, user data and service data when the authorization response is allowed; A determination module, used to determine risk scores corresponding to device data, user data, and business data respectively; An input module, used to input the risk score corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is obtained by training the historical risk score corresponding to each data with the marked weight until convergence; The determination module is further used to determine the risk level of the triggering operation according to the weighted risk score corresponding to each data; An authentication module is used to perform identity authentication on the client according to the risk level.

11. An identity authentication device, characterized in that: The device comprises: A receiving module, configured to receive an authorization request sent by a server in response to currently entering a target business page; the authorization request is used to request device data acquisition authority and user data acquisition authority; The receiving module is further used to receive an authorization response triggered by the user in response to the authorization request; A collection module, used for collecting device data and user data when the authorization response is allowed; A sending module is used to send the authorization response to the server so that the server can obtain device data, user data and business data when the authorization response is allowed; determine the risk scores corresponding to the device data, user data and business data respectively, and input the risk scores corresponding to each data into a preset weight determination model to obtain a weighted risk score corresponding to each data; the preset weight determination model is trained until convergence using the historical risk scores corresponding to each data with marked weights; determine the risk level of the trigger operation according to the weighted risk scores corresponding to each data, and authenticate the client according to the risk level.

12. An electronic device, characterized in that: include: A processor, a memory and a transceiver communicatively connected to the processor; The memory stores computer-executable instructions; the transceiver is used to send and receive data; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 9 when executed by a processor.

14. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 9 when being executed by a processor.

Images