Operation verification method and device, storage medium and electronic equipment

Abstract

The invention relates to the technical field of data processing, in particular to an operation verification method, an operation verification device, a storage medium and electronic equipment. The operation verification method comprises the steps that terminal equipment responds to a business operation request and sends a safety equipment service detection request to safety equipment service; after the security equipment service passes the security equipment service detection on the terminal equipment by the security equipment service, acquiring a security equipment voucher returned by the security equipment service; and when a verification request corresponding to the service operation request is determined to be realized according to the security equipment certificate, sending the security equipment certificate to a service interface corresponding to the service operation request, so as to execute the service operation request after the security equipment certificate is verified by the service interface. According to the operation verification method disclosed by the invention, the problems of high operation verification cost and complicated operation can be solved.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to an operation verification method, an operation verification device, a storage medium, and an electronic device. Background Art

[0002] There are many verification scenarios in the business of Internet products. Usually when users need to perform some sensitive actions such as "login, account binding, password modification, payment, appeal", etc., in order to ensure that it is the user himself who is operating, some "verification methods" need to be added. Commonly used verification methods on the market now include face recognition, real-name authentication, mobile phone number verification code, security question / historical behavior verification, password verification, WeChat / QQ authorization verification, slider verification, graphic verification code verification, etc.

[0003] However, in this verification solution, the higher the credibility, the higher the verification cost. For example, several highly credible verification methods such as face identity system, SMS operator, WeChat authorization, QQ authorization, etc. all need to rely on external third parties for support and cannot be implemented by themselves. There are requirements for the user's operating environment. For example, "face recognition" requires the camera and the person to perform corresponding action capture, and "SMS verification code" needs to ensure an environment that can send and receive text messages. If the environment does not allow, it is easy to cause business verification failure and the business cannot continue. It is not possible to achieve the level of automation for the time being, and users are required to perform related operations themselves. The verification process is time-consuming, the operation process is cumbersome, the user experience is poor, and the failure rate is also high.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide an operation verification method, an operation verification device, a storage medium and an electronic device, aiming to solve the problems of high operation verification cost and complex operation.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of an embodiment of the present disclosure, there is provided an operation verification method, which is applied to a terminal device and includes:

[0008] The terminal device sends a security device service detection request to the security device service in response to the service operation request;

[0009] After the secure device service performs a secure device service detection on the terminal device and the terminal device passes the detection, obtaining the secure device credential returned by the secure device service;

[0010] When it is determined according to the security device credential that the verification request corresponding to the business operation request is feasible, the security device credential is sent to the business interface corresponding to the business operation request, so as to execute the business operation request after the business interface verifies the security device credential.

[0011] According to a second aspect of an embodiment of the present disclosure, there is provided an operation verification method, which is applied to a security device service, and includes:

[0012] Receiving a security device service detection request sent by a terminal device;

[0013] Performing a security device service test on the terminal device and generating a security device credential after the test passes;

[0014] The secure device credential is returned to the terminal device.

[0015] According to a third aspect of an embodiment of the present disclosure, an operation verification method is provided, which is applied to a service interface and includes:

[0016] Receive security device credentials and business operation requests sent by terminal devices;

[0017] The security device credential is verified based on the security device service, and the business operation request is executed after the verification passes.

[0018] According to a fourth aspect of an embodiment of the present disclosure, there is provided an operation verification apparatus, applied to a terminal device, comprising:

[0019] A response module, used for the terminal device to respond to the business operation request and send a security device service detection request to the security device service;

[0020] A detection module, configured to obtain a security device credential returned by the security device service after the security device service performs a security device service detection on the terminal device and passes the detection;

[0021] A sending module is used to send the security device credential to the business interface corresponding to the business operation request when it is determined that the verification request corresponding to the business operation request is feasible based on the security device credential, so as to execute the business operation request after the business interface verifies the security device credential.

[0022] According to a third aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the operation verification method in the above embodiment is implemented.

[0023] According to a fifth aspect of an embodiment of the present disclosure, there is provided an operation verification apparatus, which is applied to a security device service, and includes:

[0024] A request receiving module, used to receive a security device service detection request sent by a terminal device;

[0025] A service detection module, used to perform a security device service detection on the terminal device and generate a security device credential after the detection passes;

[0026] The credential returning module is used to return the security device credential to the terminal device.

[0027] According to a sixth aspect of an embodiment of the present disclosure, there is provided an operation verification device, which is applied to a service interface and includes:

[0028] The credential receiving module is used to receive the security device credentials and business operation requests sent by the terminal device;

[0029] The operation execution module is used to verify the security device credential based on the security device service and execute the business operation request after the verification passes.

[0030] According to a seventh aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the operation verification method as described in any one of the above items is implemented.

[0031] According to an eighth aspect of an embodiment of the present disclosure, an electronic device is provided, characterized in that it includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the operation verification method as in the above-mentioned embodiment.

[0032] The exemplary embodiments of the present disclosure may have some or all of the following beneficial effects:

[0033] In the technical solutions provided by some embodiments of the present disclosure, by pre-testing the terminal device for security device services and returning the security device credentials when the test is passed, the operation verification process can be simplified through the security device credentials. On the one hand, it can shorten the user operation link and greatly improve the user experience. On the other hand, the silent verification method based on "environment + device" simplifies the overall process and significantly improves the success rate of the system process. On the other hand, it avoids the operator fees generated by the original verification based on SMS, face recognition and other means, which can greatly reduce costs.

[0034] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0036] Figure 1 A schematic diagram schematically illustrates a flow chart of an operation verification method in an exemplary embodiment of the present disclosure;

[0037] Figure 2 A schematic diagram of credibility classification in an exemplary embodiment of the present disclosure is schematically shown;

[0038] Figure 3 A flowchart schematically illustrating another operation verification method in an exemplary embodiment of the present disclosure;

[0039] Figure 4 A schematic diagram schematically illustrates a trusted device detection method in an exemplary embodiment of the present disclosure;

[0040] Figure 5 A schematic diagram schematically illustrates a flow chart of another operation verification method in an exemplary embodiment of the present disclosure;

[0041] Figure 6 A schematic diagram schematically illustrates a data flow diagram of an operation verification method in an exemplary embodiment of the present disclosure;

[0042] Figure 7 A schematic diagram schematically illustrates an operation verification comparison in an exemplary embodiment of the present disclosure;

[0043] Figure 8 A schematic diagram schematically shows the composition of an operation verification device in an exemplary embodiment of the present disclosure;

[0044] Fig. 9 A schematic diagram schematically shows the composition of another operation verification device in an exemplary embodiment of the present disclosure;

[0045] Fig.10 A schematic diagram schematically shows the composition of another operation verification device in an exemplary embodiment of the present disclosure;

[0046] Fig.11 A schematic diagram schematically illustrates a computer-readable storage medium in an exemplary embodiment of the present disclosure;

[0047] Fig.12 The structure diagram of a computer system of an electronic device in an exemplary embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0048] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete and will fully convey the concept of the example embodiments to those skilled in the art.

[0049] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0050] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0051] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0052] In the business of Internet products, there are many verification scenarios. Usually when users need to perform some sensitive actions such as "login, account binding, password modification, payment, complaint", etc., in order to ensure that it is the user himself who is operating, some "verification methods" need to be added.

[0053] Commonly used verification methods on the market now include "face recognition, mobile phone number verification code, security question / historical behavior verification, password verification, WeChat / QQ authorization verification, slider verification, graphic verification code verification, etc.

[0054] The above verification solutions have the following shortcomings: the higher the credibility, the higher the verification cost; several highly credible verification methods require support from external third parties and cannot be implemented by themselves (face identity system, SMS operator, WeChat authorization, QQ authorization); the verification process is time-consuming and the verification process is relatively cumbersome; the verification process requires users to do some manual operations, and the longer the funnel, the greater the probability of failure.

[0055] Based on these shortcomings, it will also bring an impact on the business that requires a verification process. For example, the commonly used real-name authentication and mobile phone verification code verification will incur cost costs, and the cost investment needs to be considered for access and use; there are requirements for the user's operating environment, such as "face recognition" requires the camera and the person to perform corresponding action capture, and "SMS verification code" needs to ensure an environment that can send and receive text messages. If the environment does not allow, it is easy to cause business verification failure and the business cannot continue; several types of verification cannot be automated for the time being, and users need to perform related operations themselves. The operation process is cumbersome, the user experience is poor, and the failure rate is also high.

[0056] Therefore, in view of the shortcomings of the prior art, the present disclosure provides an operation verification method, which is intended to be an equivalent substitute for the verification methods of "SMS verification code verification, password verification, WeChat / QQ authorization verification, etc.". When a user has been active on a single device for a long time or has completed many sensitive operations on a device, it can be basically proved that the device belongs to a certain user, that is, the user can be deduced from the device's historical behavior. When the device performs business actions such as logging in, changing passwords, and changing bound mobile phone numbers, in theory, some complex verifications (such as face recognition and SMS verification code verification) should be omitted, allowing users to perform operations directly. Not only does it save business costs, it can also greatly shorten the business process, and security can also be guaranteed.

[0057] The implementation details of the technical solution of the embodiment of the present disclosure are elaborated in detail below.

[0058] Figure 1 The following is a schematic diagram showing a flow chart of an operation verification method in an exemplary embodiment of the present disclosure. Figure 1 As shown, the operation verification method is applied to a terminal device, specifically including steps S101 to S104:

[0059] Step S101, the terminal device sends a security device service detection request to the security device service in response to the service operation request;

[0060] Step S102, after the secure device service performs a secure device service detection on the terminal device and passes it, obtaining the secure device credential returned by the secure device service;

[0061] Step S103, when it is determined according to the security device credential that the verification request corresponding to the business operation request is feasible, the security device credential is sent to the business interface corresponding to the business operation request, so as to execute the business operation request after the business interface verifies the security device credential.

[0062] In the technical solutions provided by some embodiments of the present disclosure, by pre-testing the terminal device for security device services and returning the security device credentials when the test is passed, the operation verification process can be simplified through the security device credentials. On the one hand, it can shorten the user operation link and greatly improve the user experience. On the other hand, the silent verification method based on "environment + device" simplifies the overall process and significantly improves the success rate of the system process. On the other hand, it avoids the operator fees generated by the original verification based on SMS, face recognition and other means, which can greatly reduce costs.

[0063] Below, each step of the operation verification method in this example implementation will be described in more detail with reference to the accompanying drawings and embodiments.

[0064] In step S101, the terminal device sends a security device service detection request to the security device service in response to the service operation request.

[0065] Specifically, when the terminal device receives an operation request for a certain service, it needs to perform a security check through the security device service, and the operation can be performed only after the security check passes. Therefore, after the terminal device responds to the service operation request, it needs to send a security device service check request to the security device service.

[0066] In an embodiment of the present disclosure, the generating of the secure device service detection request includes: extracting basic device information of the terminal device; encrypting the basic device information to obtain Token information; and generating the secure device service detection request based on the Token information.

[0067] Specifically, the terminal device can encrypt its own basic device information into a token and transmit it to the security device service. The token is mainly used to identify the user, authorize access rights or transmit security information. It is a string of characters generated by the server and used as a token for the terminal device to make a request. The basic device information can be one or more of the terminal device's device code, operating system information, and network environment information.

[0068] In step S102, after the secure device service performs a secure device service detection on the terminal device and the detection passes, the secure device credential returned by the secure device service is obtained.

[0069] Specifically, the step of the security device service detection will be executed by the security device service, and when the detection passes, the security device credential returned by the security device service can be obtained.

[0070] In step S103, when it is determined according to the security device credential that the verification request corresponding to the business operation request is feasible, the security device credential is sent to the business interface corresponding to the business operation request.

[0071] The security device credential is not a universal "get out of jail free" that can exempt you from all verifications. Therefore, it is necessary to test the scope of verification exemption covered by the security device credential. If it can cover the verification request of the current business, you can use the security device credential to perform simplified verification. If it cannot cover the verification request of the current business, there is no need to use the security device credential.

[0072] Therefore, the security device credential includes the trust level of the terminal device, and the method also includes: judging based on a preset trusted device rule engine whether the security device credential can replace the verification request according to the trust level; when the security device credential can replace the verification request, determining that the verification request corresponding to the business operation request is feasible.

[0073] Figure 2 A schematic diagram of credibility classification in an exemplary embodiment of the present disclosure is shown schematically. Figure 2 As shown, the trust levels can be divided into A~F, with the trust levels decreasing in sequence. The higher the trust level, the higher the security of the verification. Then the device can be used to verify more sensitive business scenarios, otherwise it can only be used in simple scenarios. The reference standards for A~F are as follows:

[0074] A: Face / real-name authentication can prove that the current user is a natural person;

[0075] B: Mobile phone verification code verification can prove that the current user is the holder of a certain mobile phone number;

[0076] C: Bound third-party verification can prove that the current user is the holder of a third-party account;

[0077] D: Account historical order / behavior information verification, which can prove that the current user is aware of certain behaviors of the specified account;

[0078] E: Sliders, graphic verification codes, etc. can prove that the current user is not a robot user;

[0079] F: No verification.

[0080] After receiving the security device credential, the terminal device extracts the trust level and then compares the trust level with the verification content required for the business operation request. If the trust level of the security device credential exceeds the trust level corresponding to the verification content required for the business operation request, it is determined that the security device credential can replace the verification request.

[0081] If the trust level of a device is B, it means that the device security verification can be used to replace the SMS verification code related verification capabilities. For example, if the original user needs to verify the mobile phone number verification code to change the mobile phone number, then on this device, the change can be performed directly without verification, saving the SMS cost and user operation details. On the contrary, if the trust level of the device is F, there is basically no security guarantee and it cannot be used in any business scenario. The higher the level, the more business scenarios it can cover.

[0082] After the terminal device sends the security device certificate to the business interface corresponding to the business operation request, the business interface verifies the security device certificate and executes the business operation request after the verification passes.

[0083] Figure 3 The flowchart of another operation verification method in the exemplary embodiment of the present disclosure is schematically shown. Figure 3 As shown, the operation verification method is applied to the security device service, specifically including steps S301 to S303:

[0084] Step S301, receiving a security device service detection request sent by a terminal device;

[0085] Step S302, performing a security device service test on the terminal device, and generating a security device credential after the test passes;

[0086] Step S303: Return the security device credential to the terminal device.

[0087] In step S302, a security device service detection is performed on the terminal device, and a security device credential is generated after the detection passes.

[0088] Specifically, the security device service detection includes device environment detection and trusted device detection, and the security device service detection on the terminal device includes:

[0089] Step 1: extract the token information of the terminal device in the security device service detection request;

[0090] Step 2: Perform the device environment detection on the terminal device based on the Token information;

[0091] Step three: after the device environment detection passes, the trusted device detection is performed on the terminal device based on the Token information.

[0092] In one embodiment of the present disclosure, in step 1, after receiving the security device service detection request, the Token information of the terminal device sent by the terminal device can be obtained by decrypting the Token. The Token is the basic device information of the terminal device, which is mainly used to identify the user identity, authorize access rights or transmit security information. It is a string of characters generated by the server as a token for the terminal device to make a request. The basic device information can be one or more of the device code, operating system information, and network environment information of the terminal device.

[0093] In one embodiment of the present disclosure, in step two, the device environment detection is performed on the terminal device based on the Token information, including: calculating the device environment score of the terminal device based on the Token information; wherein the device environment score includes one or more of a network environment score, a device system information score, and a device usage information score; and determining whether the device environment detection passes according to the device environment score.

[0094] Specifically, the device environment may be measured by comprehensively using one or more of the network environment, device system information, and device usage information to obtain a current device environment score.

[0095] Network environment score: Analyze whether the current user's network environment is normal through network environment features such as IP information, Refer ID, request UA analysis, CDN ID, proxy information, etc., and make corresponding scores.

[0096] Device system information scoring: Detect whether the device system is rooted, whether it is a simulator, whether it is a cloud real machine, whether the device information has been tampered with, whether there is a modifier, whether a script tool is detected, whether a machine modification tool is detected, whether a SIM card is inserted, etc., and score based on the detection results.

[0097] Device usage information score: The corresponding score is calculated based on the number of times the device has been risk-controlled within 30 days, whether the device's reported IP address is stable (IP province per natural day <= 3), whether it is an overseas IP address, etc.

[0098] In one embodiment of the present disclosure, after the device environment detection passes, the trusted device detection is performed on the terminal device based on the Token information in step three, including: determining the account associated with the terminal device based on the Token information; when the number of associated accounts does not exceed the account threshold, obtaining the historical behavior information corresponding to the associated account; when the terminal device is determined to be a trusted device based on the historical behavior information, determining that the trusted device detection passes. The method also includes: when the number of associated accounts exceeds the account threshold, or when the terminal device is determined to be an untrusted device based on the historical behavior information, determining that the trusted device detection fails.

[0099] In addition, after determining that the trusted device has passed the detection, the method further includes: determining the trust level of the terminal device according to the historical behavior information and a preset trusted device rule engine.

[0100] Specifically, Figure 4 The following is a schematic diagram schematically showing a trusted device detection method in an exemplary embodiment of the present disclosure. Figure 4 As shown in the figure, the specific process of trusted device detection is as follows:

[0101] First, the Token information (such as the device code) is used to associate with the most commonly used associated account of the terminal device, and then the number of associated accounts is counted. If the number of associated accounts is greater than the preset account threshold X, the result is true, and it is judged that too many accounts have logged in to the terminal device, and it cannot be used as a trusted device; if the number of associated accounts is ≤X, the result is false, and the historical behavior of the associated account on the terminal device can be obtained. According to the historical behavior of the account on this device, it is determined whether it can become a trusted device. If the judgment result is true, the trusted device is then rated AF. If the judgment result is false, it cannot be used as a trusted device, and there is no need to perform a further rating.

[0102] So, how to associate the user account through the terminal device? When the user is active, the user's active device information will be recorded. Through this information, we can get which accounts are commonly used by a certain device, thus generating an association between the device and the account.

[0103] Secondly, how to determine whether it can become a trusted device for users and determine the trust level? When the device is associated with a user, some sensitive behaviors of the user on this device are used to determine whether the device is a trusted device and what its trust level is. Specific sensitive behaviors refer to: the user has performed real-name authentication, face recognition, one-click login, large-amount payment, etc. on this device, or the user has been active on only this one device for many years.

[0104] What are the criteria for assessing the trust level? The trusted device rule engine calculates which sensitive behaviors a certain account has performed on this device. The more sensitive behaviors there are, the higher the trust level. Accordingly, the trust level of the terminal device can be determined based on the sensitive behaviors in the historical behavior information and the preset trusted device rule engine.

[0105] In one embodiment of the present disclosure, the method further includes: adjusting the trust level based on the device environment score obtained by device environment detection. That is, the trust level of the current device can also be comprehensively adjusted in combination with the score of the device environment detection.

[0106] In one embodiment of the present disclosure, in step S302, when the security device service detection is passed, a security device credential with a preset validity period can be generated based on the device code information, associated account, and trust level of the terminal device, and then returned to the terminal device.

[0107] Specifically, when the device passes the overall process of user security device verification (environment detection + trusted device detection), a security device certificate with a preset validity period can be issued to the terminal device. The certificate contains device coding information, associated account information, device trust level information, and validity period. The ciphertext is then obtained after DES encryption. During the validity period, this certificate can be used to complete business scenario operations covered by the corresponding trust level. The certificate obtained through a detection process can only be used once (similar to SMS verification, it will become invalid after verification).

[0108] Figure 5 The flowchart of another operation verification method in the exemplary embodiment of the present disclosure is schematically shown. Figure 5 As shown, the operation verification method is applied to the business interface, specifically including steps S501 to S502:

[0109] S501, receiving a security device credential and a service operation request sent by a terminal device;

[0110] S502: Verify the security device credential based on the security device service, and execute the business operation request after the verification passes.

[0111] Specifically, in step S502, where the security device credential includes one or more of the device coding information of the terminal device, an associated account, a trust level and a credential validity period, then the verification of the security device credential based on the security device service includes: verifying whether the security device credential is reliable in the security device service according to the device coding information, the associated account and the trust level; and verifying whether the security device credential is valid according to the credential validity period; and determining that the security device credential verification has passed when the security device credential is reliable in the security device service and the security device credential is valid.

[0112] Specifically, after receiving the security device credential, the business interface performs verification. First, it needs to verify whether the security device credential is reliable in the security device service, and second, it needs to verify whether the security device credential is still within the validity period. If both tests pass, then the security device credential is deemed to have passed the verification, and the corresponding business operation request is executed through the business interface, and finally the execution result is transmitted to the terminal device.

[0113] Figure 6The following is a schematic diagram showing the data flow of an operation verification method in an exemplary embodiment of the present disclosure. Figure 6 As shown in the figure, when performing operation verification, it is mainly divided into the following five processes:

[0114] 1. "Initiate Verification":

[0115] 1.1: Encrypt the device's own "device code, operating system information, network environment, etc." into Yidun token and transmit it to the security device service;

[0116] 1.2: Decrypt the Yidun token to obtain the current device operating system information, device code and other information;

[0117] 1.3: If the information is successfully obtained, proceed to the next step;

[0118] 2. Equipment Environment Monitoring:

[0119] 2.1: Analyze whether there are risks in the device operating system information;

[0120] 2.2: Analyze whether there are risks in the equipment network environment;

[0121] 2.3: After scoring, if the equipment environment test passes, proceed to the next step;

[0122] 3. Trusted Device Detection:

[0123] 3.1: Analyze the users who have been active on the device and associate the device with a certain user;

[0124] 3.2: Calculate the trust level AF of the device based on some historical behaviors of the user on this device;

[0125] 3.3: If the device meets the assessment criteria and has the corresponding trust level, proceed to the next step;

[0126] 4.《Issuance of User Security Device Credentials》:

[0127] 4.1: If the environment is safe and the equipment is trustworthy, user safety equipment verification is satisfied;

[0128] 4.2: Encrypt and generate secure device credentials based on the device’s code and trust level;

[0129] 4.3: Issue the user security device credentials to the client;

[0130] 5. Business scenario application:

[0131] 5.1: Based on the equipment security level assessed in step 4, determine which business scenarios can be verified;

[0132] 5.2: Transmit the security device credentials to the corresponding target business interface;

[0133] 5.3: Verify whether the credentials are reliable;

[0134] 5.4: After the credential verification is passed, the corresponding business operations are performed, such as logging in, changing the mobile phone number, etc., and the execution results are returned.

[0135] Figure 7 A schematic diagram schematically illustrates an operation verification comparison in an exemplary embodiment of the present disclosure. Figure 7 As shown: In the prior art, when a user logs in to the APP, a verification code is required to log in, and the steps include obtaining the verification code → sending the verification code → checking the verification code → entering the verification code → logging in. The verification process requires a total of four steps to complete the login; while using the operation verification method in the present application, when logging in, you only need to complete the verification of the security device, and you can log in automatically after the verification is successful, eliminating the intermediate verification code interaction process, simplifying the login process, allowing users to log in without feeling, and the operation is easier.

[0136] Based on the above method, the automatic verification mechanism of "user security device verification" replaces traditional verification methods such as face and SMS, which has the following three technical effects:

[0137] 1. Better user experience

[0138] Under the premise of ensuring security, the user operation link can be shortened, and the user experience has been greatly improved. Many operations that originally needed to be completed manually have become a silent verification method. For example, automatic login through security device verification, as long as the device belongs to a certain user's security device, the user does not need to do anything, and the automatic login can be successful, realizing user-free login.

[0139] 2. Systematic process has a higher success rate

[0140] A silent verification method based on "environment + equipment". Compared with SMS, face and other verification methods, it eliminates many process interfaces and steps, simplifies the overall process, and significantly improves the success rate of the system process.

[0141] 3. Reduced operating costs

[0142] The original verification based on SMS, face recognition and other means required corresponding operator fees for each verification. When using user security equipment for verification, these costs can be greatly reduced.

[0143] Figure 8 The following is a schematic diagram showing the composition of an operation verification device in an exemplary embodiment of the present disclosure. Figure 8As shown, the operation verification device 800 may include a response module 801, a detection module 802 and a sending module 803. Among them:

[0144] A response module 801 is used for the terminal device to send a security device service detection request to the security device service in response to the service operation request;

[0145] A detection module 802 is used to obtain the security device credential returned by the security device service after the security device service performs a security device service detection on the terminal device and passes the detection;

[0146] The sending module 803 is used to send the security device credential to the business interface corresponding to the business operation request when it is determined that the verification request corresponding to the business operation request is feasible based on the security device credential, so as to execute the business operation request after the business interface verifies the security device credential.

[0147] According to an exemplary embodiment of the present disclosure, the response module 801 is also used to extract basic device information of the terminal device; the basic device information includes one or more of the device code, operating system information, and network environment information of the terminal device; the basic device information is encrypted to obtain Token information; and the security device service detection request is generated based on the Token information.

[0148] According to an exemplary embodiment of the present disclosure, the security device credential includes the trust level of the terminal device, and the sending module 803 is also used to determine whether the security device credential can replace the verification request according to the trust level based on a preset trusted device rule engine; when the security device credential can replace the verification request, it is determined that the verification request corresponding to the business operation request is feasible.

[0149] The specific details of each module in the above-mentioned operation verification device 800 have been described in detail in the corresponding operation verification method, so they will not be repeated here.

[0150] Fig. 9 A schematic diagram schematically shows the composition of another operation verification device in an exemplary embodiment of the present disclosure, such as Fig. 9 As shown, the operation verification device 900 may include a response module 901, a detection module 902 and a sending module 903. Among them:

[0151] The request receiving module 901 is used to receive a security device service detection request sent by a terminal device;

[0152] A service detection module 902 is used to perform a security device service detection on the terminal device and generate a security device credential after the detection passes;

[0153] The credential returning module 903 is used to return the security device credential to the terminal device.

[0154] According to an exemplary embodiment of the present disclosure, the service detection module 902 is also used to determine the account associated with the terminal device based on the Token information; when the number of associated accounts does not exceed an account threshold, obtain historical behavior information corresponding to the associated account; when the terminal device is determined to be a trusted device based on the historical behavior information, determine that the trusted device detection has passed.

[0155] According to an exemplary embodiment of the present disclosure, the service detection module 902 is further configured to determine the trust level of the terminal device according to the historical behavior information and a preset trusted device rule engine after determining that the trusted device detection has passed.

[0156] According to an exemplary embodiment of the present disclosure, the service detection module 902 is further used to generate a secure device credential with a preset validity period based on the device encoding information, associated account, and trust level of the terminal device.

[0157] The specific details of each module in the above-mentioned operation verification device 900 have been described in detail in the corresponding operation verification method, so they will not be repeated here.

[0158] Fig.10 A schematic diagram schematically shows the composition of another operation verification device in an exemplary embodiment of the present disclosure, such as Fig.10 As shown, the operation verification device 1000 may include a credential receiving module 1001 and an operation execution module 1002. Among them:

[0159] The credential receiving module 1001 is used to receive the security device credential and service operation request sent by the terminal device;

[0160] The operation execution module 1002 is used to verify the security device credential based on the security device service and execute the business operation request after the verification passes.

[0161] According to an exemplary embodiment of the present disclosure, the security device credential includes one or more of the device coding information, associated account, trust level and credential validity period of the terminal device, and the operation execution module 1002 is also used to verify whether the security device credential is reliable in the security device service according to the device coding information, associated account and trust level; and to verify whether the security device credential is valid according to the credential validity period; when the security device credential is reliable in the security device service and the security device credential is valid, it is determined that the security device credential verification has passed.

[0162] The specific details of each module in the above-mentioned operation verification device 1000 have been described in detail in the corresponding operation verification method, so they will not be repeated here.

[0163] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0164] In an exemplary embodiment of the present disclosure, a storage medium capable of implementing the above method is also provided. Fig.11 A schematic diagram schematically illustrates a computer-readable storage medium in an exemplary embodiment of the present disclosure, such as Fig.11 As shown, a program product 1100 for implementing the above method according to an embodiment of the present disclosure is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a mobile phone. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0165] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided. Fig.12 The structure diagram of a computer system of an electronic device in an exemplary embodiment of the present disclosure is schematically shown.

[0166] It should be noted that Fig.12 The computer system 1200 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0167] like Fig.12As shown, the computer system 1200 includes a central processing unit (CPU) 1201, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1202 or the program loaded from the storage part 1208 to the random access memory (RAM) 1203. Various programs and data required for system operation are also stored in the RAM 1203. The CPU 1201, the ROM 1202 and the RAM 1203 are connected to each other through a bus 1204. An input / output (I / O) interface 1205 is also connected to the bus 1204.

[0168] The following components are connected to the I / O interface 1205: an input section 1206 including a keyboard, a mouse, etc.; an output section 1207 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the I / O interface 1205 as needed. A removable medium 1211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1210 as needed so that a computer program read therefrom is installed into the storage section 1208 as needed.

[0169] In particular, according to an embodiment of the present disclosure, the process described below with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part 1209, and / or installed from a removable medium 1211. When the computer program is executed by a central processing unit (CPU) 1201, various functions defined in the system of the present disclosure are executed.

[0170] It should be noted that the computer-readable medium shown in the embodiment of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0171] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0172] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0173] As another aspect, the present disclosure further provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0174] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0175] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0176] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure.

[0177] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An operation verification method, characterized in that: Applied to terminal equipment, including: The terminal device sends a security device service detection request to the security device service in response to the service operation request; After the secure device service performs a secure device service detection on the terminal device and the terminal device passes the detection, obtaining the secure device credential returned by the secure device service; When it is determined according to the security device credential that the verification request corresponding to the business operation request is feasible, the security device credential is sent to the business interface corresponding to the business operation request, so as to execute the business operation request after the business interface verifies the security device credential.

2. The operation verification method according to claim 1, characterized in that: The security device credential includes the trust level of the terminal device, and the method further includes: Determining, based on a preset trusted device rule engine, whether the security device credential can replace the verification request according to the trust level; When the security device credential can replace the verification request, it is determined that the verification request corresponding to the business operation request is achievable.

3. An operation verification method, characterized in that: Applied to security equipment services, including: Receiving a security device service detection request sent by a terminal device; Performing a security device service test on the terminal device and generating a security device credential after the test passes; The secure device credential is returned to the terminal device.

4. The operation verification method according to claim 3, characterized in that: The security device service detection includes device environment detection and trusted device detection, and the security device service detection on the terminal device includes: Extract the Token information of the terminal device in the security device service detection request; Performing the device environment detection on the terminal device based on the Token information; After the device environment detection is passed, the trusted device detection is performed on the terminal device based on the Token information.

5. An operation verification method, characterized in that: Applied to business interfaces, including: Receive security device credentials and business operation requests sent by terminal devices; The security device credential is verified based on the security device service, and the business operation request is executed after the verification passes.

6. An operation verification device, characterized in that: Applied to terminal equipment, including: A response module, used for the terminal device to respond to the business operation request and send a security device service detection request to the security device service; A detection module, configured to obtain a security device credential returned by the security device service after the security device service performs a security device service detection on the terminal device and passes the detection; A sending module is used to send the security device credential to the business interface corresponding to the business operation request when it is determined that the verification request corresponding to the business operation request is feasible based on the security device credential, so as to execute the business operation request after the business interface verifies the security device credential.

7. An operation verification device, characterized in that: Applied to security equipment services, including: A request receiving module, used to receive a security device service detection request sent by a terminal device; A service detection module, used to perform a security device service detection on the terminal device and generate a security device credential after the detection passes; The credential returning module is used to return the security device credential to the terminal device.

8. An operation verification device, characterized in that: Applied to business interfaces, including: The credential receiving module is used to receive the security device credentials and business operation requests sent by the terminal device; The operation execution module is used to verify the security device credential based on the security device service and execute the business operation request after the verification passes.

9. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the operation verification method according to any one of claims 1 to 5 is implemented.

10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the operation verification method as described in any one of claims 1 to 5.

Images