Identity verification method and device, equipment, storage medium and program product

Abstract

The invention discloses an identity authentication method and device, equipment, a storage medium and a program product, which are used for fully utilizing the performance of different identity authentication modes, improving the accuracy and efficiency of identity authentication and reducing resource consumption. The identity authentication method comprises the following steps: determining the intention of a user, user information and a first identity authentication record based on an access request submitted by the user through a first access platform; based on the first access platform, the user information and the intention, determining a first verification mode combination suitable for the user from a plurality of verification mode combinations; based on the first verification mode combination and the first identity verification record, determining whether to perform identity verification on the user; and if it is determined that identity verification is performed on the user, performing identity verification on the user based on the first verification mode combination.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to an identity authentication method, device, equipment, storage medium and program product. Background Art

[0002] Identity verification is an important means to achieve secure communication. By verifying the identity of the user, unauthorized access can be effectively prevented, and user data and system security can be protected. With the rapid development of Internet technology, various identity verification methods have emerged in an endless stream. The choice of identity verification method for identity verification often depends on the specific needs of the applicant or end user, resulting in the inability to guarantee the accuracy of identity verification. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide an identity authentication method, apparatus, device, storage medium and program product for making full use of the performance of different identity authentication methods, improving the accuracy and efficiency of identity authentication, and reducing resource consumption.

[0004] In order to achieve the above objectives, the present application embodiment adopts the following technical solutions: In a first aspect, an embodiment of the present application provides an identity authentication method, including: Determining the user's intention, user information, and first identity authentication record based on an access request submitted by the user through the first access platform; Determining, based on the first access platform, the user information, and the intention, a first verification method combination applicable to the user from a plurality of verification method combinations; Determining whether to authenticate the user based on the first authentication method combination and the first identity authentication record; If it is determined to authenticate the user, the user's identity is authenticated based on the first authentication method combination.

[0005] In a second aspect, an embodiment of the present application provides an identity authentication device, including: A determination module, configured to determine the user's intention, user information, and first identity authentication record based on an access request submitted by the user through the first access platform; The determination module is further configured to determine, based on the first access platform, the user information and the intention, a first verification method combination applicable to the user from a plurality of verification method combinations; A decision module, configured to determine whether to authenticate the user based on the first authentication method combination and the first identity authentication record; The verification module is used to, if it is determined that the identity of the user is to be verified, verify the identity of the user based on the first verification method combination.

[0006] In a third aspect, an embodiment of the present application provides an electronic device, including: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the identity authentication method provided in the first aspect.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can perform the identity authentication method provided in the first aspect.

[0008] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute part or all of the steps in the identity authentication method provided in the first aspect.

[0009] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: Since different users have different risks when accessing the business system with different intentions, and different access platforms have unique business characteristics, the first verification method combination determined based on the first access platform, user information and intention can better adapt to the risks of this access request, and the first verification method combination includes at least two verification methods. Compared with the isolated selection of a single verification method, it can give full play to the role of different verification methods, which is helpful to more accurately authenticate the user's identity, improve the verification accuracy, and thus improve access security; secondly, the first identity authentication record describes the user's identity authentication situation before, such as whether the user has been authenticated, whether the identity authentication is successful, and the verification method used for the user's identity authentication. Based on the first identity authentication record and the first verification method combination, it can be determined whether the user has risks and whether the verification method in the first verification method combination is valid, and then it can be determined whether it is necessary to authenticate the user this time. In the case of determining to authenticate the user, the user is authenticated based on the first verification method combination. In this way, the integration and data interconnection between the originally discrete verification methods can be realized, avoiding the problems of reduced user experience and excessive resource consumption caused by unnecessary identity authentication, improving resource utilization, and helping to respond to user access requests in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A schematic diagram of an implementation environment applicable to the identity authentication method provided in an embodiment of the present application; Figure 2 A flowchart of an identity authentication method provided for an embodiment of the present application; Figure 3 A flowchart of an identity authentication method provided for another embodiment of the present application; Figure 4 A schematic diagram of the structure of an identity verification device provided for one embodiment of the present application; Figure 5 A schematic diagram of the structure of an electronic device provided for one embodiment of the present application. DETAILED DESCRIPTION

[0011] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0012] The terms "first", "second", etc. in this specification and claims are used to distinguish similar objects, and are not used to describe a particular order or precedence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein. In addition, "and / or" in this specification and claims means at least one of the connected objects, and the character " / " generally means that the objects associated with each other are in an "or" relationship.

[0013] It should be understood that the identity authentication method provided in the embodiment of the present application can be performed by an electronic device. The electronic device referred to here may include a terminal device, such as a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent voice interaction device, a smart home appliance, a smart watch, a vehicle terminal, an aircraft, etc.; or, the electronic device may also include a server, such as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0014] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0015] In order to facilitate the understanding of the technical solution provided in the embodiments of the present application, firstly Figure 1 , the implementation environment applicable to the technical solution provided in the embodiment of the present application is described. It should be understood that the technical solution provided in the embodiment of the present application is applicable to Figure 1 The implementation environment shown is only an exemplary description and should not be understood as a limitation on the implementation environment to which the technical solution is applicable.

[0016] like Figure 1 As shown, an implementation environment applicable to the technical solution provided in the embodiment of the present application includes: multiple access platforms and business systems.

[0017] The access platform provides services for accessing business systems. The above-mentioned multiple access platforms may include, but are not limited to, online customer service systems (Instant Messaging Assistant, IMA), customer service hotline systems, intelligent customer service systems, etc. Users can access business systems through any access platform and submit their access purposes and specific requirements. Once receiving the user's access request, the access platform will forward the access request to the business system for processing. The access request carries the user ID and text describing the requirements.

[0018] The business system includes a decision engine and a data processing module. After receiving an access request, the decision engine immediately starts the data retrieval process, obtains the user information and the first identity authentication record based on the user ID carried in the access request, and provides reliable data support for subsequent identity authentication decisions.

[0019] The decision engine also performs intent recognition based on the text describing the requirements carried in the access request to obtain the user's intent, and makes a decision based on the user's user information, intent, the access platform that receives the access request, and the first identity authentication record to determine whether to authenticate the user and the first authentication method combination applicable to the user. Among them, the first authentication method combination includes at least two of the following authentication methods: face authentication, lip verification, three-factor (face, name, ID card) verification, auxiliary question verification, 5G video verification, dial pad verification, etc. If it is determined that the user's identity is authenticated, the first authentication method is recommended to the customer service, and the authentication method selected by the customer service is pushed to the access platform that receives the access request, so as to complete the user's identity authentication through the access platform to ensure seamless connection of the process. Finally, the access platform displays / synchronizes the identity authentication results.

[0020] The data processing module also generates the authentication record of this authentication based on the relevant information used in the user's identity authentication process (such as the first authentication method combination, the authentication method selected by the customer service, the authentication process data, etc.) and the verification results, and stores it in the database as a reference for future decision-making support data and risk assessment, realizing the effective recycling and management optimization of data, and is also conducive to the in-depth improvement of user portraits and the precise implementation of risk assessment. In practical applications, the verification process data can be obtained by the data processing module through monitoring or embedding. For example, taking lip reading verification as an example, the lip reading verification process is divided into four steps: sending a verification code, verifying the verification code, user lip reading verification, and processing the verification results. Listeners are added to each of the above steps to collect user process data, and / or embedding data is added to each of the above steps to report various system data, and the collected user process data and the reported various system data are grouped, cleaned and analyzed, and then packaged to obtain the verification process data.

[0021] Please refer to Figure 2 , is a flow chart of an identity authentication method provided by an embodiment of the present application, the method comprising the following steps: S202, determining the user's intention, user information, and a first identity authentication record based on an access request submitted by the user through the first access platform.

[0022] The first access platform is Figure 1 One of the multiple access platforms shown. The access request is used to request access to a service provided by the application server, such as a loan service, etc. The access request carries at least one of the following information: a user identifier (such as a user name, contact information, etc.) and a text entered by the user to indicate the user's needs, etc.

[0023] The intent indicates the user's motivation for accessing the service. As an example, the user's intent is determined based on the service requested by the access request. For example, if the service requested by the access request is the loan settlement service in advance, the user's intent is determined to be to settle the loan in advance. As another example, the natural language processing (NLP) technology is used to perform intent recognition on the user input text carried in the access request to obtain the user's intent. For example, the text carried in the access request is "My loan has been repaid, please help me issue a settlement certificate." The NLP technology is used to perform intent recognition on the text to obtain the user's intent of "issuing a settlement certificate."

[0024] User information is used to describe the detailed characteristics of the user, and may include, but is not limited to, basic information, portrait tags, access behavior, device information, etc. Among them, basic information includes entry statistical characteristics such as age, gender, and geographic location. Portrait tags are used to describe the user's portrait. For example, if the user is accustomed to credit consumption before settling the loan, the user's portrait tag is "first enjoy, then pay"; for another example, if the user likes to report problems through complaints, the user's portrait tag is "high-risk complaints". Access behavior includes the services that the user has visited in the past, the frequency of access to various services provided by the business system, etc. Device information includes the type of device used by the user, the operating system, browser preferences, etc. As an example, the user's user information is searched in the database based on the user identifier carried in the access request.

[0025] The first identity authentication record refers to a record of identity authentication of a user before the user submits an access request. The first identity authentication record may include, for example, but is not limited to, at least one of the following information: whether the user has been authenticated before the user submits this access request, whether the identity authentication is successful, a combination of authentication methods that have been recommended for the user, and the authentication method used to authenticate the user. As an example, the first identity authentication record of the user is searched in the database according to the user identifier carried in the access request.

[0026] S204: Determine a first verification method combination suitable for the user from a plurality of verification method combinations based on the first access platform, user information, and intention.

[0027] Each verification method combination includes at least two verification methods arranged in order. As an example, each verification method combination may include a preferred verification method, a secondary verification method, and an alternative verification method. Among them, the preferred verification method refers to the verification method at the first position. The secondary verification method refers to the verification method at the second position, which can be selected when the preferred verification method cannot be used or when the preferred verification method is subjectively denied by humans. The alternative verification method refers to the verification method at the third position, which can be selected when the preferred and secondary verification methods cannot be used, or when it is considered that the preferred and secondary verification methods are subjectively denied.

[0028] Since different users face different risks when accessing a business system with different intentions, and different access platforms have unique business characteristics, the first verification method combination determined based on the first access platform, user information and intention can better adapt to the risks of this access request. Moreover, the first verification method combination includes at least two verification methods. Compared with the isolated selection of a single verification method, the role of different verification methods can be fully utilized, which helps to more accurately authenticate users and improve the verification accuracy, thereby improving access security.

[0029] In the embodiment of the present application, the above S204 can be implemented in various ways, which is not limited in the embodiment of the present application.

[0030] In one implementation, the above S204 includes the following steps: S241, determining a first business scenario matching the intention from multiple business scenarios.

[0031] As an example, based on the preset correspondence between business scenarios and intents, the business scenario corresponding to the intent obtained through S202 above can be determined from multiple business scenarios as the first business scenario. For example, the business scenario corresponding to the intent of "issuing a certificate of settlement" is "certificate of settlement", the business scenario corresponding to the intent of "consulting about membership fees" is "membership fees", and the business scenario corresponding to the intent of "applying for early repayment" is "early settlement", etc.

[0032] As another example, for each business scenario, the text used to describe the business scenario is matched with the intent to obtain a match degree between the business scenario and the intent; from multiple business scenarios, a third business scenario whose match degree with the intent is greater than or equal to a first threshold is determined, and a fourth business scenario associated with the third business scenario is determined; the third business scenario and the fourth business scenario are determined as the first business scenario that matches the intent.

[0033] The association relationship between business scenarios can be preset according to actual needs. For example, the following Table 1 shows an example of an association relationship between business scenarios.

[0034] Table 1

[0035] Among them, the name and code of the business scenario are globally unique. The text describing the business scenario may include the name of the business scenario. The text describing the business scenario is matched with the intent, and various matching techniques commonly used in the art can be used, such as calculating the distance between the text and the intent, the semantic similarity, etc., which are not limited in the embodiments of the present application. The first threshold can be set according to actual needs, which are not limited in the embodiments of the present application.

[0036] For example, assuming that the intent is "I want to repay", by matching the intent with the text describing each business scenario, two third business scenarios are obtained: early settlement and partial early settlement. Based on the above Table 1, the fourth business scenario associated with the third business scenario "early settlement" includes "repayment of the scheduled payment", and then these business scenarios are determined as the first business scenarios that match the intent. The name, code and matching degree between each first business scenario and the intent are shown in Table 2 below.

[0037] Table 2

[0038] Taking into account that business scenarios are often related in real business, by taking the third business scenario with a high matching degree and the fourth business scenario associated with the third business scenario as the first business scenario matching the intention, and determining the first verification method combination on this basis, it can be ensured that the first verification method combination fully covers all relevant business scenarios, which is conducive to improving the accuracy of identity authentication.

[0039] As another example, for each business scenario, the text used to describe the business scenario is matched with the intent to obtain a first degree of match between the business scenario and the intent; based on the first degree of match between the business scenario and the intent and an interference factor of the business scenario, a second degree of match between the business scenario and the intent is obtained; from multiple business scenarios, a business scenario whose second degree of match with the intent is greater than or equal to a first threshold is determined as the first business scenario that matches the intent.

[0040] Among them, the interference factor of each business scenario can be simply understood as adding or subtracting points based on the first matching degree. The interference factor of each business scenario can be set according to actual needs, and the embodiments of the present application are not limited to this. For example, in order to guide users to repay the installment as much as possible, the interference factor of the business scenario "installment repayment" can be set to a large positive number, so that the second matching degree of the business scenario is higher, and it can be given priority when determining the first verification method combination.

[0041] S242: Based on the business scenarios and access platforms to which each verification method combination is applicable, determine at least one second verification method combination applicable to the first business scenario and the first access platform from multiple verification methods.

[0042] The business scenario applicable to each verification method combination is also referred to as the second business scenario, so as to distinguish it from the first business scenario in the previous text. The access platform applicable to each verification method combination is also referred to as the second access platform, so as to distinguish the scenario of submitting the access request. The second business scenario and the second access platform applicable to different verification method combinations are different, and the second business scenario and the second access platform applicable to each verification method can be pre-configured according to actual needs. Optionally, each verification method combination may also have other attributes, such as but not limited to at least one of the following attributes: name, code, risk level, first score, applicable user conditions, etc. Among them, the name and code are used to globally uniquely identify the verification method combination, the risk level indicates the risk level that the verification method combination can cope with, the first score indicates the recommended strength of the verification method level, and the applicable user conditions refer to the conditions that the user who applies to the verification method combination needs to meet. These attributes can be set according to actual needs, and the embodiments of the present application are not limited to this. In actual applications, in order to achieve fine-grained access security control, the risk level can be divided into six levels: high, medium-high, high, medium, medium-low and lowest, and the first score can be a value between 0 and 10.

[0043] For example, the following Table 3 shows an example of a verification method combination and its attributes.

[0044] Table 3

[0045] As an example, for each verification method combination, the business scenario to which the verification method combination applies is compared with the first business scenario, and the access platform to which the verification method combination applies is compared with the first access platform. If both comparisons are successful, the verification method combination is determined as the second verification method combination.

[0046] S243: Determine a first verification method combination applicable to the user from at least one second verification method combination based on the user information and the user condition applicable to each second verification method combination.

[0047] Different combinations of verification methods apply to different user conditions. For example, the above verification method combination 1 applies to user condition 1: the user is the user himself, the user is a real-name user, and the user's portrait label is "first enjoy, then pay"; or the user is the user himself, the current date is the user's repayment date, and the user's portrait label is "first enjoy, then pay"". Among them, the user himself means that the access request is issued by the user himself, and the non-user means that the access request is issued by someone else on behalf of the user.

[0048] As an example, for each second verification method combination, the user information is compared with the user condition applicable to the second verification method. If the user information meets the user condition, the second verification method combination is determined as the first verification method combination applicable to the user.

[0049] As another example, for each second verification method combination, the second score of the second verification method is determined based on the risk level of the second verification method combination and the first score; at least one second verification method combination is traversed in descending order of the second scores; if the user information meets the user conditions applicable to the traversed second verification method combination, the traversed second verification method combination is determined as a first verification method combination applicable to the user, and the traversal is stopped.

[0050] Exemplarily, the risk level of the second verification method combination can be mapped to a value within a preset value range, and the value is added to the first score to obtain the second score of the second verification method combination. The preset value range is the same as the value range of the first score.

[0051] Assume that there are 5 second verification method combinations, verification method combination 1 to verification method combination 5, and the second scores of these second verification methods are in the following order from high to low: verification method combination 1—> verification method combination 2—> verification method combination 3—> verification method combination 4—> verification method combination 5. If the user information meets the user conditions applicable to verification method 2 when traversing to verification method 2, verification method 2 will be regarded as the first verification method combination applicable to the user.

[0052] Since the higher the second score, the greater the probability that the second verification method combination is applicable to the user, determining the first verification method combination in the above manner can not only ensure that the determined first verification method is applicable to the user, but also avoid comparing the user information with all user conditions applicable to the second verification method combination as much as possible, thereby reducing the amount of calculation, improving the efficiency of determining the first verification method combination, and reducing the consumption of computing resources.

[0053] Since an intention may involve multiple business scenarios, each business scenario has unique business characteristics, and therefore different verification methods are applicable to each business scenario. In the above implementation, the first business scenario matching the intention is first determined, and then based on the first business scenario, the first access platform and user information, the first verification method combination applicable to the user is selected, which can ensure that the first verification method combination covers all relevant business scenarios, which is conducive to improving the accuracy of identity authentication.

[0054] In another implementation, each verification method combination is configured with applicable intent, access platform, and user conditions. In this case, the above S204 includes the following steps: for each verification method combination, the business scenario applicable to the verification method combination is compared with the first business scenario, the intent applicable to the verification method combination is compared with the intent determined by the above S202, and the user condition applicable to the verification method combination is compared with the user information of the user. If all the comparisons are successful, the verification method combination is determined as the first verification method combination applicable to the user.

[0055] The embodiment of the present application shows a partial implementation of the above S204. Of course, it should be understood that the above S204 can also be implemented in other ways, which are not limited in the embodiment of the present application.

[0056] S206: Determine whether to authenticate the user based on the first authentication method combination and the first identity authentication record.

[0057] As mentioned above, the first identity authentication record describes whether the user has been authenticated before, the result of the identity authentication, and the authentication method used. Based on this information and the combination of the first authentication method, it can be determined whether the user is at risk and whether the authentication method in the first authentication method combination is valid, and then it can be determined whether it is necessary to authenticate the user this time. In this way, the integration and data interconnection between the originally discrete authentication methods can be achieved, avoiding problems such as reduced user experience and excessive resource consumption caused by unnecessary identity authentication, improving resource utilization, and helping to respond to user access requests in a timely manner.

[0058] In one implementation, the above S206 includes the following steps: S261, determining whether there is a second identity authentication record that has been successfully authenticated in the first identity authentication record.

[0059] In practical applications, the number of first identity authentication records may be one or more. For each first identity authentication record, if the first identity authentication record indicates that the user has been authenticated in the past and the result of the identity authentication is successful, the first identity authentication record is determined as the second identity authentication record.

[0060] S262: If the second identity authentication record exists in the first identity authentication record, query whether the second identity authentication record exists a third authentication method combination, and determine whether to authenticate the user based on the query result and the first authentication method combination.

[0061] The third verification method combination is a verification method combination recommended for the user and used to authenticate the user before the first verification method combination is determined. For example, if the verification method combination shown in Table 3 above was recommended for the user, and at least one of the verification methods was used to authenticate the user, then the verification method combination is determined as the third verification method combination. If the verification method combination shown in Table 3 above was recommended for the user, but the verification method ultimately used to authenticate the user was auxiliary question verification, then it is determined that the third verification method combination does not exist in the second identity authentication record.

[0062] If there is a third verification method combination in the second identity authentication record, it means that the verification method combination recommended for the user was used to authenticate the user and the authentication was successful, and then based on the risk level of the third verification method combination and the risk level of the first verification method combination, it is determined whether to authenticate the user.

[0063] For example, considering that the verification method combination with a high risk level is more stringent and more reliable than the verification method with a low risk level, when the verification method combination with a high risk level has successfully verified the user, the verification method combination with a low risk level will usually also successfully verify the user. At this time, there is no need to authenticate the user again, thereby avoiding unnecessary identity authentication and other problems such as reduced user experience and excessive resource consumption. Based on this, if there is a third verification method combination in the second identity authentication record, and the risk level of the third verification method combination is greater than or equal to the risk level of the first verification method combination, it means that the user has been successfully authenticated by the verification method with a high risk level. In this case, there is no need to authenticate the user using the first verification method combination with a low risk level, and it is determined that the user will not be authenticated.

[0064] In addition, if a combination of authentication methods with a low risk level successfully authenticates a user, there may be two situations: the first situation is that the combination of authentication methods is too loose, resulting in the risk user being judged as a normal user; the second situation is that the user is indeed a normal user. In this case, it is necessary to use a combination of authentication methods with a high risk level to authenticate the user again to determine whether the user is a risk user. Based on this, if there is a third authentication method combination in the second authentication record, and the risk level of the third authentication method combination is lower than the risk level of the first authentication method combination, it means that the user has only been successfully authenticated by a low-risk authentication method, and it is not possible to accurately determine whether the user is a risk user, and then determine to authenticate the user.

[0065] If the third verification method combination does not exist in the second identity authentication record, it means that the verification method combination recommended for the user was not used to authenticate the user, but other verification methods were used to authenticate the user and the verification was successful, and then the first verification method used to authenticate the user is obtained from the second identity authentication record, and based on the first verification method and the first verification method combination, it is determined whether to authenticate the user.

[0066] Exemplarily, the first verification method includes multiple second verification methods arranged in sequence. Considering that the second verification method at the first position is more stringent and reliable than other second verification methods, if the user has been successfully authenticated using the second verification method at the first position, there is no need to authenticate the user using the second verification method again, and the result of authenticating the user using other second verification methods is usually successful, thereby avoiding unnecessary authentication that causes problems such as decreased user experience and excessive resource consumption. Based on this, after obtaining the first verification method used to authenticate the user from the second authentication record, if the first verification method is the same as the second verification method at the first position in the first authentication method combination, it is determined that the user is not authenticated.

[0067] In actual applications, the number of first verification methods may be one or more, so the first verification method is the same as the second verification method in the first place, including the following situations: Situation 1, the first verification method is only the same as the second verification method in the first place; Situation 2, the first verification method includes not only the second verification method in the first place, but also includes at least one other second verification method, for example, the first verification method includes the preferred second verification method and the second preferred second verification method, or, the first verification method includes the preferred second verification method and the alternative second verification method, etc.

[0068] In addition, considering that the verification method combination has not been successfully recommended, and the second verification method in the first position has not been used to successfully verify the user, there may be two situations: the first situation is that the first verification method used is too loose, resulting in the risk user being mistakenly judged as a normal user; the second situation is that the user is indeed a normal user. Therefore, in this case, it is necessary to use the first verification method combination to authenticate the user again to determine whether the user is a normal user. Based on this, after obtaining the first verification method used to authenticate the user from the second verification method record, if the first verification method is different from the second verification method in the first position in the first verification method combination, it is determined that the user is authenticated; or, if the first verification method is different from each second verification method in the first verification method combination, it is determined that the user is authenticated.

[0069] S263: If the second identity authentication record does not exist in the first identity authentication record, authenticate the user.

[0070] If the second identity authentication record does not exist in the first identity authentication record, there are two situations: the first situation is that the user has not been authenticated before; the second situation is that the user's identity authentication has failed before. In either case, the user needs to be authenticated this time to improve access security.

[0071] It is worth noting that in actual applications, there may be a situation where the first authentication method combination is not determined. In this case, it can be determined that the user's identity verification is not performed.

[0072] The embodiment of the present application shows some implementation methods of the above S206. Of course, it should be understood that the above S206 can also be implemented in other ways, and the embodiment of the present application does not limit this. For example, in some other implementations, regardless of whether there is a second identity authentication record of successful authentication in the first identity authentication record, as long as the combination of authentication methods used for the user is different from the combination of the first authentication methods, it is determined that the user is authenticated.

[0073] S208: If it is determined to authenticate the user, authenticate the user based on the authentication method in the first authentication method combination.

[0074] In one embodiment, the user's identity can be authenticated using the verification methods in the first verification method combination in sequence. If the verification results of more than half of the verification methods are successful, the final verification result is determined to be a verification failure; otherwise, the final verification result is determined to be a verification success.

[0075] In another embodiment, the second verification methods in the first verification method combination are traversed in the order of the second verification methods in the first verification method combination; the user's identity is authenticated using the traversed second verification method, and if the verification result is a successful verification, the traversal is stopped; if the verification result is a failed verification, the next second verification method is continued to be traversed. If the verification result of the second verification method at the last position is a failed verification, the final verification result is determined to be a failed verification.

[0076] In another embodiment, a first verification method combination is recommended to customer service; a third verification method selected by the customer service is determined from multiple second verification methods included in the first verification method combination; a link to the third verification method is displayed to the user through the first access platform; and in response to a triggering operation on the link, the user's identity is authenticated based on the third verification method.

[0077] Exemplarily, a user accesses a business system through an online customer service system. After the business system determines the first identity authentication method combination and determines to authenticate the user through the above S202~S206, the first authentication method combination is displayed to the customer service work platform for the customer service to select. After the customer service selects, a corresponding link is generated based on the third authentication method selected by the user and displayed to the online customer service system. In response to the user's triggering operation on the link, the user is authenticated using the third authentication method. If the authentication is successful, the user is allowed to access the business system; if the authentication fails, the user's access request is rejected.

[0078] Through the above implementation method, the autonomous decision-making of identity authentication and the coordination between the first access platform, business system and customer service work platform are improved, which is conducive to improving the efficiency of the entire business process and the smoothness and convenience of user experience.

[0079] One or more embodiments of the present application provide an identity authentication method. Since different users have different risks when accessing a business system with different intentions, and different access platforms have unique business characteristics, the first verification method combination determined based on the first access platform, user information and intention can better adapt to the risks of this access request. In addition, the first verification method combination includes at least two verification methods. Compared with the isolated selection of a single verification method, the role of different verification methods can be fully utilized, which helps to more accurately authenticate the user and improve the verification accuracy, thereby improving access security. Secondly, the first identity authentication record describes the user's identity authentication before, such as whether the user has been authenticated, whether the identity authentication is successful, and the verification method used for the user's identity authentication. Based on the first identity authentication record and the first verification method combination, it can be determined whether the user is at risk and whether the verification method in the first verification method combination is valid, etc., and then it can be determined whether it is necessary to authenticate the user this time. When it is determined that the user is authenticated, the user is authenticated based on the first verification method combination. In this way, the integration and data interconnection between the originally discrete verification methods can be achieved, avoiding unnecessary identity authentication that leads to a decline in user experience and excessive resource consumption, improving resource utilization, and helping to respond to user access requests in a timely manner.

[0080] In order to facilitate the understanding of the identity authentication method provided in the embodiment of the present application, a specific application scenario is used for explanation below.

[0081] The user accesses the business system through the IMA system. The IMA system assigns an idle customer service to the user and provides a window conversation window between the customer service and the user for the customer service to provide services to the user. At this time, the customer service will ask the user's purpose. After the user expresses the intention, the IMA system will determine the first business scenario that matches the intention, and push the first business scenario to the customer service work platform, and the customer service will confirm the first work scenario and whether it is the user himself. After the customer service confirms, the IMA system will combine its own characteristics, the user's intention and the user's user information to determine the first verification method combination applicable to the user from multiple verification method combinations, and determine whether to authenticate the user based on the first verification method combination and the first identity authentication record; if it is determined to authenticate the user, the first identity authentication method will be pushed to the customer service work platform for the user to choose. After the customer service selects, according to the third verification method selected by the customer service, a corresponding link is generated, and the link is displayed in the conversation window with the user. In response to the triggering operation of the link, the IMA system authenticates the user using the third verification method and displays the identity authentication result.

[0082] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0083] Based on the same inventive concept, the present application also provides an identity authentication device. Figure 4 , is a schematic diagram of the structure of an identity authentication device provided by an embodiment of the present application. Figure 4 As shown, in a software implementation, the identity authentication device 400 includes: a determination module 410 , a decision module 420 and a verification module 430 .

[0084] The determination module 410 is used to determine the user's intention, user information and first identity authentication record based on the access request submitted by the user through the first access platform.

[0085] The determination module 410 is further configured to determine a first verification method combination applicable to the user from a plurality of verification method combinations based on the first access platform, the user information and the intention.

[0086] The decision module 420 is used to determine whether to authenticate the user based on the first authentication method combination and the first identity authentication record.

[0087] The verification module 430 is configured to, if it is determined that the identity of the user is to be verified, verify the identity of the user based on the first verification method combination.

[0088] In another embodiment, the determining module is used to: Determining a first business scenario matching the intention from among multiple business scenarios; Based on the business scenarios and access platforms to which each verification method combination is applicable, determining at least one second verification method combination applicable to the first business scenario and the first access platform from the multiple verification method combinations; Based on the user information and the user condition applicable to each second verification method combination, a first verification method combination applicable to the user is determined from the at least one second verification method combination.

[0089] In another embodiment, when the determination module determines a first business scenario matching the intention from multiple business scenarios, the determination module performs the following steps: For each business scenario, matching the text used to describe the business scenario with the intent to obtain a matching degree between the business scenario and the intent; determining, from the multiple business scenarios, a third business scenario whose matching degree with the intent is greater than or equal to a first threshold, and determining a fourth business scenario associated with the third business scenario; The third business scenario and the fourth business scenario are determined as first business scenarios matching the intention.

[0090] In another embodiment, the determination module performs the following steps when determining the first verification method combination applicable to the user from the at least one second verification method combination based on the user information and the user condition applicable to each second verification method combination: For each second verification method combination, determining a second score of the second verification method based on the risk level of the second verification method combination and the first score; Traversing the at least one second verification method combination in descending order of the second scores; If the user information meets the user condition applicable to the traversed second verification method combination, the traversed second verification method combination is determined as the first verification method combination applicable to the user, and the traversal is stopped.

[0091] In another embodiment, the decision module is used to: Determining whether there is a second identity authentication record that has been successfully authenticated in the first identity authentication record; If the second identity authentication record exists in the first identity authentication record, query whether there is a third authentication method combination in the second identity authentication record, and determine whether to authenticate the user based on the query result and the first authentication method combination; wherein the third authentication method combination is a authentication method combination recommended for the user and used for authenticating the user before determining the first authentication method combination; If the second identity authentication record does not exist in the first identity authentication record, it is determined to authenticate the user.

[0092] In another embodiment, the decision module performs the following steps when determining whether to authenticate the user based on the query result and the combination of the first authentication method: If the third authentication method combination exists in the second authentication record and the risk level of the third authentication method combination is lower than the risk level of the first authentication method combination, it is determined to authenticate the user.

[0093] In another embodiment, the decision module performs the following steps when determining whether to authenticate the user based on the query result and the combination of the first authentication method: If the third authentication method combination does not exist in the second identity authentication record, obtaining the first authentication method used to authenticate the user from the second identity authentication record; If the first verification method is different from the second verification method that is first in the first verification method combination, determining to authenticate the user, the first verification method combination comprising a plurality of second verification methods arranged in sequence; If the first verification method is different from each second verification method in the first verification method combination, it is determined to authenticate the user.

[0094] In another embodiment, the verification module is used to: recommending the first verification method combination to the customer service, wherein the first verification method combination includes a plurality of second verification methods arranged in sequence; Determining a third verification method selected by the customer service from the multiple second verification methods; Displaying a link to the third verification method to the user through the first access platform; In response to a triggering operation on the link, the user's identity is authenticated based on the third authentication method.

[0095] Obviously, the label processing device provided in the embodiment of the present application can be used as Figure 2The authentication method shown is executed by the subject, for example Figure 2 In the identity authentication method shown, S202 and S204 can be Figure 4 The determination module 410 in the identity verification device 400 shown in FIG. 4 is executed, and S206 can be performed by Figure 4 The decision module 420 in the identity verification device 400 shown in FIG. 4 is executed, and S208 can be performed by Figure 4 The verification module 430 in the identity verification device 400 is shown to execute.

[0096] According to another embodiment of the present application, Figure 4 The various modules in the identity authentication device shown can be separately or completely combined into one or several other modules to constitute, or one (some) of the modules can be further divided into multiple functionally smaller modules to constitute, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application. The above modules are divided based on logical functions. In actual applications, the functions of one module can also be implemented by multiple modules, or the functions of multiple modules can be implemented by one module. In the embodiments of the present application, the identity authentication device may also include other modules. In actual applications, these modules can also be implemented with the assistance of other modules, and can be implemented by the collaboration of multiple modules.

[0097] According to another embodiment of the present application, the program can be executed on a general computing device such as a computer including a central processing unit (CPU), a random access memory (RAM), a read-only memory (ROM), and other processing elements and storage elements. Figure 2 A computer program (including program code) for each step involved in the corresponding method shown in FIG. Figure 4 The module device shown, and the module method for implementing the embodiment of the present application. The computer program can be recorded on, for example, a computer-readable storage medium, and transferred to an electronic device through the computer-readable storage medium and run therein.

[0098] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 5At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0099] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0100] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0101] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming an identity verification device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations: Determining the user's intention, user information, and first identity authentication record based on an access request submitted by the user through the first access platform; Determining, based on the first access platform, the user information, and the intention, a first verification method combination applicable to the user from a plurality of verification method combinations; Determining whether to authenticate the user based on the first authentication method combination and the first identity authentication record; If it is determined to authenticate the user, the user's identity is authenticated based on the first authentication method combination.

[0102] The above application Figure 2The method performed by the identity authentication device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0103] The electronic device may also perform Figure 2 method, and implement the identity verification device in Figure 2 , Figure 3 , Figure 4 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0104] Of course, in addition to software implementation methods, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0105] The embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by a portable electronic device including a plurality of application programs, enable the portable electronic device to execute Figure 2 The method of the embodiment shown is specifically used to perform the following operations: Determining the user's intention, user information, and first identity authentication record based on an access request submitted by the user through the first access platform; Determining, based on the first access platform, the user information, and the intention, a first verification method combination applicable to the user from a plurality of verification method combinations; Determining whether to authenticate the user based on the first authentication method combination and the first identity authentication record; If it is determined to authenticate the user, the user's identity is authenticated based on the first authentication method combination.

[0106] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps in the identity authentication method provided by the embodiment of the present application as described above.

[0107] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0108] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0109] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0110] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0111] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. An identity authentication method, characterized in that: include: Determining the user's intention, user information, and first identity authentication record based on an access request submitted by the user through the first access platform; Determining, based on the first access platform, the user information, and the intention, a first verification method combination applicable to the user from a plurality of verification method combinations; Determining whether to authenticate the user based on the first authentication method combination and the first identity authentication record; If it is determined to authenticate the user, the user's identity is authenticated based on the first authentication method combination.

2. The method according to claim 1, characterized in that The determining, based on the first access platform, the user information, and the intention, from a plurality of authentication method combinations, a first authentication method combination applicable to the user includes: Determining a first business scenario matching the intention from among multiple business scenarios; Based on the business scenarios and access platforms to which each verification method combination is applicable, determining at least one second verification method combination applicable to the first business scenario and the first access platform from the multiple verification method combinations; Based on the user information and the user condition applicable to each second verification method combination, a first verification method combination applicable to the user is determined from the at least one second verification method combination.

3. The method according to claim 2, characterized in that The determining a first business scenario matching the intention from a plurality of business scenarios includes: For each business scenario, matching the text used to describe the business scenario with the intent to obtain a matching degree between the business scenario and the intent; Determine, from the multiple business scenarios, a third business scenario whose matching degree with the intention is greater than or equal to a first threshold, and determine a fourth business scenario associated with the third business scenario; The third business scenario and the fourth business scenario are determined as first business scenarios matching the intention.

4. The method according to claim 2, characterized in that: The determining, based on the user information and the user condition applicable to each second verification method combination, a first verification method combination applicable to the user from the at least one second verification method combination includes: For each second verification method combination, determining a second score of the second verification method based on the risk level of the second verification method combination and the first score; Traversing the at least one second verification method combination in descending order of the second scores; If the user information meets the user condition applicable to the traversed second verification method combination, the traversed second verification method combination is determined as the first verification method combination applicable to the user, and the traversal is stopped.

5. The method according to claim 1, characterized in that The determining whether to authenticate the user based on the first authentication method combination and the first identity authentication record includes: Determining whether there is a second identity authentication record that has been successfully authenticated in the first identity authentication record; If the second identity authentication record exists in the first identity authentication record, query whether there is a third authentication method combination in the second identity authentication record, and determine whether to authenticate the user based on the query result and the first authentication method combination; wherein the third authentication method combination is a authentication method combination recommended for the user and used for authenticating the user before determining the first authentication method combination; If the second identity authentication record does not exist in the first identity authentication record, it is determined to authenticate the user.

6. The method according to claim 5, characterized in that The determining whether to perform identity authentication on the user based on the query result and the first verification method comprises: If the third authentication method combination exists in the second authentication record and the risk level of the third authentication method combination is lower than the risk level of the first authentication method combination, it is determined to authenticate the user.

7. The method according to claim 5, characterized in that The determining whether to perform identity authentication on the user based on the query result and the first verification method comprises: If the third authentication method combination does not exist in the second authentication record, obtaining the first authentication method used to authenticate the user from the second authentication record; if the first authentication method is different from the second authentication method that is first in the first authentication method combination, determining to authenticate the user, the first authentication method combination includes a plurality of second authentication methods arranged in sequence; If the first verification method is different from each second verification method in the first verification method combination, it is determined to authenticate the user.

8. The method according to claim 1, characterized in that The performing identity authentication on the user based on the verification method in the first verification method combination includes: recommending the first verification method combination to the customer service, wherein the first verification method combination includes a plurality of second verification methods arranged in sequence; Determining a third verification method selected by the customer service from the multiple second verification methods; Displaying a link to the third verification method to the user through the first access platform; In response to a triggering operation on the link, the user's identity is authenticated based on the third authentication method.

9. An identity verification device, characterized in that: include: A determination module, configured to determine the user's intention, user information, and first identity authentication record based on an access request submitted by the user through the first access platform; The determination module is further configured to determine, based on the first access platform, the user information and the intention, a first verification method combination applicable to the user from a plurality of verification method combinations; A decision module, configured to determine whether to authenticate the user based on the first authentication method combination and the first identity authentication record; The verification module is used to, if it is determined that the identity of the user is to be verified, verify the identity of the user based on the first verification method combination.

10. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the identity authentication method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the identity authentication method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product comprises a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute part or all of the steps in the identity authentication method according to any one of claims 1 to 8.

Images