Risk management and control method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a risk management and control method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: based on behavior feature information of a target user on a target system, judging whether a preset risk control triggering condition is met or not; if the preset risk control triggering condition is met, recording a risk control triggering record; when the target user performs a target operation on the target system, if a risk control trigger record exists in a current risk control period, performing second verification of the target operation on the target user; the second verification is dynamic verification; the target operation comprises login and password modification. By adopting the method, the safety can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a risk management method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of digital technology, more and more affairs can be handled through online systems. For example, employees handle work affairs through internal systems, and customers handle business through external systems or applications. Therefore, system risk control is very important.

[0003] The relevant risk control method requires users to set a highly complex password. Only when the user name and password entered by the user are correct can they log in to the system to operate. However, once the password is leaked, illegal users can successfully log in to the system to operate using the leaked password. Therefore, the security of the relevant risk control method is low. Summary of the invention

[0004] Based on this, it is necessary to provide a risk management method, device, computer equipment, computer-readable storage medium and computer program product that can improve security in response to the above-mentioned technical problems.

[0005] In a first aspect, the present application provides a risk management method, including:

[0006] Based on the target user's behavioral characteristics on the target system, determine whether the preset risk control trigger conditions are met;

[0007] If the preset risk control trigger conditions are met, the risk control trigger record will be recorded;

[0008] When the target user performs the target operation on the target system, if there is a risk control trigger record within the current risk management cycle, the target user will be subjected to a second verification of the target operation; the second verification is a dynamic verification; the target operation includes logging in and changing the password.

[0009] In one embodiment, the behavior characteristic information includes password modification behavior information, and judging whether a preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system includes:

[0010] If the password modification behavior information indicates that the number of times the target user successfully modified the password on the target system during the current risk control cycle is greater than a preset password modification number threshold, it is determined that the preset risk control trigger condition is met; and / or,

[0011] If the password modification behavior information indicates that the time when the target user successfully modified the password on the target system is within a preset password modification abnormal time period, it is determined that the preset risk control trigger condition is met.

[0012] In one embodiment, the behavior characteristic information includes binding behavior information, and judging whether a preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system includes:

[0013] If the binding behavior information indicates that the number of mobile phone numbers bound to the same target user in the current risk control cycle is greater than a preset threshold of the number of mobile phone numbers bound to the same target user, it is determined that the preset risk control trigger condition is met; and / or,

[0014] If the binding behavior information indicates that the number of users bound to the same mobile phone number in the current risk control cycle is greater than a preset threshold value for the number of users bound to the same mobile phone number, it is determined that the preset risk control trigger condition is met.

[0015] In one embodiment, the behavior characteristic information includes login behavior information, and judging whether a preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system includes:

[0016] If the login behavior information indicates that the number of accounts with the same IP address that log into the target system within a preset login abnormality time period is greater than a preset login account threshold, it is determined that the preset risk control trigger condition is met; and / or,

[0017] If the login behavior information indicates that the number of failed logins of the target user on the target system within a preset historical time period is greater than a preset login failure threshold, it is determined that the preset risk control trigger condition is met.

[0018] In one embodiment, the behavior characteristic information includes associated behavior information, and judging whether a preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system includes:

[0019] If the associated behavior information indicates that the number of cloud desktops associated with the same target user in the current risk control cycle is greater than a preset cloud desktop association number threshold, it is determined that the preset risk control trigger condition is met.

[0020] In one embodiment, the method further comprises:

[0021] When the target user logs in to the target system, the target user is instructed to input an account name, a static password, and a dynamic secret code.

[0022] In a second aspect, the present application also provides a risk management device, including:

[0023] A judgment module is used to judge whether the preset risk control trigger conditions are met based on the behavior characteristic information of the target user on the target system;

[0024] A recording module is used to record the risk control trigger record if the preset risk control trigger condition is met;

[0025] Verification module, when the target user performs the target operation on the target system, if there is a risk control trigger record within the current risk management cycle, the target user is subjected to a second verification of the target operation; the second verification is a dynamic verification; the target operation includes logging in and changing the password.

[0026] In one embodiment, the behavior characteristic information includes password modification behavior information, and the judgment module is specifically used to:

[0027] If the password modification behavior information indicates that the number of times the target user successfully modified the password on the target system during the current risk control cycle is greater than a preset password modification number threshold, it is determined that the preset risk control trigger condition is met; and / or,

[0028] If the password modification behavior information indicates that the time when the target user successfully modified the password on the target system is within a preset password modification abnormal time period, it is determined that the preset risk control trigger condition is met.

[0029] In one embodiment, the behavior characteristic information includes binding behavior information, and the judgment module is specifically used to:

[0030] If the binding behavior information indicates that the number of mobile phone numbers bound to the same target user in the current risk control cycle is greater than a preset threshold of the number of mobile phone numbers bound to the same target user, it is determined that the preset risk control trigger condition is met; and / or,

[0031] If the binding behavior information indicates that the number of users bound to the same mobile phone number in the current risk control cycle is greater than a preset threshold value for the number of users bound to the same mobile phone number, it is determined that the preset risk control trigger condition is met.

[0032] In one embodiment, the behavior characteristic information includes login behavior information, and the judgment module is specifically used to:

[0033] If the login behavior information indicates that the number of accounts with the same IP address that log into the target system within a preset login abnormality time period is greater than a preset login account threshold, it is determined that the preset risk control trigger condition is met; and / or,

[0034] If the login behavior information indicates that the number of failed logins of the target user on the target system within a preset historical time period is greater than a preset login failure threshold, it is determined that the preset risk control trigger condition is met.

[0035] In one embodiment, the behavior characteristic information includes associated behavior information, and the judgment module is specifically used to:

[0036] If the associated behavior information indicates that the number of cloud desktops associated with the same target user in the current risk control cycle is greater than a preset cloud desktop association number threshold, it is determined that the preset risk control trigger condition is met.

[0037] In one embodiment, the device further comprises:

[0038] The instruction module is used to instruct the target user to input an account name, a static password and a dynamic secret code when the target user logs in to the target system.

[0039] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps described in the first aspect when executing the computer program.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps described in the first aspect above.

[0041] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which implements the steps described in the first aspect when executed by a processor.

[0042] The above-mentioned risk control method, device, computer equipment, computer-readable storage medium and computer program product determine whether the preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system; if the preset risk control trigger condition is met, the risk control trigger record is recorded; when the target user performs the target operation on the target system, if there is a risk control trigger record in the current risk control cycle, the target user is subjected to a second verification of the target operation; the second verification is a dynamic verification; the target operation includes login and password modification. In this way, based on the behavior characteristic information of the target user on the target system, it is determined whether the risk control is triggered, and the risk control trigger record is recorded. When the target user performs operations such as login or password modification on the target system, if there is a risk control trigger record in the current risk control cycle, the target user is subjected to a second verification of the dynamic verification of the target operation, the risk in the current risk control cycle is assessed based on the user behavior, and when the risk is too high, a dynamic verification is added for operations such as login and password modification, so that even if the password is leaked, illegal users cannot log in to the system through the leaked password to perform operations, thereby improving security. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0044] FIG1 is a schematic diagram of a process of a risk management method in an embodiment;

[0045] FIG2 is a schematic diagram of a process of a risk management method in another embodiment;

[0046] FIG3 is a schematic diagram of a process of performing risk control or risk blocking on login in one embodiment;

[0047] FIG4 is a schematic diagram of a process of performing risk control or risk blocking for password modification in one embodiment;

[0048] FIG5 is a structural block diagram of a risk management device in one embodiment;

[0049] FIG. 6 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] In one embodiment, as shown in FIG1 , a risk management method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. In this embodiment, the method includes the following steps:

[0052] Step 101: Based on the behavior characteristic information of the target user on the target system, determine whether the preset risk control trigger condition is met.

[0053] In the embodiment of the present application, the target user is a user to be subject to risk control, and may be an enterprise employee or a customer. Enterprises include but are not limited to enterprises involved in finance. The target system is a system to be subject to risk control, and may be an internal enterprise system or an external system, that is, a system that provides services to customers. For example, the target user is an internal employee of an insurance company, and the target system is an internal system of the insurance company. Behavioral feature information is used to characterize the target user's operational behavior on the target system. The risk control trigger condition is used to measure whether risk control is triggered.

[0054] In one example, at every preset inspection time period, the terminal determines whether a preset risk control trigger condition is met based on the behavior feature information of the target user on the target system.

[0055] In one example, the terminal determines in real time whether a preset risk control trigger condition is met based on the behavioral feature information of the target user on the target system.

[0056] Step 102: If the preset risk control triggering condition is met, a risk control triggering record is recorded.

[0057] In an embodiment of the present application, if the preset risk control trigger condition is met, the terminal records the risk control trigger record and stores the risk control trigger record in the target database. The target database is a database for storing risk control trigger records, and only the risk control trigger records within the current risk control management cycle may be retained. For example, the terminal may clear the risk control trigger records within the previous risk control management cycle when the current risk control management cycle is reached. The target database may be a remote dictionary service (RemoteDictionary Server, Redis).

[0058] Step 103: When the target user performs the target operation on the target system, if there is a risk control trigger record within the current risk control cycle, a second verification of the target operation is performed on the target user.

[0059] The second level of verification is dynamic verification. The target operations include logging in and changing passwords.

[0060] In the embodiment of the present application, the target operation is the operation to be risk controlled, and may also include other operations performed by the target user on the target system. For example, the target operation includes a transfer. The risk control cycle can be a natural day, that is, 00:00:00-23:59:59 on the same day. There may be no interval between adjacent risk control cycles. The second verification can be a text message verification code verification.

[0061] In one example, the terminal determines the risk coefficient corresponding to each system operation of the user on the target system, and then takes the system operation with a risk coefficient greater than a preset risk coefficient threshold as the target operation.

[0062] When the target user performs the target operation on the target system, if there is a risk control trigger record within the current risk control cycle, the terminal performs a second verification of the target operation on the target user. If the target user passes both the first verification and the second verification of the target operation on the target system, the terminal determines that the target user has passed the verification of the target operation on the target system. If the target user fails the first verification of the target operation on the target system, or the target user fails the second verification of the target operation on the target system, the terminal determines that the target user has passed the verification of the target operation on the target system. Among them, the first verification can include account verification and password verification. Password verification can be static password verification or dynamic password verification.

[0063] In one example, if the target user passes the verification of the target operation on the target system, the terminal sends verification pass indication information to the target user, wherein the verification pass indication information is used to indicate that the target user passes the verification of the target operation on the target system.

[0064] In the above risk control method, based on the behavior characteristic information of the target user on the target system, it is determined whether to trigger risk control, and the risk control trigger record is recorded. When the target user logs in or changes the password on the target system, if there is a risk control trigger record in the current risk control cycle, the target user is subjected to a second level of dynamic verification of the target operation. In this way, the risk in the current risk control cycle is assessed based on the user behavior, and when the risk is too high, a dynamic verification is added for operations such as login and password modification. Even if the password is leaked, the illegal user cannot log in to the system through the leaked password to perform operations, which can improve security. Moreover, this method not only performs risk control on the login operation, but also on other operations such as password modification, which can avoid further infringement after the illegal user successfully logs in, and can further improve security. Moreover, when the risk is not high, this method only performs one level of verification, which can improve user operation efficiency, risk control efficiency and user experience while ensuring security.

[0065] In an exemplary embodiment, the behavior characteristic information includes password modification behavior information. Based on the behavior characteristic information of the target user on the target system, the specific process of determining whether the preset risk control trigger condition is met includes the following steps: if the password modification behavior information indicates that the number of times the target user successfully modified the password on the target system during the current risk control cycle is greater than the preset password modification number threshold, then it is determined that the preset risk control trigger condition is met. And / or, if the password modification behavior information indicates that the time when the target user successfully modified the password on the target system is within the preset password modification abnormal time period, then it is determined that the preset risk control trigger condition is met.

[0066] In an embodiment of the present application, the password modification behavior information is used to characterize the password modification behavior of the target user on the target system. The password modification number threshold can be 5 times. When the target system is an internal enterprise system, the password modification abnormal time period can be abnormal working hours, for example, 00:00:00-04:59:59 every day. When the target system is an external system, the password modification abnormal time period can be abnormal working hours or the user's rest time. The password modification abnormal time period can be pre-set and adjusted by the target user.

[0067] In the above risk control method, if the password modification behavior information indicates that the number of times the target user successfully modified the password on the target system during the current risk control cycle is greater than the preset password modification number threshold, it is determined that the preset risk control trigger condition is met; and / or, if the password modification behavior information indicates that the time when the target user successfully modified the password on the target system is within the preset password modification abnormal time period, it is determined that the preset risk control trigger condition is met. In this way, when the user has excessive password modification times within a period of time and / or has modified the password within an abnormal password modification time, risk control is triggered, and the abnormal behavior of the user's password modification is verified, which can further improve security.

[0068] In an exemplary embodiment, the behavior characteristic information includes binding behavior information. Based on the behavior characteristic information of the target user on the target system, the specific process of determining whether the preset risk control trigger condition is met includes the following steps: if the binding behavior information indicates that the number of mobile phone numbers bound to the same target user in the current risk control cycle is greater than the preset threshold number of user-bound mobile phone numbers, it is determined that the preset risk control trigger condition is met. And / or, if the binding behavior information indicates that the number of users bound to the same mobile phone number in the current risk control cycle is greater than the preset threshold number of users bound to mobile phone numbers, it is determined that the preset risk control trigger condition is met.

[0069] In an embodiment of the present application, the binding behavior information is used to characterize the binding behavior of the target user on the target system. The threshold value of the number of mobile phone numbers bound by users is used to measure the number of mobile phone numbers bound to the same user, and can be preset and adjusted by the target user. For example, the threshold value of the number of mobile phone numbers bound by users is 2. The threshold value of the number of users bound to mobile phone numbers is used to measure the number of users bound to the same mobile phone number, and can be preset and adjusted by the target user. For example, the threshold value of the number of users bound to mobile phone numbers is 2.

[0070] In the above risk control method, if the binding behavior information indicates that the number of mobile phone numbers bound to the same target user in the current risk control cycle is greater than the preset threshold of the number of mobile phone numbers bound to users, it is determined that the preset risk control trigger condition is met; and / or, if the binding behavior information indicates that the number of users bound to the same mobile phone number in the current risk control cycle is greater than the preset threshold of the number of users bound to mobile phone numbers, it is determined that the preset risk control trigger condition is met. In this way, when a user has an abnormal number of mobile phone numbers bound to the same user and / or an abnormal number of users bound to the same mobile phone number, risk control is triggered, and the abnormal behavior of user binding and the user's environment are verified, which can further improve security.

[0071] In an exemplary embodiment, the behavior characteristic information includes login behavior information. Based on the behavior characteristic information of the target user on the target system, the specific process of determining whether the preset risk control trigger condition is met includes the following steps: if the login behavior information indicates that the number of accounts with the same IP address that log in to the target system within a preset login abnormality time period is greater than a preset login account threshold, then it is determined that the preset risk control trigger condition is met. And / or, if the login behavior information indicates that the number of failed logins of the target user on the target system within a preset historical time period is greater than a preset login failure threshold, then it is determined that the preset risk control trigger condition is met.

[0072] In an embodiment of the present application, the login behavior information is used to characterize the login behavior of the target user on the target system. The accounts with the same IP that log into the target system within the preset login abnormality time period include the target user's account. The login account threshold can be preset and adjusted by the target user. For example, the login account threshold is 2. IP (Internet Protocol Address) is an Internet Protocol address. The historical time period can be the most recent past 1 hour. For example, the threshold for the number of failed logins is 5 times.

[0073] In the above risk control method, if the login behavior information indicates that the number of accounts with the same IP that log in to the target system within the preset abnormal login time period is greater than the preset login account threshold, it is determined that the preset risk control trigger condition is met; and / or, if the login behavior information indicates that the number of failed logins of the target user on the target system within the preset historical time period is greater than the preset failed login threshold, it is determined that the preset risk control trigger condition is met. In this way, when a user logs in to multiple accounts within the abnormal login time period with the same IP and / or has too many failed logins in a short period of time, risk control is triggered, and the abnormal login behavior of the user, the user IP and the user's environment are verified, which can further improve security.

[0074] In an exemplary embodiment, the behavioral characteristic information includes associated behavior information. Based on the behavioral characteristic information of the target user on the target system, the specific process of determining whether the preset risk control trigger condition is met includes the following steps: If the associated behavior information indicates that the number of cloud desktops associated with the same target user in the current risk management cycle is greater than a preset cloud desktop association number threshold, it is determined that the preset risk control trigger condition is met.

[0075] In an embodiment of the present application, the associated behavior information is used to characterize the associated behavior of the target user on the target system. The associated behavior may include the behavior of associating a cloud desktop. The cloud desktop associated number threshold may be pre-set and adjusted by the target user. For example, the cloud desktop associated number threshold is 2.

[0076] In the above risk control method, if the associated behavior information indicates that the number of cloud desktops associated with the same target user in the current risk control cycle is greater than the preset cloud desktop association number threshold, it is determined that the preset risk control trigger condition is met. In this way, when a user has too many behaviors of associating cloud desktops with the same user, risk control is triggered, and the abnormal behavior of the user login and the user's environment are verified, which can further improve security.

[0077] In an exemplary embodiment, the method further includes the following steps: when the target user logs in on the target system, instructing the target user to input an account name, a static password, and a dynamic secret code.

[0078] In the embodiment of the present application, the static password is a fixed password and may contain at least one of uppercase and lowercase letters, numbers and special symbols. The length of the static password is greater than or equal to the preset static password length threshold. The static password length threshold may be 8 bits. The static password may be a system default password or a password set by the target user. The dynamic password is a dynamically changing password and may be a dynamic password, that is, an unpredictable random number combination generated according to a special algorithm. For example, when the target system is an internal system of an insurance company, the dynamic password may be a China Life password and / or a cloud assistant verification password.

[0079] When the target user logs in on the target system, the terminal instructs the target user to enter the account name, static password and dynamic password. Then, the terminal performs the first verification of the target operation on the target user based on the account name, static password and dynamic password entered by the target user.

[0080] In the above risk control method, when the target user logs in on the target system, the target user is instructed to enter the account name, static password and dynamic password. In this way, when the user login is verified for the first level, not only the account number and static password are verified, but also the dynamic password is verified, which can more timely avoid the loss caused by password leakage, prevent illegal users from logging in, and further improve security.

[0081] In another embodiment, as shown in FIG2, the risk control method includes the following steps: Step 201, if the password modification behavior information indicates that the number of times the target user successfully modified the password on the target system during the current risk control period is greater than the preset password modification number threshold, it is determined that the preset risk control trigger condition is met. Step 202, if the password modification behavior information indicates that the time when the target user successfully modified the password on the target system is within the preset password modification abnormal time period, it is determined that the preset risk control trigger condition is met. Step 203, if the binding behavior information indicates that the number of mobile phone numbers bound to the same target user during the current risk control period is greater than the preset user binding mobile phone number number threshold, it is determined that the preset risk control trigger condition is met. Step 204, if the binding behavior information indicates that the number of users bound to the same mobile phone number during the current risk control period is greater than the preset mobile phone number binding user number threshold, it is determined that the preset risk control trigger condition is met. Step 205, if the login behavior information indicates that the number of accounts with the same IP that logged into the target system during the preset login abnormal time period is greater than the preset login account threshold, it is determined that the preset risk control trigger condition is met. Step 206. If the login behavior information indicates that the number of failed logins of the target user on the target system within a preset historical time period is greater than a preset login failure threshold, it is determined that the preset risk control trigger condition is met. Step 207. If the associated behavior information indicates that the number of cloud desktops associated with the same target user within the current risk management cycle is greater than a preset cloud desktop association number threshold, it is determined that the preset risk control trigger condition is met. Step 208. If the preset risk control trigger condition is met, a risk control trigger record is recorded. Step 209. When the target user logs in to the target system, the target user is instructed to enter an account name, static password, and dynamic password. Step 210. When the target user performs a target operation on the target system, if there is a risk control trigger record within the current risk management cycle, a second verification of the target operation is performed on the target user.

[0082] In one embodiment, the terminal is a target system, and the target system includes a front end and a back end. As shown in FIG3 , the process of risk control or risk blocking for login includes: when the target user performs a login operation in the target system, the front end displays the login status, and the back end generates a token: saves the application code, etc. Then, the front end displays the login page and sends the obtained account and password to the back end. The back end authenticates the account and password. If the authentication fails, the front end prompts an error; if the authentication succeeds, the back end queries the risk control trigger record of the day. If the risk control trigger record of the day is not included, the front end displays a successful login; if the risk control trigger record of the day is included, the back end records the user's successful login in redis and triggers the second verification of risk control. Then, the back end returns a random risk (risk random) to the front end. The front end pops up a window prompting to enter the SMS verification code. Then, the front end sends the random risk (risk random) employee number verification code to the back end. The back end verifies the redis and SMS verification code according to the random risk (risk random) employee number verification code. If this verification fails, the front end prompts an error; if this verification passes, the back end clears redis, and the front end displays a successful login. In this way, the method notifies the user of the login in time, allowing the user to be aware of it.

[0083] In one embodiment, the terminal is a target system, and the target system includes a front end and a back end. As shown in FIG4 , the process of risk control or risk blocking for password modification includes: when the target user performs a password modification operation in the target system, the front end displays the login status, and the back end generates a token: saves the user ID, etc. Then, the back end returns the token to the front end. The front end displays the personal information page and sends it to the back end with the token. Then, the back end queries the risk control trigger record of the day. If the risk control trigger record of the day is not included, the front end displays the password modification page. If the risk control trigger record of the day is included, the back end records the second verification of the user triggering risk control in redis. Then, the front end prompts to enter the SMS verification code. The back end obtains the password and SMS verification code from the password modification page. Then, the back end verifies the password, redis and SMS verification code. If this verification fails, the front end prompts an error; if this verification passes, the back end clears redis, saves the new password, and the front end prompts success. In this way, the method notifies the user of the password modification in a timely manner, so that the user can feel it.

[0084] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0085] Based on the same inventive concept, the embodiment of the present application also provides a risk control device for implementing the risk control method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more risk control device embodiments provided below can refer to the limitations on the risk control method above, and will not be repeated here.

[0086] In an exemplary embodiment, as shown in FIG5 , a risk management device 500 is provided, including: a judgment module 510, a recording module 520 and a verification module 530, wherein:

[0087] The judgment module 510 is used to judge whether the preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system;

[0088] The recording module 520 is used to record the risk control trigger record if the preset risk control trigger condition is met;

[0089] Verification module 530, when the target user performs the target operation on the target system, if there is a risk control trigger record within the current risk management cycle, the target user is subjected to a second verification of the target operation; the second verification is a dynamic verification; the target operation includes logging in and changing the password.

[0090] Optionally, the behavior characteristic information includes password modification behavior information, and the judgment module 510 is specifically used to:

[0091] If the password modification behavior information indicates that the number of times the target user successfully modified the password on the target system during the current risk control cycle is greater than a preset password modification number threshold, it is determined that the preset risk control trigger condition is met; and / or,

[0092] If the password modification behavior information indicates that the time when the target user successfully modified the password on the target system is within a preset password modification abnormal time period, it is determined that the preset risk control trigger condition is met.

[0093] Optionally, the behavior characteristic information includes binding behavior information, and the determination module 510 is specifically configured to:

[0094] If the binding behavior information indicates that the number of mobile phone numbers bound to the same target user in the current risk control cycle is greater than a preset threshold of the number of mobile phone numbers bound to the same target user, it is determined that the preset risk control trigger condition is met; and / or,

[0095] If the binding behavior information indicates that the number of users bound to the same mobile phone number in the current risk control cycle is greater than a preset threshold value for the number of users bound to the same mobile phone number, it is determined that the preset risk control trigger condition is met.

[0096] Optionally, the behavior characteristic information includes login behavior information, and the judgment module 510 is specifically used to:

[0097] If the login behavior information indicates that the number of accounts with the same IP address that log into the target system within a preset login abnormality time period is greater than a preset login account threshold, it is determined that the preset risk control trigger condition is met; and / or,

[0098] If the login behavior information indicates that the number of failed logins of the target user on the target system within a preset historical time period is greater than a preset login failure threshold, it is determined that the preset risk control trigger condition is met.

[0099] Optionally, the behavior characteristic information includes associated behavior information, and the judgment module 510 is specifically configured to:

[0100] If the associated behavior information indicates that the number of cloud desktops associated with the same target user in the current risk control cycle is greater than a preset cloud desktop association number threshold, it is determined that the preset risk control trigger condition is met.

[0101] Optionally, the device 500 further includes:

[0102] The instruction module is used to instruct the target user to input an account name, a static password and a dynamic secret code when the target user logs in to the target system.

[0103] Each module in the above risk control device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0104] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG6. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a risk management method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0105] Those skilled in the art will understand that the structure shown in FIG. 6 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0106] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0107] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0108] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0109] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0110] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0111] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0112] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A risk management method, characterized in that: The method comprises: Based on the target user's behavioral characteristics on the target system, determine whether the preset risk control trigger conditions are met; If the preset risk control trigger conditions are met, the risk control trigger record will be recorded; When the target user performs the target operation on the target system, if there is a risk control trigger record within the current risk management cycle, the target user will be subjected to a second verification of the target operation; the second verification is a dynamic verification; the target operation includes logging in and changing the password.

2. The method according to claim 1, characterized in that The behavior characteristic information includes password modification behavior information, and judging whether a preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system includes: If the password modification behavior information indicates that the number of times the target user successfully modified the password on the target system during the current risk control cycle is greater than a preset password modification number threshold, it is determined that the preset risk control trigger condition is met; and / or, If the password modification behavior information indicates that the time when the target user successfully modified the password on the target system is within a preset password modification abnormal time period, it is determined that the preset risk control trigger condition is met.

3. The method according to claim 1, characterized in that The behavior characteristic information includes binding behavior information, and judging whether a preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system includes: If the binding behavior information indicates that the number of mobile phone numbers bound to the same target user in the current risk control cycle is greater than a preset threshold of the number of mobile phone numbers bound to the same target user, it is determined that the preset risk control trigger condition is met; and / or, If the binding behavior information indicates that the number of users bound to the same mobile phone number in the current risk control cycle is greater than a preset threshold value for the number of users bound to the same mobile phone number, it is determined that the preset risk control trigger condition is met.

4. The method according to claim 1, characterized in that The behavior characteristic information includes login behavior information, and judging whether a preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system includes: If the login behavior information indicates that the number of accounts with the same IP address that log into the target system within a preset login abnormality time period is greater than a preset login account threshold, it is determined that the preset risk control trigger condition is met; and / or, If the login behavior information indicates that the number of failed logins of the target user on the target system within a preset historical time period is greater than a preset login failure threshold, it is determined that the preset risk control trigger condition is met.

5. The method according to claim 1, characterized in that The behavior characteristic information includes associated behavior information, and judging whether a preset risk control trigger condition is met based on the behavior characteristic information of the target user on the target system includes: If the associated behavior information indicates that the number of cloud desktops associated with the same target user in the current risk control cycle is greater than a preset cloud desktop association number threshold, it is determined that the preset risk control trigger condition is met.

6. The method according to claim 1, characterized in that The method further comprises: When the target user logs in to the target system, the target user is instructed to input an account name, a static password, and a dynamic secret code.

7. A risk management device, characterized in that: The device comprises: A judgment module is used to judge whether the preset risk control trigger conditions are met based on the behavior characteristic information of the target user on the target system; A recording module is used to record the risk control trigger record if the preset risk control trigger condition is met; Verification module, when the target user performs the target operation on the target system, if there is a risk control trigger record within the current risk management cycle, the target user is subjected to a second verification of the target operation; the second verification is a dynamic verification; the target operation includes logging in and changing the password.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images