Account login method and device, electronic equipment and storage medium

Abstract

The invention relates to an account login method and device, electronic equipment and a storage medium, and belongs to the technical field of financial science and technology and network security. The method comprises the steps that a target digital signature and first verification information sent by a client are received, an identifier of a target account and an identifier of target equipment are extracted from the first verification information, and the target digital signature and the first verification information are sent after the client verifies first biological characteristic information corresponding to the target account; respectively verifying the target digital signature and the first verification information; obtaining current login environment information of the target account based on the identifier of the target equipment; obtaining a risk level of the current login behavior based on the current login environment information and the current login behavior information; and based on the verification results of the target digital signature and the first verification information, and the risk level, identifying whether the target account is allowed to log in the target device. Therefore, the biological characteristic information can be prevented from being leaked, and the safety of the biological characteristic information is improved.

Description

Technical Field

[0001] The present disclosure relates to the fields of financial technology and network security technology, and in particular to an account login method, device, electronic device, computer-readable storage medium and computer program product. Background Art

[0002] At present, biometric technology has the advantages of simple user operation and high security, and has been widely used in the field of account login. However, when performing account login based on biometric technology in related technologies, there is a problem of biometric information leakage, resulting in low security of biometric information. Summary of the invention

[0003] The present disclosure provides an account login method, device, electronic device, computer-readable storage medium and computer program product to at least solve the problem of low security of biometric information in related technologies. The technical solution of the present disclosure is as follows:

[0004] According to a first aspect of an embodiment of the present disclosure, there is provided an account login method, applicable to a server, the method comprising: receiving a target digital signature and first verification information sent by a client, and extracting from the first verification information an identification of a target account and a target device to be logged in by the target account, wherein the target digital signature and the first verification information are sent after the client verifies the first biometric information corresponding to the target account; obtaining first determination information bound to the target account from a local storage space, and verifying the target digital signature based on the first determination information; obtaining second determination information bound to the target account from a local storage space, and verifying the first verification information based on the second determination information; obtaining current login environment information of the target account based on the identification of the target device; performing a risk assessment on the current login behavior of the target account based on the current login environment information and the current login behavior information of the target account to obtain a risk level of the current login behavior; identifying whether the target account is allowed to log in on the target device based on the verification results of the target digital signature and the first verification information, and the risk level.

[0005] According to a second aspect of an embodiment of the present disclosure, another account login method is provided, which is applicable to a client, and the method includes: collecting first biometric information corresponding to a target account, and verifying the first biometric information; in response to the first biometric information passing the verification, generating first verification information based on the target account and the identification of a target device to be logged in by the target account; signing the first verification information to obtain a target digital signature; and sending the target digital signature and the first verification information to the server, wherein the target digital signature and the first verification information are used to identify whether the target account is allowed to log in on the target device.

[0006] According to a third aspect of an embodiment of the present disclosure, there is provided an account login device, applicable to a server, the device comprising: a receiving module, configured to receive a target digital signature and first verification information sent by a client, and extracting from the first verification information an identifier of a target account and a target device to be logged in by the target account, wherein the target digital signature and the first verification information are sent after the client verifies the first biometric information corresponding to the target account; a verification module, configured to obtain the first determination information bound to the target account from a local storage space, and verify the target digital signature based on the first determination information; the verification module is also configured to obtain from a local storage space the first determination information; The second determination information bound to the target account is obtained from the local storage space, and the first verification information is verified based on the second determination information; the acquisition module is configured to obtain the current login environment information of the target account based on the identification of the target device; the risk assessment module is configured to perform a risk assessment on the current login behavior of the target account based on the current login environment information and the current login behavior information of the target account, and obtain the risk level of the current login behavior; the identification module is configured to identify whether the target account is allowed to log in to the target device based on the verification results of the target digital signature and the first verification information, as well as the risk level.

[0007] According to a fourth aspect of an embodiment of the present disclosure, there is provided an account login device, applicable to a client, the device comprising: a verification module, configured to collect first biometric information corresponding to a target account, and verify the first biometric information; a generation module, configured to generate first verification information based on the target account and an identifier of a target device to be logged in by the target account in response to the first biometric information passing the verification; a signature module, configured to sign the first verification information to obtain a target digital signature; and a sending module, configured to send the target digital signature and the first verification information to the server, wherein the target digital signature and the first verification information are used to identify whether the target account is allowed to log in on the target device.

[0008] According to the fifth aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the account login method as described in the first to second aspects above.

[0009] According to the sixth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device can execute the account login method as described in the first to second aspects.

[0010] According to a seventh aspect of an embodiment of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the account login method as described in the first to second aspects is implemented.

[0011] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects: there is no need to verify the biometric information through the server, and the client does not need to send the biometric information to the server, which can avoid the leakage of biometric information and improve the security of biometric information. In addition, the server can obtain the determination information of the target account binding from the local storage space to verify the target digital signature and the first verification information respectively. In addition, the server can comprehensively consider the verification results of the target digital signature and the first verification information, as well as the risk level of the current login behavior, to identify whether the target account is allowed to log in on the target device. That is, in the account login scenario, a multiple verification mechanism of biometric identification, digital signature, verification information and risk assessment can be adopted to improve the security of account login.

[0012] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0014] Figure 1 It is a flowchart of the account login method according to the first embodiment of the present disclosure.

[0015] Figure 2 It is a flowchart of an account login method according to the second embodiment of the present disclosure.

[0016] Figure 3 It is a flowchart of an account login method according to the third embodiment of the present disclosure.

[0017] Figure 4 It is an interactive schematic diagram of the account login method according to the fourth embodiment of the present disclosure.

[0018] Figure 5 It is a block diagram of an account login device according to the first embodiment of the present disclosure.

[0019] Figure 6 It is a block diagram of an account login device according to a second embodiment of the present disclosure.

[0020] Figure 7 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0021] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0023] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this disclosure are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards.

[0024] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of the present disclosure are in compliance with the relevant provisions of relevant laws and regulations. In the embodiments of the present disclosure, certain software, components, models, and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present disclosure, but it does not mean that the applicant has or will necessarily use the solution.

[0025] Figure 1 It is a flowchart of the account login method according to the first embodiment of the present disclosure.

[0026] like Figure 1 As shown, the account login method of the first embodiment of the present disclosure includes the following steps:

[0027] S101, receiving a target digital signature and first verification information sent by a client, and extracting an identifier of a target account and a target device to be logged in by the target account from the first verification information, wherein the target digital signature and the first verification information are sent after the client verifies the first biometric information corresponding to the target account.

[0028] It should be noted that the execution subject of the account login method of the present disclosure is a server. The account login method of the present disclosure embodiment can be executed by the account login device of the present disclosure embodiment, and the account login device of the present disclosure embodiment can be configured in any electronic device to execute the account login method of the present disclosure embodiment.

[0029] It should be noted that the first verification information carries the identifiers of the target account and the target device. The target account refers to the user's identity identifier on the client. There are no excessive restrictions on the target device, for example, it may include a mobile phone, a notebook, a computer, etc. The target digital signature is obtained by signing the first verification information. The first biometric information refers to the biometric information of the user who initiated the current login behavior of the target account. There are no excessive restrictions on the biometric information, for example, it may include fingerprint feature information, face feature information, iris feature information, etc.

[0030] In the embodiment of the present disclosure, the client is used to verify the first biometric information corresponding to the target account. After the client verifies the first biometric information, the client sends the target digital signature and the first verification information to the server. That is to say, in this solution, the biometric information can be verified by the client, and there is no need to verify the biometric information through the server. The client does not need to send the biometric information to the server, which can avoid the leakage of biometric information and improve the security of biometric information.

[0031] In one embodiment, before receiving the target digital signature and the first verification information sent by the client, it also includes sending a first random number to the client, wherein the first random number is used to generate the first verification information. It is understandable that the first random number is obfuscated data, which helps to improve the security of the target account and target device identification transmission and avoid the leakage of the target account and target device identification.

[0032] In one embodiment, before extracting the identifier of the target account and the target device to be logged in by the target account from the first verification information, the method further includes receiving first indication information sent by the client, and identifying that the first indication information indicates that the first biometric information has passed the verification. Thus, the server continues to execute the subsequent verification process only when the first biometric information has passed the verification.

[0033] S102, obtaining first determination information bound to a target account from a local storage space, and verifying a target digital signature based on the first determination information.

[0034] It is understandable that the first judgment information bound to different target accounts may be different, and there are no excessive restrictions on the first judgment information. For example, it may include the method of generating the target digital signature (such as key, hash function, signature format, etc.), preset digital signature, etc.

[0035] In one embodiment, the first determination information bound to the target account is obtained from the local storage space, and the target digital signature is verified based on the first determination information, including obtaining the target public key bound to the target account from the local storage space as the first determination information, decrypting the target digital signature based on the target public key, obtaining the second verification information, identifying whether the second verification information is consistent with the first verification information, and determining that the target digital signature has passed the verification in response to the second verification information being consistent with the first verification information, and determining that the target digital signature has not passed the verification in response to the second verification information being inconsistent with the first verification information. Thus, the server can obtain the target public key bound to the target account from the local storage space to decrypt the target digital signature, obtain the second verification information, identify whether the second verification information is consistent with the first verification information, and verify the target digital signature.

[0036] It is understandable that the target public keys bound to different target accounts may be different. If the second verification information is consistent with the first verification information, it indicates that the first verification information has integrity, and the first verification information comes from a device that the target account is allowed to log in, then the signature verification passes. If the second verification information is inconsistent with the first verification information, it indicates that the first verification information does not have integrity. At this time, the first verification information may not come from a device that the target account is allowed to log in, then the signature verification fails.

[0037] In some examples, before receiving the target digital signature and the first verification information sent by the client, the server also includes receiving the target account and target public key sent by the client, binding the target public key to the target account, and storing the target account and target public key in the local storage space. Thus, the server can receive the target account and target public key sent by the client, bind the target public key to the target account, and store the target account and target public key in the local storage space, so as to subsequently obtain the target public key bound to the target account from the local storage space.

[0038] It should be noted that there are not too many restrictions on the target public key. For example, it can be obtained based on an asymmetric encryption algorithm, such as the target public key is an RSA public key.

[0039] For example, the server may receive the target account 1 and the target public key 1 sent by the client A, bind the target public key 1 to the target account 1, and store the target account 1 and the target public key 1 in the local storage space.

[0040] The server receives the target digital signature 1 and the first verification information 1 sent by the client A, and extracts the target account 1 and the identifier of the target device X to be logged in by the target account 1 from the first verification information 1, wherein the target digital signature 1 and the first verification information 1 are sent after the client A verifies the first biometric information 1 corresponding to the target account 1.

[0041] The server obtains the target public key 1 bound to the target account 1 from the local storage space, decrypts the target digital signature 1 based on the target public key 1, obtains the second verification information 1, identifies whether the second verification information 1 is consistent with the first verification information 1, and determines that the target digital signature 1 passes the verification in response to the second verification information 1 being consistent with the first verification information 1, or determines that the target digital signature 1 fails the verification in response to the second verification information 1 being inconsistent with the first verification information 1.

[0042] For example, the server may receive the target account 2 and the target public key 2 sent by the client B, bind the target public key 2 to the target account 2, and store the target account 2 and the target public key 2 in the local storage space.

[0043] The server receives the target digital signature 2 and the first verification information 2 sent by the client B, and extracts the target account 2 and the identifier of the target device Y to be logged in by the target account 2 from the first verification information 2, wherein the target digital signature 2 and the first verification information 2 are sent after the client B verifies the first biometric information corresponding to the target account 2.

[0044] The server obtains the target public key 2 bound to the target account 2 from the local storage space, decrypts the target digital signature 2 based on the target public key 2, obtains the second verification information 2, identifies whether the second verification information 2 is consistent with the first verification information 2, and in response to the second verification information 2 being consistent with the first verification information 2, determines that the target digital signature 2 has passed the verification, or, in response to the second verification information 2 being inconsistent with the first verification information 2, determines that the target digital signature 2 has not passed the verification.

[0045] In one embodiment, first judgment information bound to the target account is obtained from a local storage space, and the target digital signature is verified based on the first judgment information, including obtaining a target hash function bound to the target account from the local storage space as the first judgment information, performing a hash operation on the first verification information according to the target hash function to obtain a second digital signature, and in response to the second digital signature being consistent with the target digital signature, determining that the target digital signature has passed the verification, and in response to the second digital signature being inconsistent with the target digital signature, determining that the target digital signature has not passed the verification.

[0046] In one embodiment, first judgment information bound to the target account is obtained from a local storage space, and the target digital signature is verified based on the first judgment information, including obtaining a target signature format bound to the target account from the local storage space as the first judgment information, and in response to the target digital signature not conforming to the target signature format, determining that the target digital signature has failed the verification.

[0047] S103, obtaining second determination information bound to the target account from the local storage space, and verifying the first verification information based on the second determination information.

[0048] It is understandable that the second determination information bound to different target accounts may be different, and there are no excessive restrictions on the second determination information. For example, it may include the method of generating the first verification information (such as the identification of the device allowed to log in by the target account, the verification information format, etc.), preset verification information, etc.

[0049] In one embodiment, the second determination information bound to the target account is obtained from the local storage space, and the first verification information is verified based on the second determination information, including obtaining the third verification information bound to the target account from the local storage space as the second determination information, identifying whether the third verification information is consistent with the first verification information, and in response to the third verification information being consistent with the first verification information, determining that the first verification information has passed the verification, and in response to the third verification information being inconsistent with the first verification information, determining that the first verification information has not passed the verification. Thus, the server can obtain the third verification information bound to the target account from the local storage space, and identify whether the third verification information is consistent with the first verification information, so as to verify the first verification information.

[0050] It is understandable that the third verification information bound to different target accounts may be different. The third verification information carries the identifiers of the target account and the devices that the target account is allowed to log in. If the third verification information is consistent with the first verification information, it indicates that the first verification information comes from the device that the target account is allowed to log in, and the first verification information passes the verification. If the third verification information is inconsistent with the first verification information, it indicates that the first verification information may not come from the device that the target account is allowed to log in, and the first verification information fails the verification.

[0051] In some examples, before receiving the target digital signature and the first verification information sent by the client, the server also includes receiving the third verification information sent by the client, extracting the target account from the third verification information, binding the third verification information to the target account, and storing the target account and the third verification information in the local storage space. Thus, the server can receive the third verification information sent by the client, extract the target account from the third verification information, bind the third verification information to the target account, and store the target account and the third verification information in the local storage space, so as to subsequently obtain the third verification information bound to the target account from the local storage space.

[0052] For example, continuing with client A, the server can receive the third verification information 1 sent by client A, extract the target account 1 from the third verification information 1, bind the third verification information 1 to the target account 1, and store the target account 1 and the third verification information 1 in the local storage space.

[0053] The server obtains the third verification information 1 bound to the target account 1 from the local storage space, identifies whether the third verification information 1 is consistent with the first verification information 1, and in response to the third verification information 1 being consistent with the first verification information 1, determines that the first verification information 1 has passed the verification, or, in response to the third verification information 1 being inconsistent with the first verification information 1, determines that the first verification information 1 has not passed the verification.

[0054] For example, continuing with client B, the server can receive the third verification information 2 sent by client B, extract the target account 2 from the third verification information 2, bind the third verification information 2 to the target account 2, and store the target account 2 and the third verification information 2 in the local storage space.

[0055] The server obtains the third verification information 2 bound to the target account 2 from the local storage space, identifies whether the third verification information 2 is consistent with the first verification information 2, and in response to the third verification information 2 being consistent with the first verification information 2, determines that the first verification information 2 has passed the verification, or, in response to the third verification information 2 being inconsistent with the first verification information 2, determines that the first verification information 2 has not passed the verification.

[0056] In one embodiment, second determination information bound to the target account is obtained from a local storage space, and the first verification information is verified based on the second determination information, including obtaining a target device identifier bound to the target account from the local storage space as the second determination information, wherein the target device identifier is an identifier of a device that the target account is allowed to log in to, and generating third verification information based on the target account and the target device identifier; in response to the third verification information being consistent with the first verification information, determining that the first verification information has passed the verification; and in response to the third verification information being inconsistent with the first verification information, determining that the first verification information has not passed the verification.

[0057] In one embodiment, second determination information bound to the target account is obtained from a local storage space, and the first verification information is verified based on the second determination information, including obtaining a target verification information format bound to the target account from the local storage space as the second determination information, and determining that the first verification information has failed the verification in response to the first verification information not conforming to the target verification information format.

[0058] S104, based on the identification of the target device, obtaining the current login environment information of the target account.

[0059] It should be noted that there are no excessive restrictions on the login environment information, for example, it may include the target device's identifier, operating system, IP (Internet Protocol) address, geographic location, network environment, etc. The network environment may include network type (such as public network, home network, mobile network), network operator, etc.

[0060] In one embodiment, based on the identification of the target device, the current login environment information of the target account is obtained, including obtaining a mapping relationship between the identification of the candidate device and the candidate login environment information, and obtaining the candidate login environment information having a mapping relationship with the identification of the target device as the current login environment information. It is understandable that the candidate login environment information mapped to the identification of different candidate devices may be different.

[0061] S105, based on the current login environment information and the current login behavior information of the target account, a risk assessment is performed on the current login behavior of the target account to obtain a risk level of the current login behavior.

[0062] It should be noted that there are not too many restrictions on login behavior information, for example, it may include login time, login frequency, keyboard behavior information (such as typing speed), mouse behavior information (such as click frequency), number of login failures, etc.

[0063] In one embodiment, based on the current login environment information and the current login behavior information of the target account, a risk assessment is performed on the current login behavior of the target account to obtain the risk level of the current login behavior, including performing a risk assessment on the current login behavior based on the current login environment information and the current login behavior information to obtain a total risk score of the current login behavior, and determining the risk level based on the total risk score.

[0064] In some examples, based on the current login environment information and the current login behavior information, a risk assessment is performed on the current login behavior to obtain a total risk score of the current login behavior, including inputting the current login environment information and the current login behavior information into a risk assessment model, and the risk assessment model outputs the total risk score. It should be noted that there are no excessive restrictions on the risk assessment model, for example, it may include a mechanism model, a data-driven model (such as a deep learning model), etc.

[0065] In some examples, determining a risk level based on a total risk score includes obtaining a mapping relationship between candidate ranges and candidate levels, determining a target range in which the total risk score is located from multiple candidate ranges, and obtaining a candidate level having a mapping relationship with the target range as the risk level.

[0066] S106, based on the verification results of the target digital signature and the first verification information, as well as the risk level, identifying whether the target account is allowed to log in to the target device.

[0067] In one embodiment, based on the verification results of the target digital signature and the first verification information, and the risk level, identifying whether to allow the target account to log in on the target device includes determining that the target account is allowed to log in on the target device in response to the target digital signature and the first verification information both passing the verification and the risk level being lower than the set level. Thus, the server can determine that the target account is allowed to log in on the target device when the target digital signature and the first verification information both pass the verification and the risk level of the current login behavior is low.

[0068] In one embodiment, based on the verification results of the target digital signature and the first verification information, and the risk level, identifying whether to allow the target account to log in on the target device includes determining that the target account is not allowed to log in on the target device in response to the target digital signature failing to pass the verification, and / or the first verification information failing to pass the verification, and / or the risk level is higher than or equal to the set level. Thus, the server can determine that the target account is not allowed to log in on the target device when at least one of the target digital signature fails to pass the verification, the first verification information fails to pass the verification, and the risk level of the current login behavior is high.

[0069] In summary, according to the account login method provided by the embodiment of the present disclosure, a target digital signature and first verification information sent by a client are received, and the identification of the target account and the target device to be logged in by the target account are extracted from the first verification information, wherein the target digital signature and the first verification information are sent after the client verifies the first biometric information corresponding to the target account, the first determination information bound to the target account is obtained from the local storage space, and the target digital signature is verified based on the first determination information, the second determination information bound to the target account is obtained from the local storage space, and the first verification information is verified based on the second determination information, based on the identification of the target device, the current login environment information of the target account is obtained, based on the current login environment information and the current login behavior information of the target account, the current login behavior of the target account is risk assessed to obtain the risk level of the current login behavior, and based on the verification results of the target digital signature and the first verification information, as well as the risk level, it is identified whether the target account is allowed to log in to the target device. Therefore, there is no need to verify the biometric information through the server, and the client does not need to send biometric information to the server, which can avoid the leakage of biometric information and improve the security of biometric information. In addition, the server can obtain the judgment information of the target account binding from the local storage space to verify the target digital signature and the first verification information respectively. In addition, the server can comprehensively consider the verification results of the target digital signature and the first verification information, as well as the risk level of the current login behavior, to identify whether the target account is allowed to log in on the target device. That is, in the account login scenario, a multiple verification mechanism of biometrics, digital signature, verification information and risk assessment can be adopted to improve the security of account login.

[0070] Figure 2 It is a flowchart of an account login method according to the second embodiment of the present disclosure.

[0071] like Figure 2 As shown, the account login method of the second embodiment of the present disclosure, in step S104, based on the current login environment information and the current login behavior information of the target account, performs a risk assessment on the current login behavior of the target account to obtain the risk level of the current login behavior, including the following steps:

[0072] S201, receiving a target digital signature and first verification information sent by a client, and extracting an identifier of a target account and a target device to be logged in by the target account from the first verification information, wherein the target digital signature and the first verification information are sent after the client verifies the first biometric information corresponding to the target account.

[0073] S202, obtaining first determination information bound to the target account from a local storage space, and verifying the target digital signature based on the first determination information.

[0074] S203: Acquire second determination information bound to the target account from the local storage space, and verify the first verification information based on the second determination information.

[0075] S204, based on the identification of the target device, obtain the current login environment information of the target account.

[0076] For the relevant contents of steps S201 - S204 , please refer to the above embodiment and will not be described again here.

[0077] S205, obtaining historical login environment information and historical login behavior information of the target account from the local storage space.

[0078] It is understandable that the historical login environment information and the historical login behavior information can be pre-stored in the local storage space of the server.

[0079] In one embodiment, historical login environment information and historical login behavior information of the target account are obtained from a local storage space, including obtaining the login environment information bound to the target account from the local storage space as the historical login environment information of the target account, and obtaining the login behavior information bound to the target account from the storage space as the historical login behavior information of the target account.

[0080] In one embodiment, historical login environment information and historical login behavior information of the target account are obtained from the local storage space, including obtaining the storage location of the information corresponding to the target account in the local storage space, and obtaining the historical login environment information and historical login behavior information of the target account from the storage location.

[0081] S206: Obtain a first risk score of the current login behavior based on the historical login environment information and the current login environment information.

[0082] In one embodiment, based on the historical login environment information and the current login environment information, obtaining a first risk score of the current login behavior includes obtaining a first difference parameter between the historical login environment information and the current login environment information, and obtaining the first risk score based on the first difference parameter. It should be noted that there are no excessive restrictions on the difference parameter, such as whether it is consistent, the amount of deviation, etc.

[0083] In some examples, the first risk score is positively correlated with the first difference parameter, that is, the greater the deviation between the historical login environment information and the current login environment information, the higher the first risk score.

[0084] In one embodiment, based on historical login environment information and current login environment information, a first risk score of the current login behavior is obtained, including inputting the historical login environment information and the current login environment information into a risk assessment model, and the risk assessment model outputs the first risk score.

[0085] S207: Obtain a second risk score of the current login behavior based on the historical login behavior information and the current login behavior information.

[0086] In one embodiment, based on historical login behavior information and current login behavior information, a second risk score for the current login behavior is obtained, including obtaining a second difference parameter between the historical login behavior information and the current login behavior information, and obtaining a second risk score based on the second difference parameter.

[0087] In some examples, the second risk score is positively correlated with the second difference parameter, that is, the greater the deviation between the historical login behavior information and the current login behavior information, the higher the second risk score.

[0088] In one embodiment, based on historical login behavior information and current login behavior information, a second risk score of the current login behavior is obtained, including inputting the historical login behavior information and the current login behavior information into a risk assessment model, and the risk assessment model outputs the second risk score.

[0089] S208: Obtain a risk level based on the first risk score and the second risk score.

[0090] In one embodiment, the risk level is obtained based on the first risk score and the second risk score, including obtaining a total risk score of the current login behavior based on the first risk score and the second risk score, and determining the risk level based on the total risk score.

[0091] In some examples, based on the first risk score and the second risk score, a total risk score of the current login behavior is obtained, including performing a weighted sum or weighted average on the first risk score and the second risk score to obtain the total risk score.

[0092] In some examples, based on the first risk score and the second risk score, a total risk score of the current login behavior is obtained, including obtaining a sum of the first risk score and the second risk score as the total risk score.

[0093] It should be noted that, for the relevant content of determining the risk level based on the total risk score, please refer to the above embodiment, which will not be repeated here.

[0094] S209, based on the verification results of the target digital signature and the first verification information, as well as the risk level, identifying whether the target account is allowed to log in to the target device.

[0095] For the relevant contents of step S209, please refer to the above embodiment, which will not be repeated here.

[0096] In summary, according to the account login method provided by the embodiment of the present disclosure, the historical login environment information and the historical login behavior information of the target account are obtained from the local storage space, and the first risk score of the current login behavior is obtained based on the historical login environment information and the current login environment information, and the second risk score of the current login behavior is obtained based on the historical login behavior information and the current login behavior information, and the risk level is obtained based on the first risk score and the second risk score. Thus, the server can obtain the historical login environment information and the historical login behavior information of the target account from the local storage space, and take into account the historical login environment information and the current login environment information to obtain the first risk score of the current login behavior, take into account the historical login behavior information and the current login behavior information to obtain the second risk score of the current login behavior, and take into account the first risk score and the second risk score to obtain the risk level of the current login behavior, thereby improving the accuracy of risk assessment.

[0097] Figure 3 It is a flowchart of an account login method according to the third embodiment of the present disclosure.

[0098] like Figure 3 As shown, the account login method of the third embodiment of the present disclosure includes the following steps:

[0099] S301, collecting first biometric information corresponding to the target account, and verifying the first biometric information.

[0100] It should be noted that the execution subject of the account login method of the present disclosure is the client. The account login method of the present disclosure embodiment can be executed by the account login device of the present disclosure embodiment, and the account login device of the present disclosure embodiment can be configured in any electronic device to execute the account login method of the present disclosure embodiment.

[0101] In one embodiment, verifying the first biometric information includes obtaining the second biometric information corresponding to the target account from the local storage space of the target device, obtaining the similarity between the second biometric information and the first biometric information, and verifying the first biometric information based on the similarity. Thus, the client can obtain the second biometric information corresponding to the target account from the local storage space of the target device, and verify the first biometric information considering the similarity between the second biometric information and the first biometric information.

[0102] It should be noted that the second biometric information corresponding to the target account refers to the biometric information of the user who actually holds the target account. The second biometric information corresponding to different target accounts may be different.

[0103] In some examples, the first biometric information is verified based on the similarity, including determining that the first biometric information has passed the verification in response to the similarity being greater than a set threshold, and determining that the first biometric information has not passed the verification in response to the similarity being less than or equal to the set threshold. Thus, when the similarity between the second biometric information and the first biometric information is large, the client can indicate that the user who initiated the current login behavior of the target account is consistent with the user who actually holds the target account, and determine that the first biometric information has passed the verification; conversely, when the similarity is small, it indicates that the user who initiated the current login behavior of the target account is inconsistent with the user who actually holds the target account, and determine that the first biometric information has not passed the verification.

[0104] In some examples, before collecting the first biometric information corresponding to the target account, the process also includes collecting the second biometric information in response to the target account confirming to enable biometric login on the target device, and storing the second biometric information in the local storage space of the target device. Thus, when the target account confirms to enable biometric login on the target device, the client can collect the second biometric information and store the second biometric information in the local storage space of the target device, so as to subsequently obtain the second biometric information from the local storage space of the target device.

[0105] For example, continuing with client A, in response to target account 1 confirming the activation of biometric login on target device X, client A collects the second biometric information 1 corresponding to target account 1 and stores the second biometric information 1 in the local storage space of target device X.

[0106] In response to a login request from the target account 1 on the target device X, client A collects the first biometric information 1 corresponding to the target account 1, obtains the second biometric information 1 from the local storage space of the target device X, obtains the similarity between the second biometric information 1 and the first biometric information 1, and verifies the first biometric information 1 based on the similarity.

[0107] For example, continuing with client B as an example, in response to the target account 2 confirming the activation of biometric login on the target device Y, client B collects the second biometric information 2 corresponding to the target account 2, and stores the second biometric information 2 in the local storage space of the target device Y.

[0108] In response to the login request of the target account 2 on the target device Y, client B collects the first biometric information 2 corresponding to the target account 2, obtains the second biometric information 2 from the local storage space of the target device Y, obtains the similarity between the second biometric information 2 and the first biometric information 2, and verifies the first biometric information 2 based on the above similarity.

[0109] In one embodiment, before collecting the first biometric information corresponding to the target account, it also includes identifying that the login method of the target account on the target device is biometric login. Therefore, the client only continues to execute the subsequent verification process when it identifies that the login method of the target account on the target device is biometric login.

[0110] In one implementation, after verifying the first biometric feature information, the method further includes sending first indication information to a server, wherein the first indication information is used to indicate whether the first biometric feature information passes the verification.

[0111] S302: In response to the first biometric information passing the verification, first verification information is generated based on the target account and the identifier of the target device to be logged in by the target account.

[0112] In one implementation, first verification information is generated based on a target account and an identifier of a target device to be logged in by the target account, including concatenating the identifiers of the target account and the target device to obtain the first verification information.

[0113] In one embodiment, based on the target account and the identifier of the target device to be logged in by the target account, generating the first verification information includes receiving a first random number sent by the server, concatenating the identifier of the target account, the target device and the first random number to obtain the first verification information. It can be understood that the first random number is obfuscated data, which helps to improve the security of the transmission of the identifier of the target account and the target device and avoid the leakage of the identifier of the target account and the target device.

[0114] S303: Perform signature processing on the first verification information to obtain a target digital signature.

[0115] It should be noted that the signing process for the first verification information can be implemented by using any digital signature generation method in the relevant technology, and no further limitations are made here.

[0116] In one embodiment, the first verification information is signed to obtain the target digital signature, including obtaining the target private key bound to the target account from the local storage space of the target device, and encrypting the first verification information based on the target private key to obtain the target digital signature. Thus, the client can obtain the target private key bound to the target account from the local storage space of the target device to encrypt the first verification information to obtain the target digital signature.

[0117] It is understandable that different target accounts may be bound to different target private keys. There are no excessive restrictions on the target private key, for example, it can be obtained based on an asymmetric encryption algorithm, such as the target private key is an RSA private key.

[0118] For example, continuing with client A, client A can generate first verification information 1 in response to the first biometric information 1 passing the verification based on the target account 1 and the identification of the target device X, obtain the target private key 1 bound to the target account 1 from the local storage space of the target device X, and sign the first verification information 1 based on the target private key 1 to obtain the target digital signature 1.

[0119] For example, continuing with client B as an example, client B can generate first verification information 2 in response to the first biometric information 2 passing the verification, based on the identification of the target account 2 and the target device Y, obtain the target private key 2 bound to the target account 2 from the local storage space of the target device Y, and sign the first verification information 2 based on the target private key 2 to obtain the target digital signature 2.

[0120] S304, sending the target digital signature and first verification information to the server, wherein the target digital signature and the first verification information are used to identify whether the target account is allowed to log in to the target device.

[0121] For example, continuing with client A, client A can send a target digital signature 1 and a first verification information 1 to the server, where the target digital signature 1 and the first verification information 1 are used to identify whether the target account 1 is allowed to log in on the target device X.

[0122] For example, continuing with client B, client B can send a target digital signature 2 and first verification information 2 to the server, where the target digital signature 2 and first verification information 2 are used to identify whether the target account 2 is allowed to log in on the target device Y.

[0123] In summary, according to the account login method provided by the embodiment of the present disclosure, the first biometric information corresponding to the target account is collected, and the first biometric information is verified. In response to the first biometric information passing the verification, based on the target account and the identifier of the target device to be logged in by the target account, the first verification information is generated, the first verification information is signed, and the target digital signature is obtained. The target digital signature and the first verification information are sent to the server, wherein the target digital signature and the first verification information are used to identify whether the target account is allowed to log in on the target device. Thus, the biometric information can be verified by the client, and there is no need to verify the biometric information through the server. The client does not need to send the biometric information to the server, which can avoid the leakage of biometric information and improve the security of biometric information. In addition, the client can comprehensively consider the identifier of the target account and the target device, generate the first verification information, and send the target digital signature and the first verification information to the server. That is, in the account login scenario, a multiple verification mechanism of biometric identification, digital signature, and verification information can be adopted to improve the security of account login.

[0124] On the basis of any of the above embodiments, before collecting the first biometric information corresponding to the target account in step S301, it also includes generating a target private key and a target public key in response to the target account confirming to enable biometric login on the target device, binding the target private key to the target account, and storing the target account and the target private key in the local storage space of the target device, and sending the target account and the target public key to the server, wherein the target public key is used to verify the target digital signature. Thus, when the target account confirms to enable biometric login on the target device, the client can generate a target private key and a target public key, bind the target private key to the target account, and store the target account and the target private key in the local storage space of the target device, so as to subsequently obtain the target private key bound to the target account from the local storage space of the target device. In addition, the client can also send the target account and the target public key to the server so that the server can subsequently verify the target digital signature.

[0125] In one embodiment, in response to the target account confirming the activation of biometric login on the target device, the third verification information is generated based on the identifier of the target account and the target device, and the third verification information is sent to the server, wherein the third verification information is used to verify the first verification information. Thus, when the target account confirms the activation of biometric login on the target device, the client can generate the third verification information taking into account the identifier of the target account and the target device, and send the third verification information to the server so that the server can subsequently verify the first verification information.

[0126] In some examples, third verification information is generated based on the identifiers of the target account and the target device, including concatenating the identifiers of the target account and the target device to obtain the third verification information.

[0127] In some examples, based on the identifiers of the target account and the target device, the third verification information is generated, including receiving a second random number sent by the server, concatenating the identifiers of the target account and the target device with the second random number, and obtaining the third verification information. It is understandable that the second random number is obfuscated data, which helps to improve the security of the transmission of the identifiers of the target account and the target device and avoid leakage of the identifiers of the target account and the target device.

[0128] For example, continuing with client A, client A can generate a target private key 1 and a target public key 1 in response to the target account 1 confirming the activation of biometric login on the target device X, bind the target private key 1 to the target account 1, and store the target account 1 and the target private key 1 in the local storage space of the target device X. Based on the identification of the target account 1 and the target device X, generate third verification information 1, and send the target public key 1 and the third verification information 1 to the server, wherein the target public key 1 is used to verify the target digital signature 1, the third verification information 1 is used to verify the first verification information 1, and the third verification information 1 carries the identification of the target account 1 and the target device X.

[0129] For example, continuing with client B as an example, client B can generate a target private key 2 and a target public key 2 in response to the target account 2 confirming the activation of biometric login on the target device Y, bind the target private key 2 to the target account 2, and store the target account 2 and the target private key 2 in the local storage space of the target device Y, generate third verification information 2 based on the identification of the target account 2 and the target device Y, and send the target public key 2 and the third verification information 2 to the server, wherein the target public key 2 is used to verify the target digital signature 2, the third verification information 2 is used to verify the first verification information 2, and the third verification information 2 carries the identification of the target account 2 and the target device Y.

[0130] Figure 4 It is an interactive schematic diagram of the account login method according to the fourth embodiment of the present disclosure.

[0131] like Figure 4 As shown, the account login method of the fourth embodiment of the present disclosure includes the following steps:

[0132] S401, in response to the target account confirming the activation of biometric login on the target device, the client generates a target private key and a target public key.

[0133] S402, binding the target private key to the target account, and storing the target account and the target private key in the local storage space of the target device.

[0134] S403, the client sends a biometric login activation request for the target account on the target device to the server.

[0135] S404: The server sends a second random number to the client.

[0136] In an embodiment of the present disclosure, the client may send a biometric login activation request for a target account on a target device to the server. Accordingly, the server may generate a second random number in response to the activation request and send the second random number to the client.

[0137] S405, the client collects the second biometric information corresponding to the target account, and stores the second biometric information in the local storage space of the target device.

[0138] For the relevant contents of step S405, please refer to the above embodiment, which will not be repeated here.

[0139] S406, the client collects the third biometric information corresponding to the target account, obtains the similarity between the second biometric information and the third biometric information, and verifies the third biometric information based on the similarity.

[0140] It should be noted that the third biometric information refers to the biometric information of the user who initiates the biometric login start process of the target account on the target device. The relevant content of verifying the third biometric information can refer to the relevant content of verifying the first biometric information, which will not be repeated here.

[0141] S407, in response to the third biometric information passing the verification, the client concatenates the target account, the target device identifier and the second random number to generate third verification information.

[0142] S408: The client signs the third verification information based on the target private key to obtain a first digital signature.

[0143] It should be noted that the relevant content of generating the first digital signature can refer to the relevant content of generating the target digital signature, which will not be repeated here.

[0144] S409, the client sends the first digital signature, the third verification information and the target public key to the server.

[0145] S410, the server decrypts the first digital signature based on the target public key to obtain fourth verification information, and verifies the third verification information based on the fourth verification information.

[0146] It should be noted that the relevant contents of verifying the third verification information may refer to the relevant contents of verifying the first verification information, and will not be repeated here.

[0147] S411, in response to the third verification information passing verification, the server extracts the target account from the third verification information, binds the target public key, the third verification information and the target account respectively, and stores the target public key, the third verification information and the target account in the local storage space.

[0148] S412, the server sends a second indication message to the client, wherein the second indication message is used to indicate that the biometric login of the target account on the target device is successfully enabled.

[0149] For the relevant contents of steps S401 - S412 , please refer to the above embodiments and will not be described in detail here.

[0150] Figure 5 4 is a block diagram of an account login device according to the first embodiment of the present disclosure.

[0151] like Figure 5 As shown, the account login device 100 of the embodiment of the present disclosure is applicable to a server, and the device 100 includes: a receiving module 110 , a verification module 120 , an acquisition module 130 , a risk assessment module 140 and an identification module 150 .

[0152] The receiving module 110 is configured to receive a target digital signature and first verification information sent by a client, and extract an identifier of a target account and a target device to be logged in by the target account from the first verification information, wherein the target digital signature and the first verification information are sent after the client verifies the first biometric information corresponding to the target account;

[0153] The verification module 120 is configured to obtain the first determination information bound to the target account from the local storage space, and verify the target digital signature based on the first determination information;

[0154] The verification module 120 is further configured to obtain second determination information bound to the target account from the local storage space, and verify the first verification information based on the second determination information;

[0155] The acquisition module 130 is configured to acquire the current login environment information of the target account based on the identification of the target device;

[0156] The risk assessment module 140 is configured to perform a risk assessment on the current login behavior of the target account based on the current login environment information and the current login behavior information of the target account, and obtain a risk level of the current login behavior;

[0157] The identification module 150 is configured to identify whether the target account is allowed to log in to the target device based on the verification results of the target digital signature and the first verification information, as well as the risk level.

[0158] In one embodiment of the present disclosure, the risk assessment module 140 is further configured to: obtain historical login environment information and historical login behavior information of the target account from a local storage space; obtain a first risk score for the current login behavior based on the historical login environment information and the current login environment information; obtain a second risk score for the current login behavior based on the historical login behavior information and the current login behavior information; obtain the risk level based on the first risk score and the second risk score.

[0159] In one embodiment of the present disclosure, the verification module 120 is further configured to: obtain the target public key bound to the target account from the local storage space as the first judgment information; decrypt the target digital signature based on the target public key to obtain second verification information; identify whether the second verification information is consistent with the first verification information; in response to the second verification information being consistent with the first verification information, determine that the target digital signature has passed the verification; in response to the second verification information being inconsistent with the first verification information, determine that the target digital signature has not passed the verification.

[0160] In one embodiment of the present disclosure, before receiving the target digital signature and the first verification information sent by the client, the verification module 120 is also configured to: receive the target account and the target public key sent by the client; bind the target public key to the target account, and store the target account and the target public key in the local storage space.

[0161] In one embodiment of the present disclosure, the verification module 120 is further configured to: obtain the third verification information bound to the target account from the local storage space as the second determination information; identify whether the third verification information is consistent with the first verification information; in response to the third verification information being consistent with the first verification information, determine that the first verification information has passed the verification; in response to the third verification information being inconsistent with the first verification information, determine that the first verification information has not passed the verification.

[0162] In one embodiment of the present disclosure, before receiving the target digital signature and the first verification information sent by the client, the verification module 120 is also configured to: receive the third verification information sent by the client, and extract the target account from the third verification information; bind the third verification information to the target account, and store the target account and the third verification information in a local storage space.

[0163] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0164] In summary, the account login device provided by the embodiment of the present disclosure does not need to verify the biometric information through the server, and the client does not need to send the biometric information to the server, which can avoid the leakage of biometric information and improve the security of the biometric information. In addition, the server can obtain the determination information of the target account binding from the local storage space to verify the target digital signature and the first verification information respectively. In addition, the server can comprehensively consider the verification results of the target digital signature and the first verification information, as well as the risk level of the current login behavior, to identify whether the target account is allowed to log in on the target device. That is, in the account login scenario, a multiple verification mechanism of biometrics, digital signature, verification information and risk assessment can be adopted to improve the security of account login.

[0165] Figure 6 4 is a block diagram of an account login device according to a second embodiment of the present disclosure.

[0166] like Figure 6 As shown, the account login device 200 of the embodiment of the present disclosure is applicable to a client, and the device 200 includes: a verification module 210, a generation module 220, a signature module 230 and a sending module 240.

[0167] The verification module 210 is configured to collect first biometric information corresponding to the target account and verify the first biometric information;

[0168] The generating module 220 is configured to generate first verification information based on the target account and the identifier of the target device to be logged in by the target account in response to the first biometric information passing the verification;

[0169] The signature module 230 is configured to perform signature processing on the first verification information to obtain a target digital signature;

[0170] The sending module 240 is configured to send the target digital signature and the first verification information to the server, wherein the target digital signature and the first verification information are used to identify whether the target account is allowed to log in to the target device.

[0171] In one embodiment of the present disclosure, the verification module 210 is further configured to: obtain the second biometric information corresponding to the target account from the local storage space of the target device; obtain the similarity between the second biometric information and the first biometric information; and verify the first biometric information based on the similarity.

[0172] In one embodiment of the present disclosure, before collecting the first biometric information corresponding to the target account, the verification module 210 is further configured to: in response to the target account confirming the activation of biometric login on the target device, collect the second biometric information; and store the second biometric information in the local storage space of the target device.

[0173] In one embodiment of the present disclosure, the signature module 230 is further configured to: obtain the target private key bound to the target account from the local storage space of the target device; and encrypt the first verification information based on the target private key to obtain the target digital signature.

[0174] In one embodiment of the present disclosure, before collecting the first biometric information corresponding to the target account, the signature module 230 is further configured to: generate a target private key and a target public key in response to the target account confirming the activation of biometric login on the target device; bind the target private key to the target account, and store the target account and the target private key in the local storage space of the target device; send the target account and the target public key to the server, wherein the target public key is used to verify the target digital signature.

[0175] In one embodiment of the present disclosure, in response to the target account confirming the activation of biometric login on the target device, the sending module 240 is further configured to: generate third verification information based on the identification of the target account and the target device; and send the third verification information to the server, wherein the third verification information is used to verify the first verification information.

[0176] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0177] In summary, the account login device provided by the embodiment of the present disclosure can verify the biometric information through the client, without the need to verify the biometric information through the server. The client does not need to send the biometric information to the server, which can avoid the leakage of biometric information and improve the security of the biometric information. In addition, the client can comprehensively consider the identification of the target account and the target device, generate the first verification information, and send the target digital signature and the first verification information to the server. That is, in the account login scenario, a multiple verification mechanism of biometric identification, digital signature, and verification information can be adopted to improve the security of the account login.

[0178] Figure 7 It is a block diagram of an electronic device according to an exemplary embodiment.

[0179] like Figure 7 As shown, the electronic device 300 includes:

[0180] The memory 310 and the processor 320, a bus 330 connecting different components (including the memory 310 and the processor 320), the memory 310 stores a computer program, and when the processor 320 executes the program, the account login method described in the embodiment of the present disclosure is implemented.

[0181] Bus 330 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0182] The electronic device 300 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by the electronic device 300, including volatile and non-volatile media, removable and non-removable media.

[0183] The memory 310 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 340 and / or cache memory 350. The electronic device 300 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 360 may be used to read and write non-removable, non-volatile magnetic media ( Figure 7 not shown, usually called a "hard drive"). Although Figure 7Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 330 via one or more data medium interfaces. The memory 310 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0184] A program / utility 380 having a set (at least one) of program modules 370 may be stored, for example, in the memory 310, such program modules 370 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 370 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0185] The electronic device 300 may also communicate with one or more external devices 390 (e.g., keyboard, pointing device, display 391, etc.), one or more devices that enable a user to interact with the electronic device 300, and / or any device that enables the electronic device 300 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 392. Furthermore, the electronic device 300 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) through a network adapter 393. Figure 7 As shown, the network adapter 393 communicates with other modules of the electronic device 300 via the bus 330. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0186] The processor 320 executes various functional applications and data processing by running the programs stored in the memory 310 .

[0187] It should be noted that the implementation process and technical principles of the electronic device of this embodiment refer to the aforementioned explanation of the account login method of the embodiment of the present disclosure, and will not be repeated here.

[0188] In summary, the electronic device provided by the embodiment of the present disclosure can execute the account login method as described above, without the need to verify the biometric information through the server, and the client does not need to send the biometric information to the server, which can avoid the leakage of biometric information and improve the security of the biometric information. In addition, the server can obtain the determination information of the target account binding from the local storage space to verify the target digital signature and the first verification information respectively. In addition, the server can comprehensively consider the verification results of the target digital signature and the first verification information, as well as the risk level of the current login behavior, to identify whether the target account is allowed to log in to the target device. That is, in the account login scenario, a multiple verification mechanism of biometric identification, digital signature, verification information and risk assessment can be adopted to improve the security of account login.

[0189] In order to implement the above embodiments, the present disclosure also proposes a computer-readable storage medium.

[0190] When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device can perform the above-mentioned, or perform the above-mentioned account login method. Optionally, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0191] In order to implement the above embodiments, the present disclosure further provides a computer program product, including a computer program, characterized in that when the computer program is executed by a processor, the account login method as described above is implemented.

[0192] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0193] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for logging into an account, characterized in that: Applicable to a server, the method comprises: Receiving a target digital signature and first verification information sent by a client, and extracting a target account and an identifier of a target device to be logged in by the target account from the first verification information, wherein the target digital signature and the first verification information are sent after the client verifies the first biometric information corresponding to the target account; Acquire first determination information bound to the target account from the local storage space, and verify the target digital signature based on the first determination information; Acquire second determination information bound to the target account from the local storage space, and verify the first verification information based on the second determination information; Based on the identification of the target device, obtaining current login environment information of the target account; Based on the current login environment information and the current login behavior information of the target account, a risk assessment is performed on the current login behavior of the target account to obtain a risk level of the current login behavior; Based on the verification results of the target digital signature and the first verification information, respectively, and the risk level, it is identified whether the target account is allowed to log in to the target device.

2. The method according to claim 1, characterized in that The step of performing risk assessment on the current login behavior of the target account based on the current login environment information and the current login behavior information of the target account to obtain the risk level of the current login behavior includes: Acquire historical login environment information of the target account and historical login behavior information of the target account from the local storage space; Based on the historical login environment information and the current login environment information, obtaining a first risk score of the current login behavior; Based on the historical login behavior information and the current login behavior information, obtaining a second risk score for the current login behavior; The risk level is obtained based on the first risk score and the second risk score.

3. The method according to claim 1, characterized in that The obtaining the first determination information bound to the target account from the local storage space, and verifying the target digital signature based on the first determination information, includes: Acquire the target public key bound to the target account from the local storage space as the first determination information; Decrypting the target digital signature based on the target public key to obtain second verification information; Identifying whether the second verification information is consistent with the first verification information; In response to the second verification information being consistent with the first verification information, determining that the target digital signature passes verification; In response to the second verification information being inconsistent with the first verification information, it is determined that the target digital signature has failed verification.

4. The method according to claim 3, characterized in that Before receiving the target digital signature and the first verification information sent by the client, the method further includes: Receiving the target account and the target public key sent by the client; The target public key is bound to the target account, and the target account and the target public key are stored in a local storage space.

5. The method according to claim 1, characterized in that The acquiring the second determination information bound to the target account from the local storage space, and verifying the first verification information based on the second determination information, includes: Acquire the third verification information bound to the target account from the local storage space as the second determination information; Identifying whether the third verification information is consistent with the first verification information; In response to the third verification information being consistent with the first verification information, determining that the first verification information passes verification; In response to the third verification information being inconsistent with the first verification information, it is determined that the first verification information has failed verification.

6. The method according to claim 5, characterized in that Before receiving the target digital signature and the first verification information sent by the client, the method further includes: receiving the third verification information sent by the client, and extracting the target account from the third verification information; The third verification information is bound to the target account, and the target account and the third verification information are stored in a local storage space.

7. An account login method, characterized in that: Applicable to the client, the method includes: Collecting first biometric information corresponding to the target account and verifying the first biometric information; In response to the first biometric information passing the verification, generating first verification information based on the target account and an identifier of a target device to be logged in by the target account; Performing signature processing on the first verification information to obtain a target digital signature; The target digital signature and the first verification information are sent to the server, wherein the target digital signature and the first verification information are used to identify whether the target account is allowed to log in to the target device.

8. The method according to claim 7, characterized in that The verifying the first biometric information includes: Acquire second biometric information corresponding to the target account from the local storage space of the target device; Acquire the similarity between the second biometric information and the first biometric information; Based on the similarity, the first biometric feature information is verified.

9. The method according to claim 8, characterized in that Before collecting the first biometric information corresponding to the target account, the method further includes: In response to the target account confirming to enable biometric login on the target device, collecting the second biometric feature information; The second biometric information is stored in a local storage space of the target device.

10. The method according to claim 7, characterized in that The step of performing signature processing on the first verification information to obtain a target digital signature includes: Obtaining a target private key bound to the target account from the local storage space of the target device; The first verification information is encrypted based on the target private key to obtain the target digital signature.

11. The method according to claim 10, characterized in that Before collecting the first biometric information corresponding to the target account, the method further includes: In response to the target account confirming to enable biometric login on the target device, generating a target private key and a target public key; Binding the target private key to the target account, and storing the target account and the target private key in the local storage space of the target device; The target account and the target public key are sent to the server, wherein the target public key is used to verify the target digital signature.

12. The method according to claim 7, characterized in that Before collecting the first biometric information corresponding to the target account, the method further includes: In response to the target account confirming on the target device that biometric login is enabled, generating third verification information based on the target account and the identifier of the target device; The third verification information is sent to the server, wherein the third verification information is used to verify the first verification information.

13. An account login device, characterized in that: Applicable to a server, the device comprises: a receiving module configured to receive a target digital signature and first verification information sent by a client, and extract an identifier of a target account and a target device to be logged in by the target account from the first verification information, wherein the target digital signature and the first verification information are sent after the client verifies the first biometric information corresponding to the target account; A verification module is configured to obtain first determination information bound to the target account from a local storage space, and verify the target digital signature based on the first determination information; The verification module is further configured to obtain second determination information bound to the target account from a local storage space, and verify the first verification information based on the second determination information; An acquisition module, configured to acquire current login environment information of the target account based on the identification of the target device; a risk assessment module configured to perform a risk assessment on the current login behavior of the target account based on the current login environment information and the current login behavior information of the target account, and obtain a risk level of the current login behavior; The identification module is configured to identify whether the target account is allowed to log in to the target device based on the verification results of the target digital signature and the first verification information, as well as the risk level.

14. An account login device, characterized in that: Applicable to a client, the device comprises: A verification module, configured to collect first biometric information corresponding to the target account and verify the first biometric information; a generating module configured to generate first verification information based on the target account and an identifier of a target device to be logged in by the target account in response to the first biometric information passing the verification; A signature module is configured to perform signature processing on the first verification information to obtain a target digital signature; The sending module is configured to send the target digital signature and the first verification information to the server, wherein the target digital signature and the first verification information are used to identify whether the target account is allowed to log in to the target device.

15. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; Wherein, the processor is configured to execute the instructions to implement the account login method as described in any one of claims 1-12.

16. A computer-readable storage medium, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the account login method as described in any one of claims 1 to 12.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the account login method according to any one of claims 1 to 12 is implemented.

Images