Cross-system non-sensing switching authentication method and device for e-commerce

Abstract

The application relates to the technical field of computer authentication, and discloses a cross-system non-susceptible switching authentication method and device for e-commerce, electronic equipment and a storage medium. The method comprises the following steps: acquiring user behavior data, and generating a user behavior data set; extracting user behavior features, and constructing a feature vector group; combining historical abnormal archives, matching a user behavior mode, and giving an initial score of abnormal risk; if the score exceeds a threshold value, cross-verification is performed on login time distribution and operation instruction sequences to determine an abnormal risk level; according to the risk level, an authentication strategy is matched, and a targeted authentication process scheme is generated; and the scheme is issued to a device front end for execution to determine an authentication result. Through dynamic and accurate risk evaluation and adaptive adjustment of authentication strength, the method solves the problem that the user experience and safety are not high due to the fixed authentication strategy in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of computer authentication technology, and in particular to a method and device for seamless cross-system switching authentication for e-commerce. Background Art

[0002] On modern e-commerce platforms, user authentication is the first line of defense for ensuring transaction security and user data safety. As e-commerce businesses expand, a single platform often integrates multiple subsystems, including transactions, payments, logistics, and customer service. Users must authenticate themselves when switching between these subsystems.

[0003] Currently, to ensure security, e-commerce systems generally employ static rule-based authentication methods. For example, regardless of whether user behavior is abnormal, a fixed authentication method of "password + SMS verification code" is used. While other methods incorporate risk detection, their assessment dimensions are limited and data is lagging. For example, assessing risk solely by determining whether the login IP address is abnormal makes it difficult to fully and realistically reflect the true risk level of the user's current operation. These existing authentication strategies are relatively fixed and lack the ability to dynamically perceive and adapt to user behavior and environmental changes.

[0004] If an overly strict authentication policy is adopted, user operations will be frequently interrupted, reducing the user experience; if an overly loose policy is adopted, the system will be slow to respond to new or potential fraudulent activities, which may easily lead to security vulnerabilities. Therefore, existing technologies result in poor user experience and security. Summary of the Invention

[0005] The present invention provides a cross-system seamless switching authentication method, device, electronic device and storage medium for e-commerce, so as to solve the problems in the prior art of low user experience and security caused by fixed authentication strategies and inability to dynamically perceive risks.

[0006] In a first aspect, in order to solve the above technical problems, the present invention provides a cross-system seamless switching authentication method for e-commerce, comprising:

[0007] Obtain user behavior data, process it, and generate a user behavior data set;

[0008] Extracting user behavior features based on the user behavior dataset and constructing a user behavior feature vector group;

[0009] Based on the user behavior feature vector group and in combination with the system's historical abnormal behavior archive, the user behavior pattern is matched and an initial abnormal risk score is assigned;

[0010] If the initial abnormal risk score exceeds a preset first threshold, cross-validating the login time distribution and operation instruction sequence in the user behavior feature vector group to determine a specific abnormal risk level;

[0011] According to the specific level of abnormal risk, matching authentication strategies from the preset authentication strategy library to generate targeted authentication process solutions;

[0012] The targeted authentication process plan is sent to the device front end for execution to determine the authentication execution result.

[0013] Preferably, the acquiring of user behavior data and processing thereof to generate a user behavior data set includes:

[0014] Collect user login time distribution data, device switching frequency data, and geographic location change data in real time, set a unique identifier for each type of data, and obtain the initial user behavior record set;

[0015] Extracting the user identifier and the operation instruction record of the login time distribution data from the initial user behavior record set, and performing missing value completion and format standardization to generate a cleaned user behavior record set;

[0016] Automatically mark abnormalities and perform corrections on data in the cleaned user behavior record set where the timestamp corresponding to the user identifier does not match the data source, thereby obtaining a verified user behavior record set;

[0017] According to the verified user behavior record set, the device switching frequency data and the geographic location change data are standardized and fused to obtain the user behavior data set.

[0018] Preferably, extracting user behavior features based on the user behavior dataset and constructing a user behavior feature vector group includes:

[0019] Extracting user interaction response speed, common function preferences, and abnormal operation ratio as user behavior features based on the user behavior dataset;

[0020] The extracted user behavior features are grouped and labeled in layers to obtain quantitative feature indices; the quantitative feature indices are multi-dimensionally mapped to construct the user behavior feature vector group.

[0021] Preferably, the matching of user behavior patterns and assigning an initial abnormal risk score based on the user behavior feature vector group and the system's historical abnormal behavior archives includes:

[0022] Analyzing the geographic location change data, device switching frequency data, and operation frequency fluctuation data according to the user behavior feature vector group to obtain a current behavior pattern;

[0023] According to the current behavior pattern, a mapping relationship between behavior patterns and risk scores preset in the historical abnormal behavior archive is matched to assign an initial abnormal risk score.

[0024] Preferably, cross-validating the login time distribution and operation instruction sequence in the user behavior feature vector group to determine the specific level of abnormal risk includes:

[0025] For the login time distribution, by comparing it with the system's historical login time period pattern, obtaining an abnormality determination result of the login time distribution;

[0026] Comparing the operation instruction sequence with the historical operation instruction sequence of the system to obtain a consistency determination result of the operation instruction sequence;

[0027] The abnormality determination result and the consistency determination result are combined to perform cross-validation to determine the specific level of the abnormality risk.

[0028] Preferably, the method of matching authentication policies from a preset authentication policy library according to the specific level of abnormal risk and generating a targeted authentication process solution includes:

[0029] Filtering a set of authentication methods from the authentication policy library according to the specific level of the abnormal risk;

[0030] Sorting the authentication methods in the authentication method set based on the differences between the user behavior characteristics and the business scenarios, and determining the order of verification steps;

[0031] The authentication method set is bound to the verification step sequence to generate the targeted authentication process solution.

[0032] Preferably, the step of sending the targeted authentication process solution to the device front end for execution and determining the authentication execution result includes:

[0033] According to the targeted authentication process scheme, dynamically adjust the interactive interface prompt content and verification time limit to generate the front-end authentication configuration;

[0034] Send the front-end authentication configuration to the authentication execution module at the front end of the device to obtain the user authentication link configuration that changes in real time;

[0035] According to the configuration of the user authentication link, the authentication data returned by the authentication execution module is extracted to determine the authentication execution result.

[0036] In a second aspect, the present invention provides a cross-system seamless switching authentication device for e-commerce, comprising:

[0037] The data collection module is used to obtain user behavior data, process it, and generate a user behavior data set;

[0038] A feature construction module, configured to extract user behavior features and construct a user behavior feature vector group based on the user behavior dataset;

[0039] A risk assessment module is used to match user behavior patterns and assign an initial abnormal risk score based on the user behavior feature vector group and historical abnormal behavior archives;

[0040] a risk level judgment module, configured to cross-validate the login time distribution and operation instruction sequence in the user behavior feature vector group to determine a specific abnormal risk level if the initial abnormal risk score exceeds a preset first threshold;

[0041] An authentication decision module is used to match authentication policies from a preset authentication policy library according to the specific level of abnormal risk and generate a targeted authentication process plan;

[0042] The authentication execution module is used to send the targeted authentication process plan to the device front end for execution and determine the authentication execution result.

[0043] In a third aspect, the present invention also provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements any one of the above-mentioned cross-system seamless switching authentication methods for e-commerce.

[0044] In a fourth aspect, the present invention also provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned cross-system seamless switching authentication methods for e-commerce.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] (1) The present invention collects user behavior data from multiple e-commerce subsystems in real time and uses a distributed framework to clean, correct and integrate it, thus solving the technical problem of data integration difficulties caused by the dispersion and different formats of data sources in the existing technology, and providing a comprehensive and high-quality data foundation for subsequent accurate risk assessment.

[0047] (2) The present invention achieves a dynamic and accurate assessment of user operation risks by constructing a user behavior feature vector group and establishing a two-level assessment mechanism of initial risk screening and in-depth verification. It can effectively identify potential abnormal behaviors and solve the problem of inaccurate risk assessment caused by existing technologies relying on a single and lagging data dimension.

[0048] (3) The present invention matches and generates targeted authentication process solutions from the policy library based on the specific risk level dynamically assessed, and sends them to the front-end for execution in real time, thereby achieving adaptive adjustment of authentication strength. While ensuring the security of high-risk operations, it reduces unnecessary interference with low-risk operations and improves the automation and intelligence level of the authentication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a flowchart of a cross-system seamless switching authentication method for e-commerce provided by the first embodiment of the present invention;

[0050] Figure 2 This is a schematic diagram of the structure of a cross-system seamless switching authentication device for e-commerce provided by the second embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0052] Reference Figure 1 The first embodiment of the present invention provides a cross-system seamless switching authentication method for e-commerce, comprising the following steps:

[0053] S11, obtaining user behavior data, processing it, and generating a user behavior data set;

[0054] S12, extracting user behavior features based on the user behavior dataset and constructing a user behavior feature vector group;

[0055] S13, matching user behavior patterns and assigning an initial abnormal risk score based on the user behavior feature vector group and the system's historical abnormal behavior archive;

[0056] S14, if the initial abnormal risk score exceeds a preset first threshold, cross-validating the login time distribution and the operation instruction sequence in the user behavior feature vector group to determine a specific abnormal risk level;

[0057] S15, matching authentication policies from a preset authentication policy library according to the specific level of the abnormal risk, and generating a targeted authentication process plan;

[0058] S16, sending the targeted authentication process solution to the device front end for execution, and determining the authentication execution result.

[0059] In step S11, user behavior data is obtained and processed to generate a user behavior data set, including:

[0060] Collect user login time distribution data, device switching frequency data, and geographic location change data in real time, set a unique identifier for each type of data, and obtain the initial user behavior record set;

[0061] Extracting the user identifier and the operation instruction record of the login time distribution data from the initial user behavior record set, and performing missing value completion and format standardization to generate a cleaned user behavior record set;

[0062] Automatically mark abnormalities and perform corrections on data in the cleaned user behavior record set where the timestamp corresponding to the user identifier does not match the data source, thereby obtaining a verified user behavior record set;

[0063] According to the verified user behavior record set, the device switching frequency data and the geographic location change data are standardized and fused to obtain the user behavior data set.

[0064] It's important to note that when collecting real-time data on user login time distribution, device switching frequency, and geographic location changes, this dispersed data is collected from the subsystems of various e-commerce platforms through multi-system interfaces. This data is then integrated into an initial set of user behavior records and stored in a pre-established database. Each data type, such as login time, device switching frequency, and geographic location change data, is assigned a unique identifier—for example, login time data is identified as LT001. This facilitates subsequent tracing and analysis, effectively improving data integration efficiency and ensuring that data sources are clearly traceable.

[0065] For example, let's assume an e-commerce platform has 100,000 users logging in daily. Login times are collected every minute through an interface to generate time distribution data. Device switching frequency records the number of times a user switches from their phone to their computer within a 24-hour period, assuming an average of two switches per person per day. Geographic location change data is obtained from the user's IP address or GPS information when they log in, recording the number of daily location changes, assuming an average of three per person per day. This data is aggregated to form an initial set of user behavior records, which are stored in a database. Each data type is assigned a unique identifier, such as LT001 for login time data, to facilitate subsequent tracing and analysis.

[0066] It should be noted that when extracting the operation instruction records of user identification and login time distribution data from the initial user behavior record set, and performing missing value completion and format standardization, incomplete operation instruction records are obtained from the user identification and login period attributes in the initial user behavior record set, and the records are completed and formatted using distributed data processing tools (such as Hadoop) to obtain a preliminary cleaned behavior data set.

[0067] For example, if an e-commerce platform has 50,000 daily user login records, some of which lack login time information, the platform can correlate historical login data based on the user ID to infer the missing time information. For example, the missing login time can be supplemented with the user's common login time period in the past seven days, such as 8:00 PM to 10:00 PM. At the same time, the format adjustment will unify the time format to a 24-hour system, such as adjusting "8:00 PM" to "8:00 PM" to ensure data consistency.

[0068] It should be noted that when automatically marking anomalies and performing corrections on data in the cleaned user behavior record set where the timestamp corresponding to the user ID does not match the data source, the initial cleaned behavior data set must be verified for record integrity and timestamp consistency. If the timestamp corresponding to the user ID does not match the data source, it will be marked and corrected to determine the behavior data set after consistency verification.

[0069] After verifying the user behavior record set, the device switching frequency data and the location change data are normalized. When the user behavior data set is obtained after fusion, the location and behavior frequency attributes are normalized. If the behavior frequency exceeds the preset frequency threshold, the location data is correlated and calibrated to determine the standardized behavior data set.

[0070] For example, if a user logs in 10 times per day, exceeding a preset threshold by 5, the system will automatically correlate their geolocation data to identify unusual logins. If a user frequently switches between cities 500 kilometers apart, the system will flag this as an anomaly and perform a calibration. By identifying the user's historical location distribution, the anomalous data will be adjusted to reflect the most common location records. Multi-dimensional fusion processing is then performed on interaction pattern attributes to generate a standardized behavioral dataset.

[0071] In step S12, user behavior features are extracted based on the user behavior dataset to construct a user behavior feature vector group, including:

[0072] Extracting user interaction response speed, common function preferences, and abnormal operation ratio as user behavior features based on the user behavior dataset;

[0073] Grouping and layering the extracted user behavior features to obtain quantitative feature indicators;

[0074] The quantitative feature indicators are mapped into multiple dimensions to construct the user behavior feature vector group.

[0075] It should be noted that when extracting user interaction response speed, common function preferences and abnormal operation ratio as user behavior characteristics based on the standardized behavior data set, relevant record values ​​are obtained for the user response speed and interaction response time attributes, and the record values ​​are grouped by time interval division to obtain user response speed distribution data.

[0076] For example, the average response speed of users on an e-commerce platform is 2 seconds between 8:00 PM and 10:00 PM, and 3 seconds between 9:00 AM and 11:00 AM. This distribution data helps identify user active periods. Based on the common function preferences and function usage frequency attributes, user function usage records are categorized and summarized. If the function usage frequency exceeds a preset threshold (e.g., 5 times per day), the common function preferences are prioritized and a set of function preference weights is determined. For example, if the search function has an average daily usage frequency of 8 times, the weight is set to 0.8. Based on the abnormal operation ratio and operation anomaly distribution attributes, user operation records are detected for anomalies. If the frequency of abnormal behavior exceeds a preset threshold (e.g., 2 times per day), the operation anomaly distribution is stratified and labeled to determine the abnormal operation ratio range. For example, if the stratification is labeled "high-frequency anomaly," the ratio range is set to 60%.

[0077] It is worth noting that when the extracted user behavior features are grouped and layered to obtain quantitative feature indicators, they are divided into multiple levels and each level is assigned a different numerical value to form a quantitative indicator. For common function preferences, weights are calculated based on the frequency of user use of different functions, and frequently used functions are assigned higher weights. For the proportion of abnormal operations, the frequency and severity of abnormal behavior are stratified into "low risk," "medium risk," "high risk," etc., and corresponding numerical values ​​are set for each level.

[0078] It should be noted that when the quantitative feature indicators are multi-dimensionally mapped to construct the user behavior feature vector group, the response speed fluctuations are multi-dimensionally mapped according to the different attributes of user behavior patterns and interaction habits to obtain the user behavior feature vector group.

[0079] Among them, the user interaction response speed refers to the reaction time of the user to perform the next operation after receiving the system interface information. This feature reflects the user's familiarity with the operation process and decision-making habits. The interaction response time record value of each operation of the user is obtained from the data set. The frequently used function preference refers to which function modules (such as search, browse, collect, evaluation, etc.) the user prefers to use in the e-commerce platform. This feature reflects the user's core needs and use purposes. The abnormal operation proportion represents the proportion of behaviors that are preliminarily judged by the system as abnormal (such as short-time high-frequency repeated clicking, very irregular page jumping) in the total operation. This feature is directly related to potential risk behaviors.

[0080] Exemplarily, the multi-dimensional mapping is to associate the quantitative feature indicators (such as user interaction response speed, frequently used function preference, and abnormal operation proportion) with user behavior patterns and interaction habit difference attributes. For example, the response speed of a certain user in the payment scene is 4 seconds on average, while in the browsing scene it is stable at 2 seconds, and the proportion of its nighttime operation is 70%. The system maps these quantitative feature indicators to behavior patterns such as "nighttime activity" and "hesitation in payment scene", thereby constructing a user behavior feature vector group. This vector group is a set containing multiple dimensional values, each value representing a quantitative feature indicator, for example: [average response speed (payment scene), average response speed (browsing scene), nighttime operation proportion, frequently used function preference weight (search), frequently used function preference weight (collection), abnormal operation proportion]. Through such mapping, the system can infer that the user's nighttime payment behavior may be hesitant or have network delay factors.

[0081] Specifically, when implementing the user response speed distribution data analysis, users with more than 100 daily operation records are preferentially selected as samples to ensure that the data quantity is sufficiently representative. Meanwhile, in the determination of the function preference weight set, the weight is dynamically adjusted according to the user's historical 30-day records to enhance the timeliness of the preference. For abnormal detection, context operation records are introduced as auxiliary judgment basis, such as combining login device information to confirm whether the abnormality is caused by device switching. In the construction of the behavior feature vector group, the mapping result is updated once a week to capture short-term changes in user habits.

[0082] In step S13, according to the user behavior feature vector group, the system's historical abnormal behavior archives are combined to match the user behavior pattern and give an initial score of abnormal risk, including:

[0083] According to the user behavior feature vector group, the geographic location change data, device switching frequency data, and operation frequency fluctuation data are analyzed to obtain the current behavior pattern;

[0084] According to the current behavior mode, a preset behavior mode and a risk score mapping relationship in the historical abnormal behavior archive are matched, and the abnormal risk initial score is given.

[0085] In an implementation manner, the step specifically comprises:

[0086] In a first step, according to the user behavior feature vector group, geographical position change data, device switching frequency data and operation frequency fluctuation data are analyzed to obtain a current behavior mode.

[0087] It should be noted that this step focuses on extracting dynamic behavior data directly related to account security from the user feature vector.

[0088] For example, the geographical position change data includes the deviation degree and change frequency of the current geographical position from the historical preferred position. Specifically, the login location preference (such as the resident city, the commonly used office / home network IP) of the user is obtained from the historical record, and the deviation degree and change frequency of the current geographical position from the historical preferred position are calculated by time period division.

[0089] The device switching frequency data includes whether the user's recent device switching behavior exceeds a preset switching threshold or deviates from the historical device type preference. Specifically, the user's recent device usage record is extracted, and whether the device switching behavior exceeds a preset switching threshold or deviates from the historical device type preference is analyzed.

[0090] The operation frequency fluctuation data includes whether the number of operations of the user within a unit time exists a sudden increase or is active in an irregular time period. Specifically, the operation record of the user is extracted, and whether the number of operations within a unit time exists a sudden increase or is active in an irregular time period (such as late at night) is analyzed.

[0091] By comprehensively analyzing the data of the three aspects, the current dynamic behavior mode of the user is obtained.

[0092] For example, the feature vector group data of the user B shows that the geographical position is changed from the resident city Beijing to an overseas city that has never been logged in, the device is switched from the commonly used mobile phone to a new model computer, and the operation frequency (such as online shopping and payment) reaches 5 times of the daily frequency. By integrating these information, the current behavior mode of "abroad, new device, and high-frequency transaction" is formed.

[0093] In a second step, according to the current behavior mode, a preset behavior mode and a risk score mapping relationship in the historical abnormal behavior archive are matched, and the abnormal risk initial score is given.

[0094] It's important to note that the "Historical Abnormal Behavior Archive" is a pre-established knowledge base containing numerous confirmed cases of fraud, account theft, and other risk events. Each case includes the behavioral pattern at the time of occurrence and the corresponding risk score. This archive is dynamically updated by continuously learning new risk cases. The "current behavior pattern" obtained in the first step is compared and matched with various "pre-set abnormal patterns" in the archive. The higher the similarity of the match, the higher the initial risk score assigned.

[0095] For example, User B's "remote location, new device, high-frequency trading" pattern closely matches (95% similarity) a typical pattern in the historical abnormal behavior archive: "account theft followed by resale of stolen goods remotely." This typical pattern has a preset risk score of 90 (out of 100) in the archive. Therefore, User B's behavior is assigned an initial abnormal risk score of 90. Users with normal behavior patterns, on the other hand, would receive a much lower risk score, such as 5.

[0096] In step S14, the login time distribution and the operation instruction sequence in the user behavior feature vector group are cross-validated to determine the specific level of abnormal risk, including:

[0097] For the login time distribution, by comparing it with the system's historical login time period pattern, obtaining an abnormality determination result of the login time distribution;

[0098] Comparing the operation instruction sequence with the historical operation instruction sequence of the system to obtain a consistency determination result of the operation instruction sequence;

[0099] The abnormality determination result and the consistency determination result are combined to perform cross-validation to determine the specific level of the abnormality risk.

[0100] In one implementation, this step specifically includes:

[0101] The first step is to compare the login time distribution with the system's historical login time period patterns to obtain an abnormality determination result of the login time distribution.

[0102] It's important to note that each user typically has a relatively fixed online activity schedule. "Historical login time patterns" are individual time profiles generated by the system based on long-term user behavior data. For example, a white-collar user's peak login times on weekdays are 9-11 a.m. and 8-10 p.m., while weekends are concentrated in the afternoon. The current login time is compared with this historical pattern.

[0103] For example, a user's initial anomaly risk score is 75, exceeding the first threshold of 60 points, triggering deep verification. The user's login occurred at 3:00 AM, but their historical login time patterns show they have never logged in during this time period in the past year. Furthermore, their late-night login frequency exceeds the preset "maximum once per week" threshold. Therefore, a "high confidence anomaly" is determined for their login time distribution.

[0104] In the second step, the operation instruction sequence is compared with the historical operation instruction sequence of the system to obtain a consistency determination result of the operation instruction sequence.

[0105] It should be noted that when a user performs a task (such as shopping or searching), the sequence of their steps is usually logical and habitual. The "historical operation sequence" is the typical operation process of the user completing various tasks recorded by the system.

[0106] For example, a user's shopping habit sequence is: login -> search for products -> browse details -> add to cart -> submit order -> pay. A sequence comparison algorithm compares the current user's sequence of operations with their historical habit sequence, calculating their degree of consistency. For example, in the aforementioned case, the system further analyzed the user's operation sequence at 3:00 AM and found that it was: login -> directly access the high-value product page -> immediately place an order and pay, without any searching, browsing, or comparison in between. This sequence's consistency score with their historical shopping habit sequence was only 20% (out of a maximum of 100%), far below the normal threshold of 80%. Therefore, the system determined that the user's operation sequence was "high-confidence inconsistency."

[0107] The third step is to combine the abnormality determination result and the consistency determination result to perform cross-validation to determine the specific level of the abnormality risk.

[0108] It should be noted that this step integrates the verification results of the above multiple dimensions through a preset decision matrix or rule engine to output the final risk level.

[0109] Exemplarily, the decision rules are as follows:

[0110] If the login time is "high confidence abnormal" and the instruction sequence is "high confidence inconsistent", the risk level is determined to be "high risk".

[0111] If the login time is "high confidence abnormal" or the instruction sequence is "high confidence inconsistent", the risk level is determined to be "medium risk".

[0112] In other cases, the risk level is "low risk".

[0113] In the above embodiment, since two high-confidence abnormal conditions are satisfied at the same time, the system ultimately determines that the specific level of abnormal risk is "high risk".

[0114] In step S15, according to the specific level of the abnormal risk, the authentication policy is matched from the preset authentication policy library to generate a targeted authentication process plan, including:

[0115] Filtering a set of authentication methods from the authentication policy library according to the specific level of the abnormal risk;

[0116] Sorting the authentication methods in the authentication method set based on the differences between the user behavior characteristics and the business scenarios, and determining the order of verification steps;

[0117] The authentication method set is bound to the verification step sequence to generate the targeted authentication process solution.

[0118] In one implementation, this step specifically includes:

[0119] The first step is to filter out a set of authentication methods from the authentication policy library according to the specific level of the abnormal risk.

[0120] It should be noted that the "Authentication Policy Library" is a pre-configured database that stores multiple authentication methods (such as static passwords, SMS dynamic passwords, email verification, biometrics (fingerprint / face), payment passwords, preset security questions, etc.) and policy templates of different security levels composed of these methods.

[0121] For example, for the "high-risk" level, the system will screen out combinations that include at least two strong authentication methods, such as "fingerprint recognition + SMS dynamic password + payment password"; for the "medium-risk" level, the system will screen out enhanced authentication combinations, such as "static password + SMS dynamic password"; for "low-risk" or no-risk users, the system will match the most convenient authentication method, such as "static password" or "seamless pass" on a trusted device.

[0122] For example, for users who are judged to be at a "high-risk" level, the system selects two alternative authentication method sets from the policy library: {fingerprint recognition, SMS dynamic password} and {face recognition, SMS dynamic password}.

[0123] In the second step, the authentication methods in the authentication method set are sorted based on the differences between the user behavior characteristics and the business scenarios, and the order of the verification steps is determined.

[0124] It should be noted that this step personalizes and contextualizes the authentication process, further enhancing the user experience. It analyzes user behavioral characteristics such as device capabilities, operating habits, and current business scenarios (e.g., small payments, large transfers).

[0125] Specifically, when analyzing user behavior, if the user's device supports biometrics and the user has a history of using it, biometric authentication will be prioritized. When considering business scenarios, if there are high-value scenarios such as large transfers, strong verification steps such as payment passwords will be added and performed earlier, even if the risk level is medium. For non-sensitive operations such as browsing and querying, the steps are simplified.

[0126] For example, in the above case, the system detects that the device currently used by the user supports facial recognition, and the user has historically had a high acceptance and fast response speed for facial recognition.

[0127] Therefore, in the set of {face recognition, SMS dynamic password}, ​​the system determines the order of verification steps as follows: the first step is face recognition, and the second step is SMS dynamic password verification.

[0128] The third step is to bind the authentication method set with the verification step sequence to generate the targeted authentication process solution.

[0129] It should be noted that this step solidifies the results of the first two steps into a complete, executable solution. It logically binds the selected authentication method and the determined verification sequence to form a structured process solution with specific steps, sequence, and required parameters.

[0130] In step S16, the targeted authentication process solution is sent to the device front end for execution, and the authentication execution result is determined, including:

[0131] According to the targeted authentication process scheme, dynamically adjust the interactive interface prompt content and verification time limit to generate the front-end authentication configuration;

[0132] Send the front-end authentication configuration to the authentication execution module at the front end of the device to obtain the user authentication link configuration that changes in real time;

[0133] According to the configuration of the user authentication link, the authentication data returned by the authentication execution module is extracted to determine the authentication execution result.

[0134] It should be noted that when refreshing the prompt content of the cross-system interaction interface in real time according to the generated targeted authentication process plan, adjusting the verification time limit, and generating the front-end authentication configuration, an adapted prompt content template is obtained from the pre-established interaction interface data, and the content is screened according to the characteristics of cross-system interaction to obtain a prompt content set that meets the verification time requirements.

[0135] Exemplarily, in an identity verification scenario, the system needs to complete the display of prompt information within a short time, and the interactive interface data stores multiple prompt templates, such as short prompts and detailed instructions. For a scenario in which the verification time is limited to 10 seconds, a short prompt template is preferentially selected, such as “Please enter the verification code”, rather than a lengthy “Please enter the 6-digit verification code received below to complete the verification”. When dynamically adjusting the prompt content set in combination with the time limit constraint, the allocation of verification time is optimized. Assuming that the total time limit of a verification link is 30 seconds, including prompt display and user input, the initial allocation is 5 seconds for prompt display and 25 seconds for user input. If it is found that the user reacts more slowly on some devices, the dynamic adjustment is made to 8 seconds for prompt display and 22 seconds for user input. If the time range after adjustment exceeds the preset threshold, such as the total time limit being not more than 35 seconds, the prompt display is compressed to 6 seconds to ensure that the overall time meets the requirements.

[0136] It should be noted that when the front-end authentication configuration is issued to the authentication execution module of the device front end, the real-time changed user authentication link configuration is obtained, the prompt content is bound with the time limit according to the verification time scheme, and is transmitted to the execution module of the device front end to obtain the real-time changed authentication link configuration.

[0137] Exemplarily, a user device front end receives a prompt content “Please enter the password” and a time limit of 10 seconds, and the execution module adjusts the display mode according to the current network state, such as preferentially loading a text prompt rather than an animation effect when the network delay is high, to ensure that the display is completed within the time limit. Subsequently, the system determines whether the configuration meets the verification mode update requirement, such as whether a temporary voice prompt needs to be added.

[0138] It should be noted that when the authentication data returned by the authentication execution module is extracted according to the user authentication link configuration, the authentication execution result is determined, the related data of authentication execution is extracted from the execution module for the authentication link after the configuration is changed, and the real-time refreshed interactive interface state is combined to obtain the final authentication result data.

[0139] Exemplarily, in a verification, the user completes password input within 5 seconds, records the input time length, the number of errors and the like, and combines the interactive interface state, such as whether an error prompt is displayed, to comprehensively analyze and obtain the authentication result data.

[0140] In order to facilitate the understanding of the present application, some preferred embodiments of the present application will be further described below.

[0141] In an implementation manner, the entire e-commerce cross-system authentication process is regarded as a closed-loop security verification system. The system aims to monitor user behavior in real time, dynamically adjust authentication strategies, and ensure e-commerce transaction security and user experience.

[0142] The working process is as follows:

[0143] Step 1: The e-commerce platform subsystem starts the user interaction process, and the data collection module starts working, collecting scattered data such as user login time distribution, device switching frequency, and geographic location changes in real time, and transmits it to the server.

[0144] Step 2: The server receives the initial set of user behavior records and uses a distributed data processing framework to clean and format the data, process incomplete records, and generate a standardized behavior data set.

[0145] Step 3: The server extracts features such as user interaction response speed, common function preferences, and abnormal operation ratio based on the standardized behavior dataset to construct a user behavior feature vector group.

[0146] Step 4: The server uses the user behavior feature vector group and combines it with historical abnormal behavior archives to analyze potential inconsistencies in user operations, such as geographic location changes and device switching frequency, and calculates an initial abnormality risk score.

[0147] Step 5: If the initial abnormal risk score exceeds the preset threshold, the server triggers the deep comparison module to perform multi-dimensional cross-validation on the login time distribution and operation instruction sequence in the user behavior feature vector group to determine the specific level of abnormal risk.

[0148] Step 6: The server calls the preset authentication policy library data based on the specific level of abnormal risk, dynamically matches the authentication method combination and verification step sequence, and generates a targeted authentication process plan.

[0149] Step 7: The server refreshes the prompt content of the cross-system interactive interface in real time based on the generated targeted authentication process plan, adjusts the verification time limit, and sends it to the device front-end authentication execution module to change the verification method of the user authentication link in real time and obtain the authentication execution result.

[0150] Step 8: The server records the authentication status based on the authentication execution result. If the authentication fails, the server further restricts the user's operation or notifies the security management personnel. If the authentication succeeds, the user is allowed to switch seamlessly between systems.

[0151] Through the above steps, e-commerce platforms can promptly detect and respond to abnormal user behavior, ensuring transaction security and user experience.

[0152] In order to issue the authentication process plan and execute the authentication, the following two implementation methods are provided:

[0153] In one embodiment, the server sends the targeted authentication process plan to the device front-end authentication execution module through a communication module configured on the server, and obtains the authentication execution result. Wherein, the communication module and the device front-end authentication execution module are pre-connected via a wired network.

[0154] In this implementation, a stable wired communication connection is pre-established between the server's communication module and the device's front-end authentication execution module. Once the server generates a targeted authentication process plan, the system immediately sends it to the device's front-end authentication execution module via the wired network, ensuring timely transmission of authentication configurations and reliable return of authentication results.

[0155] In another embodiment, the server sends the targeted authentication process solution to the device front-end authentication execution module through a communication module configured on the server, and obtains the authentication execution result. Wherein, the communication module and the device front-end authentication execution module have established a connection in advance through a wireless network.

[0156] In this implementation, a stable wireless communication connection is pre-established between the server's communication module and the device's front-end authentication execution module. Once the server generates a targeted authentication process plan, the system immediately transmits it to the device's front-end authentication execution module via the wireless network. This ensures flexible transmission of authentication configurations and real-time feedback of authentication execution results, adapting to the needs of mobile e-commerce scenarios.

[0157] In summary, the present invention discloses a cross-system seamless switching authentication method for e-commerce, including: obtaining user behavior data, processing it, and generating a user behavior data set; extracting user behavior features based on the user behavior data set, and constructing a user behavior feature vector group; matching user behavior patterns and assigning an initial abnormal risk score based on the user behavior feature vector group in combination with the system's historical abnormal behavior archives; if the initial abnormal risk score exceeds a preset first threshold, cross-validating the login time distribution and operation instruction sequence in the user behavior feature vector group to determine the specific level of abnormal risk; matching authentication policies from a preset authentication policy library based on the specific level of abnormal risk, and generating a targeted authentication process plan; sending the targeted authentication process plan to the device front end for execution, and determining the authentication execution result. The present invention solves the problems of low user experience and low security in the prior art caused by fixed authentication policies and the inability to dynamically perceive risks, through dynamic and accurate assessment of user operation risks and adaptive adjustment of authentication strength.

[0158] Reference Figure 2 The second embodiment of the present invention provides a cross-system seamless switching authentication device for e-commerce, comprising:

[0159] The data collection module is used to obtain user behavior data, process it, and generate a user behavior data set;

[0160] A feature construction module, configured to extract user behavior features and construct a user behavior feature vector group based on the user behavior dataset;

[0161] A risk assessment module is used to match user behavior patterns and assign an initial abnormal risk score based on the user behavior feature vector group and historical abnormal behavior archives;

[0162] a risk level judgment module, configured to cross-validate the login time distribution and operation instruction sequence in the user behavior feature vector group to determine a specific abnormal risk level if the initial abnormal risk score exceeds a preset first threshold;

[0163] An authentication decision module is used to match authentication policies from a preset authentication policy library according to the specific level of the abnormal risk and generate a targeted authentication process plan;

[0164] The authentication execution module is used to send the targeted authentication process plan to the device front end for execution and determine the authentication execution result.

[0165] It should be noted that the cross-system seamless switching authentication device for e-commerce provided in an embodiment of the present invention is used to execute all the process steps of the cross-system seamless switching authentication method for e-commerce in the above embodiment. The working principles and beneficial effects of the two correspond one to one, so they will not be repeated here.

[0166] An embodiment of the present invention further provides an electronic device. The electronic device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a cross-system seamless switching authentication program for e-commerce. When the processor executes the computer program, the steps in each of the above-mentioned embodiments of the cross-system seamless switching authentication method for e-commerce are implemented, such as Figure 1 Alternatively, when the processor executes the computer program, the functions of the modules / units in the above-mentioned device embodiments are realized, such as the data acquisition module.

[0167] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0168] The electronic device may be a computing device such as a desktop computer, notebook, PDA, or smart tablet. The electronic device may include, but is not limited to, a processor and memory. Those skilled in the art will appreciate that the aforementioned components are merely examples of electronic devices and do not constitute a limitation of the electronic device. The electronic device may include more or fewer components than those described above, or a combination of certain components, or different components. For example, the electronic device may also include input / output devices, network access devices, buses, and the like.

[0169] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor. The processor is the control center of the electronic device and connects various parts of the entire electronic device using various interfaces and lines.

[0170] The memory can be used to store the computer programs and / or modules. The processor implements the various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory and accessing the data stored in the memory. The memory may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function or an image playback function); the data storage area may store data generated based on the use of the mobile phone (such as audio data, a phone book, etc.). Furthermore, the memory may include high-speed random access memory and non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0171] If the module / unit integrated into the electronic device is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention can implement all or part of the process steps in the above-mentioned method embodiments by using a computer program to instruct the relevant hardware. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. It should be noted that the content of the computer-readable medium can be appropriately increased or decreased based on the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, based on legislation and patent practice, computer-readable media does not include electric carrier signals and telecommunication signals.

[0172] It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without inventive effort.

[0173] The specific embodiments described above further illustrate the objectives, technical solutions, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A cross-system seamless switching authentication method for e-commerce, characterized in that: Executed by a computer, including: Obtain user behavior data, process it, and generate a user behavior data set; Extracting user behavior features based on the user behavior dataset and constructing a user behavior feature vector group; Based on the user behavior feature vector group and in combination with the system's historical abnormal behavior archive, the user behavior pattern is matched and an initial abnormal risk score is assigned; If the initial abnormal risk score exceeds a preset first threshold, cross-validating the login time distribution and operation instruction sequence in the user behavior feature vector group to determine a specific abnormal risk level; According to the specific level of abnormal risk, matching authentication strategies from the preset authentication strategy library to generate targeted authentication process solutions; Send the targeted authentication process plan to the device front end for execution and determine the authentication execution result; The process of matching user behavior patterns and assigning an initial abnormal risk score based on the user behavior feature vector group and the system's historical abnormal behavior archives includes: Analyzing the geographic location change data, device switching frequency data, and operation frequency fluctuation data in the user behavior feature vector group to obtain a current behavior pattern; According to the current behavior pattern, a mapping relationship between the behavior pattern and the risk score preset in the historical abnormal behavior archive is matched, and an initial abnormal risk score is assigned; The cross-validation of the login time distribution and the operation instruction sequence in the user behavior feature vector group to determine the specific level of abnormal risk includes: For the login time distribution, by comparing it with the system's historical login time period pattern, obtaining an abnormality determination result of the login time distribution; Comparing the operation instruction sequence with the historical operation instruction sequence of the system to obtain a consistency determination result of the operation instruction sequence; The abnormality determination result and the consistency determination result are combined to perform cross-validation to determine the specific level of the abnormality risk.

2. The cross-system seamless switching authentication method for e-commerce according to claim 1 is characterized in that: The obtaining of user behavior data and processing thereof to generate a user behavior data set includes: Collect user login time distribution data, device switching frequency data, and geographic location change data in real time, set a unique identifier for each type of data, and obtain the initial user behavior record set; Extracting the user identifier and the operation instruction record of the login time distribution data from the initial user behavior record set, and performing missing value completion and format standardization to generate a cleaned user behavior record set; Automatically mark abnormalities and perform corrections on data in the cleaned user behavior record set where the timestamp corresponding to the user identifier does not match the data source, thereby obtaining a verified user behavior record set; According to the verified user behavior record set, the device switching frequency data and the geographic location change data are standardized and fused to obtain the user behavior data set.

3. The cross-system seamless switching authentication method for e-commerce according to claim 1 is characterized in that: The step of extracting user behavior features and constructing a user behavior feature vector group based on the user behavior dataset includes: Extracting user interaction response speed, common function preferences, and abnormal operation ratio as user behavior features based on the user behavior dataset; Grouping and layering the extracted user behavior features to obtain quantitative feature indicators; The quantitative feature indicators are mapped into multiple dimensions to construct the user behavior feature vector group.

4. The cross-system seamless switching authentication method for e-commerce according to claim 1 is characterized in that: According to the specific level of the abnormal risk, matching the authentication policy from the preset authentication policy library to generate a targeted authentication process solution includes: Filtering a set of authentication methods from the authentication policy library according to the specific level of the abnormal risk; Sorting the authentication methods in the authentication method set based on the differences between the user behavior characteristics and the business scenarios, and determining the order of verification steps; The authentication method set is bound to the verification step sequence to generate the targeted authentication process solution.

5. The cross-system seamless switching authentication method for e-commerce according to claim 1 is characterized in that: The step of sending the targeted authentication process solution to the device front end for execution and determining the authentication execution result includes: According to the targeted authentication process scheme, dynamically adjust the interactive interface prompt content and verification time limit to generate the front-end authentication configuration; Send the front-end authentication configuration to the authentication execution module at the front end of the device to obtain the user authentication link configuration that changes in real time; According to the configuration of the user authentication link, the authentication data returned by the authentication execution module is extracted to determine the authentication execution result.

6. A cross-system seamless switching authentication device for e-commerce, used to implement the cross-system seamless switching authentication method for e-commerce as claimed in any one of claims 1 to 5, characterized in that: include: The data collection module is used to obtain user behavior data, process it, and generate a user behavior data set; A feature construction module, configured to extract user behavior features and construct a user behavior feature vector group based on the user behavior dataset; A risk assessment module is used to match user behavior patterns and assign an initial abnormal risk score based on the user behavior feature vector group and historical abnormal behavior archives; a risk level judgment module, configured to cross-validate the login time distribution and operation instruction sequence in the user behavior feature vector group to determine a specific abnormal risk level if the initial abnormal risk score exceeds a preset first threshold; An authentication decision module is used to match authentication policies from a preset authentication policy library according to the specific level of the abnormal risk and generate a targeted authentication process plan; The authentication execution module is used to send the targeted authentication process plan to the device front end for execution and determine the authentication execution result.

7. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the cross-system seamless switching authentication method for e-commerce as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the cross-system seamless switching authentication method for e-commerce according to any one of claims 1 to 5.

Images