Identity verification method and device, electronic equipment and computer program product

Abstract

The invention discloses an identity verification method and device, electronic equipment and a computer program product, and relates to the computer technology, and the method comprises the steps: obtaining at least two private information pairs according to a user identifier when a triggering operation of a preset service identifier is received, and each private information pair comprises a private problem and verification information corresponding to the private problem; fragmenting the verification information corresponding to each private question to obtain a plurality of verification fragments; dynamically combining the private questions corresponding to each verification fragment to generate at least two verification questions; and obtaining verification information corresponding to the at least two verification questions, and when the at least two pieces of verification information pass all verification, passing identity verification so as to execute a service operation corresponding to the preset service identifier for the user. According to the method and the device, the complexity of acquiring the complete and effective identity information of the user by an attacker can be increased, the account security of the user can be more effectively protected, and the beneficial effects of improving the identity verification security and reducing the user loss are achieved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an authentication method, device, electronic device, and computer program product. Background Technology

[0002] With the rapid development of information technology, the effective protection of user accounts has always been a key research area. Currently, the mainstream account protection methods rely on identity verification, and conventional verification methods mainly include digital credentials such as account passwords and mobile phone verification codes, or biometric features such as facial recognition.

[0003] Traditional identity verification methods typically check the accuracy of the user's submitted account and password in the background and verify the SMS verification code to confirm the user's legitimacy. However, once the account and password are stolen by an attacker, the attacker can use the stolen credentials to log into the account and directly obtain the SMS verification code from the user's mobile phone, thereby carrying out subsequent malicious operations. Existing identity verification schemes suffer from low security performance, leading to user losses. Summary of the Invention

[0004] This application provides an authentication method, apparatus, electronic device, and computer program product that can significantly improve the security of authentication.

[0005] Firstly, this application provides an authentication method, including:

[0006] Upon receiving a trigger operation based on a preset service identifier, at least two pairs of private information are obtained based on the user identifier. Each pair of private information includes a private question and verification information corresponding to the private question. The verification information corresponding to each private question is fragmented to obtain multiple verification fragments. The private questions corresponding to each verification fragment are dynamically combined to generate at least two verification questions. The verification information corresponding to at least two verification questions is obtained. Identity verification is successful when all at least two verification information passes verification, thereby enabling the execution of the service operation corresponding to the preset service identifier for the user.

[0007] Secondly, this application provides an authentication device, the device comprising:

[0008] The information acquisition module is used to acquire at least two private information pairs based on the user identifier when a trigger operation of a preset business identifier is received. Each private information pair includes a private question and verification information corresponding to the private question.

[0009] The fragmentation module is used to fragment the verification information corresponding to each of the privacy questions to obtain multiple verification fragments;

[0010] The question generation module is used to dynamically combine the private questions corresponding to each of the verification fragments to generate at least two verification questions.

[0011] The authentication module is used to obtain authentication information corresponding to at least two of the authentication questions, and to perform the business operation corresponding to the preset business identifier for the user when all at least two of the authentication information are verified.

[0012] Thirdly, this application also provides an electronic device, the electronic device comprising:

[0013] At least one processor; and

[0014] A memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the authentication method described in any embodiment of this application.

[0016] Fourthly, this application also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the authentication method described in any embodiment of this application.

[0017] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the authentication method described in any embodiment of this application.

[0018] The authentication scheme provided in this application, upon receiving a trigger operation based on a preset business identifier, first obtains at least two pairs of private information based on the user identifier. Each pair includes a private question and corresponding verification information. Then, by fragmenting the verification information corresponding to each private question to obtain multiple verification fragments, the scheme avoids exposing the user's complete private information. Even if an attacker obtains partial verification fragments, they cannot directly reconstruct the complete verification information, increasing the difficulty of cracking the verification information. Furthermore, by dynamically combining the private questions corresponding to each verification fragment to generate at least two verification questions, the user does not need to repeatedly expose the same private question or complete verification information, reducing the risk of private information leakage. Finally, by obtaining the verification information corresponding to at least two verification questions, authentication is successful when all at least two verification questions are verified, allowing the user to execute the business operation corresponding to the preset business identifier. This significantly improves the security of authentication, thereby reducing user losses. The scheme provided in this embodiment increases the complexity for attackers to obtain complete and valid user identity information, thus more effectively protecting user account security when a preset business operation is detected, achieving the beneficial effects of improving authentication security and reducing user losses.

[0019] It should be noted that the aforementioned computer instructions may be stored, in whole or in part, on a computer-readable storage medium. This computer-readable storage medium may be packaged together with the processor of the authentication device, or it may be packaged separately from the processor of the authentication device; this application does not impose any limitations on this.

[0020] The descriptions of the second, third, fourth, and fifth aspects in this application can be referenced to the detailed description of the first aspect; and the beneficial effects of the descriptions of the second, third, fourth, and fifth aspects can be referenced to the analysis of the beneficial effects of the first aspect, which will not be repeated here.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description.

[0022] It is understood that before using the technical solutions disclosed in the various embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained. Attached Figure Description

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 This is a flowchart illustrating an authentication method provided in an embodiment of this application;

[0025] Figure 2 This is another flowchart illustrating the authentication method provided in the embodiments of this application;

[0026] Figure 3 This is a schematic diagram of the structure of the authentication device provided in an embodiment of this application;

[0027] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions of the present application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present application, not the entire structure.

[0031] Figure 1 This is a flowchart illustrating an authentication method provided in an embodiment of this application. This embodiment is applicable to user authentication in the financial sector for business operations with high security requirements. The method can be executed by an authentication device, which can be implemented in hardware or software and integrated into the electronic device executing the method. Preferably, the electronic device in this embodiment can be a server, or a computer device, etc.

[0032] refer to Figure 1 The authentication method in this embodiment includes, but is not limited to, the following steps:

[0033] S110. When a trigger operation is received from a preset service identifier, at least two private information pairs are obtained based on the user identifier. Each private information pair includes a private question and the verification information corresponding to the private question.

[0034] Before explaining the corresponding embodiments of this solution, it is necessary to first describe the specific application scenario of this solution. In the financial field, when a user accesses an account system through a financial application, they will first enter the system's login interface (first interface). The login interface provides the user with options such as account and password verification, account and SMS verification code verification, or facial recognition verification. After successful verification on the login interface, the user proceeds to the second stage. The account and password verification on the first interface is completed based on the system's backend database by querying the database. If the account and password verification fails in the backend database, it is handled according to the conventional "password retrieval" method. The aforementioned financial application can be implemented through a smart terminal, such as mobile banking; it can also be implemented on a personal computer via a web address. The specific implementation method of the financial application is not limited here.

[0035] In the second stage, users can perform routine operations, such as account inquiries, product browsing, and bill payments in mobile banking. They may also perform important operations like fund transfers and password changes. When a user performs an operation in the second stage, the system identifies the importance of the operation based on the triggered business identifier. If the current business identifier matches a preset business identifier, the system executes the identity verification operation provided in this embodiment to further verify the user's identity under the preset business identifier, thereby protecting the user's assets.

[0036] For example, the aforementioned preset business identifiers can be transfer identifiers, password modification identifiers, investment or redemption identifiers for wealth management products, etc. Specific preset business identifiers are not limited here and can be set by the user. That is, in the financial field, whether the current business operation is an important operation can be personalized by the user according to their individual needs.

[0037] Optionally, when the transfer identifier is determined to be a preset business identifier, a preset transfer amount can be further set, such as 1,000 yuan. That is, when a user is detected to be making a transfer operation and the transfer amount is not less than 1,000 yuan, the identity verification scheme provided in this embodiment is executed; if it is less than 1,000 yuan, the verification can be performed based on the traditional identity verification method for making a transfer.

[0038] The aforementioned user identifier is used to uniquely identify system users and is usually the mobile phone number or ID card number provided by the user when registering an account.

[0039] A private information pair is a binary tuple consisting of a private question and a corresponding verification message, used for user authentication. The private question is typically an authentication question whose answer is known only to the user, while the verification message is the correct answer to the verification question.

[0040] The aforementioned private information was obtained during the user's account registration process. Specifically, when a user uses the account system for the first time, they must register, including setting an account, password, private information, and corresponding verification information. This registration information is stored in the system's backend database for subsequent verification.

[0041] The aforementioned private information is generated based on the user's personal information, and the verification information corresponding to each piece of private information is also entered and bound by the user based on their personal information.

[0042] For example, the private information and corresponding verification information provided in this embodiment may include various information types, such as personal education information, personal work information, personal family information, personal dietary habits, personal hobbies and other personal information.

[0043] For example, personal education information may include: full name of primary school - Beijing Chaoyang District No.1 Primary School; full name of junior high school - Beijing Chaoyang District No.2 Middle School; full name of university - Beijing No.3 University; personal work information may include: month and year of starting work - July 2018; first job position - sales consultant; city of birth - Shanghai; personal family information may include: mother's surname - Li; best friend's name - Zhang San; pet's name - Zhaocai, etc.; personal dietary habits may include: favorite fruit - apple; personal hobbies may include: favorite ball sport - basketball; other personal information may include: vehicle brand and model - Toyota Corolla, etc. While the private information provided by different users may be the same, the corresponding verification information will differ for each user, and the information filled in during the actual registration phase shall prevail.

[0044] Optionally, when presenting questions to users, this solution displays an optional set of questions, which includes various information types. Users can select at least a preset number of questions (e.g., 5) that they can answer based on their own circumstances, and finally submit and save the selected and answered questions.

[0045] S120. Fragment the verification information corresponding to each private question to obtain multiple verification fragments.

[0046] Fragmentation processing involves splitting complete verification information (such as the answer) into multiple independent data fragments (fragments). Each fragment does not contain complete semantics, and individual fragments cannot reconstruct the original information.

[0047] Verification fragments are independent data units generated after fragmentation. They typically contain some verification information or its transformed form and must be combined in whole or in part before they can be used for identity verification.

[0048] The purpose of fragmenting the verification information corresponding to each privacy question in this embodiment is to avoid the exposure of the user's complete privacy information, and even if the attacker obtains some verification fragments, he will not be able to directly restore the complete verification information, thus increasing the difficulty of cracking the verification information.

[0049] For example, this embodiment demonstrates how multiple verification fragments are obtained after fragmenting the verification information corresponding to each privacy question in step S110. For instance, the full name of the primary school, "Beijing Chaoyang District No. 1 Primary School," can be fragmented to obtain verification fragment 1, "Beijing Chaoyang District No. 1 Primary School"; the month and year of starting work, "July 2018," can be fragmented to obtain verification fragment 2, "2018" and verification fragment 3, "July"; the birth city, "Shanghai," can be fragmented to obtain verification fragment 5, "Shang" and verification fragment 6, "Hai"; the mother's surname, "Li," can be fragmented to obtain verification fragment 7, "Li"; and the vehicle brand and model, "Toyota Corolla," can be fragmented to obtain verification fragment 8, "Toyota," and verification fragment 9, "Corolla," etc. The specific verification fragments corresponding to each piece of verification information are not listed here.

[0050] S130. Dynamically combine the private questions corresponding to each verification fragment to generate at least two verification questions.

[0051] The above verification questions are the unanswered questions presented to users after system improvements.

[0052] Based on step S120, all verification fragments related to the user have been obtained. Further, a mapping relationship between verification fragments and private questions can be established to generate verification questions related to the verification fragments based on the current mapping relationship.

[0053] For example, taking the private question corresponding to the verification fragment "above" as the birth city "Shanghai" as an example, verification sub-question 1, "The first character corresponding to the birth city", or "The capital letter corresponding to the birth city" can be generated; taking the private question corresponding to the verification fragment "Corolla" as the model in "vehicle brand and model" as an example, verification sub-question 2, "The model of your vehicle" can be generated; taking the private question corresponding to the verification fragment "Li" as the mother's surname as an example, verification sub-question 3, "Your mother's surname" or "The capital letter corresponding to your mother's surname" can be generated; taking the private question corresponding to the verification fragment "July" as the month in "month of starting work" as an example, verification sub-question 4, "The month when you started work" can be generated; the corresponding verification sub-questions specifically generated from the private questions corresponding to each verification fragment are not listed one by one here.

[0054] Furthermore, the verification sub-questions can be dynamically combined to obtain verification questions. Based on the above examples, for example, "The capital letter corresponding to the birth city" in verification sub-question 1 and verification sub-question 2 can be combined to obtain verification question 1, "Please provide the capital letter corresponding to your birth city and the model of your vehicle"; "Your mother's surname" in verification sub-question 3 and verification sub-question 4, "The month when you started work" can be combined to obtain verification question 2, "Please provide your mother's surname and the month when you started work"; "Your mother's surname" in verification sub-question 3 and "The first character corresponding to the birth city" in verification sub-question 1 can also be combined to obtain verification question 3, "Please provide your mother's surname and the first character corresponding to the birth city", etc. The specific verification questions that can be obtained are not listed one by one here.

[0055] It should be noted that in this embodiment, each verification question includes at least two verification sub-questions corresponding to verification fragments, and when the arrangement methods corresponding to each verification sub-question are different, the required verification information is also different.

[0056] Optionally, the verification information provided to the user in this embodiment includes at least two, preferably a preset quantity, such as 5. Then the system can perform a generation operation on the private questions corresponding to each verification fragment based on the preset quantity, without generating corresponding private sub-questions for all verification fragments, reducing the system workload.

[0057] S140. Obtain the verification information corresponding to at least two verification questions. When all the at least two verification information are verified successfully, the identity verification is passed, and perform the service operation corresponding to the preset service identifier for the user.

[0058] Before obtaining the verification information corresponding to at least two verification questions, the system has pre-prepared corresponding standard information based on the generated at least two verification questions. After displaying at least two verification questions to the user, the system obtains the corresponding verification information provided by the user on the visual interface based on each verification question. The system then performs identity verification based on the verification information and the pre-stored standard information. When all at least two verification questions are verified, the user's identity is confirmed, indicating that the user's identity has been verified. This allows the system to provide the user with business operations corresponding to the preset business identifier, such as allowing the user to continue with transfer transactions, thereby protecting the user's property security.

[0059] For example, in the S130 example above, verification question 1, "Please provide the first capital letter of your birth city and your vehicle model", the corresponding verification information is "S Corolla"; verification question 2, "Please provide your mother's surname and the month you started working", the corresponding verification information is "Li July"; verification question 3, "Please provide your mother's surname and the first character of your birth city", the corresponding verification information is "Li Shang", etc.

[0060] In another preferred embodiment, the private information pair includes at least one dynamic information pair; the at least one dynamic information pair includes a dynamic question and verification information corresponding to the dynamic question.

[0061] Dynamic information pairs can be understood as allowing users to adjust and modify the answers to relevant questions based on changes in the actual situation to meet the latest requirements. Consequently, the adjusted questions and answers will be updated in the database, where these questions and answers will be recorded and associated with the account for subsequent authentication of the legitimacy of user account operations.

[0062] Correspondingly, in this embodiment, the private information pair also includes at least one static information pair; the at least one static information pair includes a static question and the verification information corresponding to the static question.

[0063] Specifically, static information pairs are unambiguous verification information corresponding to static questions. This information is generally fixed and does not change over a long period. It can be based on an individual's inherent attributes, which can be composed of various aspects, such as birth information, education information, work information, marital status information, and so on. Since this content, once formed, normally does not change, it can be considered a static information pair. Dynamic information pairs, on the other hand, are uncertain and strongly correlated with the user. The verification information corresponding to dynamic questions changes over time or due to human factors, but this change is within the user's control. Examples include personal dietary habits, sports preferences, favorite celebrities, and preferred movies and TV shows—information with personal emotional connotations. This information changes dynamically with personal growth or time, but remains connected to the individual and is not independent of them; therefore, it can be considered a dynamic information pair.

[0064] Therefore, the solution provided in this embodiment may also include the following operations: receiving an update operation on the verification information corresponding to the target dynamic problem, and obtaining updated verification information; mapping and storing the target dynamic problem and the corresponding updated verification information as update information.

[0065] The triggering condition for updating the dynamic information mentioned above could be that the second step of logging into the financial application includes a dynamic information update service. In this case, the user can actively initiate an update request or the system can periodically force an update (such as every 90 days) to further improve the security of identity verification.

[0066] For example, among the various types of private information in step S120, such as personal education information, personal work information, personal family information, personal dietary habits, personal hobbies, and other personal information, personal dietary habits, personal hobbies, and other personal information can be treated as dynamic information, that is, the user can modify the verification information corresponding to this type of information.

[0067] For example, in personal hobbies, if the target dynamic question is a favorite ball sport and the corresponding original verification information is basketball, when the user's recently favorite ball sport is updated to badminton, the updated verification information corresponding to the favorite ball sport can be obtained as badminton. The favorite ball sport - badminton - can be further mapped and stored in the system as updated information, so that it can be applied to the verification operation when executing the identity verification scheme provided in this embodiment.

[0068] The authentication method provided in this application, upon receiving a trigger operation based on a preset business identifier, first obtains at least two pairs of private information based on the user identifier. Each pair includes a private question and corresponding verification information. Then, by fragmenting the verification information corresponding to each private question to obtain multiple verification fragments, the method avoids the exposure of the user's complete private information. Even if an attacker obtains partial verification fragments, they cannot directly reconstruct the complete verification information, increasing the difficulty of cracking the verification information. Furthermore, by dynamically combining the private questions corresponding to each verification fragment to generate at least two verification questions, the user does not need to repeatedly expose the same private question or complete verification information, reducing the risk of private information leakage. Finally, by obtaining the verification information corresponding to at least two verification questions, authentication is successful when all at least two verification information passes verification, allowing the user to execute the business operation corresponding to the preset business identifier. This significantly improves the security of authentication, thereby reducing user losses. The solution provided in this embodiment increases the complexity for attackers to obtain complete and valid user identity information, thus more effectively protecting user account security when a preset business operation is detected, achieving the beneficial effects of improving authentication security and reducing user losses.

[0069] Figure 2 This is another flowchart illustrating the identity verification method provided in this application embodiment. This application embodiment is an optimization based on the above embodiments. Specifically, the optimization is as follows: the process of "fragmenting the verification information corresponding to each private question to obtain multiple verification fragments" in the above embodiments, and the implementation process of "dynamically combining the private questions corresponding to each verification fragment to generate at least two verification questions" in the above embodiments are explained in detail.

[0070] See Figure 2 The authentication method in this embodiment includes, but is not limited to, the following steps:

[0071] S210. When a trigger operation is received from a preset service identifier, at least two private information pairs are obtained based on the user identifier. Each private information pair includes a private question and the verification information corresponding to the private question.

[0072] S220. Fragment the verification information corresponding to each privacy question to obtain multiple fragment fields.

[0073] In this embodiment, the verification information corresponding to each privacy question is fragmented to obtain multiple fragment fields. The solution is essentially to decompose the complete verification information into multiple independent sub-fragments (i.e. fragment fields) without complete semantics through preset rules, and a single fragment cannot restore the original verification information.

[0074] Specifically, when fragmenting the verification information corresponding to each privacy question, the specific processing method depends on the corresponding privacy question. For example, if the privacy question is the full name of the primary school - Chaoyang District No. 1 Primary School, the fragmented field obtained after fragmentation is "Chaoyang District Experimental Primary School"; if the privacy question is the vehicle brand and model - Toyota Corolla, the fragmentation can obtain two fields: "brand" and "model", namely "Toyota" and "Corolla"; if the privacy question is the place of birth "Shanghai", there are no specific requirements for the corresponding privacy question, so it can be fragmented into the smallest unit "Shang" and "Hai", etc.

[0075] In this embodiment, multiple fragment fields are sets of fragment fields obtained after fragmenting the verification information corresponding to all privacy questions.

[0076] S221. Extract fragments from multiple fragment fields based on preset extraction rules to obtain multiple verification fragments.

[0077] Since the fragment field set contains a massive number of fragment fields, using all of them as verification fragments would result in a large workload for the system when determining the corresponding verification sub-questions based on these fragments, and a huge workload for users answering the verification questions, leading to time-consuming authentication. Therefore, this embodiment sets a preset extraction rule to extract fragments that meet the requirements as verification fragments, thereby making the subsequently generated verification questions random, ensuring the security of authentication, and increasing the difficulty for attackers.

[0078] The aforementioned preset extraction rules can be based on the number of fragment fields, such as extracting 5, or they can be based on the analysis of the attribute type of the field to obtain a verification field that is a combination of numbers, letters and / or text. The specific preset extraction rules are not limited here.

[0079] In a preferred implementation, the solution provided in this embodiment may further include the following operations when performing step S221:

[0080] Perform sensitivity analysis on each privacy issue to obtain the field type, which must include at least low-frequency fields.

[0081] For example, frequently accessed data such as birth city, mother's surname, and education information—information that accompanies a user throughout their life—can be identified as high-frequency fields. Meanwhile, information that can be modified as a user grows, such as friends' names, first car brand, pet name, and personal interests, can be identified as low-frequency fields. The purpose of identifying low-frequency fields in this embodiment is that, since these low-frequency fields are generated based on user personalization, using the corresponding low-frequency fragments as verification fragments can effectively improve the security of user authentication.

[0082] Another preferred implementation method is as follows: Specifically, step S221 can be implemented through the following operations:

[0083] Determine fragment extraction constraints; based on these constraints, extract fragments from multiple fragment fields to obtain multiple verification fragments.

[0084] The preset extraction rules in this embodiment are based on fragment extraction constraints. Specifically, the fragment extraction constraints in this embodiment include that each verification question includes at least two fragment fields, fragment fields corresponding to the same private question do not coexist in the same verification question, and a verification question includes at least one low-frequency fragment corresponding to a low-frequency field.

[0085] The purpose of including at least two fragmented fields in each of the above verification questions is to increase the difficulty of identity verification. The fragmented fields corresponding to the same private question do not coexist in the same verification question. This can be understood as follows: for the month and year of starting work - July 2018, the corresponding fragments are "2018" and "July". These two fragments will not appear in the answer to the same verification question. The purpose of including at least one low-frequency field corresponding to a low-frequency fragment is to increase the difficulty of information verification and prevent malicious attacks.

[0086] Based on the solution provided in this embodiment, fragments can be extracted from multiple fragment fields to use the extracted fragments that satisfy the fragment extraction constraints as verification fragments. When there are a large number of fragment fields that satisfy the fragment extraction constraints, a certain number of fragments can be randomly selected from the fragment fields that satisfy the fragment extraction constraints as verification fragments using a random number method.

[0087] S230. Analyze the attribute features of each verification fragment in the corresponding private question. The attribute features include field features or position features.

[0088] Field features are used to represent the features that the current verification fragment can be decomposed in the corresponding private question; position features are used to represent the features that the current fragment can be represented by position information in the corresponding private question, such as the first letter, first character, second character, or last character.

[0089] To further illustrate using the aforementioned examples, for fragments "2018" and "July", the field features in the corresponding private questions can be understood as the time of starting work, specifically the year and month features in the time of starting work, respectively; for fragments "Toyota" and "Corolla", the field features in the corresponding private questions can be understood as the brand and model features, respectively; for fragments "Shanghai" and "Hai", the positional features in the corresponding private questions can include the capitalized first letter of the birth city, the first character of the birth city, and the last character of the birth city, etc.

[0090] S231. Generate a private sub-question for each verification fragment based on field features or location features.

[0091] In this embodiment, a verification problem contains at least two verification fragments.

[0092] This generates private sub-questions for each verification fragment, such as "Please answer the year you started working", "Please answer the month you started working", "Please answer the brand of your vehicle", "Please answer the model of your vehicle", "Please answer the first character of your birth city", and "Please answer the last character of your birth city".

[0093] S232. Generate verification questions by performing natural language conversion on the private sub-problems corresponding to at least two verification fragments in the order of the rules.

[0094] The order of the rules described above indicates the concatenation order of at least two private subproblems. Different concatenation orders will result in different verification information.

[0095] For example, taking two private sub-questions as private sub-question 1 "Please answer the month you started working" and private sub-question 2 "Please answer the first character of your birth city", if they are concatenated in the order of the current number, the resulting concatenated question is "Please answer the month you started working, please answer the first character of your birth city". Based on this, natural language processing is required to concatenate the question so that the user can clearly understand the question to be answered. The verification question generated after further natural language processing can be "Please answer the month you started working and please answer the first character of your birth city".

[0096] S240. Obtain verification information corresponding to at least two verification questions. When all at least two verification questions are verified, the identity verification is successful, and the business operation corresponding to the preset business identifier is executed for the user.

[0097] Optionally, before obtaining the verification information, the solution provided in this embodiment can also explain the format for filling in the verification information required for each verification question, so that users can fill in the correct verification information under the corresponding verification question according to the format instructions, thereby improving the efficiency of identity verification.

[0098] For example, in step S232 above, the verification question is "Please answer the month you started working and the first letter of your birth city," with the prompt "Fill in one number, letter, or Chinese character in each parenthesis." The visualization interface then displays ( ) ( ). The user fills in the verification information (7) (above) according to the prompt. Another example is the verification question "Please provide the first capital letter of your birth city and your vehicle model," with the prompt "Fill in one number, letter, or Chinese character in each parenthesis." The visualization interface then displays ( ) ( ) ( ) ( ). The user fills in the verification information (S) ( ) ( ) ( ) ( ) ( ) ( ). The specific number of parentheses displayed in the visualization interface is related to the number of characters required for the correct verification information corresponding to the current verification question.

[0099] In a possible scenario where the verification information corresponding to any of the aforementioned verification questions fails verification, the solution provided in this embodiment may also execute the following steps a) to c):

[0100] a) Redirect from the current identity verification interface to the identity lock interface, where at least two pieces of private information are obtained based on the user identifier.

[0101] After the user answers the verification information corresponding to at least two verification questions, the system will perform sequential verification according to the sequence identifier corresponding to each verification question. If the system detects that the verification information corresponding to any verification question fails, it can trigger the identity lock interface to further verify the user's identity.

[0102] It should be noted that the identity lock interface is only used for further verification of the user's identity on the basis of login authentication. The current verification level is lower than the verification operation when the preset business identifier is received in this embodiment. The purpose of this is to continue to provide corresponding services when the user needs to perform non-critical operations in mobile banking, so as not to affect the user experience while protecting the user's property security.

[0103] Therefore, in the identity lock interface, at least two pieces of private information are obtained based on the user identifier. The current private information is the complete information filled in by the user when registering the account, such as "the full name of your primary school", "the month and year you started working", "the job title of your first job", "the name of your best friend", etc.

[0104] The questions displayed on the identity lock screen are retrieved from the database based on the account. The rules for displaying the questions can be set by the system administrator. For example, it can be set to display all the questions filled in by the user during registration, or it can be set to display a fixed number of random questions, or it can be set to display related questions according to the type of personal information.

[0105] b) Obtain the verification information corresponding to each private information. When all verification information corresponding to at least two private information passes the verification, jump from the identity lock interface to the business display interface. In the business display interface, repeatedly execute the operation of obtaining at least two private information pairs based on the user identifier when the trigger operation of the preset business identifier is received.

[0106] Users answer corresponding questions based on private information consistent with their registration information to obtain verification information for each piece of private information. Upon successful verification, users are redirected to a business display interface where they can perform non-critical operations such as account inquiries, product browsing, and payment. When a critical operation such as fund transfer or payment password modification is detected, a trigger operation based on a preset business identifier is received to repeatedly execute the identity verification scheme provided in this embodiment.

[0107] c) If the verification information corresponding to any private information fails to pass verification, the identity lock interface is locked for a preset time and then the operation of obtaining at least two private information based on the user identifier is repeated on the identity lock interface.

[0108] If a user fails to verify any of the verification messages for their private information, it could be due to forgetting the answers or making a careless mistake. In such cases, the user must wait for a period of time (e.g., 10 minutes) before attempting to unlock again. Once the user correctly answers all the verification messages for their private information, their account is successfully unlocked. If the number of failed verifications exceeds a certain limit (e.g., 3 times), further verification is not possible, and the user must wait for a period of time (e.g., 10 minutes) before attempting to unlock again.

[0109] Another possible scenario is that a user fails to unlock their identity after a preset number of verification attempts (e.g., three). To address this, the solution provided in this embodiment also includes a privacy information reset mechanism. The specific methods for resetting privacy information can be either offline at a service center or online via biometric authentication. For offline reset, the user must personally visit a relevant service center with valid identification. After authorization by the service center staff, the user can re-enter their privacy information verification details. For online biometric authentication reset, the terminal's visual device, such as a camera, is used to receive a series of user actions based on interface prompts (e.g., opening their mouth, blinking, turning their head left and right). Image analysis confirms the user's identity, and a privacy information reset interface is provided where the user can re-enter their privacy information verification details. The specific method for resetting privacy information is not limited here and depends on the user's actual needs.

[0110] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data comply with the relevant laws, regulations and standards of the relevant regions.

[0111] The authentication method provided in this embodiment, upon receiving a trigger operation based on a preset business identifier, first obtains at least two pairs of private information based on the user identifier. Each pair includes a private question and corresponding verification information. Then, by fragmenting the verification information corresponding to each private question to obtain multiple verification fragments, the complete user's private information is avoided from being exposed. Even if an attacker obtains partial verification fragments, they cannot directly reconstruct the complete verification information, increasing the difficulty of cracking the verification information. Next, by dynamically combining the private questions corresponding to each verification fragment to generate at least two verification questions, the user does not need to repeatedly expose the same private question or complete verification information, reducing the risk of private information leakage. Finally, by obtaining the verification information corresponding to at least two verification questions, authentication is successful when all at least two verification information passes verification, allowing the user to execute the business operation corresponding to the preset business identifier. This significantly improves the security of authentication, thereby reducing user losses. The solution provided in this embodiment increases the complexity for attackers to obtain complete and valid user identity information, thus more effectively protecting user account security when a preset business operation is detected, achieving the beneficial effects of improving authentication security and reducing user losses.

[0112] Figure 3 This is a schematic diagram of an authentication device provided in an embodiment of this application. This device is suitable for executing the authentication method provided in the embodiment of this application. Figure 3 As shown, the device may specifically include: an information acquisition module 310, a fragment processing module 320, a question generation module 330, and an authentication module 340, wherein:

[0113] The information acquisition module 310 is used to acquire at least two private information pairs based on the user identifier when a trigger operation of a preset business identifier is received. Each private information pair includes a private question and verification information corresponding to the private question.

[0114] The fragmentation processing module 320 is used to fragment the verification information corresponding to each of the privacy questions to obtain multiple verification fragments;

[0115] The question generation module 330 is used to dynamically combine the private questions corresponding to each verification fragment to generate at least two verification questions;

[0116] The authentication module 340 is used to obtain authentication information corresponding to at least two of the authentication questions, and to perform the business operation corresponding to the preset business identifier for the user when all at least two of the authentication information are verified.

[0117] The authentication device provided in this application, upon receiving a trigger operation based on a preset business identifier, first obtains at least two pairs of private information based on the user identifier. Each pair includes a private question and corresponding verification information. Then, by fragmenting the verification information corresponding to each private question to obtain multiple verification fragments, the device avoids exposing the user's complete private information. Even if an attacker obtains partial verification fragments, they cannot directly reconstruct the complete verification information, increasing the difficulty of cracking the verification information. Furthermore, by dynamically combining the private questions corresponding to each verification fragment to generate at least two verification questions, the user does not need to repeatedly expose the same private question or complete verification information, reducing the risk of private information leakage. Finally, by obtaining the verification information corresponding to at least two verification questions, authentication is successful when all at least two verification information passes verification, allowing the user to execute the business operation corresponding to the preset business identifier. This significantly improves the security of authentication, thereby reducing user losses. The solution provided in this embodiment increases the complexity for attackers to obtain complete and valid user identity information, thus more effectively protecting user account security when a preset business operation is detected, achieving the beneficial effects of improving authentication security and reducing user losses.

[0118] In one embodiment, the fragment processing module 320 includes a fragment processing unit and a fragment extraction unit, wherein:

[0119] The fragmentation processing unit is used to fragment the verification information corresponding to each of the privacy questions to obtain multiple fragment fields;

[0120] The fragment extraction unit is used to extract fragments from multiple fragment fields based on a preset extraction rule to obtain multiple verification fragments.

[0121] In one embodiment, the device further includes a sensitivity analysis module, wherein:

[0122] The sensitivity analysis module is used to perform sensitivity analysis on each of the privacy issues to obtain the field type, wherein the field type includes at least low-frequency fields.

[0123] In one embodiment, the fragment extraction unit is specifically used to determine fragment extraction constraints, the fragment extraction constraints including that each verification question includes at least two fragment fields, fragment fields corresponding to the same private question do not coexist in the same verification question, and the verification question includes at least one low-frequency fragment corresponding to a low-frequency field; and based on the fragment extraction constraints, fragments are extracted from multiple fragment fields to obtain multiple verification fragments.

[0124] In one embodiment, a verification problem contains at least two verification fragments;

[0125] The question generation module 330 is specifically used to parse the attribute features of each verification fragment in the corresponding private question, the attribute features including field features or position features; generate a private sub-question corresponding to each verification fragment based on the field features or position features; and perform natural language conversion on the private sub-questions corresponding to at least two verification fragments in a rule order to generate the verification question.

[0126] In one embodiment, the private information pair includes at least one dynamic information pair; at least one of the dynamic information pairs includes a dynamic question and verification information corresponding to the dynamic question;

[0127] The device further includes an information update module, wherein:

[0128] The information update module is specifically used to receive the update operation of the verification information corresponding to the target dynamic question, obtain the updated verification information, and map and store the target dynamic question and the corresponding updated verification information as update information.

[0129] In one embodiment, when the verification information corresponding to any of the verification questions fails verification, the device further includes an interface redirection module and an interface locking module, wherein:

[0130] The interface jump module is used to obtain the verification information corresponding to each of the private information. When all the verification information corresponding to at least two of the private information passes the verification, the module jumps from the identity locking interface to the business display interface. In the business display interface, the module repeatedly executes the operation of obtaining at least two private information pairs according to the user identifier when the trigger operation of the preset business identifier is received.

[0131] The interface locking module is used to control the identity locking interface to lock for a preset time and then repeatedly execute the operation of obtaining at least two pieces of private information based on the user identifier in the identity locking interface when the verification information corresponding to any of the private information fails to be verified.

[0132] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is merely an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0133] This application also provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the authentication method described in any embodiment of this application.

[0134] This application also provides a computer-readable medium storing computer instructions that, when executed by a processor, implement the authentication method described in any embodiment of this application.

[0135] The following is for reference. Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. It illustrates a schematic diagram of the structure of a computer system 500 suitable for implementing the electronic device in the embodiment of this application. Figure 4 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0136] like Figure 4 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 502 or programs loaded from storage section 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the system 500. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0137] The following components are connected to I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to I / O interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 510 as needed so that computer programs read from it can be installed into storage section 508 as needed.

[0138] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, or installed from removable medium 511. When the computer program is executed by central processing unit (CPU) 501, it performs the functions defined in the system of this application.

[0139] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wireline, and optical fiber, or any suitable combination thereof.

[0140] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0141] The modules or units described in the embodiments of this application can be implemented in software or hardware. The described modules or units can also be housed in a processor; for example, a processor can be described as including an information acquisition module, a fragment processing module, a problem generation module, and an authentication module. The names of these modules do not necessarily limit the module itself.

[0142] In another aspect, this application also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to: upon receiving a trigger operation of a preset service identifier, obtain at least two pairs of private information based on a user identifier, each pair of private information including a private question and verification information corresponding to the private question; fragment the verification information corresponding to each private question to obtain multiple verification fragments; dynamically combine the private questions corresponding to each verification fragment to generate at least two verification questions; obtain verification information corresponding to at least two verification questions; and when all at least two verification questions are verified successfully, identity verification is successful, thereby enabling the user to perform the service operation corresponding to the preset service identifier.

[0143] According to the technical solution of this embodiment, the complexity of attackers obtaining complete and valid user identity information is increased, thereby more effectively protecting user account security when a preset business operation is detected, achieving the beneficial effects of improving identity verification security and reducing user losses.

[0144] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An authentication method, characterized in that, include: Upon receiving a trigger operation based on a preset service identifier, at least two pairs of private information are obtained based on the user identifier. Each pair of private information includes a private question and verification information corresponding to the private question. The verification information corresponding to each of the aforementioned privacy questions is fragmented to obtain multiple verification fragments; For each verification fragment, the corresponding private question is dynamically combined to generate at least two verification questions; Obtain verification information corresponding to at least two of the verification questions. When all at least two of the verification information are verified, the identity verification is successful, and the user can perform the business operation corresponding to the preset business identifier.

2. The authentication method according to claim 1, characterized in that, The verification information corresponding to each of the privacy questions is fragmented to obtain multiple verification fragments, including: The verification information corresponding to each of the aforementioned privacy questions is fragmented to obtain multiple fragment fields; Multiple verification fragments are obtained by extracting fragments from multiple fragment fields based on preset extraction rules.

3. The authentication method according to claim 2, characterized in that, Before extracting fragments from the multiple fragment fields based on a preset extraction rule, the method further includes: A sensitivity analysis is performed on each of the aforementioned privacy issues to obtain the field type, wherein the field type includes at least low-frequency fields.

4. The authentication method according to claim 3, characterized in that, The step of extracting fragments from multiple fragment fields based on a preset extraction rule to obtain multiple verification fragments includes: Determine fragment extraction constraints, which include each verification question having at least two fragment fields, fragment fields corresponding to the same private question not coexisting in the same verification question, and each verification question having at least one low-frequency field corresponding to a low-frequency fragment. Based on the fragment extraction constraints, fragments are extracted from multiple fragment fields to obtain multiple verification fragments.

5. The authentication method according to claim 1, characterized in that, A verification problem contains at least two verification fragments; The process of dynamically combining the private questions corresponding to each verification fragment to generate at least two verification questions includes: Analyze the attribute features of each verification fragment in the corresponding private question, where the attribute features include field features or position features; Generate a private sub-question corresponding to each verification fragment based on the field features or location features; The verification question is generated by performing natural language conversion on the private sub-questions corresponding to at least two of the verification fragments in a rule-based order.

6. The authentication method according to claim 1, characterized in that, The private information pair includes at least one dynamic information pair; at least one of the dynamic information pairs includes a dynamic question and verification information corresponding to the dynamic question. The method further includes: Receive update operations for the verification information corresponding to the target dynamic question, and obtain the updated verification information; The target dynamic problem and the corresponding update verification information are mapped and stored as update information.

7. The authentication method according to claim 1, characterized in that, If the verification information corresponding to any of the verification questions fails verification, the method further includes: The user is redirected from the current identity verification interface to the identity lock interface, where at least two pieces of private information are obtained based on the user identifier. Obtain the verification information corresponding to each of the private information. When all the verification information corresponding to at least two of the private information passes the verification, jump from the identity locking interface to the business display interface. In the business display interface, repeatedly execute the operation of obtaining at least two private information pairs according to the user identifier when the trigger operation of the preset business identifier is received. If the verification information corresponding to any of the private information fails to pass verification, the identity locking interface is locked for a preset time and then the operation of obtaining at least two private information based on the user identifier is repeatedly executed on the identity locking interface.

8. An authentication device, characterized in that, include: The information acquisition module is used to acquire at least two private information pairs based on the user identifier when a trigger operation of a preset business identifier is received. Each private information pair includes a private question and verification information corresponding to the private question. The fragmentation module is used to fragment the verification information corresponding to each of the privacy questions to obtain multiple verification fragments; The question generation module is used to dynamically combine the private questions corresponding to each of the verification fragments to generate at least two verification questions. The authentication module is used to obtain authentication information corresponding to at least two of the authentication questions, and to perform the business operation corresponding to the preset business identifier for the user when all at least two of the authentication information are verified.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the authentication method according to any one of claims 1-7.

10. A computer program product comprising a computer program that, when executed by a processor, implements the authentication method according to any one of claims 1-7.

Images