User identity authentication method, device, equipment, medium and program product

Abstract

The invention discloses a user identity authentication method, device and equipment, a medium and a program product. An authentication server side receives a user identity authentication request and user data sent by a service side; wherein the user data comprises equipment fingerprint information, network environment information, user behavior information and WebAuthn information; in response to the user identity authentication request, performing risk assessment according to the user data, and generating a risk assessment result; generating a corresponding user identity authentication strategy according to the risk assessment result; wherein the user identity authentication strategy comprises a user authorization mode and whether WebAuthn verification is carried out or not; and performing user identity authentication according to the user identity authentication strategy. According to the invention, through multi-dimensional risk assessment and dynamic selection of the matched user identity authentication strategy, the contradiction between security defense flexibility and user experience is solved, and the security of overall authentication and the user experience are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of wireless communication, in particular to a user identity authentication method, device, equipment, medium and product. BACKGROUND

[0002] In the current Internet application scenario, user identity authentication is a key link to protect system security and user data privacy.

[0003] H5 (HTML5, HyperText Markup Language 5, HyperText Markup Language 5) one-click login is a technology that uses the gateway number taking ability to obtain a mobile phone number through the communication network capability provided by the operator. The business page integrates one-click login JSSDK (JavaScript Software Development Kit, JavaScript, Software Development Kit) and initiates number taking. After the JSSDK successfully takes the number from the authentication server, it pulls up the authorization page, the user inputs the complete mobile phone number for authorization, and then the JSSDK obtains the token from the authentication server. The JSSDK returns the obtained token to the business page, and the business initiates token verification to obtain the mobile phone number, so as to realize user identity authentication and login.

[0004] However, the authentication process of H5 one-click login is fixed, and the same authentication process is used regardless of the risk level, which may lead to the problem of excessive verification affecting user experience in low-risk scenarios and insufficient authentication strength causing security risks in high-risk scenarios. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a user identity authentication method, device, equipment, medium and program product, which dynamically selects a matching user identity authentication strategy through multi-dimensional risk assessment, solves the contradiction between security defense flexibility and user experience, and improves the security and user experience of the overall authentication.

[0006] To achieve the above purpose, the embodiments of the present application provide a user identity authentication method applied to an authentication server, the method comprising: receiving a user identity authentication request and user data sent by a business end; wherein the user data comprises device fingerprint information, network environment information, user behavior information and WebAuthn information; in response to the user identity authentication request, performing risk assessment according to the user data to generate a risk assessment result; generating a corresponding user identity authentication strategy according to the risk assessment result; wherein the user identity authentication strategy comprises a user authorization mode and whether to perform WebAuthn verification; User authentication is performed according to the aforementioned user authentication strategy.

[0007] As an improvement to the above scheme, the risk assessment result includes a risk assessment level, which includes a low risk level, a medium risk level, and a high risk level.

[0008] As an improvement to the above solution, the step of generating a corresponding user authentication strategy based on the risk assessment results includes: When the risk assessment result is low risk, a first strategy is generated; wherein, the first strategy includes a first user authorization method and no WebAuthn verification required; the first user authorization method is that the user confirms the masked identity code; When the risk assessment result is medium risk level, determine whether the user terminal has bound the WebAuthn credential based on the user data; If the user's client has already bound a WebAuthn credential, a second policy is generated; wherein, the second policy includes the first user authorization method and requires WebAuthn verification; If the user's client has not bound a WebAuthn credential, a third policy is generated; wherein, the third policy includes a second user authorization method and no WebAuthn verification required; the second user authorization method is for the user to input a complete identity verification code; When the risk assessment result is high risk, a fourth strategy is generated; wherein, the fourth strategy includes the second user authorization method and requires WebAuthn verification.

[0009] In a first preferred embodiment, the user authentication based on the user authentication policy includes: When the risk assessment result is low risk, the first strategy is sent to the business side; Receive a token request sent by the business terminal; wherein the token request is generated by the business terminal after obtaining authorization from the user terminal using the first user authorization method; In response to the token request, a token is returned to the business terminal to complete user authentication.

[0010] In the second preferred embodiment, the user authentication based on the user authentication strategy includes: When the risk assessment result is medium risk level and the user has bound the WebAuthn credential, the second strategy is sent to the business side; Receive a WebAuthn verification request sent by the business terminal; wherein the WebAuthn verification request is generated by the business terminal after obtaining authorization from the user terminal using the first user authorization method; In response to the WebAuthn verification request, a challenge value is returned to the business terminal; Receive the verification credential sent by the service terminal; wherein, the verification credential is generated by the service terminal after performing security verification on the user terminal and passing the verification, and then signing the challenge value with a preset private key; After verifying the verification credential using a preset public key and passing the verification, a token is returned to the business terminal to complete the user identity authentication.

[0011] In a third preferred embodiment, the user authentication based on the user authentication strategy includes: When the risk assessment result is medium risk level and the user terminal has not bound WebAuthn credentials, the third strategy is sent to the business terminal; Receive a token request sent by the business terminal; wherein the token request is generated by the business terminal after obtaining authorization from the user terminal using the second user authorization method, and the token request carries a complete identity identification code; In response to the token request, the complete identity identifier is verified and, after successful verification, a token is returned to the business terminal to complete user identity authentication.

[0012] As an improvement to the above solution, the third strategy also includes: registering WebAuthn credentials; The step of performing user authentication according to the user authentication strategy further includes: Receive the WebAuthn registration request sent by the business terminal; In response to the WebAuthn registration request, the registration of the WebAuthn credentials for the user client is performed.

[0013] In the fourth preferred embodiment, the user authentication based on the user authentication strategy includes: When the risk assessment result is high risk level, the fourth strategy will be sent to the business side; Receive a WebAuthn verification request sent by the business terminal; wherein the WebAuthn verification request is generated by the business terminal after obtaining authorization from the user terminal using the second user authorization method, and the WebAuthn verification request carries a complete identity identification code; In response to the WebAuthn verification request, the complete identity code is verified and, after successful verification, a challenge value is returned to the business terminal. Receive the verification credential sent by the service terminal; wherein, the verification credential is generated by the service terminal after performing security verification on the user terminal and passing the verification, and then signing the challenge value with a preset private key; After verifying the verification credential using a preset public key and passing the verification, a token is returned to the business terminal to complete the user identity authentication.

[0014] As an improvement to the above solution, the step of responding to the user authentication request and performing a risk assessment based on the user data to generate a risk assessment result includes: Based on the user data, risk values ​​are calculated in the device environment dimension, behavioral dynamics dimension, and historical trust dimension, respectively. The initial risk assessment score is calculated by weighted summation based on the risk value and preset weight value of each dimension. The initial risk assessment score is adjusted according to a preset environmental fluctuation coefficient to obtain the final risk assessment score; The risk assessment level is determined based on the risk assessment score, and this level serves as the risk assessment result.

[0015] As an improvement to the above solution, the step of calculating risk values ​​based on the user data in the dimensions of device environment, behavioral dynamics, and historical trust includes: Based on the user data, data factors for the device environment dimension, the behavior dynamic dimension, and the historical trust dimension are determined; Based on the data factors of the device environment dimension, the behavioral dynamic dimension, and the historical trust dimension, calculate the risk value corresponding to the device environment dimension, the behavioral dynamic dimension, and the historical trust dimension.

[0016] The data factors in the device environment dimension include device fingerprint information, network environment information, and WebAuthn credential status; the data factors in the behavior dynamic dimension include user behavior information, which includes user input features, WebAuthn authentication behavior, and user interaction behavior; and the data factors in the historical trust dimension include historical risk assessment results and WebAuthn usage records.

[0017] This invention also provides another user authentication method, applied to a business application, the method comprising: When a user authentication request is received from a user terminal, user data is collected; wherein, the user data includes device fingerprint information, network environment information, user behavior information, and WebAuthn information; Send the user authentication request and the user data to the authentication server; The system receives a user authentication policy sent by the authentication server; wherein the user authentication policy is generated by the authentication server based on the risk assessment results after performing a risk assessment on the user data; the user authentication policy includes the user authorization method and whether WebAuthn verification is performed. User authentication is performed according to the aforementioned user authentication strategy.

[0018] In a first preferred embodiment, the user authentication strategy is a first strategy, which includes a first user authorization method and no WebAuthn verification required; the first user authorization method is that the user confirms the masked identity identifier code; The step of performing user authentication according to the user authentication strategy includes: According to the first user authorization method, a first authorization page is sent to the user terminal; wherein, the first authorization page includes a masked identity identification code; When the user client confirms the authorization instruction, a token request is sent to the authentication server. Receive the token returned by the authentication server to complete user identity authentication.

[0019] In the second preferred embodiment, the user authentication strategy is a second strategy, which includes a first user authorization method and the requirement for WebAuthn verification; the first user authorization method is for the user to confirm the masked identity identifier code; The step of performing user authentication according to the user authentication strategy includes: According to the first user authorization method, a first authorization page is sent to the user terminal; wherein, the first authorization page includes a masked identity identification code; When the user client confirms the authorization instruction, a WebAuthn verification request is sent to the authentication server. Receive the challenge value returned by the authentication server; After the user terminal is securely verified and the verification is successful, the challenge value is signed using a preset private key to generate a verification credential. Send the verification credentials to the authentication server; The system receives a token returned by the authentication server after verifying the verification credential using a preset public key and passing the verification, thereby completing the user identity authentication.

[0020] In the third preferred implementation, the user authentication strategy is a third strategy, which includes a second user authorization method and no WebAuthn verification required; the second user authorization method is for the user to input a complete identity verification code; The step of performing user authentication according to the user authentication strategy includes: According to the second user authorization method, a second authorization page is sent to the user terminal; wherein, the second authorization page includes a masked identity code to be entered; When the complete identity code input by the user is received, a token request is sent to the authentication server; wherein the token request carries the complete identity code. The system receives a token returned by the authentication server after verifying the complete identity code and passing the verification, thereby completing the user identity authentication.

[0021] In the fourth preferred embodiment, the user authentication strategy is a fourth strategy, which includes a second user authorization method and the requirement for WebAuthn verification; the second user authorization method is for the user to input a complete identity verification code; The step of performing user authentication according to the user authentication strategy includes: According to the second user authorization method, a second authorization page is sent to the user terminal; wherein, the second authorization page includes a masked identity code to be entered; When the complete identity code input by the user is received, a WebAuthn verification request is sent to the authentication server; wherein the WebAuthn verification request carries the complete identity code; Receive the challenge value returned by the authentication server after verifying the complete identity code and passing the verification; After the user terminal is securely verified and the verification is successful, the challenge value is signed using a preset private key to generate a verification credential. Send the verification credentials to the authentication server; The system receives a token returned by the authentication server after verifying the verification credential using a preset public key and passing the verification, thereby completing the user identity authentication.

[0022] This invention also provides a user authentication device for use on an authentication server, the device comprising: The identity authentication request receiving module is used to receive user identity authentication requests and user data sent by the business terminal; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; The risk assessment result generation module is used to respond to the user authentication request, perform a risk assessment based on the user data, and generate a risk assessment result. An identity authentication strategy generation module is used to generate a corresponding user identity authentication strategy based on the risk assessment results; wherein, the user identity authentication strategy includes the user authorization method and whether to perform WebAuthn verification; The first user authentication module is used to perform user authentication according to the user authentication strategy.

[0023] This invention also provides a user authentication device for use in a business application, the device comprising: The user data collection module is used to collect user data when it receives a user authentication request sent by the user terminal; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; The user data sending module is used to send the user identity authentication request and the user data to the authentication server; An identity authentication policy receiving module is used to receive a user identity authentication policy sent by the authentication server; wherein, the user identity authentication policy is generated by the authentication server based on the risk assessment results after performing a risk assessment on the user data; the user identity authentication policy includes the user authorization method and whether WebAuthn verification is performed; The second user authentication module is used to perform user authentication according to the user authentication strategy.

[0024] This invention also provides a user authentication device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the user authentication method as described in any of the preceding embodiments.

[0025] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to perform the user authentication method as described in any of the preceding embodiments.

[0026] This invention also provides a computer program product, which includes a computer program or computer instructions. When the computer program or computer instructions are executed by a processor, they implement the user authentication method as described in any of the above embodiments.

[0027] Compared with existing technologies, the user authentication method, apparatus, device, medium, and program products disclosed in this invention conduct risk assessment by collecting user data and dynamically match appropriate user authentication strategies. For low-risk application scenarios, a more seamless user authorization method can be adopted without the need for WebAuthn authentication. For high-risk application scenarios, a more precise user authorization method and / or a combination of WebAuthn for secondary authentication can be adopted. This avoids the problems of excessive verification affecting user experience in low-risk scenarios and insufficient authentication strength causing security risks in high-risk scenarios. It effectively solves the contradiction between security defense flexibility and user experience, and improves the overall authentication security and user experience. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating a user authentication method provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating a preferred user authentication method in an embodiment of the present invention; Figure 3 This is a schematic diagram of the webAuthn authentication process in an embodiment of the present invention; Figure 4 This is a schematic diagram of the webAuthn registration process in an embodiment of the present invention; Figure 5 This is a flowchart illustrating another user authentication method provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a user identity authentication device provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of another user authentication device provided in an embodiment of the present invention. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0031] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0032] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0033] See Figure 1 This is a flowchart illustrating a user authentication method provided in an embodiment of the present invention. The embodiment of the present invention provides a user authentication method applied to an authentication server, the method comprising steps S11 to S14: S11. Receive user authentication request and user data sent by the business terminal; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; S12. In response to the user authentication request, perform a risk assessment based on the user data and generate a risk assessment result; S13. Based on the risk assessment results, generate a corresponding user authentication strategy; wherein, the user authentication strategy includes the user authorization method and whether to perform WebAuthn verification; S14. Perform user authentication according to the user authentication strategy.

[0034] It should be noted that WebAuthn, as a new generation of Web identity authentication standard, uses a public key and private key pair for authentication and supports authentication methods such as biometrics (such as fingerprints and facial recognition) or security keys, which can effectively improve authentication security.

[0035] In the user authentication method of this invention, a suitable user authentication strategy is determined by performing a risk assessment on user data. User authentication is performed based on the user authorization method and whether WebAuthn verification is performed in the user authentication strategy. For example, zero-input seamless authentication can be implemented for low-risk scenarios, while identity code verification and WebAuthn verification are performed for high-risk scenarios.

[0036] Specifically, a number authentication JSSDK is integrated into the business-side page. After the JSSDK is loaded, it initializes a data collector to perform multi-dimensional user data collection on the page, in preparation for subsequent risk assessment.

[0037] The user data includes device fingerprint information, network environment information, user behavior information, and WebAuthn information. The device fingerprint information refers to a unique device fingerprint generated from at least one of the following: operating system, user agent (browser type), browser version number, whether the browser has cookies enabled, CPU level, number of CPU virtual cores, system language, browser plugins, screen resolution, color quality, and time zone. The network environment information includes device network status, geographical location, etc. The user behavior information refers to the user's interaction trajectory since entering the service-side page; optionally, the user behavior information includes user input characteristics, WebAuthn authentication behavior, and user interaction behavior. The WebAuthn information includes the user's WebAuthn credential status and historical WebAuthn usage records.

[0038] When a user logs in on the business page, the business page calls the JSSDK, carrying an identity verification code (such as the user's mobile phone number), the appId assigned for authentication, and signature information. The JSSDK then sends a user authentication request (number retrieval request) to the authentication server and reports the collected user data.

[0039] After receiving a user authentication request from the JSSDK, the authentication server retrieves a number from the gateway and forwards the collected user data to the risk decision system for risk assessment, generating a risk assessment result. Optionally, the risk assessment result can be characterized by a risk level; a higher risk level indicates a greater security risk to the user. Based on the risk assessment result, the authentication server generates a suitable user authentication strategy, including the user authorization method used and whether WebAuthn verification is required. The user authentication strategy is sent to the JSSDK on the business side. After parsing the authentication server's response, the JSSDK dynamically generates an authorization interface based on the risk assessment result and rendering data. The business side and the authentication server then perform user authentication according to the user authentication strategy.

[0040] By employing the technical means of this invention, risk assessment is conducted through the collection of user data, and appropriate user authentication strategies are dynamically matched. For low-risk application scenarios, a more seamless user authorization method can be adopted without the need for webAuthn authentication. For high-risk application scenarios, a more precise user authorization method and / or a combination of webAuthn for secondary authentication can be adopted. This avoids the problems of excessive verification affecting user experience in low-risk scenarios and insufficient authentication strength causing security risks in high-risk scenarios. It effectively solves the contradiction between security defense flexibility and user experience, and improves the overall authentication security and user experience.

[0041] As a preferred embodiment, the present invention further implements the above embodiments, wherein the risk assessment result includes a risk assessment level, and the risk assessment level includes a low risk level, a medium risk level, and a high risk level.

[0042] Step S13, namely generating the corresponding user authentication strategy based on the risk assessment result, includes steps S131 to S133: S131. When the risk assessment result is low risk level, a first strategy is generated; wherein, the first strategy includes a first user authorization method and no WebAuthn verification required; the first user authorization method is that the user confirms the masked identity code; S132. When the risk assessment result is at a medium risk level, determine whether the user terminal has bound a WebAuthn credential based on the user data; if the user terminal has bound a WebAuthn credential, generate a second strategy; wherein the second strategy includes the first user authorization method and requires WebAuthn verification; if the user terminal has not bound a WebAuthn credential, generate a third strategy; wherein the third strategy includes the second user authorization method and does not require WebAuthn verification; the second user authorization method is for the user to input a complete identity verification code; S133. When the risk assessment result is high risk level, a fourth strategy is generated; wherein, the fourth strategy includes the second user authorization method and requires WebAuthn verification.

[0043] See Figure 2 This is a flowchart illustrating a preferred user authentication method in this embodiment of the invention. This embodiment deeply integrates WebAuthn hardware credential technology with a multi-dimensional risk identification mechanism. When a user initiates an authentication request, the risk level is calculated in real time based on device fingerprint information, network environment information, user behavior information, and WebAuthn information, and the user authentication strategy is dynamically matched. Specifically, for low-risk and medium-risk users who have already bound WebAuthn credentials, zero-input, seamless authentication is achieved; for medium-risk users who have not bound WebAuthn credentials, verification is performed by the user entering a complete identity identifier code; in high-risk scenarios, after verification by the user entering a complete identity identifier code, WebAuthn is used as the core of secondary verification, combined with dynamic risk review. This ensures account security while significantly improving user experience by simplifying the operation process and reducing input steps, effectively balancing the contradiction between security and convenience in the authentication process, and achieving a dynamic and intelligent authentication process.

[0044] Specifically, taking a mobile phone number as the identity identifier, the authentication server generates corresponding user authentication strategies and page rendering data based on the risk level. In a low-risk scenario, the authentication server generates parameters such as a phone mask, a first authorization method, and "no WebAuthn verification required." In a medium-risk scenario, it first determines whether the user has bound a WebAuthn credential. If the credential is bound, the authentication server generates parameters such as a phone mask, a first authorization method, and "WebAuthn verification required." Otherwise, the authentication server generates parameters such as a phone mask, a second authorization method, and "no WebAuthn verification required." In a high-risk scenario, the authentication server generates parameters such as a phone mask, a second authorization method, and "WebAuthn verification required." Finally, the authentication server encapsulates the phone mask, user authorization method, and WebAuthn verification status into a response and returns it to the business-side JSSDK, which then renders the corresponding authorization page.

[0045] By employing the technical means of this invention, risk level assessment is performed in real time during user authentication, appropriate user authentication strategies are matched, and authentication strength is automatically adjusted. In low-risk situations, one-click login is possible, reducing login time. In medium-risk situations, the login method is dynamically selected based on the server response. Devices with bound credentials do not need to enter a number for quick login, while devices without bound credentials require a complete mobile phone number for authorization, enhancing the flexibility of login scenarios and balancing security and user experience. In high-risk situations, dual authentication is required by entering a complete mobile phone number + webAuthn, improving account login security.

[0046] As a preferred embodiment, the present invention further implements the above embodiments and optimizes the authentication process corresponding to the above four user identity authentication strategies.

[0047] In the first implementation, the user authentication based on the user authentication policy includes: When the risk assessment result is low risk, the first strategy is sent to the business side; Receive a token request sent by the business terminal; wherein the token request is generated by the business terminal after obtaining authorization from the user terminal using the first user authorization method; In response to the token request, a token is returned to the business terminal to complete user authentication.

[0048] In this embodiment of the invention, for low-risk users, the JSSDK loads a masked authorization page according to the parameters of the first user authorization method, displays the user's masked identity code (such as a mobile phone mask), protocol content, and a login button, and initializes a data collector to collect user behavior characteristics on the authorization page. After the user clicks the login button, the authorization page initiates a token acquisition request to the authentication server, which sends the token to the JSSDK. After successfully acquiring the token, the authorization page returns the token to the business page, closes the authorization page, and reports the collected data.

[0049] In the second implementation, the user authentication based on the user authentication policy includes: When the risk assessment result is medium risk level and the user has bound the WebAuthn credential, the second strategy is sent to the business side; Receive a WebAuthn verification request sent by the business terminal; wherein the WebAuthn verification request is generated by the business terminal after obtaining authorization from the user terminal using the first user authorization method; In response to the WebAuthn verification request, a challenge value is returned to the business terminal; Receive the verification credential sent by the service terminal; wherein, the verification credential is generated by the service terminal after performing security verification on the user terminal and passing the verification, and then signing the challenge value with a preset private key; After verifying the verification credential using a preset public key and passing the verification, a token is returned to the business terminal to complete the user identity authentication.

[0050] In an embodiment of the present invention, see Figure 3 This is a schematic diagram of the webAuthn authentication process in an embodiment of the present invention. For medium-risk users who have registered webAuthn credentials, this solution adopts a hybrid authentication method of masked authorization page and webAuthn to enhance authentication security.

[0051] The JSSDK on the business side loads the masked authorization page according to the parameters of the first user authorization method, displays the mobile phone mask to be logged in, the protocol content and the login button to the user, and initializes the data collector to collect the user's behavioral characteristics on the authorization page.

[0052] After the user clicks the login button, the authorization page will send a WebAuthn verification request to the authentication server. After receiving the request, the authentication server will return a random challenge value. The service terminal performs security verification on the user terminal, such as fingerprint recognition, requiring the user to confirm their identity. After successful security verification, the device uses its private key to sign the challenge value, ensuring that the operation is performed by a genuine user and generating a verification credential. The browser then sends the signed verification credential to the authentication server.

[0053] The authentication server uses the public key stored during registration to verify the validity of the signature and checks if the challenge value has expired. After successful verification, the authentication server returns a token to the authorization page, which then returns the token to the business page, closes the authorization page, and reports the collected data.

[0054] In the third implementation, the user authentication based on the user authentication policy includes: When the risk assessment result is medium risk level and the user terminal has not bound WebAuthn credentials, the third strategy is sent to the business terminal; Receive a token request sent by the business terminal; wherein the token request is generated by the business terminal after obtaining authorization from the user terminal using the second user authorization method, and the token request carries a complete identity identification code; In response to the token request, the complete identity identifier is verified and, after successful verification, a token is returned to the business terminal to complete user identity authentication.

[0055] In this embodiment of the invention, for medium-risk users who have not registered webAuthn credentials, this solution uses the input of a complete identity verification code for authorization. The JSSDK on the business side loads an authorization page for inputting the complete identity verification code based on the parameters of the second user authorization method. Taking a mobile phone number as an example, the JSSDK loads the middle four digits of the mobile phone number, displays the mobile phone mask to be entered and the protocol content to the user, and initializes a data collector to collect user behavior characteristics on the authorization page. When the user enters the complete mobile phone number for authorization, the authorization page sends a request to the authentication server to obtain a token, carrying the entered mobile phone number. The authentication server verifies the validity of the mobile phone number and generates a token, returning it to the authorization page. The authorization page then returns the token to the business side page, closes the authorization page, and reports the collected data.

[0056] In a preferred embodiment, based on the above, the third strategy further includes: registering WebAuthn credentials. Then, the user authentication based on the user authentication strategy further includes: Receive the WebAuthn registration request sent by the business terminal; In response to the WebAuthn registration request, the registration of the WebAuthn credentials for the user client is performed.

[0057] Preferably, the step of registering the WebAuthn credentials of the user terminal in response to the WebAuthn registration request includes: In response to the WebAuthn registration request, a random challenge value is returned to the business client; The system receives a public key and a verification credential returned by the business terminal; wherein the public key originates from a unique asymmetric key pair generated by the business terminal, the asymmetric key pair also includes a private key, and the verification credential is generated by the business terminal after signing the challenge value using the private key; After verifying the verification credential using the public key and the verification is successful, the public key is bound and stored with the user's client account, and a registration success notification is returned to the business terminal.

[0058] In an embodiment of the present invention, see Figure 4This diagram illustrates the webAuthn registration process in this embodiment of the invention. After the authentication server returns the token to the authorization page, the authorization page guides the user to register for webAuthn credentials to optimize the subsequent login experience. Once the user agrees to register, the authorization page initiates a webAuthn registration request to the authentication server, requesting registration parameters. The authentication server returns a generated random challenge value. The device prompts the user to select a security verification method and generates a unique asymmetric key pair. The private key is stored in secure hardware, and the public key is returned to the server. The device sends the public key, credential ID, and signed verification credentials to the authentication server. After verifying the signature validity, the authentication server binds and stores the public key with the user's account. Once the authentication server confirms the credentials are valid, it notifies the authorization page of successful registration.

[0059] In the fourth implementation, the user authentication based on the user authentication policy includes: When the risk assessment result is high risk level, the fourth strategy will be sent to the business side; Receive a WebAuthn verification request sent by the business terminal; wherein the WebAuthn verification request is generated by the business terminal after obtaining authorization from the user terminal using the second user authorization method, and the WebAuthn verification request carries a complete identity identification code; In response to the WebAuthn verification request, the complete identity code is verified and, after successful verification, a challenge value is returned to the business terminal. Receive the verification credential sent by the service terminal; wherein, the verification credential is generated by the service terminal after performing security verification on the user terminal and passing the verification, and then signing the challenge value with a preset private key; After verifying the verification credential using a preset public key and passing the verification, a token is returned to the business terminal to complete the user identity authentication.

[0060] In this embodiment of the invention, for high-risk users, the solution adopts a hybrid authentication method of authorizing by inputting a complete identity code and webAuthn to enhance authentication security.

[0061] The JSSDK on the business side loads the authorization page containing the middle four digits of the input mobile phone number according to the parameters of the second user authorization method, displays the mobile phone mask to be entered and the protocol content to the user, and initializes the data collector to collect the user's behavioral characteristics on the authorization page.

[0062] When a user enters their complete mobile phone number to authorize the authentication, the authorization page will send a WebAuthn verification request to the authentication server, carrying the mobile phone number entered by the user. Upon receiving the request, the authentication server verifies the validity of the mobile phone number. If the verification passes, it returns a random challenge value. The browser on the service side activates fingerprint recognition, requiring the user to confirm their identity. The device uses its private key to sign the challenge value, ensuring the operation is performed by a legitimate user; the browser then sends the signed credential to the authentication server.

[0063] The authentication server uses the public key stored during registration to verify the validity of the signature and checks if the challenge value has expired. After successful verification, the authentication server returns a token to the authorization page, which then returns the token to the business page, closes the authorization page, and reports the collected data.

[0064] Based on the four embodiments described above, the method further includes: Receive a user login request from the business terminal; wherein the user login request carries the token; The token is verified, and an encrypted identity code is generated upon successful verification. The encrypted identity code is sent to the business terminal to perform the user login operation.

[0065] Specifically, when the client has a user login requirement, the business side executes the user identity authentication process through JSSDK and obtains a token. Then, the business side can obtain the user's complete identity identification code based on the token to complete the user login operation.

[0066] The business-side page obtains a token via the JSSDK and requests the user's mobile phone number from the business server for login. The business server, carrying the issued token, appId, and other information, requests the authentication server to obtain the user's identity identifier, such as their mobile phone number. The authentication server performs parameter verification, IP verification, signature verification, appId availability verification, and token verification on the business-side page. Upon successful verification, it generates an AES-encrypted mobile phone number and returns a mobile phone number mask to the business server. The business server decrypts the encrypted mobile phone number and returns the mobile phone number mask to the business-side page frontend to complete the user login.

[0067] By employing the technical means of this invention, authentication strength is automatically adjusted through multi-dimensional risk assessment. In low-risk scenarios, only one-click authorization is required. In medium-risk scenarios, if a webAuthn hardware credential is already bound, identity is verified again via webAuthn after one-click authorization. If no webAuthn hardware credential is bound, authorization is granted by providing a complete mobile phone number, and the user is guided to register for webAuthn. In high-risk scenarios, identity is verified again via webAuthn after providing a complete mobile phone number. This process avoids excessive verification in low-risk scenarios while ensuring strong security protection in high-risk scenarios. The deep coupling of the identity authentication process and risk level solves the problem of the one-size-fits-all approach in existing identity authentication processes.

[0068] As a preferred embodiment, the present invention further implements the above embodiments on the basis of any of the above embodiments, and optimizes the process of user risk assessment by the authentication server.

[0069] Step S12, namely, responding to the user authentication request and performing a risk assessment based on the user data to generate a risk assessment result, includes steps S121 to S124: S121. Based on the user data, calculate the risk values ​​in the device environment dimension, behavior dynamic dimension, and historical trust dimension, respectively; S122. Based on the risk value and preset weight value of each dimension, the initial risk assessment score is calculated by weighted summation. S123. Adjust the initial risk assessment score according to the preset environmental fluctuation coefficient to obtain the final risk assessment score; S124. Determine the risk assessment level based on the risk assessment score, which will be used as the risk assessment result.

[0070] In this embodiment of the invention, a more granular quantitative standard is adopted in the risk identification stage, and the collected user data is divided into three dimensions: device environment, behavioral dynamics, and historical trust. The initial weights are set according to the stability of the data in each dimension, the frequency of attack exploitation, and the degree of impact on security. At the same time, an environmental fluctuation coefficient is introduced, which can dynamically adjust the risk identification level according to changes in security threats.

[0071] Specifically, the risk decision-making system of the authentication server integrates risk values ​​from three dimensions—device environment, dynamic behavioral risk, and historical trust—through data aggregation, and calculates the final risk assessment score through two stages: weighted summation and dynamic adjustment. First, the risk values ​​of each dimension are weighted and summed according to the configured weight values ​​to obtain an initial risk assessment score. Then, the score is dynamically adjusted based on the environmental fluctuation coefficient, and the final total score is used as the final risk assessment score.

[0072] The environmental fluctuation coefficient is a configurable parameter that dynamically adjusts the weight changes according to changes in security threats. The default value is 1.0, and it can be manually configured according to business scenarios. For example, for some scenarios with high security requirements, this parameter can be increased to improve the overall security sensitivity.

[0073] The formula for the final risk assessment score is as follows: riskScore = (Equipment Risk Value × Equipment Weight Value + Behavioral Risk Value × Behavioral Weight Value + Historical Risk Value × Historical Weight Value) × Environmental Fluctuation Coefficient.

[0074] Finally, the risk decision system maps the calculated risk assessment score to three risk levels: low, medium, and high. For example, a score less than 30 is considered low risk, a score between 30 and 80 is considered medium risk, and a score greater than 80 is considered high risk. The risk assessment result is then returned to the authentication server.

[0075] In a preferred embodiment, the step of calculating risk values ​​based on the user data in the dimensions of device environment, behavioral dynamics, and historical trust includes: Based on the user data, data factors for the device environment dimension, the behavior dynamic dimension, and the historical trust dimension are determined; Based on the data factors of the device environment dimension, the behavioral dynamic dimension, and the historical trust dimension, calculate the risk value corresponding to the device environment dimension, the behavioral dynamic dimension, and the historical trust dimension.

[0076] The data factors in the device environment dimension include device fingerprint information, network environment information, and WebAuthn credential status; the data factors in the behavior dynamic dimension include user behavior information, which includes user input features, WebAuthn authentication behavior, and user interaction behavior; and the data factors in the historical trust dimension include historical risk assessment results and WebAuthn usage records.

[0077] In this embodiment of the invention, the user data is divided into data factors corresponding to the device environment dimension, the behavior dynamic dimension, and the historical trust dimension, which are respectively denoted as device environment factor, behavior dynamic factor, and historical trust factor.

[0078] As an example, the process of calculating the risk value based on data factors from various dimensions is as follows: The device environment factors mainly include device fingerprint information, network environment information, and WebAuthn credential status data. Device fingerprint information involves concatenating collected device fingerprint parameters such as the number of CPU virtual cores and screen resolution into strings, and generating a SHA-256 hash using `crypto.subtle.digest` as a unique device identifier. This unique identifier is used to determine if the current device is new; if it is, the risk score is increased by 20 points upon first login. Network environment information determines the geographical location by IP address and compares it with commonly used locations. If the deviation exceeds 500 kilometers, the device may be compromised. Abnormal behaviors such as theft, login from a different location, or IP proxy will result in a risk score of +15 points. The WebAuthn credential status is judged based on data such as whether the device supports a security chip (such as TPM), whether the credential is registered, and whether the credential registration time is less than 24 hours. If the credential is not registered, the device lacks a strong authentication mechanism and is vulnerable to impersonation or attack, resulting in a risk score of +30 points. If the registration time is less than 24 hours and the device does not support a security chip (such as TPM), considering the potential for malicious registration of new credentials, and that the security of devices without a security chip (such as TPM) is lower than that of devices with hardware protection, the risk score will be +10~15 points.

[0079] Since device fingerprints and network environment are static risks, they are relatively stable and difficult to forge in real time. They are the basis for identifying the legitimacy of devices and can be used as the basis for analyzing new devices or logins from different IP addresses. They are directly related to the risk of account theft, so they have a high weighting. The initial weighting of this item is 40%.

[0080] The dynamic behavioral factors mainly include user input characteristics, WebAuthn authentication behavior, and data on the trustworthiness of page interactions. The authorization page collects user authorization characteristic data each time, and analyzes user behavior based on this data. User input characteristic data is collected from the authorization page, using the average speed from entering the authorization page to clicking the authorization button, the number of deletions per input, and the number of incorrect number entries as the basis for judgment. Normal user operation has natural time consumption and fault tolerance. If the average speed from entering the authorization page to clicking the authorization button is less than 2 seconds, it may be an automated script attack. If the number of deletions or incorrect number entries per input is more than 5, frequent deletions or incorrect entries may be brute-force attempts or malicious testing, and are therefore judged as abnormal operations, with a risk value of +10 points. WebAuthn authentication behavior is judged based on the fingerprint recognition time collected from the authorization page. If the fingerprint recognition time is less than 500ms, there is a risk of forgery. If the fingerprint recognition time is greater than 5000ms, there is a risk of brute-force attempts, and therefore a risk value of +10 points. The trustworthiness of page interaction is determined by whether each click event collected from the JSSDK and authorization page is triggered by the user and whether there is simulated click. If it is a simulated click, the risk value is +10 points. By conducting risk assessments on dynamic behavioral factors, we can enhance protection against automated attacks and prevent malicious programs from attempting to access account passwords in bulk. At the same time, by analyzing the time consumption of WebAuthn fingerprint recognition, we can prevent biometric forgery and improve authentication security.

[0081] Real-time behaviors such as input speed and authentication time can directly reflect whether the user's operation is abnormal. For example, if the number of incorrect phone number inputs is too many or the fingerprint recognition takes an abnormal amount of time, it may be an automated attack or a brute-force attempt, which requires timely response. Therefore, this item initially accounts for 35% of the score.

[0082] The historical trust factor uses historical risk assessment results and WebAuthn usage records as the scoring basis. If a user is consistently at a medium-to-high risk level, the risk score is increased by 15 points. Binding a mobile phone number to a WebAuthn hardware credential results in an additional 25 points if the same mobile phone number is matched with more than three WebAuthn hardware credentials. Since some platforms support WebAuthn credential synchronization, if the same credential is used to log in on more than three devices, the risk score is increased by 18 points.

[0083] Long-term behavioral patterns and risk intelligence are cumulative risks. Although they do not directly reflect current operations, they can help determine whether an account is in a high-risk environment and can be used as a supplementary verification dimension. Therefore, this item initially accounts for 25% of the score.

[0084] Taking the weighting of the device environment dimension as 40%, the behavioral dynamic dimension as 35%, and the historical trust dimension as 35% as an example, the formula for the final risk assessment score is as follows: riskScore = (Equipment risk value × 40% + Behavioral risk value × 35% + Historical risk value × 25%) × Environmental volatility coefficient.

[0085] By employing the technical means of this invention, a comprehensive risk assessment of the identity authentication process is conducted by introducing multi-dimensional and more granular risk factors. The initial weights are set according to the stability of data factors, the frequency of attack exploitation, and the degree of impact on security. At the same time, an environmental fluctuation coefficient is introduced, which can dynamically adjust the risk identification level according to changes in security threats. This breaks through the traditional single-dimensional risk identification and forms a comprehensive and dynamic risk assessment system, effectively improving the accuracy of risk prediction.

[0086] See Figure 5 This is a flowchart illustrating another user authentication method provided in an embodiment of the present invention. The embodiment of the present invention provides another user authentication method applied to a business end, the method comprising steps S21 to S24: S21. When a user authentication request is received from the user terminal, user data is collected; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; S22. Send the user authentication request and the user data to the authentication server; S23. Receive the user authentication policy sent by the authentication server; wherein, the user authentication policy is generated by the authentication server based on the risk assessment results after performing a risk assessment on the user data; the user authentication policy includes the user authorization method and whether to perform WebAuthn verification; S24. Perform user authentication according to the user authentication strategy.

[0087] In this embodiment of the invention, the business-side page integrates a number authentication JSSDK. After loading, the JSSDK initializes a data collector to prepare for subsequent risk assessment. After initializing the data collector, the JSSDK performs multi-dimensional user data collection on the page. The user data includes device fingerprint information, network environment information, user behavior information, and WebAuthn information. The process of collecting each data item is as follows: Collect device fingerprint information: Generate a unique device fingerprint by collecting data such as operating system, user agent (browser type), browser version number, whether the browser has cookies enabled, CPU level, number of CPU virtual cores, system language, browser plugins, screen resolution, color quality, and time zone. Collect network environment information: Collect device network status using the navigator.connection method; Collect user behavior data: record the user's interaction trajectory from entering the page, such as mouse movement path and click hotspot distribution; Collect WebAuthn credential status: Collect whether the device supports WebAuthn and whether credential information has been registered by calling the navigator.credentials.get() method, and collect WebAuthn hardware credentials.

[0088] When a user logs in on the business page, the business page calls the JSSDK, carrying an identity verification code (such as the user's mobile phone number), the appId assigned for authentication, and signature information. The JSSDK then sends a user authentication request (number retrieval request) to the authentication server and reports the collected user data.

[0089] After receiving a user authentication request from the JSSDK, the authentication server retrieves a number from the gateway and forwards the collected user data to the risk decision system for risk assessment, generating a risk assessment result. Optionally, the risk assessment result can be characterized by a risk level; a higher risk level indicates a greater security risk to the user. Based on the risk assessment result, the authentication server generates a suitable user authentication strategy, including the user authorization method used and whether WebAuthn verification is required. The user authentication strategy is sent to the JSSDK on the business side. After parsing the authentication server's response, the JSSDK dynamically generates an authorization interface based on the risk assessment result and rendering data. The business side and the authentication server then perform user authentication according to the user authentication strategy.

[0090] By employing the technical means of this invention, risk assessment is conducted through the collection of user data, and appropriate user identity authentication strategies are dynamically matched, including user authorization methods and whether WebAuthn verification is required. This avoids the problem of excessive verification affecting user experience in low-risk scenarios and insufficient authentication strength causing security risks in high-risk scenarios. It effectively solves the contradiction between security defense flexibility and user experience, and improves the overall authentication security and user experience.

[0091] In a preferred embodiment, the risk assessment result includes a risk assessment level, which includes a low-risk level, a medium-risk level, and a high-risk level.

[0092] When the risk assessment result is low risk, the user authentication strategy is the first strategy; the first strategy includes a first user authorization method and no WebAuthn verification required; the first user authorization method is for the user to confirm the masked identity identifier code; When the risk assessment result is medium risk level and the user has bound WebAuthn credentials, the user authentication strategy is the second strategy; the second strategy includes the first user authorization method and requires WebAuthn verification; When the risk assessment result is medium risk level and the user terminal is not bound to WebAuthn credentials, the user identity authentication strategy is the third strategy; the third strategy includes the second user authorization method and no WebAuthn verification required; the second user authorization method is for the user to input a complete identity identification code; When the risk assessment result is high-risk, the user authentication strategy is the fourth strategy; the fourth strategy includes the second user authorization method and requires WebAuthn verification.

[0093] Furthermore, the authentication processes corresponding to the above four user authentication strategies are optimized respectively.

[0094] In the first implementation, the user authentication based on the user authentication policy includes: According to the first user authorization method, a first authorization page is sent to the user terminal; wherein, the first authorization page includes a masked identity identification code; When the user client confirms the authorization instruction, a token request is sent to the authentication server. Receive the token returned by the authentication server to complete user identity authentication.

[0095] In the second implementation, the user authentication based on the user authentication policy includes: According to the first user authorization method, a first authorization page is sent to the user terminal; wherein, the first authorization page includes a masked identity identification code; When the user client confirms the authorization instruction, a WebAuthn verification request is sent to the authentication server. Receive the challenge value returned by the authentication server; After the user terminal is securely verified and the verification is successful, the challenge value is signed using a preset private key to generate a verification credential. Send the verification credentials to the authentication server; The system receives a token returned by the authentication server after verifying the verification credential using a preset public key and passing the verification, thereby completing the user identity authentication.

[0096] In the third implementation, the user authentication based on the user authentication policy includes: According to the second user authorization method, a second authorization page is sent to the user terminal; wherein, the second authorization page includes a masked identity code to be entered; When the complete identity code input by the user is received, a token request is sent to the authentication server; wherein the token request carries the complete identity code. The system receives a token returned by the authentication server after verifying the complete identity code and passing the verification, thereby completing the user identity authentication.

[0097] In the fourth implementation, the user authentication based on the user authentication policy includes: According to the second user authorization method, a second authorization page is sent to the user terminal; wherein, the second authorization page includes a masked identity code to be entered; When the complete identity code input by the user is received, a WebAuthn verification request is sent to the authentication server; wherein the WebAuthn verification request carries the complete identity code; Receive the challenge value returned by the authentication server after verifying the complete identity code and passing the verification; After the user terminal is securely verified and the verification is successful, the challenge value is signed using a preset private key to generate a verification credential. Send the verification credentials to the authentication server; The system receives a token returned by the authentication server after verifying the verification credential using a preset public key and passing the verification, thereby completing the user identity authentication.

[0098] It should be noted that the user authentication method applied to the business side provided in this embodiment of the invention corresponds one-to-one with all the process steps of the user authentication method applied to the authentication server in the above embodiments. The working principle and beneficial effects of the two are the same, so they will not be described again.

[0099] See Figure 6This is a schematic diagram of a user authentication device provided in an embodiment of the present invention. The present invention also provides a user authentication device 10, applied to an authentication server, the device 10 comprising: The identity authentication request receiving module 11 is used to receive user identity authentication requests and user data sent by the business terminal; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; The risk assessment result generation module 12 is used to respond to the user identity authentication request, perform a risk assessment based on the user data, and generate a risk assessment result; The identity authentication strategy generation module 13 is used to generate a corresponding user identity authentication strategy based on the risk assessment results; wherein, the user identity authentication strategy includes the user authorization method and whether to perform WebAuthn verification; The first user authentication module 14 is used to perform user authentication according to the user authentication strategy.

[0100] It should be noted that the user authentication device for the authentication server provided in this embodiment of the invention is used to execute all the process steps of the user authentication method for the authentication server described in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0101] See Figure 7 This is a schematic diagram of another user authentication device provided in an embodiment of the present invention. The present invention also provides another user authentication device 20, applied to a business terminal. The device 20 includes: User data collection module 21 is used to collect user data when it receives a user authentication request sent by a user terminal; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; User data sending module 22 is used to send the user identity authentication request and the user data to the authentication server; The identity authentication policy receiving module 23 is used to receive the user identity authentication policy sent by the authentication server; wherein, the user identity authentication policy is generated by the authentication server based on the risk assessment result after performing a risk assessment on the user data; the user identity authentication policy includes the user authorization method and whether to perform WebAuthn verification; The second user authentication module 24 is used to perform user authentication according to the user authentication strategy.

[0102] It should be noted that the user authentication device for the business side provided in this embodiment of the invention is used to execute all the process steps of the user authentication method for the business side in the above embodiment. The working principle and beneficial effect of the two are one-to-one, so they will not be described again.

[0103] This invention also provides a user authentication device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the user authentication method as described in any of the above embodiments.

[0104] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to perform the user authentication method as described in any of the above embodiments.

[0105] This invention also provides a computer program product, which includes a computer program or computer instructions. When the computer program or computer instructions are executed by a processor, they implement the user authentication method as described in any of the above embodiments.

[0106] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0107] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A user authentication method, characterized in that, Applied to the authentication server, the method includes: Receive user authentication requests and user data sent by the business terminal; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; In response to the user authentication request, a risk assessment is performed based on the user data, and a risk assessment result is generated; Based on the risk assessment results, a corresponding user authentication strategy is generated; wherein, the user authentication strategy includes the user authorization method and whether WebAuthn verification is performed; User authentication is performed according to the aforementioned user authentication strategy.

2. The user authentication method as described in claim 1, characterized in that, The risk assessment results include risk assessment levels, which include low risk, medium risk, and high risk.

3. The user authentication method as described in claim 2, characterized in that, The step of generating a corresponding user authentication strategy based on the risk assessment results includes: When the risk assessment result is low risk, a first strategy is generated; wherein, the first strategy includes a first user authorization method and no WebAuthn verification required; the first user authorization method is that the user confirms the masked identity code; When the risk assessment result is medium risk level, determine whether the user terminal has bound the WebAuthn credential based on the user data; If the user's client has already bound a WebAuthn credential, a second policy is generated; wherein, the second policy includes the first user authorization method and requires WebAuthn verification; If the user's client has not bound a WebAuthn credential, a third policy is generated; wherein, the third policy includes a second user authorization method and no WebAuthn verification required; the second user authorization method is for the user to input a complete identity verification code; When the risk assessment result is high risk, a fourth strategy is generated; wherein, the fourth strategy includes the second user authorization method and requires WebAuthn verification.

4. The user authentication method as described in claim 3, characterized in that, The step of authenticating user identity according to the user identity authentication policy includes: When the risk assessment result is low risk, the first strategy is sent to the business side; Receive a token request sent by the business terminal; wherein the token request is generated by the business terminal after obtaining authorization from the user terminal using the first user authorization method; In response to the token request, a token is returned to the business terminal to complete user authentication.

5. The user authentication method as described in claim 3, characterized in that, The step of authenticating user identity according to the user identity authentication policy includes: When the risk assessment result is medium risk level and the user has bound WebAuthn credentials, the second strategy is sent to the business side; Receive a WebAuthn verification request sent by the business terminal; wherein the WebAuthn verification request is generated by the business terminal after obtaining authorization from the user terminal using the first user authorization method; In response to the WebAuthn verification request, a challenge value is returned to the business terminal; Receive the verification credential sent by the service terminal; wherein, the verification credential is generated by the service terminal after performing security verification on the user terminal and passing the verification, and then signing the challenge value with a preset private key; After verifying the verification credential using a preset public key and passing the verification, a token is returned to the business terminal to complete the user identity authentication.

6. The user authentication method as described in claim 3, characterized in that, The step of authenticating user identity according to the user identity authentication policy includes: When the risk assessment result is medium risk level and the user terminal has not bound WebAuthn credentials, the third strategy is sent to the business terminal; Receive a token request sent by the business terminal; wherein the token request is generated by the business terminal after obtaining authorization from the user terminal using the second user authorization method, and the token request carries a complete identity identification code; In response to the token request, the complete identity identifier is verified and, after successful verification, a token is returned to the business terminal to complete user identity authentication.

7. The user authentication method as described in claim 3, characterized in that, The step of authenticating user identity according to the user identity authentication policy includes: When the risk assessment result is high risk, the fourth strategy will be sent to the business side; Receive a WebAuthn verification request sent by the business terminal; wherein the WebAuthn verification request is generated by the business terminal after obtaining authorization from the user terminal using the second user authorization method, and the WebAuthn verification request carries a complete identity identification code; In response to the WebAuthn verification request, the complete identity code is verified and, after successful verification, a challenge value is returned to the business terminal. Receive the verification credential sent by the service terminal; wherein, the verification credential is generated by the service terminal after performing security verification on the user terminal and passing the verification, and then signing the challenge value with a preset private key; After verifying the verification credential using a preset public key and passing the verification, a token is returned to the business terminal to complete the user identity authentication.

8. The user authentication method as described in claim 6, characterized in that, The third strategy also includes: registering WebAuthn credentials; The step of performing user authentication according to the user authentication strategy further includes: Receive the WebAuthn registration request sent by the business terminal; In response to the WebAuthn registration request, the registration of the WebAuthn credentials for the user client is performed.

9. The user authentication method as described in claim 2, characterized in that, The step of responding to the user authentication request by performing a risk assessment based on the user data and generating a risk assessment result includes: Based on the user data, risk values ​​are calculated in the device environment dimension, behavioral dynamics dimension, and historical trust dimension, respectively. The initial risk assessment score is calculated by weighted summation based on the risk value and preset weight value of each dimension. The initial risk assessment score is adjusted according to a preset environmental fluctuation coefficient to obtain the final risk assessment score; The risk assessment level is determined based on the risk assessment score, and this level serves as the risk assessment result.

10. The user authentication method as described in claim 9, characterized in that, The step of calculating risk values ​​based on the user data in terms of device environment, behavioral dynamics, and historical trust dimensions includes: Based on the user data, data factors for the device environment dimension, the behavioral dynamic dimension, and the historical trust dimension are determined; Based on the data factors of the device environment dimension, the behavioral dynamic dimension, and the historical trust dimension, calculate the risk value corresponding to the device environment dimension, the behavioral dynamic dimension, and the historical trust dimension. The data factors in the device environment dimension include device fingerprint information, network environment information, and WebAuthn credential status; the data factors in the behavior dynamic dimension include user behavior information, which includes user input features, WebAuthn authentication behavior, and user interaction behavior; and the data factors in the historical trust dimension include historical risk assessment results and WebAuthn usage records.

11. A user authentication method, characterized in that, When applied to the business side, the method includes: When a user authentication request is received from a user terminal, user data is collected; wherein, the user data includes device fingerprint information, network environment information, user behavior information, and WebAuthn information; Send the user authentication request and the user data to the authentication server; The system receives a user authentication policy sent by the authentication server; wherein the user authentication policy is generated by the authentication server based on the risk assessment results after performing a risk assessment on the user data; the user authentication policy includes the user authorization method and whether WebAuthn verification is performed. User authentication is performed according to the aforementioned user authentication strategy.

12. The user authentication method as described in claim 11, characterized in that, The user authentication strategy is a first strategy, which includes a first user authorization method and no WebAuthn verification required. The first user authorization method involves the user confirming the masked identity identifier code; The step of performing user authentication according to the user authentication strategy includes: According to the first user authorization method, a first authorization page is sent to the user terminal; wherein, the first authorization page includes a masked identity identification code; When the user client confirms the authorization instruction, a token request is sent to the authentication server. Receive the token returned by the authentication server to complete user identity authentication.

13. The user authentication method as described in claim 11, characterized in that, The user authentication strategy is a second strategy, which includes a first user authorization method and requires WebAuthn verification. The first user authorization method involves the user confirming the masked identity identifier code; The step of performing user authentication according to the user authentication strategy includes: According to the first user authorization method, a first authorization page is sent to the user terminal; wherein, the first authorization page includes a masked identity identification code; When the user client confirms the authorization instruction, a WebAuthn verification request is sent to the authentication server. Receive the challenge value returned by the authentication server; After the user terminal is securely verified and the verification is successful, the challenge value is signed using a preset private key to generate a verification credential. Send the verification credentials to the authentication server; The system receives a token returned by the authentication server after verifying the verification credential using a preset public key and passing the verification, thereby completing the user identity authentication.

14. The user authentication method as described in claim 11, characterized in that, The user authentication strategy is a third strategy, which includes a second user authorization method and no WebAuthn verification required; The second user authorization method involves the user entering their complete identity verification code; The step of performing user authentication according to the user authentication strategy includes: According to the second user authorization method, a second authorization page is sent to the user terminal; wherein, the second authorization page includes a masked identity code to be entered; When the complete identity code input by the user is received, a token request is sent to the authentication server; wherein the token request carries the complete identity code. The system receives a token returned by the authentication server after verifying the complete identity code and passing the verification, thereby completing the user identity authentication.

15. The user authentication method as described in claim 11, characterized in that, The user authentication strategy is the fourth strategy, which includes the second user authorization method and requires WebAuthn verification; The second user authorization method involves the user entering their complete identity verification code; The step of performing user authentication according to the user authentication strategy includes: According to the second user authorization method, a second authorization page is sent to the user terminal; wherein, the second authorization page includes a masked identity code to be entered; When the complete identity code input by the user is received, a WebAuthn verification request is sent to the authentication server; wherein the WebAuthn verification request carries the complete identity code; Receive the challenge value returned by the authentication server after verifying the complete identity code and passing the verification; After the user terminal is securely verified and the verification is successful, the challenge value is signed using a preset private key to generate a verification credential. Send the verification credentials to the authentication server; The system receives a token returned by the authentication server after verifying the verification credential using a preset public key and passing the verification, thereby completing the user identity authentication.

16. A user authentication device, characterized in that, The device, used in authentication servers, includes: The identity authentication request receiving module is used to receive user identity authentication requests and user data sent by the business terminal; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; The risk assessment result generation module is used to respond to the user authentication request, perform a risk assessment based on the user data, and generate a risk assessment result. An identity authentication strategy generation module is used to generate a corresponding user identity authentication strategy based on the risk assessment results; wherein, the user identity authentication strategy includes the user authorization method and whether to perform WebAuthn verification; The first user authentication module is used to perform user authentication according to the user authentication strategy.

17. A user authentication device, characterized in that, The device, applied to the business side, includes: The user data collection module is used to collect user data when it receives a user authentication request sent by the user terminal; wherein, the user data includes device fingerprint information, network environment information, user behavior information and WebAuthn information; The user data sending module is used to send the user identity authentication request and the user data to the authentication server; An identity authentication policy receiving module is used to receive a user identity authentication policy sent by the authentication server; wherein, the user identity authentication policy is generated by the authentication server based on the risk assessment results after performing a risk assessment on the user data; the user identity authentication policy includes the user authorization method and whether WebAuthn verification is performed; The second user authentication module is used to perform user authentication according to the user authentication strategy.

18. A user authentication device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the user authentication method as described in any one of claims 1 to 15.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the user authentication method as described in any one of claims 1 to 15.

20. A computer program product, characterized in that, The computer program product includes a computer program or computer instructions, which, when executed by a processor, implement the user authentication method as described in any one of claims 1 to 15.

Images