User identity authentication method and device, electronic equipment and storage medium

Abstract

The invention discloses a user identity authentication method and device, electronic equipment and a storage medium, and relates to the field of financial science and technology or other related fields, and the method comprises the steps: extracting identity authentication information carried in a business operation request under the condition that the business operation request of a user is received, and the identity authentication information at least comprises an authentication signature and identity information; performing verification according to the authentication signature to obtain a first verification result, the first verification result being used for indicating whether the identity information experiences an abnormal change attack; verification is carried out according to the first verification result, the identity information and a preset abnormal list, a second verification result is obtained, and a failure user identifier and a failure timestamp are stored in the preset abnormal list; and responding to the business operation request according to the second verification result to obtain a business operation result. Through the method and the device, the technical problem that security is insufficient due to the fact that an identity authentication mechanism has defects and cannot resist forgery attacks in related technologies is solved.

Description

Technical Field

[0001] This invention relates to the field of financial technology or other related fields, and more specifically, to a user identity authentication method and apparatus, electronic device, and storage medium. Background Technology

[0002] Currently, most online financial systems in the industry use Cookie-Session user authentication. The principle is to store data on both the client and server sides and verify the legitimacy of the user's identity through data comparison. When a user successfully authenticates for the first time, the server returns a "Set-Cookie" field in the response header, containing a unique session identifier (Session ID). The client browser stores this identifier in a cookie and sends it to the server in subsequent requests. The server checks the Session ID in the cookie to determine if the request comes from an authenticated user and performs appropriate authorization processing.

[0003] The existing solutions mentioned above have poor security for cookies, making online financial systems vulnerable to cross-site forgery attacks. Therefore, additional security measures are needed to protect session information. Furthermore, storing session state on the server consumes a lot of storage and computing resources, which puts a lot of pressure on the server.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] The main objective of this application is to provide a user identity authentication method, device, electronic device, and storage medium to at least solve the technical problem that the identity authentication mechanism in the related technology is flawed, unable to resist forgery attacks, and thus lacks security.

[0006] To achieve the above objectives, according to one aspect of this application, a user identity authentication method is provided. The method includes: upon receiving a user's business operation request, extracting identity authentication information carried in the business operation request, wherein the identity authentication information includes at least: an authentication signature and identity information; verifying the authentication signature to obtain a first verification result, wherein the first verification result indicates whether the identity information has undergone an abnormal change attack; verifying the first verification result, the identity information, and a preset abnormal list to obtain a second verification result, wherein the preset abnormal list stores an invalid user identifier and an invalid timestamp; and responding to the business operation request based on the second verification result to obtain a business operation result.

[0007] Further, the step of verifying based on the first verification result, the identity information, and the preset abnormal list to obtain the second verification result includes: if the first verification result indicates that the identity information has not undergone an abnormal change attack, extracting the user identity identifier and the identity information issuance timestamp from the identity information; and verifying the user identity identifier and the identity information issuance timestamp based on the preset abnormal list to obtain the second verification result.

[0008] Furthermore, the step of verifying based on the first verification result, the identity information, and the preset abnormal list to obtain the second verification result also includes: if the first verification result indicates that the identity information has undergone an abnormal change attack, determining that the second verification result is a verification failure.

[0009] Further, the step of verifying the user identity identifier and the identity information issuance timestamp based on the preset abnormal list to obtain the second verification result includes: querying the preset abnormal list based on the user identity identifier; if an invalid user identifier matching the user identity identifier is found in the preset abnormal list, extracting the invalid timestamp corresponding to the invalid user identifier; comparing the invalid timestamp with the smallest time interval from the current timestamp with the identity information issuance timestamp to obtain a comparison result; and generating the second verification result based on the comparison result.

[0010] Furthermore, the step of verifying the user identity identifier and the identity information issuance timestamp to obtain the second verification result further includes: if no invalid user identifier matching the user identity identifier is found in the preset abnormal list, the second verification result is determined to be a successful verification.

[0011] Further, the step of generating the second verification result based on the comparison result includes: if the expiration timestamp with the smallest time interval from the current timestamp is earlier than the identity information issuance timestamp, determining the second verification result as verification passed; if the expiration timestamp with the smallest time interval from the current timestamp is later than the identity information issuance timestamp, determining the second verification result as verification failed.

[0012] Further, the step of responding to the business operation request based on the second verification result to obtain the business operation result includes: if the second verification result indicates that the verification failed, setting the business operation result to a rejection operation, generating a response error message based on the business operation request, and returning the business operation result and the response error message to the user; or, if the second verification result indicates that the verification passed, executing the target financial business based on the business operation request to obtain the business operation result, and returning the business operation result to the user.

[0013] To achieve the above objectives, according to another aspect of this application, a user identity authentication device is also provided. The device includes: an extraction unit, configured to extract identity authentication information carried in a user's business operation request upon receiving such a request, wherein the identity authentication information includes at least an authentication signature and identity information; a first verification unit, configured to verify based on the authentication signature to obtain a first verification result, wherein the first verification result indicates whether the identity information has undergone an abnormal change attack; a second verification unit, configured to verify based on the first verification result, the identity information, and a preset abnormal list to obtain a second verification result, wherein the preset abnormal list stores an invalid user identifier and an invalid timestamp; and a response unit, configured to respond to the business operation request based on the second verification result to obtain a business operation result.

[0014] Furthermore, the second verification unit includes: an extraction module, used to extract the user identity identifier and the identity information issuance timestamp from the identity information when the first verification result indicates that the identity information has not undergone an abnormal change attack; and a verification module, used to verify the user identity identifier and the identity information issuance timestamp according to the preset abnormal list to obtain the second verification result.

[0015] Furthermore, the second verification unit further includes a determining module, configured to determine that the second verification result is a verification failure when the first verification result indicates that the identity information has undergone an abnormal change attack.

[0016] Further, the verification module includes: a query submodule, used to query the preset abnormal list based on the user identity identifier; an extraction submodule, used to extract the failure timestamp corresponding to the failure user identifier when a failure user identifier matching the user identity identifier is found in the preset abnormal list; a comparison submodule, used to compare the failure timestamp with the smallest time interval from the current timestamp with the identity information issuance timestamp to obtain a comparison result; and a generation submodule, used to generate the second verification result based on the comparison result.

[0017] Furthermore, the verification module also includes a first determining submodule, used to determine the second verification result as verification passed if no invalid user identifier matching the user identity identifier is found in the preset abnormal list.

[0018] Furthermore, the generation submodule includes: a second determining submodule, configured to determine the second verification result as verification passed when the expiration timestamp with the smallest time interval from the current timestamp is earlier than the identity information issuance timestamp; and a third determining submodule, configured to determine the second verification result as verification failed when the expiration timestamp with the smallest time interval from the current timestamp is later than the identity information issuance timestamp.

[0019] Furthermore, the response unit includes: a setting module, configured to set the business operation result to a rejection operation when the second verification result indicates that the verification failed, generate response error information according to the business operation request, and return the business operation result and the response error information to the user; and an execution module, configured to execute the target financial business according to the business operation request when the second verification result indicates that the verification passed, obtain the business operation result, and return the business operation result to the user.

[0020] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the user authentication method described in any of the above claims.

[0021] To achieve the above objectives, according to another aspect of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the user authentication method described in any of the above claims.

[0022] To achieve the above objectives, according to another aspect of this application, a computer program product is also provided, including computer instructions, wherein when the computer instructions are executed by a processor, they implement the steps of the user identity authentication method described in any one of the preceding claims.

[0023] This invention proposes a user identity authentication method. First, upon receiving a user's business operation request, the method extracts the identity authentication information carried in the request. This authentication information includes at least an authentication signature and identity information. Then, the authentication signature is verified to obtain a first verification result, which indicates whether the identity information has undergone an abnormal change attack. Next, the first verification result, the identity information, and a preset abnormal list are used for verification to obtain a second verification result. The preset abnormal list stores invalid user identifiers and invalid timestamps. Finally, the method responds to the business operation request based on the second verification result to obtain the business operation result.

[0024] This invention employs a token-based authentication method, integrating HMAC SHA256 encryption technology and dynamic inactive account status monitoring to accurately identify the authenticity and timeliness of user identity information. This significantly enhances system security and optimizes resource utilization, thereby solving the technical problem of insufficient security caused by deficiencies in identity authentication mechanisms in related technologies, which cannot resist forgery attacks.

[0025] Specifically, the system first analyzes received business operation requests to extract identity authentication information, including but not limited to encrypted authentication signatures and identity data. Then, it verifies the authentication signature using an encryption algorithm, generating a first verification result that clearly indicates whether the user's submitted identity information has undergone any abnormal changes or unauthorized modifications. Subsequently, a dynamic inactive account status monitoring mechanism performs a second verification on the user's identity information that passed the initial verification, yielding a second verification result. This second verification mechanism is essentially an intelligent account management tool, maintaining user identifiers for known inactive states and their corresponding inactive timestamps. By comparing these, it can quickly determine the current usability of a user's account, preventing risks caused by temporary account inactivation even when the signature verification is correct. This ensures that every business operation request originates from a legitimate and valid account status. Finally, it responds based on the second verification result, achieving ideal feedback for the business operation. This not only significantly improves security standards in the financial transaction field and reduces the success rate of forgery attacks but also promotes the rational allocation of resources and improves the overall efficiency of system operation. Attached Figure Description

[0026] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0027] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a user authentication method is shown.

[0028] Figure 2 This is a flowchart of an optional user identity authentication method according to an embodiment of the present invention;

[0029] Figure 3 This is a schematic diagram of the structure of an optional token according to an embodiment of the present invention;

[0030] Figure 4 This is an optional identity authentication flowchart according to an embodiment of the present invention;

[0031] Figure 5 This is a schematic diagram of an optional user identity authentication device according to an embodiment of the present invention;

[0032] Figure 6 This is a structural block diagram of an electronic device that performs a user authentication method according to an embodiment of the present invention. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0036] In identity authentication and authorization management, a token refers to an access token, a unique identifier generated by the server and used for secure transmission between the client and the server. The token in this invention consists of a payload and a signature, used to verify the identity of online banking users and authorize them to perform business operations.

[0037] The payload, the part of the token, contains information such as user ID, issuance timestamp, expiration timestamp, and user name. In this invention, the payload uses commas to separate different elements, exists as a string, and is Base64 encoded to ensure security during transmission.

[0038] The Signature, the signature portion of the Token, is used to verify the integrity and authenticity of the Payload, ensuring that the Token has not been tampered with or forged during transmission. This invention can generate the Signature using a fixed HMAC SHA256 encryption algorithm, achieved by combining the Payload and the server key (Secret).

[0039] HMAC SHA256, an abbreviation of HMAC (Hash-based Message Authentication Code) and SHA256 (Secure Hash Algorithm 256), is a message authentication code based on a hash algorithm. In this invention, the HMAC SHA256 algorithm is used to generate the token's signature, ensuring the token's unforgeability and security.

[0040] The dynamic inactive account status monitoring mechanism is used to track and manage user accounts that have been marked as inactive. It dynamically updates and queries information by storing user IDs and expiration timestamps to determine whether the token should be rejected or whether the user account status allows the continued use of the token for business operations.

[0041] An attack involving abnormal changes to identity information refers to any unauthorized modification of a user's identity information, including but not limited to tampering with the payload in a user's token or forging a signature, in an attempt to impersonate a legitimate user to conduct business operations.

[0042] It should be noted that the user authentication method and device in this application can be used in the financial technology field for identity verification and authorization management of online banking users, and can also be used in any field other than the financial technology field for identity verification and authorization management of online banking users. This application does not limit the application field of the user authentication method and device.

[0043] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) involved in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, processing, transmission, provision, disclosure, use, and handling of such data comply with the laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse access. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0044] The information collection (e.g., user voice, video, and text collection) and analysis operations involved in this application have provided users with corresponding operation entry points during execution, allowing users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0045] The following embodiments of the present invention can be applied to various systems / applications / devices requiring user authentication and access control, enabling a token-based dynamic security authentication mechanism. The present invention uses the HMAC SHA256 encryption algorithm to encrypt user identity information and generate a signature, then combines this with dynamic inactive account status monitoring technology for secondary verification. This better ensures the integrity and authenticity of user identity information while being more efficient in terms of resource consumption. This mechanism, through intelligent filtering and dynamic updating of inactive account identifiers and their expiration times, avoids the use of invalid tokens, ensures the security and validity of each business operation request, and enhances the overall security of the system.

[0046] For example, the implementation of this invention can be widely applied to online payment platforms, mobile banking applications, financial transaction terminals, etc. By simplifying and securing token transmission and verification, it not only improves the efficiency of identity authentication but also significantly reduces server load, enabling the system to maintain high security and stability while handling large-scale concurrent requests. Especially when users change their passwords, suspend their accounts, or perform sensitive operations, the dynamic security authentication mechanism can respond promptly to changes in account status, preventing potential unauthorized access attempts.

[0047] The present invention will now be described in detail with reference to various embodiments.

[0048] Example 1

[0049] According to an embodiment of the present invention, an embodiment of a user identity authentication method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0050] The user authentication method provided in Embodiment 1 of the present invention can be executed in a mobile terminal, computer terminal or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a user authentication method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0051] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0052] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the user authentication method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned user authentication method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0053] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0054] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0055] Under the above operating environment, the present invention provides, as follows: Figure 2The user authentication method shown is implemented by an online banking system. It combines HMAC SHA256 encryption and dynamic inactive account status monitoring technology for financial transaction authentication scenarios. In particular, it addresses the issues of abnormal identity information change attacks and resource consumption optimization. Through token-based identity verification and dynamic account status verification, the specific implementation steps include: receiving and parsing, signature verification, account status verification, and response decision-making, in order to improve the security and efficiency of online banking user authentication and reduce resource consumption.

[0056] The embodiments of the present invention will now be described in detail with reference to each specific step.

[0057] Figure 2 This is a flowchart of an optional user authentication method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0058] Step S201: Upon receiving a user's business operation request, extract the identity authentication information carried in the business operation request. The identity authentication information includes at least: authentication signature and identity information.

[0059] In this embodiment, "user" refers to an individual or enterprise that conducts financial transactions or manages personal accounts through online banking or fintech platforms. Users need to undergo identity verification to securely access and operate their accounts to prevent unauthorized access. A business operation request refers to a request made by a user when using online banking services, such as a transfer request, an account information inquiry request, or a loan application. Each request carries identity authentication information so that the system can verify the user's identity and authorize the operation.

[0060] It should be noted that, in order to verify a user's identity, the financial system requires the user to provide a specific set of information, namely, identity authentication information. This includes not only the user's basic information, such as username or account ID, but also an authentication signature used to verify the integrity and authenticity of the information. In this invention, the identity authentication information is encapsulated in a token and sent to the server via an HTTP request header or body. The authentication signature is generated using an encryption algorithm (such as HMAC SHA256), typically based on the content of the identity information and a private key, ensuring that the identity information is not tampered with during transmission. Identity information refers to a detailed description of the user's identity, including but not limited to user ID, issuance timestamp, expiration timestamp, and optional username. In this invention, the identity information is stored in a specific format in the token's payload to enable the system to perform fast and accurate identity verification.

[0061] Figure 3 This is a schematic diagram of the structure of an optional token according to an embodiment of the present invention, such as... Figure 3 As shown, the Token consists of two parts: Payload and Signature. The Header part in the existing structure is omitted. Because this invention uses a fixed Token type and HMAC SHA256 encryption algorithm to ensure the security of the Token, there is no need to declare the Token type and encryption algorithm, thereby shortening the Token length and improving the system authentication efficiency.

[0062] The Payload is a string used to store user data. Different elements are distinguished by using the delimiter "," and the element order is fixed as sub, iat, exp, and name. The field descriptions are shown in Table 1 below. The string form of the Payload is Base64 encoded and becomes the first part of the Token.

[0063] Table 1

[0064]

[0065] The Signature is used to verify the integrity and authenticity of the Token, ensuring that it has not been tampered with or forged. First, a key (Secret) is specified for Token issuance and verification. Then, a signature is generated using a fixed HMAC SHA256 algorithm as the second part of the Token: HMACSHA256(base64UrlEncode(payload),secret). After generating the signature, the Payload and Signature are concatenated into a string using ".", forming the final Token.

[0066] The main goal of the above steps is to address the security and resource consumption issues of traditional Cookie-Session user authentication methods. By introducing a token-based authentication mechanism and dynamic inactive account status monitoring, the efficiency and security of authentication can be improved, while reducing server resource usage.

[0067] Step S202: Verify based on the authentication signature to obtain a first verification result, wherein the first verification result is used to indicate whether the identity information has undergone an abnormal change attack.

[0068] Specifically, the first verification result is mainly used in the identity verification process to determine whether the identity information (i.e., the Payload part of the Token) is complete and tamper-proof, and whether the signature is genuine and valid. It is derived from the authentication signature of the Token and is a preliminary judgment on the authenticity of the identity information. In this embodiment, the HMAC SHA256 encryption algorithm is used to encrypt the Payload part of the Token and compare it with the Signature in the Token. If the calculated signature matches the stored signature, it is considered that the identity information has not undergone an abnormal alteration attack; otherwise, a security risk is indicated.

[0069] Anomaly attacks refer to the unauthorized alteration, forgery, or theft of a user's identity information to gain illegal access or perform unauthorized business operations. For example, an attacker might intercept a user's token and attempt to change the user ID or expiration time to impersonate a legitimate user, or extend the token's validity period to maintain unauthorized access.

[0070] The goal of the above steps is to improve the accuracy of online banking user authentication, prevent unauthorized access caused by identity information tampering, and enhance system security by instantly detecting and blocking tokens that have undergone abnormal change attacks.

[0071] Step S203: Verify based on the first verification result, identity information and preset abnormal list to obtain the second verification result, wherein the preset abnormal list stores the invalid user identifier and invalid timestamp.

[0072] It should be noted that the preset anomaly list is a database or data structure used to maintain system security, storing all invalid user identifiers and their corresponding expiration timestamps. In this embodiment, it is used to dynamically monitor the status of user accounts. Specifically, when a user account becomes invalid due to password changes, account suspension, or other reasons, the financial implementation system adds the relevant tokens to the preset anomaly list to prevent their continued use. The storage and retrieval efficiency of the preset anomaly list directly impacts the performance of the financial implementation system. During the design phase, efficient database indexing techniques or in-memory data structures (such as hash tables or skip lists) can be employed to accelerate query speed, reduce latency, and ensure the smoothness and responsiveness of online banking services.

[0073] The second verification result is the result of a further check after the first verification result (i.e., verifying the integrity of the token's signature) to see if the identity information matches a record in a pre-defined anomaly list. If the identity information matches an invalid user identifier in the list, and the current time is later than the identifier's expiration timestamp, the second verification result will indicate that the token is invalid; otherwise, it will indicate that the token is valid. To ensure real-time performance and accuracy, the generation of the second verification result requires ensuring the real-time updating and rapid querying of the pre-defined anomaly list. This involves real-time data synchronization technology, high-speed caching strategies, or efficient data update mechanisms to maintain the latest state of the list and avoid any potential authentication vulnerabilities.

[0074] It's important to note that an invalid user identifier refers to an account ID or token marked as invalid by the system based on security policies or user behavior (such as password changes or account cancellation). An invalidation timestamp records the precise time when the invalidation status took effect, used to determine whether a token is still valid at a given moment. When handling invalid user identifiers and timestamps, a time window technique can be used to avoid frequent list updates and queries. For example, a financial implementation system can set a time window (e.g., 5 minutes). During this period, any newly added invalid identifiers are temporarily cached and not immediately updated to the preset abnormal list until the time window ends, thus reducing the frequency of database read / write operations.

[0075] The goal of the above steps is to enhance the security and accuracy of user identity authentication. By maintaining a preset abnormal list and combining it with identity information for secondary verification, the use of invalid tokens can be effectively identified and prevented, thereby preventing unauthorized access to accounts and ensuring the security of online banking transactions and the privacy of user data.

[0076] Optionally, in the user identity authentication method provided in the embodiments of the present invention, the step of verifying based on the first verification result, identity information and a preset abnormal list to obtain the second verification result includes: if the first verification result indicates that the identity information has not undergone an abnormal change attack, extracting the user identity identifier and the identity information issuance timestamp from the identity information; and verifying the user identity identifier and the identity information issuance timestamp based on the preset abnormal list to obtain the second verification result.

[0077] In this embodiment, the premise for proceeding with subsequent operations based on the first verification result is that the identity information has not undergone an abnormal alteration attack, that is, the token's verification signature can pass the HMAC SHA256 algorithm verification, ensuring that the token's payload has not been tampered with. After this verification, the user's identity identifier (e.g., user ID) and the identity information issuance timestamp (i.e., the token's issuance time) are retrieved from the identity information to prepare for the next verification step.

[0078] A user identifier, such as a user ID, is a unique identifier that can identify a user and is crucial for determining the user's account status during the authentication process. The token issuance timestamp is a time stamp used to verify the token's validity, helping the system determine if the token has expired and whether it will still be used after changes in the user's account status (such as password changes or account cancellation). Extracting the user identifier and issuance timestamp is for secondary verification, ensuring that the token has not only not been tampered with but is also no longer used after changes in the user's account status (such as password changes or account suspension).

[0079] Verifying user identity and issuance timestamp based on a pre-set abnormal list (i.e., a dynamic list of inactive accounts) can be achieved using the following methods:

[0080] Direct comparison: Upon receiving a business operation request, immediately query the records in the pre-set exception list and compare the user identity identifier and issuance timestamp carried in the request with any identifier and its expiration time in the list. If they match, and the timestamp of the request is later than the expiration timestamp in the list, the token is considered invalid, and a second verification result is returned indicating that the token is invalid.

[0081] Time window verification: A time window (e.g., 10 minutes) can be set. During this period after a user's account status changes, any requests made using that user's identity will be rejected, regardless of the token's issuance timestamp. This method enhances real-time response, ensuring that tokens become invalid immediately after an account change.

[0082] Continuity verification: This checks the continuity of user requests, specifically verifying the consistency of tokens between user requests. If a user is detected using multiple different tokens within a short period, or if there are abnormal jumps in the token issuance timestamps (such as time reversal or jumps), it indicates possible abnormal operation. The system marks these tokens for further review or may even reject them immediately, responding with a second verification result.

[0083] In conjunction with user behavior analysis: the legitimacy of the token can be further verified by analyzing user behavior patterns, such as login frequency, operation time, and geographical location. If abnormal behavior patterns are detected, even if the token passes the above verification, the system can mark the token as suspicious and conduct a more in-depth security check.

[0084] The goal of the above steps is to provide a secure, efficient, and resource-optimized online banking user authentication solution by establishing a token-based identity authentication mechanism combined with efficient and dynamic monitoring of inactive account status. This aims to address the low security and high resource consumption issues inherent in traditional cookie-session mechanisms, ensuring the legitimacy of user operations and the rational utilization of system resources.

[0085] Optionally, in the user identity authentication method provided in this embodiment of the invention, the step of verifying the user identity identifier and the identity information issuance timestamp based on a preset abnormal list to obtain a second verification result includes: querying the preset abnormal list based on the user identity identifier; if an invalid user identifier matching the user identity identifier is found in the preset abnormal list, extracting the invalid timestamp corresponding to the invalid user identifier; comparing the invalid timestamp with the smallest time interval from the current timestamp with the identity information issuance timestamp to obtain a comparison result; and generating a second verification result based on the comparison result.

[0086] The above method aims to reduce system resource consumption by using tokens to replace the traditional cookie-session mechanism, while enhancing the security of identity authentication and preventing unauthorized access or abnormal change attacks to accounts. The core is to dynamically maintain a preset abnormal list to respond in real time to changes in user account status, such as password changes and account cancellations, and ensure that any token associated with an invalid user identifier in the preset abnormal list is no longer valid, thereby effectively controlling and monitoring the usage status of tokens.

[0087] Specifically, after performing a preliminary security check on the token based on the initial verification result, further verification is needed to determine whether the token is still valid, especially after a change in the user's account status. This involves querying a pre-defined exception list using the user's identity identifier (such as user ID). If an invalid record matching the user's identity identifier in the request is found in the pre-defined exception list, it indicates that the token may pose a security risk, the user's account status (such as password or permissions) has changed, and these tokens no longer represent the user's current valid identity status.

[0088] The purpose of extracting the expiration timestamp is to determine whether the token continues to be used after the account status changes. If the token's issuance time is earlier than the expiration time of the account status change, it proves that the token has expired and should not be used for subsequent identity verification.

[0089] Choosing the expiration timestamp with the shortest interval from the current timestamp ensures timely response to the latest account status changes. Account status may change multiple times at different points in time, and the most recent expiration timestamp can most accurately reflect the user's current account status, thereby determining the validity of the token.

[0090] If the identity information issuance timestamp is later than the most recent expiration timestamp, it means the token was issued after the user account status changed, or issued before the account status changed but did not trigger the expiration condition; therefore, the token is still considered valid. Conversely, if the identity information issuance timestamp is earlier than or equal to the most recent expiration timestamp, it indicates the token was still being used after the user account status changed; therefore, the token is considered invalid, and the system rejects any business operation requests based on this token.

[0091] Optionally, in the user identity authentication method provided in this embodiment of the invention, the step of generating a second verification result based on the comparison result includes: determining the second verification result as verification passed when the expiration timestamp with the smallest time interval from the current timestamp is earlier than the identity information issuance timestamp; and determining the second verification result as verification failed when the expiration timestamp with the smallest time interval from the current timestamp is later than the identity information issuance timestamp.

[0092] The user authentication method provided in this invention aims to solve the security and resource consumption problems existing in the traditional Cookie-Session mechanism. By introducing a token-based identity authentication mechanism and dynamic inactive account status monitoring, it enhances the security and efficiency of online banking transactions.

[0093] If the expiration timestamp with the shortest time interval from the current timestamp is earlier than the identity information issuance timestamp, the second verification result is determined to be successful. This means that the token was issued before the user's account status changed (such as password reset or account cancellation), and the token's issuance timestamp is earlier than the expiration timestamp of the account status change. While the token was marked invalid when the user's account status changed, it remained valid until then. Therefore, the token is deemed still valid, allowing the user to perform business operations, demonstrating the mechanism's timely responsiveness and effective management of existing token status.

[0094] From a security perspective, the token's issuance timestamp is earlier than the expiration timestamp of the account status change, indicating that the user has already obtained the token before the account status changed, and any operation of the token before the account status change is legitimate, thus allowing the token to continue to be used for authentication.

[0095] If the expiration timestamp, with the shortest time interval from the current timestamp, is later than the identity information issuance timestamp, and the second verification result is determined to be verification failure, it means that the token was issued after the user's account status changed. Alternatively, even if the token was issued before the account status change, the user performed operations on the account after the token was issued, causing the account status to change. In this case, the token should be considered invalid, indicating that the user may have attempted to use an invalid token, thus triggering the system's security protection mechanism. Financial system security policies require that all related tokens should be immediately invalidated once the user's account status changes to prevent unauthorized access to the account. If the token's issuance time is earlier than the user's account status change time, continuing to use the token for operations violates the security policy and may pose a security risk; therefore, the token is deemed invalid to prevent potential unauthorized access.

[0096] Optionally, in the user identity authentication method provided in the embodiments of the present invention, the step of verifying the user identity identifier and the identity information issuance timestamp to obtain a second verification result further includes: if no invalid user identifier matching the user identity identifier is found in the preset abnormal list, the second verification result is determined to be a successful verification.

[0097] In this embodiment, when no invalid user identifier matching the user's identity is found in the preset abnormal list, the second verification result is automatically determined to be successful, allowing the user to continue business operations. This indicates that the user's account status has not experienced a security event that the system deems necessary to proactively relinquish the token. The preset abnormal list stores user records whose account status is considered abnormal (such as password change, account cancellation, etc.), intended to proactively relinquish all related tokens for these users. If no invalid record matching the user's identity is found in the list, it means that since the last token issuance, the user's account status has not undergone any significant changes requiring token relinquishment, the token status is still valid, and the token's payload information (such as user ID, issuance time, expiration time, etc.) still correctly reflects the user's current status. It can be confirmed that the user is using a legitimate and valid token, and verification can be directly passed, allowing the user to use the token for subsequent business operations.

[0098] Optionally, in the user identity authentication method provided in the embodiments of the present invention, the step of verifying based on the first verification result, identity information and a preset abnormal list to obtain the second verification result further includes: if the first verification result indicates that the identity information has undergone an abnormal change attack, determining that the second verification result is a verification failure.

[0099] The system implemented in this invention checks the integrity of the token's signature in the first stage of the verification process to confirm whether the token's payload (i.e., the identity information it carries) has been tampered with, thus protecting against security threats such as man-in-the-middle attacks and data integrity breaches. If the first verification result indicates that the identity information has undergone an abnormal alteration attack, it means that the token's payload may have been illegally modified, its content is no longer trustworthy, and may no longer reflect the user's true identity information.

[0100] In this scenario, the system implementing this invention will directly determine the second verification result as verification failed. Any illegal modification of identity information will compromise the integrity and authenticity of the token. Unauthorized third parties impersonating legitimate users will seriously threaten the security of the online banking system and the safety of users' funds. Given that the cornerstone of token security is the immutability of the payload, once signs of payload tampering are detected, its continued use must be prevented to avoid potential security risks.

[0101] The goal of the above steps is to improve the security, efficiency, and resource conservation of online banking systems through innovative identity authentication mechanisms. Specifically, by using token-based authentication methods combined with dynamic exception lists and efficient data structure design, legitimate user requests can be responded to quickly, while abnormal or potentially abnormal operations can be identified and blocked in a timely manner, effectively protecting user information security and transaction security.

[0102] Step S204: Respond to the business operation request based on the second verification result to obtain the business operation result.

[0103] The above steps constitute the final stage of the identity authentication process and are crucial for the execution of business operations. At this stage, the system responds to the user's business operation request based on all previous verification results (the first and second verification results). If the verification result indicates that the token is valid and the user's account status is normal, the requested business operation, such as account inquiry or fund transfer, is executed. If the verification result indicates that the token is invalid or the user's account status is abnormal, a corresponding error message is generated, and the business operation is refused.

[0104] Optionally, in the user identity authentication method provided in this embodiment of the invention, the step of responding to a business operation request based on a second verification result to obtain a business operation result includes: if the second verification result indicates that the verification failed, setting the business operation result to a rejected operation, generating a response error message based on the business operation request, and returning the business operation result and the response error message to the user; or, if the second verification result indicates that the verification passed, executing the target financial business based on the business operation request, obtaining a business operation result, and returning the business operation result to the user.

[0105] In this embodiment, when the second verification result indicates that the verification fails, the business operation is refused and a specific response error message is generated and returned to the user. This ensures that any invalid or suspicious token will not be used to perform financial operations, thereby protecting the security of the system and the user's assets. When the verification result is successful, the corresponding financial business, such as account inquiry, transfer, payment, etc., is executed according to the business operation request, and the result of the business operation is returned to the user.

[0106] Different reasons for verification failures correspond to different error messages. For example, an expired token might return "Token expired, please log in again"; an abnormal account status might return "Account abnormal, please contact customer service"; and a tampered token might return "Token integrity verification failed, operation unauthorized." Each error message details the reason for the verification failure, helping users understand the problem and take appropriate action.

[0107] If the verification is successful, the target financial transaction will be executed according to the business operation request, which may include:

[0108] Account balance check: For transactions involving funds, such as transfers and payments, first check the available balance of the user's account to ensure that there are sufficient funds for the transaction.

[0109] Transaction authorization: If a business operation requires additional authorization (such as a large transfer that may require secondary confirmation), the user is required to confirm the authorization, such as by entering a confirmation password or verification code.

[0110] Execute business logic: After all necessary checks and authorizations are met, execute specific business logic, such as updating account balances, recording transaction history, and sending transaction confirmation notifications.

[0111] Returning business operation results: After the business operation is completed, the operation results are returned to the user, such as transaction success, transfer amount, new account balance, etc.

[0112] The goal of the above steps is to improve the security, efficiency, and resource conservation of users' online banking operations through an innovative identity authentication mechanism. By using token-based identity authentication, combined with a dynamic anomaly list and efficient data structure design, it can quickly respond to users' legitimate requests while effectively identifying and preventing illegal or abnormal operations, thus ensuring user information security and transaction security.

[0113] Figure 4 This is an optional identity authentication flowchart according to an embodiment of the present invention, such as... Figure 4As shown, to ensure token security during user logout, password modification, and permission changes, a dynamic exception list mechanism is employed to proactively revoke issued tokens. This mechanism uses a database to maintain a key-value list, where the key carries the user ID and the value is the expiration time. When a user needs to logout, change their password, or modify permissions, the revoked token is added to the dynamic exception list to ensure it cannot be used. The dynamic exception list mechanism does not require storing information for all issued token users; it only needs to specifically store information for users whose tokens need to be proactively revoked. Operations can only be performed after the user's state is stored. When a user requests logout or permission modification, the server first authenticates the user's token. If authentication is successful, the user ID and current timestamp are combined and stored in the dynamic exception list. For subsequent user requests, the server first verifies the user's identity by checking the token's validity. If the token is invalid, an error message is sent to the user. If the token is valid, the server checks the dynamic exception list to see if the user's record exists. If such a user record exists, the iat field in the payload is compared with the active expiration time in the dynamic exception list. If the iat value is less than the active expiration time, it means that the token has expired, the user request is rejected, and an error message is responded to; otherwise, the business operation is executed and the business operation result is returned.

[0114] Through the above steps S201 to S204, upon receiving a user's business operation request, the identity authentication information carried in the business operation request can be extracted. The identity authentication information includes at least an authentication signature and identity information. The authentication signature is then verified to obtain a first verification result, which indicates whether the identity information has undergone an abnormal change attack. The first verification result, identity information, and a preset abnormal list are then verified to obtain a second verification result, which stores the invalid user identifier and invalid timestamp in the preset abnormal list. Finally, the business operation request is responded to based on the second verification result to obtain the business operation result.

[0115] In this embodiment of the invention, a token-based authentication method is adopted. By integrating HMAC SHA256 encryption technology and dynamic inactive account status monitoring, the authenticity and timeliness of user identity information are accurately identified. This achieves the technical effect of significantly enhancing system security defense and optimizing resource utilization, thereby solving the technical problem of insufficient security caused by the defects of identity authentication mechanisms in related technologies, which cannot resist forgery attacks.

[0116] Specifically, the system first analyzes received business operation requests to extract identity authentication information, including but not limited to encrypted authentication signatures and identity data. Then, it verifies the authentication signature using an encryption algorithm, generating a first verification result that clearly indicates whether the user's submitted identity information has undergone any abnormal changes or unauthorized modifications. Subsequently, a dynamic inactive account status monitoring mechanism performs a second verification on the user's identity information that passed the initial verification, yielding a second verification result. This second verification mechanism is essentially an intelligent account management tool, maintaining user identifiers for known inactive states and their corresponding inactive timestamps. By comparing these, it can quickly determine the current usability of a user's account, preventing risks caused by temporary account inactivation even when the signature verification is correct. This ensures that every business operation request originates from a legitimate and valid account status. Finally, it responds based on the second verification result, achieving ideal feedback for the business operation. This not only significantly improves security standards in the financial transaction field and reduces the success rate of forgery attacks but also promotes the rational allocation of resources and improves the overall efficiency of system operation.

[0117] The invention will now be described in conjunction with another alternative embodiment.

[0118] Example 2

[0119] This invention also provides a user identity authentication device. It should be noted that the user identity authentication device of this invention includes multiple implementation units, which can be used to execute the user identity authentication method provided in the first embodiment above. Each implementation unit corresponds to each implementation step in the first embodiment above.

[0120] Figure 5 This is a schematic diagram of an optional user identity authentication device according to an embodiment of the present invention, such as... Figure 5 As shown, the device may include: an extraction unit 51, a first verification unit 52, a second verification unit 53, and a response unit 54.

[0121] The extraction unit 51 is used to extract the identity authentication information carried in the business operation request when a user's business operation request is received. The identity authentication information includes at least: authentication signature and identity information.

[0122] The first verification unit 52 is used to perform verification based on the authentication signature to obtain a first verification result, wherein the first verification result is used to indicate whether the identity information has undergone an abnormal change attack.

[0123] The second verification unit 53 is used to perform verification based on the first verification result, identity information and preset abnormal list to obtain the second verification result, wherein the preset abnormal list stores the invalid user identifier and invalid timestamp.

[0124] The response unit 54 is used to respond to the business operation request based on the second verification result and obtain the business operation result.

[0125] The aforementioned user identity authentication device can first extract the identity authentication information carried in the user's business operation request by the extraction unit 51. The identity authentication information includes at least an authentication signature and identity information. Then, the first verification unit 52 verifies the authentication signature to obtain a first verification result. The first verification result indicates whether the identity information has undergone an abnormal change attack. Then, the second verification unit 53 verifies the identity information based on the first verification result, the identity information, and a preset abnormal list to obtain a second verification result. The preset abnormal list stores the invalid user identifier and invalid timestamp. Finally, the response unit 54 responds to the business operation request based on the second verification result to obtain the business operation result.

[0126] In this embodiment of the invention, a token-based authentication method is adopted. By integrating HMAC SHA256 encryption technology and dynamic inactive account status monitoring, the authenticity and timeliness of user identity information are accurately identified. This achieves the technical effect of significantly enhancing system security defense and optimizing resource utilization, thereby solving the technical problem of insufficient security caused by the defects of identity authentication mechanisms in related technologies, which cannot resist forgery attacks.

[0127] Specifically, the system first analyzes received business operation requests to extract identity authentication information, including but not limited to encrypted authentication signatures and identity data. Then, it verifies the authentication signature using an encryption algorithm, generating a first verification result that clearly indicates whether the user's submitted identity information has undergone any abnormal changes or unauthorized modifications. Subsequently, a dynamic inactive account status monitoring mechanism performs a second verification on the user's identity information that passed the initial verification, yielding a second verification result. This second verification mechanism is essentially an intelligent account management tool, maintaining user identifiers for known inactive states and their corresponding inactive timestamps. By comparing these, it can quickly determine the current usability of a user's account, preventing risks caused by temporary account inactivation even when the signature verification is correct. This ensures that every business operation request originates from a legitimate and valid account status. Finally, it responds based on the second verification result, achieving ideal feedback for the business operation. This not only significantly improves security standards in the financial transaction field and reduces the success rate of forgery attacks but also promotes the rational allocation of resources and improves the overall efficiency of system operation.

[0128] Furthermore, the second verification unit includes: an extraction module, used to extract the user identity identifier and identity information issuance timestamp from the identity information when the first verification result indicates that the identity information has not undergone an abnormal change attack; and a verification module, used to verify the user identity identifier and identity information issuance timestamp according to a preset abnormal list to obtain a second verification result.

[0129] Furthermore, the second verification unit also includes a determination module, used to determine that the second verification result is a verification failure if the first verification result indicates that the identity information has undergone an abnormal change attack.

[0130] Furthermore, the verification module includes: a query submodule, used to query a preset abnormal list based on the user's identity identifier; an extraction submodule, used to extract the invalid timestamp corresponding to the invalid user identifier if an invalid user identifier matching the user's identity identifier is found in the preset abnormal list; a comparison submodule, used to compare the invalid timestamp with the time interval from the current timestamp with the identity information issuance timestamp to obtain a comparison result; and a generation submodule, used to generate a second verification result based on the comparison result.

[0131] Furthermore, the verification module also includes: a first determination submodule, used to determine the second verification result as verification passed if no invalid user identifier matching the user's identity identifier is found in the preset abnormal list.

[0132] Furthermore, the generation submodule includes: a second determining submodule, used to determine the second verification result as verification passed when the expiration timestamp with the smallest time interval from the current timestamp is earlier than the identity information issuance timestamp; and a third determining submodule, used to determine the second verification result as verification failed when the expiration timestamp with the smallest time interval from the current timestamp is later than the identity information issuance timestamp.

[0133] Furthermore, the response unit includes: a setting module, used to set the business operation result to a rejection operation when the second verification result indicates that the verification failed, generate response error information according to the business operation request, and return the business operation result and response error information to the user; and an execution module, used to execute the target financial business according to the business operation request when the second verification result indicates that the verification passed, obtain the business operation result, and return the business operation result to the user.

[0134] It should be noted that the extraction unit 51, the first verification unit 52, the second verification unit 53, and the response unit 54 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and the corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules or units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0135] The invention will now be described in conjunction with another alternative embodiment.

[0136] Example 3

[0137] The present invention can also provide an electronic device. Figure 6 This is a structural block diagram of an electronic device that performs a user authentication method according to an embodiment of the present invention, such as... Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) Processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0138] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the user authentication method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned user authentication method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0139] The processor can invoke information and applications stored in the memory via a transmission device to perform the following steps: Upon receiving a user's business operation request, extract the authentication information carried in the business operation request, wherein the authentication information includes at least: authentication signature and identity information; verify based on the authentication signature to obtain a first verification result, wherein the first verification result is used to indicate whether the identity information has undergone an abnormal change attack; verify based on the first verification result, the identity information, and a preset abnormal list to obtain a second verification result, wherein the preset abnormal list stores the invalid user identifier and invalid timestamp; respond to the business operation request based on the second verification result to obtain the business operation result.

[0140] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: if the first verification result indicates that the identity information has not undergone an abnormal change attack, extract the user identity identifier and the identity information issuance timestamp from the identity information; verify the user identity identifier and the identity information issuance timestamp according to the preset abnormal list to obtain the second verification result.

[0141] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: if the first verification result indicates that the identity information has undergone an abnormal change attack, determine that the second verification result is verification failure.

[0142] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: query a preset abnormal list based on the user identity identifier; if an invalid user identifier matching the user identity identifier is found in the preset abnormal list, extract the invalid timestamp corresponding to the invalid user identifier; compare the invalid timestamp with the smallest time interval from the current timestamp with the identity information issuance timestamp to obtain the comparison result; generate a second verification result based on the comparison result.

[0143] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: if no invalid user identifier matching the user identity identifier is found in the preset abnormal list, determine that the second verification result is verified as successful.

[0144] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: if the expiration timestamp with the smallest time interval from the current timestamp is earlier than the identity information issuance timestamp, determine the second verification result as verification passed; if the expiration timestamp with the smallest time interval from the current timestamp is later than the identity information issuance timestamp, determine the second verification result as verification failed.

[0145] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: if the second verification result indicates that the verification failed, set the business operation result to a rejection operation, generate a response error message according to the business operation request, and return the business operation result and the response error message to the user; or, if the second verification result indicates that the verification passed, execute the target financial business according to the business operation request, obtain the business operation result, and return the business operation result to the user.

[0146] This invention provides a user identity authentication scheme. Employing a token-based authentication method, it integrates HMAC SHA256 encryption technology and dynamic inactive account status monitoring to accurately verify the authenticity and timeliness of user identity information. This significantly enhances system security and optimizes resource utilization, thereby resolving the technical problems of insufficient security caused by deficiencies in related identity authentication mechanisms that cannot resist forgery attacks.

[0147] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0148] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0149] The invention will now be described in conjunction with another alternative embodiment.

[0150] Example 4

[0151] This invention also provides a computer-readable storage medium. Optionally, in this invention, the computer-readable storage medium can be used to store the program code executed by the user authentication method provided in Embodiment 1.

[0152] Optionally, in this embodiment of the invention, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0153] This invention also provides a computer program product, which, when executed on a data processing device, is suitable for performing user identity authentication method steps: upon receiving a user's business operation request, extracting identity authentication information carried in the business operation request, wherein the identity authentication information includes at least: an authentication signature and identity information; verifying based on the authentication signature to obtain a first verification result, wherein the first verification result is used to indicate whether the identity information has undergone an abnormal change attack; verifying based on the first verification result, the identity information, and a preset abnormal list to obtain a second verification result, wherein the preset abnormal list stores an invalid user identifier and an invalid timestamp; and responding to the business operation request based on the second verification result to obtain a business operation result.

[0154] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0155] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0156] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0157] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0158] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0159] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0160] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for authenticating user identity, characterized in that, include: Upon receiving a user's business operation request, extract the identity authentication information carried in the business operation request, wherein the identity authentication information includes at least: authentication signature and identity information; Verification is performed based on the authentication signature to obtain a first verification result, wherein the first verification result is used to indicate whether the identity information has undergone an abnormal change attack; The first verification result, the identity information, and the preset abnormal list are used for verification to obtain the second verification result, wherein the preset abnormal list stores the invalid user identifier and invalid timestamp; The business operation request is responded to based on the second verification result to obtain the business operation result.

2. The authentication method according to claim 1, characterized in that, The step of verifying the first verification result, the identity information, and the preset abnormal list to obtain the second verification result includes: If the first verification result indicates that the identity information has not undergone an abnormal change attack, extract the user identity identifier and the identity information issuance timestamp from the identity information; Based on the preset abnormal list, the user identity identifier and the identity information issuance timestamp are verified to obtain the second verification result.

3. The authentication method according to claim 1, characterized in that, The step of verifying the first verification result, the identity information, and the preset abnormal list to obtain the second verification result further includes: If the first verification result indicates that the identity information has undergone an abnormal change attack, the second verification result is determined to be a verification failure.

4. The identity authentication method according to claim 2, characterized in that, The step of verifying the user identity identifier and the identity information issuance timestamp based on the preset abnormal list to obtain the second verification result includes: The preset abnormal list is queried based on the user's identity identifier; If a failed user identifier matching the user identity identifier is found in the preset abnormal list, the failure timestamp corresponding to the failed user identifier is extracted; The expiration timestamp with the smallest time interval from the current timestamp is compared with the timestamp of the identity information issuance to obtain the comparison result. Based on the comparison results, the second verification result is generated.

5. The authentication method according to claim 2, characterized in that, The step of verifying the user identity identifier and the identity information issuance timestamp to obtain the second verification result further includes: If no invalid user identifier matching the user's identity identifier is found in the preset abnormal list, the second verification result is determined to be a successful verification.

6. The authentication method according to claim 4, characterized in that, The step of generating the second verification result based on the comparison result includes: If the expiration timestamp with the smallest time interval from the current timestamp is earlier than the identity information issuance timestamp, the second verification result is determined to be a successful verification. If the expiration timestamp with the smallest time interval from the current timestamp is later than the identity information issuance timestamp, the second verification result is determined to be verification failure.

7. The authentication method according to claim 1, characterized in that, The steps of responding to the business operation request based on the second verification result and obtaining the business operation result include: If the second verification result indicates that the verification failed, the business operation result is set to operation rejection, a response error message is generated based on the business operation request, and the business operation result and the response error message are returned to the user; or... If the second verification result indicates that the verification is successful, the target financial business is executed according to the business operation request, the business operation result is obtained, and the business operation result is returned to the user.

8. A user identity authentication device, characterized in that, include: The extraction unit is used to extract the identity authentication information carried in the user's business operation request when the user's business operation request is received. The identity authentication information includes at least: authentication signature and identity information. The first verification unit is used to verify the authentication signature and obtain a first verification result, wherein the first verification result is used to indicate whether the identity information has undergone an abnormal change attack. The second verification unit is used to perform verification based on the first verification result, the identity information and the preset abnormal list to obtain a second verification result, wherein the preset abnormal list stores the invalid user identifier and invalid timestamp; The response unit is used to respond to the business operation request based on the second verification result and obtain the business operation result.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the user authentication method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the user authentication method according to any one of claims 1 to 7.

11. A computer program product, characterized in that, It includes computer instructions, wherein when executed by a processor, the computer instructions implement the steps of the user identity authentication method according to any one of claims 1 to 7.

Images