Financial environment-oriented multi-factor authentication method and system
By identifying the risk level of financial operation requests and determining the dynamic authentication path, and by using a combination of multi-factor authentication modules, the shortcomings of fixed-strength authentication in existing technologies are solved, achieving a balance between security and user experience, and meeting the requirements of dynamic risk assessment and regulatory compliance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-29
- Publication Date
- 2026-03-27
AI Technical Summary
The existing financial authentication system, which uses fixed-strength authentication, leads to over-authentication for low-risk operations and insufficient protection for high-risk operations, failing to meet the requirements of dynamic risk assessment and regulatory compliance.
By identifying the risk level of financial operation requests initiated by the client, the authentication execution path is dynamically determined. A combination of multi-factor authentication modules is used, including graphical selection, dynamic hash protocol and one-time password authentication, and the authentication strength is dynamically adjusted according to the risk level.
It achieves a balance between security and user experience, accurately deploys security measures, prevents replay attacks, ensures the security of high-risk operations and the convenience of low-risk operations, and meets the requirements of dynamic risk assessment and regulatory compliance.
Smart Images
Figure CN121750256A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of financial technology, and in particular to a multi-factor authentication method and system for a financial environment. BACKGROUND
[0002] Modern financial authentication systems face multi-dimensional security threats and technical challenges. In terms of technical implementation, the following key problems currently exist: In terms of dynamic risk assessment, financial transaction risks exhibit typical nonlinear characteristics.
[0003] The development of cryptography technology has raised new requirements for financial authentication systems. NIST post-quantum cryptography standardization project (PQC) test data shows that a quantum computer using Shor algorithm can crack 2048-bit RSA encryption in 8 hours. This forces financial institutions to deploy quantum-resistant cryptographic components, such as the CRYSTALS-Dilithium signature scheme based on lattices.
[0004] In terms of regulatory compliance, the strong customer authentication (SCA) requirement of the European Union PSD2 directive brings about a technical architecture revolution. The directive explicitly states that the authentication process must include two or more independent factors, and dynamic link authentication (DLA) must generate a unique password for each transaction.
[0005] In the field of financial technology, the existing technical implementation solutions most similar to the present application mainly include the FIDO Alliance's UAF2.0 authentication framework and Alipay's 5.0 authentication engine.
[0006] FIDO UAF 2.0 authentication framework: As one of the most widely used strong authentication standards in the financial industry, the FIDO UAF 2.0 authentication framework adopts a strict three-verification mechanism in its technical architecture. In the local biometric verification layer, the scheme is based on TEE (Trusted Execution Environment) secure enclave to protect the key, and uses ECDSA-P256 algorithm for signature verification. According to the authentication test report (FIDO Certification Test Report v1.2) published by the FIDO Alliance, this scheme can accurately control the false acceptance rate (FAR) to an industry-leading level of 1:50,000, while maintaining the false rejection rate (FRR) within a reasonable range of 2.3%.
[0007] In terms of key security storage, the scheme makes full use of the hardware isolation technology of ARM TrustZone, ensuring the security of key materials through the physical isolation mechanism between secure world and normal world.
[0008] In the server verification layer, the scheme adopts a standard asymmetric key exchange protocol, the client uses a private key to sign the challenge value, and the server side completes the verification through the pre-stored public key. The signature algorithm supports P-256 elliptic curve, and the signature length is fixed at 512 bits.
[0009] However, this scheme uses a static HKDF-SHA256 algorithm in key derivation, which has the risk of key leakage; the biometric template cannot be synchronized across devices, limiting the application scenarios; all operations use fixed authentication strength, lacking dynamic risk adjustment capability.
[0010] Alipay 5.0 authentication engine: Alipay 5.0 authentication engine represents the most advanced technology in the mobile payment field, which innovatively adopts a federated learning risk model. The input features of the risk model reach 217 dimensions, comprehensively covering behavioral features (such as input speed, operation trajectory, etc. Fine-grained data), environmental features (device sensor data, network delay, etc. Real-time information) and transaction features (amount, transaction frequency, payee relationship, etc. Core elements). The risk scoring model constructed by XGBoost algorithm has an excellent AUC value of 0.943.
[0011] In terms of cryptographic algorithms, Alipay 5.0 uses SM2 signature algorithm combined with SM3 hash algorithm, which meets the GM / T0003-2012 standard. SM4 algorithm is used for symmetric encryption, using CBC mode and 128-bit key length, ensuring data security in the payment process. The SM2 signature speed of Alipay 5.0 is as high as 1,237 times / second, and the SM4 encryption throughput also reaches 2.5Gbps. In a high-concurrency, high-traffic payment environment, the system can maintain a high-speed and secure encryption process.
[0012] Alipay 5.0 adopts multi-factor authentication, which integrates multiple authentication methods, including nine-square picture recognition, behavior verification and voiceprint recognition, increasing multiple security safeguards, thereby effectively preventing identity theft and fraud risks. The nine-square picture recognition function relies on deep learning and a large-scale image dataset (more than 100,000 pictures), randomly selects and displays pictures, and requires users to select them in a specific pattern. Compared with traditional passwords or simple pattern verification, this method can greatly increase the difficulty of attackers to crack, further improving security. The behavior verification module collects multi-dimensional behavior features such as pressure and sliding trajectory on the touch screen to form the user's personalized behavior pattern. In addition, the voiceprint recognition uses a hybrid model architecture of i-vector and x-vector, combining deep learning and traditional feature extraction technology, so that voiceprint recognition can still maintain high accuracy in noisy environments. Its equal error rate (EER) is controlled at 3.2%, even in complex background noise, it can still provide high-accuracy identity verification.
[0013] Although the current mainstream FIDO UAF 2.0 authentication framework (Scheme 1) adopts a TEE trusted execution environment protection at the hardware security level, there is a certain design defect in the key derivation process. The scheme uses a static HKDF-SHA256 algorithm for key derivation, and this fixed mode reduces the security of the session key, which is particularly dangerous in the field of financial transactions that require long-term preservation of audit records. Secondly, there is no automatic key rotation mechanism, which is insufficient to meet the requirements of financial regulatory agencies for key life cycle management. With the development of quantum computers, this static key derivation method is completely unable to resist quantum computing attacks, and the security risks are increasingly prominent. Therefore, the present application adopts a dynamic key derivation scheme to generate a temporary session key through a timestamp and a random number, and cooperates with an OTP encryption mechanism to improve the security of the session key.
[0014] Existing financial authentication systems generally use fixed-strength authentication processes, regardless of the risk level of the user's operation, all authentication steps need to be completed. For the Alipay 5.0 authentication engine (Scheme 2), even the simplest balance inquiry operation needs to complete multiple authentications including nine-square picture recognition, voiceprint verification and behavior analysis. SUMMARY
[0015] The present application provides a multi-factor authentication method and system for a financial environment, which solves the core contradiction problem of "over-authentication for low-risk operations and insufficient protection for high-risk operations" caused by the use of fixed-strength authentication in the prior art, and realizes the intelligent balance between security and user experience.
[0016] In a first aspect, the present application provides a multi-factor authentication method for a financial environment, which comprises: identifying the risk level of the financial operation request initiated by the client to obtain a level identification result; wherein the level identification result includes: low risk, medium risk and high risk; assigning a unique session identifier to the financial operation request; dynamically determining an authentication execution path corresponding to the session identifier according to the level identification result; wherein the authentication execution path is an authentication module combination, the modules in the authentication module combination have a calling dependency relationship, and the authentication process corresponding to a high-level risk includes all authentication modules corresponding to low-level risks in turn; controlling the client terminal and the authentication server to execute each authentication module in the determined authentication module combination in sequence; after all the called authentication modules are verified, the operation request is authorized to be executed.
[0017] In a possible implementation manner of the first aspect, the authentication module combination comprises: a first authentication module, a second authentication module, and a third authentication module. The low-risk executes the first authentication module. The medium-risk executes the first authentication module and the second authentication module in sequence. The high-risk executes the first authentication module, the second authentication module, and the third authentication module in sequence.
[0018] In a possible implementation manner of the first aspect, the authentication process of the first authentication module is authentication based on graphical selection, comprising: determining a set comprising multiple pictures; receiving a picture subset selected by the client from the set based on selection rules; performing hash operation on the picture subset, and splicing operation results to generate a first authentication credential; completing verification by comparing the first authentication credential with a second authentication credential generated by a server based on the selection rules.
[0019] In a possible implementation manner of the first aspect, the set is presented to the terminal of the client in a paging manner, wherein the number of pictures displayed on each page is less than the total number of pictures to be selected by the client.
[0020] In a possible implementation manner of the first aspect, the performing hash operation on the picture subset and the splicing operation results to generate a first authentication credential comprises: calculating a hash value corresponding to each picture in the picture subset; splicing the hash value corresponding to each picture into a combined string in a predetermined order; combining the combined string with a pre-stored client key to obtain a key combination, and calculating a hash value corresponding to the key combination to generate the first authentication credential.
[0021] In a possible implementation manner of the first aspect, the authentication process of the second authentication module is authentication based on a dynamic hash protocol and a random number, comprising: generating a dynamic parameter by the client; wherein the dynamic parameter comprises: a timestamp and a random number; performing operation on a client identifier, the session identifier, the timestamp, and a pre-stored key by using a first hash function to obtain a first hash value; performing logical operation on the first hash value and a second hash value obtained based on the dynamic parameter to generate a first composite authentication code; generating a second composite authentication code by using the session identifier, the second hash value, and the timestamp. The server end receives the dynamic parameter, the first composite authentication code and the second composite authentication code, and completes verification through reverse operation and comparison.
[0022] In combination with the first aspect, in a possible implementation manner, the logical operation is exclusive or operation.
[0023] In combination with the first aspect, in a possible implementation manner, the authentication process of the third authentication module is one-time password-based authentication, including: The server end generates a one-time password; Deriving a dynamic session key based on a pre-stored key and a current timestamp; Encrypting the one-time password using the dynamic session key and sending it to the client end; After obtaining the one-time password through decryption, the client end combines the one-time password with the client end identifier and the session identifier to perform hash operation, to generate a third authentication credential; The third authentication credential is returned to the server end for verification.
[0024] In combination with the first aspect, in a possible implementation manner, the dynamic session key is derived by calculating the hash value of the pre-stored key and the current timestamp.
[0025] In the second aspect, the application provides a multi-factor authentication system for a financial environment, including: A risk level identification module is configured to identify the risk level of a financial operation request initiated by a client end, to obtain a level identification result; wherein the level identification result includes: low risk, medium risk and high risk; A session management module is configured to assign a unique session identifier to the financial operation request; A path decision module is configured to dynamically determine an authentication execution path corresponding to the session identifier according to the level identification result; wherein the authentication execution path is an authentication module combination, the modules in the authentication module combination have a calling dependency relationship, and the authentication process corresponding to a high-level risk includes all authentication modules corresponding to low-level risks in sequence; An authentication module is configured to control the client end and the authentication server end to sequentially execute each authentication module in the determined authentication module combination; An authorization module is configured to authorize the execution of the operation request after all called authentication modules are verified.
[0026] One or more technical solutions provided in the application have at least the following technical effects or advantages: The application realizes accurate delivery of security measures by identifying the risk level of the financial operation request initiated by the client, obtaining the level identification result, and the system can distinguish operations of different risk levels, providing decision basis for subsequent implementation of differentiated authentication strength, avoiding the problems of bloated experience of low-risk operations and insufficient safety of high-risk operations; the financial operation request is assigned a unique session identifier, ensuring the uniqueness and traceability of the entire authentication process, this session ID binds all subsequent authentication links together, which can effectively prevent replay attacks and session confusion, and provides a clear data main line for security audit; according to the level identification result, the authentication execution path corresponding to the session identifier is dynamically determined, which can intelligently and flexibly adapt to the best security solution. The high-risk operation automatically inherits and superimposes all authentication modules of the low-risk operation, realizing linear smooth upgrade of security strength, so as to call security resources with optimal efficiency; the client terminal and the authentication server end are controlled to execute each authentication module in the determined authentication module combination in sequence; the established security policy is forced and reliably executed. The system controls the sequence of the authentication process, ensures that each module is correctly called in turn, prevents the process from being skipped or bypassed, so that the dynamic strategy can be implemented; after all the called authentication modules are verified, the operation request is authorized to be executed, forming the final security closed loop and authorization decision point. This "and" logic ensures that the operation will be executed only after passing through all the authentication checkpoints required by the current risk, greatly increasing the difficulty of attack, and providing a solid and reliable security guarantee for high-risk financial operations. BRIEF DESCRIPTION OF DRAWINGS
[0027] Figure 1 A multi-factor authentication method for a financial environment provided by an embodiment of the application is shown in the flowchart. Figure 2 A multi-factor authentication system structure diagram for a financial environment provided by an embodiment of the application is shown in the flowchart. Figure 3 A system picture authentication module example diagram provided by an embodiment of the application is shown in the flowchart. DETAILED DESCRIPTION
[0028] The technical solutions in the embodiments of the application will be clearly and completely described in conjunction with the drawings of the embodiments of the application. Obviously, the described embodiments are part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.
[0029] In a first aspect, the application provides a multi-factor authentication method for a financial environment, as shown in Figure 1 The method comprises the following steps S101-S105.
[0030] S101, risk level identification is performed on the financial operation request initiated by the client, and a level identification result is obtained; wherein the level identification result includes: low risk, medium risk and high risk; S102, a unique session identifier is assigned to the financial operation request; S103, according to the level identification result, dynamically determine the authentication execution path corresponding to the session identifier; wherein the authentication execution path is an authentication module combination, the modules in the authentication module combination have a calling dependency relationship, and the authentication process corresponding to a high-level risk includes all authentication modules corresponding to a low-level risk in turn; Specifically, in step S103, the authentication module combination includes: a first authentication module, a second authentication module and a third authentication module; the first authentication module is executed for low risk; the first authentication module and the second authentication module are executed in turn for medium risk; the first authentication module, the second authentication module and the third authentication module are executed in turn for high risk.
[0031] For example, the present application includes three authentication modules, see the attached Figure 2 , which are respectively a first authentication module, a second authentication module and a third authentication module.
[0032] Low-risk operation (such as balance inquiry, corresponding to A-level permission) only needs to complete single-factor authentication, using the first authentication module; medium-risk operation (such as small amount transfer, corresponding to B-level permission) needs to complete double-factor authentication, using the second authentication module and calling the first authentication module; high-risk operation (such as large amount transfer, corresponding to C-level permission) needs to complete three-factor authentication, using the third authentication module and calling the first authentication module and the second authentication module.
[0033] Specifically, the authentication process of the first authentication module is based on graphical selection, including: (1) determine a set including multiple pictures; here, the set is presented in a paging manner on the terminal of the client, wherein the number of pictures displayed on each page is less than the total number of pictures selected by the client.
[0034] (2) receive the picture subset selected by the client from the set based on the selection rule; (3) perform a hash operation on the picture subset, and splice the operation result to generate a first authentication credential; Here, the hash operation is performed on the picture subset, and the operation result is spliced to generate a first authentication credential, including: (3.1) calculate the hash value corresponding to each picture in the picture subset; (3.2) splice the hash value corresponding to each picture into a combined string in a predetermined order; (3.3) Combine the combined string with the pre-stored client key to obtain the key combination, and calculate the hash value corresponding to the key combination to generate the first authentication credential.
[0035] (4) Verification is completed by comparing the first authentication credential with the second authentication credential generated by the server based on the selection rules.
[0036] For example, the first authentication module (required for A / B / C level permission operations): (1) Step 1: The user initiates an authentication request. After receiving the authentication request, the server selects images. It selects 12 images from the image library as a set, denoted as (P1, P2, P3, ..., P12), and sends the 12 images and the selection rules (Req) to the user.
[0037] The user selects three images from the images sent by the server that meet the requirements of Req, denoted as (P1, P2, P3). The image hash values are then concatenated into a combined string: Calculate the first authentication credential: ;in, This indicates the pre-stored client key.
[0038] The user will use the first authentication credential. Authentication module one sent to the server: .
[0039] (2) Step 2: The server authenticates the user's identity based on the image subset. The server stitching system reselects three images (P1*, P2*, P3*) according to the selection rules, and calculates P*=h(P1*)||h(P2*)||h(P3*). The authentication module calculates the second authentication credential H1*= h(P*||K) and compares it with the H1 sent by the user. If they do not match, the session is terminated.
[0040] Specifically, the authentication process of the second authentication module is based on dynamic hash protocol and random number authentication, including: (1) The client generates dynamic parameters; among which, the dynamic parameters include: timestamp and random number; (2) Use the first hash function to calculate the client identifier, session identifier, timestamp and pre-stored key to obtain the first hash value; (3) Perform a logical operation between the first hash value and the second hash value obtained based on the dynamic parameters to generate the first composite authentication code; here, the logical operation is an XOR operation.
[0041] (4) Generate a second composite authentication code using the session identifier, the second hash value, and the timestamp; (5) The server receives dynamic parameters, the first composite authentication code and the second composite authentication code, and completes the verification through reverse operation and comparison.
[0042] For example, the second authentication module (required for B / C level permission operations, but not required for A level permission operations): (3) Step 3: The user initiates an authentication request; dynamic parameters include: T1: Timestamp, representing the current time.
[0043] R1: Random number.
[0044] ID: Client identifier (user permanent identifier), used to uniquely identify the user.
[0045] K: Pre-stored key, which is shared with the server.
[0046] SID: Session ID (a unique sequence number that identifies this session).
[0047] H2: First composite authentication code (authentication value), generated by a hash function and an XOR operation.
[0048] H3: Second composite authentication code (hash function verification value), used to verify the correctness of the first composite authentication code.
[0049] The client first generates a timestamp T1 and a random number R1, and then calculates the authentication value and the hash function verification value; , ; And send dynamic parameters M2 = {ID, SID, T1, R1, H2, H3} to the server.
[0050] (4) Step 4: The second authentication module verifies the user's identity.
[0051] Verify timestamp: The second authentication module receives the timestamp T1* sent by the user and checks the time difference. If the time difference exceeds the threshold, the authentication process terminates.
[0052] Deconstructing the authentication value: The second authentication module retrieves the ID and K corresponding to the user from the database and deconstructs h(R1||T1): h(R1||T1) = H2 XOR h(ID|| SID||T1||K).
[0053] Verify the authentication value: The second authentication module calculates H3* based on the deconstructed h(R1||T1): H3*=h(SID||h(R1||T1)||T1), and checks whether H3* is equal to H3. If it matches H3 in the message, proceed to the next step; otherwise, terminate the session.
[0054] Specifically, the authentication process of the third authentication module is based on a one-time password, including: (1) The server generates a one-time password; (2) Derive a dynamic session key based on the pre-stored key and the current timestamp; here, the dynamic session key is derived by calculating the hash value of the pre-stored key and the current timestamp.
[0055] (3) Encrypt a one-time password using a dynamic session key and send it to the client; (4) After the client decrypts and obtains the one-time password, it combines the one-time password with the client identifier and the session identifier to perform a hash operation and generate a third authentication credential. (5) Send the third authentication credential back to the server for verification.
[0056] For example, the third authentication module (required for C-level permission operations, but not for A / B-level permission operations): (5) Step 5: The user initiates an authentication request, and the third authentication module that receives the request generates and sends a one-time password (OTP).
[0057] OTP Generation: The third authentication module generates an OTP and a current timestamp T2, and uses the timestamp T2 to calculate the dynamic session key. .
[0058] Encrypted OTP: Using dynamic session keys Encrypting OTP to obtain .
[0059] Sending Encrypted OTP: The server sends the encrypted OTP and timestamp to the user. .
[0060] (6) Step 6: The user receives and decrypts the OTP; Receive and decrypt OTP: The user receives M3 and calculates the new key. The user decrypts E_OTP to obtain OTP.
[0061] Calculate authentication value: The user calculates the third authentication credential. .
[0062] Send authentication value: The user sends the calculated third authentication credential H4 to authentication module three. Authentication module three verifies the user and completes the session.
[0063] The authentication process is initiated at the login portal of the terminal device, and users proceed to the corresponding process based on the type of operation. The front-end authentication system adopts a three-tiered verification mechanism.
[0064] S104, control the client terminal and the authentication server to execute each authentication module in the determined combination of authentication modules in sequence; S105: After all the authentication modules that have been called have verified the operation, the operation request is authorized to be executed.
[0065] The core innovation of this invention lies in constructing an intelligent, tiered authentication system that automatically matches the appropriate security verification strength based on the risk level of the financial operation. Unlike traditional authentication systems that apply a one-size-fits-all security approach to all operations, this invention creatively divides user permissions into three levels: A, B, and C, corresponding to basic queries, regular transactions, and high-risk operations, respectively. The system intelligently identifies the user's operation type and automatically triggers the corresponding authentication process, ensuring financial security while enhancing the user experience.
[0066] In terms of authentication, this invention innovatively adopts image selection as the basic verification method. The system randomly presents 12 images, and the user needs to select 3 of them according to specific requirements. The system hashes the user's selected images, concatenates them, and combines them with a timestamp to generate a unique authentication credential. The images are displayed in a paginated manner, making it difficult for attackers to infer the user's selection pattern through the interface layout. This graphical authentication is convenient for users and effectively resists brute-force attacks, perfectly balancing security and usability.
[0067] The entire authentication system adopts a modular architecture design, with each authentication step being both independent and organically connected. This avoids both over-authentication causing inconvenience and under-authentication leaving hidden dangers.
[0068] In the highest-security OTP authentication process, the system uses a timestamp-derived dynamic key K' to encrypt the OTP transmission. The user decrypts the OTP and generates a verification value to send back to the server. This non-plaintext OTP transmission enhances the security of high-privilege operations.
[0069] In Level B access authentication, the system uses composite hash values. For example, in practical applications: and Composite hash verification is performed, and two-layer authentication hash values H2 and H3 are used to improve authentication security. A multi-layered anti-replay attack protection system is constructed by combining random numbers and timestamps.
[0070] This invention employs a unique session identifier (SID) throughout the entire multi-level authentication process to ensure the security of high-risk operations.
[0071] This invention achieves a balance between security and operational efficiency by dynamically binding permission levels (A / B / C) to the authentication process. For low-risk A-level operations, only single-factor authentication is required, reducing the user's operational burden; while high-risk C-level operations require mandatory triple authentication (image selection + hash authentication + OTP). This invention saves authentication time in low-risk scenarios to a certain extent and avoids the waste of computing power in multimodal verification.
[0072] See Figure 2 This invention adopts a layered and progressive architecture, mainly composed of four core structures: front-end terminal devices, authentication system clusters, user information management modules, and enterprise servers. Three sets of terminal login terminals (first to third system login terminals) are deployed on the left side of the system, each corresponding to authentication entry points with different security levels; a three-level authentication module (first to third authentication modules) is constructed in the central area, all forming a linked verification unit with the user information management module; simultaneously, it connects to three application systems (first to third application systems) and the central enterprise server.
[0073] In terms of implementation, this authentication system adopts a tiered permission mechanism, implementing differentiated authentication processes based on the level of operational risk. The entire authentication process is initiated by the terminal device, undergoes multi-level verification by the front-end authentication system, and is finally granted permissions by the enterprise server.
[0074] While Alipay 5.0's nine-grid image recognition offers some security, it is vulnerable to attack. Attackers can easily determine which images were selected by the user simply by refreshing the page multiple times. This invention's image selection authentication employs pagination obfuscation technology (3-page × 4-image dynamic layout), as shown in the attached diagram. Figure 3 The task requires users to select 3 images that meet specific requirements from 12 images and then concatenate them using hashing. This design generates authentication values. Because it's uncertain whether a user-selected image exists on a specific page, it's difficult for automated scripts to break through using brute force, significantly improving its resistance to brute-force attacks compared to Alipay's solution.
[0075] Existing technologies rely on ECDSA signature verification and employ the SM2 / SM3 national cryptographic algorithms, both of which have the potential problem of complex key management. This invention optimizes the hash function by employing dynamic key derivation (specifically implemented in the verification string generation process): , The system employs a second-level anti-tampering verification mechanism (using a reconstructed string containing the shared key for comparison during the verification process) to ensure that even if an attacker intercepts the communication data, they cannot reverse-engineer the original password. Compared to FIDO's static HKDF key derivation, the session-level dynamic key of this invention effectively prevents replay attacks and does not rely on hardware security modules, thus reducing deployment costs.
[0076] Figure 3 The diagram illustrates the specific implementation of the system's image authentication module. The improved image authentication method, as shown in the figure, displays four images on the webpage, along with a pagination option at the bottom, for a total of three pages. Since attackers cannot determine whether each page contains the image selected by the user, security is ensured.
[0077] Secondly, this invention provides a multi-factor authentication system for the financial environment, the system comprising: The risk level identification module is used to identify the risk level of financial operation requests initiated by clients and obtain the risk level identification results; the risk level identification results include: low risk, medium risk and high risk; The session management module is used to assign a unique session identifier to financial operation requests; The path decision module is used to dynamically determine the authentication execution path corresponding to the session identifier based on the level identification result. The authentication execution path is a combination of authentication modules. The modules in the authentication module combination have calling dependencies. The authentication process corresponding to the higher level of risk includes all the authentication modules corresponding to the lower level of risk in sequence. The authentication module is used to control the client terminal and the authentication server to execute each authentication module in the determined combination of authentication modules in sequence; The authorization module is used to authorize the execution of operation requests after all called authentication modules have verified the operation.
[0078] For example, this embodiment describes in detail the specific operation process of the system of the present invention in a typical financial application scenario (a user making a large transfer through a mobile banking APP). The system is deployed on the back-end server cluster of a financial institution and interacts with the client APP on the user's mobile phone.
[0079] Scenario: After logging into the mobile banking app, a user attempts to transfer a large sum of money to a recipient they do not use regularly.
[0080] System Operation Flow: First, request initiation and risk identification: The user enters the transfer amount and recipient information on the APP interface and clicks "Confirm Transfer". Then, the client sends this financial operation request to the system. The risk level identification module immediately starts and analyzes the request. It comprehensively considers multiple dimensions such as the transfer amount, the historical transaction frequency of the recipient and the user, the operation time, and device information. Based on the built-in risk model, the module determines that this operation is high-risk and generates a risk level identification result of "high risk". Re-session creation and path decision: The session management module assigns a unique session identifier (SID) to this transfer request, such as SID_20240521083530_XYZ. This SID will be used to associate all subsequent authentication steps. The path decision module receives a risk level identification result of "high risk". According to the preset rules (high-risk operations require the most complete authentication process), the module dynamically generates an authentication execution path bound to this SID as: First authentication module → Second authentication module → Third authentication module. This reflects the call dependency relationship between modules, that is, the high-risk path includes all authentication modules of medium risk (first authentication module, second authentication module) and low risk (only the first authentication module) in sequence.
[0081] The authentication modules are executed sequentially (controlled by the authentication module): The system begins by controlling the client and server to perform authentication according to a predetermined path. The first authentication module (image selection authentication) executes: The server sends 12 images (displayed on 3 pages, 4 images per page) and the instruction: "Please select all images containing vehicles." The user selects 3 images as needed. The client calculates the image hash, generates authentication credential H1 based on the pre-stored key, and sends it to the server for verification. Verification successful. The second authentication module (dynamic hash authentication) executes: The client generates a timestamp T1 and a random number R1. The client calculates composite authentication codes H2 and H3, and sends them to the server along with parameters such as SID, T1, and R1. After verifying the timestamp's validity, the server performs a reverse operation to deconstruct the key hash value and verifies whether H3 matches. Verification successful. The third authentication module (one-time password authentication) executes: The server generates an OTP. The server encrypts the OTP using a dynamic session key K' derived from the pre-stored key and the current timestamp, and sends the ciphertext E_OTP and timestamp T2 to the client. The client decrypts the OTP, calculates authentication credential H4 (the third authentication credential), and sends it back to the server. The server verifies that H4 is valid. Final authorization: At this point, all three authentication modules along the authentication execution path have passed verification. The authorization module is triggered, sending an authorization instruction to the business system, allowing the execution of this large-amount transfer operation. The transaction is completed.
[0082] This embodiment clearly demonstrates the workflow of the system of the present invention. Through modular design and dynamic path decision-making, the system achieves the following: Security: High-risk operations are forced to undergo authentication by three different factors, greatly improving security. User Experience: For low-risk operations (such as checking the balance), the system only needs to call the first authentication module, avoiding unnecessary authentication steps and improving operational efficiency. Flexibility: The system can flexibly adapt to different authentication strengths based on accurate risk assessment results, achieving a balance between security and convenience.
[0083] The various embodiments described in this specification are presented in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. All or part of this invention can be used in numerous general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, mobile communication terminals, multiprocessor systems, microprocessor-based systems, programmable electronic devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices, etc.
[0084] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the present invention.
Claims
1. A multi-factor authentication method for the financial environment, characterized in that, include: The risk level of financial operation requests initiated by the client is identified to obtain the risk level identification result; wherein the risk level identification result includes: low risk, medium risk and high risk; Assign a unique session identifier to the financial operation request; Based on the level identification result, the authentication execution path corresponding to the session identifier is dynamically determined; wherein, the authentication execution path is a combination of authentication modules, and the modules in the authentication module combination have calling dependencies, and the authentication process corresponding to the higher level of risk includes all the authentication modules corresponding to the lower level of risk in sequence; Control the client terminal and the authentication server to execute each authentication module in the determined combination of authentication modules in sequence; After all the authentication modules that are invoked have verified the operation, the operation request is authorized to be executed.
2. The multi-factor authentication method for the financial environment according to claim 1, characterized in that, The authentication module combination includes: a first authentication module, a second authentication module, and a third authentication module; The low-risk operation executes the first authentication module; The medium-risk cases are processed sequentially by executing the first authentication module and the second authentication module. The high-risk cases are processed sequentially through the first authentication module, the second authentication module, and the third authentication module.
3. The multi-factor authentication method for the financial environment according to claim 2, characterized in that, The authentication process of the first authentication module is a graphical selection-based authentication, including: Determine a collection that includes multiple images; The receiving client selects a subset of images from the set based on selection rules; Perform a hash operation on the subset of images, and concatenate the results to generate the first authentication credential; Verification is accomplished by comparing the first authentication credential with the second authentication credential generated by the server based on the selection rules.
4. The multi-factor authentication method for the financial environment according to claim 3, characterized in that, The collection is presented to the client's terminal in a paginated manner, wherein the number of images displayed on each page is less than the total number of images that the client needs to select.
5. The multi-factor authentication method for the financial environment according to claim 3, characterized in that, The step of performing a hash operation on the subset of images and concatenating the results to generate the first authentication credential includes: Calculate the hash value corresponding to each image in the image subset; The hash values corresponding to each image are concatenated into a combined string in a predetermined order; The combined string is combined with the pre-stored client key to obtain a key combination, and the hash value corresponding to the key combination is calculated to generate the first authentication credential.
6. The multi-factor authentication method for the financial environment according to claim 2, characterized in that, The authentication process of the second authentication module is based on dynamic hash protocol and random number authentication, including: The client generates dynamic parameters; wherein, the dynamic parameters include: timestamp and random number; The first hash value is obtained by performing a calculation on the client identifier, the session identifier, the timestamp, and the pre-stored key using the first hash function; A first composite authentication code is generated by performing logical operations on the first hash value and the second hash value obtained based on the dynamic parameters. A second composite authentication code is generated using the session identifier, the second hash value, and the timestamp; The server receives the dynamic parameters, the first composite authentication code, and the second composite authentication code, and completes the verification through reverse calculation and comparison.
7. The multi-factor authentication method for the financial environment according to claim 6, characterized in that, The logical operation is the XOR operation.
8. The multi-factor authentication method for the financial environment according to claim 2, characterized in that, The authentication process of the third authentication module is based on a one-time password and includes: The server generates a one-time password. A dynamic session key is derived based on the pre-stored key and the current timestamp; The one-time password is encrypted using the dynamic session key and sent to the client; After the client decrypts and obtains the one-time password, it combines the one-time password with the client identifier and the session identifier to perform a hash operation and generate a third authentication credential. The third authentication credential is sent back to the server for verification.
9. The multi-factor authentication method for the financial environment according to claim 8, characterized in that, The derived dynamic session key is obtained by calculating the hash value of the pre-stored key and the current timestamp.
10. A multi-factor authentication system for the financial environment, characterized in that, include: The risk level identification module is used to identify the risk level of financial operation requests initiated by the client and obtain the risk level identification result; wherein, the risk level identification result includes: low risk, medium risk and high risk; The session management module is used to assign a unique session identifier to the financial operation request; The path decision module is used to dynamically determine the authentication execution path corresponding to the session identifier based on the level identification result; wherein, the authentication execution path is a combination of authentication modules, and the modules in the authentication module combination have calling dependencies, and the authentication process corresponding to the higher level risk includes all the authentication modules corresponding to the lower level risk in sequence. The authentication module is used to control the client terminal and the authentication server to execute each authentication module in the determined combination of authentication modules in sequence; The authorization module is used to authorize the execution of the operation request after all the called authentication modules have verified the operation.