Burglarproof swiping method of electronic wallet, electronic payment system, device and medium

Abstract

The invention discloses an electronic wallet anti-fraud method, an electronic payment system, an electronic wallet anti-fraud device and a medium, and the method specifically comprises the steps: in response to a payment request of payment equipment, the payment equipment executes risk pre-verification based on local data, and generates a preliminary risk score; performing environment consistency verification by the payment device to generate an environment consistency score; if the initial risk score reaches a risk threshold, triggering an enhanced verification process to generate an enhanced risk score; fusing the preliminary risk score, the environment consistency score and the optional enhanced risk score to generate a fused risk score; and performing grading processing on the payment request based on the risk grade to which the fusion risk score belongs. According to the electronic wallet anti-swiping method provided by the embodiment of the invention, while payment security is ensured, verification time delay and user disturbance are effectively controlled, and the optimal balance between security protection and payment efficiency is realized.

Description

Technical Field

[0001] This invention relates to the field of mobile payment technology, and in particular to a method for preventing theft of electronic wallets, an electronic payment system, a device, and a medium. Background Technology

[0002] The widespread adoption and deep application of mobile payments have brought immense convenience in handling high-frequency, small-amount transactions, but have also increasingly made them a prime target for various types of fraud. Currently, attack methods are constantly evolving towards systematization and sophistication, posing a serious challenge to traditional security protection strategies.

[0003] Faced with these complex attacks, existing technical solutions often find themselves in a dilemma in practice: On the one hand, many solutions still rely on single-dimensional verification signals such as location information or wireless signal strength. While these signals are easy to obtain and process quickly, they are also easily forged or bypassed, making the resulting protection system vulnerable and unreliable against targeted attacks. On the other hand, if enhanced end-to-end, multi-factor authentication is applied to all transaction requests indiscriminately for security reasons, while theoretically improving security, it introduces significant processing latency and additional user interaction steps in practice, ultimately impairing the smoothness of the core payment process and significantly degrading the user experience. Summary of the Invention

[0004] This invention aims to at least solve one of the technical problems existing in the prior art. To this end, this invention proposes a method, electronic payment system, device, and medium for preventing theft of electronic wallets, which can improve the efficiency of payment verification while ensuring payment security.

[0005] On one hand, embodiments of the present invention provide a method for preventing theft of electronic wallets, which is applied to an electronic payment system.

[0006] The embodiments of the present invention have at least the following beneficial effects: The present invention integrates the local risk pre-verification, environment consistency verification and on-demand triggered enhanced verification of the payment device, and based on the hierarchical mechanism, it only initiates enhanced verification for medium and high risk transactions, thereby avoiding the resource consumption and delay caused by full verification. Thus, while ensuring payment security, it effectively controls verification latency and user disturbance, and achieves the best balance between security protection and payment efficiency.

[0007] According to some embodiments of the present invention, the step of the payment device performing risk pre-verification based on local data to generate a preliminary risk score includes: Obtain the device integrity parameters and current environment parameters of the payment device; The preliminary risk score is generated by weighting the device integrity parameters with the current environmental parameters.

[0008] According to some embodiments of the present invention, the step of performing environmental consistency verification by the payment device and generating an environmental consistency score includes: Obtain the historical environmental parameters of the payment device; The current environmental parameters are compared with the historical environmental parameters to generate the environmental consistency score.

[0009] According to some embodiments of the present invention, the on-site verification includes: The payment device initiates multiple round-trip communications to the trusted echo node, wherein the trusted echo node is the server or a network node designated by the server. Based on the round-trip delay of multiple round-trip communications, it is determined whether the payment device exceeds the upper limit of physical distance, and a first enhancement score is generated based on the degree to which it exceeds the upper limit of physical distance.

[0010] According to some embodiments of the present invention, the collaborative sensing verification includes: Acquire the first signal sequence of the payment device and the second signal sequence of at least one cooperating device, respectively; The server calculates the sequence similarity between the first signal sequence and the second signal sequence, and generates a second enhancement score based on the sequence similarity.

[0011] According to some embodiments of the present invention, the step of calculating the sequence similarity between the first signal sequence and the second signal sequence on the server side, and generating a second enhancement score based on the sequence similarity, includes: The server calculates the overall correlation between the first signal sequence and the second signal sequence, and determines whether the overall correlation meets a preset standard. If the overall correlation reaches a preset standard, the normalized path distance of the sequence between the payment device and the cooperating device is obtained through a dynamic time warping algorithm; The sequence similarity is determined based on the regularized path distance.

[0012] According to some embodiments of the present invention, the step of performing tiered processing on the payment request based on the risk level to which the fusion risk score belongs includes: If the fusion risk score is lower than the first risk level, the payment request is approved; If the fusion risk score is between the first risk level and the second risk level, then the authentication request of the payment device is triggered; If the fusion risk score is higher than the second risk level, the payment request will be blocked or forwarded to the manual request channel.

[0013] Secondly, embodiments of the present invention provide an electronic payment system, including a payment device and a server, wherein the system is used to execute the anti-theft method for an electronic wallet as described in the above-mentioned embodiments; the system further includes: The risk pre-verification module is used to perform risk pre-verification based on the local data of the payment device and generate a preliminary risk score; The environment verification module is used to perform environment consistency verification and generate an environment consistency score. An enhanced verification module is used to trigger an enhanced verification process to generate an enhanced risk score when the initial risk score reaches a risk threshold. The enhanced verification process includes on-site verification and collaborative perception verification, which are performed selectively or jointly based on different risk thresholds reached by the initial risk score. The fusion score module is used to fuse the preliminary risk score, the environmental consistency score, and the optional enhanced risk score to generate a fused risk score; The request processing decision module is used to perform tiered processing of the payment request based on the risk level to which the fusion risk score belongs.

[0014] A computer device according to a third aspect of the present invention includes a memory and a processor, the memory being used to store at least one program, and the processor being used to load the at least one program to execute the anti-theft method for an electronic wallet as described in the above-described aspects.

[0015] A computer-readable storage medium according to a fourth aspect of the present invention includes a memory and a processor, the memory being configured to store at least one program, and the processor being configured to load the at least one program to perform the anti-fraud method for an electronic wallet as described in the above-described aspect of the present invention.

[0016] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0017] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is a flowchart of an anti-theft method for an electronic wallet according to an embodiment of the present invention; Figure 2 This is a schematic diagram of on-site verification according to a specific embodiment of the present invention; Figure 3 This is a schematic diagram of collaborative sensing verification according to a specific embodiment of the present invention; Figure 4This is a structural diagram of a computer device provided in another embodiment of the present invention. Detailed Implementation

[0018] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0019] In the description of this invention, "several" means one or more, "multiple" means two or more, "greater than," "less than," "exceeding," etc. are understood to exclude the stated number, and "above," "below," "within," etc. are understood to include the stated number. If "first," "second," etc. are used in the description, they are only for the purpose of distinguishing technical features and should not be construed as indicating or implying relative importance or implicitly indicating the number of indicated technical features or the order of the indicated technical features.

[0020] The concepts involved in this invention are explained below: RSSI: Received Signal Strength Indicator, used to measure the strength of received wireless signals; IMU: Inertial Measurement Unit, a sensor containing accelerometers and gyroscopes used to determine the motion state of a device; DTW: Dynamic Time Warping, an algorithm used to calculate the similarity between two time series of different lengths or speeds; RTT: Round-Trip Time, refers to the total time required for a signal to travel from being sent to receiving an acknowledgment. EMA: Exponential Moving Average, an average calculation method that gives higher weight to recent data; MAD: Median Absolute Deviation, a robust statistic based on the median that measures the dispersion of data; Pearson correlation coefficient: A statistical indicator that measures the degree of linear correlation between two variables.

[0021] Please refer to Figures 1-3 , Figure 1This is a flowchart of an anti-theft method for an electronic wallet according to an embodiment of the present invention. This embodiment discloses an anti-theft method for an electronic wallet, applied to an electronic payment system. The system includes a payment device and a server. The method includes, but is not limited to, the following steps: Step S100: In response to the payment request from the payment device, the payment device performs risk pre-verification based on local data to generate a preliminary risk score; It should be noted that the payment device can be any device that can perform payment functions through a payment application or e-wallet, such as a mobile phone, tablet, or smartwatch; this invention does not impose any restrictions. When a payment device generates a payment request through a payment application or e-wallet, it first triggers a risk pre-verification process. This pre-verification process performs a lightweight risk self-check on the payment device to quickly identify explicit risk characteristics and determine whether the payment device is in a risky payment environment. Because this process is completed on the payment device itself and based on the device's local data, there is no additional latency caused by communication with the server. The preliminary risk score generated by this process provides a key decision-making basis for whether more complex enhanced verification is needed subsequently, realizing pre-emptive and efficient screening of the security verification process and effectively avoiding the resource waste caused by indiscriminate full verification.

[0022] Step S200: The payment device performs an environment consistency verification and generates an environment consistency score. It should be noted that the environment consistency verification process in step S200 is completed locally on the payment device. This verification compares real-time parameters such as the network environment, geographical location, and system time zone currently collected by the device with the anonymized historical environment parameters of the user stored on the device side. It then assesses the degree of deviation between the current environment and historical patterns and quantifies this deviation as an environment consistency score. It is understandable that this process, along with the risk pre-verification in step S100, is executed on the payment device based on local data, without requiring multiple interactions with the server. Therefore, the overall verification latency is kept at a low level, ensuring verification reliability while meeting the real-time requirements of the payment scenario.

[0023] Step S300: If the initial risk score reaches the risk threshold, the enhanced verification process is triggered to generate an enhanced risk score. The enhanced verification process includes on-site verification and collaborative perception verification, which are performed selectively or jointly based on the different risk thresholds reached by the initial risk score. It should be noted that step S300 determines whether to initiate the enhanced verification process based on whether the initial risk score exceeds a preset risk threshold. This step introduces a tiered triggering mechanism to direct computationally intensive enhanced verification to medium- and high-risk requests, thereby achieving an effective balance between security and efficiency. In one embodiment of the invention, the risk threshold is further divided into a medium-risk threshold and a high-risk threshold: when the initial risk score reaches the medium-risk threshold, the first level of enhanced verification is triggered, such as round-trip latency verification between the payment device and the server; when the initial risk score reaches the high-risk threshold, the second level of enhanced verification is further triggered, such as introducing collaborative devices for multi-device collaborative perception verification. This tiered verification strategy achieves a reasonable match between security strength and system overhead: low-risk transactions are allowed to pass unnoticed, while verification with increasing intensity is only enabled as needed for medium- and high-risk transactions. This design strengthens the ability to identify high-risk objects while ensuring the overall smoothness of the general payment process.

[0024] Step S400: Integrate the preliminary risk score, the environmental consistency score, and the optional enhanced risk score to generate the integrated risk score; It should be noted that step S400 uses preset, dynamically configurable weight parameters to weight and fuse the initial risk score and the environmental consistency score to generate a basic fusion score. If the system triggers enhanced verification, the enhanced verification score is incorporated into the basic fusion score with predetermined weights to generate the final fusion risk score; if not triggered, the basic fusion score is directly used as the final fusion risk score. This weighted fusion mechanism improves the robustness of risk assessment through cross-validation of multi-source signals. In one embodiment of the present invention, the scoring formula for the fusion risk score is: Score = Integrity + Distance + Similarity + ·Geo·····①, In Equation ①, Integrity is the initial risk score, Distance and Similarity are the corresponding scores obtained based on the enhanced verification process, and Similarity is the environmental consistency score. , , , These are preset risk weights, the specific values ​​of which can be arbitrarily set according to needs. The preset and configurable nature of the weights enables the risk control system to dynamically adjust its decision focus based on different business scenarios, regional characteristics, or through continuous learning of attack patterns via online A / B testing, thus achieving flexibility and adaptability in risk control strategies.

[0025] Step S500: Based on the risk level to which the fusion risk score belongs, the payment request is processed in a tiered manner.

[0026] It should be noted that step S500 performs tiered handling based on the level of the fusion risk score: low-risk transactions are allowed to proceed without notice; medium-risk transactions trigger enhanced verification or are subject to limits; and high-risk transactions are blocked or transferred to manual review. It is important to note that the handling level here is independent of the initial risk level that triggers enhanced verification. Even if a request does not reach the medium-risk threshold for enhanced verification, if its fusion risk score increases in subsequent assessments due to factors such as environmental anomalies, it may still be judged as medium-to-high risk and blocked in the final handling, thus forming a more comprehensive layer of protection.

[0027] It should be noted that steps S100 to S500 together constitute a complete edge-cloud collaborative payment request risk control system. This system performs risk prediction and environmental consistency verification in parallel on the payment device, achieving initial screening of basic risks and environmental anomalies; dynamically triggering different levels of cloud-based enhanced verification based on the screening results; then generating a comprehensive risk assessment result through weighted fusion of multi-dimensional security signals; and finally implementing precise tiered handling strategies based on the assessment results. This technical solution, through its edge-cloud collaborative system architecture, allocates computationally intensive verification on demand, ensuring in-depth detection of high-risk transactions while maintaining a smooth payment experience for low-risk transactions.

[0028] Additionally, refer to Figure 1 In step S100 of the above-described embodiments, the following steps are also included, but are not limited to: Step S110: Obtain the device integrity parameters and current environment parameters of the payment device; Step S120: Based on the equipment integrity parameters and the current environmental parameters, a weighted calculation is performed to generate a preliminary risk score.

[0029] It should be noted that in steps S110-S120, the device integrity parameters of the payment device can be quantitatively assessed through the following dimensions: including but not limited to system Root / JB status, Hook / injection traces, system security kernel / SELinux status, certificate and signature consistency, system time anomalies, and Trusted Execution Environment (TEE / SE) integrity. The detection results of each dimension are converted into standardized scores of 0-1 to form the device integrity parameters. Simultaneously, the current environment parameters of the payment device are quantified through the following dimensions: including real-time obtained debugging / jailbreak traces, system language / time zone anomalies, permanent location / constant network matching degree, and proxy / DNS / TTL anomalies. Each dimension is also converted into standardized scores of 0-1 to form the current environment parameters. The device integrity parameters and the current environment parameters are weighted according to preset weights to generate a preliminary risk score, Integrity. The initial values ​​of the preset weights are set based on the historical operating data of the electronic payment system. After going live, they can be slightly adjusted using algorithms such as moving averages to maintain the adaptability of the risk assessment based on changes in the actual transaction environment.

[0030] Additionally, refer to Figure 1 In step S200 of the above-described embodiments, the following steps are also included, but are not limited to: Step S210: Obtain historical environmental parameters of the payment device; Step S220: Compare the current environmental parameters with the historical environmental parameters to generate an environmental consistency score.

[0031] It should be noted that in steps S210-S220, the historical and current environmental parameters of the payment device are evaluated using the same dimensions, including indicators such as debugging / jailbreak traces, system language / time zone anomalies, location / network compatibility, and proxy / DNS / TTL anomalies. The difference lies in that historical environmental parameters are constructed based on anonymized historical data stored locally on the device, while current environmental parameters are derived from real-time system status data. The environmental consistency score Geo is generated as follows: First, each indicator of the historical and current environmental parameters is quantified into a standardized score of 0-1. Then, the scores of each indicator are quantitatively compared. This comparison process uses a preset algorithm to calculate the degree of deviation for each indicator, and finally, the environmental consistency score Geo is obtained by weighted fusion of the deviations. This quantitative comparison mechanism based on historical baselines and environmental snapshots can effectively identify abnormal changes in the device environment, providing a reliable basis for environmental consistency in risk assessment.

[0032] Additionally, refer to Figure 1 , Figure 2 In step S300 of the above-described embodiments, the following steps are also included, but are not limited to: Step S310: The payment device initiates multiple round-trip communications to the trusted echo node, wherein the trusted echo node is the server or a network node specified by the server. Step S320: Based on the round-trip delay of multiple round-trip communications, obtain the upper bound of the physical distance of the payment device and generate the first enhanced score.

[0033] It should be noted that steps S310 to S320 are the specific procedures for on-site verification. The core purpose of on-site verification is to verify whether the payment device actually exists in the authorized payment environment, thereby effectively preventing the device from being remotely hijacked or unauthorized transactions initiated through relays. When the preliminary risk score reaches the medium or high risk threshold, the system will initiate an enhanced verification process: the payment device initiates multiple (usually 3-5) round-trip communications to the trusted echo node on the server side. Each round-trip delay sample is obtained by recording the signal transmission and reception times, and the upper bound of the physical distance between the payment device and the server is calculated based on this delay data, thus providing a quantitative basis for identifying relay attacks and abnormal device locations. The trusted echo node on the server side is generally a local server of the payment platform. Furthermore, the specific calculation method for the upper bound of the physical distance is as follows: d≤c·(t_rtt Δ) ······②, In Equation ②, d is the upper limit of distance (the maximum possible distance calculated based on the signal round-trip time delay), c is the upper limit of propagation speed (generally taken as the speed of light in air or cable, with a safety margin), t_rtt is the round-trip time delay, which is the time difference between the signal being sent from the payment device and returning to the payment device, and Δ is the fixed overhead in the process of the signal interacting with the payment device and the server. The fixed overhead Δ represents the basic processing delay that inevitably occurs between the payment device and the server in a normal communication link, and is unrelated to network attacks. This overhead mainly includes the following components: fixed delay generated by the operating system kernel protocol stack scheduling, protocol handshake time required to establish the network link, system processing delay of the server receiving requests and generating responses, baseline time for encryption and decryption operations in secure channels (such as TLS), and unavoidable delays such as the inherent physical layer delay of different network access methods (Wi-Fi / 4G / 5G). This invention does not specifically limit the types of delays. In some embodiments of this invention, the system will pre-calibrate the Δ values ​​under different device types and network types through large-scale testing to establish a baseline parameter table. During runtime, the system automatically matches the corresponding Δ baseline value based on the device identifier and the current network type, and allows dynamic fine-tuning within a preset range based on real-time network conditions, thereby ensuring the accuracy of distance estimation. By employing a combination of "multiple measurements and median calculation + fixed overhead deduction," misjudgments caused by network jitter can be suppressed, and the system can identify additional latency introduced by relays, thus improving the stability and verifiability of on-site verification. After obtaining the upper bound of the physical distance, a continuous first augmented value can be generated based on the degree to which the upper bound is exceeded, or the exceedance can be used as a judgment condition to generate a 0 or 1 Boolean logic value.

[0034] Additionally, refer to Figure 1 , Figure 3 In step S300 of the above-described embodiments, the following steps are also included, but are not limited to: Step S330: Obtain the first signal sequence of the payment device and the second signal sequence of at least one cooperating device, respectively; In step S340, the server calculates the sequence similarity between the first signal sequence and the second signal sequence, and generates a second enhancement score based on the sequence similarity.

[0035] It should be noted that trusted collaborative devices refer to terminal devices with a stable association with the payment device, such as smartwatches and tablets belonging to the same account system or connected to the same home network. In this embodiment of the invention, the number of collaborative devices is limited to 1-2, and they must meet any of the following trusted relationship conditions: established Bluetooth pairing connection, being in the same local area network reachable state, or passing device fingerprint consistency verification. The first signal sequence refers to the RSSI or IMU signal sequence collected by the payment device, and the second signal sequence is the corresponding type of signal sequence collected by the collaborative device. Since the payment device and the collaborative device are in the same physical environment, the similar signal sequences they collect should exhibit similar temporal variation characteristics. Therefore, the authenticity of the payment environment can be verified by calculating the similarity between the two types of signal sequences. Furthermore, when the collaborative device is unavailable, the system will automatically downgrade to the "on-site verification only + environment consistency verification" protection mode to ensure continuous security protection capabilities.

[0036] In some embodiments of the present invention, sampling is temporarily upsampled when a payment request is abnormal, and automatically downsampled after recovery; a budget is set on the end side (single RTT target ≤ X ms, total RTT ≤ 80 ms, where X is a preset time less than 80ms). When the energy consumption of the enhanced verification process for the payment request exceeds the limit, collaborative sensing verification will be shut down first, but on-site verification will be retained.

[0037] Furthermore, step S340 in the above-described embodiments also includes, but is not limited to, the following steps: Step S341: The server calculates the overall correlation between the first signal sequence and the second signal sequence, and determines whether the overall correlation meets the preset standard. Step S342: If the overall correlation reaches the preset standard, the normalized path distance of the sequence between the payment device and the cooperating device is obtained by the dynamic time warping algorithm. Step S343: Determine sequence similarity based on regular path distance.

[0038] It should be noted that steps S341 to S343 are refined processing of the collaborative sensing verification. In one embodiment of the present invention, the specific processing method for the overall correlation between the first signal sequence and the second signal sequence is as follows: Signal preprocessing process: Data acquisition phase: RSSI signals from both devices are acquired at a sampling rate of 10-20Hz; IMU signals from both devices are acquired at a sampling rate of 50-100Hz; a sliding window of 3-5 seconds is used for data buffering.

[0039] Preprocessing stage: Noise reduction is performed by using median filtering or low-pass filtering algorithms to eliminate high-frequency noise; data normalization is performed by unifying the data scale using the z-score normalization method; and resampling is performed to unify the data sequence to the same sampling interval.

[0040] Signal normalization phase: The missing data segments are filled using a linear interpolation method; for the gyroscope signal (IMU), the zero-bias average value within the sliding window is calculated; zero-bias correction is performed by subtracting the zero-bias average value from subsequent sampled values ​​to eliminate drift error in the stationary state.

[0041] Sequence similarity evaluation process: A hierarchical calculation strategy is adopted. First, the Pearson correlation coefficients of the first and second signal sequences from two devices are calculated (converted into curve calculations to determine overall similarity), and a rapid screening of overall similarity is performed. For sequences that pass the screening, a dynamic time warping algorithm is further used to align the sequences under a preset time window constraint, and the similarity after time offset compensation is calculated. This hierarchical strategy reduces computational complexity through rapid initial screening, while utilizing the time fault tolerance capability of DTW to ensure matching accuracy, achieving a balance between reliability and time consumption within a limited time search range.

[0042] Furthermore, step S500 in the above-described embodiments also includes, but is not limited to, the following steps: Step S510: If the fusion risk score is lower than the first risk level, then the payment request is approved. Step S520: If the fusion risk score is between the first risk level and the second risk level, then trigger the identity verification request of the payment device. In step S530, if the fusion risk score is higher than the second risk level, the payment request is blocked or the payment request is forwarded to the manual request channel.

[0043] It should be noted that steps S510 to S530 constitute a three-level handling mechanism based on the integrated risk score: when the score is lower than the first risk level threshold, the system executes transaction release; when the score is between the two thresholds, the local biometric or password verification process is triggered; when the score exceeds the highest risk threshold, the transaction is blocked and a risk control event record is generated, or it is pushed to the manual review queue.

[0044] In addition, in some embodiments of the present invention, risk pre-verification and environmental consistency verification are completed at the payment device end, and the preliminary risk score and environmental consistency score are generated at the end; the original sensor data generated in the enhanced verification process is not uploaded to the server end.

[0045] It should be noted that the embodiments of the present invention also follow the principle of "device-side priority and minimum upload". The entire verification process will not upload privacy data related to the payment device, such as location, Wi-Fi, cell, and sensors, to the server. It will only participate in the calculation of preliminary risk scores, environmental consistency scores, etc., on the payment device side, or be converted into summary statistical values ​​(such as geographic grid coding, hash fingerprint, similarity scores, etc.).

[0046] Furthermore, in some embodiments of this invention, the system pre-configures a tiered rollback mechanism to ensure basic risk control capabilities under abnormal scenarios: when collaborative sensing is unavailable, the system automatically downgrades to performing only on-site verification; if the on-site verification data fluctuates abnormally, it further downgrades to environmental consistency verification and triggers a single local biometric verification; when timeouts or continuous verification failures occur, transaction limit control is implemented and users are guided to offline channels or manual review processes. All rollback operations generate structured audit logs to ensure that the handling process is traceable and auditable.

[0047] Secondly, embodiments of the present invention provide an electronic payment system, including a payment device and a server, the system being used to execute the anti-theft method for an electronic wallet as described in the above-mentioned embodiments; the system further includes: The risk pre-verification module is used to perform risk pre-verification based on the local data of the payment device and generate an initial risk score. The environment verification module is used to perform environment consistency verification and generate an environment consistency score. The enhanced verification module is used to trigger the enhanced verification process to generate an enhanced risk score when the initial risk score reaches the risk threshold. The enhanced verification process includes on-site verification and collaborative perception verification, which are performed selectively or jointly based on the different risk thresholds reached by the initial risk score. The integrated score module is used to integrate the initial risk score, the environmental consistency score, and the optional enhanced risk score to generate an integrated risk score; The request processing decision module is used to perform tiered processing of payment requests based on the risk level to which the fusion risk score belongs.

[0048] It should be noted that the risk pre-verification module and environment verification module provided in this embodiment are deployed on the payment device, realizing localized risk assessment; the enhanced verification module constructs a hierarchical defense system through a configurable triggering mechanism of on-site verification and collaborative perception verification; the fusion score module integrates multi-dimensional security signals into a unified risk assessment result through a weighted fusion algorithm; and the request processing decision module executes precise hierarchical handling strategies based on quantitative risk assessment. This system achieves optimized allocation of computational load through a distributed module architecture, controls system latency while ensuring security through an edge-cloud collaboration mechanism, achieves efficient utilization of security resources through configurable verification triggering strategies, and enhances the system's robustness against complex attacks through multimodal signal fusion.

[0049] The following are anti-attack strategies implemented by the electronic payment system based on embodiments of the present invention: 1. For relay / forwarding attacks → identify and correct high latency and abnormal signal jitter characteristics → trigger blocking or initiate secondary presence verification and implement quota control; 2. Targeting replay attacks → Based on timestamp expiration + context adaptation characteristics → execute invalidation request + attach audit flag; 3. Addressing virtual location / proxy issues → Detecting sudden changes in permanent location / SSID / cellular identifier + abnormal DNS / TTL characteristics → Taking measures to increase risk level + enhance verification processes; 4. When sensor tampering or abnormal data injection is detected (noise or abnormal data distribution) → only on-site verification is retained, and a prompt is made to check the device version or security status; 5. For separate control of dual devices → based on the phenomenon of low collaboration similarity → limit the quota and record the risk control label of "identify separation".

[0050] like Figure 4 As shown, Figure 4 This is a structural diagram of a computer device provided in one embodiment of the present invention. The present invention also provides a computer device, comprising: The processor 801 can be implemented using a general-purpose central processing unit (CPU), microprocessor, application specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 802 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 802 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 802 and is called and executed by the processor 801 to execute the anti-theft method for the electronic wallet in this application embodiment. The 803 input / output interface is used to implement information input and output. The communication interface 804 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 805 transmits information between various components of the device (e.g., processor 801, memory 802, input / output interface 803, and communication interface 804); The processor 801, memory 802, input / output interface 803, and communication interface 804 are connected to each other within the device via bus 805.

[0051] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof. The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate, and may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0052] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically include computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0053] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method for preventing theft of electronic wallets, characterized in that, Applied to an electronic payment system, the system including a payment device and a server, the method includes: In response to a payment request from a payment device, the payment device performs a risk pre-verification based on local data to generate a preliminary risk score. The payment device performs an environment consistency verification and generates an environment consistency score. If the initial risk score reaches a risk threshold, an enhanced verification process is triggered to generate an enhanced risk score. The enhanced verification process includes on-site verification and collaborative perception verification, which are performed selectively or jointly based on different risk thresholds reached by the initial risk score. The initial risk score, the environmental consistency score, and the optional enhanced risk score are combined to generate a fused risk score. The payment request is processed in a tiered manner based on the risk level to which the fusion risk score belongs.

2. The anti-theft method for electronic wallets according to claim 1, characterized in that, The step of the payment device performing risk pre-verification based on local data to generate a preliminary risk score includes: Obtain the device integrity parameters and current environment parameters of the payment device; The preliminary risk score is generated by weighting the device integrity parameters with the current environmental parameters.

3. The anti-theft method for electronic wallets according to claim 2, characterized in that, The step of performing environment consistency verification by the payment device and generating an environment consistency score includes: Obtain the historical environmental parameters of the payment device; The current environmental parameters are compared with the historical environmental parameters to generate the environmental consistency score.

4. The anti-theft method for electronic wallets according to claim 1, characterized in that, The on-site verification includes: The payment device initiates multiple round-trip communications to the trusted echo node, wherein the trusted echo node is the server or a network node designated by the server. Based on the round-trip delay of multiple round-trip communications, it is determined whether the payment device exceeds the upper limit of physical distance, and a first enhancement score is generated based on the degree to which it exceeds the upper limit of physical distance.

5. The anti-theft method for electronic wallets according to claim 4, characterized in that, The collaborative sensing verification includes: Acquire the first signal sequence of the payment device and the second signal sequence of at least one cooperating device, respectively; The server calculates the sequence similarity between the first signal sequence and the second signal sequence, and generates a second enhancement score based on the sequence similarity.

6. The anti-theft method for electronic wallets according to claim 5, characterized in that, The step of calculating the sequence similarity between the first signal sequence and the second signal sequence on the server side, and generating a second enhancement score based on the sequence similarity, includes: The server calculates the overall correlation between the first signal sequence and the second signal sequence, and determines whether the overall correlation meets a preset standard. If the overall correlation reaches a preset standard, the normalized path distance of the sequence between the payment device and the cooperating device is obtained through a dynamic time warping algorithm; The sequence similarity is determined based on the regularized path distance.

7. The anti-theft method for electronic wallets according to claim 1, characterized in that, The step of performing tiered processing of the payment request based on the risk level to which the fusion risk score belongs includes: If the fusion risk score is lower than the first risk level, the payment request is approved; If the fusion risk score is between the first risk level and the second risk level, then the authentication request of the payment device is triggered; If the fusion risk score is higher than the second risk level, the payment request will be blocked or forwarded to the manual request channel.

8. An electronic payment system, characterized in that, The system includes a payment device and a server, and is used to execute the anti-theft method for the electronic wallet according to any one of claims 1 to 7; the system further includes: The risk pre-verification module is used to perform risk pre-verification based on the local data of the payment device and generate a preliminary risk score; The environment verification module is used to perform environment consistency verification and generate an environment consistency score. An enhanced verification module is used to trigger an enhanced verification process to generate an enhanced risk score when the initial risk score reaches a risk threshold. The enhanced verification process includes on-site verification and collaborative perception verification, which are performed selectively or jointly based on different risk thresholds reached by the initial risk score. The fusion score module is used to fuse the preliminary risk score, the environmental consistency score, and the optional enhanced risk score to generate a fused risk score; The request processing decision module is used to perform tiered processing of the payment request based on the risk level to which the fusion risk score belongs.

9. A computer device, characterized in that, The device includes a memory and a processor, the memory being used to store at least one program, and the processor being used to load the at least one program to execute the anti-fraud method for the electronic wallet according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing a computer to perform the anti-fraud method for an electronic wallet as described in any one of claims 1 to 7.

Images