A customer identity authentication method and system for the financial industry

Abstract

The application discloses a customer identity authentication method and system for the financial industry, relating to the technical field of identity verification. Through multi-level security protection, the application effectively improves the security of accounts and transactions. First, preliminary authentication is performed by collecting OTP, PIN code and security question answers to ensure that the user passes the basic identity verification during the login stage. Second, geographic location verification checks the matching of the user's current location with the historical frequently used locations to prevent the risk of logging in from a different place. Fingerprint recognition technology further ensures the authenticity of the user's identity by analyzing the characteristics of the core points and the peripheral area. When the system detects abnormal behavior, it will trigger an early warning and require additional verification to reduce the risk of fraud. For large transactions, the system pop-up verifies the user's fingerprint, and further verification is performed when the fingerprint authentication fails to ensure transaction security. In addition, social engineering verification verifies the user's identity through video calls, providing additional security.

Description

Technical Field

[0001] This invention relates to the field of identity verification technology, specifically to a customer identity authentication method and system for the financial industry. Background Technology

[0002] In the financial industry, customer authentication is a crucial step in ensuring transaction security and preventing fraud. Traditional customer authentication methods typically rely on a single means of verification, such as a password, PIN code, or OTP (One-Time Password). These methods have some shortcomings:

[0003] Passwords and PIN codes are easily obtained by hackers through phishing attacks, brute-force attacks, or social engineering, posing a high security risk. Modern financial fraud is becoming increasingly sophisticated, and single authentication methods are insufficient to effectively counter multiple attack methods, such as session hijacking, device information theft, or identity forgery for transactions. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a customer identity authentication method and system for the financial industry, thereby resolving the problems mentioned in the background section.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a customer identity authentication system for the financial industry, comprising,

[0006] The first data collection module is used to collect the user's OTP, PIN code, and security question answers during login to establish a knowledge factor data collection dataset. It then matches the knowledge factor data collection dataset with the corresponding values ​​in the database. If all three match successfully, a first authentication tag is added; if any one of them fails to match, a first warning instruction is sent.

[0007] The second data collection module is used to set up geolocation verification when a user makes a transaction, in order to obtain the user's current geolocation and geofence status, collect the user's historical frequently used locations, and construct a location verification index Dzy. If the location verification index Dzy is greater than the distance threshold, a second warning instruction is triggered; if the location verification index Dzy is less than or equal to the distance threshold, a second authentication tag is added.

[0008] The third acquisition module is used to acquire user fingerprints to obtain fingerprint images and extract relevant features of user fingerprints to calculate the core point region distribution index Hxz and the peripheral region distribution index Wwz. The core point region distribution index Hxz and the peripheral region distribution index Wwz are correlated, and the fingerprint factor matching index Zwyz is obtained through depth calculation. If the fingerprint factor matching index Zwyz is lower than the matching threshold, a third warning instruction is triggered; if the fingerprint factor matching index Zwyz is greater than or equal to the matching threshold, a third authentication tag is added.

[0009] The verification module allows users to log in to the financial app to view or retrieve information after obtaining the first authentication tag. After obtaining the second authentication tag, users are allowed to conduct transactions. When the transaction amount exceeds 10,000 yuan, a pop-up window verifies the user's fingerprint. After obtaining the third authentication tag, large transactions are allowed. Upon receiving the first, second, and third warning instructions, the same verification method is repeated for the user. If the verification fails three times in a row, the account is locked, and the user is required to provide the original identity document to the offline business counter for reactivation.

[0010] The user behavior recognition module is used to collect user behavior data during user login and transaction processes, build and train a risk prediction model, and extract features such as device login, transaction volume behavior, typing habits, and account change information from user behavior data to construct an abnormal behavior index Ycx. If the abnormal behavior index Ycx is higher than the abnormal behavior threshold, a fourth warning instruction is sent.

[0011] The social engineering dynamic verification module is used to send a video call to verify identity after receiving the fourth early warning instruction. It verifies the user's identity information and documents. When the authentication is successful, a fourth authentication tag is added, and the operation is allowed to continue.

[0012] Preferably, the second acquisition module includes a geographic location acquisition unit, a location verification calculation unit, and a location evaluation unit;

[0013] The geographic location acquisition unit is used to collect and obtain the user's current geographic location through GPS and IP location positioning technology, retrieve historical transaction locations, and establish a database of the user's frequently used locations;

[0014] The location verification calculation unit is used to extract the latitude and longitude features of locations from a commonly used location database and calculate the location verification index Dzy using the Haversine formula.

[0015] ;

[0016] In the formula, r represents the Earth's radius, set to 6371 kilometers. Indicates the latitude of the historical location. Indicates the latitude and longitude of the current login location. Indicates the longitude of the current login location. The longitude value of a historical location is represented by hav, which represents the semi-sine function. This represents the precision dimension conversion function.

[0017] Preferably, the location assessment unit is used to preset a distance threshold and compare the distance threshold with the location verification index Dzy to obtain a distance assessment result, including:

[0018] If the location verification index Dzy > distance threshold, it indicates that the current user's location credibility and geofence compliance are abnormal, and there is a risk of login from another location, triggering the second warning instruction;

[0019] When the location verification index Dzy ≤ distance threshold, it means that the current user's location credibility and geofence compliance are normal, there is no risk of login from another location, and a second authentication tag is added.

[0020] Preferably, the third acquisition module includes a fingerprint acquisition unit, a first feature extraction unit, and a first calculation unit;

[0021] The fingerprint acquisition unit is used to acquire user fingerprint images using online or offline fingerprint acquisition devices, and to perform grayscale processing, binarization and noise reduction preprocessing operations on the fingerprint images.

[0022] The first feature extraction unit uses the Harris corner detection algorithm to extract the core point region distribution features and the peripheral region distribution features from the preprocessed fingerprint image. The first calculation unit then performs depth analysis based on these core point region distribution features and the peripheral region distribution features, calculating the core point region distribution index Hxz and the peripheral region distribution index Wwz using the following formulas:

[0023] ;

[0024] In the formula, The number of feature points in the core area. Let i be the weight of the i-th core point. Let be the distance between the i-th core point and its nearest neighbor core point; The bifurcation point parameter of the i-th core point; Let be the short ridge parameter of the i-th core point; Let i be the island point parameters of the i-th core point; This represents the standard deviation of the distances between all feature points within the core point region. This is the average distance between all feature points within the core area; The standard deviation of the directional angles of all feature points within the core point region; It is the average value of the directional angles of all feature points within the core point region; The area of ​​the core region; The ridge density in the core area;

[0025] ;

[0026] In the formula, This represents the number of feature points in the outer region. The weight of the i-th peripheral feature point is... Let be the distance between the i-th peripheral feature point and its nearest neighbor peripheral feature point; The bifurcation point parameter of the i-th peripheral feature point; Let be the short ridge parameter of the i-th peripheral feature point; Let be the island point parameters of the i-th peripheral feature point; This represents the standard deviation of the distances between all feature points within the outer region. This is the average distance between all feature points within the outer region; The standard deviation of the directional angles of all feature points within the outer region; It is the average value of the directional angles of all feature points within the outer region; The area of ​​the outer region; The density of ridge lines in the outer region.

[0027] Preferably, the third acquisition module further includes an association unit and a fingerprint evaluation unit;

[0028] The associated unit is used to calculate the fingerprint factor matching index Zwyz by combining the core area distribution index Hxz and the peripheral area distribution index Wwz using the following associated formula:

[0029] ;

[0030] In the formula, and This represents the weighting coefficients of the core area distribution index Hxz and the peripheral area distribution index Wwz, and α+β=1.

[0031] Preferably, the fingerprint evaluation unit is used to construct a matching threshold based on the initial fingerprints recorded by users in the database, and compare the matching threshold with the fingerprint factor matching index Zwyz to obtain the fingerprint matching evaluation result, including:

[0032] If the fingerprint factor matching index Zwyz ≥ the matching threshold, it means that the current user's fingerprint matching degree is qualified and it belongs to the user's own operation, and a third authentication tag is added;

[0033] When the fingerprint factor matching index Zwyz is less than the matching threshold, it indicates that the current user's fingerprint matching degree is abnormal, there is a risk of theft, and the third warning instruction is triggered.

[0034] Preferably, the user behavior recognition module includes a user behavior data acquisition unit, a second feature extraction unit, and an abnormal behavior calculation unit;

[0035] The user behavior data collection unit is used to record the device information used by users when logging in, including device type, operating system, browser type and device ID; and to record users' transaction behavior data, including transaction amount, transaction frequency and transaction time; and to record users' typing speed, typing error rate and typing rhythm; and to record users' changes to account information, including password changes, contact information changes and device binding changes.

[0036] The second feature extraction unit is used to extract features such as device login, transaction volume, typing habits, and account change information from user behavior data after building and training a risk prediction model using machine learning algorithms, including logistic regression, decision tree, or random forest.

[0037] The abnormal behavior calculation unit is used to calculate the user's abnormal behavior index Ycx in real time based on the risk prediction model. The abnormal behavior index Ycx is calculated using the following formula:

[0038]

[0039] In the formula, Replace the device frequency value for the user. This represents the daily trading frequency value. For users to change frequency values, For users' typing speed per minute, This indicates the error rate per minute. and All are weighting coefficients It is represented as the first correction constant.

[0040] Preferably, the user behavior recognition module also includes a behavior evaluation unit;

[0041] The behavior assessment unit is used to preset abnormal behavior thresholds and compare these thresholds with the abnormal behavior index Ycx to obtain user behavior assessment results, including:

[0042] If the abnormal behavior index Ycx is greater than the abnormal behavior threshold, it indicates that the user's operation behavior is risky, and a fourth warning instruction is sent; if the abnormal behavior index Ycx is less than or equal to the abnormal behavior threshold, it indicates that the user's operation behavior is not risky.

[0043] Preferably, the execution steps of the social engineering dynamic verification module are as follows:

[0044] When the fourth warning instruction is received, the system sends a video call request to the user, requiring the user to verify their identity through a video call. The request includes the video call link and the verification time window.

[0045] Users accept video call requests within a specified time through a pre-designated financial app or verification platform;

[0046] The system requires users to present identification documents, such as ID cards, passports, or driver's licenses, during video calls. Verifiers verify users' identity information via video calls, and use OCR technology to automatically identify information on the identification documents and match it with information in the database, including whether facial features match the photo on the identification documents.

[0047] The verifier asks the user some dynamic questions, which are generated based on the user's account information, including recent transaction details, frequently used addresses, or registration information. If the user's identity information matches the database information exactly and the facial recognition verification is successful, the authentication is successful, a fourth authentication tag is added, and the user is allowed to continue with account operations.

[0048] If a user does not receive a video call request or fails verification, the account will be locked or further verification will be required.

[0049] A customer authentication method for the financial industry includes the following steps:

[0050] S1. Collect the user's OTP, PIN code, and security question answers during login to establish a knowledge factor collection dataset; and match the knowledge factor collection dataset with the corresponding values ​​in the database. If all three match successfully, add the first authentication tag; if any match fails, send the first warning command.

[0051] S2. When a user engages in a transaction, a geolocation verification is set up to obtain the user's current geolocation and geofence status, collect the user's historical frequently used locations, and construct a location verification index Dzy. If the location verification index Dzy is greater than the distance threshold, a second warning instruction is triggered; if the location verification index Dzy is less than or equal to the distance threshold, a second authentication tag is added.

[0052] S3. Collect user fingerprints to obtain fingerprint images and extract relevant features of user fingerprints to calculate the core point region distribution index Hxz and the peripheral region distribution index Wwz. Correlate the core point region distribution index Hxz and the peripheral region distribution index Wwz and perform deep calculation to obtain the fingerprint factor matching index Zwyz. If the fingerprint factor matching index Zwyz is lower than the matching threshold, trigger the third warning instruction; if the fingerprint factor matching index Zwyz is greater than or equal to the matching threshold, add the third authentication tag.

[0053] S4. After a user obtains the first authentication tag, the user is allowed to log in to the financial APP to view or retrieve information; after a user obtains the second authentication tag, the user is allowed to conduct transaction operations. When the transaction amount exceeds 10,000 yuan, a pop-up window will verify the user's fingerprint. After obtaining the third authentication tag, large-amount transactions are allowed. Upon receiving the first, second, and third warning instructions, the user will be repeatedly verified in the same way. If the verification fails three times in a row, the account will be locked, and the user will be required to provide the original identity document to the offline business counter for reactivation.

[0054] S5. During user login and transaction processes, collect user behavior data, establish and train a risk prediction model, and extract features such as device login, transaction volume behavior, typing habits, and account change information from user behavior data to construct an abnormal behavior index Ycx. If the abnormal behavior index Ycx is higher than the abnormal behavior threshold, send a fourth warning instruction.

[0055] S6. After receiving the fourth warning instruction, the management terminal sends a video call to verify identity and confirm the user's identity information and files. When the authentication is successful, a fourth authentication tag is added, and the operation is allowed to continue.

[0056] This invention provides a customer authentication method and system for the financial industry. It has the following beneficial effects:

[0057] (1) This system simultaneously collects OTP, PIN code, and security question answer information through the first collection module to form a knowledge factor collection dataset. The combination of the three verification methods greatly improves security and prevents the risk of a single password or PIN code being cracked by hackers. Through the dual authentication tag mechanism of geolocation verification and fingerprint verification, the system ensures the user's true identity when conducting transactions, reducing the possibility of identity forgery and illegal transactions. In particular, the introduction of the location verification index Dzy and the fingerprint factor matching index Zwyz further improves the accuracy of verification. The system has a built-in early warning mechanism, including a first early warning instruction, a second early warning instruction, and a third early warning instruction. When any verification fails, an early warning instruction is sent immediately to prevent unauthorized access and transaction behavior. If three consecutive verifications fail, the system automatically locks the account, further enhancing security protection.

[0058] (2) Through the user behavior recognition module, the system can collect and analyze user behavior data during user login and transactions, and construct an abnormal behavior index Ycx. This module can identify behaviors such as switching devices for login, abnormal transaction volume, and abnormal typing habits, and sends a fourth warning command when abnormal behavior is detected, effectively preventing fraudulent behavior. After receiving the fourth warning command, identity verification is performed through video call to verify the user's identity information and documents. This layer of verification ensures that even in high-risk situations, the user's identity can be confirmed through face-to-face dynamic verification. The system has designed a reasonable multi-layer verification process. After the user obtains each authentication tag, they are allowed to perform corresponding operations, such as viewing information, conducting transactions, and large-amount transactions, which optimizes the user experience and avoids too many cumbersome steps. By locking the account after multiple verification failures and requiring offline reactivation, the possibility of hackers obtaining user accounts through continuous attacks is prevented, ensuring the user's account security. Attached Figure Description

[0059] Figure 1 This is a schematic flowchart of the first acquisition module of the present invention;

[0060] Figure 2 This is a flowchart illustrating a customer identity authentication system for the financial industry according to the present invention.

[0061] Figure 3 This is a schematic diagram illustrating the steps of a customer identity authentication method for the financial industry according to the present invention. Detailed Implementation

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] Example 1, please refer to Figure 1 and 2 This invention provides a customer identity authentication system for the financial industry, comprising:

[0064] The first data collection module is used to collect the user's OTP, PIN code, and security question answers during login to establish a knowledge factor collection dataset. It then matches the knowledge factor collection dataset with the corresponding values ​​in the database. If all three match successfully, a first authentication tag is added and a success log is recorded. If any one of the matching fails, a first warning command is sent and a failure log is recorded.

[0065] The second data collection module is used to set up geolocation verification when a user makes a transaction, in order to obtain the user's current geolocation and geofence status, collect the user's historical frequently used locations, and construct a location verification index Dzy. If the location verification index Dzy is greater than the distance threshold, a second warning instruction is triggered; if the location verification index Dzy is less than or equal to the distance threshold, a second authentication tag is added.

[0066] The third acquisition module is used to acquire user fingerprints to obtain fingerprint images and extract relevant features of user fingerprints to calculate the core point region distribution index Hxz and the peripheral region distribution index Wwz. The core point region distribution index Hxz and the peripheral region distribution index Wwz are correlated, and the fingerprint factor matching index Zwyz is obtained through depth calculation. If the fingerprint factor matching index Zwyz is lower than the matching threshold, a third warning instruction is triggered; if the fingerprint factor matching index Zwyz is greater than or equal to the matching threshold, a third authentication tag is added.

[0067] The verification module allows users to log in to the financial app to view or retrieve information after obtaining the first authentication tag. After obtaining the second authentication tag, users are allowed to conduct transactions. When the transaction amount exceeds 10,000 yuan, a pop-up window verifies the user's fingerprint. After obtaining the third authentication tag, large transactions are allowed. Upon receiving the first, second, and third warning instructions, the same verification method is repeated for the user. If the verification fails three times in a row, the account is locked, and the user is required to provide the original identity document to the offline business counter for reactivation.

[0068] The user behavior recognition module is used to collect user behavior data during user login and transaction processes, build and train a risk prediction model, and extract features such as device login, transaction volume behavior, typing habits, and account change information from user behavior data to construct an abnormal behavior index Ycx. If the abnormal behavior index Ycx is higher than the abnormal behavior threshold, a fourth warning instruction is sent.

[0069] The social engineering dynamic verification module is used to send a video call to verify identity after receiving the fourth early warning instruction. It verifies the user's identity information and documents. When the authentication is successful, a fourth authentication tag is added, and the operation is allowed to continue.

[0070] In this embodiment, the system simultaneously collects OTP, PIN code, and security question answer information through the first acquisition module, forming a knowledge factor acquisition dataset. The combination of these three verification methods significantly improves security, preventing the risk of a single password or PIN code being cracked by hackers. The dual authentication tag mechanism of geolocation verification and fingerprint verification ensures the user's true identity during transactions, reducing the possibility of identity forgery and illegal transactions. In particular, the introduction of the location verification index Dzy and the fingerprint factor matching index Zwyz further improves the accuracy of verification. The system has a built-in early warning mechanism, including a first, second, and third early warning command. An early warning command is immediately sent when any verification fails, preventing unauthorized access and transactions. If three consecutive verification failures occur, the system automatically locks the account, further enhancing security.

[0071] Through its user behavior recognition module, the system collects and analyzes user behavior data during login and transactions, constructing an abnormal behavior index, Ycx. This module can identify behaviors such as switching devices for login, abnormal transaction volume, and unusual typing habits, and sends a fourth warning command upon detecting abnormal behavior, effectively preventing fraud. Upon receiving the fourth warning command, identity verification is performed via video call to verify the user's identity information and documents. This layer of verification ensures that even in high-risk situations, user identity can be confirmed through dynamic face-to-face verification. The system features a well-designed multi-layered verification process. After obtaining various authentication tags, users are allowed to perform corresponding operations, such as viewing information, conducting transactions, and large transactions, optimizing the user experience and avoiding excessive cumbersome steps. A mechanism that locks the account after multiple failed verifications and requires offline reactivation prevents hackers from gaining access to user accounts through continuous attacks, ensuring user account security.

[0072] Example 2 is an explanation of Example 1. Please refer to the example provided. Figure 1 Specifically, the second data acquisition module includes a geographic location acquisition unit, a location verification calculation unit, and a location evaluation unit;

[0073] The geolocation data collection unit is used to collect the user's current geolocation through GPS and IP location positioning technology, retrieve historical transaction locations, and establish a database of the user's frequently used locations; it can determine in real time whether the location is correct, effectively preventing the risks of login from other locations and location spoofing.

[0074] The location verification calculation unit is used to extract the latitude and longitude features of locations from a commonly used location database and calculate the location verification index Dzy using the Haversine formula.

[0075] ;

[0076] In the formula, r represents the Earth's radius, set to 6371 kilometers. Indicates the latitude of the historical location. Indicates the latitude and longitude of the current login location. Indicates the longitude of the current login location. The longitude value of a historical location is represented by hav, which represents the semi-sine function. This represents the precision dimension transformation function. It extracts location latitude and longitude features from a database of frequently used user locations and calculates the location verification index Dzy using the Haversine formula. This formula takes into account the curvature of the Earth, ensuring accuracy and making the assessment of the distance between the user's current location and historical transaction locations more precise.

[0077] The location assessment unit is used to preset a distance threshold and compare the distance threshold with the location verification index Dzy to obtain the distance assessment results, including:

[0078] If the location verification index Dzy > distance threshold, it indicates that the current user's location credibility and geofence compliance are abnormal, and there is a risk of login from another location, triggering the second warning instruction;

[0079] When the location verification index Dzy ≤ distance threshold, it means that the current user's location credibility and geofence compliance are normal, there is no risk of login from another location, and a second authentication tag is added.

[0080] In this embodiment, by combining dynamic location verification and intelligent distance assessment, the system can effectively identify and prevent spoofed locations, session hijacking, or other fraudulent activities. This comprehensive verification method significantly improves the security of financial transactions and reduces potential risks caused by abnormal locations. While ensuring security, the system reduces unnecessary user intervention and verification steps through an intelligent verification mechanism, thus improving the user experience. When the user's location is normal, the system automatically adds a second authentication tag, enabling the user to conduct transactions smoothly and avoiding excessive interference.

[0081] Example 3 is an explanation of Example 1. Please refer to the example provided. Figure 1 Specifically, the third acquisition module includes a fingerprint acquisition unit, a first feature extraction unit, and a first calculation unit;

[0082] The fingerprint acquisition unit is used to acquire user fingerprint images using online or offline fingerprint acquisition devices, and to perform grayscale processing, binarization and noise reduction preprocessing operations on the fingerprint images.

[0083] The first feature extraction unit uses the Harris corner detection algorithm to extract the core point region distribution features and the peripheral region distribution features from the preprocessed fingerprint image. The first calculation unit then performs depth analysis based on these core point region distribution features and the peripheral region distribution features, calculating the core point region distribution index Hxz and the peripheral region distribution index Wwz using the following formulas:

[0084] ;

[0085] In the formula, The number of feature points in the core area. Let i be the weight of the i-th core point. Let be the distance between the i-th core point and its nearest neighbor core point; The bifurcation point parameter of the i-th core point; Let be the short ridge parameter of the i-th core point; Let i be the island point parameters of the i-th core point; This represents the standard deviation of the distances between all feature points within the core point region. This is the average distance between all feature points within the core area; The standard deviation of the directional angles of all feature points within the core point region; It is the average value of the directional angles of all feature points within the core point region; The area of ​​the core region; The ridge density in the core area;

[0086] ;

[0087] In the formula, This represents the number of feature points in the outer region. The weight of the i-th peripheral feature point is... Let be the distance between the i-th peripheral feature point and its nearest neighbor peripheral feature point; The bifurcation point parameter of the i-th peripheral feature point; Let be the short ridge parameter of the i-th peripheral feature point; Let be the island point parameters of the i-th peripheral feature point; This represents the standard deviation of the distances between all feature points within the outer region. This is the average distance between all feature points within the outer region; The standard deviation of the directional angles of all feature points within the outer region; It is the average value of the directional angles of all feature points within the outer region; The area of ​​the outer region; The density of ridge lines in the outer region.

[0088] The third acquisition module also includes an association unit and a fingerprint evaluation unit;

[0089] The associated unit is used to calculate the fingerprint factor matching index Zwyz by combining the core area distribution index Hxz and the peripheral area distribution index Wwz using the following associated formula:

[0090] ;

[0091] In the formula, and This represents the weighting coefficients of the core area distribution index Hxz and the peripheral area distribution index Wwz, and α+β=1.

[0092] The fingerprint evaluation unit is used to construct a matching threshold based on the initial fingerprints recorded by users in the database, and compares the matching threshold with the fingerprint factor matching index Zwyz to obtain the fingerprint matching evaluation result, including:

[0093] If the fingerprint factor matching index Zwyz ≥ the matching threshold, it means that the current user's fingerprint matching degree is qualified and it belongs to the user's own operation, and a third authentication tag is added;

[0094] When the fingerprint factor matching index Zwyz is less than the matching threshold, it indicates that the current user's fingerprint matching degree is abnormal, there is a risk of theft, and the third warning instruction is triggered.

[0095] In this embodiment, the third acquisition module uses precise fingerprint image processing and analysis, employing the Harris corner detection algorithm to extract and evaluate the distribution characteristics of the core point and peripheral area. This meticulous feature extraction and matching algorithm helps improve the accuracy of fingerprint authentication and reduces the risk of misidentification. By comparing these features with the initial fingerprint data in the database, the system can effectively identify the user, thereby enhancing the security of financial transactions.

[0096] Example 4 is an explanation of Example 1. Please refer to the example provided. Figure 1 Specifically, the user behavior recognition module includes a user behavior data acquisition unit, a second feature extraction unit, and an abnormal behavior calculation unit;

[0097] The user behavior data collection unit is used to record the device information used by users when logging in, including device type, operating system, browser type and device ID; and to record users' transaction behavior data, including transaction amount, transaction frequency and transaction time; and to record users' typing speed, typing error rate and typing rhythm; and to record users' changes to account information, including password changes, contact information changes and device binding changes.

[0098] The second feature extraction unit is used to extract features such as device login, transaction volume, typing habits, and account change information from user behavior data after building and training a risk prediction model using machine learning algorithms, including logistic regression, decision tree, or random forest.

[0099] The abnormal behavior calculation unit is used to calculate the user's abnormal behavior index Ycx in real time based on the risk prediction model. The abnormal behavior index Ycx is calculated using the following formula:

[0100]

[0101] In the formula, Replace the device frequency value for the user. This represents the daily trading frequency value. For users to change frequency values, For users' typing speed per minute, This indicates the error rate per minute. and All are weighting coefficients It is represented as the first correction constant.

[0102] Specifically, the user behavior recognition module also includes a behavior evaluation unit;

[0103] The behavior assessment unit is used to preset abnormal behavior thresholds and compare these thresholds with the abnormal behavior index Ycx to obtain user behavior assessment results, including:

[0104] If the abnormal behavior index Ycx is greater than the abnormal behavior threshold, it indicates that the user's operation behavior is risky, and a fourth warning instruction is sent; if the abnormal behavior index Ycx is less than or equal to the abnormal behavior threshold, it indicates that the user's operation behavior is not risky.

[0105] In this embodiment, the user behavior recognition module enhances the financial system's ability to monitor user identity and behavior through a data-driven approach, making the identity authentication process more secure and reliable. The system can adjust risk assessment based on the abnormal behavior index Ycx of user behavior, providing dynamic security protection and reducing the risk of fraud and account theft.

[0106] Example 5 is an explanation of Example 1. Please refer to the example provided. Figure 1 Specifically, the execution steps of the social engineering dynamic verification module are as follows:

[0107] When the fourth warning instruction is received, the system sends a video call request to the user, requiring the user to verify their identity through a video call. The request includes the video call link and the verification time window.

[0108] Users accept video call requests within a specified time through a pre-designated financial app or verification platform;

[0109] The system requires users to present identification documents, such as ID cards, passports, or driver's licenses, during video calls. Verifiers verify users' identity information via video calls, and use OCR technology to automatically identify information on the identification documents and match it with information in the database, including whether facial features match the photo on the identification documents.

[0110] The verifier asks the user some dynamic questions, which are generated based on the user's account information, including recent transaction details, frequently used addresses, or registration information. If the user's identity information matches the database information exactly and the facial recognition verification is successful, the authentication is successful, a fourth authentication tag is added, and the user is allowed to continue with account operations.

[0111] If a user does not receive a video call request or fails verification, the account will be locked or further verification will be required.

[0112] In this embodiment, upon receiving the fourth warning instruction, the system sends a video call request to the user, including a link and a verification time window, ensuring the user can authenticate their identity within the specified time. This process increases the security and timeliness of verification. During the video call, the user must present identification documents (such as an ID card, passport, or driver's license), and the verifier automatically recognizes the document information using OCR technology. This step ensures that the user's identity information matches the information in the database, reducing the risk of identity theft. The verifier verifies the user's facial features against the photo on the identification document via video call, further improving the accuracy and security of identity verification. The verifier asks dynamic questions generated based on account information, such as recent transaction details, frequently used addresses, or registration information. The user's answers to the dynamic questions further confirm the user's true identity. If the user's identity information matches perfectly and facial recognition verification passes, the system adds a fourth authentication tag, allowing the user to continue account operations. Otherwise, the system locks the account or requires further verification. This mechanism effectively protects account security and can quickly respond to potential security threats.

[0113] Example 6, please refer to Figure 3 A customer authentication method for the financial industry includes the following steps:

[0114] S1. Collect the user's OTP, PIN code, and security question answers during login to establish a knowledge factor collection dataset; and match the knowledge factor collection dataset with the corresponding values ​​in the database. If all three match successfully, add the first authentication tag; if any match fails, send the first warning command.

[0115] S2. When a user engages in a transaction, a geolocation verification is set up to obtain the user's current geolocation and geofence status, collect the user's historical frequently used locations, and construct a location verification index Dzy. If the location verification index Dzy is greater than the distance threshold, a second warning instruction is triggered; if the location verification index Dzy is less than or equal to the distance threshold, a second authentication tag is added.

[0116] S3. Collect user fingerprints to obtain fingerprint images and extract relevant features of user fingerprints to calculate the core point region distribution index Hxz and the peripheral region distribution index Wwz. Correlate the core point region distribution index Hxz and the peripheral region distribution index Wwz and perform deep calculation to obtain the fingerprint factor matching index Zwyz. If the fingerprint factor matching index Zwyz is lower than the matching threshold, trigger the third warning instruction; if the fingerprint factor matching index Zwyz is greater than or equal to the matching threshold, add the third authentication tag.

[0117] S4. After a user obtains the first authentication tag, the user is allowed to log in to the financial APP to view or retrieve information; after a user obtains the second authentication tag, the user is allowed to conduct transaction operations. When the transaction amount exceeds 10,000 yuan, a pop-up window will verify the user's fingerprint. After obtaining the third authentication tag, large-amount transactions are allowed. Upon receiving the first, second, and third warning instructions, the user will be repeatedly verified in the same way. If the verification fails three times in a row, the account will be locked, and the user will be required to provide the original identity document to the offline business counter for reactivation.

[0118] S5. During user login and transaction processes, collect user behavior data, establish and train a risk prediction model, and extract features such as device login, transaction volume behavior, typing habits, and account change information from user behavior data to construct an abnormal behavior index Ycx. If the abnormal behavior index Ycx is higher than the abnormal behavior threshold, send a fourth warning instruction.

[0119] S6. After receiving the fourth warning instruction, the management terminal sends a video call to verify identity and confirm the user's identity information and files. When the authentication is successful, a fourth authentication tag is added, and the operation is allowed to continue.

[0120] In this embodiment, the invention effectively improves account and transaction security through multi-layered security protection. First, preliminary authentication is performed by collecting OTP, PIN code, and answers to security questions to ensure basic identity verification during login. Second, geolocation verification checks the user's current location against historically frequently used locations to prevent login risks from different locations. Fingerprint recognition technology further ensures the authenticity of the user's identity by analyzing the characteristics of core points and peripheral areas. When the system detects abnormal behavior (such as high transaction amounts or login from abnormal devices), it triggers an alert and requires additional verification to reduce fraud risks. For large transactions, the system pops up a window to verify the user's fingerprint, and performs further verification if fingerprint authentication fails, ensuring transaction security. Furthermore, social engineering verification verifies the user's identity through video calls, adding extra security. The overall method, by comprehensively applying authentication, alerts, behavioral analysis, and social engineering verification, provides a comprehensive and effective account protection mechanism, significantly improving the security of financial transactions.

[0121] The threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by those skilled in the art for each set of sample data; as long as it does not affect the ratio between the parameter and the quantized value, it is acceptable.

[0122] The above formulas are all derived from software simulation using a large amount of data, and are selected to be close to the actual values. The coefficients in the formulas are set by those skilled in the art according to the actual situation. The above are only preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or changes made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A customer identity authentication system for the financial industry, characterized in that: include, The first data collection module is used to collect OTP, PIN code and security question answers when users log in, and to build a knowledge factor data collection dataset. The knowledge factor collection dataset is then matched with the corresponding values ​​in the database. If all three match successfully, the first authentication tag is added; if any match fails, the first warning instruction is sent. The second data collection module is used to set up geolocation verification when a user makes a transaction, in order to obtain the user's current geolocation and geofence status, collect the user's historical frequently used locations, and construct a location verification index Dzy. If the location verification index Dzy is greater than the distance threshold, a second warning instruction is triggered; if the location verification index Dzy is less than or equal to the distance threshold, a second authentication tag is added. The third acquisition module is used to acquire user fingerprints to obtain fingerprint images and extract relevant features of user fingerprints to calculate the core point region distribution index Hxz and the peripheral region distribution index Wwz. The core point region distribution index Hxz and the peripheral region distribution index Wwz are correlated, and the fingerprint factor matching index Zwyz is obtained through depth calculation. If the fingerprint factor matching index Zwyz is lower than the matching threshold, a third warning instruction is triggered; if the fingerprint factor matching index Zwyz is greater than or equal to the matching threshold, a third authentication tag is added. The verification module allows users to log in to the financial app to view or retrieve information after obtaining the first authentication tag. After obtaining the second authentication tag, users are allowed to conduct transactions. When the transaction amount exceeds 10,000 yuan, a pop-up window verifies the user's fingerprint. After obtaining the third authentication tag, large transactions are allowed. Upon receiving the first, second, and third warning instructions, the same verification method is repeated for the user. If the verification fails three times in a row, the account is locked, and the user is required to provide the original identity document to the offline business counter for reactivation. The user behavior recognition module is used to collect user behavior data during user login and transaction processes, build and train a risk prediction model, and extract features such as device login, transaction volume behavior, typing habits, and account change information from user behavior data to construct an abnormal behavior index Ycx. If the abnormal behavior index Ycx is higher than the abnormal behavior threshold, a fourth warning instruction is sent. The social engineering dynamic verification module is used to send a video call to verify identity after receiving the fourth early warning instruction. It verifies the user's identity information and documents. When the authentication is successful, a fourth authentication tag is added, and the operation is allowed to continue.

2. A customer identity authentication system for the financial industry according to claim 1, characterized in that: The second acquisition module includes a geographic location acquisition unit, a location verification calculation unit, and a location evaluation unit; The geographic location acquisition unit is used to acquire the user's current geographic location through GPS and IP location positioning technology, retrieve historical transaction locations, and establish a database of the user's frequently used locations; The location verification calculation unit is used to extract the latitude and longitude features of locations from a commonly used location database, and calculate the location verification index Dzy using the Haversine formula. ； In the formula, r represents the radius of the Earth. Indicates the latitude of the historical location. Indicates the latitude and longitude of the current login location. Indicates the longitude of the current login location. The longitude value of a historical location is represented by hav, which represents the semi-sine function. This represents the precision dimension conversion function.

3. A customer identity authentication system for the financial industry according to claim 2, characterized in that: The location assessment unit is used to preset a distance threshold and compare the distance threshold with the location verification index Dzy to obtain a distance assessment result, including: If the location verification index Dzy > distance threshold, it indicates that the current user's location credibility and geofence compliance are abnormal, and there is a risk of login from another location, triggering the second warning instruction; When the location verification index Dzy ≤ distance threshold, it means that the current user's location credibility and geofence compliance are normal, there is no risk of login from another location, and a second authentication tag is added.

4. A customer identity authentication system for the financial industry according to claim 1, characterized in that: The third acquisition module includes a fingerprint acquisition unit, a first feature extraction unit, and a first calculation unit; The fingerprint acquisition unit is used to acquire user fingerprint images using online or offline fingerprint acquisition devices, and to perform grayscale processing, binarization, and noise reduction preprocessing operations on the fingerprint images. The first feature extraction unit is used to extract the core point region distribution features and the peripheral region distribution features of the preprocessed fingerprint image using the Harris corner detection algorithm. The first calculation unit then performs depth analysis based on these core point region distribution features and peripheral region distribution features, calculating the core point region distribution index Hxz and the peripheral region distribution index Wwz using the following formulas: ； In the formula, The number of feature points in the core area. Let i be the weight of the i-th core point. Let be the distance between the i-th core point and its nearest neighbor core point; The bifurcation point parameter of the i-th core point; Let be the short ridge parameter of the i-th core point; Let i be the island point parameters of the i-th core point; This represents the standard deviation of the distances between all feature points within the core point region. This is the average distance between all feature points within the core area; The standard deviation of the directional angles of all feature points within the core point region; It is the average value of the directional angles of all feature points within the core point region; The area of ​​the core region; The ridge density in the core area; ； In the formula, This represents the number of feature points in the outer region. The weight of the i-th peripheral feature point is... Let be the distance between the i-th peripheral feature point and its nearest neighbor peripheral feature point; The bifurcation point parameter of the i-th peripheral feature point; Let be the short ridge parameter of the i-th peripheral feature point; Let be the island point parameters of the i-th peripheral feature point; This represents the standard deviation of the distances between all feature points within the outer region. This is the average distance between all feature points within the outer region; The standard deviation of the directional angles of all feature points within the outer region; It is the average value of the directional angles of all feature points within the outer region; The area of ​​the outer region; The density of ridge lines in the outer region.

5. A customer identity authentication system for the financial industry according to claim 1, characterized in that: The third acquisition module also includes an association unit and a fingerprint evaluation unit; The associated unit is used to calculate the fingerprint factor matching index Zwyz from the core point area distribution index Hxz and the peripheral area distribution index Wwz using the following associated formula: ； In the formula, and This represents the weighting coefficients of the core area distribution index Hxz and the peripheral area distribution index Wwz, and α+β=1.

6. A customer identity authentication system for the financial industry according to claim 5, characterized in that: The fingerprint evaluation unit is used to construct a matching threshold based on the initial fingerprints recorded by users in the database, and compare the matching threshold with the fingerprint factor matching index Zwyz to obtain the fingerprint matching evaluation result, including: If the fingerprint factor matching index Zwyz ≥ the matching threshold, it means that the current user's fingerprint matching degree is qualified and it belongs to the user's own operation, and a third authentication tag is added; When the fingerprint factor matching index Zwyz is less than the matching threshold, it indicates that the current user's fingerprint matching degree is abnormal, there is a risk of theft, and the third warning instruction is triggered.

7. A customer identity authentication system for the financial industry according to claim 1, characterized in that: The user behavior recognition module includes a user behavior data acquisition unit, a second feature extraction unit, and an abnormal behavior calculation unit. The user behavior data collection unit is used to record the device information used by the user when logging in, including device type, operating system, browser type and device ID; and to record the user's transaction behavior data, including transaction amount, transaction frequency and transaction time; and to record the user's typing speed, typing error rate and typing rhythm; and to record the user's changes to account information, including password change, contact information change and bound device change. The second feature extraction unit is used to extract features such as device login, transaction volume, typing habits, and account change information from user behavior data after building and training a risk prediction model using machine learning algorithms, including logistic regression, decision tree, or random forest. The abnormal behavior calculation unit is used to calculate the user's abnormal behavior index Ycx in real time based on the risk prediction model. The abnormal behavior index Ycx is calculated using the following formula: In the formula, Replace the device frequency value for the user. This represents the daily trading frequency value. For users to change frequency values, For users' typing speed per minute, This indicates the error rate per minute. and All are weighting coefficients It is represented as the first correction constant.

8. A customer identity authentication system for the financial industry according to claim 1, characterized in that: The user behavior recognition module also includes a behavior evaluation unit; The behavior evaluation unit is used to preset a behavior anomaly threshold and compare the behavior anomaly threshold with the abnormal behavior index Ycx to obtain user behavior evaluation results, including: If the abnormal behavior index Ycx is greater than the abnormal behavior threshold, it indicates that the user's operation behavior is risky, and a fourth warning instruction is sent; if the abnormal behavior index Ycx is less than or equal to the abnormal behavior threshold, it indicates that the user's operation behavior is not risky.

9. A customer identity authentication system for the financial industry according to claim 1, characterized in that: The execution steps of the social engineering dynamic verification module are as follows: When the fourth warning instruction is received, the system sends a video call request to the user, requiring the user to verify their identity through a video call. The request includes the video call link and the verification time window. Users accept video call requests within a specified time through a pre-designated financial app or verification platform; The system requires users to present identification documents, such as ID cards, passports, or driver's licenses, during video calls. Verifiers verify users' identity information via video calls, and use OCR technology to automatically identify information on the identification documents and match it with information in the database, including whether facial features match the photo on the identification documents. Verifiers ask users dynamic questions, which are generated based on the user's account information, including recent transaction details, frequently used addresses, or registration information. If the user's identity information matches the database information exactly and the facial recognition verification is successful, the authentication is successful, a fourth authentication tag is added, and the user is allowed to continue with account operations. If a user does not receive a video call request or fails verification, the account will be locked or further verification will be required.

10. A customer authentication method for the financial industry, applied to a customer authentication system for the financial industry as described in any one of claims 1-9, characterized in that: Includes the following steps, S1. Collect user login information such as OTP, PIN code, and security question answers to establish a knowledge factor collection dataset; The knowledge factor collection dataset is then matched with the corresponding values ​​in the database. If all three match successfully, the first authentication tag is added; if any match fails, the first warning instruction is sent. S2. When a user engages in a transaction, a geolocation verification is set up to obtain the user's current geolocation and geofence status, collect the user's historical frequently used locations, and construct a location verification index Dzy. If the location verification index Dzy is greater than the distance threshold, a second warning instruction is triggered; if the location verification index Dzy is less than or equal to the distance threshold, a second authentication tag is added. S3. Collect user fingerprints to obtain fingerprint images and extract relevant features of user fingerprints to calculate the core point region distribution index Hxz and the peripheral region distribution index Wwz. Correlate the core point region distribution index Hxz and the peripheral region distribution index Wwz and perform deep calculation to obtain the fingerprint factor matching index Zwyz. If the fingerprint factor matching index Zwyz is lower than the matching threshold, trigger the third warning instruction; if the fingerprint factor matching index Zwyz is greater than or equal to the matching threshold, add the third authentication tag. S4. After a user obtains the first authentication tag, the user is allowed to log in to the financial APP to view or retrieve information. After a user obtains the second authentication tag, they are allowed to conduct transaction activities. When the transaction amount exceeds 10,000 yuan, a pop-up window will verify the user's fingerprint. After obtaining the third authentication tag, large-amount transactions are allowed. Upon receiving the first, second, and third warning instructions, the user will be repeatedly verified in the same way. If the verification fails three times in a row, the account will be locked, and the user will be required to provide the original identity document to the offline business counter for reactivation. S5. During user login and transaction processes, collect user behavior data, establish and train a risk prediction model, and extract features such as device login, transaction volume behavior, typing habits, and account change information from user behavior data to construct an abnormal behavior index Ycx. If the abnormal behavior index Ycx is higher than the abnormal behavior threshold, send a fourth warning instruction. S6. After receiving the fourth warning instruction, the management terminal sends a video call to verify identity and confirm the user's identity information and files. When the authentication is successful, a fourth authentication tag is added, and the operation is allowed to continue.

Images