CN105847216A - Identity authentication method and device - Google Patents

Abstract

The present application provides an identity authentication method and device. The method includes: obtaining the password input by the user and the proficiency of the user inputting the password; and performing identity authentication on the user according to the password input by the user and the proficiency of the user inputting the password. This application combines the password input by the user and the proficiency of the password input by the user to authenticate the user at the same time, which can improve the security of the identity authentication, and at the same time no longer rely on the user's terminal equipment, making the implementation more flexible.

Description

Identity authentication method and device

【Technical field】

The present application relates to the technical field of the Internet, in particular to an identity authentication method and device.

【Background technique】

With the development of computer technology, password security has always been an important research direction in the computer field, especially in today's rapid development of the Internet, password security technologies are emerging in an endless stream.

Currently, the relatively safe encryption technology is the two-step verification method. Take Google's two-step verification method as an example. This two-step verification method first requires the user to enter the password in the password input box, and then sends a dynamic password to the mobile phone bound when the user registers, requiring the user to enter the dynamic password again. Only when the two password verifications pass, can the user be confirmed as a legitimate user and allow the user to perform corresponding operations, such as logging in.

Although the above-mentioned two-step verification method has certain improvements in password security, because the method relies on the user's mobile phone, there are certain limitations in use and is not flexible enough. For example, if the mobile phone is not with the user at the time, or due to objective reasons (such as mobile phone not Signal or power failure, etc.) cannot receive the dynamic password, resulting in the inability of legitimate users to perform identity authentication and perform corresponding operations.

【Content of invention】

Various aspects of the present application provide an identity authentication method and device, which are used to increase the flexibility of identity authentication while improving the security of identity authentication.

In one aspect of the present application, an identity authentication method is provided, including:

Obtaining the password entered by the user and the user's proficiency in entering the password;

Perform identity authentication on the user according to the password input by the user and the user's proficiency in inputting the password.

Another aspect of the present application provides an identity authentication device, including:

An acquisition module, configured to acquire the password input by the user and the user's proficiency in inputting the password;

An authentication module, configured to authenticate the user according to the password input by the user and the proficiency of the user in inputting the password.

In this application, the password entered by the user and the proficiency of the user's input password are obtained, and the user is authenticated according to the password entered by the user and the proficiency of the user's input password. Compared with the method in the prior art that only authenticates the user based on the password, the security of the identity authentication is improved due to the combination of two kinds of information; in addition, the user's proficiency in inputting the password can be improved during the process of the user inputting the password. Acquisition, through proficiency to identify whether the current password input is the user himself, to achieve user authentication, without relying on the user's terminal equipment to receive dynamic passwords, so the use is not limited by the user's terminal equipment, and has a high flexibility.

【Description of drawings】

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings that need to be used in the embodiments or the description of the prior art. Obviously, the accompanying drawings in the following description are of the present application For some embodiments, those of ordinary skill in the art can also obtain other drawings based on these drawings without paying creative efforts.

FIG. 1 is a schematic flow diagram of an identity authentication method provided by an embodiment of the present application;

Fig. 2 is a schematic structural diagram of an identity authentication device provided by an embodiment of the present application.

【detailed description】

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of this application.

FIG. 1 is a schematic flowchart of an identity authentication method provided by an embodiment of the present application. As shown in Figure 1, the method includes:

101. Obtain the password input by the user and the user's proficiency in inputting the password.

102. Perform identity authentication on the user according to the password input by the user and the proficiency of the user in inputting the password.

This embodiment provides an identity authentication method, which can be executed by an identity authentication device. The identity authentication method provided by this embodiment can be applied to various scenarios that need to verify the identity of the user, such as the login process of various application systems, the payment process based on the Internet, and the access process of network resources; correspondingly, the identity authentication device can be Clients in various systems or devices dedicated to identity authentication.

For example, when a user needs to log in to an application system, such as QQ or WeChat or Tmall or Taobao, the client of the application system provides the user with a login interface, which displays a user name input box and a password input box And a login button (or a submit button) for the user to enter a username and password. The user enters the username and password and clicks the login button or the submit button to provide the username and password to the client. At this point, the client receives the user name and password entered by the user. In this application scenario, the identity authentication device may be a client of the application system, and the client has the function of implementing corresponding services in addition to the identity authentication function.

For example, when a user needs to use an online payment service, the client of the online payment system provides the user with an online payment interface, which displays information such as payment amount, payer, password input box, verification code, and a confirmation button. Wherein, the password input box is used for the user to input a password. The user enters the password in the password input box and clicks the confirm button to provide the password to the client of the online payment system. At this time, the client terminal of the online payment system receives the password input by the user. In this application scenario, the identity authentication device may be a client of an online payment system.

Considering that the user's password may be stolen, if the user is authenticated only based on the password entered by the user, the security is low. For this reason, this embodiment provides a highly secure identity authentication method, specifically as follows:

When the user needs to be authenticated, the identity authentication device acquires the password input by the user, and at the same time acquires the user's proficiency in inputting the password. For example, the identity authentication device may provide the user with an interactive interface, on which information such as a password input box and a submit button is provided for the user to input the password required for identity authentication.

Wherein, different users generally have different levels of proficiency in inputting the same password. In particular, compared with a user who is familiar with passwords and a user who is not familiar with passwords, there will be a large difference in the proficiency of inputting passwords between the two. Users who are familiar with passwords can input passwords more smoothly and quickly; on the contrary, users who are not familiar with passwords will pause when inputting passwords, and the speed will be slower.

Based on the above analysis, in this embodiment, it can be judged whether the user entering the password is a pre-registered legal user according to the user's proficiency in inputting the password.

Afterwards, the identity authentication device performs identity authentication on the user according to the password input by the user and the user's proficiency in inputting the password.

In addition to using the password entered by the user, this embodiment also combines the information of the proficiency of the user's input password to authenticate the user, which is different from the method in the prior art that only uses one kind of information to authenticate the user. In addition, the proficiency of the user's password input can be obtained during the process of the user's password input. Through the proficiency, it can be identified whether the user who is currently entering the password is the user himself, and the authentication of the user is realized without relying on The user's terminal equipment receives the dynamic password, so the use is not limited by the user's terminal equipment, and has high flexibility.

In an optional implementation manner, the identity authentication device performs identity authentication on the user according to the password input by the user and the proficiency of the password input by the user, including:

Determine whether the password entered by the user is the same as the preset password;

If the password entered by the user is the same as the preset password, determine whether the user's proficiency in entering the password is within the preset proficiency range;

If the proficiency of the user in inputting the password is within the preset proficiency range, it is determined that the user is a legitimate user.

In the above optional implementation manner, the legal user needs to register in advance and set a password in advance. In addition, the identity authentication device also pre-sets the proficiency range of the legal user inputting the password. Specifically, the identity authentication device compares the password input by the user with the preset password; if the password input by the user is the same as the preset password, it further judges whether the proficiency of the user input password is within the preset proficiency range; if the user If the proficiency of entering the password is within the preset proficiency range, it means that the user is a legitimate user.

Optionally, when the password input by the user is different from the preset password, or the user's proficiency in entering the password is not within the preset proficiency range, it is determined that the user is an illegal user. or

Optionally, when the password entered by the user is different from the preset password, it is determined that the user is an illegal user; when the password entered by the user is the same as the preset password, but the user's proficiency in entering the password is not within the preset proficiency range , it is determined that the user is a suspicious user.

If the user's password is lost or stolen, even if the user passes the password verification, since the proficiency of entering the password is different from that of the legitimate user, the illegal user will be identified, which improves the security of identity authentication. In addition, compared with the dynamic password in the prior art, the proficiency of the user's password input only needs to be acquired during the process of the user's password input, and does not depend on the user's terminal equipment, so it is not limited by the user's terminal equipment. Has high flexibility.

In an optional implementation, considering that the more familiar the user is with the password to be entered, the faster the input speed, the user's proficiency in entering the password can be represented by the time spent on inputting a single character in the password; the shorter the time-consuming , indicating that the user's proficiency in entering the password is higher; on the contrary, it indicates that the user's proficiency in entering the password is lower.

Based on the above, a method for obtaining the user's proficiency in password input includes: monitoring the keyboard events generated during the user's password input process to obtain the number of characters included in the password and the total time consumed by the user to input the password; further, according to the user input The total time-consuming of the password and the number of characters included in the password, and the average time-consuming for the user to input a single character in the password is obtained as the proficiency of the user in entering the password. This method is relatively simple to implement and has high efficiency.

Based on the above implementation of obtaining the proficiency of the user's input password, an implementation of judging whether the user's proficiency of entering the password is within the preset range of proficiency includes:

Obtain the difference between the average time-consuming time for a user to input a single character in the password and the pre-acquired standard time-consuming;

Comparing the obtained difference with a preset threshold interval;

If the difference is within the preset threshold interval, it is determined that the user's proficiency in inputting the password is within the preset proficiency range;

If the difference is not within the preset threshold interval, it is determined that the user's proficiency in inputting the password is not within the preset proficiency range.

In the above embodiment, the preset proficiency range may be represented by a threshold interval, which is equivalent to quantifying the proficiency range, which is convenient for implementation and operation. Wherein, according to different passwords and application scenarios, the value of the threshold interval will also be different, and this embodiment does not limit the specific value of the threshold interval. For example, assuming that the threshold interval can be [0.00,0.08], then if the average time-consuming of a single character can be 0.2 seconds, the standard time-consuming is 0.15 seconds, and the difference between the average time-consuming of a single character and the standard time-consuming is 0.05 , if the difference is within the above-mentioned threshold range, it means that the user's proficiency in entering the password is within the preset proficiency range, and it can be determined that the user who entered the password is a legitimate user.

It is worth noting that before implementing the above solution, it is necessary to obtain the standard time-consuming in advance. One way to obtain the standard time consumption includes:

A learning period is set in advance. The learning period may be a specified period of time, such as 3 days, one week, one month, and so on. Alternatively, the number of times the user enters the password can also be set, such as 10 times, 20 times, etc., and the learning period can be specifically determined by the number of times the user enters the password.

During the learning period, the user will enter the password multiple times, and the maximum number of times the user enters the password is set to N, where N is a natural number greater than 1. For the i-th time when the user enters the password, the identity authentication device can obtain the average time spent on inputting a single character in the i-th password by the user within the learning period, which is denoted as S _i . For example, the identity authentication device can monitor the keyboard events generated by the user during the ith password input process in the learning cycle, so as to obtain the number of characters included in the password and the total time consumed by the user to input the password for the ith time; The total time-consuming of the password and the number of characters included in the password, and the average time-consuming for the i-th input of a single character in the password by the user. Wherein, i=1, 2, . . . , N. In this way, the identity authentication device can obtain the average time-consuming of each input of a single character in the password by the user within the preset learning period, which is a total of N average time-consuming; then the standard deviation of the obtained N average time-consuming can be calculated to obtain Time consuming by the above standards. The calculation method of the standard deviation is as follows:

For N average time-consuming, calculate the average value E=(S ₁ +S ₂ +...+S _N )/N;

According to the formula (Σ(S _i E) ² /N) ^1/2 , the standard deviation SS is calculated.

Based on the above implementations, in order to further improve the security of identity authentication, and at the same time reduce the probability of misjudgment (that is, reduce the probability that a legal user is judged as an illegal user), when the password entered by the user is the same as the preset password, but When the proficiency of the user's password input is not within the preset proficiency range, it can be judged as a suspected illegal user (that is, a suspicious user) instead of being directly judged as an illegal user. In this way, the user can be further verified according to the verification code entered by the user. Authentication. The verification code can be a dynamic password in the prior art.

Specifically, when it is determined that the password entered by the user is the same as the preset password, but the user's proficiency in entering the password is not within the preset proficiency range, the identity authentication device may send a verification code to the terminal device bound to the user name in advance , and provide the user with a verification code input interface for the user to input the received verification code, so as to further authenticate the user through the verification code.

Specifically, the identity authentication device can compare the verification code input by the user with the verification code sent to the user; if the two are the same, it is determined that the user is a legitimate user; if the two are not the same, it is determined that the user is an illegal user.

For the user, if it is a legal user, it can obtain a verification code from its terminal equipment and provide it to the identity authentication device; if it is an illegal user, it cannot obtain the verification code, so that it cannot pass the identity authentication.

In the above embodiment, the proficiency of the user's password input is combined with the two-step verification method. First, based on the proficiency of the user's password input, it is judged whether the password input is the user who registered the password. If it is determined that the user is the user who registered the password, then There is no need to start the second step in the two-step authentication method, and it can avoid the restrictions on user terminal equipment on the basis of ensuring the security of identity authentication, which has greater flexibility; if it is determined that the user is suspicious, then start the two-step authentication method In the second step, it is beneficial to minimize the probability of misjudgment on the basis of ensuring the security of identity authentication. It is worth noting that, generally speaking, the password is the most critical data for a user, and the time-consuming input by the user is within a certain range. The probability of enabling the second-step verification is extremely low, which reduces the dependence on the user's terminal equipment. The method is more flexible in implementation.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence. Depending on the application, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by this application.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

Fig. 2 is a schematic structural diagram of an identity authentication device provided by an embodiment of the present application. As shown in FIG. 2 , the device includes: an acquisition module 21 and an authentication module 22 .

The acquiring module 21 is configured to acquire the password input by the user and the user's proficiency in inputting the password.

The authentication module 22 is configured to authenticate the identity of the user according to the password input by the user acquired by the acquisition module 21 and the proficiency of the password input by the user.

In an optional embodiment, the authentication module is specifically used to: determine whether the password input by the user is the same as the preset password; within the proficiency range; if the user's proficiency in entering the password is within the preset proficiency range, it is determined that the user is a legitimate user.

The authentication module is also used to determine that the user is an illegal user if the password input by the user is not the same as the preset password, or the user's proficiency in inputting the password is not within the preset proficiency range. or

The authentication module is also used to: when the password entered by the user is different from the preset password, determine that the user is an illegal user; when the password entered by the user is the same as the preset password, but the user's proficiency in entering the password is not higher than the preset proficiency When it is within the range, it is determined that the user is a suspicious user.

Further, the authentication module is also used for: when the user belongs to a suspicious user, continue to verify the identity of the user according to the verification code input by the user.

In an optional embodiment, the obtaining module 21 is specifically used to: monitor the keyboard events generated during the process of user inputting the password, so as to obtain the number of characters included in the password and the total time-consuming for the user to input the password; The time and the number of characters included in the password, and the average time consumed by the user to input a single character in the password is obtained as the user's proficiency in entering the password.

Based on the scheme that the above-mentioned acquisition module 21 acquires the proficiency of the user's input password, the authentication module 22 is used to judge whether the user's proficiency of the password input is within the preset proficiency range, specifically:

Obtain the difference between the average time-consuming of a single character in the user's input password and the pre-acquired standard time-consuming; if the difference is within the preset threshold range, it is determined that the user's proficiency in entering the password is within the preset proficiency range; if the difference is If it is not within the preset threshold interval, it is determined that the user's proficiency in inputting the password is not within the preset proficiency range.

Further, the obtaining module 21 is also used to pre-acquire the standard time-consuming, specifically: obtaining the average time-consuming of the i-th input of a single character in the password by the user within the preset learning period, i=1, 2, ..., N, N is The maximum number of times the user enters the password during the learning period, N is a natural number greater than 1; calculate the standard deviation of the average time-consuming of the obtained N, and use it as the standard time-consuming.

The identity authentication device provided in this embodiment obtains the password input by the user and the proficiency of the user input password, and at the same time performs identity authentication on the user according to the password input by the user and the proficiency of the user input password. Since the identity authentication device provided in this embodiment combines two types of information to authenticate the user at the same time, the security of the identity authentication is improved; in addition, the proficiency of the user's password input can be acquired during the process of the user's password input. It can identify whether the current password input is the user himself, realize the authentication of the user, and do not need to rely on the user's terminal equipment to receive the dynamic password, so the use is not limited by the user's terminal equipment, and has high flexibility.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above-mentioned integrated units implemented in the form of software functional units may be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium, and include several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) or a processor (processor) execute the methods described in various embodiments of the present application. partial steps. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other various media that can store program codes. .

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limiting them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present application.

Claims (14)

1. an identity identifying method, it is characterised in that including:

The password of acquisition user's input and described user input the proficiency of described password；

The password inputted according to described user and described user input the proficiency of described password, to described user Carry out authentication.

Method the most according to claim 1, it is characterised in that described according to described user input close Code and described user input the proficiency of described password, and described user is carried out authentication, including:

Judge that the password that described user inputs is the most identical with the password preset；

If the password of described user input is identical with the password preset, it is judged that described user inputs described password Whether proficiency is in the range of default proficiency；

If described user inputs the proficiency of described password in the range of default proficiency, determine that described user belongs to In validated user.

Method the most according to claim 2, it is characterised in that the described user of described acquisition inputs described The proficiency of password, including:

Monitor described user and input the KeyEvent produced in described cryptographic processes, include obtaining described password Character number and described user input the total time-consuming of described password；

The character number that the most time-consuming and described password of described password includes is inputted, it is thus achieved that institute according to described user State user and input the average time-consuming to input the ripe of described password as described user of single character in described password White silk degree.

Method the most according to claim 3, it is characterised in that the described user of described judgement inputs described The proficiency of password whether in the range of default proficiency, including:

Obtain described user and input the average the most time-consuming with the standard obtained in advance of single character in described password Difference；

If described difference is in default threshold interval, determine that described user inputs the proficiency of described password and exists In the range of described default proficiency；

If described difference is not at default threshold interval, determine that described user inputs the proficiency of described password not In the range of described default proficiency.

Method the most according to claim 4, it is characterised in that described to obtain described standard in advance time-consuming, Including:

Obtain described user i & lt in default learning cycle and input the average consumption of single character in described password Time, i is the natural number less than N, and N is the maximum times that user inputs described password in described learning cycle；

Calculate the N number of the most time-consuming standard deviation of described acquisition, using time-consuming as described standard.

6. according to the method described in any one of claim 2-5, it is characterised in that also include:

If the password of described user input differs with the password preset, determine that described user belongs to non-legally and uses Family；

If the password of described user input is identical with the password preset, but described user inputs the ripe of described password White silk degree, not in the range of default proficiency, determines that described user belongs to suspicious user.

Method the most according to claim 6, it is characterised in that also include:

If it is determined that described user belongs to suspicious user, then continue the identifying code inputted according to described user, to institute State user and carry out authentication.

8. an identification authentication system, it is characterised in that including:

Acquisition module, the password and described user for obtaining user's input inputs the proficiency of described password；

Authentication module, inputs the skilled of described password for password and the described user inputted according to described user Degree, carries out authentication to described user.

Device the most according to claim 8, it is characterised in that described authentication module specifically for:

Judge that the password that described user inputs is the most identical with the password preset；

If the password of described user input is identical with the password preset, it is judged that described user inputs described password Whether proficiency is in the range of default proficiency；

If described user inputs the proficiency of described password in the range of default proficiency, determine that described user belongs to In validated user.

Device the most according to claim 9, it is characterised in that described acquisition module specifically for:

Monitor described user and input the KeyEvent produced in described cryptographic processes, include obtaining described password Character number and described user input the total time-consuming of described password；

The character number that the most time-consuming and described password of described password includes is inputted, it is thus achieved that institute according to described user State user and input the average time-consuming to input the ripe of described password as described user of single character in described password White silk degree.

11. devices according to claim 10, it is characterised in that described authentication module specifically for:

Obtain described user and input the average the most time-consuming with the standard obtained in advance of single character in described password Difference；

If described difference is at default threshold interval, determine that described user inputs the proficiency of described password in institute In the range of stating default proficiency；

If described difference is not at default threshold interval, determine that described user inputs the proficiency of described password not In the range of described default proficiency.

12. devices according to claim 11, it is characterised in that described acquisition module is additionally operable to:

Obtain described user i & lt in default learning cycle and input the average consumption of single character in described password Time, i=1,2 ..., N, N are the maximum times that user inputs described password in described learning cycle, and N is Natural number more than 1；

Calculate the N number of the most time-consuming standard deviation of described acquisition, using time-consuming as described standard.

13. according to the device described in any one of claim 9-12, it is characterised in that described authentication module is also For:

When the password that described user inputs differs with the password preset, determine that described user belongs to non-legally User；

The password inputted described user is identical with the password preset, but described user inputs the ripe of described password When white silk degree is not in the range of default proficiency, determine that described user belongs to suspicious user.

14. devices according to claim 13, it is characterised in that described authentication module is additionally operable to:

When described user belongs to suspicious user, continue the identifying code inputted according to described user, to described use Family carries out authentication.