WO2016107415A1

WO2016107415A1 - Auxiliary identity authentication method based on user network behavior feature

Info

Publication number: WO2016107415A1
Application number: PCT/CN2015/097581
Authority: WO
Inventors: 冯亮; 尹亚伟
Original assignee: 中国银联股份有限公司
Priority date: 2014-12-30
Filing date: 2015-12-16
Publication date: 2016-07-07
Also published as: CN105591747B; CN105591747A; TW201633197A

Abstract

The present invention provides an auxiliary identity authentication method. The method comprises: collect and analyze social networking site account data to obtain a training data set, and accordingly, construct a user identification model and train the user identification model by using the training data set as an input; before a user intends to perform an actual data exchange process with a data processing server, the data processing server performs a main identity authentication process for the user in a normal manner, and if the result of the main identity authentication process is "success", sends an auxiliary authentication request to an authentication server associated with the data processing server to trigger an auxiliary identity authentication process; and an auxiliary authentication server performs the auxiliary identity authentication process for the user based on the user identification model running on the auxiliary authentication server. The disclosed auxiliary identity authentication method has wide applicability, is convenient and effective, and has low costs.

Description

Auxiliary authentication method based on user network behavior characteristics

Technical field

The present invention relates to a secondary authentication method and, more particularly, to a secondary authentication method based on user network behavior characteristics.

Background technique

At present, with the increasing popularity of computers and network applications and the growing variety of services in different fields, it is becoming more and more necessary for the secondary authentication process (such as username and password based authentication) to authenticate users to network users. The more important.

Existing secondary authentication methods typically rely on mobile phone text messages (ie, sending a text message to the user after the primary authentication is passed, the user then transmits back a response message based on the message, thereby assisting in determining the identity of the user) or biometric (eg, user-based) Fingerprint, iris, voice, etc. assist in determining the identity of the user).

However, the existing technical solutions have the following problems: (1) The method of short message verification requires the user to carry the mobile phone with him and the environment in which he has a good wireless communication information, so the applicability is poor, and if the short message receiving delay occurs, the user may be caused. The situation of loss of aging in response to delays; (2) The way of biometric identification requires additional specific hardware and software facilities, so the cost is higher and the application is narrower.

Therefore, there is a need to provide a secondary authentication method based on user network behavior characteristics that is widely applicable, convenient, effective, and low in cost.

Summary of the invention

In order to solve the problems existing in the above prior art solutions, the present invention proposes a secondary authentication method based on user network behavior characteristics that is widely applicable, convenient, effective, and low in cost.

The object of the invention is achieved by the following technical solutions:

A secondary authentication method, the secondary authentication method comprising the following steps:

(A1) collecting and analyzing social network account data to obtain a training data set, and then constructing a user identification model and training the user identification model with the training data set as input to enable it to work normally;

(A2) before the user intends to perform an actual data interaction process with the data processing server, the data processing server performs a master identity verification process for the user in a conventional manner, and if the result of the master identity verification process is "pass", then send a secondary authentication request to the authentication server associated with it to trigger the secondary authentication process, and allow the user to perform subsequent actual data interaction processes only if the secondary authentication result is "pass";

(A3) The secondary verification server performs a secondary authentication process for the user based on the user identification model running thereon and transmits the secondary authentication result back to the data processing server.

In the solution disclosed above, preferably, analyzing the social network account data includes: (1) manually determining and marking the category of each social networking website account to classify each social networking website account as a "normal account" or a "junk account" respectively. (2) Extracting specific feature attributes of individual users using the social networking website account from the social networking website account data to form training data.

In the solution disclosed above, preferably, the user identification model is constructed based on a classifier pattern, and the user recognition model is trained based on a machine learning algorithm, wherein the user recognition model quantifies the characteristic attribute of the user by It is compared to a predetermined one or more thresholds to actually verify the identity of the user.

In the solution disclosed above, preferably, the feature attribute includes basic information of the user, social information, and social behavior information.

In the solution disclosed above, preferably, the secondary verification request includes a first user identifier of the user for the primary authentication process.

In the solution disclosed above, preferably, the step (A3) further comprises: (1) after receiving the auxiliary verification request, the verification server prompts the user to log in to a specific social networking site through a specific user interface to Obtaining social networking site account data associated with the user, wherein the user logs into the social networking site using a second user identifier; (2) if the login operation fails, the authentication server prompts the user "login failed, unable to verify And returning a verification result indicating "unable to verify" to the data processing server, if the login operation is successful, proceeding to step (3); (3) determining whether the current login is the first time of the user by querying the verification history database Logging in, and if it is the first login, associating the first user identifier with the second user identifier and recording the association in the verification history database and proceeding to step (5), if not for the first time Login, then pass Querying the verification history database to determine whether the second user identifier is consistent with an association identifier indicated in a verification record previously associated with the first user identifier, and if not, terminate the verification process and Returning a verification result indicating "verification failure" to the data processing server, if yes, proceeding to step (4); (4) determining a time difference between the last successful verification time and the current time associated with the second user identifier If the time difference does not exceed the predetermined threshold, terminate the verification process and return a verification result indicating "verification successful" to the data processing server, if the time difference exceeds a predetermined threshold, proceed to step (5); (5) obtain Social network website account data associated with the user and extracting the characteristic attribute of the user, and then calculating, by the user identification model, a probability value that the account is classified as a “normal account number”, and then the probability value is predetermined The threshold is compared and the time difference between the registration time of the account and the current time is calculated, if the probability value does not exceed the Determining a threshold and the time difference does not exceed a predetermined time threshold, recording a verification time, account information, and verification result of the current verification of the account in the verification history database and terminating the verification process and the data processing server A verification result indicating "verification successful" is returned, otherwise, the verification process is terminated and a verification result indicating "verification failure" is returned to the data processing server.

In the solution disclosed above, preferably, the step (A3) further comprises: prompting the user that the account registration time is too short if the reason for the verification failure is that the time difference between the registration time and the current time is less than the time threshold.

The auxiliary identity verification method based on user network behavior characteristics disclosed by the invention has the following advantages: wide applicability, convenience and efficiency, and low cost.

DRAWINGS

The technical features and advantages of the present invention will be better understood by those skilled in the art, in which:

1 is a flow chart of a secondary authentication method in accordance with an embodiment of the present invention.

detailed description

1 is a flow chart of a secondary authentication method in accordance with an embodiment of the present invention. As shown in FIG. 1, the auxiliary authentication method disclosed by the present invention includes the following steps: (A1) collecting and analyzing social network website (for example, Weibo website, etc.) account data to obtain a training data set, and constructing a user identification model accordingly as well as Training the user identification model with the training data set as input to enable it to function properly; (A2) before the user intends to perform an actual data interaction process with a data processing server (eg, a service provider server) The data processing server performs a primary authentication process for the user in a conventional manner, and if the result of the primary authentication process is "pass", sends a secondary authentication request to the authentication server associated therewith to trigger the secondary authentication The process, and allowing the user to perform subsequent actual data interaction processes only if the secondary authentication result is "pass"; (A3) the secondary verification server executes for the user based on the user identification model running thereon A secondary authentication process that passes the secondary authentication results back to the data processing server.

Preferably, in the auxiliary authentication method disclosed by the present invention, analyzing the social network account data includes: (1) manually determining and marking the category of each social networking website account to classify each social networking website account as a “normal account”. Or "junk account"; (2) extracting specific feature attributes of individual users who use the social networking website account from the social networking site account data to form training data.

Preferably, in the auxiliary authentication method disclosed by the present invention, the user identification model is constructed based on a classifier mode, and the user identification model is trained based on a machine learning algorithm, wherein the user identification model quantifies a user's The feature attributes are compared and compared to a predetermined one or more thresholds to actually authenticate the user.

Preferably, in the secondary authentication method disclosed by the present invention, the number of "normal account" and "junk account" included in the training data set is substantially equal. This can effectively prevent the tilt of the training data and affect the working effect of the user identification model.

Preferably, in the auxiliary authentication method disclosed by the present invention, the feature attribute includes basic information of the user (for example, whether the area is set, the value of the local setting, the gender setting, the value of the gender setting, whether the avatar is set, birthday) Whether to set, the value of the birthday setting, whether the mailbox is set, whether the occupation information is set, the number of professional experiences, whether the education information is set, the number of educations, etc.), social information (for example, the number of fans, the number of followers, and the ratio of the two) , the number of two-way friends, whether the followers are grouped, the number of groups grouped, etc.) and social behavior information (for example, the number of posts posted, the average time span of postings in a day, the percentage of blog posts with URLs, blog posts @ others The average number, the number of similar blog posts, the proportion of similar blog posts, the average number of similar blog posts, the average release time for similar posts, the average number of comments posted, and so on. Based on the feature information, the user identification model can determine and identify the type of user using the social networking website account, such as a junk account. Generally, it has the following characteristics: basic information is less filled, has a small number of fans, more followers, and the latter is much more than the former, less published blog posts and comments, or a large number of advertisements and false news in a short time.

Preferably, in the secondary authentication method disclosed by the present invention, the secondary authentication request includes a first user identifier (ie, a user ID) of the user for the primary authentication process.

Preferably, in the auxiliary authentication method disclosed by the present invention, the step (A3) further includes: (1) after receiving the auxiliary verification request, the verification server prompts the user to log in to the specific through a specific user interface. Social networking site (such as a microblogging site that has authorized the authentication server to obtain relevant social networking site account data through the user's login operation) to obtain social networking site account data associated with the user (which is socialized) The website server sends to the verification server), wherein the user logs into the social networking website using a second user identifier (ie, the user's social networking website account); (2) if the login operation fails, the authentication server prompts the user "Login failed, cannot be verified" and returns a verification result indicating "unable to verify" to the data processing server. If the login operation is successful, proceed to step (3); (3) determine the current login by querying the verification history database Whether it is the first login of the user, and if it is the first login, the first user identifier and the Decoding the second user identifier and recording the association in the verification history database and proceeding to step (5), if not logging in for the first time, determining the second user identifier by querying the verification history database Whether the association identifier indicated in the previous verification record associated with the first user identifier (ie, the previously recorded association relationship with the first user identifier) is consistent, and if not, the verification is terminated. And returning to the data processing server a verification result indicating "verification failure", if yes, proceeding to step (4); (4) determining a time and current time of the last successful verification related to the second user identifier Time difference, if the time difference does not exceed the predetermined threshold, terminate the verification process and return a verification result indicating "verification successful" to the data processing server, if the time difference exceeds a predetermined threshold, proceed to step (5); Obtaining social networking website account data associated with the user and extracting the characteristic attribute of the user, followed by The user identification model calculates a probability value that the account is classified as a "normal account number", and then compares the probability value with a predetermined threshold (which is configured by an administrator of the verification server) and calculates the registration time and current time of the account. a time difference, if the probability value does not exceed the predetermined threshold and the time difference does not exceed a predetermined time threshold (which is configured by an administrator of the authentication server), then Determining the verification time, account information, and verification result of the current verification of the account in the verification history database and terminating the verification process and returning a verification result indicating "verification successful" to the data processing server; otherwise, terminating the verification process and A verification result indicating "verification failure" is returned to the data processing server.

Preferably, in the auxiliary authentication method disclosed by the present invention, the step (A3) further includes: if the reason for the verification failure is that the time difference between the registration time and the current time is less than the time threshold, prompting the user to “account registration time” Too short."

As can be seen from the above, the auxiliary authentication method disclosed by the present invention has the following advantages: wide applicability, convenience and efficiency, and low cost.

Although the invention has been described in terms of the preferred embodiments described above, the implementation forms are not limited to the embodiments described above. It will be appreciated that various changes and modifications can be made in the present invention without departing from the spirit and scope of the invention.

Claims

A secondary authentication method, the secondary authentication method comprising the following steps:

(A1) collecting and analyzing social network account data to obtain a training data set, and then constructing a user identification model and training the user identification model with the training data set as input to enable it to work normally;

(A2) before the user intends to perform an actual data interaction process with the data processing server, the data processing server performs a master identity verification process for the user in a conventional manner, and if the result of the master identity verification process is "pass", then send a secondary authentication request to the authentication server associated with it to trigger the secondary authentication process, and allow the user to perform subsequent actual data interaction processes only if the secondary authentication result is "pass";

(A3) The secondary verification server performs a secondary authentication process for the user based on the user identification model running thereon and transmits the secondary authentication result back to the data processing server.
The auxiliary authentication method according to claim 1, wherein the analyzing the social network account data comprises: (1) manually determining and marking the category of each social networking website account to classify each social networking website account as a "normal account". Or "junk account"; (2) extracting specific feature attributes of individual users using the social networking website account from social networking website account data to form training data.
The secondary authentication method according to claim 2, wherein the user identification model is constructed based on a classifier mode, and the user identification model is trained based on a machine learning algorithm, wherein the user identification model quantifies a user The feature attribute is compared to a predetermined one or more thresholds to actually verify the identity of the user.
The secondary authentication method according to claim 3, wherein the feature attribute comprises basic information of the user, social information, and social behavior information.
The secondary authentication method according to claim 4, wherein the secondary authentication request includes a first user identifier of the user for the primary identity verification process.
The secondary authentication method according to claim 4, wherein the step (A3) further comprises: (1) after receiving the secondary verification request, the verification server passes a specific The user interface prompts the user to log in to a particular social networking site to obtain social networking site account data associated with the user, wherein the user logs into the social networking site using the second user identifier; (2) if the login operation fails, then The verification server prompts the user to "login failed, cannot be verified" and returns a verification result indicating "unable to verify" to the data processing server. If the login operation is successful, proceed to step (3); (3) verify the history by querying The database determines whether the current login is the first login of the user, and if it is the first login, associates the first user identifier with the second user identifier and records the association in the verification history database And proceeding to step (5), if not logging in for the first time, determining whether the second user identifier is associated with the verification record previously associated with the first user identifier by querying the verification history database The identifiers are consistent, if not, the verification process is terminated and returned to the data processing server The verification result indicating "verification failure", if yes, proceeds to step (4); (4) determines the time difference between the time of the last successful verification associated with the second user identifier and the current time, if the time difference does not exceed the predetermined time Threshold, then terminate the verification process and return a verification result indicating "verification successful" to the data processing server, if the time difference exceeds a predetermined threshold, proceed to step (5); (5) acquire social interaction associated with the user The website account data extracts the characteristic attribute of the user, and then calculates, by the user identification model, a probability value that the account is classified as a “normal account number”, and then compares the probability value with a predetermined threshold and calculates the The time difference between the registration time of the account and the current time. If the probability value does not exceed the predetermined threshold and the time difference does not exceed the predetermined time threshold, the verification of the current verification of the account is recorded in the verification history database. Time, account information and verification results and terminate the verification process and return an indication to the data processing server "verification Gong "verification result, otherwise, the process is terminated and authentication server to the data processing is returned indicating" verification failure "verification result.
The secondary authentication method according to claim 6, wherein the step (A3) further comprises: if the reason for the verification failure is that the time difference between the registration time and the current time is less than the time threshold, prompting the user to "account registration" Time is too short".