CN105022939A

CN105022939A - Information verification method and device

Info

Publication number: CN105022939A
Application number: CN201410173229.5A
Authority: CN
Inventors: 刘金星
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd; Tencent Cloud Computing Beijing Co Ltd
Priority date: 2014-04-25
Filing date: 2014-04-25
Publication date: 2015-11-04
Anticipated expiration: 2034-04-25
Also published as: CN105022939B

Abstract

The invention discloses an information verification method and an information verification device. According to the embodiment, the method allows the use of information corresponding to different access accounts owned by the same natural person user based on an intermediate account for the same application, and has the beneficial effects of intelligently reading the information of the main account through the intermediate account, so that the purpose that the server is capable of reading attribute information of different access accounts registered by the same natural person user for the same application is achieved. The method and the device of the invention omit the tedious verification process of executing the additional safety verification strategy needed by the server when the same user accesses the same application based on affiliated accounts bounded with the main account, thereby saving the processing time of the server, reducing the performance loss of the server and improving the human-machine interaction.

Description

Information Authentication method and device

Technical field

The present invention relates to internet arena, particularly relate to a kind of Information Authentication method and device.

Background technology

Along with internet popularizing in people's work and life, under normal circumstances, corresponding to the social software of same application such as client, game application, webpage version application program (as the game of webpage version) etc., a user may have multiple access account number simultaneously; But there is not any association in service end in these attribute informations of accessing accounts corresponding, therefore, even same user, utilize different access accounts when conducting interviews to above-mentioned application program, the security strategy of enjoyment is also different, is unfavorable for man-machine interaction; And for user side, also had a strong impact on Consumer's Experience.

Such as some game, a user, except registering a main extra, also may apply for that multiple game trumpet is used for task of doing, brush copy etc.Owing to being independently each other between these accounts, although so these accounts belong to same user, but still cannot share each account that this user has distinguish corresponding attribute information, therefore small sizely can not to enjoy and main number equal security strategy treatment; Such as, when user logs in this game application based on trumpet, for security consideration, whether the trumpet providing the loaded down with trivial details proving program of the add-on security verifications such as identifying code to carry out authentication of users login is legal logging in by server, thus is unfavorable for man-machine interaction.

Summary of the invention

In view of above content, be necessary to provide a kind of Information Authentication method and device, the problem can not shared with the attribute information of settlement server to the different access account that same natural person user registers based on same application.

The embodiment of the invention discloses a kind of Information Authentication method, comprise the following steps:

Receive the triggering command of user terminal based on access account access one application, search and access historical data corresponding to described application based on described access account;

According to the described historical data of searching, identify described access account and do not meet default access rule, then search the middle account whether existing and map with described access account;

If there is the middle account mapped with described access account, then search the associated account number be associated with described middle account, and obtain relating attribute information corresponding to described associated account number;

Described relating attribute information is set to access attribute information corresponding to described access account, and by secure access strategy setting corresponding for described relating attribute information for checking described access account accesses the secure access strategy that described application adopts;

Based on the legitimacy of accessing account described in secure access policy validation described in described access attribute Information Pull.

The embodiment of the present invention also discloses a kind of Information Authentication device, comprising:

Data obtaining module, for:

Receive the triggering command of user terminal based on access account access one application, search and access historical data corresponding to described application based on described access account; According to the described historical data of searching, identify described access account and do not meet default access rule, then search the middle account whether existing and map with described access account; If there is the middle account mapped with described access account, then search the associated account number be associated with described middle account, and obtain relating attribute information corresponding to described associated account number;

Information sharing module, for:

Information authentication module, for based on the legitimacy of accessing account described in secure access policy validation described in described access attribute Information Pull.

The method of the different access account corresponding informance that the embodiment of the present invention uses same natural person user to have for same application based on middle account, be there is the beneficial effect being read master's information by middle account intelligence, reach the object of the attribute information between different access account that server can use same natural person user to register based on same application; Eliminate server and based on the main number trumpet bound, the loaded down with trivial details proof procedure of the add-on security authentication policy performed required for same application is accessed to same user, save the processing time of server, reduce the performance loss of server, improve man-machine interaction.

Accompanying drawing explanation

Fig. 1 is Information Authentication method of the present invention and device one embodiment running environment schematic diagram;

Fig. 2 is Information Authentication method first embodiment schematic flow sheet of the present invention;

Fig. 3 is in Information Authentication method of the present invention, identifies access account do not meet default access rule one embodiment schematic flow sheet according to the historical data of searching;

Fig. 4 is Information Authentication method second embodiment schematic flow sheet of the present invention;

Fig. 5 is Information Authentication method the 3rd embodiment schematic flow sheet of the present invention;

Fig. 6 accesses account and middle account corresponding relation one embodiment schematic diagram in Information Authentication method of the present invention;

Fig. 7 is Information Authentication device first embodiment high-level schematic functional block diagram of the present invention;

Fig. 8 is Information Authentication device second embodiment high-level schematic functional block diagram of the present invention;

Fig. 9 is Information Authentication device the 3rd embodiment high-level schematic functional block diagram of the present invention;

Figure 10 is Information Authentication device one embodiment hardware structure schematic diagram of the present invention.

The realization of embodiment of the present invention object, functional characteristics and advantage will in conjunction with the embodiments, are described further with reference to accompanying drawing.

Embodiment

Technical scheme of the present invention is further illustrated below in conjunction with Figure of description and specific embodiment.Should be appreciated that specific embodiment described herein only in order to explain the present invention, be not intended to limit the present invention.

In the following embodiment of Information Authentication method of the present invention and device, described middle account can be understood as the account of a unique identification nature person user, and using this middle account as related information, the different access account that the same application of access associating above-mentioned same natural person user registration uses; Namely by this middle account, the secure access strategy that when all access accounts that the same application of access that same natural person user registers uses can be shared each self-corresponding access attribute information and access this application program, server adopts.Wherein, described same application comprises same application and same webpage, and such as identical instant messaging application program, identical game application program and same webpage, subsequent embodiment will repeat no more.

As shown in Figure 1, terminal 100 and terminal 200 carry out data interaction based on internet and server 300, such as, user's methyl in terminal 100 access services device 300, and the user interface provided at server 300 have registered an access account A, and using this access account A as main number by terminal 100 or terminal 200 often access application X, the historical operation record of server 300 record access account A access application X also stores corresponding historical data, server 300 is that access account A sets up corresponding middle account a simultaneously, and the mapping relations between memory access account A and middle account a, then when user's methyl is in terminal 100 or terminal 200 new registration one access account B, the access attribute information that the access account B that registers based on user's first of server 300 is corresponding, identify this access account B and belong to access account corresponding to same natural person with access account A, then server 300 sets up the mapping relations of this access account B and middle account a, when server 300 detect terminal 100 or terminal 200 based on access account B first access application X time, server 300 finds this access account B and there is middle account a, and this middle account a is associated with access account A, then server 300 obtains access attribute information corresponding to access account A, and make to access the access attribute information that account B uses this access account A, and adopt the register of the secure access policy validation access account B access application X of authentication-access account A, and no longer issue loaded down with trivial details additional identification program as issued the legitimacy of the accessing operation of the authentication-access account B access application X such as identifying code for access account B, save the data processing resources of server 300, the convenience of Information Authentication is improve while assuring data security, also improve man-machine interaction, for user side, improve Consumer's Experience.

Embodiments provide a kind of Information Authentication method first embodiment, as shown in Figure 2, Information Authentication method of the present invention comprises:

Step S01, receive the triggering command of user terminal based on access account access one application, search and access historical data corresponding to described application based on described access account;

When server receive user terminal based on access account access one of them application triggering command time, the above-mentioned triggering command that server response user terminal sends, search the historical data of accessing above-mentioned application correspondence based on this access account, such as based on IP address corresponding during this application of access of this access account the last time, the last this application of access continue access duration, in preset duration (within such as one week or within one month) access total degree and each corresponding access duration of this application and access the historical datas such as IP address.

Such as, server receive user terminal based on login account as No. QQ and this instant messaging application program of QQ password login QQ time, the history access record that this user terminal of whois lookup is corresponding when logging in QQ based on above-mentioned QQ number, login time when obtaining last login QQ corresponding to this QQ number, log in after operation duration, log in after performed Action Events, the historical data such as corresponding IP address and MAC Address when logging in.

The described historical data that step S02, basis are searched, identifies described access account and does not meet default access rule, then search the middle account whether existing and map with described access account;

Server accesses the historical data of above-mentioned application correspondence according to this access account found, and identifies whether this access account meets default access rule; Such as identify whether this access account is access this application first, or whether this access account is in this application of access of non-common area, or this access account whether in preset duration (in such as 10 minutes) repeatedly attempt accessing above-mentioned application etc. based on different IP addresses.When identifying above-mentioned access account and not meeting default access rule, such as above-mentioned access account accesses this application first, or this access account is in this application of access of non-common area, or this account repeatedly attempted accessing above-mentioned application etc. based on different IP addresses in 10 minutes, then whether store the middle account mapped with this access account in whois lookup database.

In the present embodiment, described middle account can be understood as this access account, and other access the related information that account is associated with same application; By the middle account that this access account is corresponding, can find that account middle with this map other be associated with this access account other access account.

In the embodiment of the present invention one preferred embodiment, server, according to the described historical data of searching, identifies described access account and does not meet default access rule, comprising:

Server obtains user terminal the accesses above-mentioned application program IP address corresponding to triggering command and/or MAC Address based on described access account; Access in historical data corresponding to above-mentioned application program in this access account obtained, search above-mentioned IP address and/or whether MAC Address exists; If server can not find this access account and accesses the IP address and/or MAC Address that above-mentioned application program uses in described historical data, then identify this access account and do not meet default access rule.

If step S03 exists the middle account mapped with described access account, then search the associated account number be associated with described middle account, and obtain relating attribute information corresponding to described associated account number;

When there is to this access account the middle account mapped with this access account in whois lookup, whois lookup and this middle account relating same can access this application program other access account, i.e. the associated account number that is associated of this middle account; When middle account exists the associated account number be associated with this middle account, server obtains relating attribute information corresponding to above-mentioned each associated account number; Wherein, the relating attribute information that associated account number is corresponding also can be understood as the corresponding access attribute information of above-mentioned associated account number.

When there is to this access account the middle account mapped with this account in whois lookup, but when not finding the associated account number of middle account relating with this, also just say, in the middle of server, the middle account mapped with this access account is only accessed account with this and is established mapping relations, then server directly obtains access attribute information corresponding to this middle account.

Step S04, be access attribute information corresponding to described access account by described relating attribute information sharing, and by secure access Policies sharing corresponding for described relating attribute information for described access account accesses the secure access strategy that described application adopts;

Step S05, based on the legitimacy of accessing account described in secure access policy validation described in described access attribute Information Pull.

The relating attribute information of associated account number corresponding for the above-mentioned middle account obtained is set to access attribute information corresponding to this access account by server, simultaneously, by secure access strategy setting corresponding for above-mentioned relating attribute information for this access account of checking accesses the secure access strategy that above-mentioned application adopts, and based on the above-mentioned access attribute information shared, utilize above-mentioned shared secure access strategy, verify that above-mentioned access account accesses the legitimacy of above-mentioned application, thus save and adopt add-on security authentication policy such as to issue identifying code, the safety verification strategy that the authorization information etc. that controlling user terminal provides other extra is added is to verify that this access account accesses the legitimacy of above-mentioned application.

The embodiment of the present invention receive user based on access account access one application triggering command time, search this access account and access historical data corresponding to above-mentioned application program; Based on above-mentioned historical data, identify described access account and do not meet default access rule, and find the middle account existing and map with described access account, and the associated account number by being associated with described middle account, obtain the relating attribute information that above-mentioned associated account number is corresponding; Described relating attribute information is set to access attribute information corresponding to described access account, and by secure access strategy setting corresponding for described relating attribute information for checking described access account accesses the secure access strategy that described application adopts; Based on the legitimacy of accessing account described in secure access policy validation described in described access attribute Information Pull; Compared in prior art, even if when same natural person user adopts main number jointly to access same application with trumpet, server still adopts additional safety verification strategy to verify the legitimacy of this access of above-mentioned access account to above-mentioned trumpet, the embodiment of the present invention has the beneficial effect being read master's information by middle account intelligence, reaches the object of the attribute information between different access account that server can use same natural person user to register based on same application; Eliminate server and based on the main number trumpet bound, the loaded down with trivial details proof procedure of the add-on security authentication policy performed required for same application is accessed to same user.

The embodiment of the present invention also provides and identifies access account according to the historical data of searching in a kind of Information Authentication method and do not meet default access rule one embodiment; The present embodiment is further describing of carrying out the step " S02, according to the described historical data of searching, identify described access account and do not meet default access rule " in embodiment described in Fig. 2.

Based on the description of embodiment described in Fig. 2, as shown in Figure 3, identify access account according to the historical data of searching in Information Authentication method of the present invention and do not meet default access rule, comprising:

Step S11, according to described historical data, search the access times of accessing described application in preset duration based on described access account;

Step S12, identify whether described access times are less than first threshold; If so, then step S13 is performed; If not, then step S14 is performed;

Step S13, identify described access account and do not meet default access rule;

Server accesses the historical data of above-mentioned application correspondence according to the described access account found, search in preset duration (in such as one month or in one week) and access the total access times of described application based on above-mentioned access account, identify whether above-mentioned access times are less than first threshold; In the present embodiment, described first threshold can be determined by the access frequency of server according to the different access account of the above-mentioned application of access, or determined according to history access record corresponding to the legitimate verification of each access account of the above-mentioned application correspondence of access or historical data by server, or the instruction that arranges triggered in user side according to technician by server obtains above-mentioned first threshold; The present embodiment does not limit the obtain manner of first threshold and concrete numerical value.

Server is according to the described historical data obtained, and identifying the described access times of accessing described application corresponding based on described access account in preset duration is be less than first threshold, then identify above-mentioned access account and do not meet default access rule.

Step S14, obtain the respectively corresponding each access duration of described access times, identify whether the quantity that access duration exceedes preset duration is less than Second Threshold;

When the quantity that described access duration exceedes preset duration is less than Second Threshold, performs step S13, identify described access account and do not meet default access rule;

When the quantity that described access duration exceedes preset duration is more than or equal to described Second Threshold, perform step S15;

Step S15, identify described access account and meet default access rule.

At server according to the described historical data obtained, identify when being more than or equal to first threshold based on the described access times that the described application of described access account access is corresponding in preset duration, server obtains the access duration of above-mentioned access times each this application of access corresponding respectively, and whether the quantity that acquisition access duration exceedes preset duration is less than Second Threshold; Described preset duration is similar to confirming the mode of first threshold with the validation testing of Second Threshold, described preset duration and Second Threshold can be determined by the access frequency of server according to the different access account of the above-mentioned application of access, or determined according to history access record corresponding to the legitimate verification of each access account of the above-mentioned application correspondence of access or historical data by server, or the instruction that arranges triggered in user side according to technician by server obtains above-mentioned preset duration and Second Threshold; The present embodiment does not limit the obtain manner of preset duration and Second Threshold and concrete numerical value.

Such as, each access duration that the above-mentioned access times N that server obtains is corresponding is respectively M1 ~ Mn, whether the quantity Nx that then server identification N number of access duration M1 ~ Mn exceedes preset duration M0 is less than Second Threshold N0, when the quantity Nx that described access duration M1 ~ Mn exceedes preset duration M0 is less than Second Threshold N0, server identifies described access account and does not meet default access rule; When the quantity Nx that described access duration M1 ~ Mn exceedes preset duration M0 is more than or equal to Second Threshold N0, server identifies described access account and meets default access rule.

The embodiment of the present invention accesses the access frequency of described application according to the historical data identification obtained based on described access account and access duration corresponding to each this application program of access identifies that described access account does not meet the mode of default access rule, improves the convenience of server identification.

The embodiment of the present invention additionally provides a kind of Information Authentication method second embodiment; The difference of embodiment described in the embodiment of the present invention and Fig. 2 is, when identifying this access account and there is not corresponding middle account, for this access account creates a middle account.

Based on the description of embodiment described in Fig. 2 and Fig. 3, as shown in Figure 4, Information Authentication method of the present invention " step S02, according to the described historical data of searching; identify described access account and do not meet default access rule; then search the middle account whether existing and map with described access account, also comprise afterwards:

If step S20 does not exist the middle account mapped with described access account, then create the middle account uniquely mapped with described access account, and described middle account shares access attribute information corresponding to described access account.

Server is according to the historical data of searching, identify this access account when not meeting default access rule and search the middle account not existing and map with this access account, the middle account that the access attribute information creating one that server is corresponding according to this access account uniquely maps with this access account, and this middle account can share access attribute information corresponding to this access account, that is, after this access account and this middle account are bound, by this middle account, server can get access attribute information corresponding to all access accounts that account middle with this bind and respectively access the historical data that this application of access corresponding to account produces.

When server is after above-mentioned access account creates a middle account, identify exist when accessing account B with related other of above-mentioned access account A if server is follow-up, according to the incidence relation of access account B and above-mentioned access account A, above-mentioned access account B also can bind with middle account corresponding to access account A by server, and server can be shared access attribute information corresponding to each access account with identical middle account and respectively access relevant information corresponding to the above-mentioned access accounts such as secure access strategy corresponding to account.

The embodiment of the present invention is that the access account that there is not middle account creates corresponding middle account, improves the intelligent of information sharing.

The embodiment of the present invention additionally provides Information Authentication method the 3rd embodiment; The difference of embodiment described in the present embodiment and Fig. 4 is, server is that access account is pre-created corresponding middle account.

Based on the description of embodiment described in Fig. 2, Fig. 3 and Fig. 4, as shown in Figure 5, Information Authentication method of the present invention also comprises before " step S01, reception user terminal access a triggering command applied based on access account, search and apply corresponding historical data based on described access account access is described ":

Step S10, set up the mapping relations of each access account corresponding to described application and middle account;

In the present embodiment, server, according to the incidence relation between each access account of same application correspondence, is set up the mapping relations of each access account and middle account and stores; Wherein, during mapping relations between the above-mentioned access account that server is set up and corresponding middle account, a unique corresponding middle account of access account, but middle account can corresponding one or more access account, as shown in Figure 6, each access account is associated by middle account; And server is when the legitimacy of account is accessed in checking one, can share each access account that the middle account identical with this access account map distinguish corresponding access attribute information, secure access strategy and corresponding historical data.

In a preferred embodiment, server sets up the mapping relations of each access account corresponding to described application and middle account, can in the following way:

Server obtains all access accounts of described application correspondence and respectively accesses access attribute information corresponding to account, and obtains the historical data of user based on the described application correspondence of each access account access; According to the described access attribute information obtained and historical data, calculate the relating value between each access account; The access account being greater than default correlation threshold for described relating value sets up same middle account; Wherein, access attribute information corresponding to described access account and secure access strategy corresponding to described access attribute information is shared between each access account that described middle account is identical.

Such as, server obtains all login accounts corresponding to a certain network game software-network game A and access attribute information corresponding to each login account, such as user's pet name, the phone number bound with network game account or the access attribute such as email address, age of user information; Based on above-mentioned login account, obtain user and log in historical data corresponding to above-mentioned network game A based on each login account, such as conventional entry address, conventional login IP address, login time section, login duration etc.; According to the above-mentioned access attribute information obtained and historical data, server calculates the relating value between each access account; Such as, whether whether identical, the conventional login MAC Address in whether identical, the conventional login IP address of conventional entry address is identical, whether login time section is consistent, and using above-mentioned information as relevant parameter, and be that above-mentioned each relevant parameter gives certain weighted value respectively according to the significance level of each relevant parameter, according to above-mentioned relevant parameter and weighted value corresponding to each relevant parameter, calculate the relating value that above-mentioned login account is corresponding; Same middle account is set up for described relating value is greater than a login account presetting correlation threshold; And between each access account having an identical middle account, share the secure access strategy of access attribute information and the correspondence corresponded to each other.

In an alternative embodiment of the invention, server sets up the mapping relations of each access account corresponding to described application and middle account, can also in the following way:

Server obtains the characteristic identity information of each access account corresponding to described application and unique sign nature person user corresponding to described access account; The described access account identical for described characteristic identity information sets up same middle account; Access attribute information corresponding to described access account and secure access strategy corresponding to described access attribute information is shared between each access account that described middle account is identical.Such as, server obtains each access account of above-mentioned application correspondence and each characteristic identity identity information of accessing unique sign nature person user corresponding to account, such as Chinese user, obtain the ID (identity number) card No. of binding when above-mentioned user registers access account, then access account identical for ID (identity number) card No. is created same middle account by server; Or, server obtains ID (identity number) card No. first corresponding to an access account a logged in first, then whois lookup had logged in ID (identity number) card No. corresponding to each access account of above-mentioned application correspondence, identified whether to exist the middle account identical with above-mentioned ID (identity number) card No. first or middle account corresponding to identical access account b and this access account b; If exist, then above-mentioned access account a directly binds with corresponding middle account by server, sets up the mapping relations of access account a and above-mentioned middle account.

It is that the information that follow-up server shares identical access account corresponding provides important evidence that embodiment of the present invention server sets up each access account corresponding to same application and the mapping relations of middle account, save the processing time of server, reduce the performance loss of server, improve man-machine interaction; To user side, owing to there will not be loaded down with trivial details add-on security proving program, therefore in verification process program, improve Consumer's Experience.

The embodiment of the present invention additionally provides Information Authentication device first embodiment; As shown in Figure 7, Information Authentication device of the present invention comprises: data obtaining module 01, information sharing module 02 and information authentication module 03.

Data obtaining module 01, for: receive the triggering command of user terminal based on access account access one application, search and access historical data corresponding to described application based on described access account; According to the described historical data of searching, identify described access account and do not meet default access rule, then search the middle account whether existing and map with described access account; If there is the middle account mapped with described access account, then search the associated account number be associated with described middle account, and obtain relating attribute information corresponding to described associated account number;

When the data obtaining module 01 of server receive user terminal access the triggering command of one of them application based on access account time, data obtaining module 01 responds the above-mentioned triggering command that user terminal sends, search the historical data of accessing above-mentioned application correspondence based on this access account, such as based on IP address corresponding during this access account the last time this application of access, the last this application of access the access duration that continues, in preset duration, (within such as one week or within one month) accesses total degree and the historical data such as each corresponding access duration and access IP address of this application.

Such as, data obtaining module 01 receive user terminal based on login account as No. QQ and this instant messaging application program of QQ password login QQ time, data obtaining module 01 searches history access record corresponding when this user terminal logs in QQ based on above-mentioned QQ number, login time when obtaining last login QQ corresponding to this QQ number, log in after operation duration, log in after performed Action Events, the historical data such as corresponding IP address and MAC Address when logging in.

Data obtaining module 01 accesses the historical data of above-mentioned application correspondence according to this access account found, and identifies whether this access account meets default access rule; Such as identify whether this access account is access this application first, or whether this access account is in this application of access of non-common area, or this access account whether in preset duration (in such as 10 minutes) repeatedly attempt accessing above-mentioned application etc. based on different IP addresses.When identifying above-mentioned access account and not meeting default access rule, such as above-mentioned access account accesses this application first, or this access account is in this application of access of non-common area, or this account repeatedly attempted accessing above-mentioned application etc. based on different IP addresses in 10 minutes, then data obtaining module 01 searches in database the middle account whether storing and map with this access account.

In the embodiment of the present invention one preferred embodiment, data obtaining module 01, according to the described historical data of searching, identifies described access account and does not meet default access rule, comprising:

Data obtaining module 01 obtains user terminal the accesses above-mentioned application program IP address corresponding to triggering command and/or MAC Address based on described access account; Access in historical data corresponding to above-mentioned application program in this access account obtained, search above-mentioned IP address and/or whether MAC Address exists; If data obtaining module 01 can not find this access account and accesses the IP address and/or MAC Address that above-mentioned application program uses in described historical data, then identify this access account and do not meet default access rule.

When data obtaining module 01 finds the middle account that this access account exists and this access account maps, data obtaining module 01 search account relating middle with this same can access this application program other access account, i.e. the associated account number that is associated of this middle account; When middle account exists the associated account number be associated with this middle account, data obtaining module 01 obtains relating attribute information corresponding to above-mentioned each associated account number; Wherein, the relating attribute information that associated account number is corresponding also can be understood as the corresponding access attribute information of above-mentioned associated account number.

When data obtaining module 01 finds the middle account that this access account exists and this account maps, but when not finding the associated account number of middle account relating with this, also just say, in the middle of server, the middle account mapped with this access account is only accessed account with this and is established mapping relations, then data obtaining module 01 directly obtains access attribute information corresponding to this middle account.

Information sharing module 02, for: described relating attribute information is set to access attribute information corresponding to described access account, and by secure access strategy setting corresponding for described relating attribute information for checking described access account accesses the secure access strategy that described application adopts;

Information authentication module 03, for: based on the legitimacy of accessing account described in secure access policy validation described in described access attribute Information Pull.

The relating attribute information of associated account number corresponding for the above-mentioned middle account obtained is set to access attribute information corresponding to this access account by information sharing module 02, meanwhile, by secure access strategy setting corresponding for above-mentioned relating attribute information for this access account of checking accesses the secure access strategy that above-mentioned application adopts; Information authentication module 03 is based on the above-mentioned access attribute information shared, utilize above-mentioned shared secure access strategy, verify that above-mentioned access account accesses the legitimacy of above-mentioned application, thus save and adopt add-on security authentication policy such as to issue identifying code, control the additional safety verification strategy such as the authorization information that user terminal provides other extra to verify that this access account accesses the legitimacy of above-mentioned application.

The embodiment of the present invention receive user based on access account access one application triggering command time, search this access account and access historical data corresponding to above-mentioned application program; Based on above-mentioned historical data, identify described access account and do not meet default access rule, and find the middle account existing and map with described access account, and the associated account number by being associated with described middle account, obtain the relating attribute information that above-mentioned associated account number is corresponding; Be access attribute information corresponding to described access account by described relating attribute information sharing, and by secure access Policies sharing corresponding for described relating attribute information for checking described access account accesses the secure access strategy that described application adopts; Compared in prior art, even if when same natural person user adopts main number jointly to access same application with trumpet, server still adopts additional safety verification strategy to verify the legitimacy of this access of above-mentioned access account to above-mentioned trumpet, the embodiment of the present invention has the beneficial effect by middle account intelligent sharing master information, reaches the object that server can share the attribute information between different access account that same natural person user registers based on same application; Eliminate server and based on the main number trumpet bound, the loaded down with trivial details proof procedure of the add-on security authentication policy performed required for same application is accessed to same user.

Continue referring to Fig. 7, in embodiment of the present invention Information Authentication device, described data obtaining module 01 identifies access account according to the historical data of searching and does not meet default access rule, can also realize in the following manner:

Data obtaining module 01 accesses the historical data of above-mentioned application correspondence according to the described access account found, search in preset duration (in such as one month or in one week) and access the total access times of described application based on above-mentioned access account, identify whether above-mentioned access times are less than first threshold; In the present embodiment, described first threshold can be determined by the access frequency of server according to the different access account of the above-mentioned application of access, or determined according to history access record corresponding to the legitimate verification of each access account of the above-mentioned application correspondence of access or historical data by server, or the instruction that arranges triggered in user side according to technician by server obtains above-mentioned first threshold; The present embodiment does not limit the obtain manner of first threshold and concrete numerical value.

Data obtaining module 01 is according to the described historical data obtained, and identifying the described access times of accessing described application corresponding based on described access account in preset duration is be less than first threshold, then identify above-mentioned access account and do not meet default access rule.

At data obtaining module 01 according to the described historical data obtained, identify when being more than or equal to first threshold based on the described access times that the described application of described access account access is corresponding in preset duration, data obtaining module 01 obtains the access duration of above-mentioned access times each this application of access corresponding respectively, and whether the quantity that acquisition access duration exceedes preset duration is less than Second Threshold; Described preset duration is similar to confirming the mode of first threshold with the validation testing of Second Threshold, described preset duration and Second Threshold can be determined by the access frequency of server according to the different access account of the above-mentioned application of access, or determined according to history access record corresponding to the legitimate verification of each access account of the above-mentioned application correspondence of access or historical data by server, or the instruction that arranges triggered in user side according to technician by server obtains above-mentioned preset duration and Second Threshold; The present embodiment does not limit the obtain manner of preset duration and Second Threshold and concrete numerical value.

Such as, each access duration that the above-mentioned access times N that data obtaining module 01 obtains is corresponding is respectively M1 ~ Mn, then data obtaining module 01 identifies whether the quantity Nx that N number of access duration M1 ~ Mn exceedes preset duration M0 is less than Second Threshold N0, when the quantity Nx that described access duration M1 ~ Mn exceedes preset duration M0 is less than Second Threshold N0, data obtaining module 01 identifies described access account and does not meet default access rule; When the quantity Nx that described access duration M1 ~ Mn exceedes preset duration M0 is more than or equal to Second Threshold N0, data obtaining module 01 identifies described access account and meets default access rule.

The embodiment of the present invention also provides a kind of Information Authentication device second embodiment; The difference of embodiment described in the embodiment of the present invention and Fig. 7 is, server when identifying this access account and there is not corresponding middle account, for this access account creates a middle account.

Based on the description of embodiment described in Fig. 7, as shown in Figure 8, Information Authentication device of the present invention also comprises:

Information creation module 04, for:

If there is not the middle account mapped with described access account, then create the middle account uniquely mapped with described access account, and described middle account shares access attribute information corresponding to described access account.

Data obtaining module 01 is according to the historical data of searching, identify this access account when not meeting default access rule and search the middle account not existing and map with this access account, the middle account that the access attribute information creating one that information creation module 04 is corresponding according to this access account uniquely maps with this access account, and this middle account can share access attribute information corresponding to this access account, that is, after this access account and this middle account are bound, by this middle account, data obtaining module 01 can get access attribute information corresponding to all access accounts that account middle with this bind and respectively access the historical data that this application of access corresponding to account produces.

When information creation module 04 is after above-mentioned access account creates a middle account, identify exist when accessing account B with related other of above-mentioned access account A if data obtaining module 01 is follow-up, according to the incidence relation of access account B and above-mentioned access account A, the middle account that above-mentioned access account B is corresponding with access account A also can be bound by information creation module 04, and information sharing module 02 can share relevant information corresponding to the above-mentioned access account such as access attribute information corresponding to each access account with identical middle account and secure access strategy corresponding to each access account.

The embodiment of the present invention additionally provides a kind of Information Authentication device the 3rd embodiment; The difference of embodiment described in the present embodiment and Fig. 8 is, server is that access account is pre-created corresponding middle account.

Based on the description of above embodiment, as shown in Figure 9, Information Authentication device of the present invention also comprises:

Module 05 is set up in mapping, for:

Set up the mapping relations of each access account corresponding to described application and middle account; Wherein, account in the middle of unique corresponding one of described access account, described middle account at least one access account corresponding.

In the present embodiment, map and set up module 05 according to the incidence relation between each access account of same application correspondence, set up the mapping relations of each access account and middle account and store; Wherein, when mapping the mapping relations between above-mentioned access account and corresponding middle account setting up module 05 foundation, account in the middle of unique corresponding one of an access account, but middle account can corresponding one or more access account, as shown in Figure 6, each access account is associated by middle account; And server is when the legitimacy of account is accessed in checking one, can share each access account that the middle account identical with this access account map distinguish corresponding access attribute information, secure access strategy and corresponding historical data.

In a preferred embodiment, map and set up the mapping relations that module 05 sets up each access account corresponding to described application and middle account, can in the following way:

Mapping is set up module 05 and is obtained all access accounts of described application correspondence and respectively access access attribute information corresponding to account, and obtains user accesses described application correspondence historical data based on each access account; According to the described access attribute information obtained and historical data, calculate the relating value between each access account; The access account being greater than default correlation threshold for described relating value sets up same middle account; Wherein, access attribute information corresponding to described access account and secure access strategy corresponding to described access attribute information is shared between each access account that described middle account is identical.

Such as, mapping is set up module 05 and is obtained all login accounts corresponding to a certain network game software-network game A and access attribute information corresponding to each login account, such as user's pet name, the phone number bound with network game account or the access attribute such as email address, age of user information; Based on above-mentioned login account, obtain user and log in historical data corresponding to above-mentioned network game A based on each login account, such as conventional entry address, conventional login IP address, login time section, login duration etc.; According to the above-mentioned access attribute information obtained and historical data, map and set up module 05 and calculate relating value between each access account; Such as, whether whether identical, the conventional login MAC Address in whether identical, the conventional login IP address of conventional entry address is identical, whether login time section is consistent, and using above-mentioned information as relevant parameter, and be that above-mentioned each relevant parameter gives certain weighted value respectively according to the significance level of each relevant parameter, according to above-mentioned relevant parameter and weighted value corresponding to each relevant parameter, calculate the relating value that above-mentioned login account is corresponding; Same middle account is set up for described relating value is greater than a login account presetting correlation threshold; And between each access account having an identical middle account, share the secure access strategy of access attribute information and the correspondence corresponded to each other.

In an alternative embodiment of the invention, map and set up the mapping relations that module 05 sets up each access account corresponding to described application and middle account, can also in the following way:

Map and set up the characteristic identity information that module 05 obtains each access account corresponding to described application and unique sign nature person user corresponding to described access account; The described access account identical for described characteristic identity information sets up same middle account; Access attribute information corresponding to described access account and secure access strategy corresponding to described access attribute information is shared between each access account that described middle account is identical.Such as, mapping is set up module 05 and is obtained each access account of above-mentioned application correspondence and each characteristic identity identity information of accessing unique sign nature person user corresponding to account, such as Chinese user, obtain the ID (identity number) card No. of binding when above-mentioned user registers access account, then map and set up module 05 by the same middle account of access account identical for ID (identity number) card No. establishment; Or, map and set up module 05 and obtain ID (identity number) card No. first corresponding to an access account a logged in first, then map and set up module 05 and search ID (identity number) card No. corresponding to each access account of logging in above-mentioned application correspondence, identify whether to exist the middle account identical with above-mentioned ID (identity number) card No. first or middle account corresponding to identical access account b and this access account b; If exist, then map and set up module 05 and directly bound with corresponding middle account by above-mentioned access account a, the mapping relations of account a and above-mentioned middle account are accessed in foundation.

The embodiment of the present invention also provides a kind of hardware configuration of Information Authentication device, and as shown in Figure 10, this Information Authentication device comprises:

Processor 101, storer 102, user interface 103, network interface 104 and communication bus 105.Communication bus 105 is for the communication between building block each in home server, and user interface 103 is for receiving the information of user's input, and this user interface can be wireline interface and wave point, such as keyboard, mouse etc.Network interface 104 communicates mutually with outside for Information Authentication device, and this network interface also can include line interface and wave point.Storer 102 can comprise one or more computer-readable recording mediums, and it not only comprises internal storage, also comprises external memory storage.Operating system and information sharing application program etc. is stored in this storer.Processor 101 for calling the information sharing application program in storer 102, to perform following operation:

Receive the triggering command of user terminal based on access account access one application based on user interface 103, search based on historical data corresponding to the described application of described access account access by communication bus 105;

Based on the legitimacy of accessing account described in secure access policy validation described in described access attribute Information Pull; Save data processing resources, while assuring data security, improve the convenience of Information Authentication, also improve man-machine interaction.

Further, processor 101 also for calling the information sharing application program in storer 102, to perform following operation:

IP address corresponding to described triggering command and/or MAC Address is obtained by communication bus 105;

In described historical data, search described IP address and/or MAC Address;

If can not find described IP address and/or MAC Address in described historical data, then identify described access account and do not meet default access rule.

According to described historical data, searched the access times of accessing described application in preset duration based on described access account by communication bus 105, identify whether described access times are less than first threshold;

When described access times are less than first threshold, identify described access account and do not meet default access rule;

When described access times are more than or equal to described first threshold, obtain each access duration that described access times are corresponding respectively, whether the quantity that identification access duration exceedes preset duration is less than Second Threshold;

When the quantity that described access duration exceedes preset duration is less than Second Threshold, identifies described access account and do not meet default access rule.

Obtain all access accounts of described application correspondence by communication bus 105 and respectively access access attribute information corresponding to account, and obtaining the historical data of user based on the described application correspondence of each access account access;

According to described access attribute information and historical data, calculate the relating value between each access account;

The access account being greater than default correlation threshold for described relating value sets up same middle account;

Wherein, access attribute information corresponding to described access account and secure access strategy corresponding to described access attribute information is shared between each access account that described middle account is identical.

The characteristic identity information of each access account corresponding to described application and unique sign nature person user corresponding to described access account is obtained by communication bus 105;

The described access account identical for described characteristic identity information sets up same middle account;

The method of the different access account corresponding informance that embodiment of the present invention Information Authentication device uses same natural person user to have for same application based on middle account, be there is the beneficial effect being used master's information by middle account intelligence, reach the object that server can share the attribute information between different access account that same natural person user registers based on same application; Eliminate server and based on the main number trumpet bound, the loaded down with trivial details proof procedure of the add-on security authentication policy performed required for same application is accessed to same user, save the processing time of server, reduce the performance loss of server, improve man-machine interaction.

It should be noted that, in this article, term " comprises ", " comprising " or its any other variant are intended to contain comprising of nonexcludability, thus make to comprise the process of a series of key element, method, article or device and not only comprise those key elements, but also comprise other key elements clearly do not listed, or also comprise by the intrinsic key element of this process, method, article or device.When not more restrictions, the key element limited by statement " comprising ... ", and be not precluded within process, method, article or the device comprising this key element and also there is other identical element.

The invention described above embodiment sequence number, just to describing, does not represent the quality of embodiment.

Through the above description of the embodiments, those skilled in the art can be well understood to the mode that above-described embodiment method can add required general hardware platform by software and realize, hardware can certainly be passed through, but in a lot of situation, the former is better embodiment.Based on such understanding, technical scheme of the present invention can embody with the form of software product the part that prior art contributes in essence in other words, this computer software product is stored in a storage medium (as ROM/RAM, magnetic disc, CD), comprising some instructions in order to make a station terminal equipment (can be mobile phone, computing machine, server, or the network equipment etc.) perform method described in each embodiment of the present invention.

The foregoing is only the preferred embodiments of the present invention; not thereby its scope of the claims is limited; every utilize instructions of the present invention and accompanying drawing content to do equivalent structure or equivalent flow process conversion; directly or indirectly be used in the technical field that other are relevant, be all in like manner included in scope of patent protection of the present invention.

Claims

1. an Information Authentication method, is characterized in that, comprises the following steps:

Described relating attribute information is set to access attribute information corresponding to described access account, and is the secure access strategy that the described access account of checking accesses described application employing by secure access strategy setting corresponding for described relating attribute information;

2. the method for claim 1, is characterized in that, the described historical data that described basis is searched, and identifies described access account and does not meet default access rule, comprising:

Obtain IP address corresponding to described triggering command and/or MAC Address;

In described historical data, search described IP address and/or MAC Address;

3. the method for claim 1, is characterized in that, the described historical data that described basis is searched, and identifies described access account and does not meet default access rule, comprising:

According to described historical data, search the access times of accessing described application in preset duration based on described access account, identify whether described access times are less than first threshold;

4. the method for claim 1, is characterized in that, described in search the middle account whether existing and map with described access account, also comprise afterwards:

5. the method as described in any one of claim 1-4, is characterized in that, described reception user terminal, based on the triggering command of access account access one application, also comprises before:

6. method as claimed in claim 5, is characterized in that, the described mapping relations setting up each access account corresponding to described application and middle account, comprising:

Obtain all access accounts of described application correspondence and respectively access access attribute information corresponding to account, and obtaining the historical data of user based on the described application correspondence of each access account access;

7. method as claimed in claim 5, is characterized in that, the described mapping relations setting up each access account corresponding to described application and middle account, comprising:

Obtain the characteristic identity information of each access account corresponding to described application and unique sign nature person user corresponding to described access account;

8. an Information Authentication device, is characterized in that, comprising:

Data obtaining module, for:

Information sharing module, for:

9. device as claimed in claim 8, is characterized in that, described data obtaining module also for:

In described historical data, search described IP address and/or MAC Address;

10. device as claimed in claim 8, is characterized in that, described data obtaining module also for:

11. devices as claimed in claim 8, is characterized in that, also comprise:

Information creation module, for:

12. devices as described in any one of claim 8-11, is characterized in that, also comprise:

Module is set up in mapping, for:

13. devices as claimed in claim 12, is characterized in that, described mapping set up module also for:

14. devices as claimed in claim 12, is characterized in that, described mapping set up module also for: