CN112687042A

CN112687042A - Authentication method, authentication device and electronic equipment

Info

Publication number: CN112687042A
Application number: CN202011535488.XA
Authority: CN
Inventors: 王欢; 叶磊; 闫冬梅; 李曼
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2020-12-23
Filing date: 2020-12-23
Publication date: 2021-04-20
Anticipated expiration: 2040-12-23
Also published as: CN112687042B

Abstract

The present disclosure provides an authentication method, an authentication device, and an electronic device, which may be used in the field of information security, financial field, or other fields, and the authentication method executed by a server side includes: acquiring a service request initiated based on at least one medium, wherein the service request comprises respective medium attributes of the at least one medium; responding to the service request, and determining an authentication mode corresponding to the service request based on the respective medium attribute of at least one medium and a first mapping relation, wherein the first mapping relation comprises the relation between the medium attribute and the authentication mode; and based on the respective medium attribute of at least one medium, performing authentication according to an authentication mode corresponding to the service request, so as to perform service processing on the service request after the authentication is passed.

Description

Authentication method, authentication device and electronic equipment

Technical Field

The present disclosure relates to the field of information security technology and the field of finance, and more particularly, to an authentication method, an authentication apparatus, and an electronic device.

Background

With the continuous development of digital technology, the application scenes of authentication operation in the work and life of users are more and more.

In the related art, user authentication needs to be achieved by means of a medium. The client authenticated by the relevant media can perform various operations on various protocols, accounts, media and the like hung down by the client through the authentication channel according to the operation authority.

In carrying out the presently disclosed concept, the inventors have found that there are at least the following problems in the related art. The authentication mode is to ensure the safety of the use of the medium or the participators, provide a differentiated safety authentication means and ensure the non-repudiation of the transaction. In the related art, one medium is solidified by an authentication means, and the authentication flexibility cannot meet the requirements of users.

Disclosure of Invention

In view of the above, the present disclosure provides an authentication method, an authentication apparatus, and an electronic device for improving authentication flexibility.

One aspect of the present disclosure provides an authentication method performed by a server, including: acquiring a service request initiated based on at least one medium, wherein the service request comprises respective medium attributes of the at least one medium; responding to the service request, and determining an authentication mode corresponding to the service request based on the respective medium attribute of at least one medium and a first mapping relation, wherein the first mapping relation comprises the relation between the medium attribute and the authentication mode; and based on the respective medium attribute of at least one medium, performing authentication according to an authentication mode corresponding to the service request, so as to perform service processing on the service request after the authentication is passed.

One aspect of the present disclosure provides an authentication method performed by a client, including: sending a service request initiated based on at least one medium to a server, wherein the service request comprises the respective medium attribute of the at least one medium; receiving an authentication result and/or a service processing result aiming at the service request from the server; and the authentication result is a result that the server side responds to the service request, determines an authentication mode corresponding to the service request based on the respective medium attribute of the at least one medium and the first mapping relation, and performs authentication according to the authentication mode corresponding to the service request based on the respective medium attribute of the at least one medium.

One aspect of the present disclosure provides an authentication apparatus applied to a server, including: the request acquisition module is used for acquiring a service request initiated based on at least one medium, wherein the service request comprises the respective medium attribute of the at least one medium; the request response module is used for responding to the service request and determining an authentication mode corresponding to the service request based on the respective medium attribute of at least one medium and a first mapping relation, wherein the first mapping relation comprises the relation between the medium attribute and the authentication mode; and the authentication module is used for authenticating according to an authentication mode corresponding to the service request based on the respective medium attribute of at least one medium so as to process the service processing on the service request after the authentication is passed.

One aspect of the present disclosure provides an authentication apparatus applied to a client, including: a request sending module, configured to send a service request initiated based on at least one medium to a server, where the service request includes a medium attribute of each of the at least one medium; the result receiving module is used for receiving an authentication result and/or a service processing result aiming at the service request from the server side; and the authentication result is a result that the server side responds to the service request, determines an authentication mode corresponding to the service request based on the respective medium attribute of the at least one medium and the first mapping relation, and performs authentication according to the authentication mode corresponding to the service request based on the respective medium attribute of the at least one medium.

One aspect of the present disclosure provides a service architecture including a media and authentication service component, where the media and authentication service component includes a media service object, a media type service object, an authentication mode service object, and an authentication mode type service object, where there is a one-to-many correspondence between the media type service object and the media service object, there is a many-to-many correspondence between the media service object and the authentication mode service object, and there is a one-to-many correspondence between the authentication mode type service object and the authentication mode service object.

One aspect of the present disclosure provides an electronic device comprising one or more processors and a storage for storing executable instructions that, when executed by the processors, implement the method as described above.

Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions for implementing the method as described above when executed.

Another aspect of the disclosure provides a computer program comprising computer executable instructions for implementing the method as described above when executed.

The authentication method, the authentication device and the electronic device provided by the embodiment of the disclosure determine the authentication mode corresponding to the service request based on the medium attribute included in the service request, so as to perform authentication according to the authentication mode. Through the decoupling management of the medium and the authentication mode, a more flexible management method is provided for the authentication field, and the use scene of the authentication mode is expanded.

The authentication method, the authentication device and the electronic equipment provided by the embodiment of the disclosure also solve the many-to-many scene of the medium and the authentication mode on the basis of one medium and multiple combined authentication modes.

The authentication method, the authentication device and the electronic equipment provided by the embodiment of the disclosure realize the scene that the authentication mode can authenticate both a person and a medium through the decoupling of the medium and the authentication mode and the decoupling management of the authentication mode and user information.

According to the authentication method, the authentication device and the electronic equipment provided by the embodiment of the disclosure, the medium only has corresponding special information and does not contain associated information among clients, accounts, products and the like. After the data analyzed by the server side is compared with the data in the database, the corresponding user information is found, so that the current user can be authenticated based on other medium attributes corresponding to the user information, the diversity of authentication modes is improved, and the safety of the user privacy information is improved.

The authentication method, the authentication device and the electronic device provided by the embodiment of the disclosure do not need to greatly modify the existing system, and only need to decouple the existing information (for example, store the existing information in different storage spaces respectively and establish a mapping relationship between the information), or complete information acquisition and add corresponding information in a medium service object library, so that the popularization cost is reduced, the flexibility of the system is improved, and the user requirements are met.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure with reference to the accompanying drawings, in which:

fig. 1 schematically illustrates an application scenario of an authentication method, an authentication apparatus and an electronic device according to an embodiment of the present disclosure;

fig. 2 schematically illustrates an exemplary system architecture to which an authentication method, an authentication apparatus, may be applied, according to an embodiment of the present disclosure;

FIG. 3 schematically shows a flow chart of an authentication method according to an embodiment of the present disclosure;

FIG. 4 schematically illustrates a media and authentication approach many-to-many schematic according to an embodiment of the disclosure;

FIG. 5 schematically shows a relationship diagram between media, authentication means and accounts according to an embodiment of the disclosure;

FIG. 6 schematically illustrates a decoupling process schematic according to an embodiment of the disclosure;

FIG. 7 schematically illustrates a schematic diagram of business components in accordance with an embodiment of the disclosure;

FIG. 8 schematically shows a flow chart of an authentication method according to another embodiment of the present disclosure;

fig. 9 schematically illustrates a block diagram of an authentication device according to an embodiment of the present disclosure;

fig. 10 schematically shows a block diagram of an authentication apparatus according to another embodiment of the present disclosure; and

FIG. 11 schematically shows a block diagram of an electronic device according to an embodiment of the disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.). Where a convention analogous to "A, B or at least one of C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B or C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.). The terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more features.

The embodiment of the disclosure provides an authentication method, an authentication device and electronic equipment. The authentication method includes an authentication mode determination process and an authentication process. In the authentication mode determining process, firstly, a service request initiated based on at least one medium is obtained, the service request comprises the respective medium attribute of the at least one medium, then, in response to the service request, an authentication mode corresponding to the service request is determined based on the respective medium attribute of the at least one medium and a first mapping relation, and the first mapping relation comprises the relation between the medium attribute and the authentication mode. And entering an authentication process after the authentication mode determining process is finished, and authenticating according to an authentication mode corresponding to the service request based on the respective medium attribute of at least one medium so as to perform service processing on the service request after the authentication is passed.

Fig. 1 schematically shows an application scenario of an authentication method, an authentication apparatus, and an electronic device according to an embodiment of the present disclosure.

As shown in fig. 1, a description will be given by taking a scenario of card swiping for entering a station as an example. The user can check tickets, check tickets by holding a mobile phone and display two-dimensional codes, check tickets, check identity cards or face recognition. In the related art, because media (such as train tickets, identity cards or face feature information existing in an organization) issued or stored by the organization are bound with an authentication mode, if a user holds an identity card to initiate a service request (or an authentication request), the user can only be authenticated in the mode of identity card authentication, and authentication by a face image or an authentication code (such as a two-dimensional code) provided by the organization is inconvenient to realize. In addition, for a scenario with a high security level, it is also inconvenient to quickly increase the authentication complexity to increase the reliability of the authentication result, such as requiring an organization to re-develop a new program to implement multiple authentications.

The media, the authentication mode and the user are subjected to decoupling management, the authentication mode for a certain media is convenient to change through a mode of establishing a mapping relation, and if the authentication mode corresponding to the user is face authentication when the user holds an identity card to trigger a service request, the acquired face image is compared with the stored face image corresponding to the identity card to determine whether the authentication is passed. In addition, the authentication mode corresponding to the combination of the media can be switched conveniently by modifying the mapping relation, for example, after the authentication identity is a valid identity card, face authentication, fingerprint authentication or password authentication and the like are further triggered, so that the diversity of the authentication modes and the convenience for switching the authentication modes are improved.

According to the authentication method, the authentication device and the electronic equipment provided by the embodiment of the disclosure, the medium and the authentication mode are decoupled, and/or the authentication mode and the user are decoupled, so that the authentication mode aiming at a certain medium or the authentication mode corresponding to a combination of multiple media can be changed conveniently in a mode of changing the mapping relation, a more flexible management method is provided for the authentication field, and the use scene of the authentication mode is expanded.

It should be noted that the inbound scenario is only an exemplary scenario, and may also be, for example, a payment scenario, a system login scenario, and the like, which is not limited herein.

The authentication method, the authentication device and the electronic equipment provided by the embodiment of the disclosure promote product and medium separation based on a business architecture. When a customer needs to enjoy preferential service provided by a certain product of the organization, the most suitable product service can be automatically recommended by the server side only after identity authentication is carried out through one medium, the customer can easily enjoy intelligent scene service provided by the organization, the user does not need to carry various media, the user does not need to judge a suitable scene by himself or find out a suitable card, and the transaction convenience is effectively improved.

Fig. 2 schematically shows an exemplary system architecture to which an authentication method, an authentication apparatus, according to an embodiment of the present disclosure may be applied. It should be noted that fig. 2 is only an example of a system architecture to which the embodiments of the present disclosure may be applied to help those skilled in the art understand the technical content of the present disclosure, and does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments or scenarios. It should be noted that the authentication method, the authentication apparatus, and the electronic device provided in the embodiments of the present disclosure may be used in the information security field in the aspects related to authentication, and may also be used in various fields other than the information security field, such as the financial field.

As shown in fig. 2, the system architecture 200 according to this embodiment may include

terminal devices

201, 202, 203, a network 204 and a server 205. The network 204 may include a plurality of gateways, routers, hubs, network wires, etc. to provide a medium for communication links between the

end devices

201, 202, 203 and the server 205. Network 204 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.

The user may use the

terminal device

201, 202, 203 to interact with other terminal devices and the server 205 via the network 204 to receive or send information and the like, such as sending service requests and receiving protocols, transaction results and the like. The

terminal devices

201, 202, 203 may be installed with various communication client applications, such as a bank-type application, a payment-type application, an e-commerce-type application, a web browser application, a search-type application, an office-type application, an instant messaging tool, a mailbox client, social platform software, etc. (just examples).

The

terminal devices

201, 202, and 203 include, but are not limited to, smart phones, point of sale (POS), desktop computers, augmented reality devices, tablet computers, laptop portable computers, retail terminals, and other electronic devices that can support at least one authentication mode.

The server 205 may receive and process the service request, the authentication request, and the like. For example, the server 205 may be a back office management server, a cluster of servers, or the like. The background management server can analyze and process the received service request, information request and the like, and feed back the processing result (such as an authentication result, an authentication mode, a service processing result and the like) to the terminal equipment.

It should be noted that the authentication method provided by the embodiment of the present disclosure may be executed by the server 205 or the

terminal devices

201, 202, 203, and the like. Accordingly, the authentication device provided by the embodiment of the present disclosure may be provided in the server 205 or the

terminal device

201, 202, 203. It should be understood that the number of terminal devices, networks, and servers are merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

In order to facilitate a better understanding of the embodiments of the present disclosure, first, a relationship between a medium, an authentication manner, and a user in the related art is exemplified. In the related art, the medium includes an authentication mode and account information, some media even include product information, and when a customer uses the medium, the bank server directly performs corresponding processing according to the authentication mode included in the medium. For a commercial bank, a medium is a real object or a virtual medium which can rapidly and safely access a customer account, and a customer authenticated by the relevant medium can perform various operations on various protocols, accounts and media hung by the customer through an authentication channel according to operation permissions; the authentication mode is to ensure the safety of the use of the medium or the participators, provide a differentiated safety authentication means and ensure the non-repudiation of the transaction.

For example, the medium in the related art may be an entity medium such as a U-shield, a bank card, a bankbook, etc., and the entity medium may store information therein, and the information may identify an account, so that a bank may determine a corresponding account based on the information stored in the medium to facilitate management of the account. However, as shown above, in the prior art, the fixed relationship among the medium, the authentication method, and the account makes it inconvenient to change the authentication method for a certain medium, and the flexibility is low, and the authentication requirements of the user in some scenarios cannot be met.

In the related technical solution, on one hand, a corresponding authentication manner is set for a medium, one medium is solidified with one authentication manner, which results in inflexible authentication, multiple media need to store the corresponding authentication manners respectively, and if the authentication manner data of the multiple media are the same, the data of the authentication manners also need to be stored repeatedly, which results in that the data of the authentication manners cannot be reused. On the other hand, the use scene of the authentication mode is limited, and the authentication mode can only authenticate a medium.

The embodiment of the disclosure flexibly solves the many-to-many relationship between the medium and the authentication mode through the idea of decoupling the medium and the authentication mode and the relationship between the storage medium and the authentication mode.

Some technical background and technical terms to which embodiments of the present disclosure relate are exemplified below.

And (3) service architecture: the overall structure, the interrelation and the principle standard of the supporting business operation elements are planned and defined from the enterprise level perspective, and the content such as the design, the framework, the behavior and the like of the current and future states of the enterprise are structurally expressed for realizing the matching of the strategic target and the tactical demand of the enterprise.

And (4) service components: the method is used for abstracting the banking business, and structurally classifying and hierarchically describing the business process, the business concept, the product and the user experience in a certain mode (graph, symbol, character and the like).

The business object is as follows: a set of associated entities reflecting the nature of the business.

Solid model: abstraction of data features. It logically and consistently expresses the service concept information according to a certain rule.

A service entity: the business view abstract represents a thing which objectively exists in the real world and can be distinguished from other objects and is described by a series of business attributes.

For example, a business architecture includes a plurality of business objects, each of which may include one or more mockups. Aiming at the problem that data of a medium and an authentication mode are not flexible, the technical scheme that the medium and the authentication mode are decoupled with each other is designed based on a business architecture model.

Fig. 3 schematically shows a flow chart of an authentication method according to an embodiment of the present disclosure.

As shown in fig. 3, the authentication method performed by the server may include operations S302 to S306.

In operation S302, a service request initiated based on at least one medium is obtained, where the service request includes a medium attribute of each of the at least one medium.

In this embodiment, the service request includes but is not limited to: payment requests, gate open requests, transaction (e.g., account opening, fund inquiry, transfer, clearing, transaction) requests, and the like.

For example, the medium includes at least one of a physical medium and a data medium. Wherein physical media include, but are not limited to: bank card, identity document, U shield, bankbook, driving license, etc. Wherein, the bank card can include: debit cards, payroll cards, credit cards, joint name cards, union cards, and the like. These media may store a user's account, personal identification information, and the like. The introduction of the data medium enables a user to separate from the physical medium to carry out transaction operation, so that the user does not need to carry the physical medium with him. For example, the data medium may carry user identification information or the like. For example, the data medium includes, but is not limited to, various biometric features such as a face image (feature), fingerprint information (feature), or voiceprint information (feature). The media properties may characterize the type of media, etc., such as media properties including, but not limited to: the attribute of the bank card, the attribute of the image, the attribute of the two-dimensional code, the attribute of the voiceprint, the attribute of the U shield and the like. In addition, the media properties may further include such things as: medium identification, image acquisition time, location, etc.

In operation S304, in response to the service request, an authentication manner corresponding to the service request is determined based on a respective media attribute of at least one medium and a first mapping relationship, where the first mapping relationship includes a relationship between the media attribute and the authentication manner.

For example, the authentication method corresponding to the attribute of the credit card is that the card number of the credit card is successfully matched in the database, the inquiry or payment password verification of the credit card is successful, the face image of the current cardholder of the credit card is successfully compared with the stored face image corresponding to the credit card, and the like. In addition, the authentication method may also include multiple authentications, for example, when an identity card is used for entering a station, the authentication method includes: firstly, matching the identity card information in a database, and then comparing the face images.

In operation S306, authentication is performed according to an authentication method corresponding to the service request based on the respective medium attribute of the at least one medium, so that the service request is subjected to service processing after the authentication is passed.

For example, based on the identification number, a one-dimensional code printed on the ticket, a two-dimensional code displayed on a display screen, redemption information issued by the organization, a facial image, fingerprint information, etc.

In one embodiment, the system receives an authentication request and determines whether the authentication subject is a physical medium or a virtual medium (e.g., whether the authentication subject includes a face image, etc.) based on the media attributes. If the authentication subject is the entity medium, the system inquires the entity medium and the authentication mode association table and compares the entity medium and the authentication mode association table, and if the comparison is successful, the system returns an authentication result which is successful. If the authentication subject is a virtual medium, the system queries the authentication mode and compares the authentication mode with the participant association table, and if the comparison is successful, the system returns an authentication result which is successful.

In one embodiment, the first mapping relationship further comprises a relationship between at least two combinations of media attributes and an authentication means.

Correspondingly, determining the authentication mode corresponding to the service request based on the respective media attributes of the at least one medium includes determining the authentication mode corresponding to the service request based on a combination of the respective media attributes of the at least two media and the first mapping relationship.

The medium attribute and the authentication mode of at least one medium are stored in different storage spaces. Therefore, the authentication mode corresponding to the medium attribute can be adjusted by constructing the mapping relation between the two.

Fig. 4 schematically shows a media and authentication manner many-to-many schematic diagram according to an embodiment of the disclosure.

In the related art, one settlement account corresponds to one scrambler, and one scrambler is required to be shared when a plurality of roles operate the account, and one scrambler cannot operate a plurality of settlement accounts.

As shown in fig. 4, in the embodiment of the present disclosure, a plurality of cipherers may be hung on a public settlement account by the same commercial bank, and a plurality of roles may be assigned for use. Meanwhile, the cipher device can be reused for public settlement account numbers under the same commercial bank, such as the cipher device 2 in fig. 4. Therefore, the above problems can be effectively improved. Through the decoupling management of the medium and the authentication mode, the multi-to-multi scene of the medium and the authentication mode is also solved on the basis of a medium multi-combination authentication mode.

In one embodiment, the method may further include the following operations.

In response to the service request, if there is a second mapping relationship corresponding to the media attribute, determining user authentication information of the participant based on the media attribute and the second mapping relationship, the second mapping relationship being a relationship between the media attribute and the user authentication information of the participant.

And responding to the acquired user information, authenticating the user information based on the user authentication information according to an authentication mode corresponding to the service request, and performing service processing on the service request after the authentication is passed.

In the embodiment, through decoupling of the medium and the authentication mode and decoupling management of the authentication mode and the participator, a scene that the authentication mode can authenticate both the person and the medium is realized.

For example, in the related art, after the medium information is that a customer purchases a bank financial product, the bank provides the customer with a physical or virtual medium that enables the customer to quickly and safely access the product account. The authentication mode information is private key information of the user or a real object or a virtual substance for storing the private key information of the user. The face recognition authentication mode can only be a single authenticator, and cannot simultaneously authenticate media.

In the embodiment of the disclosure, the face recognition authentication mode is bound with the medium, and the specified medium can be authenticated through face information recognition. For example, the system receives a customer fund transfer request, the fund transfer request includes medium attribute information, such as a bank card a, the system can determine that the corresponding authentication mode is face recognition by querying the second mapping relationship, and then can compare the received face image with a stored face image of a user corresponding to the bank card a, and if the comparison is successful, the authentication is passed. For another example, the customer enjoys a guest service to the physical storefront, the system receives the customer name, the system can determine that the corresponding authentication mode is face recognition by inquiring the second mapping relation, the received face image can be compared with the stored face image of the user corresponding to the customer name, and if the comparison is successful, the authentication is passed. The method can effectively solve the problem that the face recognition authentication method can only be used for authenticating a single authenticator and cannot authenticate media at the same time.

In an embodiment, the authentication mode may also be multiple authentication, for example, the authentication mode is bank card password authentication and face recognition authentication, and the authentication process triggered by the bank card or the face recognition authentication needs to pass after the dual pass of the bank card a and the face authentication.

In one embodiment, the media attribute and the authentication mode of at least one medium and the user authentication information of the participant are stored in different storage spaces.

Fig. 5 schematically shows a relationship diagram among media, authentication means, and accounts according to an embodiment of the present disclosure.

Compared with the technical scheme of solidification among the media, the authentication mode and the account in the related art, the relationship among the media, the authentication mode and the account in the embodiment of the disclosure is stored in a way of being associated with each other through the first mapping relationship as shown in fig. 5. The authentication methods and the participants (user authentication information) are stored in association with each other through a second mapping relationship.

For example, the media attribute information or the user information is transmitted to a server side of the bank for decoding and verification. After the data analyzed by the system is compared with the information in the database, the corresponding authentication mode is found, and then the person who initiates the request is authenticated according to the correct authentication mode.

The authentication method provided by the embodiment of the disclosure can facilitate a customer to select more appropriate and more favorable product services according to the self demand, and does not need to carry a large number of physical media to deal with the possible use scenes, so that the customer enjoys the services and has higher safety.

In one embodiment, the media attributes are stored in a media service object, the authentication mode is stored in an authentication mode service object, and the user authentication information is stored in a participant service object.

The authentication mode business object has a first mapping relation and a second mapping relation which are associated with the authentication mode business object.

In one embodiment, the method may further include the following operations.

Firstly, constructing a medium and authentication service component, wherein the medium and authentication service component comprises a medium service object and an authentication mode service object;

then, the medium information, the authentication mode information and the participant information in the coupling state are split to obtain the medium information, the medium type information, the authentication mode type information and the participant information.

And then, storing the medium information and the medium type information in a data set of the medium business object in a correlated manner, storing the authentication mode information and the authentication mode type information in a data set of the authentication mode business object, wherein a first mapping relation exists between the medium attribute and the authentication mode, and a second mapping relation exists between the medium attribute and the user authentication information of the participator.

Fig. 6 schematically illustrates a decoupling process schematic according to an embodiment of the present disclosure.

As shown in fig. 6, the original system stores the following information: the user A holds a credit card and authenticates the user A in a credit card authentication mode. This information is split into three parts: user a is for a participant business object, the credit card authentication mode is for an authentication mode business object, and the credit card information is for a media business object. The authentication mode service object and the medium service object belong to the medium and the authentication service component. In this way, the decoupled three-part information can be respectively stored in the data sets (such as databases) of the business objects corresponding to the three-part information, and the mapping relationship between the decoupled three-part information can be obtained.

FIG. 7 schematically shows a schematic diagram of a business component according to an embodiment of the disclosure.

As shown in fig. 7, when an organization constructs a business architecture, it needs to separate a medium, an authentication method, and a participant, and to construct business objects or entity models such as the participant, the authentication method, and the medium, respectively.

For example, the media and authentication service component includes a media service object, a media type service object, an authentication mode service object, and an authentication mode type service object, where there is a one-to-many correspondence between the media type service object and the media service object, there is a many-to-many correspondence between the media service object and the authentication mode service object, and there is a one-to-many correspondence between the authentication mode type service object and the authentication mode service object. The authentication mode business object and the participant business object have one-to-many corresponding relation. There is a many-to-many correspondence between the media service object and the account service object.

In addition, a many-to-many corresponding relationship exists between the participant agreement service object and the media type service object, a many-to-many corresponding relationship exists between the client service object and the media service object, and a one-to-many corresponding relationship exists between the participant service object and the authentication mode service object.

For example, for existing data in an organization such as a bank, the business objects such as the participants, the authentication method, the media and the like can be constructed in a mode of modifying original user information.

For example, after completing corresponding database table transformation according to the business object, the data architecture layer splits the original coupled participant with the authentication mode, the authentication mode and the medium, and performs data migration to complete data storage according to a new rule. The transformation is transparent to the customer, the customer does not need to provide extra information, and the transformation can be completed only by the inside of the bank. Table 1 exemplarily shows a physical table.

TABLE 1 physical table

In addition, for data (such as data of a new client) which is not available in an organization such as a bank, business objects such as the participant, the authentication method, the medium and the like can be constructed in a manner of creating new client information.

The disclosed embodiments allow for authentication means to authenticate both media and participants. Based on the thought, the authentication mode is respectively decoupled from the medium and the participants for management, and a next graph is formed. And managing the mapping relation between the medium and the authentication mode through an entity of the relation between the authentication mode and the medium, and managing the mapping relation between the authentication mode and the participator through an entity of the relation between the authentication mode and the participator.

Another aspect of the present disclosure provides an authentication method performed by a client.

Fig. 8 schematically shows a flow chart of an authentication method according to another embodiment of the present disclosure.

As shown in fig. 8, the authentication method includes operations S802 to S804.

In operation S802, a service request initiated based on at least one medium is sent to a server, where the service request includes a medium attribute of each of the at least one medium.

In operation S804, an authentication result and/or a service processing result for the service request from the server side is received.

And the authentication result is a result that the server side responds to the service request, determines an authentication mode corresponding to the service request based on the respective medium attribute of the at least one medium and the first mapping relation, and performs authentication according to the authentication mode corresponding to the service request based on the respective medium attribute of the at least one medium.

In one embodiment, the method may further include the operations of: and sending the user information to the server side so that the server side determines the user authentication information of the participator based on the medium attribute and the second mapping relation when determining that the second mapping relation corresponding to the medium attribute exists, and authenticating the user information based on the user authentication information according to an authentication mode corresponding to the service request.

Another aspect of the present disclosure provides an authentication apparatus, and fig. 9 schematically shows a block diagram of an authentication apparatus according to an embodiment of the present disclosure.

As shown in fig. 9, the authentication apparatus 900 in the server side may include: a request acquisition module 910, a request response module 920 and an authentication module 930.

The request obtaining module 910 is configured to obtain a service request initiated based on at least one medium, where the service request includes a medium attribute of each of the at least one medium.

The request response module 920 is configured to, in response to the service request, determine an authentication manner corresponding to the service request based on a media attribute of each of the at least one medium and a first mapping relationship, where the first mapping relationship includes a relationship between the media attribute and the authentication manner.

The authentication module 930 is configured to perform authentication according to an authentication method corresponding to the service request based on a medium attribute of each of the at least one medium, so as to perform service processing on the service request after the authentication is passed.

It should be noted that, the operations that each module can perform refer to the related description part of the above method, and are not described herein again.

Another aspect of the present disclosure provides an authentication apparatus.

Fig. 10 schematically shows a block diagram of an authentication apparatus according to another embodiment of the present disclosure. As shown in fig. 10, the authentication apparatus 1000 is applied to a client, and the authentication apparatus 1000 may include a request sending module 1010 and a result receiving module 1020.

The request sending module 1010 is configured to send a service request initiated based on at least one medium to a server, where the service request includes a medium attribute of the at least one medium.

The result receiving module 1020 is configured to receive an authentication result and/or a service processing result for the service request from the server side.

The operations that each module can perform refer to the related description part of the method, which is not described herein again.

It should be noted that the implementation, solved technical problems, implemented functions, and achieved technical effects of each module/unit and the like in the apparatus part embodiment are respectively the same as or similar to the implementation, solved technical problems, implemented functions, and achieved technical effects of each corresponding step in the method part embodiment, and are not described in detail herein.

Any of the modules, units, or at least part of the functionality of any of them according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules and units according to the embodiments of the present disclosure may be implemented by being split into a plurality of modules. Any one or more of the modules, units according to the embodiments of the present disclosure may be implemented at least partially as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented by any other reasonable means of hardware or firmware by integrating or packaging the circuits, or in any one of three implementations of software, hardware and firmware, or in any suitable combination of any of them. Alternatively, one or more of the modules, units according to embodiments of the present disclosure may be implemented at least partly as computer program modules, which, when executed, may perform the respective functions.

For example, any number of the request obtaining module 910, the request responding module 920 and the authenticating module 930 may be combined and implemented in one module, or any one of them may be split into a plurality of modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of the other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the request obtaining module 910, the request responding module 920 and the authenticating module 930 may be implemented at least partially as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in hardware or firmware by any other reasonable manner of integrating or packaging a circuit, or may be implemented in any one of or a suitable combination of software, hardware and firmware. Alternatively, at least one of the request obtaining module 910, the request responding module 920 and the authenticating module 930 may be implemented at least partly as a computer program module, which when executed may perform a corresponding function.

FIG. 11 schematically shows a block diagram of an electronic device according to an embodiment of the disclosure. The electronic device shown in fig. 11 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.

As shown in fig. 11, an electronic device 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)1102 or a program loaded from a storage section 1108 into a Random Access Memory (RAM) 1103. The processor 1101 may comprise, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 1101 may also include on-board memory for caching purposes. The processor 1101 may comprise a single processing unit or a plurality of processing units for performing the different actions of the method flows according to the embodiments of the present disclosure.

In the RAM 1103, various programs and data necessary for the operation of the electronic device 1100 are stored. The processor 1101, the ROM 1102, and the RAM 1103 are communicatively connected to each other by a bus 1104. The processor 1101 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM 1102 and/or the RAM 1103. It is to be noted that the programs may also be stored in one or more memories other than the ROM 1102 and the RAM 1103. The processor 1101 may also perform various operations of the method flows according to the embodiments of the present disclosure by executing programs stored in the one or more memories.

Electronic device 1100 may also include input/output (I/O) interface 1105, input/output (I/O) interface 1105 also connected to bus 1104, according to an embodiment of the disclosure. Electronic device 1100 may also include one or more of the following components connected to I/O interface 1105: an input portion 1106 including a keyboard, mouse, and the like; an output portion 1107 including a signal output unit such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage section 1108 including a hard disk and the like; and a communication section 1109 including a network interface card such as a LAN card, a modem, or the like. The communication section 1109 performs communication processing via a network such as the internet. A driver 1110 is also connected to the I/O interface 1105 as necessary. A removable medium 1111 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 1110 as necessary, so that a computer program read out therefrom is mounted into the storage section 1108 as necessary.

According to embodiments of the present disclosure, method flows according to embodiments of the present disclosure may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable storage medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication portion 1109 and/or installed from the removable medium 1111. The computer program, when executed by the processor 1101, performs the above-described functions defined in the system of the embodiment of the present disclosure. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM 1102 and/or the RAM 1103 and/or one or more memories other than the ROM 1102 and the RAM 1103 described above.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. These examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. An authentication method performed by a server side, comprising:

acquiring a service request initiated based on at least one medium, wherein the service request comprises respective medium attributes of the at least one medium;

responding to the service request, and determining an authentication mode corresponding to the service request based on the respective medium attribute of the at least one medium and a first mapping relation, wherein the first mapping relation comprises the relation between the medium attribute and the authentication mode; and

and based on the respective medium attribute of the at least one medium, performing authentication according to an authentication mode corresponding to the service request, so as to perform service processing on the service request after the authentication is passed.

2. The method of claim 1, wherein the first mapping relationship further comprises a relationship between each of at least two combinations of media attributes and an authentication means; and

the determining the authentication method corresponding to the service request based on the respective media attributes of the at least one medium includes determining the authentication method corresponding to the service request based on a combination of the respective media attributes of the at least two media and the first mapping relationship.

3. The method of claim 1, further comprising:

in response to the service request, if a second mapping relation corresponding to the medium attribute exists, determining user authentication information of the participant based on the medium attribute and the second mapping relation, wherein the second mapping relation is a relation between the medium attribute and the user authentication information of the participant; and

4. The method according to claim 3, wherein the media attribute of each of the at least one medium, the authentication method, and the user authentication information of the participant are stored in different storage spaces.

5. The method of claim 4, wherein the media attributes are stored in a media service object, the authentication means are stored in an authentication means service object, and the user authentication information is stored in a participant service object.

6. The method of claim 5, further comprising:

constructing a medium and authentication service component, wherein the medium and authentication service component comprises a medium service object and an authentication mode service object;

splitting the medium information, the authentication mode information and the participant information in the coupling state to at least obtain medium information, medium type information, authentication mode information and authentication mode type information; and

and storing the medium information and the medium type information in a data set of the medium business object in an associated manner, and storing the authentication mode information and the authentication mode type information in a data set of the authentication mode business object.

7. An authentication method performed by a client, comprising:

sending a service request initiated based on at least one medium to a server, wherein the service request comprises respective medium attributes of the at least one medium; and

receiving an authentication result and/or a service processing result aiming at the service request from the server;

and the authentication result is a result that the server side responds to the service request, determines an authentication mode corresponding to the service request based on the respective media attribute of the at least one medium and the first mapping relation, and authenticates according to the authentication mode corresponding to the service request based on the respective media attribute of the at least one medium.

8. The method of claim 7, further comprising:

and sending user information to the server side so that the server side determines user authentication information of participants based on the medium attribute and the second mapping relation when determining that the second mapping relation corresponding to the medium attribute exists, and authenticating the user information based on the user authentication information according to an authentication mode corresponding to the service request.

9. An authentication device applied to a server side, the authentication device comprising:

a request obtaining module, configured to obtain a service request initiated based on at least one medium, where the service request includes a medium attribute of each of the at least one medium;

a request response module, configured to respond to the service request, determine an authentication manner corresponding to the service request based on a media attribute of each of the at least one medium and a first mapping relationship, where the first mapping relationship includes a relationship between the media attribute and the authentication manner; and

and the authentication module is used for authenticating according to an authentication mode corresponding to the service request based on the respective medium attribute of the at least one medium so as to perform service processing on the service request after the authentication is passed.

10. An authentication apparatus applied to a client, the authentication apparatus comprising:

a request sending module, configured to send a service request initiated based on at least one medium to a server, where the service request includes a medium attribute of each of the at least one medium;

a result receiving module, configured to receive an authentication result and/or a service processing result for the service request from the server; and the authentication result is a result that the server side responds to the service request, determines an authentication mode corresponding to the service request based on the respective media attribute of the at least one medium and the first mapping relation, and authenticates according to the authentication mode corresponding to the service request based on the respective media attribute of the at least one medium.

11. An electronic device, comprising:

one or more processors;

storage means for storing executable instructions which, when executed by the processor, implement an authentication method according to any one of claims 1 to 6, or an authentication method according to claim 7 or 8.

12. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, implement an authentication method according to any one of claims 1 to 6 or an authentication method according to claim 7 or 8.