Nothing Special   »   [go: up one dir, main page]

WO2021159669A1 - 系统安全登录方法、装置、计算机设备和存储介质 - Google Patents

系统安全登录方法、装置、计算机设备和存储介质 Download PDF

Info

Publication number
WO2021159669A1
WO2021159669A1 PCT/CN2020/104948 CN2020104948W WO2021159669A1 WO 2021159669 A1 WO2021159669 A1 WO 2021159669A1 CN 2020104948 W CN2020104948 W CN 2020104948W WO 2021159669 A1 WO2021159669 A1 WO 2021159669A1
Authority
WO
WIPO (PCT)
Prior art keywords
account
user
handwritten
verification
information corresponding
Prior art date
Application number
PCT/CN2020/104948
Other languages
English (en)
French (fr)
Inventor
曹春辉
Original Assignee
深圳壹账通智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳壹账通智能科技有限公司 filed Critical 深圳壹账通智能科技有限公司
Publication of WO2021159669A1 publication Critical patent/WO2021159669A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/42—User authentication using separate channels for security data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/04—Real-time or near real-time messaging, e.g. instant messaging [IM]
    • H04L51/046—Interoperability with other network applications or services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/07—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail characterised by the inclusion of specific contents
    • H04L51/18—Commands or executable codes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/55—Push-based network services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN

Definitions

  • This application relates to the field of artificial intelligence authentication technology, in particular to a system security login method, device, computer equipment, and computer-readable storage medium.
  • the commonly used identity verification methods include entering a password or a verification code.
  • the inventor realizes that the common defect of these methods is that if criminals illegally obtain the verification code or password, they can log in, so that the security of the login cannot be guaranteed.
  • the purpose of this application is to provide a system security login method, device, computer equipment, and computer-readable storage medium.
  • a system security login method including:
  • an instruction is sent to at least one message push system so that the message push system sends the first verification password to the login terminal of the second account of the message push system according to the instruction, where the The second account of the message push system is associated with the first account of the user in the target system;
  • the login request of the user is passed.
  • a system security login device including:
  • the sending module is configured to send an instruction to at least one message push system when a user requests to log in to the target system, so that the message push system sends the first verification to the login terminal of the second account of the message push system according to the instruction A password, wherein the second account of the message push system is associated with the first account of the user in the target system;
  • the receiving module is configured to receive the manually processed first verification password uploaded by the user as a second verification password, wherein the first verification password is processed manually and corresponds to the user's identity ;
  • a determining module configured to determine whether the user is legal according to the second verification password and pre-obtained verification information corresponding to the first account
  • the pass module is configured to pass the login request of the user when it is determined that the user is legal.
  • a computer device including a memory and a processor, the memory is used to store a program of the processor for system security login, and the processor is configured to execute the program of the system security login Perform the following processing: when a user requests to log in to the target system, send an instruction to at least one message push system so that the message push system sends the first verification password to the login terminal of the second account of the message push system according to the instruction, Wherein, the second account of the message pushing system is associated with the first account of the user in the target system; the first verification password uploaded by the user and processed manually is received as the second verification A password, wherein the first verification password is processed manually and corresponds to the identity of the user; determining whether the user is legal according to the second verification password and the verification information corresponding to the first account obtained in advance; In the case where it is determined that the user is legitimate, the login request of the user is passed.
  • a computer-readable storage medium storing computer-readable instructions
  • a program for system security login is stored thereon.
  • the system security login program is executed by a processor to implement the following processing: Log in to the target system and send an instruction to at least one message push system, so that the message push system sends the first verification password to the login terminal of the second account of the message push system according to the instruction, wherein the message push system
  • the second account of the user is associated with the first account of the user in the target system; the first verification password that has been manually processed uploaded by the user is received as a second verification password, wherein the first verification password is After a verification password is manually processed, it corresponds to the identity of the user; according to the second verification password and the pre-obtained verification information corresponding to the first account, it is determined whether the user is legal; when it is determined that the user is legal In this case, the login request of the user is passed.
  • the above system security login method, device, computer equipment and computer-readable storage medium on the one hand, by sending a verification instruction to the user’s account in the message push system, the target system to be logged in by the user is separated from the channel that receives the verification instruction.
  • the molecule uses the account of another user to log in to the target system, as long as the other user can receive the information sent by the message push system, he can learn that the account has been stolen in time, which improves the security of login; on the other hand, it must be the user himself Only the authentication password obtained by personal processing can log in legally, which further improves the security of login.
  • Fig. 1 is a schematic diagram showing a system architecture of a method for system security login according to an exemplary embodiment.
  • Fig. 2 is a flow chart showing a method for system security login according to an exemplary embodiment.
  • FIG. 3 is a detailed flowchart of step 230 of an embodiment shown according to the embodiment corresponding to FIG. 2.
  • FIG. 4 is a detailed flowchart of step 231 of an embodiment shown according to the embodiment corresponding to FIG. 3.
  • Fig. 5 is a block diagram showing a device for system security login according to an exemplary embodiment.
  • Fig. 6 is an exemplary block diagram showing a computer device that implements the foregoing method for system security login according to an exemplary embodiment.
  • Fig. 7 shows a computer-readable storage medium for realizing the above-mentioned system security login method according to an exemplary embodiment.
  • This application first provides a method for system security login.
  • the system here can be various software systems, such as a database management system, a financial management system, a student status management system, etc., or even an operating system.
  • System login is the process of entering the system. Generally, the system login is performed through an account specific to a system. After the system is logged in, a series of operations can be performed, such as using system functions, accessing information on the system, and managing resources on the system, etc. .
  • logging in to the system it may be that an illegal user is logging in with the account of a legal user, which results in insecure login of the system, and the system security login method provided in this application can realize the secure login of the system.
  • the implementation terminal of this application can be any device with computing and processing functions.
  • the device can be connected to an external device to receive or send data.
  • it can be a portable mobile device, such as a smart phone, a tablet computer, a notebook computer, or a PDA ( Personal Digital Assistant), etc., can also be fixed devices, such as computer equipment, field terminals, desktop computers, servers, workstations, etc., or a collection of multiple devices, such as cloud computing physical infrastructure or server clusters.
  • the implementation terminal of this application may be a server or a physical infrastructure of cloud computing.
  • Fig. 1 is a schematic diagram showing a system architecture of a method for system security login according to an exemplary embodiment.
  • the system architecture includes a server 110, a smart phone 120, and a message push server 130.
  • the smart phone 120 is used by a user.
  • the server 110, the smart phone 120, and the message push server 130 are connected by a communication link. It can be used to receive and send data.
  • the server 110 is the implementation terminal of the application
  • the server 110 runs a target system
  • the message push server 130 runs a message push system.
  • a specific process for a user to log in to the target system on the server 110 may be as follows: the user obtains the information obtained when the user registers with the target system of the server 110 in advance. The first account is registered and the verification information is sent to the target system; the user sends a login request to the server 110 by using the smart phone 120 to request to log in to the target system on the server 110, and the server 110 will push the message to the server 130 according to the login request.
  • the message push system sends an instruction message, and the message push system sends the first verification password to the smart phone 120 according to the instruction message; the user of the smart phone 120 processes the first verification password to generate a second verification password, and then sends the second verification password Send to the server 110, and the server 110 can determine whether the user is legal according to the second authentication password sent by the user and the previously obtained authentication information, and in the case where it is determined to be legal, the login request of the user is passed.
  • the message push system may be a message push system of a WeChat official account.
  • the user s smartphone 120 is equipped with a WeChat APP and follows a specific official account.
  • the first verification password can be pushed to the smartphone 120.
  • a verification password can be a string of characters.
  • the user can process the first verification password by reading this string of characters.
  • the processed second verification password is the voice information corresponding to this string of characters.
  • the voice information is sent to the server 110. Since the voice information uniquely corresponds to the user and identifies the user's identity, the server can use a specific algorithm to base the voice information and the obtained voice message for verification (verification message) Perform user's legality verification.
  • Fig. 1 is only an embodiment of the present application.
  • the implementing terminal in this embodiment is a server, in other embodiments, the implementing terminal of the present application may be various terminals or devices as described above; although in this embodiment, the implementing terminal of the present application and The terminal running the target system is the same terminal, but in other embodiments or specific applications, the implementing terminal of the present application and the terminal running the target system may be different terminals; although in this embodiment, the implementing terminal of the present application It is a different terminal from the terminal running the message pushing system, but in other embodiments or specific applications, the implementing terminal of this application and the terminal running the message pushing system may be the same terminal.
  • This application does not make any limitation on this, and the protection scope of this application should not be restricted in any way.
  • Fig. 2 is a flow chart showing a method for system security login according to an exemplary embodiment.
  • the system security login method of this embodiment can be executed by a server, as shown in FIG. 2, and includes the following steps:
  • Step 210 When the user requests to log in to the target system, send an instruction to at least one message push system so that the message push system sends the first verification password to the login terminal of the second account of the message push system according to the instruction.
  • the second account of the message pushing system is associated with the first account of the user in the target system.
  • the implementation terminal of this application can be the device where the target system is located, or it can be a terminal device other than the device where the target system is located.
  • the implementation terminal of this application may be provided with a module for monitoring user login requests.
  • the target system can be a variety of software systems, such as a database management system, and the target system can include one or more modules.
  • the terminal corresponding to the second account that is, the terminal that receives the first verification password, can be the same terminal used by the user to request to log in to the target system. It can be a different terminal, which is easy to understand. Generally speaking, the terminal logs in to a system through an account. Therefore, the second account of the message push system may have a corresponding login terminal.
  • the request sent by the user can be a network request based on various protocols, for example, it can be a request based on the HTTP/HTTPS protocol.
  • the instruction sent to the message push system can be a simple reminder message, or it can be an instruction or code, such as a script.
  • the instruction includes a first verification password and a first account of the user in the target system
  • the message push system stores a mapping relationship table between the second account and the first account of the target system
  • the message push system After the message push system obtains the instruction, it first extracts the first verification password and the first account in the instruction, and then by querying the mapping relationship table between the second account and the first account of the target system, it determines the relationship with the first account of the target system.
  • the second account corresponding to the first account in the instruction finally sends the first verification password to the login terminal of the second account.
  • the instruction sent to the message push system includes a second account
  • the implementation terminal of this application stores the corresponding relationship between the first account and the second account, and the user requests to log in to the system to upload the first account.
  • This application The implementation terminal can obtain the first account, determine the corresponding second account according to the corresponding relationship, and then generate an instruction according to the determined second account and send it to the message push system, so that the second account of the message push system
  • the login terminal of the account can obtain the first verification password.
  • the message push system may be any system capable of pushing messages, and the user's first account in the target system is the user's identification in the target system, for example, it may be an email account, an ID number, or a self Define the account number, mobile phone number, etc.
  • the message pushing system is a short message system
  • the second account number of the message pushing system is a mobile phone number
  • the message push system is an email sending system
  • the second account of the message push system is an email account
  • the message pushing system is a system for pushing messages to users on WeChat
  • the second account of the message pushing system is a WeChat account.
  • the system used to push messages to users on WeChat may be a WeChat official account.
  • the second account of the message pushing system is associated with the user's first account in the target system, that is, the second account of the message pushing system is associated with the user's first account in the target system.
  • the corresponding relationship is determined before the user requests to log in to the target system.
  • the message push system is a WeChat official account
  • the user uses his WeChat to follow the WeChat official account
  • the user's WeChat account becomes the second account of the message push system.
  • the user can establish the association relationship between the second account and the first account in a variety of ways.
  • the account binding entry can be set on the WeChat official account. After the user registers the first account of the target system, the account binding entry will be used to connect The first account is submitted to realize the binding between the first account and the second account; it can also be that after the user registers the first account of the target system, the target system uploads the WeChat account following the WeChat official account to achieve the first account.
  • One account is bound to a second account, wherein the data recording the binding relationship between the first account and the second account will be synchronized to the background of the WeChat official account.
  • the method may further include:
  • the implementation terminal of this application is the terminal where the target system is located, and the association relationship between the second account and the first account is established by receiving the registration information and the second account.
  • the registration information includes the candidate first account
  • the generating the first account of the target system for the user according to the registration information includes: extracting the candidate first account contained in the registration information. Account; if there is no account consistent with the candidate first account in the target system, the candidate first account is used as the user's first account.
  • the generating the first account of the target system for the user according to the registration information includes: if the registration information is the information for the first registration, randomly generating an ungenerated account as The first account corresponding to the registration information.
  • Step 220 Receive the manually processed first verification password uploaded by the user as a second verification password.
  • the first verification password is processed manually and corresponds to the user's identity.
  • the first verification password After the first verification password is processed manually, it corresponds to the user's identity means that the first verification password itself cannot be used for identity verification, and the second verification password obtained after the first verification password is processed manually because it contains With the artificially processed information, a unique corresponding relationship is established with the user, and the user's identity can be identified, so it can be used for identity verification.
  • the first verification password may be a combination of symbols
  • the first verification password processed manually that is, the corresponding second verification password may be the symbol combination input by the user, because the symbol combination input by the user is recorded
  • the handwriting of the user is displayed, and the handwriting represents the identity of the user, so it can be used to verify whether the user is legal.
  • the first verification password can be a combination of symbols
  • the first verification password processed manually that is, the corresponding second verification password
  • the symbol combination includes multiple symbols, and each symbol can be one of letters, numbers, and words.
  • Step 230 Determine whether the user is legal according to the second verification password and the pre-obtained verification information corresponding to the first account.
  • step 230 may be as shown in FIG. 3.
  • FIG. 3 is a detailed flowchart of step 230 of an embodiment shown according to the embodiment corresponding to FIG. 2.
  • the first verification password is a combination of symbols for the user to correspondingly enter handwritten information
  • the second verification password is the handwritten information that the user enters according to the combination of symbols, which is obtained in advance and is
  • the verification information corresponding to the first account is at least one handwritten symbol submitted by the user of the first account, and the symbol combination is a randomly generated combination of symbols of the same type as the handwritten symbol, as shown in FIG. 3, including the following step:
  • Step 231 Use a pre-trained convolutional neural network model to determine the overall similarity between the handwritten information and the pre-obtained verification information corresponding to the first account.
  • the handwritten information corresponding to the symbol combination is the handwritten symbol combination.
  • the difference between the symbol combination and the handwritten symbol is that the symbol combination is a printed font output by a computer or other equipment, and the handwritten symbol is a font manually handwritten by a user.
  • the pre-trained convolutional neural network model can be used to perform tasks such as image recognition, and can also be used to determine the similarity between images.
  • the handwritten symbols are regarded as images, and the handwritten symbols are input to the convolution Neural network model, image processing is performed by the convolutional neural network model to determine the similarity.
  • Convolutional neural network models can be various models that include convolutional layers and can recognize image similarity. In addition to convolutional layers, convolutional neural network models can also include other structures, such as pooling layers and fully connected layers.
  • the convolutional neural network model may also be a model based on a convolutional neural network, such as a generative confrontation network model based on a convolutional neural network, an enhanced model based on a convolutional neural network, and so on.
  • the pre-obtained verification information corresponding to the first account is a handwritten symbol submitted by the user, and the pre-trained convolutional neural network model is used to determine the difference between the handwritten information and the pre-obtained
  • the overall similarity of the verification information corresponding to the first account includes: using a pre-trained convolutional neural network model to obtain the similarity between each symbol in the handwritten information and the handwritten symbol in the verification information; The average value of each similarity is used as the overall similarity between the handwritten information and the pre-obtained verification information corresponding to the first account.
  • the advantage of this embodiment is that by using the average of the similarities to determine whether the user is legal, the accuracy of the judgment result is guaranteed to a certain extent.
  • step 231 may be as shown in FIG. 4.
  • FIG. 4 is a detailed flowchart of step 231 of an embodiment shown according to the embodiment corresponding to FIG. 3.
  • the pre-obtained verification information corresponding to the first account is a plurality of handwritten symbols submitted by the user.
  • step 231 may include the following steps:
  • Step 2311 For each handwritten symbol in the verification information corresponding to the first account obtained in advance, use a pre-trained convolutional neural network model to obtain the similarity between the handwritten symbol and each symbol in the handwritten information .
  • the verification information corresponding to the first account in this embodiment includes multiple handwritten symbols
  • the number of handwritten symbols in the verification information corresponding to the first account is m
  • the number of symbols in the handwritten information is n
  • the number of similarities obtained by performing this step is m*n. For example, if the number of handwritten symbols in the verification information corresponding to the first account number is 5, and the number of symbols in the handwritten information, that is, the number of symbols included in the symbol combination is 6, then similar
  • Step 2312 Determine the minimum value among the acquired similarities as the overall similarity between the handwritten information and the pre-obtained verification information corresponding to the first account.
  • the minimum value of each similarity is taken as the overall similarity, that is, only when the minimum value of each similarity is still greater than a predetermined similarity threshold, the user is determined to be legitimate. , Improve the security of authentication when users log on to the target system.
  • the pre-obtained verification information corresponding to the first account is a plurality of handwritten symbols submitted by the user, and the pre-trained convolutional neural network model is used to determine the difference between the handwritten information and the pre-obtained and
  • the overall similarity of the verification information corresponding to the first account includes: judging whether there are handwritten symbols consistent with the content of the symbols in the handwritten information in the verification information corresponding to the first account obtained in advance; if so, For the pre-obtained handwritten symbols in the verification information corresponding to the first account that are consistent with each pair of content in the handwritten information, the pre-trained convolutional neural network model is used to obtain the similarity as the first similarity ; Determine the average value of each first similarity obtained as the first average value; For the handwritten symbols that are inconsistent with each pair of content in the handwritten information in the verification information corresponding to the first account obtained in advance, Use the pre-trained convolutional neural network model to obtain the similarity as the second similarity; determine the average value of each second similarity
  • the similarity between the handwritten symbols with the same content is obtained respectively.
  • the average value of and the average value of the similarity between the handwritten symbols with inconsistent content, and then the weighted sum of the two average values is used as the overall similarity between the handwritten information and the pre-obtained verification information corresponding to the first account , So that the overall similarity obtained finally reflects the different effects of the similarity between the handwritten symbols with the same content and the similarity between the handwritten symbols with inconsistent content, which improves the accuracy of determining the user’s legality to a certain extent. sex.
  • the handwritten symbols with the same content correspond to the first similarity. Similarity has a greater role in determining overall similarity, which means that if the handwritten symbols with the same content are more similar, it means that the handwritten symbols in the verification information and the symbols in the handwritten information are more likely to be written by the same person, and the more they should be The handwritten information is recognized as similar to the pre-obtained verification information corresponding to the first account. In this way, for legitimate users, a higher overall similarity can be calculated to ensure that legitimate users can be accurately identified.
  • the pre-obtained verification information corresponding to the first account is a plurality of handwritten symbols submitted by the user
  • the pre-trained convolutional neural network model is used to determine the difference between the handwritten information and the pre-obtained and
  • the overall similarity of the verification information corresponding to the first account includes: using a pre-trained convolutional neural network model to obtain the multiple handwritten symbols of the verification information, the similarity between two handwritten symbols is used as the first Three similarities; determine the average value of each third similarity obtained as the third average; for each handwritten symbol in the verification information corresponding to the first account obtained in advance, use the pre-trained convolution
  • the neural network model obtains the similarity between the handwritten symbol and each symbol in the handwritten information as the fourth similarity; determines the average value of the obtained fourth similarities as the fourth average; The ratio of the value to the fourth average value is used as the overall similarity between the handwritten information and the pre-obtained verification information corresponding to the first account.
  • the model may not be able to recognize the similarity between each pair of symbols as 1.
  • the overall similarity is taken as the ratio of the third average value to the fourth average value. , To a certain extent, reduce the overall similarity error caused by the similarity error of the model output, and improve the accuracy of user legitimacy verification.
  • Step 232 If the overall similarity reaches a predetermined similarity threshold, it is determined that the user is legal, otherwise it is determined that the user is illegal.
  • the legality of the user is determined based on the comparison result of the overall similarity and the corresponding threshold, which realizes the accurate judgment of whether the user is legal.
  • the first verification password is a combination of symbols used to enable the user to correspondingly input voice
  • the second verification password is the first voice information that the user enters according to the combination of symbols, which is obtained in advance and is
  • the verification information corresponding to the first account is the second voice information submitted by the user of the first account, the symbol combination is a randomly generated character sequence, and the second verification password is based on the second verification password and the pre-obtained first voice information.
  • the verification information corresponding to the account to determine whether the user is legal includes: using a pre-trained voiceprint recognition model to determine the voiceprint similarity between the second voice information and the first voice information; and using pre-trained voice recognition The model determines the content of the first voice information;
  • voiceprint similarity reaches a predetermined voiceprint similarity threshold and the content is consistent with the symbol combination, it is determined that the user is legitimate.
  • the user's identity is authenticated through voice and voiceprint without entering a password, which improves the convenience of the user to log in on the target system.
  • the user's terminal can receive the verification password.
  • the user's terminal can get reminders, which improves the security of login.
  • the voiceprint recognition model can determine the similarity of voiceprints between voices, and the voice recognition model can identify what the voice information refers to.
  • the voiceprint recognition model and the voice recognition model can be models established based on various algorithms, and the voiceprint similarity or voice recognition can also be performed by calling an external interface.
  • GMM-UBM Global System for Mobile Communications
  • DFSMN Deep Feedforward Sequential Memory Networks
  • Step 240 Pass the user's login request when it is determined that the user is legitimate.
  • the user Through the user's login request, that is, the user is allowed to log in to the target system, after logging in to the target system, the user can perform operations such as using the target system and managing resources on the target system.
  • the target system for the user to log in is separated from the channel that receives the verification instruction.
  • the molecule uses the account of another user to log in to the target system, as long as the other user can receive the information sent by the message push system, he can learn that the account has been stolen in time, which improves the security of login; on the other hand, it must be the user himself Only the authentication password obtained by personal processing can be legally logged in, which further improves the security of login.
  • This application also provides a system security login device.
  • the following are device embodiments of this application.
  • Fig. 5 is a block diagram showing a device for system security login according to an exemplary embodiment. As shown in Figure 5, the device 500 includes:
  • the sending module 510 is configured to send an instruction to at least one message push system when a user requests to log in to the target system, so that the message push system sends the first message to the login terminal of the second account of the message push system according to the instruction.
  • a verification password wherein the second account of the message push system is associated with the first account of the user in the target system;
  • the receiving module 520 is configured to receive the manually processed first verification password uploaded by the user as a second verification password, wherein the first verification password is processed manually and is associated with the user’s identity correspond;
  • the determining module 530 is configured to determine whether the user is legal according to the second verification password and pre-obtained verification information corresponding to the first account;
  • the pass module 540 is configured to pass the login request of the user when it is determined that the user is legal.
  • the sending module is further configured to send an instruction to at least one message push system when a user requests to log in to the target system, so that the message push system sends the message push system to the first message push system according to the instruction.
  • the first verification password is a combination of symbols for the user to correspondingly enter handwritten information
  • the second verification password is the handwritten information entered by the user according to the combination of symbols, which is obtained in advance with the first
  • the verification information corresponding to the account is at least one handwritten symbol submitted by the user of the first account
  • the symbol combination is a randomly generated combination of symbols of the same type as the handwritten symbol
  • the determining module is further configured to:
  • the overall similarity reaches a predetermined similarity threshold, it is determined that the user is legal, otherwise it is determined that the user is illegal.
  • the pre-obtained verification information corresponding to the first account is a handwritten symbol submitted by the user, and the pre-trained convolutional neural network model is used to determine the difference between the handwritten information and the pre-obtained
  • the overall similarity of the verification information corresponding to the first account includes:
  • the average value of the obtained similarities is determined as the overall similarity between the handwritten information and the pre-obtained verification information corresponding to the first account.
  • the pre-obtained verification information corresponding to the first account is a plurality of handwritten symbols submitted by the user, and the pre-trained convolutional neural network model is used to determine the difference between the handwritten information and the pre-obtained and
  • the overall similarity of the verification information corresponding to the first account includes:
  • the minimum value among the acquired similarities is determined as the overall similarity between the handwritten information and the pre-obtained verification information corresponding to the first account.
  • the pre-obtained verification information corresponding to the first account is a plurality of handwritten symbols submitted by the user, and the pre-trained convolutional neural network model is used to determine the difference between the handwritten information and the pre-obtained and
  • the overall similarity of the verification information corresponding to the first account includes:
  • the pre-trained convolutional neural network model is used to obtain the similarity as the first A similarity
  • the pre-trained convolutional neural network model is used to obtain the similarity as the second similarity ;
  • the average value of the obtained similarities is determined as the overall similarity between the handwritten information and the pre-obtained verification information corresponding to the first account.
  • the first verification password is a combination of symbols used to enable the user to correspondingly input voice
  • the second verification password is the first voice information that the user enters according to the combination of symbols, which is obtained in advance and is
  • the verification information corresponding to the first account is the second voice information submitted by the user of the first account
  • the symbol combination is a randomly generated character sequence
  • the determining module is further configured to:
  • voiceprint similarity reaches a predetermined voiceprint similarity threshold and the content is consistent with the symbol combination, it is determined that the user is legitimate.
  • the computer equipment includes:
  • At least one processor At least one processor
  • a memory communicatively connected with the at least one processor; wherein,
  • the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute as shown in any of the foregoing exemplary embodiments.
  • System security login method
  • the computer device 600 according to this embodiment of the present application will be described below with reference to FIG. 6.
  • the computer device 600 shown in FIG. 6 is only an example, and should not bring any limitation to the function and scope of use of the embodiments of the present application.
  • the computer device 600 is represented in the form of a general-purpose computing device.
  • the components of the computer device 600 may include, but are not limited to: the aforementioned at least one processing unit 610, the aforementioned at least one storage unit 620, and a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610).
  • the storage unit stores program code, and the program code can be executed by the processing unit 610, so that the processing unit 610 executes the various exemplary methods described in the “Methods of Embodiments” section of this specification. Steps of implementation.
  • the storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 621 and/or a cache storage unit 622, and may further include a read-only storage unit (ROM) 623.
  • RAM random access storage unit
  • ROM read-only storage unit
  • the storage unit 620 may also include a program/utility tool 624 having a set of (at least one) program module 625.
  • program module 625 includes but is not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples or some combination may include the implementation of a network environment.
  • the bus 630 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any bus structure among multiple bus structures. bus.
  • the computer device 600 can also communicate with one or more external devices 800 (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable a user to interact with the computer device 600, and/or communicate with Any device (such as a router, a modem, etc.) that enables the computer device 600 to communicate with one or more other computer devices. This communication can be performed through an input/output (I/O) interface 650.
  • the computer device 600 may also communicate with one or more networks (for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 660.
  • networks for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet
  • the network adapter 660 communicates with other modules of the computer device 600 through the bus 630. It should be understood that although not shown in the figure, other hardware and/or software modules can be used in conjunction with the computer device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.
  • the example embodiments described here can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computer device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiment of the present application.
  • a computer device which can be a personal computer, a server, a terminal device, or a network device, etc.
  • each aspect of the present application can also be implemented in the form of a program product, which includes program code.
  • program product runs on a terminal device
  • program code is used to make the The terminal device executes the steps according to various exemplary embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification.
  • a program product 700 for implementing the above method according to an embodiment of the present application is described. It can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be stored in a terminal device, For example, running on a personal computer.
  • CD-ROM compact disk read-only memory
  • the program product of this application is not limited to this.
  • the computer-readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with an instruction execution system, device, or device.
  • the program product can use any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Type programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • the readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.
  • the program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.
  • the program code used to perform the operations of the present application can be written in any combination of one or more programming languages.
  • the programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming languages. Programming language-such as "C" language or similar programming language.
  • the program code can be executed entirely on the user's computer equipment, partly on the user's equipment, executed as an independent software package, partly on the user's computer equipment and partly executed on the remote computer equipment, or entirely on the remote computer equipment or server. Executed on.
  • the remote computer equipment can be connected to the user’s computer equipment through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer equipment (for example, using Internet service providers). Business to connect via the Internet).
  • LAN local area network
  • WAN wide area network
  • Internet service providers for example, using Internet service providers.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请涉及人工智能的身份验证领域，揭示了一种系统安全登录方法、装置、计算机设备和存储介质。该方法包括：当用户请求登录目标系统，向消息推送系统发送指示，以使消息推送系统根据指示向消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；接收用户上传的用人工方式加工过的第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；在确定所述用户合法的情况下，通过所述用户的登录请求。此方法下，提高了系统登录的安全性。

Description

系统安全登录方法、装置、计算机设备和存储介质 技术领域
本申请要求于2020年2月14日提交中国专利局、申请号为CN 202010092464.5，发明名称为“系统安全登录方法、装置、介质及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
本申请涉及人工智能的身份验证技术领域，特别是涉及一种系统安全登录方法、装置、计算机设备和计算机可读存储介质。
 背景技术
随着互联网特别是移动互联网时代的发展，网络安全正变得越来越重要。目前，当用户登录一个系统或者软件时，常使用的身份校验方式有输入密码或验证码等。
 技术问题
发明人意识到，这些方式共同的缺陷是，若不法分子非法获取到了验证码或者密码，就可以进行登录，这样就无法保证登录的安全性。
 技术解决方案
在人工智能的身份验证技术领域，为了解决上述技术问题，本申请的目的在于提供一种系统安全登录方法、装置、计算机设备和计算机可读存储介质。
第一方面，提供了一种系统安全登录方法，包括：
当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；
接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；
根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；
在确定所述用户合法的情况下，通过所述用户的登录请求。
第二方面，提供了一种系统安全登录装置，包括：
发送模块，被配置为当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；
接收模块，被配置为接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；
确定模块，被配置为根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；
通过模块，被配置为在确定所述用户合法的情况下，通过所述用户的登录请求。
第三方面，提供了一种计算机设备，包括存储器和处理器，所述存储器用于存储所述处理器的系统安全登录的程序，所述处理器配置为经由执行所述系统安全登录的程序来执行以下处理：当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；在确定所述用户合法的情况下，通过所述用户的登录请求。
第四方面，提供了一种存储有计算机可读指令的计算机可读存储介质，其上存储有系统安全登录的程序，所述系统安全登录的程序被处理器执行时实现以下处理：当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；在确定所述用户合法的情况下，通过所述用户的登录请求。
 有益效果
上述系统安全登录方法、装置、计算机设备和计算机可读存储介质，一方面，通过向用户在消息推送系统的账号发送验证指令，使用户要登录的目标系统与接收验证指令的渠道分离，当不法分子使用其他用户的账户登录目标系统时，只要其他用户能够接收到消息推送系统发来的信息，就可以及时得知账户被盗，提高了登录的安全性；另一方面，由于必须是用户本人亲自加工得到的验证口令才能合法登录，进一步提高了登录的安全性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性的，并不能限制本申请。
 附图说明
图1是根据一示例性实施例示出的一种系统安全登录方法的系统架构示意图。
图2是根据一示例性实施例示出的一种系统安全登录方法的流程图。
图3是根据图2对应实施例示出的一实施例的步骤230的细节流程图。
图4是根据图3对应实施例示出的一实施例的步骤231的细节流程图。
图5是根据一示例性实施例示出的一种系统安全登录装置的框图。
图6是根据一示例性实施例示出的一种实现上述系统安全登录方法的计算机设备的示例框图。
图7是根据一示例性实施例示出的一种实现上述系统安全登录方法的计算机可读存储介质。
 本发明的实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
此外，附图仅为本申请的示意性图解，并非一定是按比例绘制。图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。
本申请首先提供了一种系统安全登录方法。此处的系统可以是各种软件系统，比如可以是数据库管理系统、财务管理系统、学籍管理系统等，甚至还可以是操作系统。系统登录是进入系统的过程，一般通过特定于一个系统的账户进行该系统的登录，系统登录后，可以进行一系列操作，比如使用系统的功能、访问系统上的信息、管理系统上的资源等。在进行系统登录时，可能是不合法用户在使用合法用户的账户登录，这样就造成了系统的不安全登录，而本申请提供的系统安全登录方法可以实现系统的安全登录。
本申请的实施终端可以是任何具有运算和处理功能的设备，该设备可以与外部设备相连，用于接收或者发送数据，具体可以是便携移动设备，例如智能手机、平板电脑、笔记本电脑、PDA（Personal Digital Assistant）等，也可以是固定式设备，例如，计算机设备、现场终端、台式电脑、服务器、工作站等，还可以是多个设备的集合，比如云计算的物理基础设施或者服务器集群。
可选地，本申请的实施终端可以为服务器或者云计算的物理基础设施。
图1是根据一示例性实施例示出的一种系统安全登录方法的系统架构示意图。如图1所示，该系统架构包括服务器110、智能手机120和消息推送服务器130，智能手机120由用户使用，服务器110、智能手机120和消息推送服务器130两两之间通过通信链路相连，可用于接收和发送数据，在本实施例中，服务器110为本申请的实施终端，服务器110上运行有目标系统，消息推送服务器130上运行有消息推送系统。当本申请提供的系统安全登录方法应用于图1所示的系统架构中时，用户登录服务器110上的目标系统的一个具体过程可以是这样的：用户事先向服务器110的目标系统进行注册时获得了第一账号并向目标系统发送了验证信息；用户通过使用智能手机120向服务器110发送登录请求，以请求登录服务器110上的目标系统，服务器110会根据该登录请求，向消息推送服务器130的消息推送系统发送指示消息，消息推送系统会根据该指示消息向智能手机120发送第一验证口令；智能手机120的用户对第一验证口令进行加工后生成第二验证口令，并将第二验证口令向服务器110发送，服务器110可以根据用户发来的第二验证口令和之前已获得的验证信息来确定用户是否合法，在确定合法的情况下，即通过该用户的登录请求。
具体而言，消息推送系统可以为微信公众号的消息推送系统，用户的智能手机120装有微信APP并关注了特定的公众号，通过该公众号可以向智能手机120推送第一验证口令，第一验证口令可以是一串文字，用户通过读出这串文字即可实现对第一验证口令的加工，加工生成的第二验证口令即为与这串文字对应的语音信息，通过智能手机120将该语音信息发送至服务器110，由于该语音信息与用户唯一对应，标识了用户的身份，因此，服务器可以利用特定的算法来根据该语音信息和已获得的用于验证的语音消息（验证消息）进行用户的合法性验证。
需要指出的是，图1仅为本申请的一个实施例。虽然在本实施例中的实施终端为服务器，但在其他实施例中，本申请的实施终端可以为如前所述的各种终端或设备；虽然在本实施例中，本申请的实施终端和运行了目标系统的终端为同一终端，但在其他实施例或者具体应用中，本申请的实施终端和运行了目标系统的终端可以为不同的终端；虽然在本实施例中，本申请的实施终端和运行了消息推送系统的终端为不同的终端，但在其他实施例或者具体应用中，本申请的实施终端和运行了消息推送系统的终端可以为同一终端。本申请对此不作任何限定，本申请的保护范围也不应因此而受到任何限制。
图2是根据一示例性实施例示出的一种系统安全登录方法的流程图。本实施例的系统安全登录方法可以由服务器执行，如图2所示，包括以下步骤：
步骤210，当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令。
其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联。
如前所述，本申请的实施终端可以是目标系统本身所在的设备，也可以是目标系统所在设备之外的终端设备，当本申请的实施终端为目标系统所在设备之外的终端设备时，本申请的实施终端内可以设有监控用户登录请求的模块。目标系统可以是各种软件系统，比如可以是数据库管理系统，目标系统可以包括一个或多个模块。第二账号对应的终端，即接收第一验证口令的终端，可以与用户请求登录目标系统使用的终端为同一终端，可以为不同的终端，易于理解，一般而言，终端通过账号登录一个系统，所以，消息推送系统的第二账号可以具有对应的登录终端。
用户发来的请求可以是基于各种协议的网络请求，比如可以是基于HTTP/HTTPS协议的请求。
向消息推送系统发送的指示可以是单纯的提醒消息，也可以是指令或代码，比如可以是脚本。
在一个实施例中，所述指示包括第一验证口令和所述用户在所述目标系统的第一账号，所述消息推送系统存储了第二账号与目标系统的第一账号的映射关系表，所述消息推送系统在获得所述指示后，首先提取所述指示中的第一验证口令和第一账号，然后通过查询第二账号与目标系统的第一账号的映射关系表，确定与所述指示中的第一账号对应的第二账号，最终向第二账号的登录终端发送第一验证口令。
在一个实施例中，向所述消息推送系统发送的指示包括第二账号，本申请的实施终端存储了第一账号与第二账号的对应关系，用户请求登录系统会上传第一账号，本申请的实施终端可以获取到第一账号，根据该对应关系确定对应的第二账号，然后根据确定出的第二账号生成指示并发送至所述消息推送系统，从而使所述消息推送系统的第二账号的登录终端可以获得第一验证口令。
所述消息推送系统可以是任何能够推送消息的系统，所述用户在所述目标系统的第一账号即为所述用户在所述目标系统的标识，比如可以是邮箱账号、身份证号、自定义账号、手机号等。
在一个实施例中，所述消息推送系统为短信系统，所述消息推送系统的第二账号为手机号。
在一个实施例中，所述消息推送系统为邮件发送系统，所述消息推送系统的第二账号为邮箱账号。
在一个实施例中，所述消息推送系统为用于在微信上向用户推送消息的系统，所述消息推送系统的第二账号为微信的账号。
比如，用于在微信上向用户推送消息的系统可以为微信公众号。
所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联，即，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号的对应关系在用户请求登录目标系统前即已确定。
比如，当消息推送系统为微信公众号时，用户使用其微信关注了该微信公众号，该用户的微信的账号即成为所述消息推送系统的第二账号。用户建立第二账号与第一账号的关联关系可以通过多种方式，例如可以是在微信公众号设置账号绑定入口，用户在注册了目标系统的第一账号后，将通过账号绑定入口将该第一账号提交，从而实现第一账号与第二账号的绑定；还可以是用户在注册了目标系统的第一账号后，在目标系统将关注该微信公众号的微信账号上传，实现第一账号与第二账号的绑定，其中，记录第一账号与第二账号的绑定关系的数据会被同步至微信公众号的后台。
在一个实施例中，在步骤210之前，所述方法还可以包括：
接收用户发来的注册信息；根据所述注册信息为所述用户生成所述目标系统的第一账号；接收所述用户上传的所述消息推送系统的第二账号，并将所述第二账号与所述第一账号关联。
在本实施例中，本申请的实施终端为目标系统所在的终端，通过接收注册信息以及第二账号，建立第二账号与第一账号的关联关系。
在一个实施例中，注册信息中包含了候选第一账号，所述根据所述注册信息为所述用户生成所述目标系统的第一账号，包括：提取所述注册信息中包含的候选第一账号；若所述目标系统中不存在与所述候选第一账号一致的账号，则将所述候选第一账号作为所述用户的第一账号。
在一个实施例中，所述根据所述注册信息为所述用户生成所述目标系统的第一账号，包括：若所述注册信息为首次注册的信息，则随机生成一个未生成过的账号作为与所述注册信息对应的第一账号。
步骤220，接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令。
其中，所述第一验证口令经过人工方式加工后，与用户的身份对应。
所述第一验证口令经过人工方式加工后，与用户的身份对应是指，所述第一验证口令本身不能用于身份验证，第一验证口令经过人工方式加工后得到的第二验证口令由于包含了人工加工的信息，与用户建立了唯一对应关系，可以标识用户的身份，因此可以用于身份验证。
比如，第一验证口令可以为符号组合，用人工方式加工过的所述第一验证口令，即对应的第二验证口令可以为用户手写输入的该符号组合，由于用户手写输入的该符号组合记录了用户的笔迹，而笔迹代表了用户的身份，因此可以用来验证用户是否合法。再比如，第一验证口令可以为符号组合，用人工方式加工过的所述第一验证口令，即对应的第二验证口令可以为用户读出该符号组合所发出的语音，由于语音包含了声纹信息，因此可以用来验证用户身份。符号组合包括多个符号，每一符号可以是字母、数字、文字中的一种。
步骤230，根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法。
在一个实施例中，步骤230的具体步骤可以如图3所示。图3是根据图2对应实施例示出的一实施例的步骤230的细节流程图。在图3所示实施例中，所述第一验证口令为使用户对应录入手写信息的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的手写信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的至少一个手写符号，所述符号组合为随机生成的与所述手写符号的类型相同的符号的组合，如图3所示，包括以下步骤：
步骤231，利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
根据所述符号组合对应录入的手写信息即为手写的该符号组合，符号组合与手写符号的区别在于，符号组合是计算机等设备输出的打印字体，而手写符号是用户人工手写的字体。
预先训练好的卷积神经网络模型可以用于执行图像识别等任务，还可以用来判断图像之间的相似度，在本实施例中，将手写符号视为图像，将手写符号输入至卷积神经网络模型，由卷积神经网络模型进行图像处理进而判断相似度。卷积神经网络模型可以是各种包含卷积层且能够识别图像相似度的模型，卷积神经网络模型除了卷积层之外，还可以包括其他结构，比如可以包括池化层、全连接层等，卷积神经网络模型还可以是基于卷积神经网络的模型，比如可以是基于卷积神经网络的生成式对抗网络模型、基于卷积神经网络的强化模型等。
在一个实施例中，预先获得的与所述第一账号对应的验证信息为用户提交的一个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：利用预先训练好的卷积神经网络模型获取所述手写信息中每一符号与所述验证信息中的手写符号的相似度；确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
由于平均值反映了参与平均的各相似度的集中程度，所以本实施例的好处在于，通过使用各相似度的平均值来判断用户是否合法，在一定程度上保证了判断结果的准确性。
在一个实施例中，步骤231的具体步骤可以如图4所示。图4是根据图3对应实施例示出的一实施例的步骤231的细节流程图。在本实施例中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，如图4所示，步骤231可以包括以下步骤：
步骤2311，针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度。
由于在本实施例中与所述第一账号对应的验证信息包括多个手写符号，假如与所述第一账号对应的验证信息中的手写符号的数目为m，而所述手写信息中符号的数目，即所述符号组合中包含的符号的数目为n，那么通过执行本步骤获得的相似度的数目为m*n。比如，若与所述第一账号对应的验证信息中的手写符号的数目为5，而所述手写信息中符号的数目，即所述符号组合中包含的符号的数目为6，那么获得的相似度的数目为5*6=30。
步骤2312，在获取的各相似度中确定出最小值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
在图4所示实施例中，通过将各相似度中的最小值作为整体相似度，也就是说，只有在各相似度中的最小值还大于预定相似度阈值时，才确定所述用户合法，提高了用户登录目标系统时验证的安全性。
在一个实施例中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：判断预先获得的与所述第一账号对应的验证信息中是否存在与所述手写信息中的符号内容一致的手写符号；如果是，对于预先获得的与所述第一账号对应的验证信息中和所述手写信息中的每一对内容一致的手写符号，利用预先训练好的卷积神经网络模型获取相似度，作为第一相似度；确定获取的各第一相似度的平均值，作为第一平均值；对于预先获得的与所述第一账号对应的验证信息中和所述手写信息中的每一对内容不一致的手写符号，利用预先训练好的卷积神经网络模型获取相似度，作为第二相似度；确定获取的各第二相似度的平均值，作为第二平均值；基于预先获得的权重确定所述第一平均值与所述第二平均值的加权和，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度；如果否，针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度；确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
在本实施例中，在预先获得的与所述第一账号对应的验证信息中存在与所述手写信息中的符号内容一致的手写符号时，通过分别获取内容一致的手写符号之间的相似度的平均值和内容不一致的手写符号之间的相似度的平均值，然后将两个平均值的加权和作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，使得最终获得的整体相似度分别体现了内容一致的手写符号之间的相似度和内容不一致的手写符号之间的相似度的不同作用，在一定程度上提高了确定所述用户合法时的准确性。
比如，若将内容一致的手写符号对应的第一相似度的权重设为0.7，而将内容不一致的手写符号对应的第二相似度的权重设为0.3，那么内容一致的手写符号对应的第一相似度在确定整体相似度时的作用更大，这意味着若内容一致的手写符号越相似，说明验证信息中的手写符号和手写信息中的符号更可能是同一人写的，就越应该将所述手写信息与预先获得的与所述第一账号对应的验证信息识别为相似，这样，对于合法的用户，就可以计算出更高的整体相似度，保证了合法用户能够被准确识别。
在一个实施例中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：利用预先训练好的卷积神经网络模型获取所述验证信息的多个手写符号中，两两手写符号之间的相似度，作为第三相似度；确定获取的各第三相似度的平均值，作为第三平均值；针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度，作为第四相似度；确定获取的各第四相似度的平均值，作为第四平均值；将所述第三平均值与所述第四平均值的比值作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
对于同一人手写的多个符号，模型也可能无法将每一对符号之间的相似度识别为1，在本实施例中，通过将第三平均值与第四平均值的比值作为整体相似度，在一定程度上减少了模型输出的相似度的误差所导致的整体相似度的误差，提高了用户合法性验证的准确性。
步骤232，若所述整体相似度达到预定相似度阈值，确定所述用户合法，否则确定所述用户不合法。
在图3所示实施例中，通过根据整体相似度与相应阈值的比较结果来确定用户是否合法，实现了对用户是否合法的准确判断。
在一个实施例中，所述第一验证口令为用于使用户对应录入语音的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的第一语音信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的第二语音信息，所述符号组合是随机生成的字符序列，所述根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法，包括：利用预先训练好的声纹识别模型确定所述第二语音信息与所述第一语音信息的声纹相似度；利用预先训练好的语音识别模型确定所述第一语音信息的内容；
若所述声纹相似度达到预定声纹相似度阈值且所述内容与所述符号组合一致，确定所述用户合法。
在本实施例中，通过语音和声纹对用户身份进行认证，无需输入密码，提高了用户在目标系统上登录的便捷性，同时，用户的终端可以收到验证口令，当有非法登录时，用户的终端可以获得提醒，提高了登录的安全性。
声纹识别模型可以确定出语音之间的声纹相似度，而语音识别模型可以识别出语音信息所指代的内容。声纹识别模型和语音识别模型可以是基于各种算法建立的模型，还可以通过调用外部接口来进行声纹相似度或语音的识别。比如，可以将GMM-UBM（Gaussian Mixture Model-Universal Background Model，高斯混合模型-通用背景模型），作为声纹识别模型；可以将DFSMN（Deep Feedforward Sequential Memory Networks，深层前馈序列记忆神经网络）模型，作为语音识别模型。
步骤240，在确定所述用户合法的情况下，通过所述用户的登录请求。
通过所述用户的登录请求，即，使所述用户登录到所述目标系统，用户在登录到目标系统上后，可以进行使用目标系统、管理目标系统上的资源等操作。
综上所述，根据图2实施例提供的系统安全登录方法，一方面，通过向用户在消息推送系统的账号发送验证指令，使用户要登录的目标系统与接收验证指令的渠道分离，当不法分子使用其他用户的账户登录目标系统时，只要其他用户能够接收到消息推送系统发来的信息，就可以及时得知账户被盗，提高了登录的安全性；另一方面，由于必须是用户本人亲自加工得到的验证口令才能合法登录，进一步提高了登录的安全性。
本申请还提供了一种系统安全登录装置，以下是本申请的装置实施例。
图5是根据一示例性实施例示出的一种系统安全登录装置的框图。如图5所示，装置500包括：   
发送模块510，被配置为当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；
接收模块520，被配置为接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；
确定模块530，被配置为根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；
通过模块540，被配置为在确定所述用户合法的情况下，通过所述用户的登录请求。
在一个实施例中，所述发送模块还被配置为在当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令之前：
接收用户发来的注册信息；
根据所述注册信息为所述用户生成所述目标系统的第一账号；
接收所述用户上传的所述消息推送系统的第二账号，并将所述第二账号与所述第一账号关联。
在一个实施例中，所述第一验证口令为使用户对应录入手写信息的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的手写信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的至少一个手写符号，所述符号组合为随机生成的与所述手写符号的类型相同的符号的组合，所述确定模块被进一步配置为：
利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度；
若所述整体相似度达到预定相似度阈值，确定所述用户合法，否则确定所述用户不合法。
在一个实施例中，预先获得的与所述第一账号对应的验证信息为用户提交的一个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
利用预先训练好的卷积神经网络模型获取所述手写信息中每一符号与所述验证信息中的手写符号的相似度；
确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
在一个实施例中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度；
在获取的各相似度中确定出最小值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
在一个实施例中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
判断预先获得的与所述第一账号对应的验证信息中是否存在与所述手写信息中的符号内容一致的手写符号；
如果是，对于预先获得的与所述第一账号对应的验证信息中和所述手写信息中的每一对内容一致的手写符号，利用预先训练好的卷积神经网络模型获取相似度，作为第一相似度；
确定获取的各第一相似度的平均值，作为第一平均值；
对于预先获得的与所述第一账号对应的验证信息中和所述手写信息中的每一对内容不一致的手写符号，利用预先训练好的卷积神经网络模型获取相似度，作为第二相似度；
确定获取的各第二相似度的平均值，作为第二平均值；
基于预先获得的权重确定所述第一平均值与所述第二平均值的加权和，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度；
如果否，针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度；
确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
在一个实施例中，所述第一验证口令为用于使用户对应录入语音的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的第一语音信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的第二语音信息，所述符号组合是随机生成的字符序列，所述确定模块被进一步配置为：
利用预先训练好的声纹识别模型确定所述第二语音信息与所述第一语音信息的声纹相似度；
利用预先训练好的语音识别模型确定所述第一语音信息的内容；
若所述声纹相似度达到预定声纹相似度阈值且所述内容与所述符号组合一致，确定所述用户合法。
根据本申请的第三方面，还提供了一种计算机设备，执行上述任一所示的系统安全登录方法的全部或者部分步骤。该计算机设备包括：
至少一个处理器；以及
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如上述任一个示例性实施例所示出的系统安全登录方法。
所属技术领域的技术人员能够理解，本申请的各个方面可以实现为系统、方法或程序产品。因此，本申请的各个方面可以具体实现为以下形式，即：完全的硬件实施方式、完全的软件实施方式（包括固件、微代码等），或硬件和软件方面结合的实施方式，这里可以统称为“电路”、“模块”或“系统”。
下面参照图6来描述根据本申请的这种实施方式的计算机设备600。图6显示的计算机设备600仅仅是一个示例，不应对本申请实施例的功能和使用范围带来任何限制。
如图6所示，计算机设备600以通用计算设备的形式表现。计算机设备600的组件可以包括但不限于：上述至少一个处理单元610、上述至少一个存储单元620、连接不同系统组件（包括存储单元620和处理单元610）的总线630。
其中，所述存储单元存储有程序代码，所述程序代码可以被所述处理单元610执行，使得所述处理单元610执行本说明书上述“实施例方法”部分中描述的根据本申请各种示例性实施方式的步骤。
存储单元620可以包括易失性存储单元形式的可读介质，例如随机存取存储单元（RAM）621和/或高速缓存存储单元622，还可以进一步包括只读存储单元（ROM）623。
存储单元620还可以包括具有一组（至少一个）程序模块625的程序/实用工具624，这样的程序模块625包括但不限于：操作系统、一个或者多个应用程序、其它程序模块以及程序数据，这些示例中的每一个或某种组合中可能包括网络环境的实现。
总线630可以为表示几类总线结构中的一种或多种，包括存储单元总线或者存储单元控制器、外围总线、图形加速端口、处理单元或者使用多种总线结构中的任意总线结构的局域总线。
计算机设备600也可以与一个或多个外部设备800（例如键盘、指向设备、蓝牙设备等）通信，还可与一个或者多个使得用户能与该计算机设备600交互的设备通信，和/或与使得该计算机设备600能与一个或多个其它计算机设备进行通信的任何设备（例如路由器、调制解调器等等）通信。这种通信可以通过输入/输出（I/O）接口650进行。并且，计算机设备600还可以通过网络适配器660与一个或者多个网络（例如局域网（LAN），广域网（WAN）和/或公共网络，例如因特网）通信。如图所示，网络适配器660通过总线630与计算机设备600的其它模块通信。应当明白，尽管图中未示出，可以结合计算机设备600使用其它硬件和/或软件模块，包括但不限于：微代码、设备驱动器、冗余处理单元、外部磁盘驱动阵列、RAID系统、磁带驱动器以及数据备份存储系统等。
通过以上的实施方式的描述，本领域的技术人员易于理解，这里描述的示例实施方式可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本申请实施方式的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质（可以是CD-ROM，U盘，移动硬盘等）中或网络上，包括若干指令以使得一台计算机设备（可以是个人计算机、服务器、终端装置、或者网络设备等）执行根据本申请实施方式的方法。
根据本申请的第四方面，还提供了一种计算机可读存储介质，其上存储有能够实现本说明书上述方法的程序产品，所述计算机可读存储介质可以是非易失性，也可以是易失性。在一些可能的实施方式中，本申请的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当所述程序产品在终端设备上运行时，所述程序代码用于使所述终端设备执行本说明书上述“示例性方法”部分中描述的根据本申请各种示例性实施方式的步骤。
参考图7所示，描述了根据本申请的实施方式的用于实现上述方法的程序产品700，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在终端设备，例如个人电脑上运行。然而，本申请的程序产品不限于此，在本文件中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
所述程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以为但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子（非穷举的列表）包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器（RAM）、只读存储器（ROM）、可擦式可编程只读存储器（EPROM或闪存）、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本申请操作的程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算机设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算机设备上部分在远程计算机设备上执行、或者完全在远程计算机设备或服务器上执行。在涉及远程计算机设备的情形中，远程计算机设备可以通过任意种类的网络，包括局域网（LAN）或广域网（WAN），连接到用户计算机设备，或者，可以连接到外部计算机设备（例如利用因特网服务提供商来通过因特网连接）。
此外，上述附图仅是根据本申请示例性实施例的方法所包括的处理的示意性说明，而不是限制目的。易于理解，上述附图所示的处理并不表明或限制这些处理的时间顺序。另外，也易于理解，这些处理可以是例如在多个模块中同步或异步执行的。
应当理解的是，本申请并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围执行各种修改和改变。本申请的范围仅由所附的权利要求来限制。

Claims (20)

  1. 一种系统安全登录方法，包括：
    当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；
    接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；
    根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；
    在确定所述用户合法的情况下，通过所述用户的登录请求。
  2. 根据权利要求1所述的方法，其中，在当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令之前，所述方法还包括：
    接收用户发来的注册信息；
    根据所述注册信息为所述用户生成所述目标系统的第一账号；
    接收所述用户上传的所述消息推送系统的第二账号，并将所述第二账号与所述第一账号关联。
  3. 根据权利要求1所述的方法，其中，所述第一验证口令为使用户对应录入手写信息的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的手写信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的至少一个手写符号，所述符号组合为随机生成的与所述手写符号的类型相同的符号的组合，所述根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法，包括：
    利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度；
    若所述整体相似度达到预定相似度阈值，确定所述用户合法，否则确定所述用户不合法。
  4. 根据权利要求3所述的方法，其中，预先获得的与所述第一账号对应的验证信息为用户提交的一个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
    利用预先训练好的卷积神经网络模型获取所述手写信息中每一符号与所述验证信息中的手写符号的相似度；
    确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
  5. 根据权利要求3所述的方法，其中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
    针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度；
    在获取的各相似度中确定出最小值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
  6. 根据权利要求3所述的方法，其中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
    判断预先获得的与所述第一账号对应的验证信息中是否存在与所述手写信息中的符号内容一致的手写符号；
    如果是，对于预先获得的与所述第一账号对应的验证信息中和所述手写信息中的每一对内容一致的手写符号，利用预先训练好的卷积神经网络模型获取相似度，作为第一相似度；
    确定获取的各第一相似度的平均值，作为第一平均值；
    对于预先获得的与所述第一账号对应的验证信息中和所述手写信息中的每一对内容不一致的手写符号，利用预先训练好的卷积神经网络模型获取相似度，作为第二相似度；
    确定获取的各第二相似度的平均值，作为第二平均值；
    基于预先获得的权重确定所述第一平均值与所述第二平均值的加权和，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度；
    如果否，针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度；
    确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
  7. 根据权利要求1所述的方法，其中，所述第一验证口令为用于使用户对应录入语音的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的第一语音信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的第二语音信息，所述符号组合是随机生成的字符序列，所述根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法，包括：
    利用预先训练好的声纹识别模型确定所述第二语音信息与所述第一语音信息的声纹相似度；
    利用预先训练好的语音识别模型确定所述第一语音信息的内容；
    若所述声纹相似度达到预定声纹相似度阈值且所述内容与所述符号组合一致，确定所述用户合法。
  8. 一种系统安全登录装置，包括：
    发送模块，被配置为当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；
    接收模块，被配置为接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；
    确定模块，被配置为根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；
    通过模块，被配置为在确定所述用户合法的情况下，通过所述用户的登录请求。
  9. 一种计算机设备，包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述处理器执行:
    当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；
    接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；
    根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；
    在确定所述用户合法的情况下，通过所述用户的登录请求。
  10. 根据权利要求9所述的计算机设备，其中，在当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令之前，所述计算机可读指令被所述处理器执行时，使得所述处理器还执行:
    接收用户发来的注册信息；
    根据所述注册信息为所述用户生成所述目标系统的第一账号；
    接收所述用户上传的所述消息推送系统的第二账号，并将所述第二账号与所述第一账号关联。
  11. 根据权利要求9所述的计算机设备，其中，所述第一验证口令为使用户对应录入手写信息的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的手写信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的至少一个手写符号，所述符号组合为随机生成的与所述手写符号的类型相同的符号的组合，所述根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法，包括：
    利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度；
    若所述整体相似度达到预定相似度阈值，确定所述用户合法，否则确定所述用户不合法。
  12. 根据权利要求11所述的计算机设备，其中，预先获得的与所述第一账号对应的验证信息为用户提交的一个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
    利用预先训练好的卷积神经网络模型获取所述手写信息中每一符号与所述验证信息中的手写符号的相似度；
    确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
  13. 根据权利要求11所述的计算机设备，其中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
    针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度；
    在获取的各相似度中确定出最小值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
  14. 根据权利要求11所述的计算机设备，其中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
    判断预先获得的与所述第一账号对应的验证信息中是否存在与所述手写信息中的符号内容一致的手写符号；
    如果是，对于预先获得的与所述第一账号对应的验证信息中和所述手写信息中的每一对内容一致的手写符号，利用预先训练好的卷积神经网络模型获取相似度，作为第一相似度；
    确定获取的各第一相似度的平均值，作为第一平均值；
    对于预先获得的与所述第一账号对应的验证信息中和所述手写信息中的每一对内容不一致的手写符号，利用预先训练好的卷积神经网络模型获取相似度，作为第二相似度；
    确定获取的各第二相似度的平均值，作为第二平均值；
    基于预先获得的权重确定所述第一平均值与所述第二平均值的加权和，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度；
    如果否，针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度；
    确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
  15. 根据权利要求9所述的计算机设备，其中，所述第一验证口令为用于使用户对应录入语音的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的第一语音信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的第二语音信息，所述符号组合是随机生成的字符序列，所述根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法，包括：
    利用预先训练好的声纹识别模型确定所述第二语音信息与所述第一语音信息的声纹相似度；
    利用预先训练好的语音识别模型确定所述第一语音信息的内容；
    若所述声纹相似度达到预定声纹相似度阈值且所述内容与所述符号组合一致，确定所述用户合法。
  16. 一种存储有计算机可读指令的计算机可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行：
    当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令，其中，所述消息推送系统的第二账号与所述用户在所述目标系统的第一账号相关联；
    接收所述用户上传的用人工方式加工过的所述第一验证口令，作为第二验证口令，其中，所述第一验证口令经过人工方式加工后，与用户的身份对应；
    根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法；
    在确定所述用户合法的情况下，通过所述用户的登录请求。
  17. 根据权利要求16所述的计算机可读存储介质，其中，在当用户请求登录目标系统，向至少一消息推送系统发送指示，以使所述消息推送系统根据所述指示向所述消息推送系统的第二账号的登录终端发送第一验证口令之前，所述计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器还执行：
    接收用户发来的注册信息；
    根据所述注册信息为所述用户生成所述目标系统的第一账号；
    接收所述用户上传的所述消息推送系统的第二账号，并将所述第二账号与所述第一账号关联。
  18. 根据权利要求16所述的计算机可读存储介质，其中，所述第一验证口令为使用户对应录入手写信息的符号组合，所述第二验证口令为用户根据所述符号组合对应录入的手写信息，预先获得的与所述第一账号对应的验证信息为第一账号的用户提交的至少一个手写符号，所述符号组合为随机生成的与所述手写符号的类型相同的符号的组合，所述根据所述第二验证口令和预先获得的与所述第一账号对应的验证信息确定所述用户是否合法，包括：
    利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度；
    若所述整体相似度达到预定相似度阈值，确定所述用户合法，否则确定所述用户不合法。
  19. 根据权利要求18所述的计算机可读存储介质，其中，预先获得的与所述第一账号对应的验证信息为用户提交的一个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
    利用预先训练好的卷积神经网络模型获取所述手写信息中每一符号与所述验证信息中的手写符号的相似度；
    确定获取的各相似度的平均值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
  20. 根据权利要求18所述的计算机可读存储介质，其中，预先获得的与所述第一账号对应的验证信息为用户提交的多个手写符号，所述利用预先训练好的卷积神经网络模型确定所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度，包括：
    针对预先获得的与所述第一账号对应的验证信息中的每一手写符号，利用预先训练好的卷积神经网络模型获取该手写符号与所述手写信息中每一符号的相似度；
    在获取的各相似度中确定出最小值，作为所述手写信息与预先获得的与所述第一账号对应的验证信息的整体相似度。
PCT/CN2020/104948 2020-02-14 2020-07-27 系统安全登录方法、装置、计算机设备和存储介质 WO2021159669A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010092464.5A CN111343162B (zh) 2020-02-14 2020-02-14 系统安全登录方法、装置、介质及电子设备
CN202010092464.5 2020-02-14

Publications (1)

Publication Number Publication Date
WO2021159669A1 true WO2021159669A1 (zh) 2021-08-19

Family

ID=71181548

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/104948 WO2021159669A1 (zh) 2020-02-14 2020-07-27 系统安全登录方法、装置、计算机设备和存储介质

Country Status (2)

Country Link
CN (1) CN111343162B (zh)
WO (1) WO2021159669A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113886780A (zh) * 2021-09-30 2022-01-04 平安银行股份有限公司 客户信息校验方法、装置、介质及电子设备
CN114401124A (zh) * 2021-12-29 2022-04-26 北京中科网威信息技术有限公司 防火墙登录方法、装置、电子设备及计算机程序产品
CN115001798A (zh) * 2022-05-30 2022-09-02 中国银行股份有限公司 手机银行登录方法及装置
CN115022002A (zh) * 2022-05-27 2022-09-06 中国电信股份有限公司 验证方式确定方法、装置、存储介质和电子设备
CN115174213A (zh) * 2022-07-05 2022-10-11 中国银行股份有限公司 身份认证方法及装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111343162B (zh) * 2020-02-14 2021-10-08 深圳壹账通智能科技有限公司 系统安全登录方法、装置、介质及电子设备

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102811228A (zh) * 2012-08-31 2012-12-05 中国联合网络通信集团有限公司 网络业务登录方法、设备和系统
CN103326989A (zh) * 2012-03-19 2013-09-25 上海博路信息技术有限公司 一种基于语音识别的验证码
CN105141427A (zh) * 2015-08-18 2015-12-09 赛肯(北京)科技有限公司 一种基于声纹识别的登录认证方法、装置及系统
US20160323450A1 (en) * 2013-09-24 2016-11-03 Telesign Corporation Call center sms verification system and method
CN106878018A (zh) * 2016-12-30 2017-06-20 腾讯科技（深圳）有限公司 操作验证方法及装置
CN107018138A (zh) * 2017-04-11 2017-08-04 百度在线网络技术（北京）有限公司 用于确定权限的方法和装置
CN107196893A (zh) * 2016-03-15 2017-09-22 百度在线网络技术（北京）有限公司 登录方法、登录服务器和登录客户端
CN111343162A (zh) * 2020-02-14 2020-06-26 深圳壹账通智能科技有限公司 系统安全登录方法、装置、介质及电子设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101488859A (zh) * 2009-02-27 2009-07-22 上海凌锐信息技术有限公司 基于笔迹识别的网络安全认证系统及其实现方法
CN104022879B (zh) * 2014-05-29 2018-06-26 金蝶软件（中国）有限公司 语音安全校验的方法及装置
CN109040051A (zh) * 2018-07-27 2018-12-18 郑州云海信息技术有限公司 一种bmc登录方法、系统、设备及计算机可读存储介质
CN110634492B (zh) * 2019-06-13 2023-08-25 中信银行股份有限公司 登录验证方法、装置、电子设备及计算机可读存储介质

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103326989A (zh) * 2012-03-19 2013-09-25 上海博路信息技术有限公司 一种基于语音识别的验证码
CN102811228A (zh) * 2012-08-31 2012-12-05 中国联合网络通信集团有限公司 网络业务登录方法、设备和系统
US20160323450A1 (en) * 2013-09-24 2016-11-03 Telesign Corporation Call center sms verification system and method
CN105141427A (zh) * 2015-08-18 2015-12-09 赛肯(北京)科技有限公司 一种基于声纹识别的登录认证方法、装置及系统
CN107196893A (zh) * 2016-03-15 2017-09-22 百度在线网络技术（北京）有限公司 登录方法、登录服务器和登录客户端
CN106878018A (zh) * 2016-12-30 2017-06-20 腾讯科技（深圳）有限公司 操作验证方法及装置
CN107018138A (zh) * 2017-04-11 2017-08-04 百度在线网络技术（北京）有限公司 用于确定权限的方法和装置
CN111343162A (zh) * 2020-02-14 2020-06-26 深圳壹账通智能科技有限公司 系统安全登录方法、装置、介质及电子设备

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113886780A (zh) * 2021-09-30 2022-01-04 平安银行股份有限公司 客户信息校验方法、装置、介质及电子设备
CN114401124A (zh) * 2021-12-29 2022-04-26 北京中科网威信息技术有限公司 防火墙登录方法、装置、电子设备及计算机程序产品
CN114401124B (zh) * 2021-12-29 2022-10-28 北京中科网威信息技术有限公司 防火墙登录方法、装置、电子设备及计算机存储介质
CN115022002A (zh) * 2022-05-27 2022-09-06 中国电信股份有限公司 验证方式确定方法、装置、存储介质和电子设备
CN115022002B (zh) * 2022-05-27 2024-02-06 中国电信股份有限公司 验证方式确定方法、装置、存储介质和电子设备
CN115001798A (zh) * 2022-05-30 2022-09-02 中国银行股份有限公司 手机银行登录方法及装置
CN115174213A (zh) * 2022-07-05 2022-10-11 中国银行股份有限公司 身份认证方法及装置
CN115174213B (zh) * 2022-07-05 2024-04-16 中国银行股份有限公司 身份认证方法及装置

Also Published As

Publication number Publication date
CN111343162B (zh) 2021-10-08
CN111343162A (zh) 2020-06-26

Similar Documents

Publication Publication Date Title
WO2021159669A1 (zh) 系统安全登录方法、装置、计算机设备和存储介质
US11669598B1 (en) Authenticating media data based on metadata encoding
US11847199B2 (en) Remote usage of locally stored biometric authentication data
US11153351B2 (en) Method and computing device for identifying suspicious users in message exchange systems
JP6429945B2 (ja) 音声データを処理するための方法及び装置
JP2022532677A (ja) 身元検証及び管理システム
US11244146B2 (en) Systems and methods for secure user logins with facial recognition and blockchain
CN107517207A (zh) 服务器、身份验证方法及计算机可读存储介质
US9703982B2 (en) Document distribution and interaction
EP3061025B1 (en) Method and system for authenticating service
WO2022142032A1 (zh) 手写签名校验方法、装置、计算机设备及存储介质
US12021864B2 (en) Systems and methods for contactless authentication using voice recognition
WO2021196935A1 (zh) 数据校验方法、装置、电子设备和存储介质
WO2022116487A1 (zh) 基于生成对抗网络的语音处理方法、装置、设备及介质
US11902275B2 (en) Context-based authentication of a user
WO2020233009A1 (zh) 身份验证方法、装置、计算设备和存储介质
US10855677B2 (en) Voice-based verification for multi-factor authentication challenges
CN110826036A (zh) 用户操作行为安全性的识别方法、装置和电子设备
US20090046708A1 (en) Methods And Systems For Transmitting A Data Attribute From An Authenticated System
KR102403471B1 (ko) 동형 암호화된 음성을 이용한 개인 식별 방법 및 시스템
CN109614780B (zh) 生物信息认证方法及装置、存储介质、电子设备
WO2024174714A1 (zh) 真实性验证方法和装置
WO2020252880A1 (zh) 反向图灵验证方法及装置、存储介质、电子设备
CN111291336B (zh) 游戏平台中游戏的注册方法、装置
CN116097619A (zh) 使用生物识别数据验证身份的系统和方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20918814

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 03/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20918814

Country of ref document: EP

Kind code of ref document: A1