Method and apparatus for service login based on third party's information

• US 9,450,939 B2
• Filed: 09/16/2014
• Issued: 09/20/2016
• Est. Priority Date: 09/29/2013
• Status: Active Grant

• Current Assignee: Tencent Technology Company Limited (Tencent Holdings Limited)
• Original Assignee: Tencent Technology Company Limited (Tencent Holdings Limited)
• Inventors: Zhou, Hao, Zhang, Wenrui, Huang, Tianqing, Cha, Wen, Cen, Lifang, Deng, Jinfu, Wang, Hui
• Primary Examiner(s): JHAVERI, JAYESH M
• Application Number:
  US14/487,621
• Publication Number:
  US 20150096004A1
• Time in Patent Office: 735 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method and apparatus for service login to a service provider sites have been disclosed. The method including: receiving a login request from a user, wherein the login request comprises at least both terminal'"'"'s login information input by the user and third party account information pertaining to the user; after successful verification on the third party account information, determining by the service provider, whether the terminal'"'"'s login information input by the user matches to reference login information, wherein the reference login information comprises specific information of the user to further identify user'"'"'s identity; if the terminal'"'"'s login information matches to at least a portion of the reference login information, delivering service to the terminal according to the third party account information.

Claims

1. A method for service login to a service provider, comprising:

receiving by the service provider, a login request from a user terminal, wherein the login request comprises at least;

terminal'"'"'s login information which is specific to the user terminal and is used by a user for login to the user terminal itself; and

an input of user'"'"'s third party account information which corresponds to an open account information acquired by the service provider for user'"'"'s third party account information verification by the service provider prior to verifying the terminal login information of the user;

after successful verification on the user'"'"'s third party account information, determining by the service provider;

whether the terminal'"'"'s login information matches to reference login information, wherein the reference login information comprises specific information of the user to further identify user'"'"'s identity;

if the terminal'"'"'s login information matches to at least a portion of the reference login information, delivering service to the terminal according to the successful verification of the third party account information;

wherein the terminal'"'"'s login information comprises an application identification code, and wherein the determining of whether the terminal'"'"'s login information input matches the reference login information, comprises;

acquiring the third party account information corresponding to the application identification code; and

when the third party account information from the login request being the same as the third party account information corresponding to the application identification code, confirming that the terminal'"'"'s login information matches the reference login information.

2. The method according to claim 1, wherein the determining of whether the terminal'"'"'s login information input matches the reference login information, comprises:

acquiring by the user terminal, the reference login information which corresponds to the third party account information, wherein;

when the terminal'"'"'s login information matches to at least a portion of the reference login information, confirming by the service provider that the login request is successful;

otherwise, confirming by the service provider that the login request is unsuccessful.

3. The method according to claim 1, wherein the user terminal'"'"'s login information comprises user'"'"'s login time, and wherein the determining of whether the terminal'"'"'s login information input matches the reference login information, comprises:

acquiring a designated user'"'"'s login time period corresponding to the third party account information, wherein a user'"'"'s login statistical value of the third party account information within the acquired user'"'"'s designated login time period being greater than a first preset threshold, wherein;

when the user'"'"'s login time is within the user'"'"'s designated login time period, confirming that the user'"'"'s login information matches the reference login information;

otherwise, confirming that the login information does not match the reference login information.

4. The method according to claim 1, wherein,

when the third party account information from the login request is not the same as the third party account information corresponding to the application identification code, confirming that the terminal'"'"'s login information does not match the reference login information code.

5. The method according to claim 2, wherein a login statistical value corresponding to the terminal'"'"'s login information in the reference login information being greater than a second preset threshold.

6. The method according to claim 1, further comprising:

if the terminal'"'"'s login information does not match the reference login information, verifying the user terminal according to a preset verification mode associated with the third party account information;

when the verification is successful, delivering the service to the user terminal according to the third party account information.

7. The method according to claim 6, wherein the verifying of the terminal according to the preset verification mode associated with the third party account information, comprises:

sending a designated verification code to a mobile phone number associated with the third party account information when short message verification is the preset verification mode, wherein the designated verification code is to be entered as an additional input to the user terminal;

confirming that the verification of the user terminal is successful when the designated verification code received from the user terminal as the additional input is the same as the sent designated verification code corresponding to the third party account information, otherwise, the verification of the user terminal is not successful.

8. The method according to claim 6, wherein the verifying of the user terminal according to the preset verification mode associated with the third party account information, comprises:

sending a verification link to an electronic mailbox (e-mail) associated with the third party account information when e-mail verification is the preset verification mode, wherein the verification link is to be visited on the user terminal;

confirming that verification of the user terminal is successful when a network address corresponding to the verification link has been visited on the user terminal within an interval of a first preset duration, otherwise, the verification of the user terminal is not successful.

9. The method according to claim 6, wherein the verifying of the user terminal according to the preset verification mode associated with the third party account information, comprising:

sending a designated verification code to an instant messaging application account associated with the third party account information when instant messaging application verification is the preset verification mode, wherein the designated verification code is to be entered as an additional input to the user terminal;

confirming that verification of the user terminal is successful when the designated verification code received from the user terminal as the additional input is the same as the sent designated verification code corresponding to the third party account information, otherwise, the verification of the user terminal is not successful.

10. The method according to claim 6, wherein the verifying of the terminal according to the preset verification mode associated with the third party account information, comprises:

providing a backup data verification prompt associated with the third party account information when backup data verification is the preset verification mode, wherein the prompted backup data is to be entered as an additional input to the user terminal;

confirming that verification of the user terminal is successful when the backup data received from the user terminal as the additional input matches the prompted backup data corresponding to the third party account information, otherwise, the verification of the user terminal is not successful.

11. The method according to claim 10, wherein the backup data verification comprises one or more of:

biometric verification and text information verification, and the providing of the backup data verification prompt associated with the third party account information when backup data verification is the preset verification mode, comprises;

providing a biometric data input prompt associated with the third party account information when biometric data verification is the preset verification mode, wherein the biometric data is to be entered as an additional input to the user terminal;

confirming that the backup data associated with the third party account information verification of the user terminal is successful when the biometric data received from the user terminal as the additional input matches the biometric data corresponding to the third party account information, otherwise, the verification of the user terminal is not successful;

or

providing a text information input prompt associated with the third party account information when text information verification is the preset verification mode, wherein the text information is to be entered as an additional input to the user terminal;

confirming that the backup data associated with the third party account information verification of the terminal is successful when the received text information matches the backup data associated with the third party account information, otherwise, the verification of the terminal is not successful.

12. The method according to claim 11, wherein the biometric data verification comprises one or more of:

fingerprint information verification, voice verification, semantic verification, iris verification, heartbeat verification and facial features verification.

13. The method according to claim 11, wherein the text information verification comprises one or more of:

password card verification, digital certificate verification, signature information verification, preset question verification and preset trajectory verification.

14. The method according to claim 1, wherein after performing the verification according to the third party account information, the method further comprises:

omitting further login request after a number of consecutively received login requests have failed verifications and the number has exceeded a third preset threshold.

15. The method according to claim 1, wherein the terminal'"'"'s login information comprises application identification code, and the method further comprises:

omitting a designated login request if a number of times the designated login request has received within a second preset duration has exceeded a fourth preset threshold, wherein the designated login request carries the application identification code, and wherein the third party account information carried by each designated login request being different.

16. The method according to claim 1, wherein the reference login information comprises one or more of:

terminal identifier, terminal equipment serial number, application identification code, terminal IP address, terminal geographical position information and terminal login time.

17. The method as defined in claim 1, further comprising:

determining whether an open account information corresponding to the third party account information has already been saved on a server according to the third party account information when a login request is received;

the verification of the third party account information is successful when it is determined that the open account information corresponding to the third party account information has already been saved on the service provider'"'"'s server.

18. An apparatus in a service provider server for service login, comprising at least a processor operating in conjunction with at least a memory which stores instruction codes operable by the processor to configure the apparatus to:

receive a login request from a user, wherein the login request comprises at least terminal'"'"'s login information which is specific to a terminal which is used by the user for login to the terminal itself, and an input of user'"'"'s third party account information which corresponds to an open account information acquired by the service provider server for user'"'"'s third party account information verification by the service provider server prior to verifying the terminal login information of the user;

after successful verification by the service provider server on the user'"'"'s third party account login information, judge whether the terminal'"'"'s login information matches to reference login information, wherein the reference login information comprises specific information of the user to further identify user'"'"'s identity;

if the terminal'"'"'s login information matches to at least a portion of the reference login information;

deliver service to the user terminal according to the successful verification of the third party account information;

wherein the terminal'"'"'s login information comprises an application identification code, and wherein the determining of whether the terminal'"'"'s login information input matches the reference login information, comprises;

acquiring the third party account information corresponding to the application identification code; and

when the third party account information from the login request being the same as the third party account information corresponding to the application identification code, confirming that the terminal'"'"'s login information matches the reference on information.

19. The apparatus according to claim 18, wherein the apparatus is configured to:

acquire the reference login information which corresponds to the third party account information;

determine that when the terminal'"'"'s login information matches to at least a portion of the reference login information, confirming by the service provider that the login request is successful;

otherwise, confirming by the service provider that the login request is unsuccessful.

20. The apparatus according to claim 18, wherein the terminal'"'"'s login information comprises user'"'"'s login time, wherein the apparatus is configured to:

acquire a designated user'"'"'s login time period corresponding to the third party account information, wherein a user'"'"'s login statistical value of the third party account information within the acquired user'"'"'s designated login time period being greater than a first preset threshold;

determine that when the user'"'"'s login time is within the user'"'"'s designated login time period, confirm that the user'"'"'s login information matches the reference login information;

otherwise, confirm that the login information does not match the reference login information.