Shulou(Shulou.com)06/03 Report--

2015 Annual Report on Network Trusted Identity Development Ali Mobile Security

Chapter 1: The Development Status of Network Trusted Identity in 2015 1.1 New Changes in the Demand for the Development of Network Trusted Identity

In 2002, China began to explore the construction of network real-name system, its essential purpose is to ensure the credibility of cyberspace users, to avoid rumors, fraud and other illegal and criminal acts. In years of practice, network platforms or users carry out network identity authentication mainly because of the following two requirements:

On the one hand, in order to ensure the healthy and orderly development of the industry, the relevant functional departments of the state require Internet users engaged in business or service quality to carry out necessary identity authentication, such as e-commerce operators (online shopkeepers) and Internet access service providers (domain name registration, cyberspace rental, etc.).

On the other hand, in order to protect the legitimate rights and interests of individual Internet users and maintain the healthy development of enterprise business, the network platform will also take some measures to prevent its own users from being infringed by illegal and criminal acts. In 2015, the demand for the development of network trusted identity has produced some new changes, mainly reflected in the following two aspects:

First, the development of network credible identity has risen to the height of national strategy and has become an important foundation for supporting the development of "Internet +." As of December 2015, the total number of Internet users in China has reached 688 million, and how to effectively manage the Internet has become an important issue to promote further social and economic development.

Second, the development of emerging Internet services has prompted individual Internet users to voluntarily provide personal real identity information to obtain certain services. In the past, very few users were willing to actively provide their names and ID numbers for real-name registration, but this phenomenon is gradually changing. For example, users of Internet credit products voluntarily provide their own information to present their credit status, thus obtaining corresponding value-added services.(such as credit consumption, credit visa, etc.); The development of Internet + policing enables users to quickly handle related services after identity authentication, greatly improving the service efficiency of relevant government departments; Internet matchmaking users increase the probability of successful matchmaking through real-name authentication and multi-directional provision of their personal information... The development of these new services has brought new opportunities to the construction of trusted identities in cyberspace.

1.2 Problems in the Development of Trusted Identity on the Internet

1. Destroy network trusted identity authentication, black gray industry chain is emerging

Identity authentication is an important means to ensure the credibility of cyberspace identity. Because false identity network accounts are important tools for network illegal and criminal activities, a series of black and gray industrial chains with false identity and counterfeit identity of others to destroy the credibility of network identity have been derived. These industrial chains include the following types:

a) Using *** means to steal citizen identity information in batches

For example, companies in hotels, insurance, aviation, medical care, express delivery and other industries have encountered information leakage incidents. According to the Survey Report on Protection of Rights and Interests of Chinese Internet Users (2015), nearly 80% of Internet users 'personal identity information has been leaked, including Internet users' names, academic qualifications, home addresses, ID card numbers and work units, etc., and personal information leakage has brought troubles to the daily life of Internet users.

b) Illegal collection and trafficking of identity materials

In addition to the theft of digital identity information, there is also an active industrial chain for the collection and sale of citizen entity identity information in real life, including the sale of entity identity cards. According to incomplete statistics, there are more than 300 QQ groups and Qzone for ID card trading, and it is estimated that there are more than 250,000 active people (as shown in the figure below).

Cyberspace for illegal ID card sales

At present, there are two main ways to obtain identity materials in the black ash industry chain: one is to steal and lose certificates and resell them; the other is to make use of citizens 'weak awareness of personal identity information protection, fabricate various false purposes, or defraud identity materials by using small profits (such as part-time recruitment, winning registration, etc.). This method has spread from rural areas with low Internet penetration to factories and schools, which shows the rampant black ash production.

According to statistics, the identity cards used for false authentication mainly come from Henan, Sichuan, Hubei, Hunan and other identities, while the use of these identities for false network authentication is concentrated in Guangdong, Fujian, Zhejiang, Jiangsu and other coastal areas.

Regional Distribution of False Identity Authentication

c) Handling mobile phone cards and bank cards with false identities

Because mobile phone number and bank card verification are important auxiliary means of network real-name verification at present, black and gray industrial chains such as mobile phone card, ID card and theft without real name registration have been derived.

According to incomplete statistics, at present, the number of mobile phone cards without real name registration circulating in gray production reaches 100 million, and the price of obtaining a mobile phone card without real name registration is about 50-100 yuan (including certain telephone charges). However, these mobile phone cards without real name registration are also used by lawbreakers to receive mobile phone short message Captcha in batches by using cat pool, SMS Captcha platform and other technical means, breaking through the way of identity authentication by using mobile phone Captcha.

At present, a one-stop service for bank card acquisition, sales and use has been formed in the black and gray industry chain, and it is sold together with ID card, USBKey, mobile phone card, account opening information, etc. At present, the amount of a set of bank card materials sold on the market is about 100 yuan, and the amount of a common card sold is 200 yuan. The price of a complete set of bank card materials, such as USBKey and account opening materials, ranges from 400 to 600 yuan. The price of bank cards is much higher than that of mobile phone cards, but the market is still huge and the harm is more serious.

Examples of advertisements for bank cards with false identities

Chuzhou police cracked a case of illegally selling ID cards and bank cards online

d) Use technical means to break through the network identity authentication process

This includes falsification of identity information, falsification of identification materials, use of software to modify mobile phone or computer parameters to break through the authentication process, etc. Because of the great harm of this kind of industrial chain, there are great differences compared with offline illegal and criminal acts. Therefore, legislative, judicial and other administrative organs have different cognition on it, it is difficult to determine punishment, fail to carry out effective management and punishment, and fail to form effective deterrent to illegal and criminal acts.

2. Protection of Personal Information

In the current development of trusted identity in cyberspace, the protection of citizens 'personal information should not be underestimated. The information leakage incident in South Korea in 2011 and the largest network theft case in the recent financial history of the United States are warning the whole society. In this regard, the state has also issued a lot of laws, regulations and norms for the protection of citizens 'personal information, but at present, there is no special law on the protection of citizens' information in our country, and the scope of information protection is also a little single, and many relevant laws and norms of real-name system are still in the process of soliciting opinions, and no legal and regulatory system has been formed yet. Because of the limitation of adjustment scope and adjustment method, the current law cannot provide a complete solution for the protection of citizens 'personal information.

In the network trusted identity industry, most of them are still solving the problem of identity authentication, and there are few protection information service businesses, which also bring great challenges in daily business development. Therefore, the protection of citizens 'personal information should not only be guaranteed by systematic laws and regulations and administrative management, but also encourage the development of personal information protection industry.

Chapter II Development of Alibaba Real Person Authentication in 2015 2.1 Serving Alibaba Ecology and Improving Real Person Authentication Ability

In 2015, Aliju security real person authentication has served more than ten scenarios such as Taobao market personal store opening authentication, second-hand transaction user authentication, advertising user authentication, virtual operator card sales real person authentication, etc. The following aspects have been greatly improved:

First, the certification of product service capabilities. By serving a large number of users in multiple scenarios, the reliability of real person authentication has been effectively verified in practice.

Second, portrait recognition, living detection and other capabilities are iteratively upgraded in practice to reach the world's leading level;

Third, based on big data risk identification and interception, a huge risk database has been accumulated to identify nearly 10 million identity fraud and fraudulent use.

Fourth, leading data security systems. Aliju Security has built a safe and reliable underlying security architecture, including the world's leading remote multi-active data center, and established the most complete disaster recovery backup system; OceanBase, a massive relational database independently developed, is the first database with independent intellectual property rights in China to ensure the strategic security of national data.

2.2 Promote the change of mobile phone card real name registration

In 2015, Alibaba transformed the online card sales and card opening process of Alibaba Communications to realize the real person authentication of online mobile phone number purchase and card opening. The real person authentication of mobile phone card purchase has been effectively upgraded on the basis of the original mobile phone real-name registration system. While greatly improving the validity of mobile phone number user identity, it eliminates the link of recovering user identity information in the process of logistics sending mobile phone card, and provides convenience to users while reducing the risk of information leakage. Alibaba's move has been fully affirmed by the Ministry of Industry and Information Technology and plays an important role in promoting the development of the information and communication industry and promoting the transformation and upgrading of the industry.

2.3 Serving "Uncle Police" to Improve Citizens 'Experience

On January 5,2016, Hangzhou City Public Security Bureau launched the police APP"Uncle Police" in response to the policy guidelines of "Smart City" and "Civilized City." This application used the real person authentication technology for the first time nationwide through the form of Internet + police. The application enables citizens to conveniently do things online on their mobile phones, improving the experience and efficiency of government affairs.

Police Uncle APP

2.4 Participate in the establishment of network trusted identity industry alliance

In 2015, under the promotion of the First Research Institute of the Ministry of Public Security, Alibaba participated in the establishment of the Network Trusted Identity Industry Alliance, aiming to promote the establishment of a network trusted identity system through the joint development of industries and industries. At the 2015 Wuzhen World Internet Conference, Alibaba participated as a pilot unit for online application of Chinese resident ID cards, and Alibaba's experience and achievements in the construction of network trusted identity system were widely recognized and praised.

Participate in the online application display of Chinese resident ID card at the World Internet Conference

Chapter III Development Trend of Network Identity Authentication in 2016 3.1 Development from Real Name Authentication to Real Person Authentication

At present, false identity brings great convenience to cybercrime. The development of black and gray industry chain has caused a large number of real names in the existing cyberspace. The real name system cannot play its real role and effect. According to the Survey Report on the Protection of Rights and Interests of Chinese Internet Users (2015), in the past year, Internet users have suffered an overall loss of about 80.5 billion yuan due to personal information disclosure, spam, fraud and other problems, of which about 45 million Internet users have suffered economic losses of more than 1000 yuan in the past year. Because real person authentication needs to meet the requirements of authenticity, validity and consistency of user identity at the same time, it will greatly increase the cost of illegal crime and play a vital role in purifying cyberspace.

At the same time, the development of emerging services also puts forward higher requirements for the authenticity of user identity. For example, with the emergence of online taxis, passengers put forward higher requirements for the authenticity and reliability of driver identity; the premise of online matchmaking and e-government is also based on the authenticity of user identity. Therefore, with the continuous development of Internet +, real person authentication will become the basic requirement for many business development.

3.2 Big data risk identification and biometric technologies will drive new changes

In the past, not only how to ensure the authenticity of user identity is a big problem, but also an important factor is how to ensure the authenticity of user identity without harming most normal user experience, and will not reject users because of the high threshold of identity authentication. The reason for this series of problems lies in the unity of identity authentication methods. As long as the authentication method is fixed, the difficulty of breaking through the black gray industry chain will be greatly reduced. Once the difficulty of this single authentication method is increased, it will have an impact on all users. In recent years, the continuous development of big data analysis and biometric technology will effectively change this situation.

On the one hand, risk identification using big data can effectively analyze user behavior, so as to accurately classify and stratify users, judge the authentication motivation of each user in real time, adopt different authentication methods for users with different risk levels, and ensure the quick experience of normal users, while risk users cannot simply pass authentication by stealing other people's information. The full use of big data can guarantee the validity of single authentication, and at the same time, it can carry out secondary authentication on accounts that may be stolen or bought and sold through early warning identification of abnormal behaviors of accounts, so as to ensure the continuous validity of identity information.

On the other hand, the development of biometric technology and the popularity of smart phones have made it possible for biometric technology to be used for network authentication, including the current portrait and fingerprint authentication methods, while the development of voiceprint and iris recognition technology will greatly enrich the way of identity authentication and enhance the reliability of real person authentication.

3.3 Identity data protection becomes a top priority

Data security is the lifeline of network authentication. Identity data protection is a full-link systematic work, including authentication equipment, client program, network transmission, server and other all-round technical upgrading and mechanism guarantee. In recent years, frequent user information leakage incidents have sounded the alarm for us, prompting identity data security to enter a more comprehensive development stage.

The full PDF version of the 2015 Internet Trusted Identity Development Annual Report, please click here

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.