Device Guard is a lightweight alternative to the ID Verification service, designed for scenarios where a full integration of the ID Verification service is not feasible. This solution uses the Tongyi Large Language Model to deeply analyze device risks in the authentication environment and independently detect potential risks.
Integration overview
Before you integrate Device Guard, you must have a mature facial recognition algorithm and a comprehensive risk management system. Contact your account manager to assess if this solution fits your business scenario.
Device Guard can identify device risks on different clients. System environment and permission requirements vary across client platforms. For specific configuration details, see the "Usage notes" section in the integration guide for your client.
The overall workflow for Device Guard is as follows: the client collects device information and reports it to the server to identify risks. Your application server then calls a query API to retrieve detailed device risk tags.
To integrate this solution, you need to build both an application server (hereafter referred to as "the server") and a client. For the specific interaction logic, see the sequence diagram below.
The Device Guard workflow is divided into the following two phases:
Phase 1: Data collection and reporting: This phase runs only on the client. The SDK automatically communicates with the Device Guard server to report information. Therefore, you must ensure that the client has network access to Alibaba Cloud servers.
Phase 2: Result retrieval and business processing: This phase requires your server. The server calls a query API to get risk detection results, executes your business logic, and returns the final result to the client.
If you also integrate a non-Alibaba Cloud facial recognition service, follow these timing guidelines when making calls from the client:
Timing 1 (initialization): Call the SDK initialization API when the user enters the authentication guide page, or even earlier. This ensures that the environment is ready before facial recognition begins.
Timing 2 (token retrieval): Call the
getDeviceTokenAPI after the user completes the facial scan. Ensure at least a 3-second interval between this call and initialization.
When you call the getDeviceToken API, you must pass in a bizId, the unique identifier for the current facial scan. This identifier links the device token to the business authentication record. When your server queries for the risk result, it can pass in the same bizId to ensure the detection result corresponds to the correct business transaction.