Safety certification device for internet bank remote payment based on multi-interface safety smart card
The technical field is as follows:
the utility model relates to a safety certification device of online bank remote payment based on many interfaces safety smart card.
Background art:
since its birth, bank cards have always existed and developed in the form of magnetic stripe cards. While the magnetic stripe card brings convenience to people, the magnetic stripe card is very easy to copy, and brings high fund risk to the bank card set woven belt. In order to prevent the fraud risk of the magnetic stripe card, the bank card organization introduced the strategy of migrating the bank card from the magnetic stripe card to the smart chip card (i.e. EMV migration). Migration has been implemented in many countries and regions. At present, China also enters a transition stage of upgrading a magnetic stripe card to an intelligent chip bank card, and both domestic technical conditions and card using environments are provided. In the upgrading process, the mode that the intelligent chip bank card directly adopts the multi-interface (namely a contact interface, a non-contact interface and a human-computer interaction interface) secure intelligent card is undoubtedly a one-step selection. The system can realize various transactions including PBOC2.0 and EMV through a contact interface, and ensure the safety; the functions of safe micropayment transaction and the like can be realized through a non-contact interface; but also can display key transaction information to the user by using a man-machine interaction interface of the smart card and can wait for the key pressing confirmation of the user. Therefore, the user can easily realize one card for multiple purposes.
The Internet bank is also called on-line bank and Internet bank, which means that the bank provides traditional service items such as opening an account, selling an account, inquiring, reconciling, in-line transfer, cross-line transfer, credit, online stock certificates, investment and financing and the like to a customer through the Internet by using the Internet technology, so that the customer can safely and conveniently manage the current and regular deposit, checks, credit cards, personal investment and the like without going out.
Since online transactions are not face-to-face, users can make requests at any time and any place, and the traditional identification method usually authenticates the identity of the user by a user name and a login password. However, if the password of the user is transmitted over the network in a plaintext manner during login, the password is easily intercepted by an attacker, and further the identity of the user can be counterfeited, so that the identity authentication mechanism can be broken.
At present, the online bank personal authentication media (security tools) mainly include: passwords, file digital certificates, dynamic password cards, dynamic cell phone passwords, mobile password tokens, mobile digital certificates, and the like. The mobile digital certificate is actually a kind of usb key. Different banks in China are called differently, such as the Ministry of industry called U shield and the Ministry of agriculture called K Bao. The USBKey stores personal digital certificates of users. The personal identity authentication through the USBKey is the relatively most safe mode in the existing online bank personal authentication method.
One of the problems of using the USBKey authentication method is that in addition to the requirement of applying for a bank card before the banking business is launched, the user needs to be additionally provided with a corresponding USBKey. With the increasing popularity of online banking, users who select the usb key to protect the security of the online banking have reached a considerable number. If the bank card of the multi-interface security smart card is used, the multi-interface security smart bank card can be directly used to replace the USBKey. Therefore, the method can save a considerable cost for distributing the USBKey and has good social and economic benefits. Meanwhile, when the user uses the internet bank, the user can use the internet bank more conveniently because only the multi-interface security smart card (appearing in a bank card mode) is needed to be owned and the USBKey is not needed to be additionally used.
In addition, the USBKey is not absolutely safe, and the USBKey which is widely applied at present actually has two security vulnerabilities: 1) there is a vulnerability to the interactive operation. An attacker can carry out remote control, and impersonates the USBKey of the user to carry out identity authentication, but the user cannot know the USBKey. 2) Data cannot be prevented from being tampered. Before the user sends the USB Key to encrypt, the user may be tampered with another transaction by an attacker intercepting screen, so that the user can tamper with the transaction without knowing the user and the authentication is passed. The above two security problems can be solved by combining the human-computer interaction interface in the multi-interface security smart card. The key information of each transaction is displayed on a display interface in the human-computer interaction interface of the multi-interface security intelligent card, and the transaction can be normally and successfully carried out only after a user presses a confirmation key on the human-computer interaction interface of the multi-interface security intelligent card, so that the safety and reliability of the transaction are ensured.
The invention content is as follows:
an object of the utility model is to overcome exist among the prior art not enough and provide a realize the safety certification device based on online bank remote payment of many interfaces safety smart card based on public key certificate under the support of many interfaces safety smart card.
The purpose of the utility model is realized like this: including certificate server, the bank server that is connected with certificate server, its characterized in that: the bank online bank server is connected with the multi-interface security intelligent card through a non-contact transmission channel of the security authentication information.
The non-contact type transmission channel of the security authentication information comprises a computer connected with the bank internet bank server, a non-contact type intelligent card reader-writer connected with the computer, and a multi-interface security intelligent card connected with the non-contact type intelligent card reader-writer in a non-contact manner, wherein an intelligent card reader-writer module suitable for a non-contact interface of the multi-interface security intelligent card is installed on the computer.
The non-contact type transmission channel of the security authentication information comprises a wireless communication line connected with a bank internet bank server, a mobile phone terminal with a short-distance wireless communication module, and a multi-interface security smart card connected with the mobile phone terminal, wherein the short-distance wireless communication module in a non-contact type smart card reader-writer mode is arranged in the mobile phone terminal.
The multi-interface security smart card is characterized in that a man-machine interaction interface with an ultrathin flexible display, a flexible film key and an ultrathin flexible battery is added on the basis of the traditional contact interface and non-contact interface multi-interface security smart card, the man-machine interaction interface is used for displaying some key information for a user and waiting for an interface confirmed by key input of the user, and the multi-interface security smart card conforms to the Chinese financial Integrated Circuit (IC) card specification (V2.0), the non-contact payment IC card payment specification and the international standard ISO10536 series standard, supports ISO/IEC 14443-A and ISO/IEC 7816 protocols and supports a cryptographic algorithm approved by the national cryptographic administration, and the cryptographic algorithm comprises SM1, SSF33, RSA and abstract algorithms and can be used as smart card products of multi-interface smart bank cards.
The related data to be transmitted and received between the computer or the mobile phone terminal and the bank internet bank server are transmitted to the multi-interface security intelligent card for digital signature, encryption and decryption processing on the basis of the establishment of the non-contact transmission channel, and the result is returned.
The utility model discloses have following positive effect: the multi-interface security smart card is applied to security authentication of remote payment to an online bank (hereinafter referred to as online bank), and the security authentication of the remote payment of the online bank can be realized by using the multi-interface security smart card. Through the establishment of a non-contact transmission channel between a computer or a mobile phone terminal with a short-distance wireless communication module and the multi-interface security smart card, the security function of the multi-interface security smart card can be utilized to carry out operations such as identity authentication, data encryption and the like, thereby realizing the remote payment of the internet bank. On the basis, after the multi-interface security intelligent card is used as a multi-interface intelligent bank card, the multi-interface security intelligent card can be directly used for replacing the traditional USBKey, so that the cost for distributing the USBKey can be saved, and the multi-interface security intelligent card has good social and economic benefits. Meanwhile, when the user uses the internet bank, the user does not need to additionally use the USBKey because the user only needs to have the multi-interface security smart card (appearing in a bank card mode), so that the user (particularly the user of the mobile phone terminal with the short-distance wireless communication module) can use the internet bank more conveniently. In addition, key information of each transaction is displayed on a display interface in the human-computer interaction interface of the multi-interface security smart card by combining with the human-computer interaction interface in the multi-interface security smart card, and the transaction can be normally and successfully carried out only after a user presses a confirmation key on the human-computer interaction interface of the multi-interface security smart card, so that two security loopholes of the currently and widely applied USBKey are well solved, namely: 1) there is a vulnerability to the interactive operation. An attacker can carry out remote control, and impersonates the USBKey of the user to carry out identity authentication, but the user cannot know the USBKey. 2) Data cannot be prevented from being tampered. Before the user sends the USB Key to encrypt, the user may be tampered with the screen by an attacker, so that the user can tamper with the transaction without knowing and the authentication is passed, thereby ensuring the safety and reliability of the transaction.
Description of the drawings:
fig. 1 is a basic schematic diagram of the present invention.
Fig. 2 is a schematic diagram of the establishment of a non-contact transmission channel between a computer and a multi-interface security smart card according to the present invention.
Fig. 3 is the schematic diagram of the establishment of the non-contact transmission channel between the mobile phone terminal and the multi-interface security smart card of the present invention.
Fig. 4 is a schematic diagram of the certificate distribution process of the present invention.
Fig. 5 is a schematic diagram of the security authentication protocol of the present invention.
The specific implementation mode is as follows:
as shown in fig. 1, the utility model discloses a certificate server, the bank online bank server that is connected with certificate server, bank online bank server are connected with many interface security smart card through the non-contact transmission channel of safety certification information.
The utility model discloses used many interfaces safety smart card indicates the safety smart card that increases a man-machine interaction interface again (have ultra-thin flexible display, flexible film button and ultra-thin flexible battery promptly on traditional many interfaces (contact interface and non-contact interface) safety smart card's basis (can be used to show some key information and can wait for the interface that user's button input was confirmed for the user). The intelligent card meets the standards of Chinese financial Integrated Circuit (IC) card specification (V2.0), non-contact payment IC card payment specification, international standard ISO10536 series and the like, supports ISO/IEC 14443-A and ISO/IEC 7816 protocols, supports cryptographic algorithms approved by the State code administration (including SM1, SSF33, RSA and the like) and abstract algorithms (such as SHA-1 and the like), and can be used as an intelligent bank card with multiple interfaces.
1. Establishment of non-contact transmission channel of safety authentication information
The method can be divided into two forms:
as shown in fig. 2, in a first form, the non-contact transmission channel of the security authentication information includes a computer connected to the bank server, a non-contact smart card reader/writer connected to the computer, and a multi-interface security smart card connected to the non-contact smart card reader/writer in a non-contact manner, where the computer is provided with a smart card reader/writer module adapted to a non-contact interface of the multi-interface security smart card.
And establishing a non-contact transmission channel between the computer and the multi-interface security smart card. The computer is required to be provided with a smart card reader-writer module which is suitable for a non-contact interface of the multi-interface security smart card, so that a non-contact type transmission channel can be established between the computer and the multi-interface security smart card. The general form is that an external non-contact intelligent card reader-writer is added on a computer, and a matching program (such as a drive program) of the corresponding reader-writer is installed in the computer.
As shown in fig. 3, in a second form, the non-contact transmission channel of the security authentication information includes a wireless communication line connected to the bank server, a mobile phone terminal having a short-range wireless communication module, and a multi-interface security smart card connected to the mobile phone terminal, where the mobile phone terminal is provided with the short-range wireless communication module in a non-contact smart card reader/writer mode.
And establishing a non-contact transmission channel between the mobile phone terminal with the short-distance wireless communication module and the multi-interface security smart card. The short-distance wireless communication module in the mobile phone terminal is set to be in a non-contact intelligent card reader-writer mode, so that a non-contact transmission channel, 2, a safety authentication protocol is established with the multi-interface safety intelligent card
The utility model discloses well safety certification agreement indicates the agreement and the standard that follow when the user uses the net bank in-process, carries out both sides identity safety certification between computer or cell-phone terminal and the bank net bank server. The secure authentication protocol is based on the use of public key certificates. The public key certificate and private key of the user and the corresponding encryption and decryption algorithm and digest algorithm are all in the multi-interface security smart card, so that in the security authentication process, the related data needing to be sent and received between the computer or mobile phone terminal and the bank internet bank server are transmitted to the multi-interface security smart card for processing (such as digital signature, encryption and decryption and the like) and returning the result on the basis of the establishment of the non-contact transmission channel. In addition, before the multi-interface security smart card performs digital signature processing on the transaction key information, the transaction key information is displayed on a display interface in a human-computer interaction interface, and digital signature operation is executed only after a user presses a confirmation key on the human-computer interaction interface.
The security authentication part includes the steps of:
1) distribution of public key certificates (as shown in fig. 4):
A. the certificate server generates respective public key certificates for the bank online bank server and the terminal user;
B. the certificate server writes a public key certificate of the bank online banking server into the multi-interface security smart card in an off-line manner;
C. the certificate server informs the bank internet bank server of the public key certificate of the user;
2) and (4) safety authentication: the identity authentication of both parties (i.e. the terminal user and the bank) is realized between the computer or the mobile phone terminal and the bank internet bank server through a public key certificate (as shown in fig. 5). The messages sent by the secure authentication protocol are as follows:
C->S:PEs(Nc)
S->C:PEc(Ns,TIMEcs,TYPEcs,AMOUNTcs,EXTcs,SIGs(Nc))
C->S:PEs(Ns,SIGc(TIMEcs,TYPEcs,AMOUNTcs,EXTcs))
wherein,Crepresents a sender of a computer or a mobile phone terminal,Srepresenting a bank online bank server receiver; PEc is expressed byCIs expressed by SIGcCThe private key signature of (2); PEs is expressed bySPublic key encryption of (1), SIGs stands forSThe private key signature of (2);Ncindicating the verification factor generated by the sender,Nsrepresenting a verification factor generated by the recipient;TIMEcswhich represents the time of operation of the transaction,TYPEcswhich indicates the kind of operation of the transaction,AMOUNTcswhich represents the amount of the operation money,EXTcsindicating a reserved extension;
the security authentication protocol performs the following steps:
firstly, after the transaction is started, the terminal sender sends a request for encrypting and authenticating by using a server receiver certificate public key to a server receiver, and the request content comprises a terminal generated verification factorNc;
Secondly, the bank internet bank server searches the corresponding certificate of the user according to the information of the user using the internet bank currently, and generates a verification factor after verifying the legality of the certificate to the certificate serverNsUsing its own private key pairNcTransaction operation time with current transaction after signatureTIMEcsCategory of transaction operationTYPEcsAmount of operationAMOUNTcsReserving an extension partEXTcsEncrypting the information by using the encryption public key of the receiver, and then transmitting the information to the terminal;
thirdly, the terminal decrypts the ciphertext information sent by the bank online banking server (firstly using the private key of the terminal and then using the prestored bank online banking clothesPublic key visa server signature of server), checkNcAfter the consistency is obtained;
fourthly, after the verification is passed, the mobile terminal pairTIMEcs,TYPEcs,AMOUNTcs,EXTcsAfter the information is signed by the private key of the terminal (before the terminal sends the information into the multi-interface security smart card for digital signature processing, the multi-interface security smart card displays the key transaction information on the display interface in the human-computer interaction interface, and only after a user presses the confirmation key on the human-computer interaction interface, the digital signature operation is executed), the information is signed by the private key of the multi-interface security smart card, and the key transaction information is sent to the terminalNsThe public key of the bank online bank server is encrypted and then transmitted to the online bank server;
fifthly, the online bank server receives the informationNsWith the originalNsA comparison is made. If the identity is the same, the identity security authentication of the two parties is passed, and the transaction is successful. Simultaneously connecting the mobile terminal pairTIMEcs,TYPEcs,AMOUNTcs, EXTcsStoring and recording the private key signature result of the transaction information; if not, the transaction fails.