WO2010003284A1

WO2010003284A1 - Method, system and its security device for network interworking

Info

Publication number: WO2010003284A1
Application number: PCT/CN2008/071572
Authority: WO
Inventors: 许剑卓; 陶佳; 龚志杰; 戴英侠; 熊蜀吉
Original assignee: Xu Jianzhuo; Tao Jia; Gong Zhijie; Dai Yingxia; Xiong Shuji
Priority date: 2008-07-07
Filing date: 2008-07-07
Publication date: 2010-01-14

Abstract

A method, a system and its security device for network interworking are provided. The method comprises: the client terminal receiving the operation content inputted by the user; the security device obtaining the operation content; the security device processing the operation content to produce encrypted cryptograph used for recovering the operation content by decryption, and sending the encrypted cryptograph to the client terminal; the client terminal sending the encrypted cryptograph to the server. The method can prevent the operation content from being juggled or forged by Trojan Horse.

Description

Network interaction method, system and security device thereof

The invention relates to a network interaction technology between a client and a network server, in particular to a network interaction method, a system and a security device thereof for preventing a Trojan from attacking by means of tampering and forgery when a Trojan exists. BACKGROUND OF THE INVENTION Due to the convenience of networks, network-based application systems, such as online banking, securities, and online games, are playing an increasingly important role in production and life. However, due to the characteristics of the network, the security of network communication has become an important issue.

The security focus of network communication lies in the identity authentication and information encryption of the interaction process. There are a variety of security technologies to choose from during this process. For example, fingerprint authentication technology for identity authentication, e-Certificate technology, and the like. There are encryption algorithms such as AES, 3DES. The application of these technologies creates a rigorous cryptosystem that protects the entire interaction process. Although it is easy to intercept this information over the network, it is difficult to know and tamper with its contents because it does not know the key. In general, directly cracking a cryptosystem is not worth the loss. Therefore, the attacker takes the vulnerability of finding the system and attacks.

Currently, the common attack method is to use Trojans to steal and tamper with sensitive information. This method of attack differs from direct cracking in that it steals authentication information or tampers with interactive content as an attack to bypass the protection of the password system.

The initial system login uses a static password, so the Trojan only needs to monitor the keyboard to steal the user login password. In this case, in order to prevent Trojan attacks, the application of soft keyboard, random verification code, dynamic password authentication technology and e-Cert and other security technologies make this type of Trojan attack difficult to work, it is difficult to achieve the purpose of attack by simply intercepting information. . Therefore, the technology using the Trojan attack in the related art has gradually turned into tampering or falsifying communication content. The manner in which Trojans falsify or falsify communication contents will be described below with reference to the drawings.

Figure 1 is a flow chart of normal operation between the client and the server. As shown in FIG. 1, the client operating system receives the operation content input by the user through the mouse or the keyboard (see step 11), the operating system The operation content is delivered to the client software (see step 12), the client software encrypts the operation content (see step 13), and then passes the encrypted operation content to the server (see step 14).

It can be seen from the above that step 12 "the operating system transmits the user's operation content to the client software" is a vulnerable link. Trojans can attack this link, bypassing the protection of existing security technologies. That is, the Trojan can be used to host the client host, intercept the user operation, and tamper with the operation content; some Trojans even pretend that the client actively completes the operation scheduled by the attacker, so that the client host of the Trojan is implanted, and the user operates the content. It is difficult to pass to the client software safely.

Example 1, Figure 2 is a flow chart of the Trojan monitoring keyboard and mouse. When the Trojan is implanted on the client host, monitor the keyboard and mouse, you can get the operation content before the client software (some attackers will add a shell based on the real client software, and then trick the user into downloading.) The design idea of the modified client software is the same as this example. The only difference is that the method of intercepting the mouse and keyboard is different. As shown in Figure 2, the operation content received by the client software is tampering or forged operation content. No matter how advanced the security technology used in step 25 is, it cannot achieve a defense effect.

Example 2, Figure 3 is a flow chart of the Trojan forgery operation content, the virtual user operating the mouse and the keyboard. As shown in Figure 3, it is difficult for the client software to determine whether the real user is operating or whether the Trojan is operating.

Example 3, Figure 4 is a flow chart of the Trojan embedding client software intercepting the user's operation content. For some complex client software (such as online game client software), the Trojan also uses the method of embedding the client software to intercept and tamper with the user's operation content, thereby achieving illegal purposes.

It can be seen from the above that in order to remove Trojans and protection systems, the following commonly used schemes are as follows: The first one: using anti-virus software to kill Trojans. Although the use of anti-virus software is the most effective means of removing viruses and Trojans, it does not guarantee that there is no Trojan in the operating system on the client. The most important reason is that the new Trojans are appearing and spreading too fast. For example, new Trojans appear every day, and it is difficult for anti-virus software to remove Trojans before the virus database is upgraded. Web applications such as e-mail, MSN and QQ communication tools and BBS forums make Trojans spread very fast; many users have anti-virus installed on their hosts. Software, but ignores the virus database update, anti-virus software automatically updates the virus interval is too long; Trojan can forge user operations, proactively turn off the protection of anti-virus software, and even cause anti-virus software to lose functionality.

And for sensitive, economically valuable targets, the Trojan can cause great losses as long as it succeeds. Therefore, we need to find another way to completely solve the threat of Trojans. Second: Adopt various types of authentication and encryption security products. For the local security of the client, at present, these security technologies only have a few technologies such as a soft keyboard, a verification code or a client software embedding Trojan scanning module. among them,

A soft keyboard is a technology that provides a password for entering with a mouse. Specifically, a random keyboard is formed on the screen, and then the keyboard is clicked to complete the password input. Because the password input is done by the mouse, it is difficult for the Trojan to steal the keyboard message and steal the password.

A verification code is a technique for preventing brute force. A string of characters displayed by the picture is provided on the login interface, and then the user is required to input the characters. When logging in, the server first verifies that these characters are correct (some systems are self-verified by the client software, and the defense effect is much worse). Because the characters displayed in the picture are generally distorted, and they are all set against the background of irregular lines. Therefore, these characters are difficult to be automatically recognized from the picture by the program. If used properly, the Trojan has a certain defense effect. . For example, if this technology is extended to critical business operations and supported by captcha technology, the spoofing behavior of the trojan will be greatly limited by forging the content of the operation.

The client software embedding Trojan scanning module actually integrates a Trojan killing tool into the client software. Its principle of killing Trojans is the same as anti-virus software, and can be seen as a streamlined version of its anti-virus software.

In addition, e-Cert technology and dynamic password technology can defend against the attacking behavior of Trojans that steal user passwords.

However, most of the above technologies are directed to the user's login process and have a certain defense effect. For the security problem when the user operates, it is difficult to defend, especially for the Trojan that intercepts the user's operation content as the main attack means, the defense effect is not good. The following examples are given.

Figure 5 is a flow diagram of normal interaction between the client and the server. Figure 6 is a flow chart of the Trojan implanted in the client preemptively obtaining the content of the operation by the client software, then tampering with the content of the operation and then sending it to the client software. As shown in Figure 6, during the entire interaction, the Trojan completely bypasses the protection of the cryptosystem formed by various security technologies.

Third: Install the firewall on the client to prevent unauthorized network access by setting a firewall policy. Figure 7 is a flow chart of using a firewall to defend against Trojans. Among them, the Trojan's theft of the username and password must be passed to the attacker, and then the attacker can use the stolen username and password to impersonate the legitimate user to log in to the system to complete the illegal purpose. Therefore, the stolen username password must be sent to the attacker via the network through the Trojan to complete the attack process completely. When a reasonable firewall policy is configured, the communication process between the Trojan and the outside world is blocked, thereby blocking the attack process and recovering the loss.

However, using the personal version of the firewall to defend against Trojan attacks has many limitations. The main disadvantages are as follows: Trojans that are completely unable to defend against tampering or forgery of user operations are the main means of attack; The default firewall policy is too loose and has many loopholes. The configuration of the firewall requires professional knowledge, which can be completed by non-ordinary users; Trojans can communicate by changing the communication port, embedding or fraudulently using the authorized program; Trojans can forge user operations, proactively turn off the protection of personal firewalls, and even cause personal firewalls to be lost. Features.

An invention patent application having the application number of 200610149618. X, the disclosure of which is incorporated herein by reference. Summary of the invention

The object of the present invention is to provide a network interaction method, which uses a security device to process an operation content to prevent a Trojan from tampering or forging an operation content to achieve an attacking purpose, thereby providing a more secure solution and improving the solution. The security level of the network application system expands the scope of network applications.

It is also an object of the present invention to provide a network interaction system that provides security by inputting operational content and processing the operation content by using a security device to prevent the Trojan from tampering or forging the operation content to achieve an attacking purpose. The solution has improved the security level of network application systems and expanded the scope of network applications.

It is also an object of the present invention to provide a security device that processes input operational content such that the operational content is not entered by the client to prevent the Trojan from tampering or falsifying the content of the operation for attack purposes.

Another object of the present invention is to provide a network interaction system, which uses a security device to confirm the correctness of operation content and process the operation content, so as to prevent the Trojan from tampering or forging the operation content to achieve the purpose of attack, thereby Provides a more secure solution, increases the security level of network application systems, and expands the scope of network applications. The object of the present invention is also to provide a security device, which can display the operation content, so that the user can confirm whether the operation content is correct through the display, and if it is correct, the operation content is processed to prevent the Trojan from tampering or forging. The way the content is manipulated achieves the purpose of the attack.

To achieve the above object, the present invention provides a network interaction method, the method comprising: obtaining, by a security device, an operation content; the security device processing the operation content to generate an encrypted ciphertext for decrypting the content of the restoration operation, and Transmitting the encrypted ciphertext to the client; the client transmitting the encrypted ciphertext to a server.

To achieve the above object, the present invention also provides a network interaction system, which includes a client and a security device;

a security device, configured to: input, by the client user, the operation content, process the operation content, to generate an encrypted ciphertext for decrypting the content of the restoration operation, and transmit the encrypted ciphertext to the client; And receiving the encrypted ciphertext transmitted by the security device, and sending the encrypted ciphertext to the server through a network.

To achieve the above object, the present invention further provides a security device, the security device comprising: an input unit, the input unit is configured to input the operation content by a client user; and the processing unit is configured to input the Encrypting the operation content to generate an encrypted ciphertext for decrypting the content of the restoration operation;

a sending unit, configured to send the encrypted ciphertext to the client. To achieve the above object, the present invention also provides a network interaction system, which includes a client and a security device;

a client, configured to receive the operation content input by the user, and transmit the operation content to the security device, and receive the encrypted ciphertext transmitted by the security device, and send the encrypted ciphertext to the server;

a security device, configured to receive the operation content transmitted by the client, display the operation content, and determine whether the client user confirms the operation content, and if the determination result is yes, the security device performs the operation The content is processed to generate an encrypted ciphertext for decrypting the content of the restore operation, and the generated encrypted ciphertext is transmitted to the client.

In order to achieve the above object, the present invention further provides a security device, the security device comprising: a receiving unit, the receiving unit is configured to receive the operation content transmitted by a client, and a display unit, the display unit is configured to display the Operational content;

a determining unit, configured to determine whether the client user confirms the operation content; a processing unit, if the determination result of the determining unit is yes, the processing unit is configured to process the operation content, and generate an encrypted ciphertext for decrypting the content of the restoration operation;

a sending unit, configured to transmit the encrypted ciphertext to the client. In order to achieve the above object, the present invention further provides a network interaction system, the system including a server, and a client and a security device;

The security device is configured to receive an operation content input by a user, process the operation content, generate and display an encrypted ciphertext for decrypting the content of the restoration operation, and the client is configured to receive the encryption input by the user Ciphertext, and the encrypted ciphertext is sent to the server through the network.

In order to achieve the above object, the present invention further provides a security device, the security device comprising: an input unit, configured to input, by the client user, the operation content;

a processing unit, configured to process the input operation content, and generate an encrypted ciphertext for decrypting the restored operation content;

a conversion unit, configured to convert the encrypted ciphertext into an inputtable character, and a display unit, configured to display the converted encrypted ciphertext.

An advantageous effect of the present invention is that by using the security device to process the operation content, an encrypted ciphertext for decrypting the content of the restoration operation is generated, so that the Trojan cannot tamper with the encrypted ciphertext. Therefore, Trojans can only perform blocking attacks at most, and cannot attack with simple bypass. The blocking attack can cause the user to use the application system at most, without causing direct loss to the user, and there is no benefit to the attacker, thereby avoiding the user's loss, providing a more secure solution and improving the network application system. The level of security has expanded the range of network applications. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in the claims In the drawing

Figure 1 is a flow chart of normal operation between the client and the server;

2 is a flow chart showing the operation of the Trojan tampering operation content implanted in the client host;

3 is a flow chart showing the operation of the Trojan forgery operation content implanted in the client host;

Figure 4 is a flow chart showing the operation of the Trojan tampering operation content embedded in the client software;

Figure 5 is a flow chart of normal interaction between the client and the server;

6 is an interactive flow chart of tampering the content of the operation by the Trojan implanted in the client; Figure 7 is a flow chart for defending a Trojan using a firewall;

8 is a schematic structural diagram of a network interaction system according to Embodiment 1 of the present invention;

Figure 9 is a schematic view showing the structure of the security device of Figure 8;

Figure 10 is a schematic diagram of the structure of the client in Figure 8;

Figure 11 is a schematic view showing the structure of the server in Figure 8;

12 is a schematic structural diagram of a network interaction system according to Embodiment 2 of the present invention;

Figure 13 is a schematic view showing the structure of the security device of Figure 12;

14 is a schematic structural diagram of a network interaction system according to Embodiment 3 of the present invention;

Figure 15 is a schematic view showing the structure of the safety device of Figure 14;

Figure 16 is a schematic diagram of the structure of the client in Figure 14;

17 is a flow chart of a network interaction according to Embodiment 4 of the present invention;

Figure 18 is a flow diagram of one embodiment of steps 1704 and 1705 of Figure 17; Figure 19 is a flow diagram of another embodiment of steps 1704 and 1705 of Figure 17; Figure 20 is a step 1709 of Figure 17. FIG. 21 is a flow chart of another embodiment of steps 1709 and 1710 of FIG. 17; FIG. 22 is a flow chart of network interaction according to Embodiment 5 of the present invention;

Figure 23 is a flow chart of the network interaction of Embodiment 6.

BEST MODE FOR CARRYING OUT THE INVENTION In order to make the objects, technical solutions and advantages of the present invention more comprehensible, the present invention will be further described in detail below with reference to the embodiments and drawings. The illustrative embodiments of the present invention and the description thereof are intended to explain the present invention, but are not intended to limit the invention.

The invention provides a network interaction method, system and security device thereof. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Example 1

The network interaction system of the present invention, as shown in FIG. 8, the system includes a server 803, a client 801, and a security device 802. The security device 802 is configured to acquire operation content, and process the operation content to generate Encrypting the encrypted ciphertext of the restored operation content, and transmitting the encrypted ciphertext to the client 801; and the client 801 is configured to receive the transmission transmitted by the security device 802 The ciphertext is sent to the server 803 over the network.

It can be seen from the above that the system can complete the input and processing of the operation content by using the security device 802, that is, the output of the security device is the encrypted ciphertext, which we call the full hardware input. Since the user does not input the operation content on the client, the Trojan can not invade the security device content. Therefore, the Trojan cannot intercept the operation content in the plaintext form, let alone tampering and forgery, thereby avoiding unnecessary loss to the user, thereby providing A more secure solution that increases the security level of network applications and expands the range of network applications.

Figure 9 is a schematic diagram showing the structure of the security device of Figure 8. As shown in FIG. 9, the security device 802 further includes an input unit 901, a processing unit 902, and a sending unit 903. The input unit 901 is configured to input the operation content by the client user. The processing unit 902 is configured to input the The operation content is processed to generate an encrypted ciphertext for decrypting the content of the restore operation; the transmitting unit 903 is configured to send the encrypted ciphertext to the client 801. In addition, the security device 802 can also include a display unit (not shown) for displaying the input of the operational content.

In the present embodiment, the operations of the input unit 901, the processing unit 902, and the transmitting unit 903 are controlled by the CPU. The processing unit 902 processes the operation content by adopting a method of processing the operation content according to a certain encryption protocol and an encryption algorithm to generate an encrypted ciphertext for decrypting the content of the restoration operation.

As can be seen from the above, the security device 802 can be connected to the client 801 in a wired or wireless manner. Figure 10 is a schematic diagram of the structure of the client in Figure 8. As shown in FIG. 10, the client 801 includes a first receiving unit 1001 and a first sending unit 1002. The first receiving unit 1001 is configured to receive an encrypted ciphertext transmitted by the security device 802. The first sending unit 1002 The encrypted ciphertext for transmitting the first receiving unit 1001 is transmitted to the server 803.

Figure 11 is a block diagram showing the structure of the server of Figure 8. As shown in FIG. 11, the server 803 includes a second receiving unit 1101, a processing unit 1103, an operating unit 1104, and a second sending unit 1105. The second receiving unit 1101 is configured to receive the encrypted ciphertext transmitted by the client 801. The processing unit 1103 decrypts the encrypted ciphertext to obtain the operation content; the operation unit 1104 is configured to perform a corresponding operation according to the acquired operation content; the second sending unit 1105 is configured to transmit the operation result to the client 801. .

As shown in FIG. 10, the first receiving unit 1001 of the client 801 is further configured to receive an operation result transmitted by the server 803; and the client 801 further includes a first display unit 1004, the first The display unit 1004 is for displaying the result of the operation.

In addition, as shown in FIG. 10, the client 801 may further include a first encryption unit 1003, where the first encryption unit 1003 is configured to encrypt the encrypted ciphertext, and then the encrypted encryption key is encrypted by the first sending unit 1002. The text is transmitted to the server 803, which further ensures the security of the transmitted data. Accordingly, as shown in FIG. 11, the server 803 further includes a second decryption unit 1102, and the second decryption unit 1102 is configured to decrypt the received encrypted encrypted ciphertext to obtain the operation content.

In addition, the server 803 can encrypt the operation result before returning the operation result to the client 801. After the client 801 receives the operation result, the operation result is decrypted and displayed. Therefore, the server 803 further includes a second encryption unit 1106, the second encryption unit 1106 is configured to encrypt the obtained operation result, and transmit the encrypted operation result to the second sending unit 1105;

Correspondingly, the client further includes a first decryption unit 1005 for decrypting the encrypted operation result and then sending it to the second display unit 1004 for display.

In the above embodiment, the security device 802 can be used alone or integrated in an existing portable device, such as a USB encryption device for electronic certificate computing, or a mobile phone.

It can be seen from the above that the system can complete the input and processing of the operation content by using the security device 802, that is, the output of the security device is the encrypted ciphertext, which we call the full hardware input. Since the user does not input the operation content on the client, the Trojan can not invade the security device content. Therefore, the Trojan cannot intercept the operation content in clear text, let alone tampering and forgery, avoiding unnecessary loss to the user and ensuring network interaction. Security, which provides a more secure solution, increases the security level of network application systems, and expands the scope of network applications.

Example 2

The present invention further provides a network interaction system. As shown in FIG. 12, the system includes a server 1203, a client 1201, and a security device 1202. The client 1201 is configured to receive operation content input by a user, and the operation content is And transmitting to the 1202 security device, and receiving the encrypted ciphertext sent by the security device 1202 for decrypting the content of the restoration operation, and sending the encrypted ciphertext to the server 1203; the security device 1202 is configured to receive the operation content transmitted by the client 1201, Displaying the content of the operation, and determining whether the client user confirms the operation content. If the determination result is yes, the security device 1202 processes the operation content to generate the encrypted ciphertext, and transmits the generated encrypted ciphertext to the client. End 1201. It can be seen from the above that if the Trojan modifies or falsifies the operation content before the security device 1202 obtains the operation content, the user can detect and block the operation content; the user confirms the operation content, and the operation content is already inside the security device 1202, and the Trojan cannot be modified. Therefore, it can avoid unnecessary loss to the user and ensure the security of the network interaction.

Different from Embodiment 1, in the present embodiment, the operation content acquired by the security device 1202 is transmitted by the client 1201, is not input by the user, and can transmit information by wire or wirelessly.

Figure 13 is a block diagram showing the construction of the security device of Figure 12. As shown in FIG. 13, the security device 1202 includes a receiving unit 1301, a display unit 1302, a determining unit 1303, a processing unit 1304, and a sending unit 1305. The receiving unit 1301 is configured to receive the operation content transmitted by the client 1201. The display unit 1302 is configured to display the operation content. The determining unit 1303 is configured to determine whether the user of the client 1201 confirms the operation content. If the determination result of the determination unit 1303 is YES, the processing unit 1304 is configured to perform the operation content. Processing to generate an encrypted ciphertext for decrypting the content of the restore operation; the sending unit 1304 is configured to transmit the encrypted ciphertext to the client 1201.

In addition, the security device 1202 further includes an input unit 1306 that allows the user to input information confirming the content of the operation; or the user can also input the content of the operation, as described in Embodiment 1.

It can be seen from the above that after the security device 1202 receives the operation content transmitted by the client 1201, the operation content is displayed. At this time, the user can confirm whether the operation content is incorrect according to the display of the display unit 1302 of the security device 1202. If the error is determined, the confirmation unit 1306 of the security device 1202 can confirm the operation. If the determination unit 1303 determines that the user has confirmed the operation content, the processing unit 1304 of the security device 1202 processes the operation content. The processing result is transmitted to the client 1201. If the user confirms that the operation content is incorrect, the cancel button set in the input unit 1306 is passed. Therefore, if the Trojan modifies or falsifies the operation content before the security device 1202 obtains the operation content, the user can detect and block it.

Correspondingly, the configuration of the client 1201 is similar to that of the embodiment 1, except that the client 1201 further includes a first input unit for the user to input the operation content; and the first sending unit further needs to send the operation content to the security device 1202. In addition, the functions of the other components and their respective parts are similar to those of Embodiment 1, and are not described herein again.

The configuration of the server 1203 is similar to that of Embodiment 1, and details are not described herein again. In the above embodiment, the security device 1202 can be used alone or integrated in an existing portable device, such as a USB encryption device for electronic certificate computing or a human biometric authentication device, such as fingerprint authentication and iris authentication. The device or the like is implemented. In this case, after the security device 1202 displays the operation content and the user confirms, the human biometric authentication unit can be used to confirm the operation content, such as using human biometrics such as fingerprints and irises for confirmation. Therefore, the input unit 1306 in the security device 1202 can be a key input unit and a human biometric authentication unit. As can be seen from the above, if the Trojan modifies or falsifies the operation content before the security device 1202 obtains the operation content, the user can detect and block the content. Network interaction security is guaranteed.

Example 3

The present invention also provides a network interaction system. As shown in FIG. 14, the system includes a server 1403, a client 1401, and a security device 1402.

The security device 1402 is configured to receive an operation content input by the user, process the operation content, generate an encrypted ciphertext for decrypting the content of the restoration operation, convert the encrypted ciphertext into an inputtable character, and display the converted the encryption The cipher text is used by the client 1401 to receive the encrypted ciphertext input by the user, and the encrypted ciphertext is sent to the server 1403 through the network.

As can be seen from the above, the system completes the input and processing of the operation contents by using the security device 1402. Since the user does not input the operation content on the client, the Trojan can not invade the security device content. Therefore, the Trojan can not intercept the operation content in the plaintext form, let alone tampering and forgery, avoiding unnecessary loss to the user, thus providing A more secure solution that increases the security level of network applications and expands the range of network applications.

Figure 15 is a block diagram showing the construction of the security device of Figure 14. The security device includes an input unit 1501, a processing unit 1502, a conversion unit 1504, and a display unit 1503. The input unit 1501 is configured to input the operation content by the client user. The processing unit 1502 is configured to perform the input operation content. Processing, generating the encrypted ciphertext; converting unit 1504, configured to convert the encrypted ciphertext into an inputtable character; and displaying unit 1503, configured to display the converted encrypted ciphertext.

In the present embodiment, the operations of the input unit 1501, the processing unit 1502, the conversion unit 1504, and the display unit 1503 are controlled by the CPU. The processing unit 1502 processes the operation content in the following manner: using an encryption key, performing operation processing on the operation content according to a certain encryption protocol and an encryption algorithm to generate an encrypted ciphertext. In this embodiment, the converting unit 1504 converts the encrypted ciphertext into a common inputtable character by using a certain character conversion rule, but is not limited thereto, and may be represented by other means.

As can be seen from the above, the security device 1402 can be disconnected from the client 1401, the client user inputs the operation content by using the input unit 1501 of the security device 1402, and the user can also display the encrypted ciphertext displayed by the display unit 1503 of the security device 1402. The client 1401 is input through an input unit of the client 1401.

Figure 16 is a block diagram showing the structure of the client in Figure 14. As shown in FIG. 16, the client includes a first input unit 1601 and a first sending unit 1602; wherein the first input unit 1601 is configured to input the encrypted ciphertext by a client user; the first sending unit 1602 is configured to: The encrypted ciphertext is transmitted to the server 1403.

As shown in FIG. 16, the client further includes a first encryption unit 1603, the first encryption unit 1603 is configured to encrypt the encrypted ciphertext; and the first sending unit 1602 transmits the encrypted encrypted ciphertext to the Server 1403.

In this embodiment, the configuration of the server 1403 is as described in Embodiment 1, and details are not described herein again. Therefore, as shown in FIG. 16, the client further includes a first receiving unit 1604, and a first display unit 1606. The first receiving unit 1604 is configured to receive an operation result transmitted by the server 1403. The first display unit 1606 Used to display the result of this operation.

In addition, the client further includes a first decryption unit 1605 for decrypting the encrypted operation result.

It can be seen from the above that the system can complete the input and encryption processing of the operation content by using the security device 802. Since the user does not input the operation content on the client, the Trojan cannot invade the security device content. Therefore, the Trojan cannot intercept the operation content in the plaintext form. , let alone tampering and forgery, to avoid unnecessary losses to users.

In the above embodiment, the security device can be used alone or integrated into an existing portable device, such as the security device being implemented by using a mobile phone.

Example 4

The present invention also provides a network interaction method, the method comprising: the security device acquiring the operation content; the security device processing the operation content to generate an encrypted ciphertext for decrypting the restoration operation content; the client acquiring the encryption password And send the encrypted ciphertext to the server.

It can be seen from the above that the method uses the security device to process the operation content, so as to prevent the Trojan from tampering or forging the operation content to achieve the purpose of attack, thereby providing a more secure solution. The case has improved the security level of the network application system and expanded the scope of network applications.

The method will be described in detail below with reference to Figs.

Step 1701: The user inputs the operation content through the input unit of the security device 802. Step 1702: The security device 802 processes the operation content by using a certain encryption algorithm and an encryption protocol to generate an encrypted ciphertext for decrypting the content of the restoration operation;

Step 1703, the security device 802 transmits the generated encrypted ciphertext to the client 801;

Step 1704, the client 801 transmits the encrypted ciphertext to the server 803 through the network; Step 1705, the server 803 receives the encrypted ciphertext;

Step 1706, the server 803 decrypts the received encrypted ciphertext to obtain the operation content.

Steps 1707, 1708, the server 803 performs corresponding operations according to the operation content, and generates an operation result;

Step 1709, the server 803 sends the operation result to the client 801 through the network;

Step 1710: The client 801 receives the operation result.

In step 1709, the client 801 displays the result of the operation.

In the above embodiment, the security device 802 and the client 801 can be connected by wire or wirelessly. By using the security device 802, the system completes the input and processing of the operation content, thereby providing a more secure solution, improving the security level of the network application system, and expanding the scope of the network application.

Figure 18 is a flow diagram of one embodiment of steps 1704 and 1705 of the present invention. As shown in FIG. 18, the specific implementation is as follows:

Step 1801, the client 801 encapsulates the encrypted ciphertext into a communication packet according to a public and customized network protocol.

Step 1802, the client 801 transmits the communication packet to the server 803 through the network; Step 1803, after receiving the communication packet, the server 803 uses the same communication protocol as the client 801 to parse the communication packet to obtain The encrypted ciphertext.

In the present embodiment, in order to further improve the security of network data transmission, the encrypted ciphertext may be encrypted, encrypted, and transmitted before being transmitted to the server 803 in step 1704. Correspondingly, after the encrypted ciphertext is received by the server 803, the decryption is performed first, and then step 1706 is performed. The specific implementation manner is shown in FIG. 19:

Step 1901, the client 801 uses the encrypted ciphertext as input of one or more cryptosystems. Part of the information, participate in the operation of the cryptosystem, and obtain the encrypted ciphertext after the operation;

Step 1902, the client 801 encapsulates the encrypted ciphertext into a communication packet according to a public or customized network protocol.

Step 1903, the client 801 transmits the communication packet to the server 803 through the network. Step 1904, after receiving the communication packet, the server 803 parses the received communication packet by using the same communication protocol as the client 801. The obtained encrypted ciphertext is obtained. In step 1905, the server 803 performs an inverse operation on the encrypted ciphertext corresponding to the client 801 to obtain the encrypted ciphertext.

Figure 20 is a flow diagram of one embodiment of steps 1709 and 1710 of the present invention. As shown in FIG. 20, the specific implementation is as follows:

Step 2001, the server 803 encapsulates the operation result into a communication packet according to a public and customized network protocol;

Step 2002, the server 803 transmits the communication packet to the client 801 through the network; in step 2003, after receiving the communication packet, the client 801 uses the same communication protocol as the server 803 to parse the communication packet to obtain Operation result.

Before the server 803 transmits the operation result to the client 801, the operation result is encrypted first; correspondingly, after the client 801 receives the operation result, the operation result is decrypted and then displayed. Wherein, the specific implementation manner is as shown in FIG. 21:

Step 2101: The server 803 participates in the operation of the cryptosystem as part of the input information of one or more cryptosystems, and obtains the encrypted ciphertext after the operation;

Step 2102, the server 803 encapsulates the encrypted ciphertext into a communication packet according to a public or customized network protocol.

Step 2103, the server 803 transmits the communication packet to the client 801 through the network. In step 2104, after receiving the communication packet, the client 801 parses the received communication packet by using the same communication protocol as the server 803. , obtaining the encrypted ciphertext;

Step 2105: The client 801 performs an inverse operation on the encrypted ciphertext corresponding to the server 803 to obtain the operation operation content.

It can be seen from the above that by using the security device to process the operation content, the Trojan cannot tamper with and forge the operation content. Therefore, the Trojan can only perform blocking attacks at most, and cannot attack with a simple bypass. Blocking attacks can cause users to use the application system at the most, without causing direct loss to the user, and there is no benefit to the attacker. Example 5

The network interaction method of the present invention will be described in detail below with reference to FIGS. 12 and 22.

Step 2201: The user operates on the human-machine interface of the client 1201, and the operation content can be input through an input unit of the client 1201, such as a keyboard or a mouse;

Step 2202, the client 1201 receives the operation content of the user, and then transmits the operation content to the security device 1202;

Step 2203, the display unit of the security device 1202 displays the operation content. Step 2204, the security device 1202 checks whether the operation content is incorrect according to the display, and if the determination is correct, the input unit of the security device 1202 confirms, after confirming The security device 1202 processes the operation content with a certain encryption algorithm and an encryption protocol to generate an encrypted ciphertext for decrypting the content of the restoration operation, and transmits the encrypted ciphertext to the client 1201; Biometric features such as fingerprints, irises, etc. are confirmed;

Step 2205, the client 1201 transmits the encrypted ciphertext to the server 1203 through the network; the steps 2206 to 2212 are similar to the steps 1705 to 1711 in FIG. 17, and are not described herein again.

In addition, the client 1201 can transmit the encrypted ciphertext to the server 1203 in the manner shown in Figs. In the manner shown in Figures 20 and 21, the server 1203 transmits the result of the operation to the client 1202.

It can be seen from the above that if the Trojan modifies or falsifies the operation content before the security device 1202 obtains the operation content, the user can detect and block it, thereby ensuring the security of the network authentication.

Example 6

The network interaction method of the present invention will be described in detail below with reference to FIGS.

Step 2301, the user inputs the operation content through the input unit of the security device 1402. Step 2302, the security device 1402 processes the operation content with a certain encryption algorithm and an encryption protocol to generate an encrypted ciphertext for decrypting the content of the restoration operation; The security device converts the encrypted ciphertext into an inputtable character according to a certain character conversion rule;

Step 2303, the security device 802 displays the converted encrypted ciphertext;

Step 2304, the user can input the displayed encrypted ciphertext to the client through the client input unit.

Step 2305, the client 1401 transmits the encrypted ciphertext to the server 1403 through the network; the steps 2306 to 2312 are similar to the steps 1705 to 1711 in FIG. 17, and are no longer 此处 Said.

It can be seen from the above that by using the security device 802, the input and encryption processing of the operation content can be completed, that is, the output of the security device is the encrypted ciphertext, which is referred to herein as the full hardware input. Since the user does not input the operation content on the client, the Trojan can not invade the security device content. Therefore, the Trojan cannot intercept the operation content in the plaintext form, let alone tampering and forgery, avoiding unnecessary loss to the user, thus providing A more secure solution that increases the security level of network applications and expands the range of network applications. The above network interaction system and method are applicable to various application systems involving network interaction, such as online banking, securities trading, online game electronic equipment trading, enterprise key business systems, e-commerce and network payment, and other fields involving network interactive authentication.

The specific embodiments of the present invention have been described in detail with reference to the preferred embodiments of the present invention. The scope of the protection, any modifications, equivalents, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Claim

A network interaction method, the method comprising:

The security device obtains the operation content;

The security device processes the operation content to generate an encrypted ciphertext for decrypting and restoring the operation content;

The client obtains the encrypted ciphertext;

The client transmits the encrypted ciphertext to the server.

The method according to claim 1, wherein the obtaining, by the security device, the operating content comprises: the user inputting the operating content into the security device.

The method according to claim 2, further comprising: after generating the encrypted ciphertext, further comprising:

Transmitting the encrypted ciphertext into an inputtable character;

The converted encrypted ciphertext is displayed.

The method according to claim 3, wherein the obtaining, by the client, the encrypted ciphertext comprises: the user inputting the converted encrypted ciphertext into the client.

The method according to claim 2, wherein the obtaining, by the client, the encrypted ciphertext comprises: transmitting, by the security device, the generated encrypted ciphertext to the client.

The method according to claim 1, wherein the obtaining, by the security device, the operation content comprises:

The client receives the operation content input by the user;

The client transmits the operational content to the security device to cause the security device to obtain the operational content.

The method according to claim 6, wherein after the security device obtains the operation content, the method further includes:

Displaying the operation content;

Determining whether the user confirms the operation content, and if the determination result is yes, the security device processes the operation content.

The method according to claim 1, wherein the method further comprises: the server receiving the encrypted ciphertext;

The server decrypts the received encrypted ciphertext to obtain the operation content; Performing corresponding operations according to the obtained operation content, and generating an operation result;

Transmitting the result of the operation to the client.

The method according to claim 8, wherein before the sending the encrypted ciphertext to the server, the client further comprises: the client encrypting the encrypted ciphertext; After the server receives the encrypted encrypted ciphertext, the method further includes: the server decrypting the encrypted encrypted ciphertext.

The method according to claim 8, wherein the method further comprises: the client receiving the operation result;

The result of the operation is displayed.

The method according to claim 10, wherein before the server transmits the operation result to the client, the method further comprises: encrypting the operation result;

And before the displaying the operation result, the client further includes: decrypting the encrypted operation result.

12. A network interaction system, the system comprising a server, wherein the system comprises a client and a security device;

a security device, configured to input, by the client user, the operation content, process the operation content, to generate an encrypted ciphertext for decrypting the content of the restoration operation, and transmit the encrypted ciphertext to the client;

And a client, configured to receive the encrypted ciphertext transmitted by the security device, and send the encrypted ciphertext to the server through a network.

The system according to claim 12, wherein the security device comprises: an input unit, wherein the input unit is configured to input the operation content by a client user; and the processing unit is configured to The input operation content is processed to generate an encrypted ciphertext for decrypting the content of the restore operation;

a sending unit, configured to send the encrypted ciphertext to the client.

The system according to claim 12, wherein the client comprises: a first receiving unit, wherein the first receiving unit is configured to receive an encrypted ciphertext transmitted by the security device;

a first sending unit, wherein the first sending unit is configured to transmit the encrypted ciphertext to the server.

15. The system of claim 14, wherein the client further comprises a first An encryption unit, configured to encrypt the encrypted ciphertext; and the first sending unit transmits the encrypted encrypted ciphertext to the server.

The system according to claim 14, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive the encrypted ciphertext transmitted by the client;

a processing unit, the processing unit decrypts the encrypted ciphertext to obtain the operation content;

An operation unit, configured to perform a corresponding operation according to the acquired operation content; and a second sending unit, configured to transmit an operation result to the client.

The system according to claim 15, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive the encrypted encrypted ciphertext transmitted by the client;

a second decryption unit, configured to decrypt the encrypted encrypted ciphertext to obtain the encrypted ciphertext;

The system according to claim 16 or 17, wherein the first receiving unit is further configured to receive an operation result transmitted by the server;

And the client further includes a first display unit, the first display unit is configured to display the operation result.

The system according to claim 18, wherein the server further comprises a second encryption unit, the second encryption unit is configured to encrypt the operation result, and the encrypted operation result is Transmitting to the second transmitting unit;

The client also includes a first decryption unit for decrypting the encrypted operation result.

20. A security device, characterized in that the security device comprises:

An input unit, wherein the input unit is configured to input an operation content by a client user;

a processing unit, configured to process the input operation content to generate an encrypted ciphertext for decrypting the restored operation content; a sending unit, configured to send the encrypted ciphertext to the client.

21. A network interaction system, the system comprising a client and a security device; wherein

a security device, configured to receive the operation content transmitted by the client, display the operation content, and determine whether the client user confirms the operation content, and if the determination result is yes, the security device performs the operation The content is encrypted to generate an encrypted ciphertext for decrypting the content of the restore operation, and the generated encrypted ciphertext is transmitted to the client.

The system according to claim 21, wherein the security device comprises: a receiving unit, the receiving unit is configured to receive the operation content transmitted by the client, and a display unit, where the display unit is used Displaying the operation content;

a determining unit, configured to determine whether the client user confirms the operation content; and the processing unit, if the determining result of the determining unit is yes, the processing unit is configured to encrypt the operation content, Generating the encrypted ciphertext;

a sending unit, configured to transmit the encrypted ciphertext to the client.

The system according to claim 21, wherein the client comprises: a first input unit, wherein the first input unit is configured to input, by the client user, the operation content; The first sending unit is configured to send the operation content to the security device; and is further configured to transmit the encrypted ciphertext to the server;

a first receiving unit, configured to receive the encrypted ciphertext by the security device.

The system according to claim 23, wherein the client further comprises a first encryption unit, and the first encryption unit is configured to encrypt the encrypted ciphertext;

And the first sending unit transmits the encrypted encrypted ciphertext to the server.

The system according to claim 23, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive an encrypted ciphertext transmitted by the client;

An operation unit, configured to perform a corresponding operation according to the obtained operation content; a second sending unit, configured to transmit an operation result to the client.

The system according to claim 24, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive the encrypted encrypted ciphertext transmitted by the client;

The system according to claim 25 or 26, wherein the first receiving unit is further configured to receive an operation result transmitted by the server;

The system according to claim 27, wherein the server further comprises a second encryption unit, the second encryption unit is configured to encrypt the operation result, and the encrypted operation result is obtained Transmitting to the second transmitting unit;

29. A security device, characterized in that the security device comprises:

a receiving unit, configured to receive the operation content transmitted by the client; a display unit, the display unit is configured to display the operation content;

a judging unit, configured to determine whether the client user confirms the operation content; and the processing unit, if the judgment result of the judging unit is yes, the processing unit is configured to process the operation content, generate An encrypted ciphertext for decrypting the contents of the restore operation;

a sending unit, configured to transmit the encrypted ciphertext to the client.

30. The security device of claim 29, wherein the security device further comprises an input unit for the user to input information confirming the content of the operation.

31. A network interaction system, the system includes a server, wherein the system further includes a client and a security device;

The security device is configured to receive an operation content input by a user, and perform the operation content And generate and display an encrypted ciphertext for decrypting the content of the restore operation;

The client is configured to receive the encrypted ciphertext input by a user, and send the encrypted ciphertext to the server through a network.

The system according to claim 31, wherein the security device comprises: an input unit, the input unit is configured to input the operation content by a client user; and the processing unit is configured to use The input operation content is processed to generate the encrypted ciphertext;

a conversion unit, configured to convert the encrypted ciphertext into an inputtable character; a display unit, wherein the display unit is configured to display the converted encrypted ciphertext.

The system according to claim 31, wherein the client comprises: a first input unit, wherein the first input unit is configured to input, by the client user, the encrypted ciphertext;

The system according to claim 33, wherein the client further comprises a first encryption unit, and the first encryption unit is configured to encrypt the encrypted ciphertext;

The system according to claim 33, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive an encrypted ciphertext transmitted by the client;

The system according to claim 34, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive the encrypted encrypted ciphertext transmitted by the client;

a processing unit, the processing unit decrypts the encrypted ciphertext to obtain the operation content; An operation unit, configured to perform a corresponding operation according to the acquired operation content; and a second sending unit, configured to transmit an operation result to the client.

The system according to claim 35 or 36, wherein the client further comprises:

a first receiving unit, configured to receive an operation result transmitted by the server; and a first display unit, where the first display unit is configured to display the operation result.

The system according to claim 37, wherein the server further comprises a second encryption unit, the second encryption unit is configured to encrypt the operation result, and the encrypted operation result Transmitting to the second transmitting unit;

39. A security device, characterized in that: the security device comprises:

An input unit, configured to: input, by the client user, the operation content; the processing unit, configured to process the input operation content, and generate an encrypted ciphertext for decrypting the content of the restoration operation;