Background technology
Along with popularizing of banking operations such as Web bank, network trading, the operation of transaction such as use that network is done shopping, transferred accounts has more and more obtained user's welcome, because of it pays the convenient, fast extensive welcome that obtains the user.But, because network trading often is designed into great economic interests, application system in the therefore present open network is faced with numerous assaults, especially the user is in PC the easiest attack such as suffer that data are stolen, distorted during to application system input data, these data include but not limited to account and the password imported in online game, the payment password of perhaps importing in payment system, payment amount etc.
Existing protection customer transaction safe terminal mainly contains following several:
First kind is e-bank's password card: the random coordinates according to the webpage prompting is chosen password, and the numeral before using on all coordinate positions all is covered by the coating, and prompting scrapes the acquisition numeral off thereby the user is according to coordinate, the input webpage.Its shortcoming is that numerical ciphers is limited, and this card was calcellation after all numeral was all scraped off, can not reuse, and therefore this mode usable range is less.
Second kind is dynamic password card, and its principle is that dynamic password is input with the time, dealing money etc. generally, and per minute produces once.But this minute brought opportunity to network hacker, can carry out illegal transaction by the lawless person as security breaches, and the solution that shortens the password generation time meet interim between synchronous problem.
The third is the U shield, or title USBKey, as shown in Figure 1, this kind security terminal is to generally acknowledge the safest Net silver safety equipment at present, wherein a kind of profile is as USB flash disk, include an intelligent card chip, support asymmetric cryptographic algorithm, be used for the various keys of safe storage (such as digital certificate and corresponding private key) on the one hand, not allowing expressly derives, external user also can't directly read, and the U shield is operated key, certificate by internal processes and finished authentication and set up escape way and digital signature, realizes the safe transmission and the transaction resisting denying of data.Another kind of U shield has increased display screen and four buttons on the basis of preceding a kind of U shield.Display screen is used for showing transaction number of the account and dealing money, and the user uses the C key to Cancel Transaction by key roll screen reading up and down, and the OK key is confirmed transaction.Can prevent effectively that like this data from being distorted by virus or wooden horse when computer imports the U shield into, higher security be arranged than first generation U shield.
But, that a kind of U shield no matter, its effect only is the corresponding relation of setting up between a U shield itself and the bank account card, obtains this U shield if also just say other people, can operate equally.And the password of trading account all is to import on the page of application system (as Net silver) by computer, is easy to be subjected to attacks such as wooden horse, virus and keyboard intercepting, and this is the weak link of existing U shield.
In sum, there is potential safety hazard exactly in the problem that the network security terminal of prior art mainly exists, or is snatched password by attack easily, or easy stolen problem.
Summary of the invention
At above-mentioned defective, the purpose of this invention is to provide a kind of network security terminal, there are security breaches to solve existing network security terminal, the password that is stolen easily in Jiao Yi the process on the net, thus user's property is caused dangerous technical matters.
For achieving the above object, the present invention has adopted following technical scheme:
A kind of network security terminal provided by the invention, comprise a housing, be arranged on the central processing module in the housing, be arranged on the communication interface on the housing, the keyboard load module that is arranged on described surface of shell and is connected with described central processing module, storer and be arranged on the safety encipher module that is connected with described central processing module in the described housing, wherein, described storer is in order to the network security rule of storage heterogeneous networks application server, described central processing module is caught the numerical information of described keyboard load module input, and this numerical information sent to described safety encipher module, this safety encipher module is called the network security rule of the correspondence in the described storer by described central processing unit, it is encrypted the back be transferred to network application server in the internet by described communication interface.
According to the described network security terminal of preferred embodiment of the present invention, also be provided with a LCDs on the described housing, it is connected with described central processing unit, in order to show dealing money, trading account, stateful transaction numerical information.
According to the described network security terminal of preferred embodiment of the present invention, described keyboard load module comprises ten digital keys of 0-9, and an at least one acknowledgement key and a cancellation button.
According to the described network security terminal of preferred embodiment of the present invention, described communication interface is a Mini-USB interface, and this network security terminal is connected with computing machine by the Mini-USB interface.
Another object of the present invention provides a kind of network security interactive system based on above-mentioned network security terminal, this system comprises at least one network application server, at least one has the client of computing machine, the user that at least one is corresponding with described client, described network application server becomes the network node that can communicate by letter with more described client by Internet connection, it is characterized in that, also comprise at least one network security terminal, this network security terminal can be connected with the computing machine of arbitrary client by communication interface, this network security terminal further comprises a housing, one is arranged on the central processing module in the housing, one is arranged on the communication interface on the housing, the keyboard load module that is arranged on described surface of shell and is connected with described central processing module, storer and be arranged on the safety encipher module that connects in described central processing module in the described housing, wherein, described storer is in order to the network security rule of storage heterogeneous networks application server, described central processing module is caught the numerical information of described keyboard load module input, and this numerical information sent to described safety encipher module, this safety encipher module is called the network security rule of the correspondence in the described storer by described central processing unit, it is encrypted the back be transferred to network application server in the internet by described communication interface, this network application server to the decrypts information or safe handling that receive after, the setting code comparison that will in network application server, prestore, if correct, then send confirmation and give described network security terminal; If mistake is then pointed out input error.
According to the described network security interactive system of preferred embodiment of the present invention, described network security terminal is in each mutual, and described safety encipher module adds different keys for described numerical information.
According to the described network security interactive system of preferred embodiment of the present invention, described network security terminal also is provided with a LCDs, and affirmation that described network application server sends and prompting error message show by this LCDs.
According to the described network security interactive system of preferred embodiment of the present invention, described network application server is bank server or third party's payment system server, described keyboard load module can be imported dealing money, and show by described LCDs, confirm or Cancel Transaction by described keyboard.
A further object of the present invention provides a kind of network security exchange method based on said system, comprising:
Step 1: the user connects by client-server and network application server; Step 2: user's option dealing type; Step 3: the user is connected the network security terminal with the client computer; Step 4: after the network application server checking client legitimacy, send trade confirmation information; Step 5: the user passes through the trading password of network security terminal input agreement, and sends to network application server by the internet; Step 6: network application server judges whether trading password mates; Step 7: network application server sends response message according to judged result; Step 8: carry out or stop transaction.
According to the described network security exchange method of preferred embodiment of the present invention, described step 7 further comprises: if the judged result coupling is then sent correct information and shown for described network security terminal; Otherwise, then send error message, show for described network security terminal.
Owing to adopted above technical characterictic, make the present invention than prior art, have following advantage and good effect:
First, network security terminal provided by the invention, can be when the user carries out online transaction, the function of traditional U shield not only is provided, can also directly can directly import trading password on the security terminal of hot plug at this, directly the netkey consensus standard according to corresponding bank or other application servers is encrypted the password of input on the chip of security terminal inside, encrypted afterwards information directly arrives bank or other corresponding application server by internet transmission, bank server or other similar service device inside to these dark text data decryptions or safe handling after, with the predefined trading password comparison of user, afterwards, return corresponding information, for example correct or mistake, prompting is afterwards re-entered, and perhaps confirms information such as the amount of money, has avoided U shield in the past that a digital authenticating only is provided, and the password of transaction still will be imported on the computer of client, is installed in the security risk that the illegal software on the client computer is usurped easily.
The second, network security terminal provided by the invention, after importing trading password each time, the capital produces once different key informations, be transferred to application server safely, after application server deciphering or safe handling, carry out matching judgment again, can avoid in transmission course, being analyzed the problem of password by packet capturing, the data of at every turn catching are all different, and the hidden danger that reduces to be cracked improves security performance.
Three, network security terminal provided by the invention, can be with user's Transaction Information, for example dealing money etc. directly shows in this terminal, can be directly by this terminal check with Cancel Transaction, compare traditional U shield or USB-KEY, have the advantage of more convenient operation.
Certainly, implement any one specific embodiment of content of the present invention, might not reach above whole technique effect simultaneously.
Embodiment
Below in conjunction with accompanying drawing several preferred embodiments of the present invention is described in detail, but the present invention is not restricted to these embodiment.The present invention contain any on marrow of the present invention and scope, make substitute, modification, equivalent method and scheme.Understand for the public is had completely the present invention, in the following preferred embodiment of the present invention, describe concrete details in detail, and do not have the description of these details also can understand the present invention fully for a person skilled in the art.In addition, for fear of essence of the present invention is caused unnecessary obscuring, do not describe well-known method, process, flow process, element and circuit etc. in detail.
As shown in Figures 2 and 3, the present invention at first provides a kind of network security terminal, specifically can show as similar USB-KEY or the similar configuration design of U shield, comprise housing 1, central processing unit 101, keyboard 102, display 103, safety encipher module 104, communication interface 105 and storer 106.
As shown in Figure 3, wherein, communication interface can adopt Mini-USB interface 3, and back-up system is discerned automatically, and hot plug is used for realizing being connected of network security terminal and computing machine.Display 103 adopts LCDs 6 as the display module that shows Transaction Information.Keyboard 102 is provided with 12 buttons as the keyboard load module, specifically comprises ten digital keys 2 of 0-9 and an affirmation button 5 and a cancellation button 4.
In fact, central processing unit, storer and safety encipher module can be integrated on the same chip, to the burned program of chip, divide different functional modules.
Wherein, memory stores has the safety standard and the digital certificate information (the similar traditional U shield of this part) of each application server, for example be applied in the bank, can be according to the customization of a certain bank, store the security protocol standard of this bank, bank can by digital certificate information discern this security terminal whether with the corresponding account coupling of bank, this function is a prior art, does not add at this and gives unnecessary details.
In process of exchange, after the user must import 6-8 bit digital password by the keyboard of security terminal, central processing unit on the chip is promptly caught corresponding digital information, by the security protocol standard of the safety encipher module of carrying out encryption function according to storage, password is encrypted, encrypted the back and be transferred in the network, judge whether correct after application server is resolved again afterwards by communication interface, legal, just can carry out ensuing transaction.
When this security terminal is applied in the network trading process, network application server is a bank server, and described keyboard load module can be imported dealing money, and shows by described LCDs, confirms or Cancels Transaction by described keyboard.
As shown in Figure 4, rely on above-mentioned security terminal, can set up a kind of network interaction system, can be applicable to the field of need to be keep secret safety such as network game, internet bank trade, comprise network application server 200 specifically, have the client of computing machine 300, the user 400 corresponding with described client, network application server 200 becomes the network node that can communicate by letter with a little clients by Internet connection, and the network security terminal 100 that can insert client computer 300.The structure of network security terminal 100 is as above described, and does not repeat to introduce.
Network security terminal 100 is connected with the computing machine 300 of arbitrary client by communication interface (for example USB mouth), in process of exchange, the central processing module of network security terminal 100 is caught the transaction PIN code of user from the input of keyboard load module, and this PIN code sent to the safety encipher module, safety encipher module invokes network security rule, generate key and the ciphertext that contains PIN code according to safety rule, communication interface is transferred to the network application server 200 in the internet, after 200 pairs of ciphertexts that receive of network application server are decrypted and handle, with the setting code information comparison that prestores in the network application server 200, if correct, then send confirmation and give described network security terminal; If mistake is then pointed out input error.
Network security terminal 100 is in each transaction, and the safety encipher module generates different keys for the transaction PIN code at random, and each key all is unique like this, even be hunted down in transmission course, can not be used for concluding the business next time, has guaranteed that Secure Transaction ground carries out.
Whole exchange method flow process can be as shown in Figure 5,
S501: the user connects by client-server and network application server;
In this step, bank server is at first set up the bank account corresponding relation of network security terminal therewith by the digital certificate in the network security terminal, at first, both are corresponding just connecting, but, as long as this is to hold this network security terminal (equipment of for example similar U shield) and know that (for example: number of the account) can connect, security still is in reduced levels to bank account information.
S502; After connecting, user's option dealing type;
The transaction classification that the safe control of user's download Net silver, selection will be carried out is for example remitted money, is transferred accounts or payment etc.The user is connected the network security terminal with client-server, network application server sends trade confirmation information;
In this process, the application server of bank can send need checking information to the network security terminal, the perhaps display of client, prompting input password for example, demonstration dealing money or the like.
S503: the user passes through the trading password of network security terminal input agreement, and sends to network application server by the internet;
In this process, input of transaction PIN code and processing are not pass through the computing machine of client, directly finish in the network security terminal, send the network application server of bank to.
S504: network application server checking trading password;
Because network application server and network security terminal are observed common protocols, network application server can judge whether coupling to comparing when opening an account or at the trading password that bank counter is provided with the user after the safe handlings such as key information deciphering.
S505: if coupling, then checking is passed through, and carries out next step transaction;
S506: if do not match, then send information to display screen, provide error message, require to re-enter, surpass certain number of times, then stop transaction, even lock an account.
Certainly, in actual applications, can also carry out function corresponding improvement and interpolation, for example add the dynamic password productive unit of traditional dynamic password card, have function corresponding simultaneously at different demands.
As for the specific implementation of safety encipher, the several application example is below arranged, as a reference.
Application examples one
As shown in Figure 6, be the application mode that a kind of digital envelope is encrypted the PIN+ digital signature, the implementation procedure of this mode is as follows:
One, the network security terminal inner presets PKs (network application server end PKI), the client certificate that encryption equipment produces;
Two, client IE browses manual download message interactive controls, and installs;
Three, client login Net silver carries out the SSL negotiation, the legitimacy of the Web server certificate of checking SSL accelerator inside;
Four, client is after certification authentication is passed through to Web server, the legitimacy of SSL accelerator checking network security terminal inner client certificate;
Five, after client certificate verification passes through, finish ssl tunneling and set up, enter the Net silver internal system;
Six, the client carries out network bank business based operation, needs input PIN;
Seven, import PIN from the network security terminal, PIN is encrypted automatically with PKs in inside;
Eight, the information interaction control reads PIN ciphertext, the client certificate of network security terminal inner;
Nine, IE and interactive controls are called the network security terminal, use client certificate SKe (client certificate private key) that whole transaction message is signed;
Ten, all information are by the ssl tunneling encrypted transmission;
11, after information arrives the SSL accelerator, carry out the SSL unloading, the PIN ciphertext that acquisition PKs encrypts, client certificate, signature value etc.;
12, the Net silver front end processor uses the PKI in the client certificate that whole message is tested label.Private key deciphering PKs in the encryption equipment obtains PIN, and the ZPK2 (another one PIN encryption key) with the background system agreement changes encryption PIN and calculates MAC in encryption equipment inside again, and is concurrent toward the backstage;
13, internal verification passes through, and confirms that also information is returned;
14, confirmation is returned, and changes next step business operation over to.
This mode utilizes the service end PKI directly to encrypt the PIN of input, promptly is the process that is transformed into backstage symmetrical treatment algorithm from the asymmetric Processing Algorithm of front end, and is simple and convenient.
Application examples two
As shown in Figure 7, digital envelope encryption key+MAC+PIN encrypts, and the implementation procedure of this mode is as follows:
1. the network security terminal inner presets PKs, the client certificate that encryption equipment produces;
2. client IE browses manual download message interactive controls, and installs;
3. client login Net silver carries out the SSL negotiation, the legitimacy of the Web server certificate of checking SSL accelerator inside;
4. client is after certification authentication is passed through to Web server, the legitimacy of SSL accelerator checking network security terminal inner client certificate;
5. after client certificate verification passes through, finish ssl tunneling and set up, enter the Net silver internal system;
6. the client carries out network bank business based operation, needs input PIN;
7. import PIN from the network security terminal, internal random produces working key ZPK1, ZAK1, and encrypts two keys with inner PKs, and ZPK1 encrypts PIN simultaneously;
8. the information interaction control reads PIN ciphertext, key ciphertext, the client certificate of network security terminal inner;
Call the network security terminal 9.IE reach interactive controls, use inner ZAK1 that whole transaction message is carried out MAC and calculate;
10. all information are by the ssl tunneling encrypted transmission;
11. after information arrives the SSL accelerator, carry out the SSL unloading, the ciphertext, MAC value of PIN ciphertext, PKs encryption key etc. occur;
12. the Net silver front end processor uses the inner private key deciphering of encryption equipment to obtain ZPK1, ZAK1 earlier, uses ZAK1 checking MAC.ZPK2, ZAK2 with the background system agreement changes encryption PIN and calculates message MAC in encryption equipment inside again;
13. internal verification passes through, and confirms that also information is returned;
14. confirmation is returned, and changes next step business operation over to.
This mode is the working key that utilizes the protection of service end PKI to produce at random, and working key is used to encrypt the PIN of input and calculates message MAC, realizes the design of working key " one-time pad ".
Certainly, concrete application mode can also be improved according to same principle, does not add at this and gives unnecessary details.
The preferred embodiment of the present invention just is used for helping to set forth the present invention.Preferred embodiment does not have all details of detailed descriptionthe, does not limit this invention yet and only is described embodiment.Obviously, according to the content of this instructions, can make many modifications and variations.These embodiment are chosen and specifically described to this instructions, is in order to explain principle of the present invention and practical application better, thereby the technical field technician can utilize the present invention well under making.The present invention only is subjected to the restriction of claims and four corner and equivalent.