TWI679603B - System for assisting a financial card holder in setting password for the first time and method thereof - Google Patents

Abstract

The invention discloses a system and a method for helping a cardholder to set a financial card password for the first time. The system includes a first server with a password setting module including a storage sub-module, a second server electrically connected with the first server, and a financial card management module; A software product (App) connected to the first server, the App is installed on a mobile device held by the cardholder, and the App is authenticated by the password setting module; and an authentication device, and The second server is communicatively connected, and the authentication device has a display element, an input element, and a financial card read-write element.

Description

System and method for helping cardholder to set financial card password for the first time

The present invention relates to a system and method for helping cardholders to set a password for a financial card for the first time, and particularly to a system and method that does not require a paper financial card password letter.

Existing financial card password letters are generated by the related functions of the financial card system. After the password file is generated by the relevant functions of the financial card system, specific security personnel will manually operate the designated equipment and transaction functions under the specified environment to complete the printing of the financial card password letter. Packaged, transported, and mailed to designated branches by special persons; finally, designated persons at each branch will take inventory, store, store, and keep them; when a customer goes to the branch to apply for a new financial card in front of the counter, the designated person will review it with the supervisor. Obtain the cryptographic letter of the financial card from the vault, and deliver it to the cardholder for signing together with the newly applied financial card.

Therefore, for the financial industry, there is still a need for a system or method to replace the current tedious process of printing password letters by manual operation, saving related manual operations, environmental facilities, printing machines, paper, mailing, custody and storage. , Asset security control and risk audit, etc. In addition, if the use of paper financial card cipher letters can be eliminated, the effect of energy conservation and carbon reduction can also be achieved, which will contribute to the environmental protection of the planet.

In view of this, the present invention provides a system and method for helping cardholders to set a password for a financial card for the first time. .

In one aspect, the present invention discloses a system for helping cardholders to set a password for a financial card for the first time, including: a first server provided with a password setting module including a storage sub-module; a second server Is electrically connected to the first server and is provided with a financial card management module; a software product (App) is communicatively connected to the first server, and the App is installed in a card held by the cardholder A mobile device, and the App is authenticated by the password setting module; and an authentication device communicatively connected with the second server, the authentication device has a display element, an input element, and a financial card read-write element; wherein: The password setting module is in a pre-registration procedure: receiving a first authentication data, which is composed of identification information of the mobile device and personal information of the cardholder, and storing the first authentication data in the storage A sub-module; and, receiving a second authentication data, which is an optional digest, and storing the second authentication data in the storage sub-module; the App automatically triggers an event after the start, and requires input Enter the personal information and financial card account number, and send the entered personal information and account number to the password setting module; The password setting module after confirming the status of the financial card to the financial card management module: according to a combination method The first authentication data is combined to generate a first key, wherein the combination method is randomly selected from a plurality of combination methods and has a first number; and an encryption method is randomly selected from the plurality of encryption methods, and the encryption The method has a second number; and transmitting the first number to the App, and the confirmation data encrypted based on the first key, the confirmation data includes an encrypted information and the optional digest, wherein the encrypted information includes the The second number, and the initial sampling location; the app obtains the identification information of the mobile device and the personal information of the cardholder from the mobile device, and combines the identification information and the combination method corresponding to the first number and Personal information to generate a second key; use the second key to interpret the encrypted information and the optional digest, and use the second number A corresponding encryption method and the starting sampling position, encrypting the selected digest to obtain an encrypted value; and encrypting the encrypted value based on the second key and transmitting the encrypted value to the password setting module; the password setting module After confirming the correctness of the encrypted value, a request for obtaining an authentication code is sent to the financial card management module and an authentication code is obtained; and, an authentication code image is generated and transmitted to the App; the App displays the authentication Code image for use by the cardholder when setting the password of the financial card for the first time through the authentication device; and the authentication device reads the financial card through the financial card read-write component and sends it to the financial card management module Confirm the status of the financial card, and then provide a first user interface through the display element for the cardholder to input the authentication code and the new password of the financial card through the input element to complete the first password setting.

In some specific embodiments of the present invention, the password setting module provides a second user interface for an operator of the issuer of the financial card to input the first authentication data and the second authentication data.

In some specific embodiments of the invention, the App requires an activation password.

In some specific embodiments of the present invention, the first user interface of the authentication device requires an authentication code and a new password, and at least a portion of the personal information, and sends the information to the financial card management module based on the input data. Request to set a new password. In a specific embodiment, after confirming that the received authentication code and personal data are correct, the financial card management module obtains a garbled new password and transmits it to the authentication device for reading and writing components by the financial card. Write the garbled new password to the debit card.

In another aspect, the present invention provides a method for helping a cardholder to set a password for a financial card for the first time, including: providing a first server with a password setting module including a storage sub-module; a second servo Device, which is electrically connected to the first server, and is provided with a financial card management module; a software product (App), which is communicatively connected to the first server, the App is installed in the cardholder's possession A mobile device, and the App is authenticated by the password setting module; and an authentication device is communicatively connected with the second server, the authentication device has a display element, an input element, and a financial card read-write element; the The password setting module is in a pre-registration procedure: it receives a first authentication data, which is composed of the identification information of the mobile device and the personal information of the cardholder, and stores the first authentication data in the storage sub-module. Module; and, receiving a second authentication data, which is an optional digest, and storing the second authentication data in the storage sub-module; the App automatically triggers an event after startup, and requires input of a Personal information and financial card account number, and send the entered personal information and account number to the password setting module; the password setting module after confirming the status of the financial card to the financial card management module: according to a combination method The first authentication data is used to generate a first key, wherein the combination method is randomly selected from a plurality of combination methods and has a first number; an encryption method is randomly selected from the plurality of encryption methods, and the encryption method Having a second number; and transmitting the first number to the App, and the confirmation data encrypted based on the first key, the confirmation data including an encrypted information and the optional digest, wherein the encrypted information includes the first The second number, and the first sampling location; the app obtains the identification information of the mobile device and the personal information of the cardholder from the mobile device, and combines the identification information and the individual according to the combination method corresponding to the first number Information to generate a second key; use the second key to decipher the encrypted information and the optional digest, and pair it according to the second number Encryption method and the starting sampling position, encrypt the selected digest to obtain an encrypted value; and encrypt the encrypted value based on the second key and send it to the password setting module; the password setting module is After confirming the correctness of the encrypted value, send a request for obtaining an authentication code to the financial card management module and obtain an authentication code; and, generate an authentication code image and transmit it to the App; the App displays the authentication code An image for use by the cardholder when setting the password of the financial card for the first time through the authentication device; and the authentication device reads the financial card through the financial card read-write component and confirms with the financial card management module The state of the financial card, and then a first user interface is provided through the display element for the cardholder to input the authentication code and the new password of the financial card through the input element to complete the first password setting.

In some specific embodiments of the present invention, the password setting module provides a second user interface for an operator of the issuer of the financial card to input the first authentication data and the second authentication data.

In some specific embodiments of the invention, the App requires an activation password.

In some specific embodiments of the present invention, the first user interface of the authentication device requires an authentication code and a new password, and at least a portion of the personal information, and sends the information to the financial card management module based on the input data. Request to set a new password. In a specific embodiment, after confirming that the received authentication code and personal data are correct, the financial card management module obtains a garbled new password and transmits it to the authentication device for reading and writing components by the financial card. Write the garbled new password to the debit card.

Other objects and advantages of the present invention are partly described in the following description, or can be understood through the embodiments of the present invention. It should be understood that the foregoing summary of the invention and the following embodiments are merely illustrative and explanatory illustrations, and do not limit the present invention as the scope of patent application.

It should be noted that, unless otherwise specified, all technical and scientific terms used herein have meanings as commonly understood by a person of ordinary skill in the technical field to which the present invention belongs. Furthermore, the word "a" as used in this specification refers to the quantity of at least one (one or more) unless otherwise specified.

In one aspect, the present invention provides a system for helping cardholders to set a password for a financial card for the first time. The system includes a first server, a second server, a software product (App), and an authentication device.

The first server is provided with a password setting module, which includes a storage sub-module.

The second server is electrically connected to the first server and is provided with a financial card management module.

According to a preferred embodiment of the present invention, the first and second servers are disposed on a card issuer of the financial card.

The software product (App) is communicatively connected to the first server and installed on a mobile device held by the cardholder, and the App is authenticated by the password setting module. According to the present invention, the mobile device includes, but is not limited to, a tablet computer or a smart phone, and is preferably a smart phone. The mobile device preferably does not include a notebook computer. The communication connection is preferably an Internet communication connection. According to the present invention, the software product is preferably a mobile application. According to the present invention, the mobile device may include a storage unit storing the code of the software product, and a processing unit for executing the code of the software product.

The authentication device is communicatively connected with the second server, and has a display element, an input element, and a financial card read-write element. In some embodiments of the present invention, the authentication device is an automatic teller machine or an automatic deposit and withdrawal machine. According to the present invention, the authentication device is preferably connected to the second server through a dedicated network.

In a pre-registration process, the password setting module receives a first authentication data and a second authentication data, and stores the first and second authentication data in the storage sub-module. The first authentication information is composed of identification information of the mobile device and personal information of the cardholder, and the second authentication information is an optional digest. In the pre-registration procedure, the password setting module may provide a second user interface for an operator of the issuing party of the financial card to input the first authentication information and the second authentication information. The aforementioned identification information includes IMEI, UDID, Keychain, MAC address, or a combination thereof. The optional digest may be provided by the cardholder, or selected by the operator from the database of the storage submodule, or randomly selected by the password setting module from the database of the storage submodule.

After launching the App, an event is automatically triggered, which requires input of personal information and account number of the financial card, and transmits the entered personal information and account number to the password setting module. According to a preferred embodiment of the present invention, the App requires a startup password, and the App will not start until the startup password is verified to be correct. The startup password includes, but is not limited to, a graphic password, a touch-tone password, fingerprint recognition, or face recognition.

The password setting module performs the following steps after confirming the status of the financial card to the financial card management module: (1) combining the first authentication data according to a combination method to generate a first key, wherein the first key The combination method randomly selects a plurality of combination methods and has a first number; (2) randomly selects an encryption method from the plurality of encryption methods, the encryption method has a second number; and, (3) assigns the first A number and the confirmation data encrypted based on the first key are transmitted to the App. The confirmation data includes an encrypted information and an optional digest as described above, wherein the encrypted information includes the second number and a starting sampling position. According to the present invention, the combination method includes, but is not limited to: combining a single field of the first authentication data, or complete data of a plurality of fields, or a part of a plurality of fields of the first authentication data The data is combined, or the same field data of the first authentication data is combined multiple times.

The App obtains the identification information of the mobile device and the personal information of the cardholder from the mobile device, and combines the identification information and personal information according to a combination method corresponding to the first number to generate a second key ; Use the second key to decipher the encrypted information and the optional digest, and encrypt the optional digest according to the encryption method corresponding to the second number and the starting sampling position to obtain an encrypted value; and, based on The second key encrypts the encrypted value and sends it to the password setting module. The cardholder's personal information can be registered by the cardholder and stored in the mobile device. The start sampling position indicates from which position of the selected digest the encryption method starts sampling and encrypting.

After confirming the correctness of the encrypted value, the password setting module sends a request for obtaining an authentication code to the financial card management module and obtains an authentication code; and generates an authentication code image and transmits it to the App. The authentication code is preferably a random number of 6 to 8 codes, but is not limited thereto. In a specific embodiment of the present invention, the authentication code image is encrypted by using a visual cryptographic theory method to produce the authentication code image, so that the plain code value of the authentication code can be read manually by human eyes.

Then, the App displays the authentication code image for the cardholder to use when setting the password of the financial card for the first time through the authentication device.

Finally, the authentication device reads the financial card through the financial card read-write element, and confirms the status of the financial card to the financial card management module, and then provides a first user interface through the display element for the The cardholder enters the authentication code and the new password of the financial card through the input element to complete the first password setting.

In some specific embodiments of the present invention, the first user interface of the authentication device requires an authentication code and a new password, and at least a portion of the personal information, and sends the information to the financial card management module based on the input data. Request to set a new password. In a specific embodiment, after confirming that the received authentication code and personal data are correct, the financial card management module obtains a garbled new password and transmits it to the authentication device for reading and writing components by the financial card. Write the garbled new password to the debit card.

In another aspect, the present invention provides a method for helping a cardholder to set a password for a financial card for the first time, including: providing a first server with a password setting module including a storage sub-module; a second servo Device, which is electrically connected to the first server, and is provided with a financial card management module; a software product (App), which is communicatively connected to the first server, the App is installed in the cardholder's possession A mobile device, and the App is authenticated by the password setting module; and an authentication device is communicatively connected with the second server, the authentication device has a display element, an input element, and a financial card read-write element; the The password setting module is in a pre-registration procedure: it receives a first authentication data, which is composed of the identification information of the mobile device and the personal information of the cardholder, and stores the first authentication data in the storage sub-module. Module; and, receiving a second authentication data, which is an optional digest, and storing the second authentication data in the storage sub-module; the App automatically triggers an event after startup, and requires input of a Personal information and financial card account number, and send the entered personal information and account number to the password setting module; the password setting module after confirming the status of the financial card to the financial card management module: according to a combination method The first authentication data is used to generate a first key, wherein the combination method is randomly selected from a plurality of combination methods and has a first number; an encryption method is randomly selected from the plurality of encryption methods, and the encryption method Having a second number; and transmitting the first number to the App, and the confirmation data encrypted based on the first key, the confirmation data including an encrypted information and the optional digest, wherein the encrypted information includes the first The second number, and the first sampling location; the app obtains the identification information of the mobile device and the personal information of the cardholder from the mobile device, and combines the identification information and the individual according to the combination method corresponding to the first number Information to generate a second key; use the second key to decipher the encrypted information and the optional digest, and pair it according to the second number Encryption method and the starting sampling position, encrypt the selected digest to obtain an encrypted value; and encrypt the encrypted value based on the second key and send it to the password setting module; the password setting module is After confirming the correctness of the encrypted value, send a request for obtaining an authentication code to the financial card management module and obtain an authentication code; and, generate an authentication code image and transmit it to the App; the App displays the authentication code An image for use by the cardholder when setting the password of the financial card for the first time through the authentication device; and the authentication device reads the financial card through the financial card read-write component and confirms with the financial card management module The state of the financial card, and then a first user interface is provided through the display element for the cardholder to input the authentication code and the new password of the financial card through the input element to complete the first password setting.

In the pre-registration procedure, the password setting module may provide a second user interface for an operator of the issuing party of the financial card to input the first authentication information and the second authentication information. The aforementioned identification information includes IMEI, UDID, Keychain, MAC address, or a combination thereof. The optional digest may be provided by the cardholder, or selected by the operator from the database of the storage submodule, or randomly selected by the password setting module from the database of the storage submodule.

In some specific embodiments of the invention, the App requires an activation password. The startup password includes, but is not limited to, a graphic password, a touch-tone password, fingerprint recognition, or face recognition.

In some specific embodiments of the present invention, the first user interface of the authentication device requires an authentication code and a new password, and at least a portion of the personal information, and sends the information to the financial card management module based on the input data. Request to set a new password. In a specific embodiment, after confirming that the received authentication code and personal data are correct, the financial card management module obtains a garbled new password and transmits it to the authentication device for reading and writing components by the financial card. Write the garbled new password to the debit card.

Now with FIGS. 1 and 2 to help illustrate the present invention and a method setting system Cardholder first debit card passwords specific preferred embodiments.

First, see FIG. 1, the present invention is shown in one particular embodiment the first cardholder help embodiments set passwords debit card system. In this specific embodiment, the system 1 for helping cardholders to set a password for a financial card for the first time includes a first server 10 , a second server 20 , a software product (App) 30, and an authentication device 40 . The software product 30 may be a mobile software product, such as an app issued by a financial industry.

The first server 10 is provided with a password setting module 12 , which includes a storage sub-module 122 . The second server 20 is electrically connected to the first server 10 and is provided with a financial card management module 22 . The first and second servers 10 and 20 may be disposed on a card issuer of the financial card.

The App 30 is communicatively connected to the first server 10 and is installed on a mobile device 70 held by the cardholder, and the App 30 is authenticated by the password setting module 12 . The mobile device 70 may be a tablet computer or a smart phone, preferably a smart phone.

The authentication device 40 is communicatively connected to the second server 20 through a dedicated network, and has a display element 42 , an input element 44, and a financial card read-write element 46 . In some examples, the authentication device 40 is an automatic teller machine or an automatic teller machine.

In a pre-registration process, the password setting module 12 receives a first authentication data and a second authentication data, and stores the first and second authentication data in the storage sub-module 122 . The first authentication data is composed of the identification information of the mobile device 70 and the personal information of the cardholder, and the second authentication data is an optional digest. The number of bits in the digest is preferably between 512 bits and 1024 bits.

After launching the App 30 , an event will be triggered automatically, requesting input of personal information and debit card account number, and transmitting the entered personal information and account number to the password setting module 12 . Preferably, the App requires a startup password, and the App will be launched only after verifying that the startup password is correct to meet security requirements.

The password setting module 12 performs the following steps after confirming the status of the financial card to the financial card management module 22 : (1) combining the first authentication data according to a combination method to generate a first key, wherein The combination method randomly selects a plurality of combination methods and has a first number; (2) randomly selects an encryption method from the plurality of encryption methods, and the encryption method has a second number; and (3) replaces The first number and the confirmation data encrypted based on the first key are transmitted to the App, the confirmation data includes an encrypted information and the optional digest as described above, wherein the encrypted information includes the second number, and sampling is started position.

The App 30 obtains the identification information of the mobile device 70 and the personal information of the card holder from the mobile device 70 , and combines the identification information and personal information according to a combination method corresponding to the first number to generate a A second key; using the second key to decipher the encrypted information and the optional digest, and encrypt the optional digest according to the encryption method corresponding to the second number and the starting sampling position to obtain an encrypted value ; And, encrypting the encrypted value based on the second key and transmitting the encrypted value to the password setting module 12 .

After confirming the correctness of the encrypted value, a request for obtaining an authentication code is sent to the financial card management module 22 , and an authentication code is obtained; and an authentication code image is generated and transmitted to the App 30 . The password setting module 12 can encrypt the authentication code to produce the authentication code image by using a visual cryptography theory method, so that the plain code value of the authentication code can be read manually by human eyes.

Then, the App 30 displays the authentication code image for use by the cardholder when setting the password of the financial card for the first time through the authentication device 40 . When the password of the financial card is set for the first time, the authentication device 40 reads the financial card through the financial card read-write component 46 , and confirms the status of the financial card with the financial card management module 22 , and then displays the component 42 through A first user interface is automatically provided for the cardholder to input the authentication code and the new password of the financial card through the input element 44 to complete the first password setting.

In another aspect, the present invention provides a method for helping a cardholder to set a password for a financial card for the first time. See flowchart of FIG. 2, which helps the present invention a method of setting the first cardholder financial card of a particular embodiment of a password. As shown in the figure, the method includes the following steps: ( S110 ) providing a first server with a password setting module including a storage sub-module; a second server electrically connected to the first server And a financial card management module; a software product (App) that communicates with the first server, the App is installed on a mobile device held by the cardholder, and the App is approved by the Password setting module authentication; and an authentication device in communication with the second server, the authentication device having a display element, an input element, and a financial card read-write element; ( S120 ) the password setting module is During the registration process: receiving a first authentication data, which is composed of identification information of the mobile device and personal information of the cardholder, and storing the first authentication data in the storage sub-module; and, receiving a The second authentication information is an optional digest, and the second authentication information is stored in the storage submodule; ( S210 ) After the app is started, an event is automatically triggered to request input of personal information and debit card account Number, and send the entered personal information and account number to the password setting module; ( S220 ) After the password setting module confirms the status of the financial card to the financial card management module: combine the first according to a combination method Authentication data to generate a first key, wherein the combination method is randomly selected from a plurality of combination methods and has a first number; among the plurality of encryption methods, an encryption method is randomly selected, and the encryption method has a first The second number; and transmitting the first number to the App and the confirmation data encrypted based on the first key, the confirmation data including an encrypted information and the optional digest, wherein the encrypted information includes the second number, And the first sampling location; ( S230 ) The App obtains the identification information of the mobile device and the personal information of the cardholder from the mobile device, and combines the identification information and the individual according to the combination method corresponding to the first number Information to generate a second key; use the second key to decipher the encrypted information and the optional digest, and according to the second number corresponding to The encryption method and the sampling start position, the encrypted digest managed to obtain an encrypted value; and, after encrypting the second key value based on the encrypted password is transmitted to the setting module; (S310) the password setting mode After confirming the correctness of the encrypted value, the group sends a request for obtaining an authentication code to the financial card management module and obtains an authentication code; and, generates an authentication code image and transmits it to the App; ( S320 ) the App displays the authentication code image for the cardholder to use when setting the password of the financial card for the first time through the authentication device; and ( S410 ) the authentication device reads the financial card through the financial card read-write element, And confirming the status of the financial card to the financial card management module, and then providing a first user interface through the display element for the cardholder to input the authentication code and the new password of the financial card through the input element To complete the first password setup.

The method of helping the cardholder to set the password of the financial card for the first time can be completed with or without the aforementioned system 1 for helping the cardholder to set the password of the financial card for the first time.

The specific embodiments of the present invention are described in more detail by the following examples, but the present invention is not limited to the specific configurations, conditions, and methods provided therein.

Examples 1 : Pre-operation

The financial industry provides a management server (first server), which is installed with a password setting module, for the clerk to apply for a new financial card user (financial card holder, in the example referred to as "user" ), Register the authentication information agreed upon, and the registration information is stored in the database of the password setting module. Its related transaction functions and registration contents are as follows:

1. Binding user mobile device equipment authentication information (first authentication information): a. Login IMEI / UDID / Keychain / MAC / ID number / birthday / mobile phone number / etc. Authentication information. Here, the user who applies for a new financial card can go to the financial institution's branch counter or visit the official website in advance to fill in the application form after checking the IMEI / UDID / Keychain / MAC and other information from their mobile phone. Information login system. The aforementioned authentication information can be bound to the user's ID number. b. Use of the first authentication data: (1) When the first authentication data is bound, the password setting module automatically and randomly specifies the initial value of its combination method, and stores the combination method in the database (3 Bytes). (2) This combination method is used to randomly combine fields such as IMEI / UDID / Keychain / MAC / ID number / birthday. (3) The "combination method" (3 Bytes) stored in the database is actually a number. The database does not store the original content of the combined data. The "combination method" value stored in the database here is only an initial value. The password setting module should automatically and randomly generate a "combination method" value every time it accepts a request, using the new "combination method" value. Update the value of this column in the database. (4) The original content of the combined data will be referred to as "Current_key" (here the first key), and its length should be at least 128 Bytes. This "Current_key" is the key when subsequent sensitive data is to be encrypted with Advanced Encryption Standard (AES). In order to know Current_key, it is necessary to know its "combination method" and its corresponding code. When the first authentication information bound by the original registration is leaked, the current_key content of the user is not directly exposed.

2. Binding User Identification Information (Second Authentication Information): The clerk will register one digest of the user's choice for applying for a new financial card (512 Bytes ≦ Digest ≦ 1024 Bytes). The second authentication information can also be bound to the user's ID number. The optional digest can be provided by the user, or can be selected by the user for the user or by the system randomly from the database.

After completing the pre-operation registration data above, the user can operate the trading device, download / install the "Initial Password Application" (software product (App)) from the Internet environment, and start to report after the installation is completed. Preparatory work completed:

1. The app must provide options such as graphic password, touch-tone password, fingerprint recognition, or face recognition for users to set the startup password of the app.

2. Each time the user executes the app, the app must ask the user to enter the user's ID number, birthday, and debit card account number, and immediately send an uplink message to the password setting module to complete the initial identification of the user. a. The content of the uplink message must include the ID number, birthday, debit card account number, and app version number and date. b. After the server-side password setting module verifies that the user ’s identity and mobile device are correct, it must store the app ’s version number, date, and the current application ’s financial card account number and other upstream message information for future verification of the app during the transaction operation stage. For legitimacy. c. The "Financial Card Account Number" must be a newly applied financial card account number that has not changed its initial password.

Examples 2 : Trading operations

1. The user launches the App such as Example 1 after logging in to the "Startup Password" on the personal device interface. The App requires the user to enter identity authentication information: a. The app displays a message on the personal device interface, asking for the user's ID number, birthday, And debit card accounts. b. Key content of the uplink message = ID number, birthday, debit card account number, and version number and date of the app. c. The uplink message is decoded by the firewall (Web AP F / W) and then transmitted to the host of the password setting module. d. The password setting module checks the legitimacy of the app installed by the user and confirms the current status of the user's financial card account according to the uplink message. (1) The account number of the debit card must be a debit card account that has been newly applied for and has not changed the initial password of the debit card. (2) The status of the debit card must be normal. (3) When the password setting module database has the account information, but it has not timed out for more than 10 minutes, it should reject the application's repeat request for this transaction. (4) When the identity of the user (identification number, birthday, debit card account) is not matched, the password setting module must notify the cardholder via SMS, email, etc. simultaneously. When the accumulated error count exceeds 4 times, the system should reject the transaction and ask the user to contact the customer service staff to review the user's identity and reset the accumulated error count. e. After the password setting module verifies that the uplink message is correct, it generates a reply to the downlink message App: (1) The system stores the user's "combination method" according to the database, and the mobile device authentication data originally bound by the user is output. "Current_key" (first key). (2) The key content of the downlink message = webpage identification code + combination method + "Current_key" AES (encryption method + optional digest + SHA-256 ("Current_key")) + App legitimacy authentication result, where SHA-256 is a Hash function. (a) The "Encryption method" column has a total of 10 Bytes. The first 3 Bytes are placed in the "Combination Method" that produces "Current_key", the 4th to 6th Bytes are placed in the current encryption method item, and the last 4 Bytes are placed in the current encryption. Start sampling position of "Selected Digest". (b) The above values of "encryption method" and "start sampling position" are both randomly generated at the moment of the transaction. This random random value needs to be different from the previous three records. (c) "Web page identification code" is a common identification number for multi-party systems such as the password setting module, App, and financial card system for the same requested transaction. The web page identification value is generated by the password setting module. The life cycle of the webpage identification code value is generated when the password setting module generates a downlink message in response to the App, obtains the authentication code value image in the App, and the cardholder operates the special function of the automatic deposit and withdrawal machine to complete the new password setting of the financial card End. f. Store the content of the aforementioned uplink message and downlink message in the database of the password setting module for subsequent transactions to verify the identity of the user.

2. After the App receives the downlink message of the password setting module: a. When the value of the "App legitimacy result" of the content of the downlink message is successful, according to the "combination method" value of the downlink message (the "encryption method of the downlink message") The first 3 Bytes of the column), get the device data (including IMEI / UDID / Keychain / MAC and other information) from the user ’s mobile device, and the user ’s personal information (identity number / birthday information, etc.) The user logs in and stores it on the mobile device by himself) to generate "Current_key" (second key) (that is, the App has a plurality of combination methods built-in, which can be determined according to the received number Combination method), one is to decrypt the "encryption method" column of the downlink message to obtain the current "encryption method" plain code value; the other is to identify the consistency of the value in the SHA-256 ("Current_key") column of the downstream message The password connected to the App sets the legitimacy of the module host). b. The App then encrypts the content of the "optional digest" according to the current "encryption method" (the 4th to 6th Bytes value and the last 4 Bytes value in the "encryption method" column of the downstream message), and generates an uplink message Send a request for obtaining an authentication code to the password setting module (that is, the App has a plurality of encryption methods built in, and the encryption method used can be determined according to the received number). (1) Key content of the uplink message = webpage identification code + Mobile value + Verify value + some data of the uplink and downlink messages in the previous steps (a) Mobile value = SHA-256 ("Current_key" ( b) Verify value = "Current_key" AES {(encrypt the "optional digest" content according to the encryption method) + SHA-256 ("optional digest" content)}; the "encryption method" column totals 10 bytes, the first 3 Bytes puts the "Combined Method" of "Current_key", the 4th to 6th Bytes puts the current encryption method item, and the last 4 Bytes puts the starting sampling position of "Selected Digest" when the current encryption is made. The app obtains it according to the aforementioned downlink message "Encryption method" value, start sampling with the "Start Sampling Position" value of the specified "Selected Digest", execute the corresponding encryption code with the specified "Encryption method" number value, and generate x value after encryption , Its length should be at least 128 Bytes. After that, the value of x and the related hash function value are protected by AES encryption of "Current_key" (second key). (2) The App sends the uplink message to the server after it is encrypted by SSL. Password setting Host module.

3. After the password setting module receives the uplink message of the App (requesting an authentication code): a. According to the user's current transaction information, check the content of the App's uplink message to identify the mobile device device content (IMEI / UDID / Keychain / MAC), the legality of the user's personal information (ID card number / birthday), and the correctness of the installed app, so as to identify the user. b. When the identity of the user is not identified, the password setting module must notify the cardholder via SMS, email, etc. simultaneously. When the accumulated error count exceeds 4 times, the system should reject the transaction and ask the user to contact the customer service staff to review the user's identity and reset the accumulated error count. c. After verifying the identity of the user, the password setting module generates the content of the uplink message, and sends a request to the host of the financial card system (second server) to obtain the current authentication code value. (1) The content of the uplink message includes: web page identification code, financial card account number, transaction date, transaction time, ATM machine number (here blank value), ATM transaction serial number (here blank value), and authentication code value (here Is blank). (2) After the financial card system (financial card management module) verifies that the upstream message is correct, it randomly generates "authentication code value" and responds to the password setting module. (a) "Authentication code" is used as a financial card system for subsequent cardholders to insert a new physical financial card into an automatic deposit and withdrawal machine (authentication device), operate a specific transaction, and complete the setting of a new password for a financial card. Cardholder identification. (b) The "authentication code" generated dynamically and randomly by the financial card management module is valid for 10 minutes and the authentication code value is a random number of 6-8 digits. (c) The financial card management module stores this transaction requirement content for subsequent cardholders to use the new physical financial card to insert automatic deposit and withdrawal machines and operate specific transactions, and complete the new password setting of the financial card as a financial card system For cardholder identification. d. After receiving the authentication code value, the password setting module first adopts the "Visual Cryptography Theory Method" to clearly output the "authentication code value image" of the initial password value of the financial card, and then generates a downlink message (including the encrypted one). Authentication code value image), reply to App after SSL encryption. (1) The "authentication code value image" is encrypted using "theoretical method of visual cryptography": (a) Step 1: Randomly obtain the base map or background color (b) Step 2: Produce several interference lines in the background ( Line color, thickness, length, and position are randomly generated) (c) Step 3: Produce numbers (random number colors, fonts, glyphs, shift to different directions (PIXEL) to produce the same number multiple times) (d) Step 4 : Generate several interference lines in the foreground (line color, thickness, length, and position are randomly generated) (e) Step 5: Generate JPEG image file (f) After the password value is properly encrypted and protected by this method, the The clear value of the image needs to be read by human eyes. (2) The key content of the downlink message: webpage identification code, authentication code value image, app legitimacy authentication result and other data. (3) The password setting module updates the database's current transaction processing status and identity authentication results. (4) In addition to the image of the authentication code value, the content of this downlink message should also include informing the cardholder to operate the specific function of the automatic deposit and withdrawal machine to complete the new password setting of the financial card within a time limit (for example, 10 minutes). (5) The password setting module must simultaneously notify the cardholder via SMS and email: the authentication code value is completed, and the cardholder is requested to operate the specific function of the automatic deposit and withdrawal machine within the time limit to complete the new password setting of the financial card and other information .

4. After receiving the downlink message (including the authentication code value image) from the password setting module, the App: a. Display the authentication code value image on the personal device interface. b. Display a message informing the cardholder that the specific function of the ATM is completed within the time limit to complete the setting of the new password of the debit card and other information on the personal device interface. c. The app stores the key data of this transaction selection in an encrypted file on the personal device device side. This file uses the first-in-first-out method and stores a maximum of ten transaction records.

5. After obtaining the authentication code, the user (cardholder) must insert the new physical financial card into the automatic deposit and withdrawal machine (authentication device) and operate the specific transaction to complete the setting of the new password for the financial card. a. Specific transaction functions of the authentication device: (1) This specific transaction function refers to the current "Financial Card Reset Password" transaction function at the branch counter (non-financial card password change transaction) for cardholders to insert a new physical financial card application The automatic deposit and withdrawal machine, input the current authentication code value and the new password value of the financial card set on the interface of the automatic deposit and withdrawal machine, complete the setting of the new password of the financial card. (2) Data processing flow of specific transaction function: (a) The specific transaction function calls the software in the physical financial card chip, and asks it to randomly generate a random number. (b) Generate an uplink message and send a request to the financial card management module to generate a new password value for the financial card. Key data of the uplink message: financial card account number, authentication code, new password for the financial card, and chaotic values of the current output of the financial card chip software. (c) After the financial card management module verifies that the upstream message is correct, the connected calling entity's garbled device (Hardware DES) generates a garbled new financial card's new password value. (d) The financial card management module generates a downlink message (containing the "new garbled financial card password") and responds to the specific transaction function of the ATM. (e) The specific transaction function calls the software in the physical financial card chip, and asks it to unlock the card and write the "new garbled financial card password" to the chip. b. The "authentication code" that is dynamically and randomly generated by the financial card management module each time has a certain valid time limit, and the cardholder must complete the setting of the new password of the financial card within the time limit. c. When the debit card has completed the new password setting operation, the automatic deposit and withdrawal machine should refuse the cardholder to perform specific transaction functions repeatedly.

6. When the user (cardholder) forgets the authentication code value, the user must re-execute the complete procedure of the transaction operation (the above steps 1. to 5.) to obtain the new authentication code value.

7. When the user (cardholder) fails to complete the new password setting of the financial card from the automatic deposit and withdrawal machine within the time limit, the current authentication code will expire and the user must re-execute the transaction operation (step 1 above). ~ 6.) Complete procedure to get new authentication code value.

To sum up, the present invention separates the two physical devices of the transaction device (mobile device equipment) and the authentication device (automatic deposit and withdrawal machine) from each other, and the cardholder manually obtains the authentication code through the mobile device, prompting the two The physical device handles the same transaction request, and completes the identity check and authentication process within a limited time and time, so that the cardholder can operate the automatic deposit and withdrawal machine in time to complete the setting of the new password of the financial card. These multi-factor transaction security models not only meet the requirements of the competent authority for the use of "two or more technologies" for transaction security design, but also ensure that the electronic transaction is completed manually and completely prevent the remote control of Trojan horse programs. Trading risks.

The present invention adopts a two-stage identity authentication mode (including personal data of users, authentication data of binding transaction devices and user identification data, and whether the transaction is manual operation), which is different from the usual "password" as The unique authentication mode can comprehensively and substantially strengthen the transaction security threshold for user identification.

The operation of the transaction framework of the present invention requires a user to hold a physical financial card and insert an automatic deposit and withdrawal machine to operate a specific transaction function. After entering the current authentication code value and the new password value set by the financial card, the new password for the financial card is completed. Setting operation. The hacker cannot remotely control the manual operation to complete the setting of the new password of the debit card.

For the user, the burden and risks related to the safekeeping, loss, and theft of paper password letters can be excluded. For gangsters and hackers, they need to obtain the user ’s physical financial card, the bound physical mobile device, the “startup password” of the app, and the user ’s personal information before they have the opportunity to obtain the authentication code value. Set up the new password of the debit card within. More often than not, you can commit a crime only after obtaining a paper password and a physical financial card. The threshold for prevention has been raised significantly.

For financial institutions, in addition to ensuring that information security thresholds are raised, the present invention can replace the cumbersome procedures of printing manual password letters for financial institutions, saving related manual operations, environmental facilities, printing machines, paper, and postal services. , Custody, storage, information security control and risk audit, etc., and can achieve the effect of energy saving and carbon reduction.

1 ‧‧‧A system for helping cardholders to set a password for a financial card for the first time

10 ‧‧‧First server

12 ‧‧‧ Password Setting Module

122 ‧‧‧Storage Submodule

20 ‧‧‧Second server

22 ‧‧‧Financial Card Management Module

30 ‧‧‧Software Products

40 ‧‧‧certified device

42 ‧‧‧Display element

44 ‧‧‧input components

46 ‧‧‧Financial Card Reader

70 ‧‧‧ mobile device

S110 ~ S410 ‧‧‧ step flow

FIG. 1 is a block diagram of a system according to a specific embodiment of the present invention.

FIG. 2 is a flowchart illustrating a method according to a specific embodiment of the present invention.

no

Claims (10)

A system for helping cardholders to set a password for a financial card for the first time includes: a first server provided with a password setting module including a storage sub-module; a second server and the first server It is electrically connected and is provided with a financial card management module; a software product (App) that communicates with the first server, the App is installed on a mobile device held by the cardholder, and the App is Authenticated by the password setting module; and an authentication device in communication with the second server, the authentication device having a display element, an input element, and a financial card read-write element; wherein: the password setting module is in a In the pre-registration process: receiving a first authentication data, which is composed of identification information of the mobile device and personal information of the cardholder, and storing the first authentication data in the storage sub-module; and, receiving A second authentication data, which is an optional digest, and stores the second authentication data in the storage submodule; the app automatically triggers an event after launching, and requires the input of personal information and debit card Account and sends the entered personal information and account number to the password setting module; after the password setting module confirms the status of the financial card to the financial card management module: combine the first authentication data according to a combination method, To generate a first key, wherein the combination method is randomly selected from a plurality of combination methods and has a first number; among the plurality of encryption methods, an encryption method is randomly selected, and the encryption method has a second number; And, transmitting the first number to the App, and the confirmation data encrypted based on the first key, the confirmation data includes an encrypted information and the optional digest, wherein the encrypted information includes the second number, and at the beginning Sampling location; the App obtains the identification information of the mobile device and the personal information of the card holder from the mobile device, and combines the identification information and personal information according to the combination method corresponding to the first number to generate a first Two keys; use the second key to decipher the encrypted information and the optional digest, and according to the encryption method corresponding to the second number and the open At the initial sampling position, encrypt the optional digest to obtain an encrypted value; and encrypt the encrypted value based on the second key and send it to the password setting module; the password setting module confirms the encrypted value After correctness, when it is correct, send a request to obtain the authentication code to the financial card management module and obtain an authentication code; and, generate an authentication code image and send it to the App; the App displays the authentication code map For example, it is used by the cardholder to set the password of the financial card for the first time by the authentication device; and the authentication device reads the financial card through the financial card read-write component and confirms the financial card management module with the The status of the financial card, and then a first user interface is provided through the display element for the cardholder to input the authentication code and the new password of the financial card through the input element to complete the first password setting. For example, the system for requesting item 1 to help a cardholder set a password for a financial card for the first time, wherein the password setting module provides a second user interface for the operator of the issuer of the financial card to input the first authentication information and the Second certification information. For example, if item 1 is a system for helping cardholders to set a password for a financial card for the first time, the app requires an activation password. For example, if the system of claim 1 is used to help a cardholder set a password for a financial card for the first time, the first user interface of the authentication device requires an authentication code and a new password, and at least a part of the personal information, The information sent to the financial card management module is a request to set a new password. For example, if the system for requesting item 4 to help the cardholder to set the password of the financial card for the first time, the financial card management module confirms that the received authentication code and personal information are correct, obtains the garbled new password, and transmits it to the An authentication device for writing the garbled new password to the financial card through the financial card read-write element. A method for helping cardholders to set a password for a financial card for the first time, including: providing a first server provided with a password setting module including a storage submodule; a second server and the first server The device is electrically connected and provided with a financial card management module; a software product (App) communicates with the first server, the App is installed on a mobile device held by the cardholder, and the App Is authenticated by the password setting module; and an authentication device, which is communicatively connected with the second server, the authentication device has a display element, an input element, and a financial card read-write element; the password setting module is During the registration process: receiving a first authentication data, which is composed of identification information of the mobile device and personal information of the cardholder, and storing the first authentication data in the storage sub-module; and, receiving a The second authentication information is an optional digest, and the second authentication information is stored in the storage sub-module; the app automatically triggers an event after launching, and requires input of personal information and account number of the financial card And send the entered personal information and account number to the password setting module; after confirming the status of the financial card with the financial card management module, the password setting module combines the first authentication data according to a combination method to generate A first key, wherein the combination method is randomly selected from a plurality of combination methods and has a first number; an encryption method is randomly selected from the plurality of encryption methods, the encryption method has a second number; and, Send the first number to the App, and the confirmation data encrypted based on the first key, the confirmation data includes an encrypted information and the optional digest, wherein the encrypted information includes the second number, and a sampling location at the beginning ; The App obtains the identification information of the mobile device and the personal information of the card holder from the mobile device, and combines the identification information and personal information according to the combination method corresponding to the first number to generate a second gold Key; use the second key to decipher to get the encrypted information and the optional digest, and according to the encryption method corresponding to the second number and the start fetch Position, encrypt the optional digest to obtain an encrypted value; and encrypt the encrypted value based on the second key and send it to the password setting module; the password setting module confirms the correctness of the encrypted value Then, when it is correct, a request for obtaining an authentication code is sent to the financial card management module, and an authentication code is obtained; and, an authentication code image is generated and transmitted to the App; the App displays the authentication code image, For the cardholder to set the password of the financial card for the first time through the authentication device; and the authentication device reads the financial card through the financial card read-write component and confirms the financial card to the financial card management module State, and then provide a first user interface through the display element for the cardholder to input the authentication code and the new password of the financial card through the input element to complete the first password setting. For example, if the method of requesting item 6 is to help the cardholder set the password of the financial card for the first time, the password setting module provides a second user interface for the operator of the issuer of the financial card to input the first authentication information and the second Certification information. For example, the method for requesting item 6 to help a cardholder set a password for a financial card for the first time, wherein the app requires an activation password. For example, the method for requesting item 6 to help a cardholder set a password for a financial card for the first time, wherein the first user interface of the authentication device requires an authentication code and a new password, and at least a portion of the personal information, based on the input The information sent to the financial card management module is a request to set a new password. For example, the method for requesting item 9 to help a cardholder set a password for a financial card for the first time, wherein the financial card management module confirms that the received authentication code and personal information are correct, obtains a garbled new password, and transmits it to the An authentication device for writing the garbled new password to the financial card through the financial card read-write element.