WO2012155818A1

WO2012155818A1 - Method and device for protecting user information based on credible resource

Info

Publication number: WO2012155818A1
Application number: PCT/CN2012/075436
Authority: WO
Inventors: 柴洪峰; 徐燕军; 康建明; 鲁志军; 单长胜; 徐静雯; 何朔
Original assignee: 中国银联股份有限公司
Priority date: 2011-05-13
Filing date: 2012-05-14
Publication date: 2012-11-22
Also published as: CN102780686A

Abstract

A method for protecting bank user information based on credible resource is provided by the invention. The method comprises the following steps of: A, acquiring a user card number from a browse page accessed by a user; B, determining the bank identification code for the user card number; C, determining the bank discrimination information about the user card number based on the bank identification code for the user card number; D, based on the bank discrimination information about the user card number and the browse page accessed by the user, prompting information about current operation to the user.

Description

Method and device for protecting bank user information based on trusted resources

Priority claim

The present application claims priority to Chinese Patent Application No. 201110124325.7, entitled "A Method and Apparatus for Protecting Bank User Information Based on Trusted Resources", filed on May 13, 2011, the entire contents of which are incorporated by reference. Combined in this application. Technical field

The present invention relates to network security and, more particularly, to a method and apparatus for protecting bank user information based on trusted resources. Background technique

With the development of Internet payment services, online payment brings various kinds of problems while providing payment convenience. Among them, phishing fraud is one of the most prominent problems. According to the latest statistics, recently, the official website of the cloning bank, the fraudulent activity of sending SMS to swindle the funds of online banking users again. According to the monitoring data of the China Internet Information Reporting Center, since 2010, the number of bank-related fraudulent websites has increased significantly, and more than 70 cloned websites have been cloned. In the case of public reports in the media, the amount of users who were cheated was as high as one million yuan. According to the National Computer Network Emergency Center, the losses caused by "phishing" to e-commerce users have reached 7.6 billion yuan, and the average amount of online shopping users to be "fished" is 86 yuan.

In the case of phishing scams, the cardholder is confused by the phishing website and enters the correct username (including account information) and password; or, in the form of phishing emails and phishing emails, gives fake links in emails and text messages, spoofing The cardholder logs into the phishing website in the fake link to defraud the cardholder's authentic identity authentication information.

In response to these phishing methods, banks and some payment companies have designed a variety of ways to prevent them, but these methods can only prevent their free websites or bank cards/payment cards from being phishing, and cannot provide a unified prevention policy to protect all cards. people.

In addition, the prior art adopts a blacklist method, and in the case where the current phishing websites are endless, the blacklist method is difficult to manage.

Another common feature of the prior art is the verification of the user's legal identity, such as being widely used. Username and password method. However, fraudulent use of stolen real legal identity makes it difficult for banks and payment companies to defend against online banking systems. Therefore, in order to solve the above and other problems, a unified defense technology solution is needed. Summary of the invention

In order to solve the above and other problems, according to an object of the present invention, a method for protecting bank user information based on a trusted resource including bank authentication information and a bank identification code, wherein the bank identification information and the bank identification code are provided, Corresponding; the bank user information includes a user card number and a user password; the method includes the following steps:

A. Obtain a user card number from a browsing page accessed by the user;

B. Determine a bank identification code for the user card number;

C. determining bank identification information about the user card number based on the bank identification code regarding the user card number;

D. Prompting the user for information about the current operation based on the bank authentication information about the user card number and the browsing page accessed by the user.

Preferably, in step A, the user card number is obtained from the sequence entered by the user in the browsing page. Preferably, the sequence is a string of numbers from 13 to 19 bits.

Preferably, the sequence includes a digit string of 13 to 19 bits and other non-numeric symbols.

Preferably, the time interval of the input operations of the numbers in the sequence is less than one second.

Preferably, the bank authentication information comprises a bank trusted payment website and/or a bank trusted IP address.

Preferably, the user is prompted to information about the current operation by comparing the bank trusted payment web address in the bank authentication information of the user card number with the web address of the browsing page accessed by the user.

Preferably, the prompt is in the form of a pop-up window in the browsing page.

Preferably, in step D, when it is determined that the user is using the browsing page to access the non-trusted resource, the user is prompted to perform the current operation unsafe.

Preferably, the trusted resource further includes a bank card number check bit position and a bank card number check algorithm. In step D, when it is determined that the user is using the browse page to access the trusted resource, the step D further includes: Determining the check digit position and verification algorithm of the user card number by using the bank identification code of the user card number, and verifying the user card number by using the check digit position and the check algorithm of the user card number, and prompting the user when the user card number verification is successful The current operation is a safe operation.

According to another object of the present invention, there is provided an apparatus for protecting bank user information based on a trusted resource, the trusted resource comprising bank authentication information, a bank identification code, wherein the bank authentication information corresponds to a bank identification code; the bank user information includes a user card number and a user password; the device includes a storage unit, a capture unit, and a judging unit, wherein

The storage unit is used to store and manage trusted resources;

The determining unit is configured to determine a bank identification code for the user card number,

The determining unit is further configured to determine bank identification information of the user card number based on the bank identification code regarding the user card number,

The judging unit is further configured to prompt the user for information on the current operation based on the bank authentication information regarding the user card number and the browsing page accessed by the user.

Preferably, the capture unit obtains the user card number from the sequence entered by the user in the browsing page. Preferably, the sequence is a string of numbers from 13 to 19 bits.

Preferably, the judging unit prompts the user for information on the current operation by comparing the bank trusted payment web address in the bank authentication information about the user card number with the web address of the browsing page accessed by the user.

Preferably, the prompt is in the form of a pop-up window in the browsing page.

Preferably, when the user is using the browsing page to access the non-trusted resource, the determining unit prompts the user that the current operation is not secure.

Preferably, the trusted resource further includes a bank card number check bit position and a bank card number verification algorithm. When determining that the user is using the browse page to access the trusted resource, the determining unit is further configured to: determine by using a bank identification code about the user card number Check digit position and check of user card number The algorithm, and using the check digit position and check algorithm of the user card number to verify the user card number, and prompting the user to perform the current operation as a safe operation when the user card number verification is successful.

Preferably, the browsing page is a browsing page generated in a browser of a personal computer or a handheld communication device.

Preferably, the storage unit is a remote storage unit.

Preferably, the device is installed as a plugin in a browser used by the user to access the browsing page. Preferably, the device automatically starts monitoring service with the activation of the browser.

An advantage of the present invention is that it is easier to implement based on trusted resource information than blacklist management, and is more secure and reliable.

Another advantage of the present invention is that the screen blur capture technology is adopted, that is, not only for the pure digital string, but also for the middle of the separator, and the digital string with the operation time interval in the middle performs the capture action, which expands the scope of protection.

Another advantage of the present invention is the card number verification function, which is more accurate for payment operation prompts and better protects cardholder account information.

Another advantage of the present invention is that the IE security plug-in technology is adopted, which is convenient for installation, automatic triggering, and background operation, and does not affect the card holder's usual use, and is easy to accept.

DRAWINGS

Various aspects of the present invention will become apparent to those skilled in the <RTIgt; It should be understood by those skilled in the art that these drawings are only intended to illustrate the technical solutions of the present invention, and are not intended to limit the scope of the present invention. among them,

1 is a flow diagram of a method of protecting bank user information based on trusted resources, in accordance with an embodiment of the present invention. 2 is a schematic diagram of an apparatus for protecting bank user information based on trusted resources, in accordance with an embodiment of the present invention.

detailed description

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be further described in detail with reference to the accompanying drawings. In the present invention, the trusted resource can be stored in the database as a table, as shown in Table 1 below, the trusted resource can include the bank name, the bank trusted payment address, the bank identification code, the card number check digit location, and the card number. Algorithm. These data items for specific banks can provide a basis for protecting specific bank user information. In addition, trusted resources for each bank of all cardholders can be maintained in the Trusted Resource Table, which provides uniform protection for all cardholders. Trusted resource tables are easier to maintain than blacklists.

Table 1

Those skilled in the art will appreciate that the data items in Table 1 may also be other types or forms of information. For example, a bank trusted IP address can be used instead of a bank trusted payment address as a bank authentication information to provide cardholders with secure authentication. Here, the bank card bin is a bank identification code of a bank to which each card number is identified.

The bank user information to be protected includes the user card number and the user password. In one embodiment, the trusted resource may only include bank authentication information and a bank identification code, wherein each bank's bank authentication information corresponds to a bank identification code.

As shown in FIG. 1, there is shown a flow chart of a method for protecting bank user information based on trusted resources in accordance with an embodiment of the present invention.

In step A, the user card number is obtained from the browsing page accessed by the user. For example, as is well known to those skilled in the art, the user card number can be obtained from an input sequence in a browsing page accessed by the user. The sequence can be a string of numbers from 13 to 19 bits. Alternatively, the sequence may include a numeric string of 13 to 19 bits and other non-numeric symbols, such as spaces or commas or dashes, and the like. Alternatively, the time interval of the input operation of the numbers in the sequence is less than 1 second, so that in the case where the digital string is edited in multiple edit boxes, as long as the keyboard numeric key operation and the keyboard shift key operation and the mouse The time interval between move operations is less than 1 second and is also within the range of sequence capture. Those skilled in the art It should be understood that the capture described above can be accomplished in a variety of ways, such as by a computer program. Through this fuzzy capture method, the protection range of the user card number can be expanded. After determining the input sequence, the corresponding user card number conforming to the bank card number format can be extracted from the sequence according to the general bank card number format.

In step B, a bank identification code for the user card number, i.e., card bin, is determined. This step can be done by matching the acquired user card number with the bank identification code in the trusted resource.

In step C, bank identification information about the user card number is determined based on the bank identification code for the user card number. Here, the bank authentication information corresponds to the bank identification code, that is, a bank identification code corresponds to a bank identification information.

In step D, the user is prompted for information about the current operation based on the bank authentication information about the user card number and the browsing page accessed by the user. For example, the user's information about the current operation can be prompted by comparing the bank trusted payment web address in the bank authentication information about the user card number with the web address of the browsing page accessed by the user.

In an embodiment, when the bank trusted payment website in the bank identification information about the user card number is inconsistent with the website address of the browsing page accessed by the user, it is determined that the user is accessing the non-trusted resource by browsing the page, thereby prompting the user to perform the current operation. Not safe. Here, the pop-up dialog box may prompt the user that the currently accessed page may be an illegal page. In this way, when it is detected that the page accessed by the user is unsafe, the user is immediately notified of the security of the current operation before the user inputs the password or before the user clicks the confirmation button after entering the password.

In another embodiment, the trusted resource may further include a bank card number check bit position and a bank card number verification algorithm. In step D, when it is determined that the user is using the browse page to access the trusted resource,

The bit position and check algorithm, and the user card number is verified using the check digit position and check algorithm of the user card number. When the user card number verification is successful, the user is prompted to perform the current operation as a safe operation. Alternatively, when the user card number verification is successful, the user is prompted to perform a payment operation, and the user should pay attention to checking the information and protecting the security of the account, so that the user information can be more accurately and better protected.

2 is a schematic diagram of an apparatus for protecting bank user information based on trusted resources, in accordance with an embodiment of the present invention.

As shown in FIG. 2, the protection device for protecting bank user information based on the trusted resource includes a storage unit, a capturing unit, and a determining unit. The storage unit is used to store and manage trusted resources. Here, save The storage unit may be disposed within the protection device or may be a remote storage unit configured to determine a bank identification code for the user card number via the network disconnect unit. Here, the judging unit may match the number in the user card number according to the bank identification code stored in the storage unit to determine the bank to which the user card number belongs.

The judging unit is further configured to determine the bank identification information of the user card number based on the bank identification code regarding the user card number.

In one embodiment, the judging unit prompts the user for information regarding the current operation by comparing the bank trusted payment web address in the bank authentication information about the user card number with the web address of the browsing page accessed by the user.

In an embodiment, the trusted resource may further include a bank card number check bit position and a bank card number verification algorithm.

When it is determined that the user is using the browsing page to access the trusted resource, the determining unit is further configured to:

Determining the check digit position and verification algorithm of the user card number by using the bank identification code of the user card number, and verifying the user card number by using the check digit position and the check algorithm of the user card number, and prompting when the user card number verification is successful The user's current operation is a safe operation.

In an embodiment of the invention, the browsing page may be a browsing page generated in a browser of a personal computer or handheld communication device.

In another embodiment of the invention, the protection device is installed as a plug-in in a browser used by the user to access the browsing page. Optionally, the protection device automatically starts monitoring service with the activation of the browser. Here, the protection device can be a browser security plug-in, so there is no application, automatic installation, and the resident memory will be stored after installation. This protection mode is completely transparent to the user and does not interfere with the daily operation of the user, and is convenient for the user to accept. It will be apparent to those skilled in the art that <RTIgt; </ RTI> <RTIgt; </ RTI> <RTIgt; </ RTI> <RTIgt; </ RTI> <RTIgt; Such changes and substitutions are intended to fall within the scope of the appended claims.

Claims

Rights request

A method for protecting bank user information based on a trusted resource, wherein the trusted resource comprises bank identification information and a bank identification code, wherein the bank identification information corresponds to a bank identification code;

Bank user information includes user card number and user password;

The method includes the following steps:

A. Obtain a user card number from a browsing page accessed by the user;

B. Determine a bank identification code for the user card number;

2. The method according to claim 1, wherein in step A, the user card number is obtained from a sequence entered by the user in the browsing page.

3. Method according to claim 2, characterized in that said sequence is a string of numbers from 13 to 19 digits.

4. The method of claim 2, wherein the sequence comprises a digit string of 13 to 19 bits and other non-numeric symbols.

5. Method according to claim 2, characterized in that the time interval of the input operations of the numbers in the sequence is less than one second.

6. The method according to claim 1, wherein the bank authentication information comprises a bank trusted payment website and/or a bank trusted IP address.

7. The method according to claim 6, wherein the information about the current operation of the user is prompted by comparing the bank trusted payment website in the bank authentication information about the user card number with the website address of the browsing page accessed by the user.

8. The method of claim 1, wherein the prompt is in the form of a pop-up window in the browsing page.

9. The method according to claim 1, wherein in step D, when it is determined that the user is using the browsing page to access the non-trusted resource, the user is prompted to perform the current operation unsafe.

10. The method of claim 1 wherein:

The trusted resource further includes a bank card number check bit position and a bank card number check algorithm. In step D, when it is determined that the user is using the browse page to access the trusted resource, the step D further includes:

Determining the check digit position and verification algorithm of the user card number by using the bank identification code of the user card number, and verifying the user card number by using the check digit position and the check algorithm of the user card number, and prompting the user when the user card number verification is successful The current operation is a safe operation.

11. A device for protecting bank user information based on a trusted resource, wherein the trusted resource comprises bank identification information and a bank identification code, wherein the bank authentication information corresponds to a bank identification code.

Bank user information includes user card number and user password;

The device includes a storage unit, a capture unit, and a judging unit, wherein

The storage unit is used to store and manage trusted resources;

The determining unit is configured to determine a bank identification code for the user card number, The determining unit is further configured to determine bank identification information of the user card number based on the bank identification code regarding the user card number,

12. Apparatus according to claim 11 wherein the capture unit obtains the user card number from a sequence entered by the user in the browsing page.

13. Apparatus according to claim 12 wherein said sequence is a string of numbers from 13 to 19 bits.

14. Apparatus according to claim 12 wherein said sequence comprises a digit string of 13 to 19 bits and other non-numeric symbols.

15. Apparatus according to claim 12 wherein the time interval between the input operations of the digits in the sequence is less than one second.

16. Apparatus according to claim 11 wherein said bank authentication information comprises a bank trusted payment website and/or a bank trusted IP address.

17. The apparatus according to claim 16, wherein the judging unit prompts the user for information on the current operation by comparing the bank trusted payment web address in the bank authentication information about the user card number with the web address of the browsing page accessed by the user. .

18. The apparatus of claim 11, wherein the prompt is in the form of a pop-up window in a browsing page.

19. The apparatus according to claim 11, wherein when the user is using browsing When the page accesses the non-trusted resource, the judging unit prompts the user that the current operation is not secure.

20. Apparatus according to claim 11 wherein:

The trusted resource further includes a bank card number check bit position and a bank card number verification algorithm. When it is determined that the user is using the browse page to access the trusted resource, the determining unit is further configured to:

The apparatus according to claim 11, wherein the browsing page is a browsing page generated in a browser of a personal computer or a handheld communication device.

22. The apparatus according to claim 12, wherein the storage unit is a remote storage unit.

23. The apparatus according to claim 12, wherein the apparatus is installed as a plug-in in a browser used by a user to access a browsing page.

24. Apparatus according to claim 23 wherein said apparatus automatically initiates monitoring services as the browser is activated.