CN101101686A - Electronic bank authentication method, system and smart card using the method - Google Patents

Abstract

The invention provides an electronic bank authentication method, an electronic bank authentication system and a smart card using the method. The electronic bank authentication system includes a smart card, a card reader with a terminal for reading and writing the smart card, and a server connected to the card reader through the network; the card reader receives biometric information through the terminal, and uses the system private key to input the biometric information. The first function value is secretly signed to generate the user's private key, and the user's private key is stored in the smart card; the smart card uses the user's private key to sign the second function value of the message to be signed, and sends the signed message to the server through the card reader ; The server uses the pre-stored biometric information and system public key to verify the signature.

Description

Electronic bank authentication method, and system and smart card using the method

technical field

The present invention relates to secure communication, in particular to an electronic bank authentication method, an electronic bank authentication system using the method and a smart card.

Background technique

With the establishment and improvement of the global information network, the development of electronic banking has become an irresistible trend. Provide customers with multi-channel and multi-form online financial services, greatly breaking through and extending the traditional bank counter business. Compared with traditional banking, electronic banking has great advantages. Firstly, electronic banking adopts a brand-new operation mode; secondly, electronic banking has low cost and high efficiency. Therefore, it is developing very rapidly in the world. However, since the two sides of the electronic banking transaction——the bank and the customer do not meet each other, this transaction is convenient but also has certain security risks. For both parties to a transaction, the privacy, integrity and non-repudiation of information transmission are key factors affecting transaction security.

It is for security and ease of use considerations that smart cards have been widely used in the financial industry in recent years. The rapid rise of bank card intelligence is mainly driven by the following aspects: first, smart cards are more and more widely used across industries; second, cash transactions are gradually decreasing; third, credit card fraud is becoming more and more rampant; fourth, the global Smart card payment systems are gaining popularity. However, the current protection of smart cards is basically based on passwords. In order not to forget passwords, users often use simple and easy-to-remember passwords, which weakens the security of the system. At the same time, the phenomenon that the user forgets the password also occurs from time to time. Moreover, the password cannot be bound to the user's identity, and anyone who obtains the password can use the credit card for consumption.

Fig. 1 is a flow chart of electronic bank authentication in the prior art.

As shown in Figure 1, in step 1, the user enters the account information by swiping the card;

Step 2, the user enters the account password (password) from the front keyboard, and the user password (password) is sent to the background server to implement the authentication process;

Step 3, use the secret k in the card to authenticate with the background server through an authentication protocol;

Step 4, once the authentication is passed, complete a reasonable transaction according to the user's reasonable wishes.

Here, the secret k in the card exists in two situations: (1) in the symmetric cryptographic environment, k is the shared secret between the smart card and the background server; (2) in the public key cryptographic environment, k is the user’s private key, and the corresponding , in the background server, there is a public key certificate corresponding to this private key.

Fig. 2 is another flow chart of electronic bank authentication in the prior art.

As shown in Figure 2, in step 1, the user enters the account information by swiping the card;

In step 2, the user enters the smart card personal identification code (PIN code) from the keyboard at the front desk to start the smart card;

In step 3, use the secret k in the card to carry out an authentication protocol with the background server;

In step 4, once the authentication is passed, a reasonable transaction is completed according to the user's reasonable wishes.

Apparently, the second prior art solution is more reasonable than the first prior art solution, and has higher security.

In the existing technology, the combination of IC card and password is actually the key to start banking business. However, when users set passwords, they often use "birthday", "name", and other easily memorized numbers and/or letter combinations as passwords. And when the user enters the password, it may encounter the shooting of the camera. Therefore, when the smart card is lost, the user account is likely to be compromised. Moreover, the network authentication trend of the original system is to adopt the public key cryptography technology which is more convenient for authentication, but this requires the bank to establish a public key infrastructure (PKI) to realize the management and use of digital certificates. For example, my country's "People's Bank of China" invested in the development of a CA (digital certificate) system many years ago. But this is more tedious and expensive.

Contents of the invention

The purpose of the present invention is to enhance the security of the system without destroying the functions of the original system, and the improved new system is fully compatible with the original system.

Specifically, in the solution of the present invention, biometric features are introduced. The function of biometric feature is double, it not only cooperates with password to implement smart card local authentication, but also utilizes biometric feature to implement remote network authentication. The final requirement is to achieve two goals: (1) Local authentication of smart cards not only relies on passwords, but also uses biometric information; (2) In the network authentication with the background server, identity-based cryptography using biometrics as the public key is used , so as to achieve the purpose of eliminating the need for digital certificates and their corresponding and expensive public key infrastructure.

According to the first aspect, the present invention provides an electronic bank authentication method, including using the system private key to secretly sign the first function value of the biometric information as input, and generating the user private key; using the user private key as the input of the message to be signed Two-function value signature; use pre-stored biometric information and system public key to verify the signature.

According to the second aspect, an electronic bank authentication system is provided, including a smart card, a card reader with a terminal for reading and writing the smart card, and a server connected to the card reader through the network; the card reader receives biometric information through the terminal, and uses the system private key Secretly sign the first function value of the biometric information as the input, generate the user private key, and store the user private key in the smart card; the smart card uses the user private key to sign the second function value of the message to be signed as the input, and the signed The message is sent to the server through the card reader; the server uses the pre-stored biometric information and system public key to verify the signature.

According to a third aspect, there is provided a smart card for an electronic bank authentication system, the electronic bank authentication system includes a smart card, a card reader with a terminal for reading and writing the smart card, and a server connected to the card reader through a network; the smart card The user's private key is stored, and the user's private key is generated by the card reader using the system private key to secretly sign the first function value of the biometric information as the input; the smart card uses the user's private key to sign the second function value of the message to be signed as the input , and send the signed message to the server through the card reader, so that the server can use the pre-stored biometric information and system public key to verify the signature.

The invention adopts an authentication system based on biometric features, which not only can complete efficient and safe electronic transactions, but also because of the particularity based on biometric features, the user's identity and biometric features are uniquely bound. In this way, even if another person obtains the smart card, the authentication operation cannot be completed. At the same time, the user can also choose a method that does not need to memorize any password. Since we use effective identity-based cryptography to implement network authentication, expensive public key infrastructure construction is omitted.

Description of drawings

The present invention will be described in more detail below by way of example with reference to the accompanying drawings, in the figure:

Fig. 1 is a flow chart of electronic bank authentication in the prior art;

FIG. 2 is a flow chart of another electronic bank authentication in the prior art;

FIG. 3 is a flowchart of electronic bank authentication according to an embodiment of the present invention.

Detailed ways

FIG. 3 is a flowchart of electronic bank authentication according to an embodiment of the present invention. It should be noted that, before implementing the electronic bank authentication method of the present invention, the user needs to register with the bank, and store the original biometric features in the smart card and the background server. In addition, there is a system private key mk in the credit card machine.

As shown in Figure 3, the electronic banking system includes a smart card, a credit card machine with a front terminal, and a background server. The background server and the credit card machine are connected through the network.

In step 1, the user enters the account information by swiping the card.

In step 2, the user enters the smart card personal identification number (PIN code) from the front keyboard, and enters the biometric feature, and the smart card can only be activated if both match.

In step 3, the card reader uses the system private key mk to generate a temporary authentication private key tk corresponding to the transaction date and biological characteristics for the user, that is, the user's private key, and then imports tk into the card.

In step 4, the card reader converts the user's wishes into a message m in a certain fixed format, uses the tk imported into the smart card to perform an identity-based digital signature on the message m, and verifies the user's original biometrics stored in the background server.

In step 5, once the verification is passed, a reasonable transaction is completed according to the user's wishes.

In step 6, the identity-based digital signature using tk is stored in the background server as a transaction endorsement document. Endorsement documents can be destroyed after a specified period.

The specific digital signature algorithm based on identity is described below.

According to the present invention, the identity-based signature algorithm is composed of four algorithms: a system parameter generation algorithm S, a private key extraction algorithm Ext, a signature algorithm Sig, and a verification algorithm Ver. The four algorithms are described as follows:

System parameter generation algorithm S: generate system parameters.

The algorithm is as follows:

Step 1: The system randomly generates two large prime numbers p and q with different sizes and similar sizes, where p and q are both strong prime numbers.

Step 2: Calculate n=pq and φ=(p-1)(q-1).

Step 3: Select an integer e, 1<e<φ, and e and φ are mutually prime.

Step 4: Use the extended Euclidean algorithm to calculate the unique integer d satisfying ed≡1mod(φ), 1<d<φ. Here, the integers e and d are multiplicative inverses. It should be noted that the integers e and d may also be determined in other ways.

Step 5: Pick a Hash Function $h:{\left\{\mathrm{0,1}\right\}}^{*}\&Right\; Arrow;Z_{\mathrm{no}}^{*}$ . It should be noted that other signature functions are also feasible.

Step 6: The system public parameters are (n, e, H), and the private key mk is d. The system public key is e.

Private key extraction algorithm Ext: Use the system private key to secretly sign the biometric information as the input signature function value to generate the user private key.

Given a user’s biometric information ID ∈ {0, 1} ^* and time information t, the algorithm is as follows:

Step 1: Calculate P _ID =H(ID||t), where || represents a connector of a character string. Here, biometric information is a necessary input. It should be noted that biometric information and time information may be combined in other ways, such as and or or.

Step 2: Calculate S _ID = (P _ID ) ^d mod (n).

Step 3: S _ID is the private key tk corresponding to biometric information ID and time information t.

Signature algorithm Sig: Use the user's private key to sign the signature function value of the input message. It should be noted that the signature function here may adopt a signature algorithm different from the private key extraction algorithm.

For the message m to be signed, the algorithm is as follows:

Step 1: Randomly select an integer r∈Z _n . The selection operation can be completed by a random number generator.

Step 2: Calculate α= ^re mod(n).

Step 3: Calculate h=H(m||α), where || represents a connector of a character string. Here, the message to be signed is a necessary input. It should be noted that other combinations may be used between the message to be signed and the parameter α, such as and, or.

Step 4: Calculate β=(r·S _ID ) ^h mod (n).

Step 5: (α, β) is the signature for message m.

Verification Algorithm Ver: Use the pre-stored biometric information and system public key to verify the signature.

For the signature (α, β), using ID, t, the verification algorithm is as follows:

Step 1: Calculate P _ID = H(ID||t)

Step 2: Calculate h=H(m||α).

Step 3: Verify whether β ^e =(α·P _ID ) ^h mod(n) holds. If true, output 1 to accept the signature, otherwise output 0 to reject the signature.

The invention can increase the security of the system without changing the original system architecture. The enhancement of security is embodied in the multiple uses of biometric information and the application of realizable, effective, and provably safe identity-based cryptography. The solution of the present invention has the following characteristics: (1) the protection of the smart card not only depends on the password, but also utilizes biometric identification; (3) the endorsement file after the transaction is completed is completed once in the network authentication; (4) because the present invention utilizes the biometric feature as the identity of the user, the identity-based cryptographic technology is used to carry out network authentication and digital signature , so the expensive overhead of the public key infrastructure that is usually used to implement public key cryptographic algorithms can be saved.

It will be apparent that the invention described herein may be varied in many ways, and such variations are not to be regarded as departing from the spirit and scope of the invention. Therefore, all changes obvious to those skilled in the art are included within the scope of the claims.

Claims (13)

1. An electronic bank authentication method, comprising using the system private key to secretly sign the first function value of the biometric information as input to generate the user's private key; utilizing the user's private key to sign the second function value of the message to be signed; using The pre-stored biometric information and system public key verify the signature. 2. The electronic bank authentication method according to claim 1, characterized in that the first function and/or the second function is a hash function. 3. The electronic bank authentication method according to claim 1, characterized in that the first function takes a combination of biometric information and time information as input. 4. The electronic bank authentication method as claimed in claim 1, wherein the step of using the user private key to sign the second function value input to the message to be signed comprises generating a random number, processing the user private key with the random number, and using the processing Signature with the user's private key; the method includes using the system public key to process the random number to generate a first parameter; the signature verification step is performed based on the first parameter. 5. The electronic bank authentication method according to claim 4, characterized in that the second function takes the combination of the message to be signed and the first parameter as input. 6. The electronic bank authentication method according to claim 1, characterized in that said system public key and system private key are multiplicative inverse elements. 7. The electronic bank authentication method according to claim 3 or 5, characterized in that said combination is formed by connection. 8. The electronic bank authentication method as claimed in claim 1, characterized in that it comprises storing the signature obtained in the step of signing the second function value input to the message to be signed using the user's private key into the background server as a transaction endorsement document. 9. An electronic bank authentication system, including a smart card, a card reader with a terminal for reading and writing the smart card, and a server connected to the card reader through a network; The card reader receives the biometric information through the terminal, uses the system private key to secretly sign the first function value inputted by the biometric information, generates the user's private key, and stores the user's private key into the smart card; The smart card uses the user's private key to sign the second function value input to the message to be signed, and sends the signed message to the server through the card reader; The server uses pre-stored biometric information and system public key to verify the signature. 10. The electronic bank authentication system as claimed in claim 9, wherein the smart card includes a random number generator for generating random numbers, the smart card uses the random number to process the user's private key, and utilizes the processed user's private key to sign, the smart card The system public key is used to process the random number to generate a first parameter; the server performs signature verification based on the first parameter. 11. The electronic bank authentication system as claimed in claim 9, wherein the card reader includes a device for matching the smart card personal identification code and the input biometric feature respectively, and activating the smart card when both are matched. 12. A smart card for an electronic bank authentication system, the electronic bank authentication system comprising a smart card, a card reader with a terminal for reading and writing the smart card, and a server connected to the card reader through a network; The smart card stores the user's private key, and the user's private key is generated by the card swiping machine using the system private key to secretly sign the first function value input to the biometric information; The smart card uses the user's private key to sign the second function value of the message to be signed, and sends the signed message to the server through the card reader, so that the server uses the pre-stored biometric information and the system public key to verify the signature. 13. The smart card as claimed in claim 12, characterized in that it includes a random number generator for generating random numbers, the smart card uses the random number to process the user's private key, and uses the processed user's private key to sign, the smart card uses the system public key The random number is processed to generate a first parameter; the server performs signature verification based on the first parameter.

Images