Mobile phone financial transaction method and mobile phone double-set bank card
Technical Field
The invention belongs to a bank card and a financial transaction method, and particularly relates to a mobile phone bank card and a corresponding mobile phone and a financial transaction method.
Background
1: mobile phone bank card: the mobile phone bank card is not unknown, the mobile phone bank card is a virtual bank card through hundred-degree encyclopedia retrieval, namely, the mobile phone is bound with the bank card, so that the mobile phone has a payment function, and the mobile phone bank card is a precondition for realizing mobile phone banking.
2: and (3) cashing without card: the applicant finds that the transaction flow is complex, the cardholder needs to open a mobile phone bank, reserves an appointment code through the operation of the mobile phone bank, determines the effective time of the appointment, receives a temporary password short message sent by a server system after inputting a password through a password card or an electronic password device, and then inputs the temporary password, a mobile phone number and an appointment number on a teller machine within the effective time.
3: the old people in rural areas use the bank card: for the old people or people with poor memory, the memory of the password is always a difficult problem, the applicant is born in north of Hunan province, mothers are more than 70 years old, the operation of teller machines is a problem, most of the old people are also questioned on the safety of the teller machines due to the propaganda of televisions or other media, and over-the-counter transaction is preferred, so that the popularization and the popularization of the teller machines of bank business outlets in rural areas are difficult, the over-the-counter transaction and the bank workers need to check identity cards, confirm receipts and the like, the time is very long, the bank also has a difficult problem, the transaction amount of the old people in the rural areas is very small, even dozens of money, the labor cost of the bank is not low, but the income is limited, and the provided conditions are poor.
4: i-bank electronic cipherer: the electronic cipher device introduced by the industrial and commercial bank is a computing device of dynamic cipher, and has a defect that if two identical original data are input, the converted cipher is identical, which means that a set of corresponding algorithm is arranged in the server, and the server actually calculates the original data and the cipher data, so that the cardholder inputs the original data, the cipher data obtained by the electronic cipher device can be identical with the data stored in the server, and then passes the verification, the security is completely controlled by the server, once the server is invaded, the cipher algorithm is cracked, the starting cipher of the electronic cipher device has no function, the cipher can be directly input, the cipher passes the cipher verification, and the electronic cipher device is not needed at all.
5: and (3) the online banking account opening loophole: according to related news reports, bank staff cause the depositor to suffer great economic loss in a U shield packet dropping mode, on one hand, the situation that the internal control of the bank is not strict is displayed, meanwhile, the situation that the bank card has technical loopholes in the process of opening the account is also shown, and the process of opening the account does not control possible violation of the bank staff.
Disclosure of Invention
The technical characteristics are as follows: two kinds of bank card slots are designed on the mobile phone, one kind is a built-in bank card slot, the other kind is an external bank card slot, the double-built bank card matched with the mobile phone is a built-in bank card and an external bank card, the built-in bank card comprises a mobile phone card, the external bank card refers to a plug-in bank card, an external plug-in bank card and a non-contact bank card, the electronic cipher device is an external bank card with special properties, in the aspects of bank card identification and financial transaction program, two schemes are provided, the other scheme is that the bank card is identified by independent mobile phone banking hardware and a financial transaction method is provided, the mobile phone part and the mobile phone banking part are only hardware which coexist on one mobile phone, the mobile phone part and the mobile phone banking part are respectively provided with an independent power key and are not influenced by each other, the mobile phone financial transaction program is compiled by using a read-only memory and cannot be rewritten, when a cardholder makes a transaction or the cardholder does not operate, the power supply of the mobile phone bank part is turned off; a method for identifying bank card and providing financial transaction by using existing mobile phone through writing program includes dividing transaction into one-time password verification transaction and two-time password verification transaction according to password verification type, dividing transaction into early warning mode transaction and normal mode transaction according to whether transaction is early-warning or not, adopting different password verification modes for different conditions during transaction, setting external bank card and internal bank card to have mutual loss reporting function, binding bank card and used mobile phone, clearly indicating money checking and counting process when deposit is made, storing encrypted password data or wrong number password in server, the mobile phone part refers to the part of the mobile phone supporting the function of the telephone card, the mobile phone banking part refers to the part of the mobile phone supporting the function of the bank card, the hardware of the mobile phone and the bank card are allowed to be overlapped, but the data and the program are independent, and the early warning mode refers to a transaction mode that the system simultaneously and secretly alarms to a public security organization during transaction.
The specific implementation mode is as follows: the financial transaction method described in the specification is a method for improving the security of the password, and does not refer to a transaction rule or method of a certain financial product or an authentication code, reserved information and the like, so the specification does not describe the financial transaction process in detail, the password security technology is a bank card which is applicable to any financial product, and the early warning mode is applicable to any principle.
Classification of financial transactions: the financial transactions discussed in the specification refer to the following: the method comprises the steps of opening an account, withdrawing cash, transferring accounts, recharging, virtual bank consumption, market consumption, information inquiry, information modification, unlocking, depositing, losing reporting and canceling, and the transaction items belong to bank processing authorities, so that the transaction items are not in the design range of a mobile phone financial transaction program, and the market consumption is finished by using the funds of the virtual bank.
For ease of understanding, the following terms will now be introduced:
1: a bank card slot is arranged: the mobile phone card is a bank card slot matched with a built-in bank card, the sizes of the built-in bank card slot and the mobile phone card slot are consistent, some data are recorded as a card seat, and the mobile phone card is a device for fixing the bank card and providing a circuit so as to support a mobile phone to read and write data of the bank card.
2: a bank card is arranged inside: all electronic chips with bank card function are built-in bank cards, when the built-in bank cards are designed to be one card with multiple numbers, the IC card module parts are independent, the one card with multiple numbers are divided into two types, one type is different bank cards with different bank accounts, the other type is different functional modules, for example, different numbers are adopted for transactions of mobile phone banks and teller machines, but the different numbers are one bank account, the former is bound with different external bank cards, the latter is bound with only one external bank card, and the most of the functions also comprises 2.
3: external bank card slot: the mobile phone is a bank card slot matched with an external bank card, and is a plug-and-play bank card slot, when other external jacks of the mobile phone can read and write data of an IC card or other electronic chips, and the IC card or other electronic chips have the bank card function, the jacks are also the external bank card slot described in the specification.
4, external bank card: the mobile phone can be inserted into all or part of the product, the mobile phone and the product can complete data transmission, the product has the functions of a bank card and is an external bank card, the external bank card is provided with an external plug-in bank card, a plug-in bank card and an electronic password device, and the external bank card recorded in the specification does not include the electronic password device unless the external bank card is specified.
5: inserting a bank card: the external socket for plugging the bank card is the existing bank card socket, the external bank card slot is a special slot for externally plugging the bank card, and the external bank card slot needs to be distinguished, and the externally plugged bank card can be used only by matching the mobile phone with the external bank card slot.
6: an electronic cipher device: the electronic cipher device is an electronic device for converting a cipher, and the program of the electronic cipher device is a part of a financial transaction program of a mobile phone.
7: one password authentication transaction and two password authentication transactions: the method is characterized in that the method comprises the steps of dividing according to the input times of passwords in a transaction process, wherein in the two password verification transactions, the first password verification is the password verification of transaction reservation, the first password verification and the second password verification of the two password verification have time interval limitation, and the reservation aims to prevent others from knowing the user password.
8: single-calculation and double-calculation ciphers: the client end completes the encryption process of the password, the server end stores the encrypted data, or vice versa, the password is a single-calculation password, the client end and the server end complete the encryption or conversion of the password, and the password is a double-calculation password by comparing whether the data of the client end and the data of the server end are the same or not.
9: recharging: the method is characterized in that a cardholder injects funds into a virtual bank by using a bank card, and the virtual bank is opened by the cardholder and needs to be recharged, which is different from the existing virtual bank.
10: virtual banking refers to internet banking and mobile phone banking, and the invention does not actually need internet banking.
11: market consumption: the method is a process for completing fund payment for market consumption by using funds of a virtual bank, and the fund payment can not be completed by inputting a password by using a bank card, which is different from the prior bank card.
12: and (3) online consumption: the method is a process for completing fund payment of an online shopping mall through funds of a virtual bank, and the available funds of the virtual bank are recharged by a bank card, which is different from the current virtual bank.
13: salt value: the auxiliary encryption data in the password encryption process are salt value data which are single salt data, salt sharing data and salt sharing data, the single salt data are data which are stored in an external bank card or an internal bank card and are used for being encrypted by the external bank card or the internal bank card and a user password independently, the salt sharing data are data which are stored in the external bank card and the internal bank card and are used for being encrypted by a mobile phone through the external bank card, the internal bank card and the user password, the salt sharing data are data in a transaction reservation stage, after the mobile phone financial transaction program obtains temporary password information, the mobile phone financial transaction program automatically generates salt value data in the external bank card or the internal bank card, the salt sharing data exceed a verification time or are deleted after verification, and the external bank card comprises an electronic password device.
14: early warning mode and normal mode: the early warning mode is a transaction mode which can normally complete various financial transactions, but once capital expenditure occurs, the system automatically and secretly alarms a public security organization, and the early warning mode is a transaction mode which looks normal on the surface and actually has problems.
15: civil registration and criminal alarm: after entering the early warning mode and after the capital expenditure appears, the system sends the transaction information to the server, the server sends two kinds of alarm information to the alarm system of the public security organization according to the amount of the capital expenditure, the civil registration means that only the transaction abnormal information is recorded on a case, the cardholder needs to process according to the will, the criminal alarm means that the amount of the capital expenditure reaches the criminal case setting standard, and the system reports the criminal case and requests the public security organization to give an alarm.
16: the dynamic password is a password which is updated after passing password authentication each time.
17: the temporary password is temporary authentication information sent by the server to the mobile phone or a mobile phone financial transaction program, and is used only once and has time limitation.
18: the user password is set by the card holder, and the current bank card user password is 6 digits.
19: IMEI: the IMEI is the international identification code of the mobile equipment, and the IMEI is the unique identity number of the mobile phone.
20: synchronization of salt value data and co-salt, single salt and adjacent salt ciphers: from the principle of password encryption, under the condition that a user password is not changed, after password verification is passed, a mobile phone financial transaction program updates salt value data, the updated salt value data are stored in a bank card, the user password and the updated salt value data are encrypted as original password data, the encrypted data are sent to a server, old password data which are already verified by the server are replaced, the designed password can pass verification again, the user password is not changed all the time, but the salt value data are changed continuously, namely a dynamic password, the dynamic password ensures that the password stored by the server is updated under the condition that the user password is not changed, the design has the premise that hardware for storing the salt value data is needed, the mobile phone financial transaction program calls the salt value data from the hardware, and in a specification, the salt value data of an external bank card and a built-in bank card can participate in encryption independently, the external bank card and the internal bank card have three types of salt value data, one type is used for common encryption, the other type is used for independent encryption, the other type is used for temporary encryption, in the description discussion encryption process, the pointed password types respectively refer to the passwords after the three types of salt value data are encrypted according to different encryption types, and for convenience of description, the passwords are respectively referred to as a common salt password, a single salt password and an adjacent salt password for short.
21: co-salt code: the method comprises the steps that common salt data and user passwords of an external bank card and an internal bank card are encrypted as original data, a server stores the encrypted data, the operation is simple, the external bank card is inserted into a mobile phone or the data of the external bank card is read by the mobile phone, the data is led into the mobile phone, and the user passwords are input.
22: single salt code: the single salt data and the user password of the internal bank card or the external bank card are used as original data to be encrypted, the server stores the encrypted data, and the user password is directly input during verification.
23: salt-adjacent dense codes: the temporary salt data and the temporary password of the built-in bank card or the external bank card are used as original data to be encrypted, the server stores the encrypted data, the temporary password is input during verification, the temporary salt password is used for second password verification in two password verification transactions, the external temporary password and the internal temporary password of the temporary salt password are respectively the salt data of the external bank card and the salt data of the built-in bank card to participate in encryption to complete the password, and the temporary salt password is only used once and has use time limitation.
24: transaction reservation: transaction appointment refers to a transaction intention request issued by a cardholder agreeing to complete a financial transaction within a certain time.
Introduction of hardware of a bank card: the double bank card refers to an external bank card and an internal bank card, the external bank card and the internal bank card are electronic chips, the identity of a card owner and data required by transaction are proved in a related financial transaction program, and the external bank card comprises an electronic cipher device:
a: a bank card is arranged inside: the built-in bank card is built in the mobile phone and is inserted and taken out by utilizing a slot of the built-in bank card, the product schematic diagram of the built-in bank card is shown in figure 3 and mainly comprises a card 2, a card body 1 and a covering layer, the card body 1 is attached on the card 2, the card body 1 is connected with the card 2 through a connecting rib 3, the card is provided with a layer of covering layer which covers the contact part of the circuit, meanwhile, the card body covers the account opening password part of the covering layer, when in use, a card holder breaks off the card body and inserts the card body into a mobile phone, and meanwhile, the account opening password is checked, a bank needs to ensure that the product is complete when the product is picked up and has no trace of artificial damage, a cardholder needs to pay attention to check the integrity of the product, the problem is caused when the covering layer is torn or the card is broken off, the size of the built-in bank card is the same as that of the mobile phone card, and the mobile phone card is allowed to be used as the built-in bank card.
B: externally inserting a bank card: the external inserted bank card is shown in figure 2, the external inserted bank card is provided with a covering layer covering an account opening password, the external inserted bank card is inserted into an external bank card slot during transaction, the external inserted bank card is compatible with a teller machine and other financial transaction equipment, the maximum length and width dimension of the external inserted bank card is the same as that of the existing bank card or an identity card, the current bank card and the identity card are 85.60 mm, 53.98mm, the maximum length and width dimension is the value, one side of the external inserted bank card is the telephone card dimension, the position of the chip of the external inserted bank card is the same as that of the existing bank card chip, the external inserted bank card and the internal bank card are convenient to be compatible with a mobile phone and the teller machine or other bank card identification equipment, and for environmental protection and saving, the external inserted bank card and the internal bank card can be one card, the internal bank card can be separated.
C: inserting a bank card: the inserted bank card needs a data plug wire to connect the bank card and a mobile phone end, a golden finger or other data reading and writing access is arranged on the inserted bank card body, one end of the data plug wire is connected with the mobile phone, the other end of the data plug wire is connected with the inserted bank card, the bank card end of the data plug wire has a clamping function and clamps the bank card, the data plug wire is connected with the golden finger or other data reading and writing access, the bank card can be communicated with the mobile phone, after the use is finished, the clamping device is loosened, the data plug wire can be detached from the bank card and the mobile phone, the principle of the inserted bank card and the current bank card is not changed, and the size of the inserted bank card is the same as that of the.
D: non-contact bank card: the non-contact bank card is a radio frequency card, only a mobile phone has a radio frequency signal receiving function, only the mobile phone function needs to be added to the non-contact bank card, and the bank card is not changed.
E: an electronic cipher device: the electronic cipher device is similar to the industrial and silver electronic cipher device in structure, has a power supply and a cipher algorithm, and is provided with a keyboard and a display screen.
No matter the kind of the bank card, the bank card has the bank card number, any one kind of built-in bank card and any one kind of external bank card are bound and used together,
the bank card described in the specification refers to an IC card, including PBOC card, EMV card and VISA card, excluding magnetic stripe card.
It should be noted that some mobile phones, such as charm mobile phones, have their phone card sockets disposed at the sides, and the mobile phone card can be replaced without removing the battery or the rear cover, and the phone card socket is an external socket, but the external bank card socket, the external bank card and the internal bank card described in the specification are different from this concept, and the external bank card referred in the specification means that some or all of the bank cards cannot be put into the mobile phone, that is, the bank card is taken out after the cardholder finishes the transaction by technical means, otherwise, the mobile phone is inconvenient to use, while the internal bank card means a bank card that can be put into the mobile phone for a long time, that is, the mobile phone card socket of charm is built-in the classification of the invention, so only so that the external bank card is emphasized to be safe, the internal bank card is emphasized to be convenient, only the socket is disposed at the outside, the bank card is kept in the mobile phone for a long time, and the security of the bank card is not different from that of the built-in bank card.
The limit of the IMEI number of the mobile phone to the transaction is that the IMEI number of the mobile phone is bound with a bank card, and a cardholder cannot use the mobile phone and the bank card except for the binding to finish the following transactions, 1: capital expenditure, 2: balance inquiry, three conditions exist when the mobile phone is not used continuously, 1: if the bank card is lost or stolen, the bank card is also lost, and the card holder needs to report the loss; 2, the cardholder changes the new machine, but the old machine can be used, the cardholder needs to use the old mobile phone to send out the communication request for changing the mobile phone in this situation, the server starts timing after receiving the communication request for changing the new machine, the cardholder takes out the bank card, loads the bank card into the new machine, sends information to the server within the specified time, the system receives the new machine, the old machine can not trade; in the 3 rd case, the mobile phone is damaged due to water inlet and the like, information cannot be read, in this case, a cardholder puts a bank card into a new mobile phone, inputs the IMEI number of an old mobile phone, inserts the bank card into the mobile phone without performing the IMEI number input operation, a system prompts the cardholder to input the IMEI number of the original mobile phone and provides an IMEI number query method, and when a loss is reported, the bank card is not bound with the IMEI number of the mobile phone.
A password verification transaction, the password verification transaction comprising: the method comprises the steps of mobile phone transfer, recharging, balance inquiry, transaction detail inquiry and virtual bank consumption, wherein the steps of mobile phone transfer and recharging are to be completed by verifying a common salt password, the steps of virtual bank consumption are to be completed by verifying a single salt password, balance inquiry and transaction detail inquiry are to be performed by inquiring the balance of a bank card and the details of withdrawal, transfer and recharging of the bank card after the verification of the common salt password, and the steps of virtual bank balance and virtual bank transaction detail are to be inquired after the verification of the single salt password.
Two password verification transactions: the two password verification transactions are cash withdrawal, loss report, market consumption, bank counter or teller machine transfer, the verification of the common salt password is completed when the cash withdrawal and the bank counter or teller machine transfer are completed in the transaction reservation stage, the verification of the single salt password is completed when the loss report and the market consumption are completed, and the verification of the temporary salt password is completed in the second password verification stage.
The password verification in the transaction reservation stage of the first password verification and the second password verification is the same, the cardholder inputs the user password or uses the external bank card to input the user password again, and the second password verification needs to be performed according to different conditions, which are described below.
The bank counter or the teller machine transfers or withdraws cash, and the second password verification can be realized through the internal bank card and the external bank card:
1: the process of second password verification is completed by utilizing an external bank card, after the transaction reservation passes the password verification, a server sends a temporary password to a mobile phone number bound by a cardholder or to a mobile phone financial transaction program, the mobile phone financial transaction program automatically generates temporary salt data, when the server sends the temporary password to the mobile phone number bound by the cardholder, the cardholder needs to input the temporary password and the temporary salt data and encrypt the temporary password by using a mobile phone, when the server sends the temporary password to the mobile phone financial transaction program, the mobile phone financial transaction program directly encrypts the temporary salt data and the temporary password, after the encryption is completed, the mobile phone financial transaction program transmits the encrypted data to the server, simultaneously the server deletes the temporary password, a mobile phone terminal deletes the encrypted data, reserves the temporary salt data, and after the transaction reservation is completed, the mobile phone financial transaction program sends a prompt message of successful reservation, when the temporary salt data and the temporary password are correct, the encrypted data of the teller terminal or other financial transaction equipment terminal and the data of the server terminal are the same, after the verification is passed, all the related data of the temporary password are deleted, the cardholder does not verify, the mobile phone financial transaction program is closed, after the server sends the temporary password to the mobile phone terminal next time, the mobile phone financial transaction program deletes the original temporary password and the temporary salt data and generates new temporary salt data, and the cardholder can utilize the funds of an online bank or a bank mobile phone to get the funds at the bank counter or the teller machine, but the reservation is required as well.
2: the process of second password verification is completed by utilizing the built-in bank card, after the transaction reservation passes the password verification, the server sends a temporary password to the mobile phone number bound by the cardholder or sends the temporary password to the mobile phone financial transaction program, the mobile phone financial transaction program automatically generates the temporary salt data, when the server sends the temporary password to the mobile phone number bound by the cardholder, the cardholder needs to input the temporary password and the temporary salt data and encrypt the temporary password by using the mobile phone, when the server sends the temporary password to the mobile phone financial transaction program, the mobile phone financial transaction program directly encrypts the temporary salt data and the temporary password, after the encryption is completed, the mobile phone financial transaction program transmits the encrypted data to the server, the server deletes the temporary password, the mobile phone end deletes the encrypted data, the temporary salt data is reserved, and after the transaction reservation is completed, the mobile phone financial transaction program sends a prompt message of successful reservation, the cardholder transacts business to a teller machine or a bank counter within a specified time, the teller machine or other financial transaction equipment needs to be provided with a scanning device, the cardholder inputs a temporary password on a mobile phone, a mobile phone financial transaction program displays encrypted data, the cardholder places the mobile phone in a scanning port of the teller machine or other financial transaction equipment, the teller machine or other financial transaction equipment sends scanned temporary salt password data to a server, and after verification is passed, all relevant data of the temporary password are deleted.
And (4) market consumption, wherein the password verification for the second time is realized through a built-in bank card:
according to news reports, staff in a shopping mall supervises and is stolen, hands and feet are moved on the POS machine, bank card information and password information of a consumer are stolen, so that the consumer suffers from loss, therefore, an external bank card verification scheme is eliminated, the shopping mall consumption can only use built-in bank card verification, after a transaction appointment passes the password verification, a server sends a temporary password to a mobile phone number bound by a cardholder or sends the temporary password to a mobile phone financial transaction program, the mobile phone financial transaction program automatically generates salt data, when the server sends the temporary password to the mobile phone number bound by the cardholder, the cardholder needs to input the temporary password and the salt data to be encrypted by using a mobile phone, when the server sends the temporary password to the mobile phone financial transaction program, the mobile phone financial transaction program directly encrypts the salt data and the temporary password, and after the encryption is finished, the mobile phone financial transaction program transmits the encrypted data to the server, the server deletes the temporary password, the mobile phone end deletes the encrypted data, the temporary salt data is reserved, after the transaction reservation is finished, the mobile phone financial transaction program sends out the prompt message of successful reservation, the cardholder transacts the business to the POS machine in the market within the specified time, the POS machine needs to be equipped with a display device for displaying the transaction information and the serial number of the POS machine, the cardholder scans the display information of the POS machine and uses the mobile phone to input the temporary password, the mobile phone sends the temporary salt password and the information scanned from the POS machine to the server, after the verification is passed, all the related data of the temporary password are deleted, the server returns the transaction information to the POS machine, the POS machine completes the subsequent transaction flow according to the above, and the attention needs to be paid that in order to prevent the two-dimensional code of the POS machine from carrying viruses, a simpler bar code or a direct digital code, the display screen of the scanning is separated from the POS machine, so that some people are prevented from illegally acquiring information during scanning, the temporary password is only used once, due to the fact that the transaction reservation is used, and the POS machine cannot read the bank card information, and therefore, the situation that some other useful people steal the bank card information and the password information through the POS machine can be prevented, as can be seen from the discussion, when the scheme is executed, the POS machine only plays a role of providing data, the server only stores the data and compares the temporary salt password data stored by the server end with the temporary salt password data sent by the mobile phone end, the POS machine does not have the opportunity of contacting the built-in bank card at all, namely the time limit of the transaction reservation, the mobile phone financial transaction program has an upper limit, the time upper limit is preferably not more than 240 minutes according to the safety consideration, even if the card holder shops in other shops, the card holder needs to avoid the trouble in the indoor transaction stage, it is not possible for a person to shop too far away from a place of residence or temporary residence, and 4 hours is sufficient.
Opening an account: the bank account or bank card is requested to be opened by the account opening person carrying the related identity document, the bank opening uses the external bank card to open the account and bind the internal bank card, only the account opening password is not set by the bank opening person, but the account opening password covering layer of the external bank card is scraped, the bank opening person inputs the account opening password, the encryption is completed by the account opening password and the certificate number of the bank opening person, when the bank opening sends the certificate number of the bank opening person to the server, the server encrypts the account opening password and the certificate identity number together, the financial transaction system of the bank opening and the account opening password algorithm of the server are consistent, thereby obtaining the correct account opening password, only when the account opening password is correct, the account opening process can be completed, namely, the account opening person binds the identity document number provided by the bank opening person, the account opening password can only provide the bank card balance inquiry service, after the bank account opening process is completed, the contact person mobile phone number bound by the account opening person receives the account opening notice and the bank card balance notice, the notice reminds the card holder that the bank card can not be handed to any person including bank staff, the account opening person uses the mobile phone to scan the numbers of the external bank card and the internal bank card, the number information is sent to the server, the server returns information, the sent number is different from the number information input by the bank, the account opening fails, the card holder needs to communicate with the bank, the correction is related to input, the information is consistent, the account opening succeeds, the card holder needs to reset the password, the account can be used, the stored fund can not be used before the password is reset, the password resetting is carried out by the mobile phone, the card holder breaks the internal bank card, checks the account opening password, inputs the same certificate number when the account opening password and the account opening process is completed, when a card holder enters a password setting page, setting the password twice, and after a system checks the password, the password setting is completed, and it needs to be noted that the password setting needs to be set by the external bank card and the internal bank card together, namely the external bank card is not inserted, the password setting cannot be successful, an account opening bank opens an account by using the internal bank card and binds the external bank card, the account opening process and the password resetting process are similar, the account opening has three main points, the account opening bank can only open the account by using the internal bank card or the external bank card, the external bank card and the internal bank card cannot be used for opening the account at the same time, the account opening process cannot input the user password, the bank card which does not participate in the account opening needs to ensure the integrity of the package, the data is prevented from being copied, the account opening is not performed, all the card holder need to submit the operation of a bank worker, only one bank card is allowed to participate in the operation, and the card holder needs to set to normally.
Electronic ciphers and dynamic ciphers: the electronic cipher device is similar to the I/O electronic cipher device in structure, except that the electronic cipher device has no starting cipher, the cipher displayed after calculation is more complicated than the I/O electronic cipher device, and is not 6 digits, the cipher displayed after calculation needs to be scanned and led in through a mobile phone, but not input, the electronic cipher device plays a role of an external bank card, the electronic cipher device is bound with an internal bank card, after a power supply is turned on, a card holder inputs a user cipher, the electronic cipher device encrypts the user cipher and common salt data by using MD5 or other encryption methods, the electronic cipher device displays the encrypted result by using a two-dimensional code or other data forms which can be identified by a mobile phone, and displays the number of the electronic cipher device, the mobile phone scans a screen of the electronic cipher device, and when the mobile phone detects that the number of the electronic cipher device is matched with the number of the internal bank card, the encrypted cipher data is led into the mobile phone, the mobile phone encrypts the co-salt data of the built-in bank card and the imported password data again, the encrypted co-salt password is sent to the server, the server compares the co-salt password data with the co-salt password data stored in the server, the sent co-salt password data and the co-salt password data stored in the server are completely the same, namely the password is correct, otherwise, the password is wrong, the server returns a correct or wrong judgment result to the mobile phone end, the card holder scans the screen of the electronic password device again by the mobile phone or the card holder takes the mobile phone out after the password verification is finished, the server judges that the password is correct, the electronic password system and the mobile phone financial transaction program generate new co-salt data which are respectively stored in the electronic password device and the built-in bank card and delete the old co-salt data, meanwhile, the mobile phone end sends the new co-salt data and the data encrypted by the user password to the, the electronic cipher device and the built-in bank card both store old common salt data, the information returned by the server is correct in cipher, but the cardholder does not scan after a certain time, the electronic cipher device and the built-in bank card both store old common salt data, the mobile phone simultaneously sends the information of whether the stored new cipher or old cipher to the server to inform the server to store the old cipher, after the work is completed, the cardholder does not continue to operate, after a certain time, the electronic cipher device automatically turns off the power supply, when the electronic cipher device completes the encryption of the single salt cipher, the encryption flow is similar to the common salt cipher encryption flow, the difference is that after the single salt data and the user cipher are encrypted, the single salt cipher is scanned and derived through the mobile phone or other financial transaction equipment, the encryption is not performed with the salt data of the built-in bank card, and the principle of the dynamic cipher of the built-in bank card and the external bank card is similar to the principle, after the password verification is passed, the external bank card and/or the internal bank card generate new salt value data, the new salt value data and the user password are encrypted together, the encrypted result is sent to the server, the external bank card and/or the internal bank card store the new salt value data and delete the salt value data which is verified, and the specification shows that the encryption of the password and the encryption data of the password are at the mobile phone end and the bank card end by using the electronic password device, the server only stores the encrypted password data, the server end is difficult to crack, the mobile phone end and the electronic password device end are respectively encrypted, and the possibility that the password is stolen is very low.
According to the statistics of relevant institutions, the money transfer early warning system has over 100 billion funds in China suffering from financial fraud every year, the probability that the fraudulent funds are successfully recovered is very little, and huge pain and economic loss are brought to victims, so that the transferred account, namely the account controlled by a financial fraud offender, is a key ring, is controlled by the following method, and the money transfer is characterized in that 1: the full or nearly full account of the cardholder has transfer intention or huge transfer amount, and the transfer of the full or nearly full account of the cardholder needs a certain amount of funds, such as 50000 yuan minimum for individual and 50 ten thousand yuan minimum for unit; 2: cardholder transfers to transfer account for the first time, 3: the mobile phone financial transaction program is judged by grabbing the following information, the opposite party is self-called a national staff, such as a certain court, a person in a check-up yard, and requires the cardholder to remit into a secure account, which requires the account for remittance to be a personal account, 4: the name is a public staff, but calls a phone to a cardholder in non-working time, when the system captures the characteristics, namely the server is informed to start transfer early warning, the server informs bank staff to contact the cardholder for processing through a contact phone reserved by the cardholder, the server can also suspend to account, when the cardholder transfers the account through an online bank or a mobile phone bank, the server needs to transfer the account to a counter after the server starts the early warning, and the counter account is a personal account, namely the server is definitely informed that the cardholder is likely to suffer financial fraud through voice. Informing the card holder to dial back to the captured telephone number, using anti-fake software, adopting freezing method by the Unionpay system to the cheat account controlled by the public security organization, wherein the cheat account is foreign or overseas, the public security department can not freeze, and the clear identification is needed to facilitate the identification of bank workers, furthermore, the bank card can not transfer to foreign or overseas by default, the card holder needs foreign or overseas transfer service, and the transfer range needs to be declared or changed to the counter when opening the card, furthermore, because the cheat and the victim usually use the common language to communicate, the mobile phone financial transaction program uses the voice recognition function, for example, the criminal record is called in conversation to the card holder, the family person has unexpected cheat, etc., the mobile phone financial transaction program identifies the two talking of the cheat by capturing these key fields, the bank card holder remits the intention, the bank worker uses the principle of the relative consent, namely, the cardholder is required to dial the phone of children, spouses, unit leaders or other persons closely related to the cardholder, inquire the opinions of the cardholder, record the opinions, prevent financial fraud as much as possible, and prove that the bank has full advising responsibility, the financial fraud prevention is greatly related to the opening of the bank card and the loophole of a preventing mechanism, a ghost bank card is arranged under the name of the cardholder, namely the bank card which is unknown to the cardholder, but no related inquiry is provided at present, after receiving a fraud phone, the opposite party is already carrying out crime from the perspective of crime, but the principal is not lost, the public security organization sets up a nationwide unified telecommunication fraud early warning platform, the phone of the fraudster can be changed through number changing software, difficulty is traced, but the bank account can not be left all the time, and the victim of telecommunication fraud inputs the account to the platform, the existence of fraud is confirmed by public security authorities, namely certain precautionary measures are taken.
Early warning mode and normal mode: on the password input page, a plurality of password input boxes are provided, a cardholder selects any one password input box as a normal mode, the rest password input boxes are all password input boxes of an early warning mode, all the password input boxes need to input correct user passwords, otherwise, all the password input boxes are password errors, the early warning mode can be entered only when the correct user passwords are input into the password input boxes of the early warning mode, once the early warning mode is entered, the system locks the early warning mode, the system enters the early warning mode by using the password input boxes of the normal mode after exiting the transaction page, the cardholder needs to unlock a bank counter, the normal use of the bank card can be recovered, the early warning mode cannot be seen from the page by others, but provides a distinguishing characteristic for the cardholder to refer to, and the distinguishing characteristic 1: the transactable amount of the early warning mode is preset by the cardholder who does not have the preset amount, and the balance of the bank card defaulted by the system is the transactable amount, so that whether the entered page is in the normal mode or the early warning mode cannot be accurately judged by the distinguishing characteristic alone, and the distinguishing characteristic 2: the method is characterized in that identification features are arranged beside money or at other remarkable positions, for example, the identification features are two large-size characters of a fox or a character picture or other features which are easy to identify and remember, when a transaction page is entered, the fox is not a two-character but is lazy, the early warning mode is entered, the normal mode identification features are noticed, only the contents of the normal mode and the early warning mode identification features are distinguished, no matter the early warning mode or the normal mode is adopted, a mobile phone financial transaction program or a teller machine sends the number information of a password input frame to a server, the mobile phone financial transaction program does not indicate that the transaction is the early warning mode or the normal mode, the server compares the sent number information of the password input frame with the number information of the password input frame stored in the server to judge the early warning mode or the normal mode, the above-mentioned judgement information will not return to the mobile phone end or teller terminal end, the server begins to lock the early-warning mode once it is judged to enter the early-warning mode, however, after entering the early-warning mode, only if the fund expense transaction occurs, the server will look up the switch-on base station of the mobile phone and send the alarm information to the public security organization where the mobile phone switch-on base station is located, the alarm information is divided into two kinds, civil registration and criminal alarm, the civil registration and criminal alarm are divided according to the transaction amount, for example, 2000 yuan is divided into division line, below 2000 yuan is civil registration, 2000 yuan or above is criminal alarm, only criminal alarm polices need to be issued, and the civil registration is according to the will of the cardholder, the cardholder confirms that the fund is stolen because of its own operation, can request the case, the cardholder operates by oneself to enter the early-warning mode, as long as the money range of the civil registration, the withdrawal is not problematic, the early warning mode is released after the withdrawal is carried out, if the cardholder enters the early warning mode, only the transaction or deposit with non-fund change such as balance inquiry or password modification is carried out, the early warning mode does not trigger alarm, and the instruction shows that the cardholder does not set the transaction amount of the early warning mode, which is more beneficial to personal safety, other people cannot judge whether the entered transaction amount is the mode as long as the other people do not master distinguishing characteristics, for safety, more password input boxes are needed to be set, so that the safety is better, but the password input boxes are not too many from the screen angle and the actual requirement, and the password input boxes are preferably 8 to 10.
Loss reporting: when the external bank card or the internal bank card is lost, the card holder needs to report the loss in time,
1: the loss report of the built-in bank card comprises the following steps: the built-in bank card is built in the mobile phone, the possibility of loss is more than that of an external bank card or an electronic password device, when the built-in bank card is lost, a cardholder needs to use another mobile phone or a teller machine to insert the external bank card, a user password is input to complete a transaction reservation, after the transaction reservation is completed, the fund of the bank card is frozen, but the cardholder still needs to go to a bank counter, complete the loss report by using a temporary salt password and complete the new card;
loss reporting of the external bank card: the loss report of the external bank card is relatively simple, the internal bank card is used for inputting the user password to complete the transaction appointment, after the transaction appointment is completed, the fund in the card is frozen, the cardholder carries the valid identity document to the bank counter to report the loss and to make up a new card, whether the bank card is internally arranged or externally arranged, the single salt data and the user password are used for encryption, when the counter reports the loss, the cardholder inputs the temporary password again, the loss reporting process is completed, because other people may pick up the lost mobile phone or external bank card and report the loss, namely two people may report the loss, the reason is that the password needs to be input when the password is lost, after the new card is mended, the cardholder needs to input the user password by the mobile phone together with the external bank card and the internal bank card, the new card can be normally used, when the external bank card and the internal bank card of the cardholder are lost, the loss needs to be reported, and the process is the same as the conventional loss reporting process of the bank card.
The method comprises the steps that a user reserves no card to fetch cash, a teller machine is provided with fingerprint identification or other biological characteristic identification equipment, after the user passes first password verification, the user selects to reserve no card to fetch cash, an identity document number registered by the user is input, related reservation information exists, a server sends biological characteristic information stored by the user to the teller machine, the user provides related biological characteristics to the teller machine, the teller machine passes the verification, namely, a subsequent process is started, the biological characteristics refer to the characteristic of relative uniqueness of a human body distinguished from other people, the characteristic can be identified by computer identification equipment and comprises iris, fingerprint, face identification or other biological characteristic identification, however, the password of the biological characteristic identification is not good, and the user mainly has no way to modify.
And (3) information modification: after the password verification is passed, the cardholder can modify the password, information modification except the password is required to be carried out on a bank counter, and the cardholder forgets that the password modification is required to be carried out on the bank counter.
Unlocking: after the bank card enters the early warning mode, the cardholder needs to unlock the bank counter with the valid identity document, and when the bank counter is unlocked, the cardholder cannot input the password, but can change the password input box in the normal mode.
Depositing: the external bank card can be used for the deposit, the internal bank card can also be used for the deposit, the deposit does not need to input the password, because the deposit transaction process is completely consistent with the current bank card transaction process, the external bank card can be directly inserted into a teller machine or other financial transaction equipment, when the built-in bank card or the electronic cipher device is used for depositing, the teller machine or other financial transaction equipment is required to be provided with scanning equipment, by scanning the built-in bank card number displayed on the mobile phone or inputting the bank card number by the card holder, the card holder does not need to make an appointment or a password when depositing, in addition, when the teller machine is in transaction, the currency detecting and counting device adopts a transparent device, the camera monitors currency detecting and counting processes of the teller machine, a depositor doubtlessly detects and counts currency, the transaction can be cancelled, and the bank notes enter the inside of the teller machine to complete the transaction process after the cardholder approves the counting result.
Wrong number password: the wrong number password is a password which needs to be verified and is different from a password stored during password setting, the wrong number has three situations, the number of digits of characters of the password to be verified and the stored password is not the same, or the number of digits of the characters is the same, but the number of digits is not more than the number of characters of the password to be verified and is less than the number of characters of the password stored during password setting, the wrong number password is long password data, for convenience in description, the password to be verified is marked as an A password, the password stored during password setting is marked as a B password, and one password can be selected during use.
For example, the mobile phone financial transaction program encrypts original data to obtain combined data of 400-bit numeric and English-size data, and the password stored in the server is 398 bits or 402 bits, or even 400 bits, but two characters are not in agreement, for example, 137 bits of the encrypted data is 3, the server stores A, 256 bits of the encrypted data is g, and the server stores 9, which are wrong number passwords, when setting the password, the three stored passwords are B passwords, which are not only limited to bank card passwords, but also can be applied to password verification in any occasions.
The wrong number password is generated, when the password is set, after the password is encrypted, a program randomly deletes a few-bit characters of the password or randomly adds a few-bit characters or replaces the few-bit characters with other characters, the password is stored, the password is the wrong number password, the replaced characters need to be effective characters of the original password, the wrong number refers to character errors or character length errors, the characters refer to basic information that one character is a unit font, a similar font unit or a symbol in a computer or telecommunication technology, the number of bits of the wrong number is limited, generally 2 to 5, when only one wrong number exists, the password is easy to crack, when the wrong number is too many, verification is difficult, the risk of the same password is increased, when the program is designed, the number and the type of the wrong number should be determined, the type of the wrong number is to indicate whether the password A is more than the character or less than the character or different characters by the program, in view of the principle of wrong number, the password A has fewer characters than the password B, the password verification result is unique, and the other two passwords have the possibility of being identical, for example, the verification without characters is carried out, when the password is set, the wrong number is 2, the 137 th bit is 5, the 211 th bit is j after the password is encrypted, when the password is verified, the 137 th bit is 8, the 211 th bit is 9, and other characters are identical, the two passwords are identified as the same password by a program, so that the verification is passed, about the problem, the Wang Xiaoyun professor of Shandong university obtains the conclusion that the uniqueness of the MD5 password is only relative through the operation of the MD5 algorithm, and actually, the MD5 value is also identical, in the invention, the long password is obtained by adding salt value data, the password combination analysis of the characters consisting of numbers and English capital letters is a power of 62 password digits, if the number of cipher bits is 200 bits, which is 62 to the power of 200, the probability of the same cipher is very small.
And (3) verification: after the program is started and verified, actually, the program is generally only a design scheme, the description refers to three cases, the program firstly analyzes the character length of the data, the character length is unmatched, namely the password is judged to be wrong, the character length is verified to pass, and then the next step is carried out, the character length matching does not mean that the character length of the data and the character length are the same, but the data length converted by wrong numbers is the same, for example, the program specifies that the A password is 2 bits less than the B password, the result is that the encrypted data is 200 bits, the stored data is 201 bits, namely the A password is 1 bit less than the B password, and the authentication cannot be passed,
the characters are different, the characters of the password A and the password B are different, the verification is to compare the characters of the password A and the password B one by one, when different characters appear, the recorded times exceed the number of the characters appointed by the wrong number, the program judges that the password is wrong, after the verification is finished, the number of different characters does not reach the appointed wrong number and is also the password error, only the number of different characters is the same with the appointed wrong number, the password passes the verification, for example, the appointed wrong number is 2, when the result is compared, when the characters of the password A and the password B are different and reach 3, the comparison is abandoned, the password error is judged, when all the characters of the password A and the password B are compared, only 1 pair of characters are different or not different, and the password error is also generated,
the verification of the A password is less than that of the B password, which is caused by randomly adding characters to the stored password when the password is set, for example, the A password is less than the B password by 2 bits, and a character comparison method is also adopted, only the character comparison is carried out, the 2 nd character is compared when the first character of the A password is the same as the first character of the B password, and so on, when the comparison is carried out, after the A password and the B password have different characters, the character of the B password is deleted, the character of the A password is compared with the next character of the B password, when the characters are the same, the comparison of the next pair of characters is carried out sequentially, and so on, namely, the comparison is carried out in a staggered way, for example, the 14 th bit character of the A password is different from the 14 th bit character of the B password, the 15 th bit character of the A password is compared with the 16 th bit character of the B password, by analogy, if the 87 th character of the A password is different from the 88 th character of the B password, the 87 th character of the A password is compared with the 89 th character of the B password, when the different numbers of the characters of the A password and the B password exceed the error number, the program stops comparing, the password is judged to be wrong, after the comparison is finished, when the different numbers of the characters of the A password and the B password are not enough than the error number, the password is wrong, and only when the different numbers of the characters of the A password and the B password are the same as the error number, the password is correct,
the verification that the password A has more characters than the password B is carried out, the stored password randomly reduces characters when the password is set, the verification comparison that the password A has more characters than the password B has the same verification principle with that the password A has less characters than the password B, but the dislocation comparison is opposite, in the dislocation comparison, the first character of the password A is the same as the first character of the password B, the 2 nd character is compared, and so on, when the password A and the password B have different characters, the character of the password A is deleted, the character of the password B is compared with the next character of the password A, when the characters are the same, the next pair of characters are compared in sequence, and so on, namely the dislocation comparison, when the number of the characters which are different from the password A and the password B exceeds the number of errors, the program stops comparing, judges that the password is wrong, after the comparison is finished, when the number of characters of the password A and the password B is different from a wrong number, the password is also wrong, and the password is correct only when the number of characters of the password A and the password B is different from the wrong number, the allowable digit of data of the password B after encryption is not definite, namely, a program does not force all encrypted data to have the same character length, but an upper limit and a lower limit of the character length need to be set, the wrong number refers to the fact that the number of data characters of the password A and the password B is different or a part of characters are different, the difference of the number of bits of the data of the password A and the data of the password B are wrong numbers when the number of the data of the password A and the data of the password B are different, and the different number of characters is the wrong number.
Example 1: withdrawal or transfer: the cardholder inserts the external bank card into the teller machine, inputs the temporary password, waits for the server to send the temporary password, receives the temporary password information through the mobile phone short message, then inputs the temporary password, sends the temporary password to the mobile phone financial transaction program, the cardholder only needs to wait, after seeing the prompt message of successful transaction reservation, takes down the external bank card, continues the transaction to the bank counter or the teller machine within the time set by the cardholder, inserts the external bank card into the teller machine, inputs the temporary password, selects the service type, for safety, the cardholder can also reserve the transaction type and input the transaction amount in the reservation stage, the cardholder still needs to input the transaction amount in the teller machine, the transaction amount is inconsistent, the transaction fails, the cardholder can see that the transaction difficulty is not much different from the transaction of the current teller machine, and feels that the temporary password is difficult to memorize, and completing the transaction by using the mobile phone.
Example 2: withdrawal or transfer: the cardholder uses the electronic cipher device to make a transaction appointment, the server sends a temporary cipher to the mobile phone number bound by the cardholder or sends a temporary cipher to the mobile phone financial transaction program, the cardholder scans the electronic cipher device with the mobile phone, the electronic cipher device receives the scanning signal, the program automatically generates the temporary salt data, the cardholder needs to input the temporary cipher and the temporary salt data and encrypts the temporary cipher and the temporary salt data with the electronic cipher device, after the encryption is completed, the electronic cipher device displays the encrypted result in a two-dimensional code or other data forms which can be identified by the mobile phone, and displays the number of the electronic cipher device, the mobile phone scans the screen of the electronic cipher device, the mobile phone financial transaction program introduces the temporary salt data of the electronic cipher device and transmits the temporary cipher data to the server, the server deletes the temporary cipher, the mobile phone deletes the encrypted data, retains the temporary salt data, and the cardholder transacts business to a teller machine or a bank counter, the teller machine or other financial transaction equipment needs to be equipped with a scanning device, a cardholder inputs a temporary password in the electronic password device, the teller machine scans the screen of the electronic password device and sends the serial number of the electronic password device and the temporary salt password data to the server, the server compares the temporary salt password data stored in the server with the password data sent by the teller machine, the two are in accordance, the transaction is completed, and meanwhile, the electronic password device deletes the related data of the temporary password.
Example 3: the old people are difficult to be proficient in operating the short message function of the mobile phone, the mobile phone numbers of children or other relatives are filled in by contacting the mobile phone numbers when an account is opened, the bank card passwords of the old people are informed by the children in the reservation stage, the old people choose to avoid other people at home, the safety in the password input process is ensured, the children or other relatives inform the temporary passwords when a teller machine is operated or a counter is fetched, the temporary passwords are only used once, even if other people know the temporary passwords, the cardholder cannot complete the transaction within the specified time, and the transaction is invalidated.
Example 4: the mobile phone bank or the online bank is charged, a cardholder inserts the external bank card, the internal bank card is inserted into the mobile phone, the user password is input without inserting, the mobile phone bank or the online bank is selected to charge after passing the password verification, the transaction page is entered, the mobile phone bank or the online bank is selected to charge, the transaction amount is input, the system sends the transaction information to the server after the transaction information is input, the charging is successful, the transaction information is inconsistent, the transaction is failed, and the external bank card is taken out after the transaction is completed.
Example 5: the mobile phone bank deals, after the recharging is successful, the mobile phone bank can use the fund of the virtual bank to finish the mobile phone payment, the fund of the virtual bank refers to the money recharged by the bank card, the cardholder inputs the user password, and after the password verification is passed, the deal is finished, and the deal is finished by using the single salt password.
Example 6: the method comprises the steps of transferring accounts by a mobile phone, inserting an external bank card into a cardholder, inputting a user password by an internal bank card on the mobile phone without inserting the internal bank card, entering a transaction page after the user password is verified, selecting the mobile phone to transfer accounts, inputting a transaction amount and an account number of the opposite party, sending transaction information to a server by a system after the information is input, successfully transferring accounts after the password is verified and the account number of the opposite party is verified, failing to verify, and taking out the external bank card after the transaction is completed.
Description of the drawings: FIG. 1 is a schematic diagram of an early warning mode and a normal mode, wherein A, B, C is a password input box, a cardholder enters the normal mode after selecting A to input a password, 1 indicates that the password is correct, 2 indicates that the password is incorrect, 3 indicates that the cardholder can enter the early warning mode after exiting the normal mode, 4 indicates that the cardholder enters the early warning mode and is not fund-changing operation, 5 indicates that the cardholder enters the early warning mode and is fund-paying operation, 6 indicates that the fund-paying amount is small, 7 indicates that the fund-paying amount reaches the alarm-giving degree of criminal, and 8 and 9 indicate that the cardholder enters a counter to release the locking of the early warning mode.
Fig. 2 is a schematic view of an appearance structure of an extrapolation bank card, wherein 1 is a cover layer of an account opening password, 2 is a circuit contact part, a transverse line part marked with length is the longest value of the bank card, and a vertical line part marked with width is the widest value of the bank card.
Fig. 3 is an appearance structure diagram of the built-in bank card, 1 is a card body, 2 is a card, 3 is a connecting rib of the card body and the card, and 4 is a circuit contact part.
FIG. 4 is a schematic diagram of wrong number password authentication, wherein a single arrow indicates that the character authentication is passed, an open single arrow and an open double arrow indicate that the authentication is not passed, wherein a box with MI indicates the authentication process when the characters of the A password and the B password are different, a box with M2 indicates that the A password is more authenticated than the characters of the B password, and a box with M3 indicates that the A password is less authenticated than the characters of the B password.