TW201911169A - Mobile E-bank transaction authentication method and system return the signature data packaged with the hash value, the identification code, and the certificate data, and verification data to the E-bank servo end - Google Patents

Abstract

In a Mobile E-bank transaction authentication method and system, an authentication servo end stores a hash value and an identification code generated according to the transaction data from an E-bank servo end, the hash value and the identification code are transmitted to a mobile apparatus through the E-bank servo end, such that the mobile apparatus transmits the hash value, the identification code, and the certificate data which is read from an electronic card via a card reader to the authentication servo end. The authentication servo end transmits the transaction data to the mobile apparatus when determining that the received hash value and the identification code are matched with the stored hash value and an identification code, and returns the signature data packaged with the hash value, the identification code, and the certificate data, and verification data to the E-bank servo end when receiving a correct data notification from the mobile apparatus.

Description

Mobile online banking transaction authentication method and system

The invention relates to a mobile internet banking transaction service, in particular to a mobile internet banking transaction authentication method and system.

When an online banking transaction is performed using, for example, a desktop computer, it is necessary to communicate with a card reader connected to the computer and inserted with, for example, a financial card, through a component pre-installed on the computer to complete the authentication and authorization. Trading signature operations. However, todayadays, the use of mobile devices to perform mobile commerce needs is increasing, and it is necessary to provide a mobile authentication and authorization function and related interface suitable for mobile devices, so that users can utilize mobile devices and incorporate, for example, a chip financial card or XML (Extensible Markup Language, An extendable markup language) an electronic card of a signature card for confirmation of a financial service such as a non-contracted transfer or a large transfer.

In order to meet the above-mentioned mobile business requirements, the existing mobile online banking authentication technology proposes to utilize a specific application and perform transaction verification or voucher signing operations related to a financial transaction through a mobile card reader dedicated to mobile devices. . However, this particular application needs to transmit the transaction source data with a relatively large amount of data when performing transaction verification or voucher signature, thus causing the mobile device to provide a large memory storage space and the risk of the mobile device performing performance degradation. increase.

Therefore, there is still much room for improvement in the existing mobile online banking certification technology.

Accordingly, it is an object of the present invention to provide a mobile internet transaction authentication method that overcomes the shortcomings of the prior art.

Therefore, the mobile banking transaction authentication method provided by the present invention is provided by a mobile device connected to a card reader and equipped with a mobile security application, and is inserted into the card reader and stored corresponding to a specific client. The voucher data is executed by an electronic card, an online banking server and an authentication server. The mobile online banking certification method includes the following steps:

(A) by the online banking server, when receiving a transaction request from the mobile device and relating to a financial transaction of a specific account and including transaction information, transmitting an authentication request including the transaction data to the authentication server end;

(B) by the authentication server, when receiving the authentication request from the online banking server, using a predetermined hash algorithm, generating a hash value and an identifier corresponding to the hash value according to the transaction data. And storing the hash value and the identification code, and transmitting the hash value and the identification code to the online banking server;

(C) transmitting, by the online banking server, the received hash value and the identification code to the mobile device when receiving the hash value and the identification code from the authentication server;

(D) by the mobile device, when receiving the hash value and the identification code from the online banking server, starting to execute the mobile security application to establish a connection with the authentication server and read the card reader Taking the voucher data stored by the electronic card, and transmitting the received hash value and the identification code and the voucher data from the card reader to the authentication server;

(E) by the authentication server, after receiving the hash value, the identification code and the authentication data from the mobile device, and determining that the received hash value and the identification code respectively correspond to the stored hash And the identification code, the transaction data is transmitted to the mobile device; and

(F) by the authentication server, when receiving a notification from the mobile device and indicating that the transaction data is correct, the received hash value, the identification code and the authentication data are packaged and signed. Obtaining signature information, and transmitting a successful authentication reply corresponding to the authentication request and including the signature data and the credential data to the online banking server.

Accordingly, it is another object of the present invention to provide a mobile internet transaction authentication system that overcomes the shortcomings of the prior art.

Therefore, the mobile internet transaction authentication system provided by the present invention comprises a mobile device, a card reader, an online banking server and an authentication server. The mobile device is equipped with an action security control application. The card is electrically connected to the mobile device and has an electronic card inserted therein. The electronic card stores a voucher data corresponding to a specific client, and the authentication server is connected to the online banking server.

When the online banking server receives a transaction request from the mobile device and is related to a specific account financial transaction and includes transaction data, the online banking server transmits an authentication request containing the transaction data to the authentication server.

When the authentication server receives the authentication request from the online banking server, the authentication server generates a hash value and an identifier corresponding to the hash value according to the transaction data by using a predetermined hash algorithm, and stores The hash value and the identification code, and the hash value and the identification code are transmitted to the online banking server.

When the online banking server receives the hash value and the identification code from the authentication server, the online banking server transmits the received hash value and the identification code to the mobile device.

When the mobile device receives the hash value and the identification code from the online banking server, the mobile security application is started to establish a connection with the authentication server and the card reader reads the electronic card for storage. The voucher data is transmitted to the authentication server by the received hash value and the identification code and the voucher data from the card reader.

When the authentication server receives the hash value, the identification code and the authentication data from the mobile device, and determines that the received hash value and the identification code respectively correspond to the stored hash value and the identifier The authentication server transmits the transaction data to the mobile device.

When the authentication server receives a notification from the mobile device and indicates that the transaction data is correct, the authentication server packs the received hash value, the identification code and the authentication data to obtain a signature. Data, and a successful authentication reply corresponding to the authentication request and including the signature data and the credential data is transmitted to the online banking server.

The effect of the present invention is that the authentication server first uses the hash value generated from the transaction data from the online banking server to authenticate that the mobile security application installed by the mobile device is true, and then transmits the transaction data to the transaction information. The mobile device transmits the signature data and the voucher data packaged with the hash value, the identification code and the voucher data to the online banking server, after the transaction device confirms the correctness of the transaction. Therefore, under the existing system architecture, not only the security of the voucher data stored in the electronic card can be ensured, but also the amount of data transmitted during the authentication period can be greatly reduced.

Referring to FIG. 1, an embodiment of the mobile internet transaction authentication system 100 of the present invention can be applied to a banking institution and provides related financial services to a customer who wants to conduct financial transactions related to a particular account via online banking. Trading certification services. The mobile internet transaction authentication system 100 includes a mobile device 1, an online banking server 2, an authentication server 3, a card reader 4, an electronic card 5, and a verification server 6.

In this embodiment, the mobile device 1 is, for example, a smart phone or a tablet computer held by the client, and a mobile security application APP is installed in advance. The mobile device 1 can establish a connection with the online banking server 2 and the authentication server 3 via a wireless communication network (not shown).

In use, the card reader 4 is electrically connected to the mobile device 1 and is inserted with the electronic card 5. The electronic card 5 stores credential data corresponding to the particular customer.

The online banking server 2 provides an online banking webpage, and can connect to the authentication server 3, the verification server 6, and a transaction execution server 200 for executing a transaction via, for example, an internet (not shown).

The verification server 6 stores a plurality of reference document materials respectively corresponding to a plurality of different clients.

Hereinafter, how the mobile banking transaction authentication system 100 performs a mobile banking transaction authentication procedure for the financial transaction will be described in detail with reference to FIGS. 1 and 2. The smart banking over-the-counter service program includes the following steps.

First, in step S21, when the mobile device 1 is connected to the online banking webpage provided by the online banking servo 2 end, and after successfully verifying the user identity to log in to the specific account, the mobile device 1 generates a correlation through human operation. The financial transaction includes a transaction request for the transaction data, and the transaction request is transmitted to the online banking server 2. In this embodiment, the financial transaction is, for example, a transfer transaction, but not limited thereto, and the transaction data is, for example, an account including at least a transaction date, a transfer amount, the specific account (ie, an outgoing account), and a transfer The transaction message of the account, but not limited to this.

Then, in step S22, the online banking server 2 stores the transaction data upon receiving the transaction request from the mobile device 1, and transmits an authentication request containing the transaction data to the authentication server 3.

Next, in step S23, the authentication server 3, when receiving the authentication request from the online banking server 2, generates a hash value and a unique corresponding to the hash value according to the transaction data by using a predetermined hash algorithm. And identifying the hash value and the identification code, and transmitting the hash value and the identification code to the online banking server 2.

Next, in step S24, the online banking server 2 transmits the received hash value and the identification code to the mobile device 1 when receiving the hash value and the identification code from the authentication server 3, And then, a poll corresponding to the authentication request is continuously transmitted to the authentication server 3.

Next, in step S25, the mobile device 1 starts executing the mobile security application APP when the hash value and the identification code from the online banking server 2 are received, so as to establish a connection with the authentication server 3 And causing the card reader 4 to read the voucher data stored by the electronic card 5, and transmitting the received hash value and the identification code and the voucher data from the card reader 4 to the authentication server. 3.

Next, in step S26, when receiving the hash value, the identification code and the authentication data from the mobile device 1, the authentication server 3 determines whether the received hash value and the identification code respectively correspond to the steps. The hash value stored in S23 and the identification code are used to authenticate whether the mobile security application APP executed by the mobile device 1 is true (ie, has not been tampered with). If the result of the determination is affirmative (ie, the action security application APP is proved to be true), the flow proceeds to step S28, otherwise, the authentication server 3 fails an authentication (the action security application APP). The error message is transmitted to the online banking server 2 (step S27).

In step S28, when the mobile security application APP is authenticated by the authentication server 3, the authentication server 3 transmits the transaction data stored in step S22 to the mobile device 1.

Then, in step S29, the mobile device 1 displays the transaction data via the execution of the mobile security application APP when receiving the transaction data from the authentication server 3. In this case, the customer can confirm the correctness by the transaction information displayed on the mobile device 1. After confirming that the transaction data is correct by the client, the mobile device 1 generates a notification indicating that the transaction data is correct through a human operation, and transmits the notification to the authentication server. Thus, the mutual authentication between the authentication server 3 and the mobile security application APP executed by the mobile device 1 is completed.

Then, in step S30, the authentication server 3, upon receiving the notification from the mobile device 1, packages and signs the received hash value, the identification code and the authentication data to obtain signature data. In this embodiment, the signature information may be, for example, a signature value.

Thereafter, when the authentication server 3 receives the polling from the online banking server 2, in step S31, the authentication server 3 responds to the polling to correspond to the authentication request and includes the signature. The data and the successful authentication reply of the voucher data are transmitted to the online banking server 2. Therefore, the online banking server 2 retrieves the signature data and the document data. It is worth noting that during the two-way authentication performed by the authentication server 3 and the mobile security application APP, the transmission of the transaction data is greatly reduced.

Next, in step S32, when receiving the successful authentication reply from the authentication server, the online banking server 2 generates, for the financial transaction, the received signature data and the voucher data, and the transaction. The verification request of the transaction data included in the request is requested, and the verification request is transmitted to the verification server 6.

Next, in step S33, when receiving the verification request from the online banking server 2, the verification server 6 determines whether the voucher data matches one of the stored reference document data of the pen reference voucher data. If the result of this determination is affirmative, the flow proceeds to step S35. Conversely, if the verification server 6 determines that the stored reference document data does not have any reference document data corresponding to the document data, that is, when the electronic card 5 stores the document data When it is damaged or expires, the verification server 6 transmits a verification failure error message to the online banking server 2 (step S34).

In step S35, the verification server 6 uses the predetermined hash algorithm to obtain a hash value based on the transaction data when it is determined that the voucher data matches the stored reference document data of the pen reference voucher data. .

In step S36, the verification server 6 determines whether the hash value obtained in step S35 matches the hash value included in the signature result, thereby determining whether the signature material is successfully verified. If the determination is affirmative, that is, the transaction data received by the online banking server 2 matches the transaction data confirmed by the customer, the flow proceeds to step S37, otherwise, the flow returns to step S34.

In step S37, the verification server 6 transmits a verification success response replied to the verification request to the online banking server 2 when it is determined that the signature data is successfully verified.

Next, in step S38, the online banking server 2 transmits the transaction data to the transaction execution server 200 upon receiving the successful verification reply from the verification server 6. Then, the transaction execution server 200 executes the financial transaction based on the transaction data to generate a transaction result indicating the completion of the financial transaction, and transmits the transaction result to the online banking server 2.

Finally, the online banking server 2 receives the transaction result from the transaction execution server 200, and transmits the transaction result to the mobile device 1 (step S39), so that the mobile device 1 is received from the online banking server. When the result of the transaction is 2, the result of the transaction is displayed for the customer to rely on (step S40). At this point, the mobile online banking transaction certification process was completed.

In summary, the authentication server 3 first uses the hash value generated from the transaction data from the online banking server 2 to authenticate that the mobile security application APP installed by the mobile device 1 is true. Transmitting the transaction data to the mobile device for the customer to confirm its correctness, thereby achieving the two-way authentication, the hash code, the identification code and the signature data of the voucher data and the voucher data And transmitted to the online banking server. Then, after the verification server 6 confirms that the transaction data held by the online banking server 2 matches the transaction data confirmed by the client, the online banking server 2 transmits the transaction data to the transaction execution servo. End 200 to actually execute the financial transaction. Therefore, under the existing system architecture, not only the security of the voucher data stored in the electronic card can be ensured, but also the transaction data can be prevented from being falsified, thereby improving the security of the mobile online banking transaction. In addition, since it is not necessary to transmit a large amount of transaction original data as required in the prior art, the amount of transmitted data can be greatly reduced, and the object of the present invention can be achieved.

However, the above is only the embodiment of the present invention, and the scope of the invention is not limited thereto, and all the simple equivalent changes and modifications according to the scope of the patent application and the patent specification of the present invention are still Within the scope of the invention patent.

100‧‧‧Mobile online banking transaction authentication system

1‧‧‧ mobile device

APP‧‧‧Action Security App

2‧‧‧Internet banking server

3‧‧‧Certified server

4‧‧‧ card reader

5‧‧‧Electronic card

6‧‧‧Verification server

200‧‧‧Transaction execution server

S21-S40‧‧‧Steps

Other features and advantages of the present invention will be apparent from the embodiments of the present invention, wherein: Figure 1 is a block diagram illustrating an embodiment of the mobile internet banking authentication system of the present invention; 3 is a flow chart exemplarily illustrating how the embodiment performs a mobile banking transaction authentication procedure.

Claims (12)

A mobile online banking transaction authentication method, comprising a mobile device connected to a card reader and having a mobile security application, an electronic card inserted in the card reader and storing a voucher data corresponding to a specific client, The online banking server and the authentication server perform the following steps: (A) receiving, by the online banking server, a financial transaction from the mobile device and related to a specific account. When the transaction request includes the transaction data, an authentication request including the transaction data is transmitted to the authentication server; (B) by the authentication server, when the authentication request from the online banking server is received, a reservation is utilized. a hash algorithm, generating a hash value and an identifier corresponding to the hash value according to the transaction data, storing the hash value and the identification code, and transmitting the hash value and the identification code to the online banking server; (C) by the online banking server, when receiving the hash value and the identification code from the authentication server, the received hash value and the knowledge Transmitting to the mobile device; (D) by the mobile device, when receiving the hash value and the identification code from the online banking server, starting to execute the mobile security application to establish a connection with the authentication server And causing the card reader to read the voucher data stored by the electronic card, and transmitting the received hash value and the identification code and the voucher data from the card reader to the authentication server; Receiving, by the authentication server, the hash value, the identification code and the authentication data from the mobile device, and determining that the received hash value and the identification code respectively correspond to the stored hash value and The identification code is transmitted to the mobile device; and (F) by the authentication server, when receiving a notification from the mobile device indicating that the transaction data is correct, the received The hash value, the identification code and the authentication data are packaged and signed to obtain signature information, and a successful authentication response corresponding to the authentication request and including the signature data and the certificate data is transmitted to Online banking server end. The mobile internet transaction authentication method according to claim 1 further includes the following steps before the step (A): (G) by using the mobile device, connecting to the online banking webpage provided by the online banking server and logging in to the mobile banking website. After a specific account, the transaction request is generated through a human operation, and the transaction request is transmitted to the online banking server. The mobile internet transaction authentication method according to claim 1, further comprising the following steps between step (E) and step (F): (H) receiving, by the mobile device, the transaction from the authentication server At the time of the data, the transaction data is displayed by the execution of the action security application, and the notification is generated by a human operation, and the notification is transmitted to the authentication server. The method for authenticating the online banking transaction described in claim 1 is also performed by a verification server connected to the online banking server and storing a plurality of reference document data. After the step (F), the method further comprises the following steps: I) by the online banking server, when receiving the successful authentication reply from the authentication server, generating, for the financial transaction, the received signature data and the voucher data, and the transaction request includes The verification request of the transaction data, and the verification request is transmitted to the verification server; (J) by the verification server, after receiving the verification request from the online banking server, and determining that the certificate data is consistent with And storing, by the predetermined hash algorithm, a hash value obtained according to the transaction data, and determining whether the hash value obtained by the judgment matches the signature result The hash value included, determining whether the signature data is successfully verified; and (K) by the verification server, when determining that the signature data is successfully verified And transmitting a verification success reply in response to the verification request to the online banking server. The mobile banking transaction authentication method according to claim 4, after the step (K), further comprising the following steps: (L) by the online banking server, when receiving the successful reply from the verification server, Transmitting the transaction data to a transaction execution server; (M) receiving, by the online banking server, a transaction result from the transaction execution server indicating the completion of the financial transaction, and transmitting the transaction result to the mobile device And (N) by the mobile device, displaying the transaction result when receiving the transaction result from the online banking server. The mobile banking transaction authentication method according to claim 1, wherein: in the step (C), the online banking server continues to transmit a corresponding to the authentication after the hash value and the identification code are transmitted to the mobile device. The requested polling is sent to the authentication server; and in the step (F), the authentication server responds to the polling from the online banking server, and transmits the successful authentication reply to the online banking server. A mobile online banking transaction authentication system comprising: a mobile device installed with a mobile security application; a card reader electrically connected to the mobile device and having an electronic card stored therein, the electronic card storing a certificate corresponding to a specific customer Data; an online banking server; and an authentication server connected to the online banking server; wherein, when the online banking server receives a transaction request from the mobile device and is related to a specific account financial transaction and includes transaction information The authentication request of the online banking server to the transaction server is transmitted to the authentication server; wherein, when the authentication server receives the authentication request from the online banking server, the authentication server uses a predetermined hash algorithm. Generating a hash value and an identifier corresponding to the hash value according to the transaction data, and storing the hash value and the identification code, and transmitting the hash value and the identification code to the network banking server; wherein, when When the online banking server receives the hash value and the identification code from the authentication server, the online banking server will connect Transmitting the received hash value and the identification code to the mobile device; wherein, when the mobile device receives the hash value and the identification code from the online banking server, the mobile control application is started to establish and The authentication server connects the card and reads the voucher data stored by the electronic card, and transmits the received hash value and the identification code and the voucher data from the card reader to the certificate. a server; after the authentication server receives the hash value, the identification code, and the authentication data from the mobile device, and determines that the received hash value and the identification code respectively match the stored hash value And the identification code, the authentication server transmits the transaction data to the mobile device; and wherein, when the authentication server receives a notification from the mobile device and indicates that the transaction data is correct, the authentication server The terminal packs the received hash value, the identification code and the authentication data into a signature to obtain signature information, and corresponds to the authentication request and includes the signature Material voucher information with the successful authentication reply transmitted to the online banking server end. The action online banking transaction authentication system according to claim 7, wherein the mobile device generates a transaction request through a human operation after linking the online banking webpage provided by the online banking server and logging in to the specific account, and the The transaction request is transmitted to the online banking server. The action online banking transaction authentication system according to claim 7, wherein the mobile device displays the transaction data via the action security application when the transaction data is received from the authentication server, and is operated by a human operation. The notification is generated and transmitted to the authentication server. The action online banking transaction authentication system according to claim 7, further comprising a verification server connected to the online banking server and storing a plurality of reference voucher data respectively corresponding to the plurality of different clients, wherein: the online banking server is receiving Upon the successful authentication reply from the authentication server, for the financial transaction, a verification request including the received signature data and the voucher data, and the transaction data included in the transaction request is generated, and the The verification request is transmitted to the verification server; after the verification server receives the verification request from the online banking server and determines that the certificate data matches the stored reference document data of the pen reference document, the verification server utilizes The predetermined hash algorithm obtains a hash value according to the transaction data, and determines whether the signature data is successfully verified by determining whether the hash value obtained by the judgment matches the hash value included in the signature result; and When the verification server determines that the signature data is successfully verified, the verification server responds to the verification request. The power reply is transmitted to the online banking server. The action online banking transaction authentication system according to claim 10, wherein: the online banking server transmits the transaction data to a transaction execution server when receiving the verification success reply from the verification server; the online banking server receives Transmitting a transaction result from the transaction executing the server and indicating the completion of the financial transaction, and transmitting the transaction result to the mobile device; and the mobile device displays the transaction when receiving the transaction result from the online banking server result. The mobile internet transaction authentication system according to claim 7, wherein: the online banking server continues to transmit a poll corresponding to the authentication request to the authentication after the hash value and the identification code are transmitted to the mobile device. The server is in response to the polling from the online banking server, and the successful authentication reply is transmitted to the online banking server.