TWI459786B - Multi-channel active identityauthentication system and related computer program product and method - Google Patents

Description

Multi-channel active network identity verification system and related computer program products

The invention relates to a network security control mechanism, in particular to a multi-channel active network identity verification system and related computer program products.

As various Internet service applications become more and more popular, the importance of Internet security is getting higher and higher. The traditional way to log into a remote network service system (such as online banking, network ordering, online games, corporate intranet systems, etc.) is to use the user account and password to verify the identity of the registrant. With Trojans, keyloggers, screen loggers, Phishing, man-in-the-middle attack attacks, replay attacks Advances in malicious technology have made it a major security threat to simply use user account and password authentication methods.

In order to enhance the security of online banking transactions, a security vendor launched a SMS-authentication scheme using SMS channels, such as RSA Security's security authentication system (approximately ten years ago). On-demand Authenticators) and so on. After the user logs in to the online banking system with his existing account and password, the online banking system will use the telecom platform to the SMS side. Send a set of one time password (OTP) to the user's mobile phone. The user must enter the dynamic password on the webpage of the online bank to complete the second identity verification procedure before the online banking transaction service can be performed.

However, this type of method and system is not effective against the threat of man-in-the-middle attacks and phishing attacks. Because once the user is attacked by a man-in-the-middle attack or phishing attack in the process of logging into the online banking system, the dynamic password entered by the user on the webpage of the online bank will be intercepted by the malicious person who launched the attack. And know. As a result, various improved solutions have been continuously proposed.

For example, the Chinese Patent No. I288554 patent specification of the Chinese Trust proposes a so-called two-factor identity authentication method and system, which adds a summary data of the transaction content, such as a partial number of the transfer account, or a short message sent in the dynamic password. The transaction amount, for the user to compare with the data entered by the user on the webpage, wherein the dynamic password is calculated from the data of the transaction content. If the user can carefully check the correctness of the content of the newsletter, the ability to detect attacks can be improved. But this approach does not effectively defend against more man-in-the-middle attacks and phishing attacks. For example, a phishing page may prompt the user: "If the transfer account or transaction amount in the SMS received by your mobile phone does not match the transaction you entered on the webpage, please enter the dynamic password in the SMS into the "Cancel transaction" on the webpage. "The field to cancel the transaction." At this time, if the user operates according to the instructions of the phishing webpage, the malicious person who initiated the attack can obtain the dynamic password.

Even if the aforementioned dynamic password has limitations on the use of time limit, it is still sufficient for the malicious person to impersonate the user to tamper with the content of the online transaction during the valid period of the password, resulting in the user's money loss.

In addition, there have been cases where a hacker impersonated a user who misreported the mobile phone SIM card to the telecommunications company and defrauded the same phone number from the telecommunications company. At this point, the hacker can receive the dynamic password that the online banking system is to send to the user, and use the online banking service to impersonate the user's identity, causing the user's money loss.

It can be seen from the foregoing description that the method and system proposed by the Taiwan Patent No. I288554 still have obvious loopholes in the security, and it is impossible to effectively verify the authenticity of the network user and ensure the security of the network transaction.

In view of this, how to effectively verify the authenticity of network users' identity and strengthen the security control effectiveness of network services is an urgent problem to be solved.

The present specification provides an embodiment of a multi-channel active network identity verification system, comprising: a browser module for transmitting a service request through a first transmission pipeline; and a security authentication module for generating a challenge a service processing module, configured to generate service content information corresponding to the service request, and use a target connection between the service processing module and the browser module, and pass the service content information and the challenge value through the first The transmission pipeline is transmitted to the browser module; a display device is configured to display the service content information and the challenge value; and a verification activation module is configured to prompt the user to display the service content information and the challenge value displayed by the display device Entering a predetermined interface; a verification data generating module, configured to generate a response value corresponding to the challenge value received by the predetermined interface according to a challenge response algorithm, and use the key to the service content information and the response value Encrypting to generate security verification data; and a short message module for passing the security verification data in a short message form Second transmission piped to the security authentication module; wherein the security module receiving the authentication security authentication information, will verify the information and a secure authentication source telephone number, if If the service content information and the response value are not included in the security verification data, or the source phone number is not a pre-agreed number, the security authentication module rejects the service request sent by the browser module through the first transmission pipeline. .

The present specification provides an embodiment of a computer program product that allows a service provider system to perform a multi-channel network identity verification operation, the multi-channel network identity verification operation comprising: generating a challenge value according to a challenge response algorithm; utilizing A service processing module uses a target connection between the service processing module and a client device, and transmits the challenge value to the client device through a first transmission pipeline; and receives security verification data transmitted through a second transmission pipeline. And verifying the security verification data; and if the security verification data does not include a response value corresponding to the challenge value, rejecting a service request sent by the client device through the first transmission pipeline.

The present specification further provides an embodiment of a computer program product that allows a service provider system to perform a multi-channel network identity verification operation, the multi-channel network identity verification operation comprising: generating a set of dynamic passwords; utilizing a service processing module Using a target connection between the service processing module and a client device, transmitting the dynamic password to the client device through a first transmission pipeline; receiving security verification data transmitted through a second transmission pipeline; verifying the The security verification data; and if the dynamic password is not included in the security verification data, rejecting a service request sent by the client device through the first transmission pipeline.

The present specification further provides an embodiment of a computer program product, which allows a client device having a verification data generation module to perform an active network identity verification operation, the active network identity verification operation including: prompting a user to provide a service Providing a challenge value transmitted by the end system through a first transmission pipeline, inputting a predetermined interface of the client device, receiving the challenge value by using the predetermined interface, and generating a modulus by using the verification data Blocking, according to a challenge response algorithm, a response value corresponding to the challenge value; using the verification data generation module to generate a security verification data related to the response value; and using the security verification data as one or more newsletters The form is transmitted to a designated telephone number via a second transmission pipe.

The present specification further provides an embodiment of a computer program product, which allows a client device having a verification data generation module to perform an active network identity verification operation, the active network identity verification operation including: prompting a user to provide a service Providing a dynamic password sent by the end system through a first transmission pipeline, inputting a predetermined interface of the user equipment; receiving the dynamic password by using the predetermined interface; and using the verification data generation module to generate a security related to the dynamic password Verifying the data; and transmitting the security verification data to a designated telephone number via a second transmission pipeline in the form of one or more short messages.

The use of the aforementioned multi-channel active network identity verification system and related computer program products can not only improve the non-repudiation and security of the security verification data issued by the client device, but also effectively overcome the Trojan horse program and the keyboard side program. , screen recording programs, phishing, man-in-the-middle attacks, resend attacks, and other common network attacks have impacted on network identity verification, greatly enhancing the correctness and reliability of network identity verification, and thus achieving A higher level of network security control purposes.

100, 700‧‧‧Multi-channel active network identity verification system

110‧‧‧Service provider system

112‧‧‧Service Processing Module

114‧‧‧Safety Certification Module

120, 720, 722‧‧‧Customer device

121‧‧‧Browser module

122‧‧‧ display device

123‧‧‧Storage device

124‧‧‧ Identity Identification Module

125‧‧‧Verification data generation module

126‧‧‧SMS module

127‧‧‧Verification Startup Module

1 is a simplified functional block diagram of a first embodiment of a multi-channel active network identity verification system of the present invention.

2 and FIG. 3 are simplified flowcharts of a first embodiment of a multi-channel active network identity verification method according to the present invention.

4 is a simplified flow chart of a first embodiment of the security verification data generated by the client device of FIG. 1.

FIG. 5 is a simplified partial flowchart of a second embodiment of a multi-channel active network identity verification method according to the present invention.

FIG. 6 is a simplified flowchart of a second embodiment of the security verification data generated by the client device of FIG. 1.

FIG. 7 is a simplified functional block diagram of a second embodiment of the multi-channel active network identity verification system of the present invention.

Embodiments of the present invention will be described below in conjunction with the associated drawings. In the drawings, the same reference numerals are used to refer to the same or similar elements.

Certain terms are used throughout the description and following claims to refer to particular elements. Those of ordinary skill in the art should understand that the same elements may be referred to by different nouns. The scope of this specification and the subsequent patent application do not use the difference of the names as the means for distinguishing the elements, but the difference in function of the elements as the basis for the distinction. The word "contains" mentioned in the entire specification and subsequent claims is an open term and should be interpreted as "including but not limited to...".

The description of "and/or" as used herein includes any combination of one or more of the listed items. In addition, the terms of any singular are intended to include the meaning of the plural, unless otherwise specified in the specification.

Please refer to FIG. 1 , which illustrates a multi-channel active network according to a first embodiment of the present invention. A simplified functional block diagram of the multi-channel active identity authentication system 100. The multi-channel active network identity verification system 100 includes a service provider system 110 belonging to a service provider and a client device 120 belonging to the user. The service provider system 110 includes a service processing module 112 and a security authentication module 114. The service processing module 112 is configured to process a service request from a user. The security authentication module 114 is configured to perform network authentication for the user requesting the service. The service provider system 110 can be various network service systems, such as an online banking system, a network ordering system, an online gaming system, an intranet system, or various cloud service systems. In practice, the service processing module 112 and the security authentication module 114 may be different functional modules implemented by using a computer program, and the two may be stored on the same computer host, or may be separately stored in different computer hosts located in the same or different geographical regions. on.

The client device 120 includes a browser module 121, a display device 122, a storage device 123, an identity recognition module 124, a verification data generation module 125, a SMS module 126, and a verification activation module 127 stored in the storage device 123. The browser module 121 is for connecting to the service provider system 110 via the internet 130. The display device 122 is configured to display webpage information received by the browser module 121. The identity identification module 124 includes identification data representative of legitimate users of the client device 120. The verification data generation module 125 is a hardware device or a software module dedicated to a legitimate user of the client device 120 for generating security verification data. For example, the identity identification module 124 can be a SIM card, and the verification data generation module 125 can be a key for storing a legitimate user of the client device 120 and attached to the thin circuit board of the identity recognition module 124. ). Alternatively, the verification data generation module 125 may be a computer The program implements and stores a functional module of a key of a legitimate user of the client device 120.

The SMS module 126 is configured to transmit the security verification data to the security authentication module 114 in the form of a short message. The verification startup module 127 is configured to initiate the active network identity verification procedure proposed by the present invention according to a user's command. In this embodiment, the verification startup module 127 is implemented by a computer program and provided by the service provider to the user for storing the function module on the client device 120.

In application, the client device 120 can be any terminal device that can send a short message through a pipe outside the Internet, such as a smart phone, a notebook computer, a tablet computer, an e-book, etc., or can be a desktop computer or a vehicle. Equipment such as electronic systems.

The operation of the multi-channel active network identity verification system 100 will be further described below in conjunction with FIGS. 2 through 7.

2 and FIG. 3 are simplified flowcharts of a first embodiment of a multi-channel active network identity verification method according to the present invention. When the user wants to use a certain network service of the service provider system 110, such as online transactions, online ordering, online games, access to cloud data, login or access to a remote enterprise internal server, etc., the user The process 202 may be performed by the browser module 121 of the client device 120, and the first heavy network identity verification procedure is performed via a first transmission pipeline to log in to the service provider system 110. In this embodiment, the first transmission pipeline is the Internet 130. The client device 120 can log in to the service provider system 110 via the Internet 130 by using various conventional identity authentication methods such as a user account and a fixed password to obtain the right to use a part of the service with a lower security control level, such as browsing basic data. And other basic service items. At this time, the service processing module 112 of the service provider system 110 and the browsing of the client device 120 A data session is established between the modules 121.

In the process 204, the browser module 121 transmits the service requirements selected by the user or specified by the security control level, such as network transfer, modification of account information, etc., through the established data connection through the Internet 130. The service processing module 112 is provided.

When the service processing module 112 receives the service request from the browser module 121, the process 206 is performed to generate service content information corresponding to the service request, and the security authentication module 114 is notified to perform the multi-channel network identity verification procedure for the service request. . For example, assuming that the service request from the browser module 121 is a request for a network transfer, the service processing module 112 can transfer the amount of the network transfer, the currency, the account transferred to the account, or the name of the account. The information is used as the service content information for the user to check.

After receiving the notification from the service processing module 112, the security authentication module 114 proceeds to process 208 to generate a set of challenge values according to a challenge response algorithm. In this embodiment, a corresponding challenge response algorithm is pre-stored in the verification data generating module 125 of the client device 120, and a corresponding set of response values may be calculated according to the challenge value generated by the security authentication module 114. In practice, the service provider can separately distribute different challenge response algorithms for different users, and store them in the verification data generation module of the user device of the individual user, so that the user devices of different users are based on the same The response value calculated by the challenge value will be different to enhance the reliability of network authentication.

In process 210, the secure authentication module 114 communicates the generated challenge value to the service processing module 112.

In process 212, the service processing module 112 uses the service processing module 112 and browses The data connection between the modules 121 transmits the service content information, the challenge value, and the notification information prompting the user to perform the active network identity verification program to the browser module 121 via the Internet 130.

In the process 214, the browser module 121 displays the received service content information, challenge value, and notification information on the display device 122. The foregoing requesting the notification information of the active network identity verification program will remind the user that the verification startup module 127 in the client device 120 should be executed to start and complete the active network identity verification program, so that the service provider can be enabled. System 110 completes the aforementioned service requirements.

As described above, the verification activation module 127 in this embodiment is a functional module implemented by a computer program and provided by the service provider to the user for storage on the client device 120. When the verification initiation module 127 receives the execution command of the user, the process 216 is performed to activate the verification data generation module 125 to generate security verification data related to the service content information and the response value corresponding to the challenge value. The operation of the process 216 will be further described below in conjunction with FIG.

4 is a simplified flowchart of a first embodiment in which the client device 120 generates security verification data. When the verification initiation module 127 receives the execution command of the user, the verification initiation module 127 performs a process 402 to prompt the user to input the service content information and the challenge value displayed on the display device 122 into a predetermined interface of the client device 120. . For example, it is input by an input screen generated by the voice receiving module or the verification starting module 127.

In flow 404, the verification initiation module 127 receives the data entered by the user.

Next, the verification startup module 127 performs a flow 406 to transfer the data input by the user to the verification data generation module 125.

In the process 408, the verification data generation module 125 generates a corresponding response value based on the challenge value input by the user using the built-in challenge response algorithm.

In the process 410, the verification data generation module 125 uses the stored key to encrypt the response value and the service content information input by the user to generate a security verification data.

Next, the verification data generation module 125 or the verification initiation module 127 performs the process 218 of FIG. 2, and transmits the security verification data to the service provider through the second transmission pipeline in the form of single or multiple short messages by using the short message module 126. System 110. The second transmission pipeline referred to herein and the first transmission pipeline are data communication pipelines using different communication platforms or different communication protocols. In this embodiment, the second transmission pipeline is a telecommunication network 140 including one or more base stations 142 and a short message server 144, and the short message module 126 will send the security verification data to the short message in the process 218. The form is transmitted over the telecommunications network 140 to the subscriber receiving telephone number designated by the service provider.

In order to prevent the user from being spoofed by a malicious person and mistakenly transmitting the security verification data to the telephone number designated by the malicious person, the service provider may pre-store the designated telephone number in the verification data generation module 125 and hide it. The encryption or the encryption is performed so that the user cannot change the content of the specified telephone number, and only the verification data generation module 125 or the verification activation module 127 can access the designated telephone number. At this time, the telephone number of the receiving end of the short message in the process 218 is directly specified by the verification data generating module 125 or the verification starting module 127 to the short message module 126, and is not allowed to be set or changed by the user.

In the process 220, the short message server 144 in the telecommunication network 140 forwards the short message sent by the short message module 126 to the destination corresponding to the phone number of the receiving end of the message, that is, The security authentication module 114 in this embodiment. The short message server 144 may be a short message service center (SMSC) or a multimedia message forwarding device set up by a carrier or a short message service provider, depending on the format of the short message used by the client device 120 to transmit the security verification data. Server (MMSserver, MMSC), or a device with similar functions. Server, MMSC), or a device with similar functions.

When the security authentication module 114 receives the short message sent by the short message module 126, the processes 302 and 304 in FIG. 3 are performed to verify the security verification data in the short message and the source telephone number of the short message. In this embodiment, the security authentication module 114 decrypts the security verification data by using a key corresponding to the key stored in the verification data generation module 125, and verifies whether the decrypted security verification data contains the correct service. The content information, and the response value corresponding to the challenge value transmitted to the client device 120. The security authentication module 114 also checks if the source phone number of the newsletter is a phone number that the user of the client device 120 has previously registered with the service provider. If the security verification data includes the correct response value and the service content information, and the source phone number of the short message is a pre-agreed number, the security authentication module 114 performs the process 306. On the other hand, if the correct verification value or service content information is not included in the security verification data, or the source telephone number of the short message is not a pre-agreed number, the security authentication module 114 determines that the network identity verification fails and proceeds to process 316.

In the process 306, the security authentication module 114 checks whether the security verification data is received within a predetermined time limit after the service processing module 112 transmits the challenge value to the client device 120. If the security verification data is received within the predetermined time limit, the security authentication module 114 determines that the network identity verification is successful and proceeds to process 308; otherwise, the security authentication module 114 determines that the network identity verification failed and proceeds to flow 316.

In flow 308, the secure authentication module 114 sends a notification to the service processing module 112 that the service request is allowed.

When the service processing module 112 receives the notification of the allowed service request from the secure authentication module 114, the service processing module 112 performs a process 310 to confirm the service request transmitted by the browser module 121 over the Internet 130 in the process 204. .

Next, the service processing module 112 performs the process 312 to generate related service result information, for example, a transaction completion notification, a system login success notification, and the like, and transmits the same to the browser module 121 of the client device 120.

In the process 314, the browser module 121 displays the received service result information on the display device 122 for the user to know.

In flow 316, the secure authentication module 114 sends a notification of the denial of service request to the service processing module 112. When the service processing module 112 receives the notification of the denial of service request sent by the security authentication module 114, the service processing module 112 directly performs the process 312 to generate related service result information that the service request is not allowed, and transmits the information to the client. Browser module 121 of device 120.

In the foregoing first embodiment, when the client device 120 logs in to the service provider system 110 via the Internet 130 through the first heavy network identity verification program, the service provider system 110 is required to provide a certain network service. The service provider system 110 generates a challenge value according to the challenge response algorithm corresponding to the client device 120, and transmits the challenge value to the client device 120 through the Internet 130. The user must operate the client device 120 to generate a set of security verification data related to the challenge value by using the verification data generation module 125, and pass the security verification data in a short message form through the telecommunication network 140 different from the Internet 130. Passed to the service provider system 110 to complete Be the second most important network identity verification program. If any third party does not know the challenge response algorithm used by the verification data generation module 125, even if the challenge value transmitted by the service provider system 110 to the client device 120 is obtained, a valid response value cannot be calculated.

Since the verification initiation module 127 in the client device 120 must cooperate with the dedicated verification data generation module 125 to generate security verification data, and the telecommunication network 140 is less susceptible to man-in-the-middle attacks than the Internet 130, the service provider is provided. The system 110 can verify the user identity of the client device 120 correctly by verifying the security verification data received via the telecommunication network 140 according to the foregoing method, thereby enhancing the security of the system.

FIG. 5 is a simplified partial flowchart of a second embodiment of a multi-channel active network identity verification method according to the present invention. The difference from the foregoing first embodiment is that when the service processing module 112 notifies the security authentication module 114 of the service request sent by the browser module 121 in the process 206, the security authentication module 114 performs a process 508 to generate a set of dynamics. One time password (OTP). In practice, the security authentication module 114 can calculate a set of dynamic passwords that are specific to the service request but are not related to the service request or service content information according to a special algorithm. Alternatively, the security authentication module 114 may calculate the service request specific to the service request according to the service request sent by the browser module 121 or the service content information generated by the service processing module 112, and the service request or service content information. A related set of dynamic passwords.

Next, the security authentication module 114 proceeds to process 510 to transmit the generated dynamic password to the service processing module 112.

In process 512, the service processing module 112 uses the service processing module 112 and browses The data connection between the modules 121 transmits the service content information, the dynamic password, and the notification information prompting the user to perform the active network identity verification program to the browser module 121 via the Internet 130.

In the process 514, the browser module 121 displays the received service content information, dynamic password, and notification information on the display device 122. The foregoing requesting the notification information of the active network identity verification program will remind the user that the verification startup module 127 in the client device 120 should be executed to start and complete the active network identity verification program, so that the service provider can be enabled. System 110 completes the aforementioned service requirements.

The verification activation module 127 in this embodiment is a functional module implemented by a computer program and provided by the service provider to the user for storage on the client device 120. When the verification initiation module 127 receives the execution command of the user, the process 516 is performed to activate the verification data generation module 125 to generate security verification data related to the service content information and the dynamic password. The manner in which the process 516 operates will be further described below in conjunction with FIG.

FIG. 6 is a simplified flowchart of a second embodiment in which the client device 120 generates security verification data. When the verification startup module 127 receives the execution command of the user, the verification startup module 127 performs a process 602 to prompt the user to input the service content information and the dynamic password displayed on the display device 122 into a predetermined interface of the client device 120. For example, an input operation is performed by an input screen generated by the voice receiving module or the verification activation module 127.

In flow 604, the verification initiation module 127 receives the data entered by the user.

Next, the verification startup module 127 performs a flow 606 to transfer the data input by the user to the verification data generation module 125.

In the process 610, the verification data generation module 125 uses the stored key to encrypt the service content information and the dynamic password input by the user to generate the security verification data.

Next, the verification data generation module 125 or the verification initiation module 127 performs the flow 218 of FIG.

Flows 218 and 220 of FIG. 5 operate in the same manner as flow 218 and 220 of FIG. 1, so that the foregoing description of flows 218 and 220 of FIG. 1 also applies to the embodiment of FIG. 5, for the sake of brevity, The description will not be repeated here.

When the security authentication module 114 receives the short message sent by the short message module 126 through the telecommunication network 140, the processes 302 and 304 in FIG. 3 are performed to verify the security verification data in the short message and the source telephone number of the short message. In this embodiment, the security authentication module 114 decrypts the security verification data using a key corresponding to the key stored in the verification data generation module 125. The security authentication module 114 verifies whether the decrypted security verification data contains the correct service content information and the dynamic password, and checks whether the source telephone number of the short message is the telephone number registered by the user of the user equipment 120 to the service provider in advance. If the security verification data contains the correct dynamic password and service content information, and the source telephone number of the short message is a pre-agreed number, the security authentication module 114 performs the process 306. On the other hand, if the security verification data does not contain the correct dynamic password or service content information, or the source phone number of the newsletter is not a pre-agreed number, the security authentication module 114 determines that the network identity verification fails and proceeds to process 316.

The operation modes of the security authentication module 114, the service processing module 112, and the client device 120 in the subsequent processes in the subsequent processes 306, 308, 310, 312, 314, and 316 are the same as in the foregoing embodiment, and are simple. See, the description is not repeated here.

In the foregoing second embodiment, when the client device 120 logs in to the service provider system 110 via the Internet 130 through the first heavy network identity verification program, the service provider system 110 is required to provide a certain network service. The service provider system 110 generates a dynamic password according to a special algorithm and transmits the dynamic password to the client device 120 via the Internet 130. The user must operate the client device 120, generate a set of security verification data related to the dynamic password by using the verification data generation module 125, and send the security verification data in a short message form through the telecommunication network 140 different from the Internet 130. Passed to the service provider system 110 to complete the second network identity verification process. Since the verification initiation module 127 in the client device 120 must cooperate with the dedicated verification data generation module 125 to generate security verification data, and the telecommunication network 140 is less susceptible to man-in-the-middle attacks than the Internet 130, the service provider is provided. As long as the system 110 verifies the security verification data received via the telecommunication network 140 according to the foregoing method, the user identity of the client device 120 can be correctly verified, and the security of the system is further enhanced.

In the foregoing different embodiments, the verification data generation module 125 encrypts the data to be transmitted to the security authentication module 114 by using the stored key, so that the transmission process of the security verification data in the telecommunication network 140 can be avoided by the carrier. Unscrupulous people intercepted and tampered. The use of keys to generate secure verification data can improve the security and non-repudiation of data for security verification data. However, the use of a key to encrypt is merely an embodiment and is not intended to limit the actual implementation of the invention. For example, the verification data generation module 125 may also use other encryption algorithms that have been agreed with the security authentication module 114 to encrypt the data to be transmitted to the security authentication module 114, and when the security authentication module 114 receives the security verification data. , the corresponding decryption algorithm can be used for decryption to verify the content of the security verification data.

In addition, the security verification data generated by the verification data generating module 125 may be a text or a digital aspect, or may be an image or a sound. For example, the verification data generation module 125 can convert the encrypted data into one or more images encoded by a two-dimensional barcode or other image code as the security verification data, and then use the short message module 126 to use the one or more images. The designated short message receiving telephone number is transmitted over the telecommunications network 140 in the form of one or more short messages (eg, a multimedia message). When the security authentication module 114 receives the foregoing image, the image may be restored to the encrypted data by using the corresponding decoding algorithm, and then decrypted by the corresponding decryption algorithm to verify the content of the security verification data.

For another example, the verification data generating module 125 may encode the encrypted data into one or more audio files as the security verification data, and then use the short message module 126 to record the one or more audio files in the form of one or more short messages. (e.g., a multimedia message) is transmitted over the telecommunications network 140 to a designated short message receiving telephone number. When the security authentication module 114 receives the audio file, the audio file may be restored to the encrypted data by using the corresponding decoding algorithm, and then decrypted by the corresponding decryption algorithm to verify the content of the security verification data.

In the foregoing description, the verification activation module 127 starts execution upon receiving an execution command from the user. In practice, the automatic call verification initiation module 127 can also perform the operations of the foregoing process 216 or 516 when the browser module 121 receives the service content information transmitted by the service processing module 112.

In an embodiment where the verification data generation module 125 is a thin circuit board attached to the identity identification module 124, the verification data generation module 125 may, in the process 410 or 610, the identification code of the verification data generation module 125 and the aforementioned response. The value, dynamic password, and/or service content information are encrypted together to generate a secure verification material. In this case Next, the security authentication module 114 verifies in the processes 302 and 304 of FIG. 3 whether the decrypted security verification data includes the correct identification code of the verification data generation module 125. If the correct authentication code of the verification data generation module 125 is not included in the security verification data, the security authentication module 114 performs a process 316 to send a notification of the denial of service request to the service processing module 112.

In addition, in order to increase the flexibility of the verification data generation module 125 that the service provider dispenses with the user's other identity recognition module, the service provider may also agree with the user in advance to replace the identification code of the verification data generation module 125. The telephone number of the identity recognition module 124 serves as a basis for judging the source identity of the security verification data. Therefore, in some embodiments in which the verification data generation module 125 adds the identification code of the verification data generation module 125 to the security verification data, the security authentication module 114 may omit the source phone of the verification verification message in the flows 302 and 304 of FIG. Number program.

In addition, in the process 410 or 610, the verification data generating module 125 can also set the geographical location information (such as GPS coordinates, etc.) of the location where the client device 120 is located, and the foregoing response value, dynamic password, service content information, and/or Or the identification code of the verification data generation module 125 is encrypted together to generate security verification data. In this case, the security authentication module 114 also verifies, in the processes 302 and 304 of FIG. 3, whether the geographical location information contained in the decrypted security verification data meets a predetermined condition, such as whether the user matches the user in advance to the service provider. The range of possible activity areas registered. If the geographical location information included in the security verification data does not meet the predetermined condition, the security authentication module 114 performs a process 316 to send a notification of the denial of service request to the service processing module 112.

In some applications, the verification launch module 127 may only prompt in the flow 402 of FIG. The user inputs the challenge value displayed on the display device 122 to a predetermined interface of the client device 120. At this time, the verification data generation module 125 does not add the service content information transmitted from the service provider system 110 to the security verification data in the process 410, and the security authentication module 114 does not in the processes 302 and 304 of FIG. It will check if there is correct service content information in the security verification data. Similarly, the verification activation module 127 may also prompt the user to input the dynamic password displayed on the display device 122 into a predetermined interface of the client device 120 in the flow 602 of FIG. At this time, the verification data generation module 125 does not add the service content information transmitted from the service provider system 110 to the security verification data in the process 610, and the security authentication module 114 does not in the processes 302 and 304 of FIG. It will check if there is correct service content information in the security verification data.

In the multi-channel active network identity verification system 100 of FIG. 1, the different functional blocks in the client device 120 are located in a single hardware device, but this is only an embodiment used for convenience of explanation. In practice, different functional blocks in the client device 120 can also be located in different hardware devices.

For example, FIG. 7 is a simplified functional block diagram of a multi-channel active network identity verification system 700 according to a second embodiment of the present invention. In the multi-channel active network identity verification system 700, the browser module 121 and the display device 122 are located in the same client device 720 (eg, a computer), and the storage device 123, the identity recognition module 124, and the verification data generation module 125 The SMS module 126 and the verification activation module 127 are located in another client device 722 (eg, a smart phone).

It can be seen from the foregoing description that the service content information, the challenge value, and/or the dynamic password transmitted by the service provider system 110 through the Internet 130 are not simply transmitted back to the service through the telecommunication network 140 by using any user equipment. Providing the end system 110, Verify the program through the network identity. In the multi-channel active network identity verification system 100 or 700 proposed by the present invention, the verification startup module 127 must be stored in the client device 120 (or 722) and used together with the user-specific verification data generation module 125. The correct security verification data related to the service request can be generated and transmitted to the service provider system 110 through the correct pipeline to complete the network identity verification. Even if the client device 120 is implanted with a Trojan horse program, a keyboard side program, or a screen recording program, or the user is deceived by phishing, or the data connection between the client device 120 or 720 and the service processing module 112 The line is attacked by a man-in-the-middle, causing the service content information, the challenge value, and/or the dynamic password generated by the service provider system 110 to be intercepted and known by the malicious person, but in the case where the malicious person lacks the verification data generation module 125, The correct security verification data cannot be generated, so the network identity verification program of the security authentication module 114 cannot be passed. Therefore, the service request issued by the malicious person to impersonate the user identity is naturally not allowed by the service provider system 110.

Moreover, even if a malicious person spoofs the user's identity to the telecommunication company to report that the mobile phone SIM card is lost, and the SIM card that defrauds the same phone number from the telecommunication company, the exclusive authentication data generation module 125 is distributed to the real user in the absence of the service provider. In this case, the malicious person still cannot generate the correct security verification data that can pass the network identity verification program of the security authentication module 114.

In addition, since the challenge value or the dynamic password transmitted by the service provider system 110 to the client device 120 is a one-time data, the verification data generation module 125 performs security verification according to the dynamic password or the response value corresponding to the challenge value. Information will naturally have the characteristics of one-off materials. Therefore, even if a malicious person can intercept the security verification data transmitted in the telecommunication network 140, it cannot use the resend attack to pass The network identity verification procedure of the security authentication module 114.

It can be clearly seen from the above description that the architecture and related computer program products of the multi-channel active network identity verification system proposed in the present invention can not only improve the non-repudiation and security of the security verification data issued by the client device, but also It can effectively overcome the impact of various common network attack modes such as Trojan horse program, keyboard side program, screen recording program, phishing, man-in-the-middle attack, and resend attack on network identity verification, and greatly enhance network identity. The correctness and reliability of the verification, in order to achieve a higher level of network security control purposes.

The process characteristics in the request items of some computer program products in the scope of the subsequent patent application are consistent with the contents of some of the operational processes in the foregoing flow chart. Therefore, the request for these computer program products in the scope of the patent application should be understood as the functional module architecture that implements the aforementioned solution mainly through the computer program described in the specification, and should not be construed as an entity that mainly implements the solution by hardware. Device.

The above are only the preferred embodiments of the present invention, and all changes and modifications made to the scope of the present invention should be within the scope of the present invention.

100‧‧‧Multi-channel active network identity verification system

110‧‧‧Service provider system

112‧‧‧Service Processing Module

114‧‧‧Safety Certification Module

120‧‧‧Customer device

121‧‧‧Browser module

122‧‧‧ display device

123‧‧‧Storage device

124‧‧‧ Identity Identification Module

125‧‧‧Verification data generation module

126‧‧‧SMS module

127‧‧‧Verification Startup Module

Claims (15)

A multi-channel active network identity verification system includes: a browser module for transmitting a service request through a first transmission pipeline; a security authentication module for generating a challenge value; a service processing module, Generating service content information corresponding to the service request, and using a target connection between the service processing module and the browser module, transmitting the service content information and the challenge value to the browser through the first transmission pipeline a display device, configured to display the service content information and the challenge value; a verification activation module, configured to prompt the user to input the service content information and the challenge value displayed by the display device into a predetermined interface; a data generating module, configured to generate a response value corresponding to the challenge value received by the predetermined interface according to a challenge response algorithm, and encrypt the service content information and the response value by using a key to generate a security verification And a short message module, configured to transmit the security verification data to the short message through a second transmission pipeline a full authentication module, wherein the security authentication module verifies the security verification data and a source phone number when the security verification data is received, and if the security verification data does not include the service content information and the response value, or the source phone number If the number is not a pre-agreed number, the security authentication module rejects the service request sent by the browser module through the first transmission pipeline. A computer program product that allows a service provider system to perform a multi-channel network identity verification operation, the multi-channel network identity verification operation comprising: Generating a challenge value according to a challenge response algorithm; using a service processing module to use a target connection between the service processing module and a client device, and transmitting the challenge value to the client device through a first transmission pipeline; receiving Passing the security verification data transmitted through a second transmission pipeline; verifying the security verification data; and rejecting the user equipment through the first if the security verification data does not include a response value corresponding to the challenge value A service request from the transmission pipeline. The computer program product of claim 2, wherein the multi-channel network identity verification operation further comprises: if the security verification data does not include the service processing module being transmitted to the client device through the first transmission pipeline The service content information is rejected by the service request. The computer program product of claim 2 or 3, wherein the multi-channel network identity verification operation further comprises: rejecting the service if the security verification data is not received within a predetermined time limit after the challenge value is generated Claim. The computer program product of claim 4, wherein the multi-channel network identity verification operation further comprises: verifying a source phone number of the security verification data; and rejecting the source phone number if the source phone number is not a pre-agreed number Service requirements. The computer program product of claim 4, wherein the multi-channel network identity verification operation further comprises: rejecting the service request if the security verification data does not include an identification code of a thin circuit board. The computer program product of claim 4, wherein the multi-channel network identity verification operation further comprises: If the geographical location information contained in the security verification material does not meet a predetermined condition, the service request is rejected. The computer program product of claim 4, wherein the process of verifying the security verification data further comprises: decrypting the security verification data by using a key. A computer program product, which allows a client device having a verification data generation module to perform an active network identity verification operation, the active network identity verification operation comprising: prompting a user to pass a service provider system through a first transmission Passing a challenge value from the pipeline, inputting a predetermined interface of the client device; receiving the challenge value by using the predetermined interface; and using the verification data generation module to generate a response value corresponding to the challenge value according to a challenge response algorithm And using the verification data generation module to generate a security verification data related to the response value; and transmitting the security verification data to a designated telephone number through a second transmission pipeline in the form of one or more short messages. The computer program product of claim 9, further comprising: prompting the user to input the service content information transmitted by the service provider system through the first transmission pipeline into the predetermined interface; wherein the process of generating the security verification data includes There is: using the verification data generation module to encrypt the response value and the service content information input by the user to generate the security verification data. The computer program product of claim 10, wherein the process for generating the security verification data comprises: The verification data generation module encrypts the response value, the service content information input by the user, and the identification code of the verification data generation module to generate the security verification data. The computer program product of claim 10, wherein the process of generating the security verification data includes: using the verification data generation module to encrypt the response value, the service content information input by the user, and a geographic location information, Generate this security verification data. The computer program product of claim 10, wherein the process of generating the security verification data comprises: using the verification data generation module to encrypt the response value and the service content information input by the user by using a key to generate the Security verification data. The computer program product of claim 10, wherein the process of transmitting the security verification data to the designated telephone number comprises: converting the encrypted data into one or more images or audio files as the security verification data . The computer program product of claim 10, wherein the designated telephone number is directly specified by the verification data generation module, and the user cannot change.