TWI659374B - Mobile internet banking transaction authentication method and system - Google Patents

Abstract

In a mobile online banking transaction authentication method and system, an authentication server stores a hash value and an identification code generated according to transaction data from an online banking server, and the hash value and the identification code are transmitted to an online banking server through an online banking server. The mobile device, so that the mobile device transmits the hash value, the identification code, and a credential data read from an electronic card through a card reader to the authentication server. When the authentication server determines that the received hash value and the identification code match the stored hash value and the identification code, it transmits the transaction data to the mobile device, and upon receiving the data from the mobile device is correct When notifying, return a signature data packaged with the hash value, the identification code and the certificate data, and the verification data to the online banking server.

Description

Mobile internet banking transaction authentication method and system

The invention relates to a mobile online banking transaction service, in particular to a mobile online banking transaction authentication method and system.

Currently, when using a desktop computer for an online banking transaction operation, it is necessary to communicate with a card reader connected to the computer and inserted with a financial card, for example, through components pre-installed on the computer to complete authentication and authorization. Transaction signing. However, with the increasing demand for mobile commerce to perform mobile commerce today, it is necessary to provide mobile authentication and authorization functions and related interfaces for mobile devices, so that users can use mobile devices in combination with chip financial cards or XML (Extensible Markup Language, Extensible Markup Language) An electronic card with a signature card to perform financial service confirmation applications such as unconventional transfers or large transfers.

In order to meet the needs of the above-mentioned mobile commerce, the existing mobile online banking transaction authentication technology proposes to use a specific application and perform a transaction verification or certificate signing operation related to a financial transaction through a mobile card reader dedicated to a mobile device. . However, this particular application needs to transmit the original text of the transaction with a relatively large amount of data when performing transaction verification or certificate signing, resulting in the mobile device having to provide a larger record Memory storage and increased risk of reduced mobile device performance.

Therefore, there is still much room for improvement in the existing mobile online banking transaction authentication technology.

Therefore, an object of the present invention is to provide a mobile internet banking transaction authentication method, which can overcome the shortcomings of conventional techniques.

Therefore, the mobile internet banking transaction authentication method provided by the present invention includes a mobile device connected with a card reader and a mobile security control application program installed, inserted in the card reader, and stored corresponding to a specific customer. The electronic data of the certificate data, an online banking server and an authentication server. The mobile online banking transaction authentication method includes the following steps: (A) When the online banking server receives a transaction request from the mobile device that is related to a specific account and includes transaction data, a The authentication request of the transaction information is transmitted to the authentication server; (B) When the authentication server receives the authentication request from the online banking server, a predetermined hash algorithm is used to generate a hash based on the transaction data. Value and an identification code that uniquely corresponds to the hash value, and stores the hash value and the identification code, and transmits the hash value and the identification code to the online banking server; (C) through the online banking server, When receiving the hash value and the identification code from the authentication server, the received hash value and the identification code are transmitted to The mobile device; (D) when the mobile device receives the hash value and the identification code from the online banking server end, it starts to execute the mobile security control application program to establish a connection with the authentication server end and make the The card reader reads the credential data stored in the electronic card, and transmits the received hash value and the identification code and the credential data from the card reader to the authentication server; (E) by The authentication server, after receiving the hash value, the identification code, and the voucher data from the mobile device, determines that the received hash value and the identification code match the stored hash value and the identification code, respectively. When the transaction data is transmitted to the mobile device; and (F) by the authentication server, when receiving a notification from the mobile device indicating that the transaction data is correct, the received hash value is received , The identification code and the voucher information are packaged and signed to obtain the signing information, and a successful authentication reply corresponding to the authentication request and containing the signing data and the voucher information is sent to the online banking server

Therefore, another object of the present invention is to provide a mobile online banking transaction authentication system, which can overcome the shortcomings of conventional techniques.

Therefore, a mobile online banking transaction authentication system provided by the present invention includes a mobile device, a card reader, an online banking server and an authentication server. The mobile device is installed with a mobile security control application, and the card reader is electrically connected to the mobile device and plugged in. An electronic card stores voucher data corresponding to a specific customer, and the authentication server is connected to the online banking server.

When the online banking server receives a transaction request from the mobile device that is related to a specific account's financial transaction and includes transaction data, the online banking server transmits an authentication request containing the transaction data to the authentication server.

When the authentication server receives the authentication request from the online banking server, the authentication server uses a predetermined hash algorithm to generate a hash value and an identification code unique to the hash value according to the transaction data, and stores the hash value. The hash value and the identification code are transmitted to the online banking server.

When the online banking server receives the hash value and the identification code from the authentication server, the online banking server sends the received hash value and the identification code to the mobile device.

When the mobile device receives the hash value and the identification code from the online banking server, it starts executing the mobile security control application program to establish a connection with the authentication server and cause the card reader to read the electronic card storage The credential data, and send the received hash value and the identification code and the credential data from the card reader to the authentication server.

When the authentication server receives the hash value, the identification code, and the credential data from the mobile device, and determines that the received hash value and the identification code match the stored hash value and the identification code, respectively , The authentication server sends the request Easy data to the mobile device.

When the authentication server receives a notification from the mobile device indicating that the transaction information is correct, the authentication server packages and signs the hash value, the identification code, and the credential data to obtain a signature And send a successful authentication reply corresponding to the authentication request, including the signature data and the certificate data, to the online banking server.

The effect of the present invention is that the authentication server first uses the hash value generated based on the transaction data from the online banking server to authenticate the mobile security control application installed on the mobile device as true before transmitting the transaction data to The mobile device is used by the trader to confirm its correctness, and after the two-way authentication is achieved, the signature data and the voucher data packaged with the hash value, the identification code, and the voucher data are transmitted to the online banking server. Therefore, under the use of the existing system architecture, not only the security of the credential data stored in the electronic card can be ensured, but also the amount of data transmitted during authentication can be greatly reduced.

100‧‧‧Mobile online banking transaction authentication system

1‧‧‧ mobile device

APP‧‧‧ Mobile Security Control App

2‧‧‧Online Banking Server

3‧‧‧Certified server

4‧‧‧ card reader

5‧‧‧electronic card

6‧‧‧Verification server

200‧‧‧Transaction execution server

S21-S40‧‧‧step

Other features and effects of the present invention will be clearly presented in the embodiment with reference to the drawings, wherein: FIG. 1 is a block diagram illustrating an embodiment of the mobile online banking transaction authentication system of the present invention; and FIGS. 2 and FIG. 3 is a flowchart illustrating how the embodiment implements a mobile network Silver transaction certification process.

Referring to FIG. 1, an embodiment of the mobile online banking transaction authentication system 100 of the present invention can be applied to a banking institution, and for a customer who wants to conduct financial transactions related to a specific account via online banking, provide the relevant financial information. Authentication services for transactions. The mobile online banking transaction authentication system 100 includes a mobile device 1, an online banking server 2, an authentication server 3, a card reader 4, an electronic card 5, and a verification server 6.

In this embodiment, the mobile device 1 is, for example, a smart phone or a tablet computer held by the customer, and a mobile security control application APP is installed in advance. The mobile device 1 can establish a connection with the online banking server 2 and the authentication server 3 through a wireless communication network (not shown).

In use, the card reader 4 is electrically connected to the mobile device 1 and the electronic card 5 is inserted. The electronic card 5 stores voucher data corresponding to the specific customer.

The online banking server 2 provides an online banking webpage, and can be connected to the authentication server 3, the verification server 6, and a transaction execution server 200 for performing transactions via, for example, the Internet (not shown).

The verification server 6 stores a plurality of reference certificate data corresponding to a plurality of different customers.

Hereinafter, how the mobile online banking transaction authentication system 100 executes a mobile online banking transaction authentication procedure for the financial transaction will be described in detail with reference to FIGS. 1 and 2. The smart bank counter transaction service program includes the following steps.

First, in step S21, when the mobile device 1 is linked to the online banking web page provided by the online banking server 2 and after successfully verifying the identity of the user to log in to the specific account, the mobile device 1 generates a correlation through human operation. A transaction request that includes transaction information in the financial transaction, and sends the transaction request to the online banking server 2. In this embodiment, the financial transaction is, for example, a transfer transaction, but is not limited thereto, and the transaction information is, for example, a transaction date including at least the transaction date, the transfer amount, the account number of the specific account (that is, the transfer account number), and the transfer Account transaction messages, but not limited to this.

Then, in step S22, the online banking server 2 stores the transaction data when receiving the transaction request from the mobile device 1, and transmits an authentication request including the transaction data to the authentication server 3.

Next, in step S23, when the authentication server 3 receives the authentication request from the online banking server 2, it uses a predetermined hash algorithm to generate a hash value and a unique value corresponding to the hash value according to the transaction data. And store the hash value and the identification code, and transmit the hash value and the identification code to the online banking server 2.

Next, in step S24, when the online banking server 2 receives the hash value and the identification code from the authentication server 3, it transmits the received hash value and the identification code to the mobile device 1, And after that, a poll corresponding to the authentication request is continuously transmitted to the authentication server 3.

Next, in step S25, when the mobile device 1 receives the hash value and the identification code from the online banking server 2, it starts to execute the mobile security control application APP in order to establish a connection with the authentication server 3. And cause the card reader 4 to read the credential data stored in the electronic card 5, and transmit the received hash value and the identification code and the credential data from the card reader 4 to the authentication server 3.

Next, in step S26, when the authentication server 3 receives the hash value, the identification code, and the credential data from the mobile device 1, it is determined whether the received hash value and the identification code match the steps, respectively. The hash value and the identification code stored in S23 are used to authenticate whether the mobile security control application APP executed by the mobile device 1 is true (that is, has not been tampered with). If the determination result is affirmative (that is, the mobile security control application APP is proved to be true), the flow proceeds to step S28, otherwise, the authentication server 3 will indicate (the mobile security control application APP) that the authentication fails An error message is sent to the online banking server 2 (step S27).

In step S28, when the mobile security control application APP is authenticated as being true by the authentication server 3, the authentication server 3 transmits the transaction data stored in step S22 to the mobile device 1.

Then, in step S29, when the mobile device 1 receives the transaction data from the authentication server 3, the mobile device 1 displays the transaction data through execution of the mobile security control application APP. In this case, the customer can display the Set the transaction data to 1 to confirm its correctness. After the client confirms that the transaction information is correct, the mobile device 1 generates a notification indicating that the transaction information is correct through manual operation, and transmits the notification to the authentication server. Thus, the two-way authentication between the authentication server 3 and the mobile security control application APP executed by the mobile device 1 is completed.

Then, in step S30, when receiving the notification from the mobile device 1, the authentication server 3 packages and seals the received hash value, the identification code, and the credential data to obtain signature data. In this embodiment, the signature data may be a signature value, for example.

Then, when the authentication server 3 receives the poll from the online banking server 2 recently, in step S31, the authentication server 3 responds to the poll and will correspond to the authentication request and include the signature The successful authentication reply of the data and the certificate data is transmitted to the online banking server 2. Then, the online banking server 2 retrieves the signature data and the certificate data. It is worth noting that during the two-way authentication performed by the authentication server 3 and the mobile security control application APP, the transmission of the transaction data is greatly reduced.

Next, in step S32, when the online banking server 2 receives the successful authentication reply from the authentication server, it generates, for the financial transaction, a message including the signature information and the voucher information received, and the transaction. Request a verification request for the transaction data included, and send the verification request to the verification server 6.

Then, in step S33, the verification server 6 receives When the verification request from the online banking server 2 is made, it is determined whether the voucher data matches one of the reference voucher data stored. If the determination result is positive, the flow proceeds to step S35. Conversely, if the verification server 6 determines that the stored reference voucher data does not contain any reference voucher data that matches the voucher data, that is, when the voucher data stored in the electronic card 5 has been When it is damaged or expired, the verification server 6 sends an authentication failure error message to the online banking server 2 (step S34).

In step S35, when the verification server 6 determines that the voucher data matches one of the stored reference voucher data, it uses the predetermined hash algorithm to obtain a hash value based on the transaction data. .

In step S36, the verification server 6 determines whether the hash value obtained in step S35 matches the hash value included in the signature result, thereby determining whether the signature data is successfully verified. If the determination is affirmative, that is, the transaction data received by the online banking server 2 matches the transaction data confirmed by the client, the flow proceeds to step S37, otherwise, the flow returns to step S34.

In step S37, when the verification server 6 determines that the signature data is successfully verified, it sends a verification success response in response to the verification request to the online banking server 2.

Next, in step S38, when the online banking server 2 receives the verification success response from the verification server 6, the transaction data is transmitted to the transaction execution server. Line servo end 200. Then, the transaction execution server 200 executes the financial transaction according to the transaction data to generate a transaction result indicating the completion of the financial transaction, and transmits the transaction result to the online banking server 2.

Finally, the online banking server 2 receives the transaction result from the transaction execution server 200 and transmits the transaction result to the mobile device 1 (step S39), so that the mobile device 1 receives the transaction result from the online banking server When the transaction result of 2 is displayed, the transaction result is displayed for the customer to rely on (step S40). At this point, the mobile internet banking transaction certification process has been completed.

In summary, when the authentication server 3 first uses the hash value generated according to the transaction data from the online banking server 2 to authenticate the mobile security control application APP installed on the mobile device 1 is true, Only then send the transaction data to the mobile device for the customer to confirm its correctness. After the two-way authentication is reached, the signature data and the voucher data will be packaged with the hash value, the identification code and the voucher data. And sent to the online banking server. Then, after the verification server 6 confirms again that the transaction data held by the online banking server 2 matches the transaction data confirmed by the client, the online banking server 2 transmits the transaction data to the transaction execution server Terminal 200 in order to actually execute the financial transaction. Therefore, under the use of the existing system architecture, not only the security of the credential data stored in the electronic card can be ensured, but also the transaction data can be prevented from being tampered with, thereby improving the security of mobile online banking transactions. In addition, since it is not necessary to transmit a large amount of original text of the transaction during the certification period as required by the existing technology, Can greatly reduce the amount of data transmitted, so it can indeed achieve the purpose of cost invention.

However, the above are only examples of the present invention. When the scope of implementation of the present invention cannot be limited by this, any simple equivalent changes and modifications made according to the scope of the patent application and the contents of the patent specification of the present invention are still Within the scope of the invention patent.

Claims (12)

A mobile online banking transaction authentication method includes a mobile device connected to a card reader and a mobile security control application installed, a card inserted in the card reader to contact the card reader by contact and electrically stored corresponding to a The electronic card of a specific customer's credential data, an online banking server and an authentication server are executed. The mobile online banking transaction authentication method includes the following steps: (A) The online banking server receives a message from the mobile device and When a financial transaction related to a specific account includes a transaction request including transaction information, an authentication request including the transaction information is transmitted to the authentication server; (B) the authentication server receives a request from the online banking server When the client requests the authentication, a predetermined hash algorithm is used to generate a hash value and an identification code unique to the hash value according to the transaction data, and store the hash value and the identification code, and store the hash value and the identification code. The identification code is transmitted to the online banking server; (C) When the online banking server receives the hash value and the identification code from the authentication server, The received hash value and the identification code are transmitted to the mobile device; (D) by the mobile device, when the hash value and the identification code from the online banking server end are received, the mobile security control application program is executed, To establish a connection with the authentication server and cause the card reader to read the credential data stored in the electronic card, and transmit the received hash value with the identification code and the credential data from the card reader To the authentication server; (E) after receiving the hash value, the identification code, and the credential data from the mobile device through the authentication server, and determining that the received hash value and the identification code respectively match When the hash value and the identification code are stored, the transaction data is transmitted to the mobile device; and (F) the authentication server receives a message from the mobile device and indicates that the transaction data is correct When the notification is received, the received hash value, the identification code, and the voucher information are packaged and signed to obtain the seal information, and a response corresponding to the authentication request that includes the seal information and the voucher information Reactive authentication reply transmitted to the online banking server end. According to the mobile online banking transaction authentication method described in claim 1, before step (A), the method further includes the following steps: (G) by using the mobile device, linking with an online banking web page provided by the online banking server and logging in to the online banking website After a specific account, the transaction request is generated by human operation, and the transaction request is transmitted to the online banking server. The method for authenticating a mobile online banking transaction according to claim 1, between steps (E) and (F), further including the following steps: (H) The mobile device receives the transaction from the authentication server. When the data is displayed, the execution of the mobile security control application program displays the transaction data, and the notification is generated by human operation, and the notification is transmitted to the authentication server. The mobile online banking transaction authentication method described in claim 1, is also performed by a verification server connected to the online banking server and storing multiple reference certificate data. After step (F), it also includes the following steps: ( I) With the online banking server, upon receiving the successful authentication reply from the authentication server, for the financial transaction, a signature containing the received seal information and the voucher information, and the transaction request is included. Request for verification of the transaction data, and send the verification request to the verification server; (J) The verification server, after receiving the verification request from the online banking server, determines that the voucher data matches When one of the stored reference voucher data is used for the reference voucher data, a predetermined hash algorithm is used to obtain a hash value according to the transaction data, and by determining whether the obtained hash value matches the signature result The hash value contained therein determines whether the signature data is successfully verified; and (K) by the verification server, when it is determined that the signature data is successfully verified, A successful response to the verification request is sent to the online banking server. The mobile internet banking transaction authentication method according to claim 4, after step (K), further includes the following steps: (L) When the online banking server receives a successful response from the verification server, it will The transaction data is transmitted to a transaction execution server; (M) the online banking server receives a transaction result from the transaction execution server and indicates the completion of the financial transaction, and transmits the transaction result to the mobile device ; And (N) using the mobile device to display the transaction result when receiving the transaction result from the online banking server. The mobile internet banking transaction authentication method according to claim 1, wherein in step (C), the online banking server continues to transmit a corresponding value to the authentication after the hash value and the identification code are transmitted to the mobile device. The requested polling is to the authentication server; and in step (F), the authentication server responds to the poll from the online banking server recently, and sends the successful authentication response to the online banking server. A mobile online banking transaction authentication system includes: a mobile device installed with a mobile security control application; a card reader that is electrically connected to the mobile device and an electronic card that is electrically connected to the card reader by contact type And stores credential data corresponding to a specific client; an online banking server; and an authentication server connected to the online banking server; wherein, when the online banking server receives a message from the mobile device and related to a specific account When a financial transaction includes a transaction request including transaction information, an authentication request including the transaction information is transmitted from the online banking server to the authentication server; wherein, when the authentication server receives the authentication request from the online banking server, the authentication request The authentication server uses a predetermined hash algorithm to generate a hash value and an identification code unique to the hash value according to the transaction data, and stores the hash value and the identification code, and transmits the hash value and the identification code To the online banking server; wherein, when the online banking server receives the hash value and the identification code from the authentication server The online banking server sends the received hash value and the identification code to the mobile device; wherein when the mobile device receives the hash value and the identification code from the online banking server, it starts to execute the mobile security control An application to establish a connection with the authentication server and cause the card reader to read the credential data stored in the electronic card, and to receive the hash value and the identification code and the The certificate data is transmitted to the authentication server; after the authentication server receives the hash value, the identification code, and the certificate data from the mobile device, and determines that the received hash value and the identification code respectively agree with When the hash value and the identification code are stored, the authentication server transmits the transaction data to the mobile device; and, when the authentication server receives a transaction data from the mobile device and indicates that the transaction data is correct When notifying, the authentication server packs and signs the hash value, the identification code, and the voucher information received to obtain signature data, and assigns a And signature request including the document data and the information on the successful authentication reply transmitted to the online banking server end. The mobile online banking transaction authentication system according to claim 7, wherein the mobile device generates the transaction request through human operation after linking to an online banking web page link provided by the online banking server and logging into the specific account. The transaction request is sent to the online banking server. The mobile online banking transaction authentication system according to claim 7, wherein when the mobile device receives the transaction data from the authentication server, the mobile device displays the transaction data through the execution of the mobile security control application and performs the operation manually. Generate the notification, and send the notification to the authentication server. The mobile online banking transaction authentication system according to claim 7, further comprising a verification server connected to the online banking server and storing a plurality of reference credentials corresponding to different customers, wherein: the online banking server is receiving Upon the successful authentication reply from the authentication server, for the financial transaction, a verification request including the signature data and the voucher data received, and the transaction data included in the transaction request is generated, and the The verification request is sent to the verification server; when the verification server receives the verification request from the online banking server and determines that the voucher data matches one of the reference voucher data stored, it uses The predetermined hash algorithm obtains a hash value according to the transaction data, and determines whether the signature data is successfully verified by determining whether the obtained hash value matches the hash value included in the signature result; and When the verification server determines that the signature data is successfully verified, it will respond to the verification request with a successful verification. The reply is sent to the online banking server. The mobile online banking transaction authentication system according to claim 10, wherein: the online banking server sends the transaction data to a transaction execution server when receiving the verification success response from the verification server; the online banking server receives To a transaction result from the transaction execution server and indicating completion of the financial transaction, and transmitting the transaction result to the mobile device; and the mobile device displaying the transaction when receiving the transaction result from the online banking server result. The mobile online banking transaction authentication system according to claim 7, wherein the online banking server continuously transmits a poll corresponding to the authentication request to the authentication after the hash value and the identification code are transmitted to the mobile device. The server; and the authentication server responds to the poll from the online banking server recently, and sends the successful authentication response to the online banking server.