TWM583978U - System of using physical carrier to store digital certificate for performing online transaction - Google Patents

Abstract

A system for storing a digital voucher using an entity vehicle for online transaction, after downloading a digital voucher by a credential management server through a client, storing the digital voucher in the physical vehicle through the security control component, and performing the transaction with the transaction server In the process of trading operations, when a voucher job is required, the digital voucher is read by the entity vehicle through the security control component, and the digital voucher is used for the transaction operation, and the digital certificate applied by the browser can be stored in the physical vehicle. Use and achieve technical efficiencies that reduce the complexity of credential management.

Description

System for storing online vouchers using physical vehicles for online transactions

A system for online transactions using digital vouchers, and more particularly to a system for storing digital vouchers for online transactions using physical vehicles.

Digital credentials, also known as electronic credentials, are an identity recognition mechanism for computer systems. A digital certificate is a file or a set of computer files that record the identity of the owner and a set of public passwords. The owner of the digital certificate can authenticate to the computer system to access or use a particular computer service.

In the early days, due to the lack of network security, the computer services that need to be accessed or used through digital certificates are mostly provided in the form of webpages attached to the security plug-in components, meaning that when users access or use these services, It is through the browser to perform related services such as voucher application, renewal and inquiry to the remote server.

However, the credentials requested through the browser can only be used in the browser and cannot be used by the user elsewhere.

In summary, it can be seen that in the prior art, there has been a long-standing problem that digital certificates can only be used on the application browser, and therefore it is necessary to propose an improved technical means to solve this problem.

In view of the prior art problem that digital vouchers can only be used on the application browser, the present disclosure discloses a system for storing digital vouchers for online transactions using physical vehicles, wherein:

The system disclosed in the present application for storing digital vouchers for online transactions includes at least: a client for installing security components; a physical vehicle for connecting with a client; and a credential management server for providing client access The security control component downloads the digital certificate corresponding to the client, so that the security control component stores the digital certificate in the physical vehicle; the hardware encryption and decryption host uses the voucher information for verifying the digital certificate; and the transaction server provides the client connection. And according to the transaction requested by the client, the client performs a corresponding credential operation, so that the client reads the digital credential in the physical vehicle through the security control component, and transmits the credential information of the digital credential to the hardware plus The host is decrypted, and when the credential information is verified by the hardware encryption and decryption host, the digital voucher is used to perform a transaction operation with the transaction server.

The system disclosed in the present application is as above, and the difference from the prior art is that after the creation of the digital certificate by the credential management server through the client, the digital certificate is stored in the physical vehicle through the security control component, and is in the transaction servo. During the transaction operation, when the voucher operation is required, the digital voucher is read by the physical vehicle through the security control component, and the digital voucher is used for the transaction operation, so as to solve the problems existing in the prior art, and the voucher management can be achieved. The technical power of complexity.

The features and implementations of the present invention will be described in detail below in conjunction with the drawings and the embodiments, which are sufficient to enable any skilled person to fully understand the technical means to which the present invention solves the technical problems and implement them accordingly. The achievable effect of this creation.

The author can store the digital voucher in the physical vehicle and access the digital voucher in the physical vehicle when the digital voucher is needed. In this way, the user can use the digital voucher with different digital voucher to use the digital voucher in different clients.

The following is a system diagram for the creation of a physical vehicle using the physical vehicle to store digital certificates for the online transaction in the "Picture 1". As shown in FIG. 1, the system of the present creation includes a service server 110, a credential management server 120, a transaction server 130, a hardware encryption/decryption host 140, a physical vehicle 150, a client 160, and an attachable Communication device 190. The service server 110, the credential management server 120, the transaction server 130, the hardware encryption and decryption host 140, the client 160, and the communication device 190 may all be computing devices including data processing and network communication functions.

The computing devices referred to in this creation include, but are not limited to, one or more processors, one or more memory modules, and components such as bus bars that connect different components, including memory modules and processors. Through the various components included, the computing device can load and execute the operating system to cause the operating system to run on the computing device.

The bus of the computing device proposed by the present application may include one or more types, for example, including a data bus, an address bus, a control bus, and an expansion bus ( Expansion bus), and / or local bus and other types of bus. Busbars for computing devices include, but are not limited to, side-by-side industry standard architecture (ISA) busses, peripheral component interconnect (PCI) busses, video electronic standards associations (VESA) local busses, and tandem universal sequence busses (USB), Fast Peripheral Component Interconnect (PCI-E) bus, etc.

The processor of the computing device proposed by the present invention is coupled to the bus bar. The processor includes a register group or a scratchpad space, and the scratchpad group or scratchpad space can be completely disposed on the processing wafer, or all or part of the processor is disposed outside the processing chip and via a dedicated electrical connection. And/or coupled to the processor via a bus. The processor can be a processing unit, a microprocessor, or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processors, the computing device includes the same or similar processors and is coupled and communicated through the bus. The processor can interpret a series of instructions that cause the computing device to perform particular operations or operations, such as mathematical operations, data comparisons, and the like.

The processor of the computing device can be coupled to the chip set or electrically connected to the chip set through the bus bar. The chipset is composed of one or more integrated circuits (ICs), including a memory controller and a peripheral input/output (I/O) controller, that is, the memory controller and the peripheral output controller can be included in In an integrated circuit, two or more integrated circuits can also be used. The chipset typically provides input and memory management functions, as well as providing a plurality of general purpose and/or dedicated registers, timers, etc., wherein the general purpose and/or dedicated registers and timers are coupled or One or more processors electrically coupled to the chip set are accessed or used.

The processor of the computing device can also access the data stored in the memory module and the large-capacity storage area of the computing device through the memory controller. The above memory module includes any type of volatile memory and/or non-volatile memory (NVRAM) memory, such as static random access memory (SRAM), dynamic random access. Memory (DRAM), flash memory (Flash), read-only memory (ROM), etc. The above-mentioned mass storage area may include any type of storage device or storage medium, such as a hard disk drive, a compact disc, a flash drive (flash memory), a memory card, and a solid state disk (Solid State Disk, SSD), or any other storage device, etc. That is to say, the memory controller can access data in the static random access memory, the dynamic random access memory, the flash memory, the hard disk drive, and the solid state hard disk.

The processor of the computing device can also communicate with the peripheral device or interface such as the peripheral output device, the peripheral input device, the communication interface, and the GPS receiver through the peripheral output/input bus through the peripheral output/input controller. The peripheral input device can be any type of input device, such as a keyboard, a mouse, a trackball, a trackpad, a rocker, etc., and the peripheral output device can be any type of output device, such as a display, a printer, etc., peripheral input device It can also be the same device as the peripheral output device, such as a touch screen. The communication interface can include a wireless communication interface and/or a wired communication interface, and the wireless communication interface can include a wireless communication network such as Wi-Fi, Zigbee, Bluetooth, infrared, near field communication (NFC), 3G/4G/5G, etc. The interface of the road or other wireless data transmission protocol, the wired communication interface can be an Ethernet device, an asynchronous transfer mode (ATM) device, a DSL data machine, a cable (data) data machine, and the like. The processor can periodically poll various peripheral devices and interfaces to enable the computing device to perform input and output of data, as well as to communicate with another computing device having the elements described above.

The service server 110 can use the communication interface to provide the client 160 through a wired or wireless network connection, and is also responsible for storing the security control components using the mass storage area, and is responsible for providing the client 160 with the communication interface to download the security control components. The security component can be an add-on or plug-in of a web browser executing in the client 160, and the security component can also be included in an application executable by the client 160.

In some embodiments, the service server 110 can also use the mass storage area to store account data, and can use the communication interface to provide the client 160 to download the stored account data through the security control component. The account information is not limited to being stored in plain text. For example, the service server 110 may store the account data through a two-dimensional barcode or the like.

The account information provided in this creation may be the bank account number and/or personal data of the user of the client 160, but the creation is not limited thereto. The personal data includes, but is not limited to, name, identity card number, gender, mailing address, telephone number, email address, and the like.

The credential management server 120 can use the communication interface to provide the client 160 to connect via a wired or wireless network, or can use the mass storage area to store the digital credentials requested by the client 160.

The credential management server 120 can also use the mass storage area to record the device identification data of the client 160 and the stored information of the digital credential corresponding to the client 160. The device identification data may be a device having a unique value such as a device name, a device serial number, a processor serial number, a network address, a MAC address, etc. of the client 160, but the device identification data proposed by the present application is not The storage message contains the storage path of the digital certificate and the file name of the digital certificate, but the creation is not limited to this. Any data that can be correctly read by the digital certificate can be used as a storage message.

The credential management server 120 is responsible for receiving the device identification data transmitted by the client 160 using the communication interface, and is responsible for finding a storage message of the digital credential corresponding to the client 160 according to the received device identification data. When the voucher management server 120 searches for the storage message of the digital certificate corresponding to the client 160, the digital certificate corresponding to the client 160 can be read from the large-capacity storage area according to the searched storage signal, and the communication interface is used. The message is transmitted to the client 160. When the voucher management server 120 does not search for the stored message of the digital certificate corresponding to the client 160, the communication interface may be used to transmit a notification message indicating that the digital certificate corresponding to the client 160 does not exist to the client. End 160. The voucher management server 120 can also use the communication through the wired or wireless network when the storage message of the digital certificate corresponding to the client 160 is not found, or when the communication interface receives the voucher application message transmitted by the client 160. The interface is connected to the voucher management center 400 to apply for the corresponding digital certificate for the client 160, and the applied digital certificate is transmitted back to the client 160.

In some embodiments, the credential management server 120 can also use the communication interface to receive the device identification data and the credential information of the client 160 transmitted by the client 160, and can determine whether the received device identification data corresponds to the credential information. That is, it is judged whether or not the record containing the received device identification data and the voucher information is stored in the large-capacity storage area. If there is a record including the device identification data and the credential information received by the credential management server 120, the credential management server 120 may generate a notification message indicating that the client has been confirmed to the client 160; and if the credential management server 120 is included If the record of the received device identification data and the voucher information does not exist, the voucher management server 120 can read the corresponding communication data according to the applicant information in the voucher information, and send a confirmation message according to the communication data using the communication interface. The communication device 190 corresponding to the voucher information (that is, the communication device that the applicant of the digital certificate indicated by the voucher information can use), and the response message sent by the communication device 190, and generated according to the response message received by the communication interface. A notification message indicating whether the client 160 has been confirmed, and transmitting a notification message to the client 160 using the communication interface. The response message transmitted by the communication device 190 indicates that the applicant of the digital certificate allows or denies the client 160 to access the digital certificate. If the applicant of the digital certificate denies the client 160 access to the digital certificate, the certificate management server 120 can generate The client 160 does not have a confirmed notification message; and if the applicant of the digital certificate allows the client 160 to access the digital certificate, the credential management server 120 can generate a confirmation message that the client 160 has been confirmed.

The transaction server 130 uses the communication interface to provide the client 160 with a wired or wireless network connection and is responsible for conducting transactions with the client 160. The transaction operation performed by the transaction server 130 and the client 160 includes jobs requiring digital certificates, such as network transfer/ordering, voucher management, online financing/moving, etc., but the transaction operations proposed by the present application are not The above is limited.

The transaction server 130 can receive the account information transmitted by the client 160 using the communication interface, and can complete the transaction operation according to the received account information.

In some embodiments, the transaction server 130 and the service server 110 may be the same entity or different entities in the same server, that is, one server may simultaneously provide the transaction server 130 and the service server. 110 services.

The hardware encryption and decryption host 140 can use the communication interface to provide the client 160 with a connection via a wired or wireless network. The hardware encryption and decryption host 140 is also responsible for storing the license identification data using the large-capacity storage area, and can use the communication interface to provide the client 160 to read the stored license identification data through the security control component.

The hardware encryption and decryption host 140 is also responsible for receiving the credential information transmitted by the client 160 using the communication interface, and can read the specific data from the received credential information.

The hardware encryption and decryption host 140 can also determine whether the specific data read is consistent with the license identification data. When the specific data matches the license identification data, the certificate information is verified; and when the specific data does not match the license identification data, When it is indicated, the voucher information has not been verified. The hardware encryption and decryption host 140 can also transmit the determination result back to the client 160 using the communication interface. The judgment result may indicate whether the credential information is verified by the hardware encryption and decryption host 140.

The physical carrier 150 can be directly connected to the client 160 through the peripheral output bus, for example, USB, IEEE 1394, audio input/output terminals, etc.; the physical carrier 150 can also be connected to a specific component connected to the peripheral output bus or The module is connected to the client 160, for example, to the client 160 via a built-in or external card reader of the client 160.

The physical carrier 150 is responsible for storing the digital credentials and providing access to the connected client 160. The physical carrier 150 is a device, a module or a component that includes a storage medium capable of storing data, such as an external hard disk, a USB flash drive, a memory card, a chip card, etc., but the creation is not limited thereto.

Generally, the digital certificate stored by the physical carrier 150 is encrypted, and the client 160 needs to access the security component when accessing the digital certificate stored by the physical carrier 150, that is, the security component needs to be first After decrypting the digital certificate stored by the physical carrier 150, the client 160 can access the digital certificate stored by the physical carrier 150 through the security control component.

The client 160 is, for example, a computer, a mobile phone, a tablet, a television, a navigation device, a multimedia player, an e-book reader, an electronic dictionary, a video game host, etc., but the present invention is not limited thereto.

The client 160 can provide the physical carrier 150 connection using the peripheral output incoming bus, and can use the communication interface to communicate with the service server 110, the credential management server 120, the transaction server 130, and the hardware encryption and decryption host through the wired or wireless network. 140 connections.

The client 160 is also responsible for installing the downloaded security components. In some embodiments, the client 160 can download the security component from the connected service server 110 or transaction server 130 using the communication interface and install the downloaded security component; in another embodiment, the client The terminal 160 can also detect whether the physical carrier 150 stores an application including a security component that needs to be automatically installed after being connected to the physical carrier 150, and if so, install an application to install the security component. The client 160 can determine whether the application needs to be automatically installed according to the name of the application, the data recorded in the specific file, etc., but the creation is not limited thereto.

The client 160 is also responsible for downloading the digital certificate corresponding to the client 160 through the security control component using the communication interface to the credential management server 120. In some embodiments, the security component can download the digital credentials by the credential management server 120 when the client 160 has been connected to the physical carrier 150, that is, if the security component determines that the client 160 has not been associated with the entity. When the carrier 150 is connected, the security component can display the corresponding prompt message and does not download the digital certificate.

In general, the client 160 can transmit the device identification data of the client 160 to the credential management server 120 through the security control component, and receive the digital credential returned by the credential management server 120. The client 160 can also use the communication device to transmit the notification information sent by the credential management server 120 after receiving the notification information sent by the credential management server 120 by using the communication interface to transmit the device identification data of the client 160 to the credential management server 120. The interface transmits the voucher application message to the voucher management server 120, so that the voucher management server 120 requests the digital voucher corresponding to the client 160 according to the voucher application message, and uses the communication interface to receive the digital voucher applied by the voucher management server 120.

The client 160 is also responsible for storing the digital credentials received from the credential management server 120 to the physical vehicle 150 and for accessing the digital credential in the physical vehicle 150. In more detail, the client 160 can use the security control component to call the access library corresponding to the physical vehicle 150, so as to store the corresponding digital certificate to the entity through the security control component and the called access library. With 150, or read a digital certificate.

The client 160 is also responsible for connecting to the transaction server 130 using the communication interface and requesting the transaction server 130 for a particular transaction.

The client 160 is also responsible for reading the digital certificate in the physical vehicle 150 through the security control component when the transaction server 130 requests to perform the voucher operation during the transaction with the transaction server 130, and transmitting the voucher information to the communication interface to the transaction server 130. The hardware encrypts and decrypts the host 140 to verify the credential information.

The client 160 is also responsible for performing transaction operations with the transaction server 130 by using the digital certificate read by the security component when the certificate information of the digital certificate read by the security component is verified by the hardware encryption and decryption host 140. The client 160 can also receive the judgment result returned by the hardware encryption and decryption host 140 through the security control component by using the communication interface, and can complete the transaction with the transaction server 130 by using the digital certificate when the judgment result indicates that the voucher information is verified. The transaction operation may also end or suspend the transaction operation with the transaction server 130 when the judgment result indicates that the voucher information has not passed the verification.

The client 160 can also read the account data from the physical carrier 150 and use the communication interface to transfer the read account information to the transaction server 130.

Next, an embodiment is used to illustrate the operation of the present creation, and please refer to the "Phase 2A" flow chart of using the physical vehicle to store digital certificates for online transactions. In this embodiment, it is assumed that the service server 110 is a server providing banking services, and the physical carrier 150 is a USB flash drive, but the creation is not limited thereto.

First, the user can connect the client 160 with the physical carrier 150 (step 210). In this embodiment, it is assumed that the client 160 and the physical carrier 150 are connected through a USB interface.

If the security component is not stored in the physical carrier 150, the user can also operate the client 160 to install the security component (step 220). In this embodiment, it is assumed that the user can operate the client 160 to connect to the service server 110 to download the security control component. The security component may be an additional component or a plug-in program executed by the web browser in the client 160. After the client 160 downloads the security component, the security component may be installed into the web browser; the security component may also be Included in the application, that is, the client 160 connects to the service server 110 to download and install an application containing security components.

In practice, unless the client 160 is installed with the security component in the physical carrier 150, the connection client 160 and the physical carrier 150 (step 210) and the client 160 install the security component (step 220) without prioritization. relationship.

After the client 160 installs the security component, the client 160 can execute the security component such that the client 160 can be connected to the credential management server 120 via the security component (step 230). In this embodiment, if the security component is an add-on or plug-in of the web browser, the client 160 can execute the web browser to cause the security component to be executed; and if the security component is included in the application, the client The end 160 can execute an application including a security component to execute the security component. After the security control component is executed, it can be connected to the credential management server 120 and can transmit the device identification data of the client 160 to the credential management server 120. The security component may first determine whether the client 160 has been connected to the physical carrier 150. If the client 160 has not been connected to the physical carrier 150, the security component may display a prompt message to prompt the user to connect the client 160 with the entity. The carrier 150; and if the client 160 has been connected to the physical carrier 150, the security component can transmit the device identification data of the client 160 to the credential management server 120.

After receiving the device identification data of the client 160, the voucher management server 120 can determine whether the digital voucher of the client 160 exists according to the received device identification data (step 240). When the credential management server 120 determines that the digital credential of the client 160 does not exist, it may connect to the credential management center to apply for a digital credential for the client 160 (step 250), and may transmit the applied digital credential to the client 160. The digital certificate can also be stored; and when the digital certificate of the client 160 exists, the voucher management server 120 can read the digital voucher and transmit the read digital voucher to the client 160.

After the client 160 downloads the digital certificate by the credential management server 120 through the security control element, the downloaded digital credential is written into the physical vehicle 150 (step 260). In the present embodiment, it is assumed that the security control element can call the access library of the entity carrier 150 to write the digital certificate into the physical carrier 150.

After the client 160 writes the digital certificate to the physical carrier 150, the user can operate the client 160 to connect to the transaction server 130 (step 270). In this embodiment, if the security component is an add-on or plug-in of the web browser executed on the client 160, the client 160 needs to connect to the transaction server 130 through the web browser; In the application included in the client 160, the client 160 needs to connect to the transaction server 130 through an application including a security component. Assuming the user wants to make a network transfer/order or online financing transaction, the user can operate the client 160 to connect to the corresponding transaction server 130.

It should be particularly noted that the client 160 used by the user to connect to the transaction server 130 is not necessarily the client 160 that writes the digital certificate to the physical carrier 150, or the user can have the physical carrier 150 After the client 160 that writes the digital certificate is removed or removed to interrupt the connection between the physical carrier 150 and the client 160 that writes the digital certificate, another client that is connected to the physical carrier 150 storing the digital certificate is also That is, the user can move the entity vehicle 150 storing the digital certificate to the new client by the client 160 that writes the digital certificate, and connect to the transaction server 130 using the new client. Wherein, if the security component is an add-on or plug-in of the web browser executed on the client, the new client is connected to the physical carrier 150, and if the web browser on the new client is not installed, For the control component, the user can first operate the client 160 to download and install the security control component, and then connect through the security control component to connect to the transaction server 130 through the web browser; and if the security component is included in the client 160 In the application, after the new client is connected to the physical vehicle 150, the new client can automatically execute the application in the physical vehicle 150 to connect to the transaction server 130 through the security control component.

After the client 160 is connected to the transaction server 130 (step 270), when the client 160 performs a transaction operation with the transaction server 130, the transaction server 130 requires the client 160 to perform a voucher job, and the client 160 can The digital certificate is read from the physical carrier 150 connected to the client 160 through the security control element, and the voucher information of the read digital certificate is transmitted to the hardware encryption and decryption host 140 (step 280).

After that, the client 160 can perform the transaction operation with the transaction server 130 by using the read digital certificate through the security component to verify the credential information transmitted to the hardware encryption and decryption host 140 through the verification of the hardware encryption and decryption host 140. 290). In this embodiment, it is assumed that, as shown in the flow of "FIG. 2B", the hardware encryption/decryption host 140 can read out specific data from the voucher information received from the client 160, and can determine whether the specific data read is The pre-stored license identification data is matched (step 293), and the judgment result is generated and transmitted to the client 160. After the security component of the client 160 receives the judgment result transmitted by the hardware encryption and decryption host 140, if the judgment result indicates that the specific data matches the license identification data, the security component can use the digital certificate to complete the transaction operation (step 297), and if the judgment result indicates that the specific data does not match the certification identification data, the security control element may end the transaction operation (step 295).

Thus, through the present creation, the user can store the digital certificate to the physical vehicle and use the digit in the physical vehicle 150 in the client connecting the physical vehicle 150 after connecting the physical vehicle 150 with any client. The voucher is traded with the transaction server 130.

In the above embodiment, before the client 160 transmits the voucher information of the digital certificate read by the physical carrier 150 to the hardware encryption and decryption host 140 through the security control component (step 280), it may be as shown in the "2C chart". As shown in the flow, the client 160 may first transmit the device identification data of the client 160 and the credential information of the read digital certificate to the credential management server 120 through the security control component (step 285).

After receiving the device identification data and the credential information transmitted by the client 160, the credential management server 120 can determine whether the received device identification data and the credential information correspond (step 286). In this embodiment, the credential management server 120 may search for credential information corresponding to the device identification data, and determine whether the searched credential information is identical to the received credential information. If the same, the credential management server 120 may transmit Indicates that the client has acknowledged the notification message to the client 160 (step 288).

If the credential management server 120 does not search for the same credential information as the received credential information, the credential management server 120 may search for the digital credential represented by the credential information according to the applicant information in the received credential information. The applicant's communication data transmits the confirmation message to the communication device 190 corresponding to the voucher information using the searched communication data, and receives the response message transmitted by the communication device 190 (step 287).

After the voucher management server 120 receives the response message sent by the communication device 190, the voucher management server 120 may generate a notification message indicating whether the client has been confirmed according to the received response signal, and may generate the generated message. The notification message is transmitted to the client 160 (step 288).

After the client 160 receives the notification message sent by the credential management server 120, the security control component executed by the client 160 can determine whether the received notification message indicates that the client has been confirmed. If not, the security control component can The transaction operation is ended; if so, the security control component can transmit the voucher information of the digital certificate to the hardware encryption and decryption host 140 (step 289), so that the hardware encryption and decryption host 140 verifies the voucher information.

In summary, it can be seen that the difference between the present creation and the prior art is that after the client downloads the digital certificate by the credential management server, the digital certificate is stored in the physical vehicle through the security control component, and is performed with the transaction server. In the process of trading operations, when a voucher job is required, a digital voucher is read by a physical vehicle through a security control component, and a digital voucher is used to perform a transaction operation. The technical means can solve the digital certificate existing in the prior art. The technical effects of reducing the complexity of credential management can be achieved only by the problems that can be used on the application browser.

In the above embodiment, when the client 160 performs a transaction operation with the transaction server 130 by using the digital certificate read by the physical carrier 150 through the security control unit, the client 160 can also be used by the entity carrier 150 through the security control component. The account information is read, and the account information is transmitted to the transaction server 130, so that the transaction server 130 completes the transaction operation based on the account information.

Furthermore, the system for the use of physical vehicles for storing digital vouchers for online transactions can also be implemented in a centralized manner or in a decentralized manner in which different components are interspersed among several interconnected computer systems.

Although the embodiments disclosed in the present disclosure are as above, the contents are not intended to directly limit the scope of the patent protection of the present invention. Anyone who has the usual knowledge in the technical field of this creation, without any departure from the spirit and scope disclosed in this creation, makes some modifications to the form and details of the implementation of this creation, which are the patent protection of this creation. range. The scope of patent protection of this creation must be determined by the scope of the attached patent application.

110‧‧‧Business Server

120‧‧‧Voucher Management Server

130‧‧‧Transaction Server

140‧‧‧ hardware encryption and decryption host

150‧‧‧Ent vehicle

160‧‧‧Client

190‧‧‧Communication device

400‧‧‧Voucher Management Center

Step 210‧‧‧Connect client and physical vehicle

Step 220‧‧‧ Client installation security components

Step 230‧‧‧ The client connects to the credential management server through the security control component

Step 240‧‧‧Voucher management server determines whether the digital certificate exists

Step 250‧‧‧Voucher Management Server Requests Digital Voucher

Step 260‧‧‧ The client downloads the digital certificate and stores the digital certificate in the physical vehicle

Step 270‧‧‧ Clients connect to the transaction server

Step 280‧‧‧ When the transaction server asks the client to perform the voucher operation, the client reads the digital certificate in the physical vehicle through the security control component, and transmits the voucher information of the digital certificate to the hardware encryption and decryption host

Step 285‧‧‧ The client transmits the identification information and the credential information to the credential management server through the security component transfer device

Step 286‧‧‧ The credential management server determines whether the device identification data corresponds to the credential information

Step 287‧‧ The credential management server transmits a confirmation message to the communication device corresponding to the credential information, and receives the response message returned by the communication device

Step 288‧‧ The credential management server transmits a notification message to the security control component

Step 289‧‧‧ The security component transmits the voucher information of the digital certificate to the hardware encryption and decryption host when the notification message indicates that the client is confirmed

Step 290‧‧‧ When the voucher information is verified by the hardware encryption and decryption host, the client uses the digital certificate to conduct transaction with the transaction server through the security control component.

Step 293‧‧‧ The hardware encryption and decryption host determines whether the specific data matches the license identification data

Step 295‧‧‧Security components to close the transaction

Step 297‧‧‧ Security components use digital voucher to complete the transaction

Figure 1 is a system architecture diagram of the author's use of physical vehicles to store digital certificates for online transactions. Figure 2A is a flow chart of the author's use of the physical vehicle to store digital certificates for online transactions. Figure 2B is a flow chart of the execution of the transaction operation based on the digital certificate stored in the physical vehicle. Figure 2C is a flow chart of the client confirming the client through the credential management server.

Claims (10)

A system for storing digital vouchers for online transactions using a physical vehicle, the system comprising: at least one client, being a computing device for installing a security component; and a physical carrier comprising a storage medium for a client connection; a credential management server, wherein the client downloads a digital credential corresponding to the client through the security control component, so that the security component stores the digital credential in the physical vehicle; And the encryption and decryption host is configured to verify the voucher information of the digital voucher; and a transaction server provides the client connection, and according to the transaction requested by the client, the client performs a corresponding voucher operation, so that the client Reading the digital certificate in the physical vehicle through the security control component, and transmitting the voucher information of the digital certificate to the hardware encryption and decryption host, when the voucher information is verified by the hardware encryption and decryption host, The digital voucher is traded with the transaction server. The system for storing an online certificate by using a physical vehicle as described in claim 1, wherein the voucher management server is further configured to connect to the voucher management center to apply for the digital voucher for the client. The system for storing an online certificate by using a physical vehicle as described in claim 1, wherein the hardware encryption and decryption host determines whether one of the specific information of the voucher information and one of the pre-stored identification materials is pre-stored Matching, and transmitting a judgment result to the security control component, when the judgment result indicates that the specific data is consistent with the license identification data, the security control component uses the digital certificate to complete the transaction operation, and when the judgment result indicates that the judgment When the specific data does not match the license identification data, the transaction is terminated. The system for storing an online certificate by using a physical vehicle as described in claim 1, wherein the system further comprises a communication device corresponding to the voucher information for receiving the voucher management server to determine the The client transmits a confirmation message sent by the security component to the credential management server, and transmits a response message to the credential management server, and the credential management server further transmits a response message to the credential management server. And transmitting, by the response message, a notification message to the security control component, so that the security control component selects whether to send the voucher information of the digital voucher to the hardware encryption and decryption host according to the notification message. The system for storing a digital voucher for performing an online transaction using the physical vehicle as described in claim 1, wherein the client is further configured to read an account data from the entity vehicle through the security control component, and transmit the Account information to the transaction server to complete the transaction. A system for storing an online certificate by using a physical vehicle as described in claim 1, wherein the security control component is an add-on or plug-in of a web browser executable by the client, or is included in the Client executable in the application. The system for storing an online certificate by using a physical vehicle as described in claim 1, wherein the security control component is the client connected to the transaction server or a service server for downloading, or Stored in the physical carrier. The system for storing an online certificate by using an entity vehicle for performing online transaction, as described in claim 1, wherein the client is further configured to transmit a device identification data to the credential management server, and the credential management server is further used. Searching for the digital certificate based on the device identification data. A system for storing online vouchers for online transactions using an entity vehicle as described in claim 1 wherein the physical vehicle is an external hard drive, a flash drive, a memory card, or a wafer card. The system for storing an online certificate by using a physical vehicle as described in claim 1, wherein the client further encrypts the digital certificate through the security component and stores the encrypted digital certificate. The physical vehicle is used to decrypt the digital certificate stored in the physical vehicle through the security control component.