TWM642404U - System for identity verification applied to financial system - Google Patents

Abstract

A system for identity verification applied to a financial system is provided. The system provides a financial machine back-end server and a user device back-end server that provides verification service for a user device. A verification process is initiated by a financial machine for verifying a permission that allows the user device to perform a financial service. The financial machine generates a verification service request. The financial machine back-end server asks the user device back-end server to generate a verification data after receiving the request. The user device back-end server generates the verification data and forwards the verification data to the financial machine via the financial machine back-end server. The user device obtains the verification data from the financial machine, and then transmits to the user device back-end server for verification. The user device is allowed to perform the financial service if the verification is successful.

Description

Identity verification system applied to financial system

The description discloses a technology for using different devices to verify specific financial services, especially an identity verification system for cross-device verification using a financial information machine.

Fueled by financial technology, it is easier for the public to perform various financial services, followed by the addition of various information security technologies, including the development of various identity verification technologies. It is common that when a user wants to perform a specific financial service, in addition to the traditional password account, a second verification service of the user's device is also required. For example, the bank website for accessing financial services will require the user's mobile phone number when registering Telecom service providers conduct one-time password (OTP) verification, allowing users to obtain financial services after verifying their identity with this time-limited one-time password.

In order to provide more secure financial services through a cross-device verification, the disclosure document proposes an identity verification system. The identity verification system proposes a financial information machine background, which is to realize the background of financial information machines located in various places with a computer system. The management server is installed in the financial system to provide the information exchange service of the financial information machine, and a user device background, which is the background of the user device, connected to the database serving the user device, and used to provide the user device Get authentication services for financial services.

In the identity verification method implemented by the identity verification system, the main process includes starting a verification process through the financial information machine to verify whether the user device is allowed to perform a specific financial service, and the financial information machine generates a message requesting the verification service to the financial information machine background. Then, the background of the financial information machine requests the background of the user device to generate verification information, that is, the background of the user device generates verification information, and then sends the verification information back to the background of the financial information machine, and then forwards it to the financial information machine.

Afterwards, the user operates the user device to obtain verification information from the financial information machine, and then sends it to the background of the user device, and the background of the user device compares the received verification information with the verification information generated according to the background requirements of the financial information machine to generate a The verification result, when the verification result is successful, the user device is notified to execute the financial service.

Preferably, the user inserts an identifiable financial card into the financial information machine to start the verification process.

Furthermore, the financial information machine obtains the user identification data through the financial card, and the user identification data is sent to the background of the financial information machine along with the information requesting the verification service, and then to the background of the user device, so that the background of the user device can The verification information received by the identification data verification.

Preferably, the financial information machine can receive user identification data from the financial card or the wireless signal of the user device, and the user identification data is sent to the background of the financial information machine along with the information requesting the verification service, and then transmitted to the background of the user device, so that the user can use Or the background of the device can verify the received verification information according to the user identification data.

Preferably, the user device can obtain the verification information through a two-dimensional barcode, push information, near field communication information or short message. Furthermore, a two-dimensional barcode can be displayed on the screen of the financial information machine, or a radio frequency signal can be used to transmit near field communication information, so that the application program running in the user device can receive the verification information.

Further, the application program can be an online banking or mobile banking application program installed in the user's device, providing financial services to be selected for execution, and the financial services include services that require authentication through a specific transaction security design.

Further, the method for generating verification information in the background of the user device includes firstly generating a time-sensitive first random number and a second random number with a random number generator, storing the second random number with a storage device, and generating the second random number from the background of the financial information machine. The obtained user identification data, then based on the first random number and a fixed word string, a hash value is calculated by a hash algorithm, and then based on the user identification data, the hash value and the second random number, a cryptographic calculation is performed One-time password, the one-time password and the first random number form verification information.

Further, when the background of the user device receives the verification information from the user device, it will obtain the one-time password and the first random number from the verification information, and then obtain the second random number corresponding to the verification procedure and the user password from the storage device. The identification data, another hash value used for verification is calculated again, which can be called the second hash value, and based on the user identification data, the second hash value and the second random number, the first hash value used for verification is calculated again with a cryptographic algorithm A one-time password, which may be called a second one-time password, is used to verify the one-time password received from the user device.

In order to further understand the features and technical content of the present invention, please refer to the following detailed description and drawings related to the present invention. However, the provided drawings are only for reference and description, and are not intended to limit the present invention.

The implementation of the invention is described below through specific specific examples, and those skilled in the art can understand the advantages and effects of the invention from the content disclosed in this specification. This creation can be implemented or applied through other different specific embodiments, and the details in this specification can also be modified and changed based on different viewpoints and applications without departing from the idea of this creation. In addition, the drawings of this creation are only for simple illustration, not according to the actual size of the depiction, prior statement. The following embodiments will further describe the relevant technical content of this creation in detail, but the disclosed content is not intended to limit the protection scope of this creation.

It should be understood that although terms such as "first", "second", and "third" may be used herein to describe various elements or signals, these elements or signals should not be limited by these terms. These terms are mainly used to distinguish one element from another element, or one signal from another signal. In addition, the term "or" used herein may include any one or a combination of more of the associated listed items depending on the actual situation.

The disclosure document discloses an identity verification system applied to the financial system, in which the main technical concept is to confirm that the user can perform a specific financial service through the verification information transmitted between the user device, the financial information machine, and the respective background servers, and realize identity verification The goal is to provide a safer financial environment.

Referring first to FIG. 1 , it shows a diagram of an embodiment of the system architecture for executing the identity verification method. The system architecture shown in the figure includes various terminal devices connected in series through the network 10, wherein the main device includes a financial information machine 101 ( Such as: ATM machines, or card readers for financial cards such as financial cards) and the background 103 of the financial information machine located on the server side of the financial system. The background 103 of the financial information machine is composed of software components and hardware such as computer systems and databases. The architecture realizes that the background management server of the financial information machine 101 located in various places can provide the information exchange service of the financial information machine 101 through the network 10; the user holds a specific application program (such as mobile Internet Banking APP) user device 105, the server side is equipped with a corresponding user device background 107, the user device background 107 is implemented for the user device 105 with software components and hardware architecture such as computer systems and databases The management server of the application program, the background 107 of the user device, such as the background of the mobile device, provides the verification service for the user device to obtain financial services, and connects to the corresponding database 109 of the service user device 105. The content of the database 109 is mainly Record the user data of the registration verification service, including the related information of the bound user device 105 .

According to the implementation of the identity verification method, it can be mainly divided into the process of generating verification information and the process of executing specific financial services. The ways for the user device 105 to obtain verification information include but are not limited to two-dimensional barcodes (such as QR Code), push broadcast Information, Near Field Communication (NFC) and short messages, etc., and can directly present the way in which text is input by the user to the user device 105 . The following embodiments list the processes of device binding, non-agreed transfer, and mobile phone number collection setting, etc., wherein the process of verifying information is mainly to verify the user device 105 and user identity held by the user through the financial information machine 101, thereby The security verification confirms that the financial service proposed by the application program executed in the user device 105 can be performed.

The method running on the identity verification system can refer to the process described in FIG. 1. At the beginning, the financial information machine 101 starts a verification process after being triggered to verify whether it is allowed to execute a financial service provided by the financial system (step S101), wherein the trigger The verification procedure can be started by inserting a financial card by the user, or by approaching the financial service machine 101 with the user device 105 to start by exchanging wireless signals therein.

In the above-mentioned process of starting verification, the financial information machine 101 has received the user identification data, and then the financial information machine 101 generates a message requesting verification service to the financial information machine background 103 in the financial system, and the requesting verification service will include the user Identification data (step S103).

In the above process, the financial information machine 101 can receive user identification data (such as user ID) from the financial card or the wireless signal of the user device 105, and the user identification data will be sent to the financial information machine background 103 along with the information requesting verification service , requesting the user device background 107 to generate a verification information (step S105). When the user device background 107 generates verification information, the verification information is sent back to the financial information machine background 103 (step S107 ), and then forwarded to the financial information machine 101 (step S109 ).

After the financial information machine 101 receives the verification information, it can provide it to the user device 105 in the form of a verification pattern or a verification code (step S111), and the user device 105 obtains the verification information from the financial information machine 101, and then sends it to the user device The background 107, the user device background 107 will compare the received verification information with the verification information generated according to the requirements of the financial information machine background 103 according to the obtained user identification data, and generate a verification result (step S113) . Afterwards, the verification result is sent to the user device 105, and when the verification result is successful, the user device 105 is notified that the financial service can be continued (step S115).

According to the embodiment, the relevant detailed process can refer to FIG. 2, which shows the flow chart of an embodiment of the identity verification method running between the user device 105, the financial information machine 101, the user device background 107, and the financial information machine background 103, and refer to FIG. 3 text description of the process.

At the beginning, the user operates the financial information machine 101, such as inserting a financial card, a credit card, and other relevant financial cards with identifiable identities, and can perform verification through the financial information machine 101, wherein the information that the financial information machine 101 can obtain through the financial card includes the use of identification data of the user (step S301). In another embodiment, the user device 105 sends out a wireless signal, such as a radio frequency identification signal (RFID), so that the financial information machine 101 can obtain the identification code after receiving the wireless signal.

What is mentioned here is that the main purpose of the verification process is to verify the financial service to be executed by the user operating the user device 105. The user can select the financial service to be executed through the application program. In particular, the financial service can refer to the required The service of identity verification through specific transaction security design, such as (but not limited to) user device 105 binding, transfer, withdrawal, deposit or loan, etc., is mainly to enable customers to confirm the content of each transaction and prevent identity confirmation data from being associated with Targets whose transaction contents have been falsified. The timing for executing the financial service can be before, during, or after the verification process is started, or after the verification information is obtained.

Then, the financial information machine 101 starts the verification process, connects through the network and notifies the financial information machine background 103, requests verification service (step S303), and first responds to the information through the financial information machine background 103, which can be displayed by the financial information machine 101. The message requires the user to confirm to start the verification service, for example, a button to start the verification is displayed, and the user can press the confirmation button to start the verification process (step S305 ).

After the user confirms to start the verification process, the relevant information is sent to the financial information machine background 103 (step S307), and then the financial information machine background 103 notifies the user device background 107, requesting to generate verification information, and the user device background 107 can receive it from Obtain user identification information (such as user ID) from the information (step S309).

In the embodiment of generating verification information, the user device background 107 will first generate a value for verification. For example, a random number can be generated by a random number generator. According to one of the implementation methods, a time-sensitive first The first random number (random1) and the second random number (random2) can set a valid time in the background of the user's device. After the valid time expires, they will become invalid and the verification will fail. The user device background 107 stores the currently obtained user identification data and the second random number through the storage device therein, for later verification of the verification information sent by the user device 105 (step S311 ).

The user device background 107 then calculates a one-time password (one-time password, OTP) through a cryptographic algorithm based on the obtained information (such as user identification data and a specific value), and the specific value can be obtained through a hash algorithm ( hash algorithm) based on the first random number and a specific value (such as a fixed string (fixed string) provided by a system) to calculate a hash value (hash value) (step S313 ). For example, the cryptographic algorithm executed by the background 107 of the user device uses user identification information (such as the user ID obtained from the background), a hash value calculated based on the first random number and a specific value, and a hash value generated by the second random number calculation. The user device is provided to obtain a one-time password (OTP), which may be a hashed message authentication code-based one-time password (HOTP, HMAC-based One-Time Password, HMAC: hashed message authentication code).

What should be mentioned here is that the descriptions of random numbers and one-time passwords described in the above embodiments are not used to limit the scope of implementation of the identity verification method proposed in the disclosure document, but can be used to transfer a randomly generated password in a cryptographic manner. Set random values or any parameter values that have been calculated.

The above-mentioned one-time password and the first random number generated based on the verification process of this case will form verification information, and the user device background 107 will send the verification information to the financial information machine background 103 (step S315), and then the financial information machine background 103 will verify The information is forwarded to the financial information machine 101 (step S317).

In the financial information machine 101, the one-time password (or adding the first random number) can be converted into a verification graphic through a conversion program, such as a QR code (also other forms of verification information), and then the QR code is displayed on the On the screen, as the user's verification information (step S319). Another method can use a wireless verification code, such as transmitting NFC information in a near field communication (NFC) format encoded radio frequency signal, which can be transmitted to the user device 105 through wireless communication.

When the user sees the verification graphic or the information that specifically requires verification, the user can operate an application program (such as an online banking application program (APP)) on the user device 105 to select the financial service to be executed (step S321 ), such as user device 105 binding, transfer, withdrawal, deposit or loan, etc. This step can be performed before, during or after the above process, and then the user operates the application program to read the verification information displayed on the financial information machine 101, or receives the verification information wirelessly, that is, obtains the above user device The background 107 generates a one-time password for this verification requirement (step S323).

The user continues to operate the application program, and sends the obtained verification information to the user device background 107 (step S325). The one-time password is verified (step S327 ). After the verification is successful, the user is allowed to continue executing the financial service selected on the user device 105 . (step S329).

Further, in the process of the above-mentioned identity verification method, especially the verification information is generated by the user device background 107, the method can mainly be a software method combined with a hardware operation method, and first a random number generator is used to generate a time-sensitive The first random number (random1) and the second random number (random2), and use a storage device to store the second random number and the user identification data obtained from the background of the financial information machine, which will be used to verify the verification returned by the user device Informational Purposes.

Then, in the background of the user device, based on the first random number and a fixed string (fixed string), a hash value is calculated by a hash algorithm, and then based on the user identification data, the hash value and the second random number, to A cryptographic algorithm calculates a one-time password, and the one-time password and the first random number can form verification information sent to the user device.

In the verification procedure, after the user device reads the verification information from the financial information machine, it is sent to the background of the user device, and the software program in the background of the user device can obtain the one-time password and the first random number from the verification information , at this time, obtain the previously stored second random number and user identification data from the storage device, calculate the second hash value used for verification with the same algorithm again, and again based on the user identification data, the second hash value and The second random number is to calculate the second one-time password again with a cryptographic algorithm (such as Equation 1), which is used to compare the one-time password generated for this verification process before, that is, to verify the one-time password received from the user device password to generate the verification result.

What is mentioned here is that the one-time password used in the identity verification method can be time-sensitive, and the time will be controlled by the background of the user device; another implementation method can use a time-based one-time password algorithm ( TOTP algorithm) to generate time-sensitive one-time passwords.

In one embodiment, the user device 105 executes an application program related to financial services. When the application program executes a specific financial service, it will wait for the verification result of the identity verification performed by the financial information machine 101. Finally, when the user device 105 The background obtains the information of successful verification, that is, continues to execute the financial services to be performed initially, such as device binding, non-agreed transfer and mobile phone number collection services described in the following embodiments.

One of the processes of applying the identity verification method to the verification of a specific transaction program can refer to the flow chart of an implementation example of performing user device binding shown in FIG. 4 , wherein the process can cooperate with FIGS. 5A to 5E .

The user operates a user device to enter a binding process (step S401), and can use an application program installed on the user device, as shown in Figure 5A, a schematic diagram of an embodiment of a device binding page 501 initiated by the application program, using Users can click the button to start the binding process.

Then the application program guides the user to enter the authentication method selection page 50 shown schematically in Figure 5B. The example shown includes options such as voice OTP 503, SIM card authentication 504, and ATM authentication 505. Among the identity authentication methods, financial information is mainly used. machine for authentication (option 505) (step S403).

According to the embodiment of the above-mentioned identity verification method flow, the verification process is started by the financial information machine, the financial information machine requests verification services from its background, and then the financial information machine background requests the user device background to generate verification information, and the user device background After the verification information in this verification process is generated, it will be transferred to the financial information machine in front of the user through the background of the financial information machine.

When the financial information machine receives verification information from the background of the financial information machine, a conversion program converts the verification information into a verification pattern (such as a QR code), a verification code string or a wireless verification code, so that the user device can read the verification information ( Step S405). One of the embodiments can refer to the ATM verification scanning page 506 shown in FIG. 5C. The application program starts a scanning window 507 for scanning the verification graphics displayed on the financial information machine. The implementation example can refer to FIG. 5D shown in the user device 50, using the application to scan the verification graphic 510 displayed on the financial information machine 500 to read the verification information, and then send the verification information to the background of the user device (step S407).

Next, on the server side, the user device background verifies the verification information sent from the user device to generate a verification result, and then the user device receives the verification result (step S409 ), and determines whether the verification is successful (step S411 ). If the verification is unsuccessful, the device binding process will be terminated, and a verification error message will be displayed (step S413); if the verification is successful, the user device will display the binding success page 508 shown in Figure 5E after receiving the relevant information, allowing the user to use After confirmation, the user can click one of the buttons to continue the binding process (step S415).

To sum up, according to the identity verification system applied to the financial system described in the above-mentioned embodiments, in response to the information security requirements that financial services pay more and more attention to, the technical concept of identity verification is based on the financial information machines (such as financial Teller machine (ATM or card reader) to verify the financial services that users want to perform when operating user devices (such as mobile phones and other mobile devices). The implementation adopts two-stage verification. The first-stage verification is for the user to log in to the application provided by the financial institution In the second stage, the verification information is obtained through the financial information machine, and then verified by the background of the user's device, which can effectively improve the user's transaction security.

The content disclosed above is only the preferred feasible embodiment of the new model, and does not limit the scope of the patent application of the new model, so all equivalent technical changes made by using the description and drawings of the new model are included in the application of the new model within the scope of the patent.

10: Internet 101: Financial information machine 103: Financial information machine background 105: User device 107: User device background 109: Database 50: User device 500: Financial information machine 510: verify graphics 501: Device binding page 502: Verification method selection page 503: Voice OTP 504: SIM card authentication 505: ATM verification 506: ATM verification scan page 507: Scan window 508: binding success page Steps S101-S115 identity verification process Steps S301-S329 identity verification process Steps S401-S415 User Device Binding Process

Fig. 1 shows the schematic diagram of the embodiment of the system framework of carrying out identity verification method;

Figure 2 shows a flow chart of an embodiment of an identity verification method running between the user device, the financial information machine, the background of the user device, and the background of the financial information machine;

Fig. 3 is shown as the flowchart of identity verification method embodiment;

FIG. 4 shows a flow chart of an implementation example of binding a user device using an identity verification method; and

FIG. 5A to FIG. 5E are diagrams showing embodiments of device binding performed by a user device.

101: Financial information machine

103: Financial information machine background

105: User device

107: User device background

Steps S301~S329: identity verification process

Claims (10)

An identity verification system comprising: A financial information machine backend is a background management server for a financial information machine installed in various places by means of a computer system, which is installed in a financial system, connected to the financial information machine, and provides information on the financial information machine services to and from; and A background of a user device is a background of a user device connected to a database serving the user device, the background of the user device provides a verification service for the user device to obtain a financial service, and the user device executes the verification service An application for the financial system; Wherein, in the identity verification system, through a user's operation, the financial information machine starts a verification process for verifying whether the user's device is allowed to execute the financial service, and in the verification process, the financial information machine generating a message requesting a verification service to the background of the financial information machine, the requesting verification service including a user identification data; The background of the financial information machine requests the background of the user device to generate verification information, and the background of the user device generates the verification information, and transmits the verification information to the financial information machine through the background of the financial information machine, so that the user The or device obtains the verification information from the financial information machine, and then sends it to the background of the user device, and the background of the user device generates a verification result based on the verification information; wherein, when the verification result is a successful verification, the user is notified The device performs the financial service. The identity verification system as claimed in claim 1, wherein the user inserts an identifiable financial card into the financial information machine to start the verification process. The identity verification system as described in claim 2, wherein the financial information machine obtains the user identification data through the financial card, and the user identification data is sent to the background of the financial information machine along with the information requesting the verification service, and then transmitted to The user device background enables the user device background to verify the received verification information according to the user identification data. The identity verification system as described in Claim 1, wherein the financial information machine receives the user identification data from the wireless signal of the user device, and the user identification data is sent to the background of the financial information machine along with the information requesting the verification service , and transmitted to the user device background, so that the user device background can verify the received verification information according to the user identification data. The identity verification system as described in claim 4, wherein the user device obtains the verification information through a two-dimensional barcode, a push message, a near field communication message or a short message. The identity verification system as described in claim 5, wherein the two-dimensional barcode is displayed on a screen of the financial information machine, or the near field communication information is transmitted by a radio frequency signal, so that the The application receives the authentication information. The identity verification system as described in Claim 6, wherein, when the financial information machine receives the verification information from the background of the financial information machine, in the financial information machine, the verification information is converted into the two-dimensional barcode by a conversion program Or the radio frequency signal is read by the user device to obtain the verification information. The identity verification system as described in Claim 1, wherein the application program is an online banking application program installed in the user device, providing the financial service to be selected for execution, and the financial service includes the need to pass a specific transaction security design authentication service. The identity verification system as described in any one of claims 1 to 8, wherein the method for generating the verification information in the background of the user device includes: A random number generator is used to generate a time-sensitive first random number and a second random number, wherein a storage device is used to store the second random number and the user identification data obtained from the backend of the financial information machine; calculating a hash value with a hash algorithm based on the first random number and a fixed string; and Based on the user identification data, the hash value and the second random number, a cryptographic algorithm is used to calculate a one-time password, and the one-time password and the first random number form the verification information. The identity verification system as described in Claim 9, wherein, when receiving the verification information from the user device in the background of the user device, the one-time password and the first random number are obtained from the verification information, and then stored Obtaining the second random number and the user identification data in the device, recalculating a second hash value for verification, and again based on the user identification data, the second hash value and the second random number, the The cryptographic algorithm recalculates a second one-time password for verifying the one-time password received from the user device.

Images