WO2007143932A1

WO2007143932A1 - Usb digital authentication control method and atm and pos terminal applied to thereof

Info

Publication number: WO2007143932A1
Application number: PCT/CN2007/001820
Authority: WO
Inventors: Nian Chen
Original assignee: Nian Chen
Priority date: 2006-06-12
Filing date: 2007-06-08
Publication date: 2007-12-21

Abstract

A USB digital authentication control method includes the steps: an interface circuit sends a signal to a controller of a work host after a USB Key is inserted into a USB interface by an owner; the controller sends a series of random plaintext to the USB Key to request encryption; the USB Key generates a cryptograph after encrypting the random plaintext and sends the cryptograph and a digital certification to the controller; the controller finds a CA authentication center through the Internet according to the digital certification to authenticate and extract a corresponding common key, decrypts the cryptograph using the common key to generate the decrypted plaintext and compares the decrypted plaintext with the random plaintext; when the comparison result is same, the controller acquires the related information of a bank account associated with the digital certification by a bank system host to operate for the owner. AN ATM and a POS terminal are disclosed. Due to an application of using the combination of the USB interface structure and the digital certification, the USB Key can manage all of the bank account, acquire a good conveniency and security.

Description

USB digital authentication control method and automatic teller machine and P0S machine terminal using the same

The present invention relates to the field of digital authentication, and more particularly to a digital authentication control method using a USB interface. The invention also relates to a P0S machine terminal with a USB interface and an ATM with a USB interface using the above method. Background technique

At present, work hosts such as bank P0S machine terminals and ATMs are generally composed of main components such as a controller, a card reader, a hardware encryption card, a communication card (network card or MODEM card), a display screen, a keyboard, and a casing. The bank card is generally a magnetic stripe card, and the magnetic strip usually has a card number and anti-counterfeiting information. The authentication process of the bank card user when using the bank card is that the user first scrolls the magnetic strip of the bank card in the P0S machine card reader, and then inputs the personal password on the keyboard according to the prompt of the P0S machine. The P0S machine first sends the card number information to the controller, and sends the password to the hardware encryption card for encryption, and then sends the encrypted password to the controller. The controller sends the card number and the encrypted password to the bank through the communication card. The host of the system is authenticated by the bank system host for card number and password matching, and the user is allowed to perform operations such as consumption after matching authentication. There is also a type of chip card in the bank card, which differs from the magnetic stripe card in that it maintains a portion of the transaction information in the card in order to support offline transactions. The chip card can be used to brush the magnetic strip, and the process is exactly the same as described above. It is also possible to brush the chip, which usually requires inserting one end of the chip card with the chip into the card reader.

With the continuous development of online banking, more and more users rely on online banking for transfer and payment transactions. Due to the openness of the Internet, the risk of using card numbers and passwords on the Internet is increasing, and the situation in which the user's card number and password are stolen and causes significant economic losses often occurs. In order to ensure the security of online banking transactions, banks generally introduce digital certificates as a means of authenticating users online. The digital certificate is an identity recognition method based on an asymmetric encryption algorithm. The basis of the asymmetric encryption algorithm is a pair of public and private keys, which are generated in the USB Key. The private key is always stored in the USB Key, and is not output to the USB Key, and the public key is transmitted by the USB Key. To the CA Certification Center, a digital certificate produced by the CA Certification Center is posted on the Internet and entered into the USB Key for inquiry. Both the public key and the private key can encrypt the information and inverse each other. In the process of authentication, the control host provides the holder with a piece of information asking the holder to encrypt the information with a private key. After obtaining the information encrypted by the private key, the control host queries the CA certificate authority for the public key of the holder, decrypts the encrypted information with the public key, and compares the decrypted information with the original information. If they are consistent, the identity of the holder can be determined.

First, online banking users must personally go to the bank counter to verify their identity documents, collect the private key carrier, and apply for a bank card and digital certificate. The private key carrier is commonly used in CD-ROM, hard disk and USB Key, etc., which is loaded with the user's private key and information related to the public key in X.509 format: Due to the proliferation of spyware such as Trojans, most PCs are In a very insecure state, the private key stored on the hard disk is very easy to be stolen, which directly threatens the user's funds security. It is also insecure to use a CD or a general USB flash drive to store the private key, because the private key loaded in it must be read into the hard disk for encryption calculation. This process can easily cause the private key to be compromised. The best carrier at present is the USB Key. The shape of the USB Key is like a USB flash drive. In addition to a certain amount of storage space, there is also a computing chip. The work of encrypting with the private key is all done inside the USB Key, and the private key is not compromised.

The convenience of online banking will surely attract a large number of users to start using the USB Key. When the user already has a USB Key and associates the USB Key with the bank card, directly using the USB Key to operate on the bank POS machine becomes a It’s a logical thing. ' Invention content

In view of the above drawbacks of the prior art, the technical problem to be solved by the present invention is to provide a digital authentication control method.

It is still another object of the present invention to provide an automated teller machine with a USB interface that applies the method of the present invention.

It is still another object of the present invention to provide a POS with a USB interface to which the method of the present invention is applied Machine terminal.

In order to achieve the above object, the present invention provides a USB digital authentication control method, which is a method for controlling a working host by using a digital certificate, and the working host realizes a communication connection with an external USB Key through a USB interface, and the control method includes The following steps:

Step 1 , the external USB key is inserted into the USB interface of the working host by the holder, and the interface circuit of the USB interface sends a signal to the controller of the working host;

Step 2: The controller sends a string of random plaintext, and requests encryption by using the USB interface to the USB key.

Step 3: The USB Key encrypts the random plaintext to generate a ciphertext, and sends the ciphertext and the digital certificate in the X.509 format to the controller through the interface circuit.

Step 4: The controller finds a corresponding CA authentication center through the internetwork according to the digital certificate, and verifies and extracts a corresponding public key.

Step 5: The controller decrypts the ciphertext by using the public key to generate a decrypted plaintext, and compares the decrypted plaintext with the random plaintext;

Step 6: When the comparison result of the decrypted plaintext and the random plaintext is consistent, proceed to step VII;

When the comparison result of the decrypted plaintext and the random plaintext is inconsistent, the controller will refuse to accept further instructions issued by the holder;

Step 7: The controller obtains, by the bank system host that is in communication with the working host, the bank account related information associated with the digital certificate by the holder for the holder to operate.

Preferably, in the step 6, when the comparison result of the decrypted plaintext and the random plaintext is consistent, the following steps are performed:

First, the controller prompts the holder to input a password through a keyboard;

Secondly, the password is input through the keyboard and directly enters a hardware encryption card to encrypt; then, the controller inputs the encrypted password into the USB KEY through the USB interface, and stores the password in the The passwords in the USB KEY are compared; When the password comparison result is consistent, proceed to step VII;

When the password comparison result is inconsistent, the controller will refuse to accept further instructions from the holder.

Preferably, the working host is an automatic teller machine or a POS machine terminal.

The invention also provides an automatic teller machine applying the digital authentication method of the invention, comprising an automatic teller machine host communicatively connected with a bank system host; a keyboard for inputting a password;

The USB interface is also connected to the USB key, and the USB interface is electrically connected to the ATM through a USB interface circuit to implement a communication connection between the ATM and the USB Key.

The ATM machine obtains a digital certificate loaded in the USB Key through a communication connection between the USB interface and the USB Key, and then verifies the digital certificate through the Internet to the CA certification center; The teller machine host accepts the password through the keyboard and verifies the password; when the digital certificate and the password are verified, the ATM permits the USB Key holder to conduct a transaction on its bank account.

The automatic teller machine of the present invention has a USB interface. When using the digital certificate loaded in the USB Key for the ATM operation, the user only inserts the USB Key into the USB interface of the automatic teller machine, and then enters a password according to the prompt to meet the requirements of the two-factor authentication. , then select the bank card or bank account associated with the digital certificate to make the transaction you want. The difference between using the USB Key for ATM operation is that a USB Key can be associated with an unlimited number of accounts and bank cards, enabling a USB Key to manage all bank accounts. The automatic teller machine with USB interface of the present invention has good convenience and safety.

The present invention also provides a POS machine terminal to which the digital authentication method of the present invention is applied, comprising a controller communicatively coupled to a bank system host; a keyboard for inputting a password;

The USB interface is further connected to the USB key, and the USB interface is electrically connected to the controller through a USB interface circuit to implement a communication connection between the bank POS terminal and the USB Key;

The bank POS terminal obtains the communication connection with the USB Key through the USB interface a digital certificate carried in the USB Key, and then verifying the digital certificate through the internetwork to the CA certificate authority; and the bank POS terminal accepts a password through the keyboard and verifies the password; When the certificate and the password are both verified, the bank POS terminal permits the USB Key holder to conduct a transaction on its bank account.

The bank POS terminal of the present invention has a USB interface. When the digital certificate loaded in the USB Key is used for the operation on the POS terminal, the user only inserts the USB Key into the USB interface on the POS terminal, and then inputs according to the prompt of the terminal. The password, which meets the requirements for two-factor authentication, then selects the bank card or bank account associated with the digital certificate to conduct the desired transaction. The difference between using the USB Key for P0S operation is that a USB Key can be associated with countless accounts and bank cards, and a USB Key can be used to manage the consumption of all bank accounts, so that the bank POS terminal with USB interface of the present invention has Good convenience and safety.

The concept, the specific structure, and the technical effects produced by the present invention will be further described in conjunction with the accompanying drawings in order to fully understand the objects, features and effects of the invention. DRAWINGS

Fig. 1 is a block diagram showing the structure of a bank POS terminal to which the method of the present invention is applied.

2 is a schematic view showing the structure of an automatic teller machine to which the method of the present invention is applied. detailed description

As shown in Fig. 1, the bank POS terminal of the present invention performs the identity verification of the payer by means of a digital certificate. The user can perform a series of operations such as consumption, pre-authorization, and pre-authorization completion on the P0S terminal with USB interface through the USB Key loaded with the digital certificate.

The structure, use method and beneficial effects of the bank POS terminal of the present invention will be described below with reference to the accompanying drawings. The bank POS terminal with USB interface of the invention comprises: a controller connected to the bank system host for inputting a PIN pad; the keyboard is connected with the controller signal through a hardware encryption card. The USB interface is also connected to the USB Key, and the USB interface is electrically connected to the controller through a USB interface circuit to implement a communication connection between the bank POS terminal and the USB Key. The specific application of the method of the present invention is described below by the application steps of the bank POS terminal with a USB interface:

(1) When the terminal user of the P0S machine inserts the USB interface into the USB interface and requires identity authentication, the interface circuit of the USB interface sends a signal to the controller of the P0S machine to inform someone to request authentication;

(2) The controller sends a string of plaintext via the USB interface to request the user's USB Key encryption;

(3) After encrypting the plaintext by the USB Key, the ciphertext and the digital certificate in the X.509 format are sent to the controller through the interface circuit;

(4) The controller finds the relevant CA certification center through the Internet according to the digital certificate in the X.509 format, and verifies and extracts the public key;

(5) The controller decrypts the ciphertext by using the public key and compares it with the original plaintext;

(6) If the plaintext and the decrypted ciphertext are inconsistent, the controller can confirm that the USB Key is forged and does not belong to the holder contained in the digital certificate, and the controller will refuse the user to continue the operation;

(vii) If the plaintext and the decrypted ciphertext are identical, the controller can confirm that the USB Key is not forged and indeed belongs to the holder contained in the digital certificate;

(8) The controller will prompt the holder to enter the password through the keyboard;

(9) After the user enters the password through the keyboard, the password directly enters the hardware encryption card to encrypt; (10) The controller inputs the encrypted password into the USB KEY through the USB interface, and stores it in

The passwords in the USB KEY are compared;

(11) If the passwords are the same, you can confirm that the person who currently holds the USB Key is the holder of the digital certificate, not the other person who steals the USB Key;

(12) The controller will obtain the bank account related information related to the holder through the digital certificate through the bank system host for the user to operate;

(13) If the passwords are inconsistent, you can confirm that the current USB Key user is stealing the USB Key, and the controller will refuse to access the USB Key holder's account.

As shown in FIG. 2, the automatic teller machine applying the method of the present invention performs the identity verification of the depositor through the digital certificate. Bank users can use USB key with USB certificate loaded with digital certificate The ATM performs deposit, withdrawal, transfer, payment and other operations.

The structure, method of use, and advantageous effects of the automatic teller machine of the present invention will be described below in conjunction with the drawings. The automatic teller machine with USB interface of the present invention comprises: an automatic teller machine host communicatively connected with the bank system host; a keyboard for inputting a password; the keyboard is connected to the controller signal through a hardware encryption card. The USB interface is further connected to the USB key through a USB interface circuit to electrically connect the ATM to the USB Key.

The specific application of the method of the present invention is illustrated below by the application steps of an automated teller machine with a USB interface:

(1) When the ATM user inserts the USB interface into the USB interface and requires identity authentication, the interface circuit of the USB interface sends a signal to the ATM of the ATM to inform someone that authentication is required;

(2) The ATM machine will send a string of plain text to the holder's USB Key encryption via the USB interface;

(3) After encrypting the plaintext by the USB Key, the ciphertext and the digital certificate in the X.509 format are sent to the automatic teller machine through the interface circuit;

(4) The ATM machine finds the relevant CA certificate center through the Internet based on the digital certificate in the X.509 format, and verifies and extracts the public key;

(5) The ATM machine uses the public key to decrypt the ciphertext and compare it with the original plaintext;

(6) If the plaintext and the decrypted ciphertext are inconsistent, the ATM machine can confirm that the USB Key is forged, not the holder contained in the digital certificate, and the ATM host will reject the user access;

(vii) If the plaintext and the decrypted ciphertext are identical, the ATM machine can confirm that the USB Key is not forged, and indeed belongs to the holder contained in the digital certificate;

(8) The ATM machine will prompt the holder to enter the password through the keyboard;

(9) After the holder enters the password through the keyboard, the password directly enters the hardware encryption card to encrypt; (10) The ATM machine sends the encrypted password to the USB KEY through the USB interface. Make comparisons;

(12) The ATM machine host will obtain the bank account related information associated with the holder through the digital certificate through the bank system host for the user to operate;

(13) If the passwords are inconsistent, you can confirm that the current USB Key user is stealing the USB Key, and the ATM machine will refuse to access the USB Key holder's account.

In the above description, the present invention has been described in terms of several preferred embodiments of the present invention. The above embodiments are merely illustrative of the technical solutions of the present invention. Any technical solution that can be obtained by a person skilled in the art based on the prior art based on the prior art by logic analysis, reasoning or limited experimentation should be within the scope of the claims of the present invention.

Claims

Claim

A USB digital authentication control method is a method for controlling a working host by using a digital certificate, wherein the working host realizes a communication connection with an external USB Key through a USB interface, and the control method includes the following steps:

Step 1: The external USB key is inserted into the USB interface of the working host by the holder, and the interface circuit of the USB interface sends a signal to the controller of the working host;

2. The USB digital authentication control method according to claim 1, wherein: in the step 6, when the comparison result of the decrypted plaintext and the random plaintext is consistent, the following steps are performed: First, the The controller prompts the holder to input a password through a keyboard;

Second, the password is input through the keyboard and directly enters a hardware encryption card to encrypt; then, the controller inputs the encrypted password to the USB through the USB interface. In the KEY, the password stored in the USB KEY is compared;

When the password comparison result is consistent, proceed to step VII;

The USB digital authentication control method according to claim 1 or 2, wherein the working host is an automatic teller machine or a POS machine terminal.

4. An automated teller machine applying the method of any one of claims 1 to ₃ , comprising an automated teller machine host communicatively coupled to a bank system host; a keyboard for entering a password; characterized by:

5. A POS terminal for applying the method of any one of claims 1 to 3, comprising: a controller communicatively coupled to the bank system host; a keyboard for entering a password; characterized by:

The bank POS terminal obtains a digital certificate loaded in the USB Key through a communication connection between the USB interface and the USB Key, and then verifies the digital certificate through the internetwork to the CA certification center; The bank POS terminal accepts the password through the keyboard and verifies the password; when the digital certificate and the password pass the verification, the bank POS terminal grants the USB Key holder to its bank account Trading.