WO2010003283A1 - Network interaction method, system and safety apparatus thereof - Google Patents

Abstract

A network interaction method, system and safety apparatus thereof are provided, the method includes the following steps: a user terminal receives the operation content inputted by a user; a safety apparatus obtains the operation content; the safety apparatus processes the operation content, generates the verify cryptograph for verification; the user terminal obtains the verify cryptograph; the user terminal sends the operation content and the verify cryptograph to a server. The method can prevents Trojan horses from achieving its assailant purpose in manner of tampering or fabricating the operation content, thereby a safer solution is provided, the safety level of the network application system is improved, and the network application field is extended.

Description

 Network interaction method, system and security device thereof

 The invention relates to a network interaction technology between a client and a network server, in particular to a network interaction method, a system and a security device thereof for preventing a Trojan from attacking by means of tampering and forgery when a Trojan exists. BACKGROUND OF THE INVENTION Due to the convenience of networks, network-based application systems, such as online banking, securities, and online games, are playing an increasingly important role in production and life. However, due to the characteristics of the network, the security of network communication has become an important issue.

 The security focus of network communication lies in the identity authentication and information encryption of the interaction process. There are a variety of security technologies to choose from during this process. For example, fingerprint authentication technology for identity authentication, e-Cert technology, and the like. There are encryption algorithms such as AES, 3DES. The application of these technologies creates a rigorous cryptosystem that protects the entire interaction process. Although it is easy to intercept this information over the network, it is difficult to know and tamper with its contents because it does not know the key. In general, directly cracking a cryptosystem is not worth the loss. Therefore, the attacker takes the vulnerability of finding the system and attacks.

 Currently, the common attack method is to use Trojans to steal and tamper with sensitive information. This method of attack differs from direct cracking in that it steals authentication information or tampers with interactive content as an attack, bypassing the protection of the password system.

 The initial system login uses a static password, so the Trojan only needs to monitor the keyboard to steal the user login password. In this case, in order to prevent Trojan attacks, the application of soft keyboard, random verification code, dynamic password authentication technology and e-Cert and other security technologies make this type of Trojan attack difficult to work, it is difficult to achieve the purpose of attack by simply intercepting information. . Therefore, the technology using the Trojan attack in the related art has gradually turned into tampering or falsifying communication content. The manner in which Trojans falsify or falsify communication contents will be described below with reference to the drawings.

Figure 1 is a flow chart of normal operation between the client and the server. As shown in FIG. 1, the client operating system receives the operation content input by the user through the mouse or the keyboard (see step 11), the operating system The operation content is delivered to the client software (see step 12), the client software encrypts the operation content (see step 13), and then passes the encrypted operation content to the server (see step 14).

 It can be seen from the above that step 12 "the operating system transmits the user's operation content to the client software" is a vulnerable link. Trojans can attack this link, bypassing the protection of existing security technologies. That is, the Trojan can be used to host the client host, intercept the user operation, and tamper with the operation content; some Trojans even pretend that the client actively completes the operation scheduled by the attacker, so that the client host of the Trojan is implanted, and the user operates the content. It is difficult to pass to the client software safely.

 Example 1, Figure 2 is a flow chart of the Trojan monitoring keyboard and mouse. When the Trojan is implanted on the client host, monitor the keyboard and mouse, and get the operation content before the client software. Some attackers will add a shell based on the real client software, and then trick the user into downloading. The design idea of the modified client software is the same as this example, the only difference is that the method of intercepting the mouse keyboard is different). As shown in Figure 2, the operation content received by the client software is tampering or forged operation content. No matter how advanced the security technology used in step 25 is, it cannot achieve a defense effect.

 Example 2, Figure 3 is a flow chart of the Trojan forgery operation content, the virtual user operating the mouse and the keyboard. As shown in Figure 3, it is difficult for the client software to determine whether the real user is operating or whether the Trojan is operating.

 Example 3, Figure 4 is a flow chart of the Trojan embedding client software intercepting the user's operation content. For some complex client software (such as online game client software), the Trojan also uses the method of embedding the client software to intercept and tamper with the user's operation content, thereby achieving illegal purposes.

 It can be seen from the above that in order to remove Trojans and protection systems, the following commonly used schemes are as follows: Type: Use anti-virus software to kill Trojans. Although the use of anti-virus software is the most effective means of removing viruses and Trojans, it does not guarantee that there is no Trojan in the operating system on the client. The most important reason is that the new Trojans are appearing and spreading too fast. For example, new Trojans appear every day, and it is difficult for anti-virus software to remove Trojans before the virus database is upgraded. Web applications such as e-mail, MSN and QQ communication tools and BBS forums make Trojans spread very fast; many users have anti-virus installed on their hosts. Software, but ignores the virus database update, anti-virus software automatically updates the virus interval is too long; Trojan can forge user operations, proactively turn off the protection of anti-virus software, and even cause anti-virus software to lose functionality.

And for sensitive, economically valuable targets, the Trojan can cause great losses as long as it succeeds. Therefore, we need to find another way to completely solve the threat of Trojans. Second: Adopt various types of authentication and encryption security products. For the local security of the client, at present, these security technologies only have a few technologies such as a soft keyboard, a verification code or a client software embedding Trojan scanning module. among them,

 A soft keyboard is a technology that provides a password for entering with a mouse. Specifically, a random keyboard is formed on the screen, and then the keyboard is clicked to complete the password input. Because the password input is done by the mouse, it is difficult for the Trojan to steal the keyboard message and steal the password.

 A verification code is a technique for preventing brute force. A string of characters displayed by the picture is provided on the login interface, and then the user is required to input the characters. When logging in, the server first verifies that these characters are correct (some systems are self-verified by the client software, and the defense effect is much worse). Because the characters displayed in the picture are generally distorted, and they are all reflected in the background of irregular lines. Therefore, these characters are difficult to be automatically recognized from the picture by the program. If used properly, the Trojan has a certain defense effect. . For example, if this technology is extended to critical business operations and supported by captcha technology, the spoofing behavior of the trojan will be greatly limited by forging the content of the operation.

 The client software embedding Trojan scanning module actually integrates a Trojan killing tool into the client software. Its principle of killing Trojans is the same as anti-virus software, and can be seen as a streamlined version of its anti-virus software.

 In addition, e-Cert technology and dynamic password technology can defend against the attacking behavior of Trojans that steal user passwords.

 However, most of the above technologies are directed to the user's login process and have a certain defense effect. For the security problem when the user operates, it is difficult to defend, especially for the Trojan that intercepts the user's operation content as the main attack means, the defense effect is not good. The following examples are given.

 Figure 5 is a flow diagram of normal interaction between the client and the server. Figure 6 is a flow chart of the Trojan implanted in the client preemptively obtaining the content of the operation by the client software, then tampering with the content of the operation and then sending it to the client software. As shown in Figure 6, during the entire interaction, the Trojan completely bypasses the protection of the cryptosystem formed by various security technologies.

Third: Install the firewall on the client to prevent unauthorized network access by setting a firewall policy. Figure 7 is a flow chart of using a firewall to defend against Trojans. Among them, the Trojan's theft of the username and password must be passed to the attacker, and then the attacker can use the stolen username and password to impersonate the legitimate user to log in to the system to complete the illegal purpose. Therefore, the stolen username password must be sent to the attacker via the network through the Trojan to complete the attack process completely. When a reasonable firewall policy is configured, the communication process between the Trojan and the outside world is blocked, thereby blocking the attack process and recovering the loss.

 However, using the personal version of the firewall to defend against Trojan attacks has many limitations. The main disadvantages are as follows: Trojans that are completely unable to defend against tampering or forgery of user operations are the main means of attack; The default firewall policy is too loose and has many loopholes. The configuration of the firewall requires professional knowledge, which can be completed by non-ordinary users; Trojans can communicate by changing the communication port, embedding or fraudulently using the authorized program; Trojans can forge user operations, proactively turn off the protection of personal firewalls, and even cause personal firewalls to be lost. Features.

 An invention patent application having the application number of 200610149618. X, the disclosure of which is incorporated herein by reference. Summary of the invention

 The object of the present invention is to provide a network interaction method, which uses a security device to let a user determine whether the operation content is correct, and if it is correct, processes the operation content to prevent the Trojan from tampering or forging the operation content to achieve the purpose of attack, thereby Provide a more secure solution, improve the security level of network application systems, and expand the scope of network applications.

 The object of the present invention is also to provide a network interaction system, which uses the security device to process the operation content to prevent the Trojan from tampering or forging the operation content to achieve the purpose of attack, thereby providing a more secure solution and improving安全 The security level of the network application system has expanded the scope of network applications.

 It is also an object of the present invention to provide a security device that processes the content of the operation such that the content of the operation is not entered by the client to prevent the Trojan from tampering or forging the content of the operation for attack purposes.

Another object of the present invention is to provide a network interaction system, which uses a security device to confirm the correctness of operation content and process the operation content, so as to prevent the Trojan from tampering or forging the operation content to achieve the purpose of attack, thereby Provides a more secure solution, increases the security level of network application systems, and expands the scope of network applications. The object of the present invention is also to provide a security device, which can display the operation content, so that the user can confirm whether the operation content is correct through the display, and if it is correct, the operation content is processed to prevent the Trojan from tampering or forging. The way the content is manipulated achieves the purpose of the attack.

 The object of the present invention is to provide a network interaction method, which uses a security device to input operation content, so as to prevent the Trojan from tampering or forging the operation content to achieve the purpose of attack, thereby providing a more secure solution and improving the network application. The security level of the system expands the range of network applications.

 It is also an object of the present invention to provide a network interaction system that provides security by inputting operational content and processing the operation content by using a security device to prevent the Trojan from tampering or forging the operation content to achieve an attacking purpose. The solution has improved the security level of network application systems and expanded the scope of network applications.

 It is also an object of the present invention to provide a security device that can input an operation content and process the operation content such that the operation content is not input by the client, so as to prevent the Trojan from tampering or forging the operation content to achieve the purpose of attack. .

 In order to achieve the above object, the present invention provides a network interaction method, the method includes: a client receiving an operation content input by a user; a security device acquiring the operation content; and the security device processing the operation content to generate Verifying the ciphertext of the verification; the client obtains the verification ciphertext; the client sends the operation content and the verification ciphertext to the server through the network.

 To achieve the above object, the present invention further provides a network interaction system, the system further comprising a client and a security device; wherein

 a client, configured to receive an operation content input by a user;

 a security device, configured to acquire the operation content, process the operation content, generate and display a verification ciphertext;

 And the client is further configured to obtain the verification ciphertext, and send the operation content and the verification ciphertext to the server through a network.

 To achieve the above object, the present invention provides a security device, the security device comprising: an input unit, the input unit is configured to input the operation content by a client user; and the processing unit is configured to input the The operation content is processed to generate a verification ciphertext for verification;

a conversion unit, configured to convert the verification ciphertext into an inputtable character; a display unit, wherein the display unit is configured to display the converted verification ciphertext. In order to achieve the above object, the present invention further provides a network interaction system, which includes a client and a security device;

 a client, configured to receive the operation content input by the user, and transmit the operation content to the security device, and receive the verification ciphertext transmitted by the security device, and send the operation content and the verification ciphertext to The server;

 a security device, configured to receive the operation content transmitted by the client, display the operation content, and determine whether the client user confirms the operation content, and if the determination result is yes, the security device performs the operation The content is processed, a verification ciphertext for verification is generated, and the generated verification ciphertext is transmitted to the client.

 In order to achieve the above object, the present invention further provides a security device, the security device comprising: a receiving unit, the receiving unit is configured to receive the operation content transmitted by a client, and a display unit, the display unit is configured to display the Operational content;

 a judging unit, configured to determine whether the client user confirms the operation content; and the processing unit, if the judgment result of the judging unit is yes, the processing unit is configured to process the operation content, generate Verification ciphertext for verification;

 a sending unit, configured to transmit the verification ciphertext to the client.

 To achieve the above objective, the present invention provides a network interaction method, the method comprising: obtaining, by a security device, operation content; the security device processing the operation content, generating a verification ciphertext for verification; the security The device transmits the operation content and the verification ciphertext to the client; the client sends the operation content and the verification ciphertext to the server.

 In order to achieve the above object, the present invention further provides a network interaction system, the system includes a server, and the system further includes a client and a security device;

 The security device is configured to receive an operation content input by a user, process the operation content, generate a verification ciphertext for verification, and transmit the operation content and the verification ciphertext to the client ;

 The client is configured to receive the operation content and the verification ciphertext transmitted by the security device, and send the operation content and the verification ciphertext to the server through a network.

To achieve the above object, the present invention further provides a security device, the security device comprising: an input unit, the input unit is configured to input the operation content by a client user; and the processing unit is configured to input the The operation content is processed to generate a verification ciphertext for verification; And a sending unit, configured to send the operation content and the verification ciphertext to the client.

 The present invention has an advantageous effect in that the present invention encrypts the operation content using the security device or displays the operation content using the security device, so that the Trojan cannot intercept and tamper the content before the security device displays the content, otherwise the user can detect it. Therefore, the Trojan can only perform blocking attacks at most, and cannot attack with a simple bypass. Blocking attacks can cause users to use the application system at the most, without causing direct loss to the user. There is no benefit to the attacker, thus avoiding user losses, providing a more secure solution and improving the network application system. The level of security has expanded the range of network applications. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in the claims In the drawing

 Figure 1 is a flow chart of normal operation between the client and the server;

 2 is a flow chart showing the operation of the Trojan tampering operation content implanted in the client host;

 3 is a flow chart showing the operation of the Trojan forgery operation content implanted in the client host;

 Figure 4 is a flow chart showing the operation of the Trojan tampering operation content embedded in the client software;

 Figure 5 is a flow chart of normal interaction between the client and the server;

 6 is an interactive flow chart of tampering with the content of the operation by the Trojan implanted in the client;

 Figure 7 is a flow chart of using a firewall to defend against Trojans;

 8 is a schematic structural diagram of a network interaction system according to Embodiment 1 of the present invention;

 Figure 9 is a schematic view showing the structure of the security device of Figure 8;

 Figure 10 is a schematic diagram of the structure of the client in Figure 8;

 Figure 11 is a schematic view showing the structure of the server in Figure 8;

 12 is a schematic structural diagram of a network interaction system according to Embodiment 2 of the present invention;

 Figure 13 is a schematic view showing the structure of the security device of Figure 12;

 Figure 14 is a schematic view showing the structure of the client in Figure 12;

 15 is a schematic structural diagram of a network interaction system according to Embodiment 3 of the present invention;

 Figure 16 is a schematic view showing the structure of the security device of Figure 15;

Figure 17 is a schematic view showing the structure of the client in Figure 15; 18 is a flow chart of a network interaction according to Embodiment 4 of the present invention;

 Figure 19 is a flow diagram of one embodiment of steps 1807 and 1807 of Figure 18; Figure 20 is a flow diagram of another embodiment of steps 1807 and 1807 of Figure 18; Figure 21 is a representation of steps 1811 and 1812 of Figure 18 Figure 22 is a flow chart of another embodiment of steps 1811 and 1812 of Figure 18; Figure 23 is a flow chart of network interaction of Embodiment 5 of the present invention;

 Figure 24 is a flow chart of the network interaction of the sixth embodiment. BEST MODE FOR CARRYING OUT THE INVENTION In order to make the objects, technical solutions and advantages of the present invention more comprehensible, the present invention will be further described in detail below with reference to the embodiments and drawings. The illustrative embodiments of the present invention and the description thereof are intended to explain the present invention, but are not intended to limit the invention.

 The invention provides a network interaction method, system and security device thereof. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

 Example 1

 The network interaction system of the present invention, as shown in FIG. 8, the system includes a server 803, and the system further includes a client 801 and a security device 802; wherein the client 801 is configured to receive operation content input by the user; The device 802 is configured to acquire the operation content, process the operation content, generate a verification ciphertext for verification, and display the verification ciphertext; the client 801 is further configured to acquire the school generated by the security device 802. The ciphertext is verified, and the operation content and the verification ciphertext are sent to the server through the network.

 Figure 9 is a schematic diagram showing the structure of the security device of Figure 8. As shown in FIG. 9, the security device includes: an input unit 901, a processing unit 902, a conversion unit 904, and a display unit 903; wherein the input unit 901 is configured to input operation content for a client user; the processing unit 902 is configured to The operation content input by the input unit 901 is processed to generate a verification ciphertext for verification; the conversion unit 904 is configured to convert the verification ciphertext into an inputtable character; the display unit 903 is configured to display the converted ciphertext Verify the ciphertext.

In the present embodiment, the operations of the input unit 901, the processing unit 902, and the display unit 903 are controlled by the CPU. The processing unit 902 can process the operation content in the following manner: using an encryption key, according to a certain encryption protocol and an encryption algorithm The operation is performed to generate a verification ciphertext for encryption.

 In the present embodiment, the conversion unit 904 converts the generated verification ciphertext into a character that can be input by using a certain character conversion rule. But it is not limited to this.

 As can be seen from the above, the security device 802 can be disconnected from the client 801. The user 801 uses the input unit 901 of the security device 802 to input the operation content, and the user can also display the conversion of the display unit 903 of the security device 802. The latter verification ciphertext is input to the client 801.

 Figure 10 is a schematic diagram of the structure of the client in Figure 8. As shown in FIG. 10, the client 801 includes a first input unit 1001 and a first sending unit 1003;

 The first input unit 1001 is configured to input the operation content and the verification ciphertext by the client user; the first sending unit 1003 is configured to transmit the operation content and the verification ciphertext transmitted by the first input unit 1001 to the server 803.

 Figure 11 is a block diagram showing the structure of the server of Figure 8. As shown in FIG. 11, the server 803 includes a second receiving unit 1101 determining unit 1103, an operating unit 1104, and a second sending unit 1105. The second receiving unit 1101 is configured to receive the operation content and checksum transmitted by the client 801. The ciphering unit 1103 is configured to determine whether the operation content matches the verification ciphertext; when the determination result of the determination unit 1103 is YES, the operation unit 1104 is configured to perform a corresponding operation according to the acquired operation content; The two transmitting unit 1105 is configured to transmit the operation result to the client 801.

 In addition, as shown in FIG. 10, the client 801 may further include a first encryption unit 1002 for encrypting the operation content and the verification ciphertext, and then encrypting by the first sending unit 1003. The subsequent operation content and the verification ciphertext are transmitted to the server 803, which further ensures the security of the transmitted data. Correspondingly, as shown in FIG. 11, the server 803 further includes a second decryption unit 1102, configured to decrypt the received encrypted operation content and the verified ciphertext to obtain the operation content and the school. Check the ciphertext.

The determining unit 1103 determines whether the operation content and the verification ciphertext match, that is, the legality of the data is determined, and the following manner may be adopted: the determining unit 1103 processes the received operation content, and the processing is performed on the security device. The processing performed in 802 is the same, that is, the same encryption algorithm and encryption protocol as the security device 802 are used to generate the verification ciphertext, and then the generated verification ciphertext is performed with the verification ciphertext received from the client 801 through the network. Comparing, judging whether the generated verification ciphertext is the same as the received verification ciphertext, if the same, the operation content is legal, and the verification ciphertext matches the operation content, and is not tampered or forged by the Trojan; otherwise, it is considered that there is a Trojan, Returning customers for illegal data End 801.

 Therefore, in the above manner, the server 803 finds that the operation content does not match the verification ciphertext, and the attacker does not know the encryption key used by the security device, thereby preventing the attacker from constructing the operation content and verifying the ciphertext. Further ensure network interaction security.

 As shown in FIG. 10, the client 801 further includes a first receiving unit 1004 and a first display unit.

1006. The first receiving unit 1004 is configured to receive an operation result transmitted by the server 803. The first display unit 1006 is configured to display the operation result.

 In addition, the server 803 can encrypt the operation result before returning the operation result to the client 801. After the client 801 receives the operation result, the operation result is decrypted and displayed. Therefore, the server 803 further includes a second encryption element 1106, the second encryption element 1106 is used to encrypt the operation result, and the encrypted operation result is transmitted to the second sending unit 1105;

 Correspondingly, the client 801 further includes a first decryption unit 1005 for decrypting the encrypted operation result and then sending it to the second display unit 1006 for display.

 It can be seen from the above that the system can complete the input and encryption processing of the operation content by using the security device 802. Although the Trojan can modify or forge the operation content in the plaintext form on the client, it cannot prevent the user from inputting the correct operation content on the security device. It is also impossible to enter tampering or forgery of the operation content on the security device. Therefore, the verification ciphertext corresponding to the falsified or forged operation content cannot be obtained. Therefore, the verification cannot be passed on the server. Therefore, it can avoid unnecessary loss to the user and ensure the security of the network interaction, thereby providing a more secure solution, improving the security level of various network application systems, and expanding the network application range.

 In the above embodiment, the security device 802 can be used alone or integrated on an existing portable device, such as the security device 802 implemented by a mobile phone.

 Example 2

 The present invention also provides a network interaction system, as shown in FIG. 12, the system includes a server.

1203, further comprising a client 1201 and a security device 1202; wherein

 The client 1201 is configured to receive the operation content input by the user, and transmit the operation content to the security device 1202, and receive the verification ciphertext transmitted by the security device 1202, and send the operation content and the verification ciphertext to the server. 1203;

The security device 1202 is configured to receive the operation content transmitted by the client 1201, display the operation content, determine whether the client user confirms the operation content, and if the determination result is yes, the security device The full device 1202 processes the operation content, generates a verification ciphertext for verification, and transmits the generated verification ciphertext to the client 1201.

 It can be seen from the above that if the Trojan modifies or falsifies the operation content before the security device 1202 obtains the operation content, the user can detect and block the operation content that the user confirms (the operation content is already inside the security device 1202, the Trojan cannot be modified) And matching with the encrypted ciphertext returned by the security device 1202, because the trojan cannot obtain the matching ciphertext, the trojan cannot return the ciphertext after the security device 1202 returns. Modify the content of the operation. Therefore, unnecessary loss to the user can be avoided, and the security of the network interaction is ensured.

 Different from Embodiment 1, in the present embodiment, the security device 1202 and the client 1201 are connected to each other, and information can be transmitted by wire or wirelessly.

 Figure 13 is a schematic illustration of the configuration of the security device of Figure 12. As shown in FIG. 13, the security device 1202 includes a receiving unit 1301, a display unit 1302, a determining unit 1303, a processing unit 1304, and a sending unit 1305. The receiving unit 1301 is configured to receive an operation content transmitted by the client 1201. The unit 1302 is configured to display the operation content. The determining unit 1303 is configured to determine whether the client user confirms the operation content. If the determination result of the determination unit 1303 is YES, the processing unit 1304 is configured to process the operation content. A verification ciphertext is generated for verification; the sending unit 1305 is configured to transmit the verification ciphertext to the client 1201.

 In addition, the security device 1202 further includes an input unit 1306, which can also be used for the user to input information confirming the content of the operation.

 It can be seen from the above that after the security device 1202 receives the operation content transmitted by the client 1201, the operation content is displayed. At this time, the user can confirm whether the operation content is incorrect according to the display of the display unit 1302 of the security device 1202. If the error is determined, the confirmation unit 1306 of the security device 1202 can confirm the operation. If the determination unit 1303 determines that the user has confirmed the operation content, the processing unit 1304 of the security device 1202 processes the operation content. The processing result is transmitted to the client 1201. If the user confirms that the operation content is incorrect, the cancel button set in the input unit 1306 is passed. Therefore, if the Trojan modifies or falsifies the operation content before the security device 1202 obtains the operation content, the user can detect and block it.

 Figure 14 is a block diagram showing the structure of the client in Figure 12. As shown in FIG. 14, the client includes a first input unit 1401, a first sending unit 1402, and a first receiving unit 1403;

The first input unit 1401 is configured to input, by the client user, the operation content; the first sending unit 1402 is configured to send the operation content to the security device 1202; the first receiving unit 1403 is configured to receive the security device 1202 to transmit the verification ciphertext; and the first sending unit 1402 is further configured to use the operation content and the verification ciphertext Transfer to server 1203.

 In addition, as shown in FIG. 14, the client 801 may further include a first encryption unit 1404 for encrypting the operation content and the verification ciphertext, and then encrypting by the first sending unit 1402. The subsequent operation content and the verification ciphertext are transmitted to the server 1203, which further ensures the security of the transmitted data.

 The configuration of the server 1203 is similar to that of the embodiment 1, as shown in FIG. 12, and details are not described herein again. Correspondingly, the client 1201 may further include a first decryption unit 1405 and a first display unit 1406, and its function is similar to that of Embodiment 1, and details are not described herein again.

 It can be seen from the above that if the Trojan modifies or falsifies the operation content before the security device 1202 obtains the operation content, the user can detect and block the content; and the operation content confirmed by the user is matched with the encryption process returned by the security device 1202. After the ciphertext is verified, the Trojan cannot modify the operation content after the security device 1202 returns the verification ciphertext. Otherwise, the server 1203 may find that the operation content does not match the verification ciphertext and the operation content. The attacker does not know the encryption key used by the security device 1202, so the operation content and the verification ciphertext pair cannot be constructed by itself, thereby ensuring security.

 In the above embodiment, the security device 1202 can be used alone or integrated in an existing portable device, such as a USB encryption device for electronic certificate calculation or a human biometric authentication device, such as fingerprint authentication and iris authentication. The device or the like is implemented. In this case, after the security device 1202 displays the operation content and the user confirms, the human biometric authentication device can be used to confirm the operation content, for example, using human biometrics such as fingerprints and irises. Accordingly, the input unit 1306 in the security device 1202 can be a key input unit, a human biometric authentication unit, or the like.

 Example 3

 The present invention also provides a network interaction system, as shown in FIG. 15, the system includes a server.

1503, further comprising a client 1501 and a security device 1502; wherein

The security device 1502 is configured to receive the operation content input by the user, process the operation content, generate a verification ciphertext for verification, and transmit the operation content and the verification ciphertext to the client 1501; the client The terminal 1501 is configured to receive the operation content and the verification ciphertext transmitted by the security device 1502, and send the operation content and the verification ciphertext to the server 1503 through the network. It can be seen from the above that the system can complete the input and encryption processing of the operation content by using the security device 1502, that is, the user does not need to input the operation content on the client human-machine interface, which is referred to herein as full hardware input. Since the user does not input the operation content on the client, the Trojan can not invade the security device content. Therefore, the Trojan can only intercept the operation content in the clear text output by the security device, but the Trojan cannot obtain the verification corresponding to the tampering or forged operation content. Ciphertext, so it cannot pass the test on the server. This avoids unnecessary losses to the user, thereby providing a more secure solution, improving the security level of various network application systems, and expanding the scope of network applications.

 Figure 16 is a block diagram showing the construction of the security device of Figure 15. As shown in FIG. 16, the security device 1502 includes: an input unit 1601, a processing unit 1602, and a sending unit 1603;

 The input unit 1601 is configured to input the operation content by the client user; the processing unit 1602 is configured to process the input operation content to generate a verification ciphertext for verification; the sending unit is configured to use the operation content and The verification ciphertext is sent to the client 1501.

 Figure 17 is a block diagram showing the configuration of the client in Figure 15. As shown in FIG. 17, the client 1501 includes a first receiving unit 1701 and a first sending unit 1702;

 The first receiving unit 1701 is configured to receive the operation content and the verification ciphertext transmitted by the security device 1502. The first sending unit 1702 is configured to transmit the operation content and the verification ciphertext to the server 1503.

 As shown in FIG. 17, the client 1501 further includes a first encryption unit 1703, where the first encryption unit 1703 is configured to encrypt the operation content and the verification ciphertext; and the first-transmission unit 1702 encrypts the encrypted content. The operation content and the verification ciphertext are transmitted to the server 1503.

 The configuration of the server 1503 is similar to that of the embodiment 1, as shown in FIG. 12, and details are not described herein again. Correspondingly, the client 1501 may further include a first decryption unit 1704 and a first display unit 1705, and its function is similar to that of Embodiment 1, and details are not described herein again.

 In the above embodiment, the security device 1202 may be used alone or integrated on an existing portable device, such as a USB encryption device for electronic certificate computing, or a mobile phone.

As can be seen from the above, the system implements full hardware input by using the security device 1502. Since the user does not input the operation content on the client, the Trojan can not invade the security device content. Therefore, the Trojan can only intercept the operation content in the clear text output by the security device, but the Trojan cannot obtain the verification corresponding to the tampering or forged operation content. Ciphertext, so it cannot pass the test on the server. This avoids unnecessary losses to the user, thus providing a more secure solution and improving each The security level of the network application system expands the scope of network applications.

 Example 4

 The present invention also provides a network interaction method, the method comprising: a client receiving an operation content input by a user; the security device acquiring the operation content; the security device processing the operation content, generating a verification ciphertext for verification The client obtains the verification ciphertext; the client sends the operation content and the verification ciphertext to the server.

 It can be seen from the above that the method uses a security device to input the operation content and encrypt the operation content to prevent the Trojan from tampering or forging the operation content to achieve the attack purpose, thereby providing a more secure solution and improving the network application system. The level of security has expanded the range of network applications.

 The method will be described in detail below with reference to Figs.

 Step 1801: The user operates on the human-machine interface of the client 801, and the operation content can be input through an input unit of the client 801, such as a keyboard or a mouse;

 Step 1802, the client 801 receives the operation content of the user;

 Step 1803, the user inputs the operation content through the input unit of the security device 802. Step 1804, the security device 802 generates a verification ciphertext for verification by using a certain encryption algorithm and an encryption protocol, and converts to a certain character conversion rule according to a certain character conversion rule. Characters can be input, and the converted check ciphertext is displayed on the display unit of the security device 802;

 Step 1805, the user inputs the converted ciphertext displayed by the security device 802 into the client 801;

 Step 1806, the client 801 transmits the operation content and the verification ciphertext to the server through the network.

803;

 Step 1807, the server 803 receives the operation content and the verification ciphertext transmitted by the client 801. Step 1808, the server 803 verifies the legality of the data, that is, verifies whether the operation content and the check ciphertext match, by using the following manner authenticating:

 The server 803 processes the received operation content by using the same encryption algorithm and encryption protocol as the security device 802, generates a verification ciphertext, and then compares the generated verification ciphertext with the received verification ciphertext. It is judged whether the generated verification ciphertext is the same as the received verification ciphertext, and if the same, the data is judged to be legal, and the received verification ciphertext matches the operation content, so that it is known whether the operation content is tampered with by the Trojan. If the generated verification ciphertext is different from the received verification ciphertext, it is considered that there is a Trojan tampering with the operation content, and it is judged that the data is illegal, and no processing is returned to the client.

Steps 1809 and 1810, if the judgment is legal, the server 803 specifies the content according to the operation content. Operation, producing an operation result;

 Step 1811, the server 803 sends the operation result to the client 801 through the network;

 Step 1812, the client 801 receives the operation result transmitted by the server 803.

 In step 1813, the client 801 displays the result of the operation.

 In the above embodiment, the security device 802 is not connected to the client 801 and can be implemented by using a mobile phone. The system performs the input and encryption processing of the operation content by using the security device 802. The server 803 verifies the validity of the operation content and the verification ciphertext, so that the server 803 finds whether the operation content and the verification ciphertext are attacks. The user constructs itself to ensure the security of network interaction, thus providing a more secure solution, improving the security level of various network application systems, and expanding the scope of network applications.

 Figure 19 is a flow diagram of one embodiment of steps 1806 and 1807 of the present invention. As shown in Figure 19, the specific implementation is as follows:

 Step 1901, the client 801 can encapsulate the operation content and the verification ciphertext into a communication package according to a public and customized network protocol.

 Step 1902, the client 801 transmits the communication packet to the server 803 through the network;

 Step 1903: After receiving the communication packet, the server 803 uses the same communication protocol as the client 801 to parse the communication packet to obtain the operation content and the verification ciphertext.

 In this embodiment, in order to further improve the security of network data transmission, before the operation content and the verification ciphertext are transmitted to the server 803 in step 1806, the operation content and the verification ciphertext may be encrypted, and then encrypted. Then transfer. Correspondingly, after the server 803 receives the operation content and the verification ciphertext, decryption is performed first, and then step 1807 is performed. Among them, the specific implementation method is shown in Figure 20:

 Step 2001, the client 801 uses the operation content and the verification ciphertext as part of the input information of one or more cryptosystems, participates in the operation of the cryptosystem, and obtains the encrypted ciphertext after the operation; in step 2002, the client 801 follows a public or customized network protocol that encapsulates the encrypted ciphertext into a communication package;

 In step 2003, the client 801 transmits the communication packet to the server 803 through the network. In step 2004, after receiving the communication packet, the server 803 analyzes the received communication packet by using the same communication protocol as the client 801. , obtaining the encrypted ciphertext;

In step 2005, the server 803 performs an inverse operation on the encrypted ciphertext corresponding to the client 801 to obtain the operation content and the verification ciphertext. 21 is a flow diagram of one embodiment of steps 1811 and 1812 of the present invention. As shown in FIG. 21, the specific implementation is as follows:

 Step 2101, the server 803 encapsulates the operation result into a communication package according to a public and customized network protocol.

 Step 2102, the server 803 transmits the communication packet to the client 801 through the network;

 Step 2103: After receiving the communication packet, the client 801 uses the same communication protocol as the server 803 to parse the communication packet to obtain an operation result.

 In the present embodiment, in order to further improve the security of the network data transmission, the server 803 encrypts the operation result before transmitting the operation result to the client 801; accordingly, the client 801 receives the operation. After the result, the result of the operation is decrypted and then displayed. Among them, the specific implementation is as shown in Figure 22:

 Step 2201: The server 803 uses the operation result as part of the input information of one or more cryptosystems, participates in the operation of the cryptosystem, and obtains the encrypted ciphertext after the operation;

 Step 2202, the server 803 encapsulates the encrypted ciphertext into a communication packet according to a public or customized network protocol.

 Step 2203, the server 803 transmits the communication packet to the client 801 through the network; Step 2204, after receiving the communication packet, the client 801 parses the received communication packet by using the same communication protocol as the server 803. , obtaining the encrypted ciphertext;

 Step 2205: The client 801 performs an inverse operation on the encrypted ciphertext corresponding to the server 803 to obtain the operation result.

 It can be seen from the above that by using the security device to process the operation content, the verification ciphertext for verification is generated, and the validity check is performed by the server, so that the Trojan can not tamper with and forge the operation content, and once the operation content is falsified, be found. Therefore, the Trojan can only perform blocking attacks at most, and cannot attack with a simple bypass. Blocking attacks can cause users to use the application system at the most, without causing direct loss to the user, and there is no benefit to the attacker.

 Example 5

 The network interaction method of the present invention will be described in detail below with reference to FIGS. 12 and 23.

 Step 2301: The user operates on the human-machine interface of the client 1201, and the operation content can be input through an input unit of the client 1201, such as a keyboard or a mouse;

Step 2302, the client 1201 receives the operation content of the user, and then transmits the operation content to the security device 1202; Step 2303, the display unit of the security device 1202 displays the content of the operation; Step 2304, the security device 1202 checks whether the content of the operation is incorrect according to the display, and if the determination is correct, the input unit of the security device 1202 confirms, after confirming The security device 1202 generates a verification ciphertext for verification by using a certain encryption algorithm and an encryption protocol, and transmits the verification ciphertext to the client 1201; in addition, it can also be performed by a human biometric method such as a fingerprint or an iris. confirm;

 Step 2305, the client 1201 transmits the operation content and the verification ciphertext to the server 1203; the steps 2306 to 2012 are similar to the steps 1807 to 1813 in FIG. 18, and are not described herein again.

 Further, in a manner as shown in Figs. 19 and 20, the client 1201 transmits the verification ciphertext and the operation content to the server 803. The server 803 can transmit the operation result to the client 801 in a manner as shown in Figs.

 It can be seen from the above that if the Trojan modifies or falsifies the operation content before the security device 1202 obtains the operation content, the user can detect and block the content; and the operation content confirmed by the user is matched with the encryption process returned by the security device 1202. After the ciphertext is verified, the Trojan cannot modify the operation content after the security device 1202 returns the verification ciphertext. Otherwise, the server 1203 may find that the operation content does not match the verification ciphertext and the operation content. The attacker does not know the encryption key used by the security device 1202, so the operation content and the verification ciphertext pair cannot be constructed by itself, thereby ensuring security.

 Example 6

 The network interaction method of the present invention will be described in detail below with reference to FIGS.

 Step 2401: The user inputs the operation content through the input unit of the security device 1502. Step 2402, the security device 1502 generates a verification ciphertext for verification by using a certain encryption algorithm and an encryption protocol.

 Step 2403, the security device 1502 transmits the verification ciphertext and the operation content to the client 1501;

 Step 2404, the client 1501 transmits the operation content and the verification ciphertext to the server 1503; the steps 2405 to 2411 are similar to the steps 1807 to 1813 in FIG. 18, and are not described herein again.

Further, in a manner as shown in FIGS. 19 and 20, the client 1201 transmits the verification ciphertext and the operation content to the server 803. In the manner shown in Figs. 21 and 22, the server 803 transmits the operation result to the client 801. It can be seen from the above that by using the security device, the input of the operation content can be completed, that is, the user does not need to input the operation content on the client human-machine interface, which we call the full hardware input here. Since the user does not input the operation content on the client, the Trojan can not invade the security device content. Therefore, the Trojan can only intercept the operation content in the clear text output by the security device, but the Trojan cannot obtain the verification corresponding to the tampering or forged operation content. Ciphertext, so it cannot pass the test on the server. This avoids unnecessary losses to the user, thereby providing a more secure solution, improving the security level of various network application systems, and expanding the scope of network applications.

 The above network interaction system and method are applicable to various application systems involving network interaction, such as online banking, securities trading, online game electronic equipment trading, enterprise key business systems, e-commerce and network payment.

 The specific embodiments of the present invention have been described in detail with reference to the preferred embodiments of the present invention. It is to be understood that the foregoing description is only The scope of the invention is to be construed as being included within the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc., are intended to be included within the scope of the present invention.

Claims

Claim

A network interaction method, the method comprising:

 The client receives the operation content input by the user;

 The security device obtains the operation content;

 The security device processes the operation content to generate a verification ciphertext for verification; the client obtains the verification ciphertext;

 The client sends the operation content and the verification ciphertext to the server.

 The method according to claim 1, wherein the obtaining, by the security device, the operating content comprises: the user inputting the operating content into the security device;

 And after generating the verification ciphertext, the method further includes:

 Converting the verification ciphertext into an inputtable character;

 The converted ciphertext after the conversion is displayed.

 The method according to claim 2, wherein the obtaining, by the client, the verification ciphertext comprises: the user inputting the converted verification ciphertext to the client.

 The method according to claim 1, wherein the obtaining, by the security device, the operation content comprises: the client transmitting the operation content to the security device, so that the security device acquires The operation content.

 The method according to claim 4, wherein after the security device obtains the operation content, the method further includes:

 Displaying the operation content;

 Determining whether the user confirms the operation content, and if the determination result is yes, the security device processes the operation content to generate the verification ciphertext.

 The method according to claim 5, wherein the obtaining, by the client, the verification ciphertext comprises: the security device sending the verification ciphertext to the client.

 The method according to claim 1, wherein the method further comprises: the server receiving the operation content and verifying a ciphertext;

 Determining whether the operation content matches the verification ciphertext;

 If the determination result is yes, the server performs a corresponding operation according to the operation content; and transmits the operation result to the client.

8. The method of claim 7, wherein the client will be within the operation Before the ciphertext is sent to the server, the method further includes: the client encrypting the operation content and the verification ciphertext;

 And after the server receives the encrypted operation content and the verification ciphertext, the method further includes: the server decrypting the encrypted operation content and the verification ciphertext.

 The method according to claim 7, wherein the method further comprises: the client receiving the operation result;

 The result of the operation is displayed.

 The method according to claim 9, wherein before the server transmits the operation result to the client, the method further comprises: encrypting the operation result;

 And before the displaying the operation result, the client further includes: decrypting the encrypted operation result.

 A network interaction system, the system includes a server, wherein the system further includes a client and a security device;

 The client is configured to receive an operation content input by a user;

 The security device is configured to acquire the operation content, process the operation content, generate a verification ciphertext for verification, and display the verification ciphertext;

 And the client is further configured to obtain the verification ciphertext, and send the operation content and the verification ciphertext to the server through a network.

 The system according to claim 11, wherein the security device comprises: an input unit, wherein the input unit is configured to input the operation content by a client user; and the processing unit is configured to use The input operation content is processed to generate the verification ciphertext;

 a conversion unit, configured to convert the verification ciphertext into an inputtable character; a display unit, wherein the display unit is configured to display the converted verification ciphertext.

 The system according to claim 11, wherein the client comprises: a first input unit, wherein the first input unit is configured to input, by the client user, the operation content and the verification ciphertext ;

 And a first sending unit, configured to transmit the operation content and the verification ciphertext to the server.

The system according to claim 13, wherein the client further comprises a first encryption unit, wherein the first encryption unit is configured to encrypt the operation content and the verification ciphertext; And the first sending unit is configured to transmit the encrypted operation content and the verification ciphertext to the server.

 The system according to claim 13, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive an operation content and a verification ciphertext transmitted by the client;

 a judging unit, configured to determine whether the obtained operation content matches the verification ciphertext;

 An operation unit, when the determination result of the determination unit is YES, the operation unit is configured to perform a corresponding operation according to the obtained operation content;

 a second transmitting element, the second transmitting element is configured to transmit an operation result to the client.

The system according to claim 14, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive the encrypted operation content and the verification ciphertext transmitted by the client;

 a second decryption unit, configured to decrypt the encrypted operation content and the verification ciphertext to obtain the operation content and the verification ciphertext;

 a judging unit, configured to determine whether the operation content acquired by the decryption unit matches the verification ciphertext;

 An operation unit, when the determination result of the determination unit is YES, the operation unit is configured to perform a corresponding operation according to the obtained operation content;

 a second sending unit, configured to transmit an operation result to the client.

The system according to claim 15 or 16, wherein the client further comprises:

 a first receiving unit, configured to receive an operation result transmitted by the server; and a display unit, wherein the first display unit is configured to display the operation result.

 The system according to claim 17, wherein the server further comprises a second encryption unit, the second encryption unit is configured to encrypt the operation result, and the encrypted operation result is obtained. Transmitting to the second transmitting unit;

 The client also includes a first decryption unit for decrypting the encrypted operation result.

 19. A security device, characterized in that the security device comprises:

An input unit, configured to input, by the client user, the operation content; a processing unit, configured to process the input operation content, and generate a verification ciphertext for verification;

 a conversion unit, configured to convert the verification ciphertext into an inputtable character; a display unit, wherein the display unit is configured to display the converted verification ciphertext.

 20. A network interaction system, the system comprising a server, wherein the system further comprises a client and a security device;

 The client is configured to receive an operation content input by a user, and transmit the operation content to the security device, and receive a verification ciphertext transmitted by the security device, and the operation content and the verification ciphertext Sent to the server;

 a security device, configured to receive the operation content transmitted by the client, display the operation content, and determine whether the client user confirms the operation content, and if the determination result is yes, the security device performs the operation The content is processed, a verification ciphertext is generated, and the generated verification ciphertext is transmitted to the client.

 The system according to claim 20, wherein the security device comprises: a receiving unit, the receiving unit is configured to receive the operation content transmitted by the client, and a display unit, where the display unit is used Displaying the operation content;

 a judging unit, configured to determine whether the client user confirms the operation content; and the processing unit, if the judgment result of the judging unit is yes, the processing unit is configured to process the operation content, generate Verification ciphertext for verification;

 a sending unit, configured to transmit the verification ciphertext to the client.

 The system according to claim 20, wherein the client comprises: a first input unit, wherein the first input unit is configured to input, by the client user, the operation content; The first sending unit is configured to send the operation content to the security device; and is further configured to transmit the operation content and the verification ciphertext to a server;

 The first receiving unit is configured to receive, by the security device, the verification ciphertext.

The system according to claim 22, wherein the client further comprises a first encryption unit, the first encryption unit is configured to encrypt the operation content and the verification ciphertext; The first sending unit is configured to transmit the encrypted operation content and the verification ciphertext to the server.

The system according to claim 22, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive operation content transmitted by the client And verifying ciphertext;

 a judging unit, configured to determine whether the operation content matches the verification ciphertext; and an operation unit, when the judgment result of the judging unit is YES, the operation unit is configured to use the acquired operation content Perform the corresponding operations;

 a second sending unit, configured to transmit an operation result to the client.

The system according to claim 23, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive the encrypted operating content and the verified ciphertext transmitted by the client;

 a second decryption unit, configured to decrypt the received encrypted operation content and the verification ciphertext to obtain the operation content and the verification ciphertext;

 a judging unit, configured to determine whether the operation content acquired by the decryption unit matches the verification ciphertext;

 An operation unit, when the determination result of the determination unit is YES, the operation unit is configured to perform a corresponding operation according to the obtained operation content;

 a second sending unit, configured to transmit an operation result to the client.

The system according to claim 24 or 25, wherein the first receiving unit is further configured to receive an operation result transmitted by the server;

 And the client further includes a first display unit, the first display unit is configured to display the operation result.

 The system according to claim 26, wherein the server further comprises a second encryption unit, the second encryption unit is configured to encrypt the operation result, and the encrypted operation result is obtained. Transmitting to the second transmitting unit;

 The client also includes a first decryption unit for decrypting the encrypted operation result.

 28. A security device, characterized in that the security device comprises:

 a receiving unit, configured to receive the operation content transmitted by the client; a display unit, the display unit is configured to display the operation content;

 a judging unit, configured to determine whether the client user confirms the operation content; and the processing unit, if the judgment result of the judging unit is yes, the processing unit is configured to process the operation content, generate Verification ciphertext for verification;

a sending unit, configured to transmit the verification ciphertext to the client.

The security device according to claim 28, wherein the security device further comprises an input unit for inputting information for confirming the content of the operation by the user; or inputting the content of the operation.

 30. A network interaction method, the method comprising:

 The security device obtains the operation content;

 The security device processes the operation content to generate a verification ciphertext for verification; the security device transmits the operation content and the verification ciphertext to the client; The operation content and the verification ciphertext are sent to the server.

 The method according to claim 30, wherein the obtaining, by the security device, the content of the operation comprises: the user inputting the content of the operation into the security device.

 The method according to claim 31, wherein the method further comprises: the server receiving the operation content and verifying a ciphertext;

 Determining whether the operation content matches the verification ciphertext;

 If the determination result is yes, the server performs a corresponding operation according to the operation content; and transmits the operation result to the client.

 The method according to claim 32, wherein the sending, by the client, the operation content and the verification ciphertext to the server comprises:

 The client encrypts the operation content and the verification ciphertext;

 Transmitting the encrypted operation content and the verification ciphertext to the server;

 And after the server receives the encrypted operation content and the verification ciphertext, the method further includes: the server decrypting the encrypted operation content and the verification ciphertext.

 The method according to claim 32, wherein the method further comprises: the client receiving the operation result;

 The result of the operation is displayed.

 The method according to claim 34, wherein the transmitting the operation result to the client comprises:

 Encrypting the result of the operation;

 Transmitting the encrypted operation result to the client;

 And before the displaying the operation result, the client further includes: decrypting the encrypted operation result.

36. A network interaction system, the system comprising a server, wherein the system Also includes a client and a security device;

 The security device is configured to receive an operation content input by a user, process the operation content, generate a verification ciphertext for verification, and transmit the operation content and the verification ciphertext to the client ;

 The client is configured to receive the operation content and the verification ciphertext transmitted by the security device, and send the operation content and the verification ciphertext to the server through a network.

 The system according to claim 36, wherein the security device comprises: an input unit, the input unit is configured to input the operation content by a client user; and the processing unit is configured to use The input operation content is processed to generate the verification ciphertext;

 And a sending unit, configured to send the operation content and the verification ciphertext to the client.

 The system according to claim 36, wherein the client comprises: a first receiving unit, the first receiving unit is configured to receive the operation content and the verification transmitted by the security device Cipher text

 And a first sending unit, configured to transmit the operation content and the verification ciphertext to the server.

 The system according to claim 38, wherein the client further comprises a first encryption unit, the first encryption unit is configured to encrypt the operation content and the verification ciphertext; The first sending unit is configured to transmit the encrypted operation content and the verification ciphertext to the server.

 The system according to claim 38, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive an operation content and a verification ciphertext transmitted by the client;

 a judging unit, configured to determine whether the obtained operation content matches the verification ciphertext;

 An operation unit, when the determination result of the determination unit is YES, the operation unit is configured to perform a corresponding operation according to the obtained operation content;

 a second sending unit, configured to transmit an operation result to the client.

The system according to claim 39, wherein the server comprises: a second receiving unit, wherein the second receiving unit is configured to receive an encrypted operation transmitted by the client Make content and verify ciphertext;

 a second decryption unit, configured to decrypt the encrypted operation content and the verification ciphertext to obtain the operation content and the verification ciphertext;

 a judging unit, configured to determine whether the operation content acquired by the decryption unit matches the verification ciphertext;

 An operation unit, when the determination result of the determination unit is YES, the operation unit is configured to perform a corresponding operation according to the obtained operation content;

 a second sending unit, configured to transmit an operation result to the client.

The system according to claim 40 or 41, wherein the first receiving unit is further configured to receive an operation result transmitted by the server;

 The client further includes a first display unit, and the first display unit is configured to display the operation result.

 43. The system according to claim 42, wherein the server further comprises a second encryption unit, the second encryption unit is configured to encrypt the operation result, and the encrypted operation result is obtained. Transmitting to the second transmitting unit;

 The client also includes a first decryption unit for decrypting the encrypted operation result.

 44. A security device, wherein the security device comprises:

 An input unit, the input unit is configured to input the operation content by a client user, and the processing unit is configured to process the input operation content to generate a verification ciphertext for verification;

 And a sending unit, configured to send the operation content and the verification ciphertext to the client.