WO2014082346A1 - 一种安全网银的实施方法 - Google Patents

一种安全网银的实施方法 Download PDF

Info

Publication number
WO2014082346A1
WO2014082346A1 PCT/CN2012/086289 CN2012086289W WO2014082346A1 WO 2014082346 A1 WO2014082346 A1 WO 2014082346A1 CN 2012086289 W CN2012086289 W CN 2012086289W WO 2014082346 A1 WO2014082346 A1 WO 2014082346A1
Authority
WO
WIPO (PCT)
Prior art keywords
mobile phone
password
login password
user
dynamic
Prior art date
Application number
PCT/CN2012/086289
Other languages
English (en)
French (fr)
Inventor
吴伟峰
Original Assignee
Wu Weifeng
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Wu Weifeng filed Critical Wu Weifeng
Publication of WO2014082346A1 publication Critical patent/WO2014082346A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3823—Payment protocols; Details thereof insuring higher security of transaction combining multiple encryption tools for a transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/42—User authentication using separate channels for security data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels

Definitions

  • the invention relates to the field of information security, and is applicable to a secure transfer system of an internet bank and an e-commerce payment method.
  • BACKGROUND With the rapid development of e-commerce and the Internet, the online transaction amount of online banking (referred to as online banking) continues to expand, and the problem of network transaction security has become increasingly prominent.
  • online banking online banking
  • dynamic password lock and USB KEY are commonly used at home and abroad as a user identity authentication technology.
  • the dynamic password lock consists of two parts: one is the static PIN code (identification code), which is set by the user to keep it; the other is the dynamic password, which is randomly generated by the dynamic password card, unpredictable, and synchronized with the access control of the background server. After the dynamic password is generated, it will remain unchanged for a while. The user can enter the static PIN code and dynamic password during this period of time, and log in to the online banking after the background verification is correct. Dynamic password locks reduce the possibility of third-party passwords through the randomness of dynamic password formation and one-time use, but hackers may still acquire and steal users' online banking through Trojans during the period when dynamic passwords have been formed but have not expired. Account.
  • the USB KEY is a hardware device with a USB interface that uses a double-key encryption authentication mode.
  • the USB KEY has a built-in single-chip or smart card chip, which has a certain storage space. It can store the user's private key or digital certificate, and use the built-in public key algorithm to authenticate the user's identity.
  • the built-in private key or digital certificate of the USB KEY is difficult to be obtained by a third party in the process of online banking transactions under the protection of the password lock, thereby ensuring the security of the online banking transaction.
  • the private key and digital certificate in the USB KEY may still be stolen and stolen during the operation.
  • the user inputs a personal account and a network login password (or a dynamic password) via the Internet;
  • the online banking system After receiving the network login password, the online banking system automatically sends the randomly generated dynamic mobile phone login password to the mobile phone number registered by the user;
  • step 103 The user logs in to the online banking client through the mobile phone, enters the received dynamic mobile phone login password, and the system verifies that the mobile phone login password and the mobile phone number of the mobile phone login password are correct, and successfully logs in to the online banking transaction interface and proceeds to step 104; If the mobile phone number of the mobile phone login password or the mobile phone login password is incorrect, the system returns to the login interface of step 101;
  • USB KEY or dynamic password
  • step 103 if the online banking system detects that the mobile phone login password is incorrectly entered more than 3 times or more, the system will lock the user's personal account, stop the login operation, or invalidate the dynamic mobile phone login password.
  • the implementation method of the secure online banking provided by the present invention only needs to add a program for generating and transmitting a dynamic mobile phone login password to the mobile phone in the bank online banking system, and the change is small but the effect is large; After downloading the mobile banking online client, its operation is only one step more than the mobile phone password verification. Compared with the existing operation mode, the operation is simple and does not cause any additional trouble to the user.
  • the mobile phone verification step uses a dynamic password. Compared with the fixed password, it further increases the difficulty of the password being learned and stolen, and further increases the security of the online banking transaction.
  • FIG. 1 is a flow chart of a method for implementing a secure online banking method disclosed by the present invention
  • W- represents the number of mobile phone login password verification errors in step 103;
  • R- stands for the mobile phone login password verification in step 103.
  • FIG. 2 is a schematic structural diagram of a system for implementing a secure internet banking method according to the present disclosure.
  • a method for implementing a secure online banking in combination with a mobile terminal the specific implementation steps are as follows: 101: A user inputs a personal account and a network login password (or a dynamic password) through the Internet; 102: After receiving the network login password, the online banking system automatically sends the randomly generated dynamic mobile phone login password to the mobile phone number registered by the user;
  • step 103 The user logs in to the online banking client through the mobile phone, inputs the received dynamic mobile phone login password, and the system verifies the mobile phone login password and the mobile phone number of the mobile phone login password is correct, and successfully logs into the online banking transaction interface to proceed to step 104; the system detects the mobile phone If the login password or the mobile phone number of the mobile phone login password is incorrect, return to the login interface of step 101;
  • USB KEY or dynamic password
  • step 103 if the online banking system detects that the mobile phone login password is incorrectly entered more than 3 times or more, the system will lock the user's personal account, stop the login operation, or invalidate the dynamic mobile phone login password.

Abstract

本发明提供一种结合移动终端的安全网银的实施方法，其实施步骤为：在原有的动态密码锁和USB KEY基础上增加手机登录密码验证步骤，用户需通过特定手机号码手机登录手机网银客户端输入即时接收到的动态手机登录密码进行验证，验证密码无误才能在万维网终端成功登录并继续操作网银系统。本发明提供的这种安全网银实施方法的原理是利用了手机通讯和万维网登录使用的是不同的、独立的网络，且使用动态密码验证，进一步降低了相关密钥泄露或被盗用的可能性，提高网银的操作安全性。

Description

一种安全网银的实施方法 技术领域
本发明涉及信息安全领域， 适用于网络银行的安全转账系统及电子商务支付方法。 背景技术 随着电子商务和互联网的快速发展， 网络银行（简称网银）的在线交易金额的不断扩大， 网络交易安全的问题也日益凸显。 目前， 网银交易过程中国内外普遍采用动态密码锁和 USB KEY作为用户身份认证技术。
动态密码锁包括两部分元素： 一是静态 PIN码（身份识别码）， 由用户自行设置保管； 另 一个是动态密码， 由动态密码牌随机生成， 不可预测， 并与后台服务器的接入控制同步， 动 态密码生成后会有一段时间保持不变， 用户可在这段时间内输入静态 PIN码和动态密码， 由 后台验证无误后登录网银。 动态密码锁通过动态密码形成的随机性和使用的一次性来降低第 三方获得密码的可能性， 但是黑客依然有可能在动态密码已经形成但还未失效的期间通过木 马程序获取并盗用用户的网银账户。
USB KEY是一种带 USB接口的硬件设备， 采用双钥加密的认证模式。 USB KEY内置单片机 或智能卡芯片， 有一定的存储空间， 可以存储用户的私钥或是数字证书， 利用内置的公钥算 法实现对用户身份的认证。 USB KEY 内置的私钥或数字证书在密码锁的保护下， 很难在网银 交易的过程中被第三方获取， 由此保证网银交易的安全。但随着网络及黑客技术的进步， USB KEY内私钥和数字证书仍然有可能在操作过程中被窃取盗用。 发明内容 本发明针对现有技术的不足， 针对现有网银身份认证技术的不足， 提出一种结合移动终 端的安全网银的实施方法， 其具体实施步骤如下：
101： 用户通过互联网输入个人账号和网络登录密码 （或动态密码）；
102： 网银系统接收到用户输入网络登录密码后， 自动发送随机生成的动态手机登录密 码到用户登记的手机号码；
103： 用户通过手机登录网银客户端， 输入收到的动态手机登录密码， 系统验证手机登 录密码及发送手机登录密码的手机号码无误， 则成功登录到网银交易界面进入到步骤 104; 系统如检测手机登录密码或发送手机登录密码的手机号码错误， 则重新回到步骤 101的登录 界面；
104： 成功登录到网银交易界面后， 用户继续通过 USB KEY (或动态密码） 身份验证进 行网银的操作。
进一步， 步骤 103中， 如网银系统检测手机登录密码输入错误超过 3次或 3次以上的有 限次数， 系统将锁定给用户的个人账户， 停止登录操作， 或使动态手机登录密码失效。
本发明相对于现有技术的有益之处在于：
1、 增加手机信息验证， 手机使用的通讯网络与网银系统的万维网是两个不同的、 互 相独立的网络系统， 黑客就算通过万维网在计算机终端盗取了用户的动态密码和 USB KEY私钥， 但缺少正确的手机登录密码验证， 也无法成功登录网银账户； 但 是要在两个互相独立、分别传输验证信息的网络中同时窃取到相关密钥的可能性 微乎其微， 即使拿到相关密钥， 没有指定的手机号码也无法进行相关操作， 大大 提高网银使用的安全性；
2、 跟现有技术相比， 要实现本发明提供的安全网银实施方法只需在银行网银系统中 增加一道生成及发送动态手机登录密码到手机的相关程序， 改动很小但收效很 大； 用户下载手机网银客户端后， 其操作与现有的操作方式相比， 也仅仅多了手 机密码验证这一个步骤， 操作简易， 对用户不会造成额外的困扰。
3、 手机验证步骤采用动态密码， 与固定密码相比， 更进一步加大密码被获知和盗取 的难度， 进一步增加网银交易安全性。 附图说明
图 1 本发明公开的安全网银实施方法系统流程图
图中， W-代表步骤 103中手机登录密码验证错误次数；
R-代表步骤 103中手机登录密码验证正确。
图 2 本发明公开的安全网银实施方法的系统结构示意图 具体实施方式
如图 1、 2所示， 一种结合移动终端的安全网银的实施方法， 其具体实施步骤如下： 101： 用户通过互联网输入个人账号和网络登录密码 （或动态密码）； 102： 网银系统接收到用户输入网络登录密码后， 自动发送随机生成的动态手机登录密码 到用户登记的手机号码；
103： 用户通过手机登录网银客户端， 输入收到的动态手机登录密码， 系统验证手机登录 密码及发送手机登录密码的手机号码无误， 则成功登录到网银交易界面进入到步骤 104; 系 统如检测手机登录密码或发送手机登录密码的手机号码错误， 则重新回到步骤 101的登录界 面；
104： 成功登录到网银交易界面后， 用户继续通过 USB KEY (或动态密码） 身份验证进 行网银的操作。
进一步， 步骤 103中， 如网银系统检测手机登录密码输入错误超过 3次或 3次以上的有 限次数， 系统将锁定给用户的个人账户， 停止登录操作， 或使动态手机登录密码失效。
本发明并不局限于上述实施方式， 如果对本发明的各种改动或变型不脱离本发明的精神 和范围， 倘若这些改动和变型属于本发明的权利要求和等同技术范围之内， 则本发明也意图 包含这些改动和变型。

Claims

权 利 要 求 书
1. 一种结合移动终端的安全网银的实施方法， 其具体实施步骤如下：
101： 用户通过互联网输入个人账号和网络登录密码 （或动态密码）；
102： 网银系统接收到用户输入网络登录密码后， 自动发送随机生成的动态手机登录密 码到用户登记的手机号码；
103： 用户通过手机登录网银客户端， 输入收到的动态手机登录密码， 系统验证手机登 录密码及发送手机登录密码的手机号码无误， 则成功登录到网银交易界面进入到步骤 104; 系统如检测手机登录密码或发送手机登录密码的手机号码错误， 则重新回到步骤 101的登录 界面；
104： 成功登录到网银交易界面后， 用户继续通过 USB KEY (或动态密码） 身份验证进 行网银的操作。
2. 如权利要求 1所示的方法， 其特征在于： 步骤 103中， 如网银系统检测手机登录密码输入 错误超过 3次或 3次以上的有限次数， 系统将锁定给用户的个人账户， 停止登录操作， 或 使动态手机登录密码失效。
PCT/CN2012/086289 2012-11-30 2012-12-10 一种安全网银的实施方法 WO2014082346A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210506840.6 2012-11-30
CN201210506840.6A CN103854177A (zh) 2012-11-30 2012-11-30 一种安全网银的实施方法

Publications (1)

Publication Number Publication Date
WO2014082346A1 true WO2014082346A1 (zh) 2014-06-05

Family

ID=50827113

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/086289 WO2014082346A1 (zh) 2012-11-30 2012-12-10 一种安全网银的实施方法

Country Status (2)

Country Link
CN (1) CN103854177A (zh)
WO (1) WO2014082346A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107196914A (zh) * 2017-04-25 2017-09-22 北京潘达互娱科技有限公司 身份认证方法及装置
CN107846406A (zh) * 2017-11-02 2018-03-27 中国银行股份有限公司 一种账户登录方法及装置
CN108377241B (zh) * 2018-02-12 2021-02-05 平安普惠企业管理有限公司 基于访问频率的监测方法、装置、设备和计算机存储介质
CN109034822A (zh) * 2018-07-13 2018-12-18 广东深海信息科技有限公司 一种网银密码验证方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008004750A1 (en) * 2006-07-03 2008-01-10 Gwi Yeoul Kim The preliminary verification system which has a authentication by phone on the internet environment
CN101848090A (zh) * 2010-05-11 2010-09-29 武汉珞珈新世纪信息有限公司 认证装置及利用其进行网上身份认证与交易的系统与方法
CN101795454B (zh) * 2010-02-10 2012-10-10 熊文俊 基于移动通信独立通道的双身份认证方法及系统
CN102780674A (zh) * 2011-05-09 2012-11-14 同方股份有限公司 一种具有多因素认证方法的网络业务处理方法及系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2958428B1 (fr) * 2010-03-30 2012-08-31 Radiotelephone Sfr Procede d'execution d'un premier service alors qu'un deuxieme service est en cours d'execution, au moyen d'un terminal informatique equipe d'une carte a circuit integre.
CN102054258A (zh) * 2010-12-16 2011-05-11 中国建设银行股份有限公司 一种基于移动设备的电子银行安全认证方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008004750A1 (en) * 2006-07-03 2008-01-10 Gwi Yeoul Kim The preliminary verification system which has a authentication by phone on the internet environment
CN101795454B (zh) * 2010-02-10 2012-10-10 熊文俊 基于移动通信独立通道的双身份认证方法及系统
CN101848090A (zh) * 2010-05-11 2010-09-29 武汉珞珈新世纪信息有限公司 认证装置及利用其进行网上身份认证与交易的系统与方法
CN102780674A (zh) * 2011-05-09 2012-11-14 同方股份有限公司 一种具有多因素认证方法的网络业务处理方法及系统

Also Published As

Publication number Publication date
CN103854177A (zh) 2014-06-11

Similar Documents

Publication Publication Date Title
US11172361B2 (en) System and method of notifying mobile devices to complete transactions
TWI690824B (zh) 用於認證的方法、裝置、終端設備及系統
CN101340281B (zh) 针对在网络上进行安全登录输入的方法和系统
CN101350723B (zh) 一种USB Key设备及其实现验证的方法
CN101005361B (zh) 一种服务器端软件保护方法及系统
US8266683B2 (en) Automated security privilege setting for remote system users
JP2018521417A (ja) 生体特徴に基づく安全性検証方法、クライアント端末、及びサーバ
KR20080009217A (ko) 개인의 존재를 조건으로 하는 토큰에 의한 거래 인증
TW201108696A (en) Account identification system, method and peripheral device of performing function thereof
CN104468099A (zh) 基于cpk的动态口令生成和验证方法及装置
CN108768941B (zh) 一种远程解锁安全设备的方法及装置
WO2014082346A1 (zh) 一种安全网银的实施方法
TW201544983A (zh) 資料通訊方法和系統及客戶端和伺服器
CN103117854A (zh) 一种安全网银的实施方法
JP5849149B2 (ja) ワンタイムパスワード生成方法およびこれを実行する装置
Zwane et al. An intelligent security model for online banking authentication
KR20140046674A (ko) 클라우드 공인인증 시스템 및 그 제공방법
WO2014082345A1 (zh) 一种安全网银的实施方法
TWI816017B (zh) 驗證資訊處理方法和裝置
Arnosti et al. Secure physical access with NFC-enabled smartphones
Cha et al. Is there a tradeoff between privacy and security in BLE-based IoT applications: Using a smart vehicle of a major Taiwanese brand as example
CN111259362A (zh) 一种硬件数字证书载体的身份鉴别方法
Prajitha et al. A secured authentication protocol which resist password reuse attack
TWI625643B (zh) 無線感測網路的匿名認證方法
TWI524712B (zh) A system and a method for preventing the identification of theft

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12889205

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12889205

Country of ref document: EP

Kind code of ref document: A1