WO2018133674A1 - 一种银行支付许可认证信息的反馈验证方法 - Google Patents

一种银行支付许可认证信息的反馈验证方法 Download PDF

Info

Publication number
WO2018133674A1
WO2018133674A1 PCT/CN2018/071372 CN2018071372W WO2018133674A1 WO 2018133674 A1 WO2018133674 A1 WO 2018133674A1 CN 2018071372 W CN2018071372 W CN 2018071372W WO 2018133674 A1 WO2018133674 A1 WO 2018133674A1
Authority
WO
WIPO (PCT)
Prior art keywords
bank
authentication information
information
payment
user
Prior art date
Application number
PCT/CN2018/071372
Other languages
English (en)
French (fr)
Inventor
齐宇庆
Original Assignee
西安慧博习兆信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安慧博习兆信息技术有限公司 filed Critical 西安慧博习兆信息技术有限公司
Publication of WO2018133674A1 publication Critical patent/WO2018133674A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Definitions

  • the invention belongs to the technical field of electronic information anti-counterfeiting, and relates to a feedback verification method for bank payment license authentication information, which is a method for copying a bank card, copying a mobile phone card, and then implementing funds in a bank device for utilizing leaked or stolen bank user information.
  • An effective defense method designed to transfer and extract cash criminal behavior.
  • the bank card is a fundamental change that has enabled the banking business to break through the limitations of time and space by means of electronic technology and network technology. It not only simplifies the busy and complicated business of bank transfer, cash withdrawal, etc., but also reduces cash and checks.
  • the circulation, while bringing self-service banking services to bank card users is fast and convenient. Now bank card users can also monitor the dynamics of their accounts in real time by means of network communication technology.
  • bank card user information There are several ways to disclose bank card user information: one is the illegal copying and sale of bank personnel; the other is that criminals access the bank information database through the network and steal user information; third, the criminals obtain the fraudulent means from the user, and There are also means for obtaining user bank card information by adding a device for stealing information on the bank device.
  • the bank and related management departments inform users of the way to prevent losses: after receiving the SMS message after the funds in their account have been transferred, they immediately go to the nearest bank device to leave time and place evidence. It means that the bank card is in its own hands, and at the same time it proves that it has not carried out the operation of transferring funds or withdrawing funds at this time, and provided the evidence to the court and public security organs for tracing, and may also request the bank to pay losses.
  • the patent document of the prior art No. 3: 201110092438.3 discloses a mobile banking client information authentication method, system and mobile terminal, and the method comprises: “........ establishing a binding of mobile phone hardware information and mobile banking registered customer information. Relationship"; “......... to solve the problem of information security of the client mobile banking system.”
  • the feature point is the user information binding relationship between the user equipment and the bank registration, the user information of the bank registration is leaked, and the information of the mobile phone is bound at the same time. Leak, binding information is copied, and users and bank funds are in danger of being stolen.
  • the object of the present invention is to overcome the above disadvantages of the prior art, and provide a feedback verification method for bank payment license authentication information, embedding a program for preparing a feedback verification method for bank payment license authentication information into a transfer and payment in a business process of a banking device.
  • Execute the front end of the program can effectively prevent criminals from using the leaked bank user information to copy the bank card, mobile phone card, and then use the password in the leaked information, implement operations on the bank equipment to achieve the purpose of stealing funds; take effective technical measures Prevent bank and user identity authentication information and payment license authentication information from being intercepted, tampered with, utilized, and the confirmation link and its technical measures are safe, easy to use, no hardware added, and can be quickly implemented.
  • a feedback verification method for bank payment license authentication information includes the following steps:
  • the bank device When the bank device sends the payment license authentication information to the user, the real-time time parameter is converted into an address pointer, and the data obtained by the pointing point in the random function data source set in the bank device according to the address pointer is used as a key, and the secret is utilized.
  • the key uses a symmetric encryption algorithm to encrypt the payment license authentication information into the first secret packet; then the first secret packet and the time parameter are asymmetrically encrypted and encrypted into a second secret packet, and the second secret packet is stored and sent as a short message.
  • the user equipment After receiving the short message sent from the bank, the user equipment decrypts the second secret packet by the asymmetric encryption algorithm to obtain the first secret packet and the time parameter; the user equipment converts the time parameter into an address pointer, and the user device according to the address pointer
  • the data obtained by the pointing point in the random function data source set in the data is used as a key, and the secret packet is decrypted by using the key to obtain the payment license authentication information;
  • the user equipment stores the confirmed payment license authentication information, and then feeds back to the bank device through the information channel and the device channel; the bank device determines the subsequent execution program according to the information fed back by the user and the supervisor.
  • the bank has a key generator to generate an asymmetric key pair.
  • Each user and bank share a pair of asymmetric keys, regardless of the public key and private key, and are not exposed to the outside world; when the user registers, they will be asymmetric.
  • the secret key pair and its encryption and decryption algorithm program are respectively distributed to the bank device and the user equipment by the "blind matching method".
  • the bank has a random function generator to generate a random function and a random function data source composed of the same.
  • the random function data source is a data string, a data ring or a database; when the user registers, the same content is set for each user and the bank. Random data source, stored in bank equipment and user equipment;
  • the bank random function data source and the user random function data source have the function of automatically synchronizing and updating the random data source data, and operating according to the preset time and operation method to change the data source data of the random function;
  • the operation of changing the random function data source data includes at least address conversion, data conversion, logical operations for changing data bits of data, arithmetic operations, and function operations.
  • the time parameter is converted into an address, and the key obtained by the random function data source set by the bank device encrypts the payment permission authentication information and sends it to the user as a secret package; the user receives the bank information, converts the time parameter into an address, and is set by the user equipment.
  • the key obtained by the random function data source decrypts the secret packet to obtain the payment permission authentication information, and uses the symmetric key consistency to confirm the registration information and identity authentication;
  • the information is obtained by asymmetric decryption to obtain the secret packet and the time parameter, and the time parameter is converted into a key obtained by the random function data source set in the user equipment to decrypt the secret packet, and the payment permission authentication information is obtained; the asymmetric key is used.
  • the uniqueness of the decrypted file is used to confirm the registration information and identity authentication.
  • An electronic evidence database for storing and receiving the other party's information is set in each of the bank and the user equipment, and the payment license authentication information is stored as electronic evidence, and the stored data includes at least time parameter data, payment permission authentication information data, Data for identity authentication information.
  • a corresponding interactive information channel is set for the payment license and the identity authentication information, and at least includes: a communication channel between the bank and the user, a device channel between the bank and the user, a communication channel between the bank and the supervisor.
  • the time parameters in the banking device and the user equipment are synchronized with the network timing signal.
  • the program for preparing the feedback verification method for the bank payment license authentication information is embedded in the front end of the transfer and payment execution program in the business process of the banking device;
  • the bank device is a device with a payment transfer payment function, and includes a bank background device corresponding to an ATM machine, a POS machine, and an online banking operation interface.
  • the user equipment unique identification information MEID When registering, the user equipment unique identification information MEID, the bank account number, the mobile phone card SIM number, and the assigned asymmetric key and its user application are bound;
  • the identification information recognition algorithm and the encryption and decryption algorithm included in the program are pre-designed automatic execution operation programs, and the user does not need to have relevant professional knowledge;
  • User equipment consists of: fixed and mobile, wired and wireless communication-enabled electronic devices, including at least mobile phones, computers, mobile terminals, fixed/mobile switching devices.
  • the payment license authentication information is: a combination of single or multiple items of short message information, QQ information, WeChat information, telephone telegram information, and fax information;
  • the payment license data includes the account number of the transfer payment, the amount of funds, the cash withdrawal amount and the number of times; the verification code of the payment license is fixed or random change data: contains: numbers, characters, letters, characters, calculations, answers, and graphic images. , multimedia information of audio and video - their single data or a combination of multiple data.
  • the present invention has the following beneficial effects:
  • the existing banking equipment and user equipment do not make any hardware changes, do not add new servers, hardware equipment and third-party institutions for security supervision, only need to do the banking equipment and user equipment according to the technical scheme described in the present invention.
  • Program upgrade (2) User bank card and device (mobile phone card) illegally copied by leaked bank user information cannot be verified by the payment license authentication information and identity information of the bank device after the upgrade of the present invention; (3) The pseudo base station constructed by using the leaked bank user information cannot perform mutual payment permission and identity authentication with the upgraded user equipment of the present invention; (4) operating on the bank device with the user bank card and password, the bank The payment permission and identity authentication of the user communication channel and device channel feedback are not received; (5) the user who has set up the supervisory party operates on the bank device, the bank does not obtain the payment permission authentication information fed back to the bank by the supervisor, and the bank device does not The operating procedures for performing payment and transfer.
  • Figure 1 is a schematic diagram of the bank card transfer payment process of the current banking equipment
  • Figure 2 is a flow chart of the method of the present invention
  • FIG. 3 is a schematic diagram of a payment permit authentication information secret package according to Embodiment 1 of the present invention.
  • FIG. 4 is a schematic diagram of a payment permit authentication information secret package according to Embodiment 2 of the present invention.
  • Figure 5 is a schematic diagram of time parameter conversion of the present invention.
  • 1-first secret packet 2-second secret packet; 3-message.
  • the current bank equipment ATM machine cash withdrawal process as an example: insert the bank card into the card reader hole, in the ATM machine's man-machine dialogue operation interface according to the prompt "please enter the password", the user uses the number keys Enter a 6-digit password, select “Withdrawal” on the operation interface ⁇ select “Amount” ⁇ Manual or select the corresponding key to enter data ⁇ “Confirm” ⁇ ATM machine pays the corresponding amount of money withdrawal ⁇ Send account payment to the user SMS ⁇ Return Card.
  • the cash withdrawal from the ATM machine can be easily operated to realize the purpose of withdrawing cash as long as the bank card and the user password are available.
  • the problem 1 is: (1) the bank card is lost, the password is leaked, and the money is extracted by the criminals at the ATM machine; (2) the criminals illegally acquire the card reader and the camera at the ATM machine, and copy the bank. Card information and password, the ATM machine extracts the funds in the card; (3) the bank's customer information is leaked, the criminals use the bank card information to copy and forge the bank card; and then use the user password to easily steal the user card in the ATM machine. Funds.
  • the above-mentioned problem 1 is already a common case and occurs from time to time.
  • a feedback verification method for a bank payment license authentication information of the present invention includes the following steps:
  • the bank device When the bank device sends the payment license authentication information to the user, the real-time time parameter is converted into an address pointer, and the data obtained by the pointing point in the random function data source set in the bank device according to the address pointer is used as a key (see FIG. 5).
  • a symmetric encryption algorithm National SM4 or DES algorithm
  • an asymmetric encryption algorithm on the first secret packet 1 and the time parameter National SM2 Or RSA algorithm
  • the user equipment After receiving the short message 3 sent from the bank, the user equipment decrypts the second secret packet 2 by using an asymmetric encryption algorithm (national secret SM2 or RSA algorithm) to obtain the first secret packet 1 and the time parameter; the user equipment sets the time parameter. Converted into an address pointer, according to the data obtained by the pointing point in the random function data source set by the address pointer in the user equipment as a key (see FIG. 5), using the key to adopt a symmetric encryption algorithm (national secret SM4 or DES algorithm) Decrypt the secret packet to obtain payment license authentication information;
  • an asymmetric encryption algorithm national secret SM2 or RSA algorithm
  • the user equipment stores the confirmed payment license authentication information, and then feeds back to the bank device through the information channel and the device channel; the bank device determines the subsequent execution program according to the information fed back by the user and the supervisor.
  • the method for verifying the payment authorization information of the bank of the present invention includes the following steps:
  • the asymmetric authentication algorithm National SM2 or RSA algorithm
  • the real-time time parameter is converted into an address pointer.
  • the key is used to encrypt the secret packet by a symmetric encryption algorithm (national secret SM4 or DES algorithm).
  • the second secret packet 2, the second secret packet 2 and the time parameter are stored, and then the short message 3 is sent to the user and the supervisor;
  • the user equipment receives the second secret packet 2 sent from the bank and the short message 3 of the time parameter, and the user equipment converts the time parameter into an address pointer, and obtains the pointing point in the random function data source set in the user equipment according to the address pointer.
  • the data is used as a key (see FIG. 5), and the second secret packet 2 is decrypted to obtain the first secret packet 1 by using a symmetric encryption algorithm (National SM4 or DES algorithm), and then the first secret packet 1 is asymmetric.
  • the encryption algorithm national secret SM2 or RSA algorithm decrypts to obtain payment license authentication information;
  • the user equipment stores the confirmed payment license authentication information, and then feeds back to the bank device through the information channel and the device channel; the bank device determines the subsequent execution program according to the information fed back by the user and the supervisor.
  • the program for compiling the feedback verification method of the bank payment license authentication information is embedded in the front end of the transfer and payment execution program in the business process of the banking device; and the user equipment is used to re-upgrade the user information, and the main contents added are: the bank of the asymmetric algorithm Key, symmetric algorithm for random function data sources and their algorithm programs, and electronic evidence database; set asymmetric key generators and random function generators for bank registration procedures.
  • Two-factor multi-channel authentication information feedback is set for bank payment license authentication information and identity authentication to improve the reliability of authentication information.
  • the identification information recognition algorithm and encryption and decryption algorithm included in the program are pre-designed automatic execution operation programs, and the user does not need to have relevant professional knowledge.
  • Asymmetric algorithm application the characteristics of two keys using asymmetric algorithm: both: one of the two keys using the asymmetric algorithm is encrypted, the other key can be decrypted, and the two keys are different, and It is not possible to derive and calculate another key from one of the keys.
  • the characteristics of the asymmetric algorithm key can not only constitute a secure communication channel, but also identity authentication.
  • Asymmetric Algorithm Banking Application The information that the bank uses to encrypt the asymmetric key to the user can be unlocked only by the user's asymmetric key. Conversely, the user encrypts the information with the asymmetric key and sends it to the bank. Only the bank's asymmetric key can be unlocked. It can be seen that even if the information is intercepted by others, it cannot be decrypted and there is no use value.
  • the present invention is in response to an attempt by the criminals to steal funds, and since the leaked bank user information does not have an asymmetric key in the user equipment, it is impossible to calculate.
  • the criminals can copy the bank card, the user equipment (mobile phone) card, and the user password by using the leaked bank user information
  • the identity authentication between the bank and the user using the asymmetric algorithm designed by the present invention cannot be performed. Therefore, the application of the asymmetric algorithm in the bank of the present invention blocks the loopholes of the criminals using the leaked bank user information to illegally copy and steal funds from the bank equipment.
  • the bank has a key generator to generate an asymmetric key pair; when the user registers, the asymmetric key pair and its encryption and decryption algorithm are respectively invisible to the operator.
  • the bank and the user are to prevent the key information from being collected and leaked by the operator at the source of the key generation during registration; the blind matching method is to complete the registration only by inputting the user public information on the registration end. Undisclosed information such as key distribution is completed by the program, and the registration side is invisible to the non-public information.
  • the difference between the asymmetric algorithm key and the digital certificate is different from the digital certificate.
  • a method of applying an asymmetric key pair (a technical solution for applying a digital certificate, see prior art 1 described in the background of the present application). Because the application of a typical digital certificate is based on the PKI architecture (Public Key Infrastructure), both the user and the bank have a certificate. Each certificate has a pair of (two) asymmetric keys, which must be confidential. One of the keys is disclosed as a public key. It is also necessary to introduce a Certification Authority (CA) as a third party. The authentication center network uses the public key to verify the identity information, which is complicated and cumbersome. In addition, the use of digital certificates requires the certification authority (CA) to pay an expensive key verification fee, and needs to be updated every two years, increasing the financial burden on the user.
  • CA Certification Authority
  • the application of the asymmetric algorithm in the present invention is based on the "one-to-one" communication relationship between the bank and the user, and the registration of both parties is recognized, and the security is not doubled by publicizing the key to the outside world.
  • Symmetric key authentication method the random symmetric key identity authentication is a real-time time parameter collected by a bank, an encryption and decryption key acquired according to the time parameter, and an encryption key and a decryption key are verified by using an encryption and decryption file.
  • the algorithm for authenticating the identity of the key is a real-time time parameter collected by a bank, an encryption and decryption key acquired according to the time parameter, and an encryption key and a decryption key are verified by using an encryption and decryption file.
  • the specific implementation method is: converting the time parameter into an address pointer, and encrypting the payment permission authentication information to the user according to the data obtained by the pointing point of the address pointer in the random function data source set by the bank device as the key; the user receives the The bank information converts the time parameter into an address pointer, and obtains the payment permission authentication information by using the data obtained by the pointing point of the address pointer in the random function data source set by the user equipment as the key, and uses the symmetric key consistency. Confirmation of registration information and identity authentication;
  • Asymmetric key authentication method converts the real-time time parameter into a key pointer.
  • the key encryption payment license authentication information obtained by the random function data source set in the bank device is a secret packet, and then the asymmetric packet and the time parameter are asymmetric.
  • the encryption is sent to the user; the user receives the bank information, obtains the secret packet and the time parameter through asymmetric decryption, and converts the secret packet into a key obtained by the random function data source set in the user equipment by using the time parameter to obtain the payment license authentication.
  • Information the feasibility of encrypting and decrypting files using asymmetric keys to confirm registration information and identity authentication.
  • Symmetric key randomization When the user registers, the bank and each user are set up with two unique and identical random data sources, which are stored in the bank's bank random data source and the user random data stored in the user equipment. source. In order to prevent the authentication information issued by the bank from being illegally intercepted and then decrypted and utilized, it is necessary to make each key different.
  • the technical solution of the present invention is: converting the time parameter into an address, and acquiring the key in the key obtained by the random function data source. Since the time parameter is a non-repetitive variable, the key acquired at each time point is different, thereby A symmetric key is implemented for each different purpose.
  • Electronic evidence database an electronic evidence database for storing and receiving the other party's information is set in the bank and the user equipment, and the data as the electronic evidence is stored.
  • the data of the electronic evidence includes at least the time parameter, the payment license authentication information, and the identity authentication.
  • Informational data The electronic evidence database stores payment and identity authentication information for banks and users, which can be used to query and trace current and past information. When the deny behavior or the electronic evidence is lost or wrong, the content of the information corresponding to the address and time series data in the electronic evidence database can be used as evidence to provide a judgment.
  • the time parameters in the banking equipment and the user equipment are synchronized with the network timing signal.
  • the timing signal is derived from the standard time parameter set by the time source of the National Time Service Center on the Beidou satellite, or from the national time center.
  • Anti-pseudo base station the bank random data source and the user random data source have the function of automatically synchronizing and updating the random data source data dynamically, and operating according to the preset time and operation method to make the random data source data change; and making the random data source data
  • the operations that change include at least address conversion, data conversion, logical operations that change the data bits of the data, arithmetic operations, and function operations.
  • the pseudo base station producer can only copy to the static bank random function data source in the leaked bank user registration information, if The dynamic update time is set to be short (for example, the second or millisecond level), and the user random function data source of the user equipment (in the mobile phone) has been updated many times in the time it takes to copy and reset the data to the pseudo base station. Therefore, the bank random function database placed by the pseudo base station cannot be synchronized with the user's random function database, the obtained symmetric keys are inconsistent, the verification information cannot pass, and the communication connection between the pseudo base station and the user cannot be established, effectively combating the use of the pseudo base station. Fraudulent activity.
  • a supervision channel is set up between the bank and the regulator.
  • the bank sends the user's payment license authentication information to the regulator through the supervision channel, and after receiving the feedback information from the regulator, determines the execution of the payment permission program.
  • the supervisory party can be a trusted person authorized by the user, a fund management manager within the enterprise, or an information security unit set up by the department or the state (for example, the fraud prevention data center of the public security department).
  • Anti-telecom fraud At present, the use of telecommunications means to fictional facts, concealing the truth, pretending to be a public security law staff, pretending to be a social security power worker, forging cars, real estate, and award-winning tax rebates, posing as acquaintances and other means of telecommunication fraud.
  • the relevant departments In order to prevent or reduce the loss of victims who are deceived, the relevant departments have formulated a “delayed payment (24 hours)” policy for the transfer of bank equipment (mainly ATM machines and POS machines) to leave the victim “awake repentance” time. From the perspective of the current implementation of its policies, anti-telecom fraud has achieved certain results. However, it also brings the drawbacks of “delayed payment”, which reduces the speed of capital flow and the speed of goods circulation, which has a very negative impact on the economy and society.
  • a security supervision channel between the bank and the supervisor is designed, which can be selected by the user.
  • the supervisor has the responsibility of identifying, approving and stopping the user's transfer and payment information. Based on the logic of “bystanders clear, the authorities are annoyed”, the probability of the regulator discovering, identifying and revealing the scams set by the telecom scammers is much higher than that of the victims. Time “awakening repentance” probability can effectively prevent being deceived and timely stop the economic loss of the victim.
  • the setting of regulators and supervisory channels can also reduce the need for “delayed payment” user groups, improve the turnover rate of funds and goods under the premise of preventing fraud and improving capital security.
  • the user entrusts others to transfer money and withdraw cash on the bank equipment, and can provide his bank card and password to the trustee, and the bank device sends the transfer payment information to the user equipment (mobile phone).
  • the user confirms the data of the transfer payment (account, transfer or withdrawal amount, etc.), feeds the confirmation data to the bank through the communication channel, and then transmits the confirmation data of the device channel to the trustee, and the trustee inputs the confirmation data on the bank device, the bank The device performs an operation procedure for the transfer payment.
  • a two-factor multi-channel user feedback information channel is set up for bank payment license authentication information and identity authentication.
  • the user feedback information channel includes at least: a communication channel between the bank and the user, a device channel between the bank and the user, banking and user supervision.
  • the communication channel of the party includes at least: a communication channel between the bank and the user, a device channel between the bank and the user, banking and user supervision.
  • the conditions for passing the certification are:
  • the bank receives and confirms that the customer has confirmed the data Crd through the information channel, and the operation data is fed back to the bank's identification data Drd through the bank's front-end equipment or network operation interface.
  • the denial data in the authentication information includes at least the denial data Dno fed back through the information channel, and the alarm data Ad via the alarm information channel, and the customer feeds back the Dno data to the bank through the communication channel; the customer can immediately feed the Ad data through the communication channel.
  • the bank informs the bank to stop the payment transfer procedure and can report it to the relevant safety supervision department or supervisor through the alarm channel.
  • the conditions for failing to pass the certification are:
  • the bank receives and determines that the customer denied the data Dno via the communication channel:
  • the bank did not receive any feedback from the customer within the specified time limit:
  • the copyor uses the copied bank card to operate, or it may be the operation after the lost or stolen bank card is used to obtain or guess the password.
  • the cardholder does not have the real means of communication for the bank card customer, and does not receive the authentication information issued by the bank, so it cannot report the authentication information to the bank within the specified time.
  • the certificate cannot be passed. Terminate the execution of the payment transfer procedure.
  • the bank received the customer's feedback that the certified data Crd or Drd is incorrect:
  • the authentication data Crd or Drd of the present technical solution is a random number, and the authentication data in each authentication information is different, and the probability of success in using the tentative data input method within a predetermined time limit is very small.
  • the authentication information feedback process also includes: the customer exceeds the preset time limit when performing the feedback operation, and the number of times the data input error is corrected when the customer performs the feedback operation exceeds the two limit conditions of the preset number limit, and the anti-counterfeiting strength of the authentication process is enhanced. .
  • the bank device is a device having a payment transfer payment function, and includes a bank background device corresponding to an ATM machine, a POS machine, and an online banking operation interface.
  • User equipment consists of: fixed and mobile, wired and wireless communication-enabled electronic devices, including at least mobile phones, computers, mobile terminals, fixed/mobile switching devices.
  • the payment permission authentication information described in the technical solution of the present invention is: a combination of single or multiple items of short message information, QQ information, WeChat information, telephone telegram information, and facsimile information; the payment permission data includes an account number for transfer payment, a fund amount, and an extraction. Current amount and number of times; the verification code of the payment license is fixed or random change data: contains: numbers, characters, letters, words, calculations, answers, and multimedia information with graphic images, audio and video - their individual data or A combination of multiple data.

Abstract

本发明公开了一种银行支付许可认证信息的反馈验证方法，属于电子信息防伪的技术领域；银行向用户发出支付许可认证信息，由实时的时间参数转换成地址经银行设备中设置的随机函数数据源获取的密钥用对称加密算法加密支付许可认证信息为密包，将密包和时间参数进行非对称加密算法加密，经存储后发送给用户和监管方；用户接收到银行信息，进行非对称加密算法解密获得密包和时间参数，利用时间参数转换成地址经用户设备中设置的随机函数数据源获取的密钥进行对称加密算法解密密包，获得支付许可认证信息；用户将确认的支付许可认证信息进行存储，再通过信息通道和设备通道反馈给银行；银行根据用户和监管方反馈的信息确定后续执行程序。

Description

一种银行支付许可认证信息的反馈验证方法 【技术领域】
本发明属于电子信息防伪的技术领域，涉及一种银行支付许可认证信息的反馈验证方法，是一种针对利用泄露或被窃取的银行用户信息复制银行卡、复制手机卡，继而在银行设备实施资金转移、提取现金的犯罪行为而设计的有效抵御方法。
【背景技术】
银行卡是借助于电子技术、网络技术使银行业务突破了时间和空间的限制而发生了根本性变化，不但简化了银行的人工转账、提现等多种业务的繁忙和复杂，减少了现金和支票的流通，同时为银行卡用户带来自助办理银行业务快捷和便利。现在银行卡用户还可以借助网络通信技术实时监控自己账户的资金动态。
以目前的银行设备ATM机提取现金的工作过程为例：将银行卡插入读卡孔，在ATM机的人机对话界面输入一个6位数的密码，在界面上选择“取款”→选择“金额”数据→“确认”→ATM机支付对应数额的钱币→向用户发送账户支付款项的短信。分析ATM机提取现金的工作过程，只要具备银行卡和用户密码就可以轻松进行提取现金的操作过程。
近来银行卡应用中出现一些问题：比较严重的问题是办理银行卡时留给银行的用户信息，包含用户名称、身份证号、银行卡号、卡内余额、银行卡密码、开户日期、电话号码以及住址等信息遭到泄露。
银行卡用户信息泄露主要有几个途径：一是银行内部人员非法复制并出售；二是不法分子通过网络进入银行信息库，窃取了用户信息；三是不法分子通过欺 诈手段从用户那里获得，另外还有通过在银行设备上加装窃取信息的设备获取到用户银行卡信息等手段。
不法分子可以利用这些信息结合伪造、复制银行卡、手机卡的技术手段，成功复制银行卡，现实中用复制银行卡在异地甚至在国境以外的银行设备窃取资金的案件时有发生，且破案困难。
银行和相关管理部门告知用户防止损失的方法是：在接到自己账户中的资金被转走之后的提示短信后，立即到距自己最近的银行设备中进行操作，以留下时间和地点证据，表示银行卡在自己的手中，同时证明在此时间里自己并没有进行资金转账或提现的操作，并将这些证据提供给法院和公安机关追查，还可据此要求银行赔付损失。
银行防止用伪卡转账或提现成功的方法只有被动应对用户的法律诉讼，赔付用户损失的资金是无可奈何之举，另外就是向公安机关报案。
现有技术：
现有技术1申请号：200710187861.5“一种网上银行系统的安全认证方法”的专利文献公开了：“其特征在于采用了手机动态认证和数字证书的双认证安全模式…….”特征点是：应用了手机动态认证和数字证书技术，其中，数字证书的颁发、身份验证服务、证书更新需要引入证书的认证中心(CA)。
现有技术2申请号：200910164350.0“银行支付确认系统及其确认方法”的专利文献公开了“……..银行信息传输系统与银行短信确认系统进行短信确认密码的交互，银行业务系统根据客户手机与银行短信确认系统的信息交互结果控制银行处理终端进行相应操作”涉及了银行与用户以短信方式交互的认证过程，存在银行用户注册信息泄露其交互的密码和短信都会被截取利用的问题。
现有技术3申请号：201110092438.3的专利文献公开了一种手机银行客户端信息认证方法、系统及移动终端，该方法包括：“……..建立手机硬件信息与手机银行注册客户信息的绑定关系”；“………以解决客户端手机银行系统信息安全性的问题。”特征点是用户设备和银行注册的用户信息绑定关系，存在银行注册的用户信息泄露，绑定手机的信息同时泄露，绑定信息被复制，用户和银行资金被窃取的危险。
除了上述现有技术外，现有公开的文献还有针对提高银行卡安全性的多种技术措施，其中有加装硬件设备的：加装摄像头、加装数据接口、加装射频模块、加装指纹识别器等，还有改进设备的：例如银行卡改进、通信设备手机卡改进等。另外，还有设置专用的安全服务器、引入第三方认(验)证网络的算法和服务方式等。
上述现有技术存在的问题是加装硬件的技术措施存在实施起来费时、费力、工作量大的问题。改进银行卡的技术措施涉及已发行的数十亿张银行卡巨大改进工作量外，还存在改进措施的安全可靠性的技术验证问题。通信设备(手机卡)改进需要银行和通信部门以及设备制造的多部门协作，涉及了后续的管理、法律责任分担诸多问题。设置专用的安全服务器、引入第三方认(验)证网络的算法和服务方式虽然可以解决问题，可是其工作量如同设计一套新的银行安全系统，涉及算法、软硬件和系统的安全可靠性、系统易用性、监管制度、使用方法的改变以及法律责任分担问题，还有增加了用户使用成本等问题。
【发明内容】
本发明的目的在于克服上述现有技术的缺点，提供一种银行支付许可认证信息的反馈验证方法，将银行支付许可认证信息的反馈验证方法编制的程序嵌入银 行设备的业务流程中的转账、支付执行程序的前端；能够有效防止不法分子利用泄露的银行用户信息复制银行卡、手机卡，再利用泄露信息中的密码、在银行设备上实施操作，以达到窃取资金的目的；采取有效的技术措施防止银行和用户的身份认证信息和支付许可认证信息被截获、篡改、利用，确认环节及其技术措施具备安全、易用、不增加硬件、可快捷实现的特点。
为达到上述目的，本发明采用以下技术方案予以实现：
一种银行支付许可认证信息的反馈验证方法，包括以下步骤：
1)银行设备向用户发出支付许可认证信息时，将实时的时间参数转换成地址指针，根据地址指针在银行设备中设置的随机函数数据源中的指向点获取的数据作为密钥，利用该密钥采用对称加密算法将支付许可认证信息加密为第一密包；接着对第一密包和时间参数进行非对称加密算法加密为第二密包，将第二密包存储后，以短信方式发送给用户和监管方；
2)用户设备接收到发自银行的短信后，对第二密包进行非对称加密算法解密，获得第一密包和时间参数；用户设备将时间参数转换成地址指针，根据地址指针在用户设备中设置的随机函数数据源中的指向点获取的数据作为密钥，利用该密钥采用对称加密算法将密包解密，获得支付许可认证信息；
3)用户设备将确认的支付许可认证信息进行存储，再通过信息通道和设备通道反馈给银行设备；银行设备根据用户和监管方反馈的信息确定后续执行程序。
银行设有密钥生成器，生成非对称的密钥对，每个用户和银行共用一对非对称密钥，不分公钥和私钥，且不向外界公开；用户注册时，将非对称秘钥对及其加解密算法程序以“盲配法”分别配发给银行设备和用户设备。
银行设有随机函数生成器，生成随机函数及其组成的随机函数数据源，随机函数数据源是一个数据串、数据环或者数据库；用户注册时，为每个用户和银行设置了内容相同的两个随机函数数据源，分别存放在银行设备和用户设备；
银行随机函数数据源和用户随机函数数据源具有自动同步更新使随机数据源数据动态变化的功能，按照预设的时间、运算方法进行操作使随机函数数据源数据发生变化；
使随机函数数据源数据发生变化的操作至少包含：地址变换、数据变换、使数据的数据位发生变化的逻辑运算、算术运算、函数运算。
用户和银行利用对称密钥和非对称密钥的加、解密算法实现相互的身份认证：
将时间参数转换成地址，由银行设备设置的随机函数数据源获取的密钥来加密支付许可认证信息为密包发送给用户；用户接收到银行信息，将时间参数转换成地址，由用户设备设置的随机函数数据源获取的密钥进行解密密包获得支付许可认证信息，利用了对称密钥一致性进行了注册信息的确认以及身份认证；
将实时的时间参数转换成地址经银行设备中设置的随机函数数据源获取的密钥加密支付许可认证信息为密包，再将密包和时间参数经非对称加密发送给用户；用户接收到银行信息，经非对称解密获得密包和时间参数，利用时间参数转换成地址经用户设备中设置的随机函数数据源获取的密钥解密密包，获得支付许可认证信息；利用了非对称密钥加解密文件的唯一性进行注册信息的确认以及身份认证。
在银行和用户设备中各设置了一个存储发送给和接收到对方信息的电子证据数据库，支付许可认证信息做为电子证据被存储，存储的数据至少包含时间参 数数据、支付许可认证信息的数据、身份认证信息的数据。
为支付许可和身份认证信息设置了对应的交互信息通道，至少包含有：银行和用户之间的通信通道、银行和用户之间的设备通道、银行和监管方的通信通道。
银行设备和用户设备中的时间参数接收网络校时信号同步。
将银行支付许可认证信息的反馈验证方法编制的程序嵌入银行设备的业务流程中的转账、支付执行程序的前端；
银行设备是具备支付转账支付功能的设备，其中包含有ATM机、POS机、网上银行操作界面所对应的银行后台设备。
注册时，将用户设备唯一性识别信息MEID、银行帐号、手机卡SIM号以及配发的非对称密钥及其用户应用程序做绑定；
用户应用程序(APP)除了需要手动操作输入的简单数据外，程序中包含的身份信息识别算法、加解密算法都是预先设计的自动执行操作程序，用户无须具备相关专业知识；
用户设备包含：固定和移动的、有线和无线通讯功能的电子设备，至少包含手机、电脑、移动终端设备、固定/移动转接的装置。
支付许可认证信息是：短信信息、QQ信息、微信信息、电话电报信息、传真信息的单项或多项的组合；
支付许可数据包含转账支付的账号、资金额度、提取现金额度和次数；支付许可的验证码是固定或随机变化数据：包含了：数字、字符、字母、文字、算式、答题，还包含有图形图像、音视频的多媒体信息——它们的单个数据或多项数据的组合。
与现有技术相比，本发明具有以下有益效果：
本发明在下列情形下能够有效防止银行和用户的资金被非法转账、提取：
(1)、现有银行设备和用户设备不做任何硬件改动，不增加新的服务器、硬件设备以及安全监管的第三方机构，只需按照本发明所述的技术方案对银行设备和用户设备做程序升级；(2)、利用泄露的银行用户信息非法复制的用户银行卡和设备(手机卡)不能通过做了本发明升级后的银行设备进行的支付许可认证信息和身份信息的验证；(3)、利用泄露的银行用户信息所建的伪基站不能和做了本发明升级后的用户设备进行相互的支付许可和身份认证；(4)、用用户银行卡和密码在银行设备上操作，银行没有收到用户通信通道和设备通道反馈的支付许可和身份认证；(5)、设置了监管方的用户在银行设备上操作，银行没有获得监管方反馈给银行的支付许可认证信息，银行设备不执行支付、转账的操作程序。
【附图说明】
图1为现行银行设备的银行卡转账支付流程示意图；
图2为本发明方法的流程图；
图3为本发明实施例1的支付许可认证信息密包示意图；
图4为本发明实施例2的支付许可认证信息密包示意图；
图5为本发明时间参数转换的示意图。
其中，1-第一密包；2-第二密包；3-短信。
【具体实施方式】
下面结合附图对本发明做进一步详细描述：
如图1所示，以目前的银行设备ATM机提取现金的工作过程为例：将银行卡插入读卡孔，在ATM机的人机对话操作界面根据提示“请输入密码”，用户利用数字键输入一个6位数的密码，在操作界面界面上选择“取款”→选择“金额” →手动或选择对应键输入数据→“确认”→ATM机支付对应数额的钱币取款→向用户发送账户支付款项的短信→退卡。
根据所述的工作过程可见，在ATM机提取现金只要具备银行卡和用户密码就可以轻松操作实现提取现金的目的。
存在的问题1是：(1)银行卡丢失、密码泄露，被不法分子在ATM机提取卡内资金；(2)不法分子在在ATM机安装了读卡器和摄像头非法获取、并复制了银行卡信息和密码，在ATM机提取卡内资金；(3)银行的客户信息泄露，不法分子利用其中的银行卡信息复制、伪造银行卡；再利用其中的用户密码在ATM机轻松窃取用户卡内的资金。上述的存在的问题1已是常见的案件且时有发生。
实施例1：
参见图2-3，本发明银行支付许可认证信息的反馈验证方法，包括以下步骤：
1)银行设备向用户发出支付许可认证信息时，将实时的时间参数转换成地址指针，根据地址指针在银行设备中设置的随机函数数据源中的指向点获取的数据作为密钥(见图5)，利用该密钥采用对称加密算法(国密SM4或DES算法)将支付许可认证信息加密为第一密包1；接着对第一密包1和时间参数进行非对称加密算法(国密SM2或RSA算法)加密为第二密包2，将第二密包2存储后，以短信3方式发送给用户和监管方；
2)用户设备接收到发自银行的短信3后，对第二密包2进行非对称加密算法(国密SM2或RSA算法)解密，获得第一密包1和时间参数；用户设备将时间参数转换成地址指针，根据地址指针在用户设备中设置的随机函数数据源中的指向点获取的数据作为密钥(见图5)，利用该密钥采用对称加密算法(国密SM4或DES算法)将密包解密，获得支付许可认证信息；
3)用户设备将确认的支付许可认证信息进行存储，再通过信息通道和设备通道反馈给银行设备；银行设备根据用户和监管方反馈的信息确定后续执行程序。
实施例2：
如图4所示，本发明银行支付许可认证信息的反馈验证方法，包括以下步骤：
1)银行设备向用户发出支付许可认证信息时，采用非对称加密算法(国密SM2或RSA算法)将支付许可认证信息加密为第一密包1；再将实时的时间参数转换成地址指针，根据地址指针在银行设备中设置的随机函数数据源中的指向点获取的数据作为密钥(见图5)，利用该密钥对密包进行对称加密算法(国密SM4或DES算法)加密为第二密包2，将第二密包2和时间参数存储后组成短信3发送给用户和监管方；
2)用户设备接收到发自银行的第二密包2和时间参数的短信3，用户设备将时间参数转换成地址指针，根据地址指针在用户设备中设置的随机函数数据源中的指向点获取数据作为密钥(见图5)，利用该密钥采用对称加密算法(国密SM4或DES算法)将第二密包2解密获得第一密包1，再对第一密包1进行非对称加密算法(国密SM2或RSA算法)解密获得支付许可认证信息；
3)用户设备将确认的支付许可认证信息进行存储，再通过信息通道和设备通道反馈给银行设备；银行设备根据用户和监管方反馈的信息确定后续执行程序。
本发明的原理及实施过程：
银行设备升级：
将银行支付许可认证信息的反馈验证方法编制的程序嵌入银行设备的业务 流程中的转账、支付执行程序的前端；和用户设备配合重新升级用户信息，增添的主要内容有：非对称算法的银行端密钥、对称算法的随机函数数据源及它们的算法程序，以及电子证据数据库；为银行的注册程序中设置非对称密钥生成器、随机函数发生器。
为银行支付许可认证信息和身份认证设置了双因素多通道认证信息反馈，以提高认证信息的可靠性。
用户设备升级：
将用户设备唯一性识别信息MEID、银行帐号、手机卡SIM号以及配发的非对称密钥及其用户应用程序、对称算法的随机函数数据源及其算法程序以及用户端的电子证据数据库做绑定；用户应用程序除了需要手动操作输入的简单数据外，程序中包含的身份信息识别算法、加解密算法都是预先设计的自动执行操作程序，用户无须具备相关专业知识。
进一步叙述本发明具有的特征及原理：
非对称算法应用：利用非对称算法两个密钥的特点：既：利用非对称算法的两个密钥中的一个加密文件，另一个密钥可以解密，而两个密钥是不同的，且无法从其中的一个密钥推导、计算出另外一个密钥。利用非对称算法密钥的特点，不但可以构成了安全通信信道，还可以进行身份的认证。
非对称算法银行应用：银行利用非对称密钥加密发送给用户的信息只有用户的非对称密钥可以解开。反之，用户利用非对称密钥加密的信息发送给银行只有银行的非对称密钥可以解开。由此可见，即使信息被他人截获了也无法解密，没有利用价值。本发明就是依此来应对不法分子窃取资金的企图，由于泄露的银行用户信息中没有用户设备中的非对称密钥，也不可能推算出来。因此，不法分子 虽然能够利用泄露的银行用户信息复制银行卡、用户设备(手机)卡、用户密码，但是，无法通过本发明设计的利用非对称算法进行的银行和用户之间的身份认证。所以，本发明所述的非对称算法在银行的应用，堵塞了不法分子利用泄露的银行用户信息，进行非法复制、从银行设备窃取资金的漏洞。
防注册信息泄露：银行设有密钥生成器，生成非对称的密钥对；用户注册时，将非对称秘钥对及其加解密算法程序分别以操作人员不可见的常用“盲配法”给银行和用户，是为了防止注册时密钥信息在密钥生成的源头上被操作人员收集、泄露；所述的盲配法，就是在注册端只需输入用户公开信息就可完成注册，密钥分发等不公开信息则由程序完成，注册端对不公开信息是不可见的。
非对称算法密钥与数字证书的区别：本发明所述的“每个用户和银行共用一对非对称密钥且不分公钥和私钥，不向外界公开”的特征，区别于数字证书的非对称密钥对的应用方法，(应用数字证书的技术方案，见本申请背景技术中所述的现有技术1)。因为典型的数字证书的应用是基于PKI架构(Public Key Infrastructure)既“公钥基础设施”，用户和银行各有一个证书，每个证书都有一对(两个)非对称密钥，必须将密钥中的一个作为公钥公开，还需要引入了认证中心(CA)作为第三方，认证中心网络用公钥来做验证身份的信息，显得繁复冗杂。另外，数字证书的使用要给认证机构(CA)支付昂贵的密钥验证费用，且需每两年做一次更新，增加了用户的经济负担。
本发明应用非对称算法，是鉴于银行和用户“一对一”的通信关系，双方注册认定，不向外界公开密钥使其安全性成倍提高。
银行用户相互的身份认证：
对称密钥身份验证法：所述的随机对称密钥身份认证是由银行采集的实时时 间参数、依据该时间参数获取的加密和解密密钥、以及用加解密文件来验证加密密钥和解密密钥的一致性进行的身份验证的算法。具体实施方法：将时间参数转换成地址指针，根据地址指针在银行设备设置的随机函数数据源中的指向点获取的数据作为密钥来加密支付许可认证信息为密包发送给用户；用户接收到银行信息，将时间参数转换成地址指针，根据地址指针在用户设备设置的随机函数数据源中的指向点获取的数据作为密钥进行解密密包获得支付许可认证信息，利用了对称密钥一致性进行了注册信息的确认以及身份认证；
非对称密钥身份验证法：将实时的时间参数转换成地址指针经银行设备中设置的随机函数数据源获取的密钥加密支付许可认证信息为密包，再将密包和时间参数经非对称加密发送给用户；用户接收到银行信息，经非对称解密获得密包和时间参数，利用时间参数转换成地址经用户设备中设置的随机函数数据源获取的密钥解密密包，获得支付许可认证信息；利用了非对称密钥加解密文件的可行性进行注册信息的确认以及身份认证。
对称密钥随机化：用户注册时，为银行和每个用户设置了内容唯一的、且相同的两个随机数据源，分别存放在银行设备的银行随机数据源和存放在用户设备的用户随机数据源。为了防止银行发出的认证信息被非法截获后解密并利用，就要使每次密钥不相同。本发明的技术方案是：将时间参数转换成地址，在随机函数数据源获取的密钥获取密钥，由于时间参数是一个不重复变量，因此，每个时间点获取的密钥就不同，从而实现了对称密钥每次不同目的。
电子证据数据库：在银行和用户设备中各设置了一个存储发送给和接收到对方信息的电子证据数据库，存储作为电子证据的数据，电子证据的数据至少包含时间参数、支付许可认证信息、身份认证信息的数据。电子证据数据库存储了银 行和用户历次的支付许可和身份认证信息，可供查询、追溯当前和既往的信息。当发生抵赖行为或电子证据发生丢失、错误时，利用电子证据数据库中的地址、时序排列数据所对应信息内容可作为证据提供研判。
时间参数的同步：银行设备和用户设备中的时间参数接收网络校时信号同步，校时信号源自国家授时中心设置在北斗卫星上时间源发出的标准时间参数，或者源自国家授时中心设置在大地原点的长波无线电时间源发出的标准时间参数。
对抗伪基站：银行随机数据源和用户随机数据源具有自动同步更新使随机数据源数据动态变化的功能，按照预设的时间、运算方法进行操作使随机数据源数据发生变化；使随机数据源数据发生变化的操作至少包含：地址变换、数据变换、使数据的数据位发生变化的逻辑运算、算术运算、函数运算。
由于银行随机数据源和用户随机数据源具有自动同步更新使随机数据源数据动态变化的功能，伪基站制作者在泄露的银行用户注册信息中只能拷贝到静态的银行随机函数数据源，如果预设的动态更新时间很短(例如秒或毫秒级别)，在拷贝和向伪基站重置数据的过程耗费的时间中，用户设备(手机中)的用户随机函数数据源早已更新过很多次了。所以，伪基站置入的银行随机函数数据库不能同步于用户的随机函数数据库，获取的对称密钥不一致，验证信息不能通过，建立不了伪基站和用户的通信联系，有效地对抗了利用伪基站进行欺诈活动。
设置安全监管通道：银行和监管者之间设置了一个监管通道，银行通过监管通道向监管方发送用户的支付许可认证信息，接收到监管方的反馈信息后，确定支付许可的程序执行。监管方可以是用户授权的信任人、企业内部的资金管理老总、还可以是部门或国家设置的信息安全单位(例如公安部门的防欺诈数据中 心)。
(1)防电信欺诈：当前，利用电信手段虚构事实，隐瞒真相、冒充公检法工作人员、冒充社保电力工作人员、伪造汽车、房产以及获奖退税，冒充熟人等电信诈骗手段层出不穷。为了防止或减少上当受骗的被害人损失，相关部门对银行设备(主要是ATM机和POS机)转账支付制定了一个“延时支付(24小时)”的政策，以留给被害人“觉醒悔悟”时间，从目前其政策的执行效果来看，防电信诈骗取得一定的效果。但是也带来了“延时支付”使大量资金流转速度、货物流转速度降低的弊端，给经济社会带来非常不利影响。
本发明的技术方案中设计了一个银行和监管者之间的安全监管通道，可由用户选定。监管方有对用户转账、支付信息进行辨识、认可和制止的职责，基于“旁观者清，当局者迷”思维逻辑，监管方发现、识别、揭露出电信诈骗者所设的骗局的概率大大高于被害人经过一定时间“觉醒悔悟”概率，能够有效防止上当受骗，及时制止被害人的经济损失。监管方和监管通道的设置还可以减少不需要“延时支付”用户群体，在防骗局、提高资金安全的前提下提高资金和货物的周转速度。
(2)防资金挪用：企事业单位可以设置资金安全监管通道，当有相关人进行转账支付时，银行和资金监管负责人互动就可确认转账支付的实施与否，这种不受时间和地点的限制资金监管方式不但提高了资金监管工作的信息化，便捷化，还能够有效地防止相关人员私自挪用资金的非法行为。
(3)带来便捷：用户委托他人在银行设备上进行转账支付、提取现金的操作，可以将自己的银行卡及密码提供给受托人，银行设备把转账支付信息发送到用户设备(手机)，用户确认了转账支付的数据(账号、转账或提现的额度等)， 通过通信通道将确认数据反馈给银行，再将设备通道的确认数据转告受托人，受托人在银行设备上输入确认数据，银行设备执行转账支付的操作程序。
用户反馈信息的防伪甄别：
为银行支付许可认证信息和身份认证设置了双因素多通道用户反馈信息通道，用户反馈信息通道至少包含有：银行和用户之间的通信通道、银行和用户之间的设备通道、银行和用户监管方的通信通道。
认证通过的条件是：
规定时限内银行收到并确认是由客户经信息通道反馈认定数据Crd，通过银行的前置设备或网络操作界面进行操作反馈到银行的认定数据Drd。
认证信息中的否认数据至少包含了经信息通道反馈的否认数据Dno，以及经报警信息通道的报警数据Ad，客户通过通信信道将Dno数据反馈到银行；客户可通过通信信道将Ad数据立即反馈到银行，通知银行停止执行支付转账程序，又可通过报警通道报送至相关安全监管部门或监管人。
认证不通过的条件是：
银行收到并认定是由客户经通信信道反馈的否认数据Dno：
——有可能是有人利用复制卡在执行支付转账操作，以及经报警信息通道报送至相关安全监管部门或监管人的报警数据Ad。
在规定时限内银行没有收到客户任何反馈信息：
——有可能是复制者利用复制的银行卡在操作，也有可能是利用丢失、窃取的银行卡获取或者猜测到密码后进行的操作。两种可能的情况下都说明其持卡人没有真正的银行卡客户的通信手段，接收不到银行发出的认证信息，所以也就无法在规定的时间内向银行反馈认证信息，认证不能通过，银行终止支付转账程序 的执行。
银行收到客户反馈的认定数据Crd或Drd不正确：
——有可能是熟悉认证过程的人利用复制卡、窃取卡、丢失卡在银行设备上进行支付转账操作做的试探性数据输入，当认定数据是固定的内容时这种试探往往能够凑效。本技术方案的认定数据Crd或Drd是随机数，每次认证信息中的认证数据都不一样，用这种试探性数据输入手法在规定的时限内获得成功的几率非常小。
认证信息反馈过程还有：客户做反馈操作时超过了预设的时限、以及客户做反馈操作时改正数据输入错误的次数超过了预设次数限制的两项条件限制，增强了认证过程的防伪强度。
本发明的技术方案所述的银行设备是具备支付转账支付功能的设备，其中包含有ATM机、POS机、网上银行操作界面所对应的银行后台设备。用户设备包含：固定和移动的、有线和无线通讯功能的电子设备，至少包含手机、电脑、移动终端设备、固定/移动转接的装置。
本发明的技术方案所述的支付许可认证信息是：短信信息、QQ信息、微信信息、电话电报信息、传真信息的单项或多项的组合；支付许可数据包含转账支付的账号、资金额度、提取现金额度和次数；支付许可的验证码是固定或随机变化数据：包含了：数字、字符、字母、文字、算式、答题，还包含有图形图像、音视频的多媒体信息——它们的单个数据或多项数据的组合。
以上内容仅为说明本发明的技术思想，不能以此限定本发明的保护范围，凡是按照本发明提出的技术思想，在技术方案基础上所做的任何改动，均落入本发明权利要求书的保护范围之内。

Claims (10)

  1. 一种银行支付许可认证信息的反馈验证方法，其特征在于，包括以下步骤：
    1)银行设备向用户发出支付许可认证信息时，将实时的时间参数转换成地址指针，根据地址指针在银行设备中设置的随机函数数据源中的指向点获取的数据作为密钥，利用该密钥采用对称加密算法将支付许可认证信息加密为第一密包(1)；接着对第一密包(1)和时间参数进行非对称加密算法加密为第二密包(2)，将第二密包(2)存储后，以短信(3)方式发送给用户和监管方；
    2)用户设备接收到发自银行的短信(3)后，对第二密包(2)进行非对称加密算法解密，获得第一密包(1)和时间参数；用户设备将时间参数转换成地址指针，根据地址指针在用户设备中设置的随机函数数据源中的指向点获取的数据作为密钥，利用该密钥采用对称加密算法将密包解密，获得支付许可认证信息；
    3)用户设备将确认的支付许可认证信息进行存储，再通过信息通道和设备通道反馈给银行设备；银行设备根据用户和监管方反馈的信息确定后续执行程序。
  2. 根据权利要求1所述的银行支付许可认证信息的反馈验证方法，其特征在于，步骤1)中，银行设备设有密钥生成器，生成非对称的密钥对，每个用户和银行共用一对非对称密钥；用户注册时，将非对称秘钥对及其加解密算法程序以“盲配法”分别配发给银行设备和用户设备。
  3. 根据权利要求1所述的银行支付许可认证信息的反馈验证方法，其特征在于，步骤1)中，银行设备设有随机函数生成器，用于生成随机函数及其组成的随机函数数据源；随机函数数据源为数据串、数据环或者数据库；用户注册时，为每个用户和银行设置内容相同的两个随机函数数据源，分别存放在银行设备和用户设备中；
    银行设备中的随机函数数据源和用户设备中的随机函数数据源具有自动同步更新使随机数据源数据动态变化的功能，按照预设的时间、运算方法进行操作使随机函数数据源数据发生变化；
    使随机函数数据源数据发生变化的操作至少包含：地址变换、数据变换和使数据的数据位发生变化的逻辑运算、算术运算和函数运算。
  4. 根据权利要求1所述的银行支付许可认证信息的反馈验证方法，其特征在于，步骤2)中，在银行设备和用户设备中各设置一个用于存储发送和接收对方信息的电子证据数据库，支付许可认证信息做为电子证据被存储于电子证据数据库中；存储的数据至少包含时间参数数据、支付许可认证信息的数据、身份认证信息的数据。
  5. 根据权利要求4所述的银行支付许可认证信息的反馈验证方法，其特征在于，银行设备和用户设备中的时间参数接收网络校时信号并同步；银行设备是具备支付转账支付功能的设备，包括ATM机、POS机或网上银行操作界面所对应的银行后台设备；用户设备为具有通讯功能的电子设备，包括手机、电脑、移动终端设备或固定/移动转接的装置。
  6. 根据权利要求4所述的银行支付许可认证信息的反馈验证方法，其特征在于，注册时，将用户设备唯一性识别信息MEID、银行帐号、手机卡SIM号以及配发的非对称密钥及其用户应用程序做绑定；用户应用程序中包含的身份信息识别算法、加解密算法是预先设计的自动执行操作程序。
  7. 根据权利要求4所述的银行支付许可认证信息的反馈验证方法，其特征在于，步骤3)中，信息通道是用于支付许可认证信息和身份认证信息交互的交互信息通道，交互信息通道包括银行和用户之间的通信通道、银行设备和用户设备 上的设备通道、银行和监管方的通信通道。
  8. 根据权利要求1-6任意一项所述的银行支付许可认证信息的反馈验证方法，其特征在于，步骤4)用户设备将确认的支付许可认证信息通过信息通道反馈给银行，并通过设备通道的操作将确认的支付许可认证信息反馈给银行设备；其特征还在于将反馈验证方法的程序设置于银行设备的业务流程中的转账、支付执行程序的前端。
  9. 根据权利要求1-6任意一项所述的银行支付许可认证信息的反馈验证方法，其特征在于，支付许可认证信息为短信信息、QQ信息、微信信息、电话电报信息、传真信息中的一种或多种的组合信息；
    支付许可认证信息的支付许可数据包含转账支付的账号、资金额度以及提取现金额度和次数；支付许可认证信息的验证码是固定或随机变化数据，包括数字、字符、字母、文字、算式、答题、图形图像、音视频的一种或多种数据的组合。
  10. 一种银行支付许可认证信息的反馈验证方法，其特征在于，包括以下步骤：
    1)银行设备向用户发出支付许可认证信息时，采用非对称加密算法将支付许可认证信息加密为第一密包(1)；再将实时的时间参数转换成地址指针，根据地址指针在银行设备中设置的随机函数数据源中的指向点获取的数据作为密钥，利用其密钥对密包进行对称加密算法加密为第二密包(2)，将第二密包(2)和时间参数存储后组成短信(3)发送给用户和监管方；
    2)用户设备接收到发自银行的含有第二密包(2)和时间参数的短信(3)，用户设备将时间参数转换成地址指针，根据地址指针在用户设备中设置的随机函数数据源中的指向点获取的数据作为密钥，利用其密钥采用对称加密算法将第二 密包(2)解密获得第一密包(1)，再对第一密包(1)进行非对称加密算法解密获得支付许可认证信息；
    3)用户设备将确认的支付许可认证信息进行存储，再通过信息通道和设备通道反馈给银行设备；银行设备根据用户和监管方反馈的信息确定后续执行程序。
PCT/CN2018/071372 2017-01-18 2018-01-04 一种银行支付许可认证信息的反馈验证方法 WO2018133674A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710030315.4 2017-01-18
CN201710030315.4A CN106682903B (zh) 2017-01-18 2017-01-18 一种银行支付许可认证信息的反馈验证方法

Publications (1)

Publication Number Publication Date
WO2018133674A1 true WO2018133674A1 (zh) 2018-07-26

Family

ID=58859188

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/071372 WO2018133674A1 (zh) 2017-01-18 2018-01-04 一种银行支付许可认证信息的反馈验证方法

Country Status (2)

Country Link
CN (1) CN106682903B (zh)
WO (1) WO2018133674A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111339270A (zh) * 2020-02-20 2020-06-26 中国农业银行股份有限公司 一种密码校验方法及装置
CN111740943A (zh) * 2020-03-31 2020-10-02 新华三信息安全技术有限公司 一种防攻击方法、装置、设备及机器可读存储介质

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106682903B (zh) * 2017-01-18 2017-11-28 齐宇庆 一种银行支付许可认证信息的反馈验证方法
CN107578511A (zh) * 2017-09-15 2018-01-12 林海航 一种智能锁及其智能钥匙
CN108053212A (zh) * 2017-12-29 2018-05-18 齐宇庆 一种软硬件结合的银行支付许可认证反馈信息系统
CN110012004B (zh) * 2018-10-12 2020-08-18 南京惠达威信息科技有限公司 一种基于数据暂存技术的数据防泄漏方法
CN110046878A (zh) * 2018-11-13 2019-07-23 阿里巴巴集团控股有限公司 一种处理转账交易的方法及装置
CN112016063A (zh) * 2019-05-29 2020-12-01 福州云豆网络科技有限公司 一种利用des算法构建的银行数据加密方法
TWI818478B (zh) * 2022-03-22 2023-10-11 兆豐國際商業銀行股份有限公司 帳戶授權管理系統

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101667276A (zh) * 2009-09-04 2010-03-10 四川钧通网络技术服务有限责任公司 银行支付确认系统及其确认方法
CN102609841A (zh) * 2012-01-13 2012-07-25 东北大学 一种基于数字证书的远程移动支付系统及支付方法
CN104318432A (zh) * 2014-10-21 2015-01-28 上海鹏逸电子商务有限公司 一种交易信息传输方法及系统和移动终端
US20160224950A1 (en) * 2015-02-02 2016-08-04 Michael J. Attar Method for Consolidating Multiple Merchants Under a Common Merchant Payment System
CN106682903A (zh) * 2017-01-18 2017-05-17 齐宇庆 一种银行支付许可认证信息的反馈验证方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101901306A (zh) * 2009-06-01 2010-12-01 北京焜安信息技术有限公司 网络交易加密方法及其所采用的动态密码设备
CN102129741A (zh) * 2010-01-18 2011-07-20 上海启电信息科技有限公司 一种银行卡防盗用的系统
CN103186850B (zh) * 2011-12-28 2016-07-06 中国银联股份有限公司 用于获取支付凭证的方法、设备及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101667276A (zh) * 2009-09-04 2010-03-10 四川钧通网络技术服务有限责任公司 银行支付确认系统及其确认方法
CN102609841A (zh) * 2012-01-13 2012-07-25 东北大学 一种基于数字证书的远程移动支付系统及支付方法
CN104318432A (zh) * 2014-10-21 2015-01-28 上海鹏逸电子商务有限公司 一种交易信息传输方法及系统和移动终端
US20160224950A1 (en) * 2015-02-02 2016-08-04 Michael J. Attar Method for Consolidating Multiple Merchants Under a Common Merchant Payment System
CN106682903A (zh) * 2017-01-18 2017-05-17 齐宇庆 一种银行支付许可认证信息的反馈验证方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HU , XIANGYI ET AL.: "A Credible Mobile Payment Solution", NETWORK SECURITY TECHNOLOGY & APPLICATION, 8 June 2016 (2016-06-08) *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111339270A (zh) * 2020-02-20 2020-06-26 中国农业银行股份有限公司 一种密码校验方法及装置
CN111740943A (zh) * 2020-03-31 2020-10-02 新华三信息安全技术有限公司 一种防攻击方法、装置、设备及机器可读存储介质
CN111740943B (zh) * 2020-03-31 2022-04-01 新华三信息安全技术有限公司 一种防攻击方法、装置、设备及机器可读存储介质

Also Published As

Publication number Publication date
CN106682903B (zh) 2017-11-28
CN106682903A (zh) 2017-05-17

Similar Documents

Publication Publication Date Title
WO2018133674A1 (zh) 一种银行支付许可认证信息的反馈验证方法
CN103714639B (zh) 一种实现对pos终端安全操作的方法及系统
CN1689297B (zh) 使用密钥基防止未经授权分发和使用电子密钥的方法
US20190005470A1 (en) Accredited certificate issuance system based on block chain and accredited certificate issuance method based on block chain using same, and accredited certificate authentication system based on block chain and accredited certificate authentication method based on block chain using same
CN101662469B (zh) 基于USBKey网上银行交易信息认证的方法和系统
US20060123465A1 (en) Method and system of authentication on an open network
CN1831865B (zh) 一种基于cpk的电子银行安全认证系统和方法
CN104322003B (zh) 借助实时加密进行的密码认证和识别方法
CN109039652B (zh) 一种数字通证的生成及应用方法
CN105900375A (zh) 用于在认证交易中保护身份的高效方法
CN105046488A (zh) 用于生成交易签署一次性密码的方法、设备和系统
CN104798083A (zh) 用于验证访问请求的方法和系统
CN106953732B (zh) 芯片卡的密钥管理系统及方法
CN112232814A (zh) 支付密钥的加密和解密方法、支付认证方法及终端设备
CN106936588A (zh) 一种硬件控制锁的托管方法、装置及系统
CN108768941B (zh) 一种远程解锁安全设备的方法及装置
CN109600296A (zh) 一种证件链即时通讯系统及其使用方法
CN104125230A (zh) 一种短信认证服务系统以及认证方法
CN108401494B (zh) 一种传输数据的方法及系统
CN111798224A (zh) 一种基于sgx的数字货币支付方法
CN102521777B (zh) 一种实现远程信贷的方法及系统
US6606387B1 (en) Secure establishment of cryptographic keys
CN111181960A (zh) 一种基于终端设备区块链应用安全授信和签名系统
CN110098925A (zh) 基于非对称密钥池对和随机数的量子通信服务站密钥协商方法和系统
US20120131347A1 (en) Securing of electronic transactions

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18741662

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18741662

Country of ref document: EP

Kind code of ref document: A1