CN100576796C - System and method for secure identity authentication in online banking system - Google Patents

Abstract

The invention discloses a method for security identity authentication in an online banking system, comprising: a service providing device returns the coordinates of the first dynamic password to a client terminal device; the client terminal device inputs the first dynamic password to the security service device, The safety service device judges whether the dynamic password for the first time is correct, and if it is correct, sends the first dynamic password verification passing information to the service providing device; the service providing device receives the dynamic password verification passing information for the first time, and sends the second dynamic password coordinate Return to the client terminal device, the client terminal device inputs the dynamic password for the second time to the security service device; the security service device judges whether the second time dynamic password imported by the client terminal device is correct, and if it is correct, then sends the security identity authentication pass to the client terminal device information. The invention also discloses a system for performing security identity authentication in the online banking system. The invention improves the security of the online banking system.

Description

System and method for secure identity authentication in online banking system

technical field

The invention relates to the technical field of identity authentication in information systems, in particular to a system and method for secure identity authentication in an online banking system.

Background technique

With the rapid development of online banking, customers have higher and higher requirements for the security of online banking transactions. At present, there are many ways to improve the security of online banking transactions, and the dynamic password card is one of the more commonly used ways.

As shown in Figure 1, Figure 1 is a schematic diagram of the current dynamic password card. The dynamic password card is equivalent to a dynamic online banking password. There are several strings printed on the dynamic password card in the form of a matrix. Randomly give two password card coordinates, such as password card coordinates A1 and B2, where A1 corresponds to "223" and B2 corresponds to "334". The customer finds the password combination "223" and "334" and enter it into the online banking system. Only when the combination of passwords "223" and "334" are all input correctly, the customer can complete the relevant transaction.

This combination of passwords changes dynamically, and the passwords entered by users are different each time they use them, and they will become invalid after the transaction is completed, thereby preventing criminals from stealing funds through stealing customers' static passwords and ensuring the security of online banking.

With the continuous popularization of dynamic password cards and the continuous development of network technology, at present, some criminals take advantage of customers' weak security awareness and unfamiliarity with bank payment processes to defraud customers of dynamic password card information through fake websites and other means, so that customers' funds are safe Hidden danger. The current dynamic password card implementation method faces the following risks:

(1) Attack by continuously refreshing the coordinates of the password card. The criminals first obtain the customer's online banking login card number, login password and several sets of dynamic password coordinate values on the fake website, and then continuously refresh the dynamic password coordinates on the real website until the coordinates corresponding to the defrauded dynamic password coordinates appear on the real website. The coordinates of the dynamic password, and then input the coordinate value of the dynamic password defrauded into the customer's online banking account, so as to realize the illegal attack on the customer's online banking account. For example, when a customer logs in to a fake website, the customer can be asked to enter the two coordinate values of A1 and B2, and then the criminals log in to the real website (provided that the criminals have obtained the customer's login card number and login password), and constantly refresh the coordinates , until the page shows that the coordinates required to be input are A1 and B2, and then enter the cheated A1 and B2 coordinates into the online banking system.

(2) Man-in-the-middle website attack. Criminals create fake e-commerce websites and lure customers to visit fraudulent websites. After stealing the customer's online banking login password, they log in to the customer's online banking to obtain the current set of dynamic password coordinates (such as A1, B2), and place the coordinates on the fraudulent website. Among them, the customer is required to input the corresponding code card coordinate password (that is, the dynamic password coordinate value). After obtaining the password card coordinate password input by the customer, the criminals immediately operate the customer's online banking to transfer money in a short time, causing customer losses.

Therefore, the current way of performing security identity authentication by means of a dynamic password card is in urgent need of reformation.

Contents of the invention

(1) Technical problems to be solved

In view of this, an object of the present invention is to provide a system for secure identity authentication in the online banking system, to overcome the low security deficiency of the current dynamic password card method for identity authentication, and to improve the security of the online banking system .

Another object of the present invention is to provide a method for secure identity authentication in the online banking system, so as to overcome the low security deficiency of the current dynamic password card method for identity authentication and improve the security of the online banking system.

(2) Technical solution

In order to achieve the above-mentioned purpose, the present invention provides a system for secure identity authentication in the online banking system, the system at least includes:

The data management device is used to run the database management system, store the security data and authentication information of the online banking dynamic password card, and be responsible for the customer access management after the authentication is passed;

The service providing device is used to obtain the coordinates of the first dynamic password from the data management device according to the transaction request received from the client terminal device, and return the acquired coordinates of the first dynamic password to the client terminal device; Obtain the coordinates of the dynamic password for the second time from the data management device after the input first dynamic password verification passes the information, and return the coordinates of the dynamic password for the second time obtained to the client terminal device;

The security service device is used to receive the first dynamic password and the second dynamic password input by the client terminal device, determine whether the time for the client terminal device to input the first dynamic password and the second dynamic password has timed out, and according to the data management The dynamic password obtained by the device judges whether the first dynamic password and the second dynamic password are correct. When confirming that the first dynamic password is correct, it sends the first dynamic password verification pass message to the service provider device. After confirming the second dynamic password When correct, send the security identity authentication pass information to the client terminal device;

The network security device is used to protect the security of the enterprise's internal network and prevent illegal users from public networks from accessing and attacking the internal network;

The client terminal device is used to connect to the service provider device or the security service device through the network security device, so as to realize the interaction between the service provider device or the security service device and the client.

In the above solution, the data management device, the service providing device and the security service device are connected to the network security device through an internal network;

The internal network is Ethernet, or a local area network optical fiber distributed data interface FDDI or token ring Token-Ring, which is used to realize the communication among the data management device, the service providing device and the security service device.

In the above solution, the network security device is a firewall, connected to the client terminal device through a public network; the public network is the Internet or an external network of the enterprise.

In the above scheme, when the service provider device returns the obtained dynamic password coordinates for the first time to the client terminal device, it is further used to send a timing start message to the security service device, and the security service device receives the timing start message. Start counting, if the timing reaches the preset valid time for the first dynamic password coordinates, and the client terminal device still does not input the first dynamic password or the first dynamic password imported by the client terminal device is still wrong, then send a message to the client terminal. The device prompts that the transaction has timed out, and sends an instruction to the service provider device, instructing the service provider device to resend a new first dynamic password coordinate to the client terminal device, which is different from the previous first dynamic password coordinate. password coordinates, the service provider device obtains the new first dynamic password coordinates from the data management device according to the received instruction, and returns the obtained new first dynamic password coordinates to the client terminal device; Within the validity period of the new first dynamic password coordinates, the security service device receives the correct first dynamic password input by the client terminal device, and then sends the first dynamic password verification pass message to the service provider device.

In the above solution, the security service device is further used to set the threshold for the number of times that the client terminal device inputs the dynamic password for the first time to the security service device. If the security service device judges that the first dynamic password input by the client terminal device is incorrect, then The customer terminal device is allowed to input the dynamic password for the first time specified by the threshold. If the number of wrong inputs reaches the specified threshold, the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day.

In the above scheme, when the service provider device returns the obtained second dynamic password coordinates to the client terminal device, it is further used to send a timing start information to the security service device, and the security service device starts after receiving the timing start information. Timing, if the timing reaches the preset valid time of the second dynamic password coordinates, the client terminal device has not yet input the second dynamic password or the second dynamic password input by the client terminal device is still wrong, then the client terminal device Prompt that the transaction is overtime, and send an instruction to the service provider device, instructing the service provider device to resend a new first-time dynamic password coordinate to the client terminal device, and the new first-time dynamic password coordinate is different from the previous first-time dynamic password coordinates, the service provider device obtains the coordinates of the new first dynamic password from the data management device according to the received instruction, and returns the acquired coordinates of the new first dynamic password to the client terminal device; Within the effective time of the second dynamic password coordinates, the security service device receives the correct second dynamic password input by the client terminal device, and then sends the security identity authentication passing information to the client terminal device.

In the above solution, the security service device is further used to set the threshold for the number of times the client terminal device inputs the second dynamic password to the security service device, and if the security service device judges that the second dynamic password input by the client terminal device is incorrect, then The client terminal device is allowed to input the second dynamic password for the specified number of thresholds. If the wrong number of times input reaches the specified threshold, the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day.

In order to achieve the above another purpose, the present invention provides a method for secure identity authentication in an online banking system, which is applied in an online banking system including at least a data management device, a service providing device, a security service device and a client terminal device A system for secure identity authentication, the method comprising:

A. The client terminal device sends a transaction request to the service provider device, and the service provider device obtains the first dynamic password coordinates from the data management device according to the received transaction request;

B. The service providing device returns the obtained first dynamic password coordinates to the client terminal device, and the client terminal device inputs the first dynamic password to the security service device according to the received first dynamic password coordinates;

C. The security service device judges whether the first dynamic password input by the client terminal device is correct, and if correct, sends the first dynamic password verification pass message to the service provider device;

D. The service providing device receives the first dynamic password verification pass information, obtains the second dynamic password coordinates from the data management device, and returns the obtained second dynamic password coordinates to the client terminal device;

E. The client terminal device inputs the second dynamic password to the security service device according to the received second dynamic password coordinates;

F. The security service device judges whether the second dynamic password input by the client terminal device is correct, and if it is correct, sends security identity authentication passing information to the client terminal device.

In the above scheme, the valid time of the first dynamic password coordinates is preset, and the service provider device in step B returns the obtained first dynamic password coordinates to the client terminal device, and further sends a timing start to the security service device. information, the method further includes: the security service device starts timing after receiving the timing start information, if the timing reaches the preset valid time of the first dynamic password coordinates, the client terminal device still does not input the first dynamic password or the client terminal The dynamic password that device imports for the first time is still wrong, then prompts transaction timeout to client terminal device, and sends instruction to service provider device, instructs service provider device to send a new first time dynamic password coordinate to client terminal device again, The new first dynamic password coordinates are different from the previous first dynamic password coordinates, and the service provider device obtains the new first first dynamic password coordinates from the data management device according to the received instruction, and turns to step B; if Within the valid time of the new first dynamic password coordinates set in advance, the security service device receives the correct first dynamic password input by the client terminal device, and then executes the sending of the first dynamic password described in step C to the service provider device. One-time dynamic password verification pass information.

In the above scheme, the threshold value of the number of times that the client terminal device inputs the dynamic password for the first time to the security service device is further set, and if the security service device judges that the first dynamic password input by the client terminal device is incorrect in step C, then the client terminal device is allowed to Input the dynamic password for the first time specified by the threshold, if the wrong number of times entered reaches the specified threshold, the customer's online banking transaction authority on the day will be locked, and the lock will be automatically unlocked the next day.

In the above scheme, the valid time of the second dynamic password coordinates is preset, and the service providing device described in step D returns the obtained second dynamic password coordinates to the client terminal device, and further sends a timing start to the security service device. information, the method further includes: the security service device starts timing after receiving the timing start information, if the timing reaches the preset valid time of the second dynamic password coordinates, the client terminal device still does not input the second dynamic password or the client terminal The second time dynamic password that device imports is still wrong, then prompts transaction overtime to client terminal device, and sends instruction to service provider device, instructs service provider device to send a new first time dynamic password coordinate to client terminal device again, The new first dynamic password coordinates are different from the previous first dynamic password coordinates, and the service provider device obtains the new first first dynamic password coordinates from the data management device according to the received instruction, and turns to step B; if Within the valid time of the preset second dynamic password coordinates, the security service device receives the correct second dynamic password input by the client terminal device, and then executes the process of sending the security identity authentication to the client terminal device described in step F. information.

In the above-mentioned scheme, the threshold value of the number of times that the client terminal device inputs the dynamic password for the second time to the security service device is further set, and if the security service device judges that the second dynamic password input by the client terminal device is incorrect in step F, then the client terminal device is allowed to Input the second dynamic password for the prescribed number of times of the threshold, if the wrong number of times of input reaches the number of times prescribed for the threshold, the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day.

(3) Beneficial effects

As can be seen from the foregoing technical solutions, the present invention has the following beneficial effects:

1. The system and method for secure identity authentication in the online banking system provided by the present invention, on the basis of in-depth research on the implementation of the current dynamic password card, improves the current implementation of the dynamic password card and adopts a secondary The way of challenge avoids the attack of continuously refreshing the coordinates of the password card and the attack of the man-in-the-middle website, and greatly improves the security of online banking.

2. The system and method for secure identity authentication in the online banking system provided by the present invention can defend against continuous coordinate refreshing attacks and effectively improve the security of dynamic password card usage. The present invention increases the probability of the expected coordinates of the first challenge by refreshing the coordinates of the password card, but after the coordinates of the first challenge are correctly entered, the hacker cannot obtain another expected coordinate by refreshing the coordinates. The coordinates of the second challenge are not within the control range of the hacker. The hacker cannot complete the transaction within the effective time of the coordinates of the second password card. After the timeout, the hacker will restart the process of another second challenge.

3. The system and method for secure identity authentication in the online banking system provided by the present invention can defend against man-in-the-middle website attacks, and effectively improve the security of using the dynamic password card. At present, the attack method used by hackers is to contact customers in the form of counterfeit website customer service. When customers log in to fraudulent websites that include password card coordinates and payment pages, the correct password card coordinates are usually not displayed immediately. After obtaining the information, the "customer service personnel" After modifying the password card coordinates of the website, the customer is required to refresh the payment page to deceive the user into inputting and intercepting it. However, the second challenge solution provided by the present invention will require a second challenge response, which increases the complexity, and the "customer service personnel" of the fraudulent website need to intercept the password card input by the customer in a very short time (generally 2 minutes). Entering the password, obtaining the coordinates of the second challenge, changing the webpage of the fraudulent website, defrauding the customer to enter again, obtaining the password for the second challenge and entering it can complete a transaction. It is difficult to complete it manually, so the threat is relatively small.

4. The system and method for secure identity authentication in the online banking system provided by the present invention have low cost and strong compatibility for the current online banking system transformation, and there is no need to carry out major changes to the existing one-challenge dynamic password card implementation. The changes are low in cost.

5. The system and method for secure identity authentication in the online banking system provided by the present invention do not need to redesign the medium of the password card, and can fully use the dynamic password card medium of one-time challenge mode, which is different from the existing one-time password card medium. The dynamic password card of the challenge is compatible for use.

Description of drawings

Fig. 1 is the schematic diagram of present dynamic password card;

Fig. 2 is the structural block diagram that carries out security identity authentication system in the online banking system provided by the present invention;

Fig. 3 is the flow chart of the method for security identity authentication in the online banking system provided by the present invention;

4 is a flow chart of a method for secure identity authentication in an online banking system according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of the interface of step 408 in FIG. 4 .

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be described in further detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

On the basis of in-depth study of the current dynamic password card implementation, the present invention improves the current dynamic password card implementation and adopts a secondary challenge method, avoiding the continuous refreshing of the password card coordinate attack and the man-in-the-middle website attack, and greatly improving the user experience. Online banking uses security.

As shown in Figure 2, Figure 2 is a structural block diagram of a security identity authentication system in the online banking system provided by the present invention, the system includes a data management device 1, a service provider 2, a security service device 3, a network security device 4 and Client terminal device 5.

Among them, the data management device 1 is used to run the database management system, store the online banking dynamic password card security data and authentication information, and be responsible for the customer access management after the authentication is passed. The data management device 1 can be a PC server or a host, and the stored online banking dynamic password card security data and authentication information at least include the card number, card coordinate sequence number, and card coordinate value of the dynamic password card.

The service provider 2 is used to obtain the first dynamic password coordinates from the data management device 1 according to the transaction request received from the client terminal device 5, and return the obtained first dynamic password coordinates to the client terminal device 5; and upon receiving Obtain the second dynamic password coordinates from the data management device 1 after the first dynamic password verification information input by the security service device 3 , and return the obtained second dynamic password coordinates to the client terminal device 5 . The service provider 2 may be a Web application server, which interacts with clients.

The safety service device 3 is used to receive the dynamic password for the first time and the second dynamic password input by the client terminal device 5, and judge whether the time for the client terminal device 5 to input the dynamic password for the first time and the second dynamic password is overtime. The dynamic password that data management device 1 obtains judges whether the dynamic password for the first time and the dynamic password for the second time are correct, and when confirming that the dynamic password for the first time is correct, send the dynamic password verification pass information for the first time to service provider 2, and confirm that the dynamic password for the first time is passed. When the second dynamic password is correct, the security identity authentication pass information is sent to the client terminal device 5 . The security service device 4 can be a security authentication server, which is used to judge whether the dynamic password input by the customer is correct.

The network security device 4 is used to protect the security of the internal network of the enterprise, and prevent unauthorized users in the public network from accessing and attacking the internal network.

The client terminal device 5 is used to connect to the service provider device 2 or the security service device 3 through the network security device 4 to realize the interaction between the service provider device 2 or the security service device 3 and the client.

The above-mentioned data management device, service providing device and security service device are connected to the network security device through the internal network. The internal network can be Ethernet (Ethernet), or a local area network such as fiber optic distributed data interface (FDDI) or token ring (Token-Ring), which is used to realize the connection between the data management device, the service provider device and the security service device. communication between.

The above-mentioned network security device is a firewall, which is connected to the client terminal device through a public network. The public network may be the Internet or an external network of an enterprise.

The above-mentioned service providing device is further used to send a timing start message to the security service device while returning the obtained dynamic password coordinates for the first time to the client terminal device, and the security service device starts timing after receiving the timing start message. Reaching the valid time of the coordinates of the first dynamic password set in advance, if the client terminal device has not yet input the first dynamic password or the first dynamic password input by the client terminal device is still wrong, then the client terminal device will be prompted that the transaction has timed out, And send instructions to the service provider device, instruct the service provider device to send a new first dynamic password coordinate to the client terminal device again, this new first dynamic password coordinate is different from the previous first dynamic password coordinate, the service provides The device acquires the coordinates of the new first-time dynamic password from the data management device according to the received instruction, and returns the acquired coordinates of the new first-time dynamic password to the client terminal device; Within the effective time of the second dynamic password coordinates, the security service device receives the correct first dynamic password input by the client terminal device, and then sends the first dynamic password verification pass information to the service provider device.

The above-mentioned security service device is further used to set the threshold value of the first dynamic password input by the client terminal device to the security service device. If the security service device judges that the first dynamic password input by the client terminal device is incorrect, the client terminal device is allowed to input For the first time dynamic password specified by the threshold, if the number of wrong input times reaches the specified threshold, the customer's online banking transaction authority on the day will be locked, and the lock will be automatically unlocked the next day.

When the above-mentioned service provider device returns the obtained second dynamic password coordinates to the client terminal device, it is further used to send a timing start message to the security service device, and the security service device starts timing after receiving the timing start message. If the timing reaches The preset valid time of the second dynamic password coordinates, if the client terminal device has not yet input the second dynamic password or the second dynamic password input by the client terminal device is still wrong, then the client terminal device will be prompted for transaction timeout, and Send an instruction to the service providing device to instruct the service providing device to resend a new second dynamic password coordinate to the client terminal device, the new second dynamic password coordinate is different from the previous second dynamic password coordinate, the service providing device Acquire the coordinates of the new second dynamic password from the data management device according to the received instruction, and return the acquired coordinates of the new dynamic password for the second time to the client terminal device; Within the effective time of the dynamic password coordinates, the security service device receives the correct second dynamic password input by the client terminal device, and then sends the security identity authentication passing information to the client terminal device.

The above-mentioned security service device is further used to set the threshold value for the number of times that the client terminal device inputs the second dynamic password to the security service device, and if the security service device judges that the second dynamic password input by the client terminal device is incorrect, then the client terminal device is allowed to input For the second dynamic password specified by the threshold, if the number of wrong input times reaches the specified threshold, the customer's online banking transaction authority on the day will be locked, and the lock will be automatically unlocked the next day.

Based on the structural block diagram of the system for secure identity authentication in the online banking system shown in FIG. 2 , the method for secure identity authentication in the online banking system provided by the present invention will be described in detail below in conjunction with FIG. 3 .

As shown in Figure 3, Figure 3 is a flow chart of a method for performing security identity authentication in an online banking system provided by the present invention, the method comprising the following steps:

Step 301: the client terminal device sends a transaction request to the service provider device, and the service provider device obtains the coordinates of the first dynamic password from the data management device according to the received transaction request;

Step 302: The service provider device returns the obtained first dynamic password coordinates to the client terminal device, and the client terminal device inputs the first dynamic password to the security service device according to the received first dynamic password coordinates;

Step 303: The security service device judges whether the first dynamic password input by the client terminal device is correct, and if it is correct, sends the first dynamic password verification pass message to the service provider device;

Step 304: The service providing device receives the information that the first OTP has been verified, obtains the coordinates of the second OTP from the data management device, and returns the obtained coordinates of the second OTP to the client terminal device;

Step 305: The client terminal device inputs the second dynamic password to the security service device according to the received coordinates of the second dynamic password;

Step 306: The security service device judges whether the second dynamic password input by the client terminal device is correct, and if it is correct, sends security identity authentication passing information to the client terminal device.

In the method for secure identity authentication shown in Figure 3, the present invention can also pre-set the valid time of the first dynamic password coordinates. While returning to the client terminal device, further send a timing start message to the security service device, the method further includes: the security service device starts timing after receiving the timing start message, if the timing reaches the preset dynamic password coordinates for the first time Valid time, if the client terminal device has not input the dynamic password for the first time or the first dynamic password input by the client terminal device is still wrong, then the client terminal device will be prompted that the transaction has timed out, and an instruction will be sent to the service provider device to instruct the service provider The device re-sends a new first-time dynamic password coordinate to the client terminal device. The new first-time dynamic password coordinate is different from the previous first-time dynamic password coordinate. New dynamic password coordinates for the first time, and turn to step 302; If within the valid time of the dynamic password coordinates for the first time preset, the security service device receives the correct first dynamic password input by the client terminal device, Then execute the step 303 of sending the first dynamic password verification pass information to the service provider device.

In the method for secure identity authentication shown in Figure 3, or in the above-mentioned method for secure identity authentication that presets the valid time of the dynamic password coordinates for the first time, the present invention can further set the client terminal device to the security service device Input the threshold value of dynamic password number of times for the first time, if in step 303, security service device judges that the dynamic password of client terminal device input is incorrect for the first time, then allow client terminal device to input the dynamic password for the first time of described threshold value regulation number of times, if If the number of incorrect input times reaches the number specified by the threshold, the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day.

In the method for secure identity authentication shown in Figure 3, the present invention can also pre-set the valid time of the second dynamic password coordinates, and the service provider described in step 304 returns the obtained second dynamic password coordinates to the client At the same time as the terminal device, further send a timing start message to the security service device, the method further includes: the security service device starts timing after receiving the timing start message, if the timing reaches the preset valid time of the second dynamic password coordinate, If the client terminal device has not yet imported the second dynamic password or the second dynamic password imported by the client terminal device is still wrong, then the client terminal device will be prompted that the transaction has timed out, and an instruction will be sent to the service provider device to instruct the service provider device to send a message to the service provider device again. The client terminal device sends a new second-time dynamic password coordinate, and the service provider device obtains the new second-time dynamic password coordinate from the data management device according to the received instruction, and turns to step 302; Within the validity period of the coordinates of the new second dynamic password, the security service device receives the correct second dynamic password input by the client terminal device, and then executes step 306 to send the security identity authentication passing information to the client terminal device.

In the method for security identity authentication shown in FIG. 3 , or in the method for security identity authentication with the above-mentioned presetting of the valid time of the second dynamic password coordinates, the present invention can further set the client terminal device to the security service device Input the threshold value of the dynamic password number of times for the second time, if in step 306, the dynamic password for the second time that the safety service device judges that the client terminal device inputs is incorrect, then allow the client terminal device to input the dynamic password for the second time that the threshold value stipulates times, if If the number of incorrect input times reaches the number specified by the threshold, the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day.

Based on the flow chart of the method for secure identity authentication in the online banking system described in FIG. 3 , the method for secure identity authentication in the online banking system of the present invention will be further described in detail below in conjunction with specific embodiments.

Example

In this embodiment, taking the IP data packet sent and received by the base station as an example, the detailed method and steps for the base station to obtain the wireless station management connection identifier are further described with reference to the accompanying drawings.

As shown in Figure 4, Figure 4 is a flow chart of a method for secure identity authentication in an online banking system according to an embodiment of the present invention, and the method includes the following steps:

Step 400: The client terminal device sends a transaction request to the service provider device, and the service provider device receives the transaction request from the client terminal device;

Step 401: The service provider device checks the legality, and if it is legal, sends the page display to the client terminal device;

Step 402: The client terminal device displays a page to remind the client to input the payment card number;

Step 403: The service provider checks whether the customer is an online banking customer and the customer type according to the payment card number input by the customer;

Step 404: The service provider device confirms that the customer is an OTP card customer, obtains the coordinates of the first OTP from the data management device according to the received transaction request, and returns the acquired coordinates of the first OTP to the client terminal device;

Step 405: The client terminal device prompts the client to input the coordinate value of the first dynamic password. After the client inputs the coordinate value of the first dynamic password, the client terminal device submits the coordinate value of the first dynamic password input by the client to the security service device. If the client If it is not input within the specified time, the security service device judges overtime, and sends an instruction to the service provider device, instructing the service provider device to send a new dynamic password coordinate for the first time to the client terminal device again, and the service provider device starts again from the data according to the instruction received. The management device obtains the coordinates of the new first dynamic password, returns the acquired coordinates of the new first dynamic password to the client terminal device, and executes step 405 again; if the client enters the first dynamic password within the specified time , then execute step 406;

Step 406: The security service device judges whether the first dynamic password input by the client terminal device is correct, and if it is correct, then sends the first dynamic password verification pass message to the service provider device, and executes step 407; otherwise, sends a message to the service provider device command, instructing the service provider to resend the coordinates of the first dynamic password to the client terminal device, the service provider obtains the coordinates of the first dynamic password from the data management device again according to the received instruction, and returns the acquired coordinates of the first dynamic password to the client terminal device, and execute step 405 again;

Step 407: The service providing device receives the information that the first dynamic password has been verified, obtains the coordinates of the second dynamic password from the data management device, and returns the acquired coordinates of the second dynamic password to the client terminal device;

Step 408: The client terminal device prompts the client to input the coordinate value of the second dynamic password within the specified time and submits it to the security service device. If the client fails to input it within the specified time, the security service device judges that it is timed out, and sends an instruction to the service provider device, instructing The service providing device resends a new second dynamic password coordinate to the client terminal device, and the service providing device acquires the new second dynamic password coordinate from the data management device again according to the received instruction, and the new second dynamic password that will be acquired The second OTP coordinates are returned to the client terminal device, and step 405 is executed again; if the client has input the OTP for the second time within the specified time, then step 409 is executed;

Step 409: The security service device judges whether the second dynamic password input by the client terminal device is correct, and if it is correct, then sends the security identity authentication passing information to the client terminal device; otherwise, the identity authentication fails, and sends a security identity authentication failure message to the client terminal device information.

Fig. 5 is a schematic diagram of the interface of step 408 in Fig. 4, and the following specific description is as follows:

The method for secure identity authentication in the online banking system provided by the present invention is also called the second challenge method of the online banking password card, which can be divided into two steps: the first challenge and the second challenge, and the customer only has two steps. Only when the answer is successful can the payment be successful.

First of all, during the first challenge, when the customer makes personal online banking payment, the system randomly prompts to input the verification code and the password corresponding to the coordinate A of the first password card. At this time, coordinate B has no coordinate information (that is, the second password coordinate not displayed), if the verification code entered by the customer and the password corresponding to the password card coordinate A are correct, the system will display the second password coordinate. Within the valid time of the first password card coordinates, if the customer’s password is entered incorrectly, the customer will be required to re-enter; if the valid time exceeds, the customer will be prompted “the password card password has expired, please re-enter the password card password”, if the customer continues to trade , another new coordinate A will be randomly generated, and the customer will be prompted to input the corresponding code card coordinate A password.

Secondly, during the second challenge, after the first challenge is passed, the system will display the second password coordinates and prompt the customer to enter the corresponding password card password again. If the password is correct and within the valid time of the password card coordinates, then The second challenge is successful, and a normal identity authentication is completed. Within the valid time of the second password card coordinates, if the customer’s password is entered incorrectly, the customer will be prompted to re-enter; if the valid time exceeds, the customer will be prompted “password card password timed out, please re-enter the password”, if the customer continues to trade, the customer will be prompted A second challenge/response process will be restarted, and the system will randomly generate another new coordinate A, return to the first challenge process, and start the first challenge process again. After the first challenge is passed, the system will display the coordinates of the second password, which can effectively defend against man-in-the-middle website attacks.

The second challenge method controls the number of wrong passwords for the first challenge, the timeout of the first challenge, the number of wrong passwords for the second challenge, the timeout of the second challenge, and the limit for the number of refreshes for the second time as follows:

(1) When the number of times the customer enters the wrong password for the first challenge reaches the specified number of times, the customer's online banking transaction authority will be locked on the same day and will be automatically unlocked the next day; Resubmit", the customer refreshes the page after confirming, and randomly generates new coordinates.

(2) When the customer enters the wrong password for the second challenge and reaches the specified number of times, the customer's online banking transaction authority will be locked on the same day and will be automatically unlocked on the next day; Resubmit", the system returns to the first challenge page and refreshes, and randomly generates new coordinates.

(3) When the customer does not enter the password for the second challenge and continuously refreshes the coordinates for more than the specified number of times, the system locks the customer's login and transaction authority, and the customer needs to go to the counter to reset the password before unlocking. In this way, the attack of continuously refreshing the coordinates of the password card can be defended.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (12)

1. A system for secure identity authentication in an online banking system, characterized in that the system at least includes: The data management device is used to run the database management system, store the security data and authentication information of the online banking dynamic password card, and be responsible for the customer access management after the authentication is passed; The service providing device is used to obtain the coordinates of the first dynamic password from the data management device according to the transaction request received from the client terminal device, and return the acquired coordinates of the first dynamic password to the client terminal device; Obtain the coordinates of the dynamic password for the second time from the data management device after the input first dynamic password verification passes the information, and return the coordinates of the dynamic password for the second time obtained to the client terminal device; The security service device is used to receive the first dynamic password and the second dynamic password input by the client terminal device, determine whether the time for the client terminal device to input the first dynamic password and the second dynamic password has timed out, and according to the data management The dynamic password obtained by the device judges whether the first dynamic password and the second dynamic password are correct. When confirming that the first dynamic password is correct, it sends the first dynamic password verification pass message to the service provider device. After confirming the second dynamic password When correct, send the security identity authentication pass information to the client terminal device; The network security device is used to protect the security of the enterprise's internal network and prevent illegal users from public networks from accessing and attacking the internal network; The client terminal device is used to connect to the service provider device or the security service device through the network security device, so as to realize the interaction between the service provider device or the security service device and the client. 2. The system for performing security identity authentication in the online banking system according to claim 1, wherein the data management device, the service providing device and the security service device are connected to the network security device through an internal network; The internal network is Ethernet, or a local area network optical fiber distributed data interface FDDI or token ring Token-Ring, which is used to realize the communication among the data management device, the service providing device and the security service device. 3. The system for secure identity authentication in the online banking system according to claim 1, wherein the network security device is a firewall connected to the client terminal device through a public network; the public network is the Internet or an enterprise External network. 4. The system for secure identity authentication in the online banking system according to claim 1, wherein the service provider further uses After sending a timing start message to the security service device, the security service device starts timing after receiving the timing start message. If the timing reaches the preset valid time of the first dynamic password coordinates, the client terminal device still has not entered the first dynamic password. If the password or the first dynamic password input by the client terminal device is still wrong, then the client terminal device will be prompted that the transaction is overtime, and an instruction will be sent to the service provider device to instruct the service provider device to send a new first time password to the client terminal device again. Dynamic password coordinates, the new first-time dynamic password coordinates are different from the previous first-time dynamic password coordinates, the service provider device obtains the new first-time dynamic password coordinates from the data management device according to the received instruction, and the acquired The first dynamic password coordinates of this new return to the client terminal device; If within the valid time of this new first dynamic password coordinates preset, the security service device receives the correct first dynamic password input by the client terminal device password, then send the first dynamic password verification pass information to the service provider device. 5. The system for performing security identity authentication in the online banking system according to claim 1, wherein the security service device is further used to set the number of times the client terminal device inputs the dynamic password for the first time to the security service device Threshold, if the security service device judges that the first dynamic password input by the client terminal device is incorrect, then the client terminal device is allowed to enter the first dynamic password specified by the threshold, if the number of incorrect inputs reaches the specified threshold , the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day. 6. The system for secure identity authentication in the online banking system according to claim 1, characterized in that, while the service provider device returns the obtained second dynamic password coordinates to the client terminal device, it is further used to Send a timing start message to the security service device, and the security service device starts timing after receiving the timing start message, if the timing reaches the preset valid time of the second dynamic password coordinates, the client terminal device still has not input the second dynamic password Or the second dynamic password that client terminal device imports is still wrong, then to client terminal device prompt transaction overtime, and send instruction to service provider device, instruct service provider device to send a new dynamic password for the first time again to client terminal device Password coordinates, the new first-time dynamic password coordinates are different from the previous first-time dynamic password coordinates, the service provider device obtains the new first-time dynamic password coordinates from the data management device according to the received instruction, and uses the obtained first-time dynamic password coordinates The new first dynamic password coordinates are returned to the client terminal device; if within the valid time of the second dynamic password coordinates set in advance, the security service device receives the correct second dynamic password input by the client terminal device, then to The client terminal device sends security identity authentication passing information. 7. The system for performing security identity authentication in the online banking system according to claim 1, wherein the security service device is further used to set the number of times the client terminal device inputs the dynamic password for the second time to the security service device Threshold, if the security service device judges that the second dynamic password input by the client terminal device is incorrect, then the client terminal device is allowed to enter the second dynamic password specified by the threshold, if the number of times entered incorrectly reaches the specified threshold , the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day. 8. A method for performing secure identity authentication in an online banking system, applied to a system for performing secure identity authentication in an online banking system that includes at least a data management device, a service providing device, a security service device, and a client terminal device, its features That is, the method includes: A. The client terminal device sends a transaction request to the service provider device, and the service provider device obtains the first dynamic password coordinates from the data management device according to the received transaction request; B. The service providing device returns the obtained first dynamic password coordinates to the client terminal device, and the client terminal device inputs the first dynamic password to the security service device according to the received first dynamic password coordinates; C. The security service device judges whether the first dynamic password input by the client terminal device is correct, and if correct, sends the first dynamic password verification pass message to the service provider device; D. The service providing device receives the first dynamic password verification pass information, obtains the second dynamic password coordinates from the data management device, and returns the obtained second dynamic password coordinates to the client terminal device; E. The client terminal device inputs the second dynamic password to the security service device according to the received second dynamic password coordinates; F. The security service device judges whether the second dynamic password input by the client terminal device is correct, and if it is correct, sends security identity authentication passing information to the client terminal device. 9. The method for security identity authentication in the online banking system according to claim 8, characterized in that the valid time of the first dynamic password coordinate is set in advance, and the first time that the service providing device will obtain in step B When the OTP coordinates are returned to the client terminal device, further send a timing start message to the security service device, the method further includes: The security service device starts timing after receiving the timing start information. If the timing reaches the preset valid time of the first dynamic password coordinates, the client terminal device still has not input the first dynamic password or the first dynamic password input by the client terminal device. The password is still wrong, then the client terminal device is prompted that the transaction is overtime, and the service provider device is sent an instruction to instruct the service provider device to send a new dynamic password coordinate for the first time to the client terminal device again. The coordinates of the password are different from the coordinates of the first dynamic password before, and the service provider device obtains the coordinates of the new dynamic password for the first time from the data management device according to the received instruction, and turns to step B; Within the validity period of the first dynamic password coordinates of the first time, the security service device receives the correct first dynamic password input by the client terminal device, then executes the first dynamic password verification pass information sent to the service provider device as described in step C . 10. The method for secure identity authentication in the online banking system according to claim 8 or 9, characterized in that the method further sets the threshold for the number of times the client terminal device inputs the dynamic password for the first time to the security service device, if In step C, the security service device judges that the first dynamic password input by the client terminal device is incorrect, and then allows the client terminal device to input the first dynamic password specified by the threshold, if the wrong number of times of input reaches the specified threshold , the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day. 11. The method for secure identity authentication in the online banking system according to claim 8, characterized in that the valid time of the second dynamic password coordinates is preset, and the second dynamic password to be obtained by the service providing device in step D When the OTP coordinates are returned to the client terminal device, further send a timing start message to the security service device, the method further includes: The security service device starts timing after receiving the timing start information. If the timing reaches the preset valid time for the coordinates of the second dynamic password, the client terminal device still has not input the second dynamic password or the second dynamic password input by the client terminal device. The password is still wrong, then the client terminal device is prompted that the transaction is overtime, and the service provider device is sent an instruction to instruct the service provider device to send a new dynamic password coordinate for the first time to the client terminal device again. The coordinates of the password are different from the coordinates of the first dynamic password before, and the service provider device obtains the coordinates of the new dynamic password for the first time from the data management device according to the received instruction, and turns to step B; Within the validity period of the second dynamic password coordinates, the security service device receives the correct second dynamic password input by the client terminal device, and then executes the sending of the security identity authentication passing information described in step F to the client terminal device. 12. The method for secure identity authentication in the online banking system according to claim 8 or 11, characterized in that the method further sets the threshold for the number of times the client terminal device inputs the dynamic password to the security service device for the second time, if In step F, the security service device judges that the second dynamic password input by the client terminal device is incorrect, and then allows the client terminal device to input the second dynamic password for the prescribed number of times of the threshold, if the wrong number of times of input reaches the number of times prescribed by the threshold , the customer's online banking transaction authority of the day will be locked, and the lock will be automatically unlocked the next day.

Images