Background
At present, a USBKEY (USB interface electronic signature tool) in the application of the internet banking is widely used as an identity authentication and electronic certificate tool, and data can be encrypted, signed and authenticated by using the USBKEY, so that the transaction has the characteristic of non-repudiation, and the safety of the application of the internet banking can be greatly improved.
When a user uses the USBKEY, the USBKEY is generally connected to a computer, when data is input, all data is input on the computer and is sent to the USBKEY by the computer for calculation, the existing computer virus and network hacker are rampant, and a plurality of Trojan programs can enable the hacker to remotely control the computer of the user through a network background. Therefore, if a hacker remotely controls the computer, the data sent to the USBKEY can be intercepted midway through the loophole of the operating system, and the key data is replaced in the dark and then sent to the USBKEY to carry out operations such as signature, encryption and the like of the false data. This may cause a loss to the user. Invisibly brings potential safety hazard to the user using USBKEY for transaction.
Meanwhile, the existing method for protecting the USBKEY from being stolen by others is generally to use a password for protection, generally, when the method is used, a computer requires a user to input the password, the password is valid when the operation is carried out, and the password needs to be input again when the USBKEY is used next time. However, because the password is input on the keyboard of the computer and is sent to the USBKEY by the computer, and the computer is possibly remotely controlled by others, the password is easy to intercept, a hacker who grasps the password can operate the USBKEY secretly through the remote control, and the USBKEY is embezzled and stolen under the condition that the owner of the USBKEY does not know. Even with dynamic passwords, or other password protection means, the password that is intercepted once is sufficient for hackers to cause loss to the user at the time.
Furthermore, at present, when electronic transactions are carried out on the internet, the real account number and the corresponding password of the user are often used, the data are input into a computer by the user, sent to a USBKEY for encryption and then sent to the internet through the computer, if the account numbers are the numbers of deposit cards or credit cards of the user, fake cards can be made after the account numbers are intercepted by other people, and the real password is used for being found by an Automatic Teller Machine (ATM), so that the risk is very huge.
Disclosure of Invention
In view of the problems existing in the prior art, the present invention aims to provide a secure transaction control method and a secure transaction control device for online banking transactions, which can enhance the security of online banking transactions, enhance the accuracy and reliability of transaction data, and are convenient to use and easy to operate, in order to improve the security of online banking and to enable users to use online banking securely.
The purpose of the invention is realized by the following technical scheme:
a secure transaction control method for network banking transaction comprises the following steps:
A. the user side sends the transaction message to the network bank through the internet and initiates a transaction request;
B. the network bank sends a short message containing confirmation information to the terminal equipment of the user through a communication network;
C. and the user side processes the confirmation information according to the acquired confirmation information, and then sends a confirmation instruction to the network bank through the Internet to finish the transaction process.
The transaction message comprises data to be transacted and electronic signature data calculated by a USB interface electronic signature tool USBKEY for the data to be transacted; or,
the confirmation information comprises transaction data information to be confirmed and a transaction confirmation code, the user side judges whether the transaction is correct or not through the transaction data information to be confirmed, and the transaction operation can be confirmed through the transaction confirmation code to complete the transaction process.
The transaction confirmation code is a transaction password of the transaction set by an internet bank; or the transaction confirmation code is a transaction password of the transaction dynamically generated by an internet bank.
The transaction confirmation code is valid for a limited time; or, the transaction confirmation code is valid within a set time; alternatively, the transaction confirmation code is valid for a limited time within a set time.
The step B comprises the following steps:
b1, the network transaction control end sends the short message containing the confirmation information to the mobile terminal of the user through the mobile communication network; or,
b2, the network transaction control terminal sends the confirmation information to the fixed terminal of the user through the fixed communication network.
The step C comprises the following steps:
c1, the user end obtains the transaction data information to be confirmed in the confirmation information sent by the network bank; and interrupting whether the transaction data information to be confirmed is correct, if so, confirming the transaction, otherwise, denying the transaction;
c2, if the user side approves the transaction, sending a transaction confirmation instruction to the network bank; the network bank confirms whether the transaction is successful according to a transaction confirmation instruction sent by the user side, and the current transaction process is completed; if the user end denies the transaction, a transaction termination instruction is sent to the network bank to terminate the current transaction.
The step C2 includes:
c21, the user end obtains the trade confirmation code in the confirmation information sent by the network bank; and the transaction confirmation code is used as a transaction confirmation instruction and is sent to the network bank; or,
c22, the user end obtains the trade confirmation code in the confirmation information sent by the network bank; electronic signature data calculated by taking the transaction confirmation code and the USBKEY as the transaction confirmation code is taken as a transaction confirmation instruction to be sent to the network bank; or,
c23, the user end obtains the trade confirmation code in the confirmation information sent by the network bank; and generates a transaction confirmation instruction through the transaction confirmation code and sends the transaction confirmation instruction to the network bank.
A safe transaction control device for network bank transaction is arranged at the network bank and comprises:
the transaction data receiving module is used for receiving a transaction message and an operation instruction sent by a user side;
the transaction processing module generates confirmation information according to the transaction message sent by the user side and sends the confirmation information to the user side; and confirming the user terminal transaction request according to the operation instruction sent by the user terminal to complete the transaction process.
The transaction processing module comprises:
the confirmation information generation module generates confirmation information according to the transaction message sent by the user side;
the confirmation information sending module is used for sending confirmation information to the user side;
the operation instruction processing module confirms the user end transaction request according to the operation instruction sent by the user end and completes the transaction process
The confirmation information generation module comprises:
a confirmation information definition module: the validation time and/or number of validations of the transaction confirmation code in the confirmation message is limited.
It can be seen from the above technical solutions that, the core of the secure transaction control method and the secure transaction control apparatus for internet banking transaction of the present invention is that a user sends a transaction message to an internet bank through the internet to initiate a transaction request; the network bank sends a short message containing confirmation information to the terminal equipment of the user through a communication network; and the user side sends a confirmation instruction to the network bank through the Internet according to the acquired confirmation information to finish the transaction process. When the user is in transaction, the user can ensure that the transaction is the transaction which the user wants to happen, and the authenticity, the accuracy and the safety of the transaction can be fully ensured. Meanwhile, the non-repudiation of the USBKEY to the transaction signature in the application of the online banking is fully utilized, and the security of the user account password is fully ensured.
Detailed Description
The invention relates to a safe transaction control method of network bank transaction, which is characterized in that a user side sends a transaction message to a network bank through the Internet to initiate a transaction request; the network bank sends a short message containing confirmation information to the terminal equipment of the user through a communication network; and the user side sends a confirmation instruction to the network bank through the Internet according to the acquired confirmation information to finish the transaction process.
The transaction message comprises data to be transacted and electronic signature data calculated by the USBKEY for the data to be transacted.
In the above, the network bank may send a short message containing the confirmation information to the mobile terminal of the user through the mobile communication network; or the network bank sends a short message containing the confirmation information to the fixed terminal of the user through the fixed communication network.
The confirmation information here generally includes a transaction confirmation code and transaction data information to be confirmed, which can be used by the user end to confirm the transaction operation, that is, data including the money receiving party, payment amount, etc. in the transaction process and a transaction confirmation code attached at the same time.
The transaction confirmation code is the transaction password of the transaction set by the internet bank; or the transaction password of the transaction dynamically generated by the network bank. Certainly, in order to further improve the security, the transaction confirmation code may be set to be valid for a number of times, such as when the transaction confirmation code is valid; or setting effective time for the transaction confirmation code; it can also be that the transaction confirmation code is set at the effective times and time.
At the moment, the user side judges whether the transaction data information to be confirmed is correct, namely whether the transaction is correct or not, and the user side acquires the transaction data information to be confirmed in the confirmation information sent by the network bank; and the user side judges whether the transaction data information to be confirmed is correct, if so, the transaction is admitted, and otherwise, the transaction is denied. The specific method is that the user side reads data information such as a money receiving party, payment amount and the like in confirmation information sent by a network bank on the mobile terminal, whether the data information is the transaction condition of the user side at this time is judged, if yes, the transaction is admitted, and otherwise, the transaction is denied.
If the user side acknowledges the transaction, a transaction confirmation instruction is sent to the network bank; the network bank confirms whether the transaction is successful according to a transaction confirmation instruction sent by the user side, and the current transaction process is completed; there are three specific ways:
1. the user side acquires a transaction confirmation code in confirmation information sent by the network bank; and the transaction confirmation code is used as a transaction confirmation instruction and is sent to the network bank;
2. the user side acquires a transaction confirmation code in confirmation information sent by the network bank; and the transaction confirmation code and the electronic signature data calculated by using the USBKEY as the transaction confirmation code and/or the transaction data are used as a transaction confirmation instruction to be sent to the network bank;
3. the user side acquires a transaction confirmation code in confirmation information sent by the network bank; and generates a transaction confirmation instruction through the transaction confirmation code and sends the transaction confirmation instruction to the network bank.
If the user end denies the transaction, a transaction termination instruction is sent to the network bank to terminate the current transaction.
No matter what confirmation instruction is sent by the user side, the network bank finishes the transaction process through the process.
Implementation mode one
The preferred embodiment of the secure transaction control method for internet banking transaction according to the present invention is shown in fig. 1, which takes internet banking transaction as an example and includes the following specific processes:
step 11, the user side sends a transaction message to the network bank through the network;
the user side sends a transaction message to the network bank through the Internet, wherein the transaction message refers to the electronic signature data calculated by the data to be transacted and the USBKEY for the data to be transacted; the data to be transacted typically includes the transaction's partner identity information, transaction amount and/or transaction type.
Step 12, the network bank sends the key data information and the transaction confirmation code of the transaction to the mobile terminal of the user side in a short message mode;
the key data information refers to the transaction data information to be confirmed and the transaction confirmation code, the user side judges whether the transaction is correct or not through the transaction data information to be confirmed, and the transaction operation can be confirmed through the transaction confirmation code, so that the transaction process is completed.
It is obvious that the internet bank can send a short message containing the confirmation information to the fixed terminal of the user through the fixed communication network.
Of course, the internet bank needs to be informed of the mobile terminal number of the user before the step, or there are two ways:
1. the mobile terminal number of the user is sent to the network bank together with the transaction message sent in the step 11;
2. when the user registers the network bank, the mobile terminal number of the user is informed to the network bank.
Step 13, the user side judges whether the key data information of the transaction sent by the network bank is correct, if so, step 14 is executed; otherwise, executing step 15;
step 14, confirming that the transaction is correct, and sending a transaction confirmation instruction to an internet bank;
the confirmation instruction here can be obtained by the following three ways:
1. the user side acquires a transaction confirmation code sent by the network bank; and the transaction confirmation code is used as transaction confirmation;
2. a user side acquires a transaction confirmation code of an internet bank; and the transaction confirmation code and the electronic signature which is calculated and configured by the USBKEY as the transaction confirmation code and/or the transaction data are used as a transaction confirmation instruction;
3. a user side acquires a transaction confirmation code of an internet bank; and generates a transaction confirmation instruction by the transaction confirmation code.
Step 15, the network bank receives and judges whether the transaction confirmation instruction sent by the user side is correct, if so, the transaction operation is carried out, and the transaction is completed; otherwise, refusing the transaction operation;
step 16, the user terminal denies the transaction and sends a transaction termination instruction to the network bank; the network bank terminates the current transaction.
The safe transaction control device for the network bank transaction is arranged in the network bank and comprises a transaction data receiving module, a transaction processing module and a transaction data receiving module as shown in figure 2, wherein the transaction data receiving module is used for receiving a transaction message and an operation instruction sent by a user side; the transaction processing module generates confirmation information according to the transaction message sent by the user side and sends the confirmation information to the user side; and confirming the user terminal transaction request according to the operation instruction sent by the user terminal to complete the transaction process.
The transaction processing module comprises a confirmation information generating module, a confirmation information sending module and an operation instruction processing module, wherein the confirmation information generating module generates confirmation information according to a transaction message sent by the user side; the confirmation information generation module may include a confirmation information definition module for defining the number of times the transaction confirmation code is valid and/or the time of validity in the confirmation information.
The confirmation information sending module is used for sending confirmation information to the user side;
and the operation instruction processing module confirms the user end transaction request according to the operation instruction sent by the user end and completes the transaction process. If the operation instruction sent by the user side is a transaction confirmation instruction, judging whether the transaction confirmation instruction is correct, and if the operation instruction is the transaction confirmation instruction, finishing the transaction operation according to a transaction request sent by the user side; otherwise, refusing the transaction operation; if the operation instruction sent from the user end is a transaction termination instruction, the transaction operation is terminated.
Through the technical scheme, the user can ensure that the transaction is the transaction which the user wants to happen when transacting, and the authenticity, the accuracy and the safety of the transaction can be fully ensured. Meanwhile, the non-repudiation of the USBKEY to the transaction signature in the application of the online banking is fully utilized, and the security of the user account password is fully ensured.
In summary, the technical scheme of the invention has the following advantages:
1. the method is easy to realize: the change of the original online banking system is not large;
2. the cost is low: the USBKEY in use in the existing application does not need to be changed or replaced, and only the change is carried out on software and application control.
3. The universality is strong: this method is in principle applicable to almost all USBKEY.
4. The practicality is strong, is convenient for popularize: are all applications of mature technology.
5. The safety is high: the potential safety hazards of the existing USBKEY for carrying out online banking transaction on the transaction reliability and the data authenticity and accuracy are completely solved; meanwhile, the user account password is fully protected.
In a word, the method of the invention increases the safety of the user, is simple and convenient and is convenient to popularize.
The above description is only for the preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.