CN102768744B - A kind of remote safe payment method and system - Google Patents

Abstract

The invention discloses a remote safe payment method, which includes the following steps: providing a bank smart card with safety data stored therein; providing a terminal and a card reader, and reading smart card information through the card reader, between the bank smart card and the remote server The user is authenticated, and after passing the authentication, a secure data link is established between the above-mentioned bank smart card and the remote server for online transactions. The invention provides a safety protection measure for the user to use the online bank.

Description

A remote secure payment method and system

technical field

The invention relates to the field of electronic payment, in particular to a remote safe payment method and system.

Background technique

With the development of e-commerce, online transactions have become more and more popular. In addition, as the price of smartphones has dropped, their sales have also increased day by day. This makes the demand for online payment through mobile phones increasingly obvious, and major banks have also launched their own mobile banking. At present, the common mobile payment methods based on mobile phones are:

Method 1: Provide security authentication for remote payment through local file certificates.

Method 2: Provide security authentication for remote payment through SMS code.

Method 3: For some mobile phones that provide USB-OTG interface, a specific U-key is already available. The security of remote payment is guaranteed through this U-key.

Disadvantages of the above approach:

Disadvantages of Method 1 and Method 2: Since smartphones may be invaded by viruses and hackers, the file certificate or SMS code in Method 1 and Method 2 may be obtained by malicious software, thus endangering the security of network transactions

Disadvantage of method 3: the bank needs to issue U-key specially, and this U-key is usually only used for online transactions of one bank. This increases the operating cost of the bank, and also makes the user need to carry a variety of U-keys in addition to the bank card, which is very inconvenient to use.

Contents of the invention

In order to solve the above problems, the present invention provides a security protection measure for users to use online banking.

The specific technical means adopted by the present invention are as follows: a remote secure payment method, characterized in that it comprises the following steps:

Provide a bank smart card with stored secure data;

Provide a terminal and a card reader, read the smart card information through the card reader, authenticate the user between the bank smart card and the remote server, and establish a secure connection between the bank smart card and the remote server after passing the verification Data link for online transactions.

In particular, the identity verification includes the following steps: the terminal reads the security data of the bank smart card, the remote server initiates a key negotiation process to the terminal through the Internet, and the terminal returns success information after the key negotiation is successful For the above-mentioned remote server, the two parties conduct mutual authentication through the key negotiation process and generate a process key, which is used as an encryption key for exchanging data between the remote server and the terminal in the subsequent communication process, so that in the A secure data transmission link is formed between the server and the bank smart card.

Particularly, the terminal is a mobile phone, and the remote server is a mobile banking server.

In particular, the terminal is a POS machine, and the remote server is a POS server.

In particular, the terminal is a mobile phone, the remote server is an online banking server, and the mobile phone communicates with the online banking server through a computer.

In particular, the bank smart card is provided with an ISO7816 interface, through which the card reader reads the security data in the card.

In particular, the bank smart card is provided with a non-contact communication interface conforming to the ISO14443 standard, and the card reader reads the security data in the card through the interface.

In particular, said security data includes digital certificates and private keys.

The present invention also provides a remote security payment system, which is characterized in that it includes:

Bank smart cards to store secure data;

A card reader for reading the above security data;

The terminal is installed with client software for online transactions;

The terminal reads the smart card information through the card reader, authenticates the user between the bank smart card and the remote server, and after passing the verification, establishes a secure data link between the bank smart card and the remote server for online transactions .

Particularly, the terminal is a mobile phone, and the remote server is an online banking server of a bank.

In particular, the terminal is a POS machine, and the remote server is a POS server.

In particular, the terminal is a mobile phone, the remote server is an online banking server, and the mobile phone communicates with the online banking server through a computer.

In particular, the bank smart card is provided with an ISO7816 interface, through which the card reader reads the security data in the card.

In particular, the bank smart card is provided with a non-contact communication interface conforming to the ISO14443 standard, and the card reader reads the security data in the card through the interface.

In particular, said security data includes digital certificates and private keys.

Beneficial effects of the present invention:

Based on the existing financial IC card, the present invention adds storage of digital certificates and a software interface to verify the identity of the user and ensure the safety of the user's online transactions, and can realize the function of the existing U-shield, and the IC card processing chip volume It is small and uses the widely existing ISO7816 interface, so the present invention provides a safety protection measure for users to use online banking.

Description of drawings

Fig. 1 is the structural diagram of the bank smart card of the embodiment of the present invention;

Fig. 2 is a flow chart of a remote secure payment method according to an embodiment of the present invention;

3 is a structural diagram of a remote secure payment system according to an embodiment of the present invention;

Fig. 4 is an interaction diagram of identity verification between the smart card, the online banking client and the server in the present invention.

detailed description

In order to describe the technical content, structural features, achieved goals and effects of the present invention in detail, the following will be described in detail in conjunction with the embodiments and accompanying drawings.

Please refer to FIG. 1 , which is a structural diagram of a bank smart card according to an embodiment of the present invention. The bank smart card is based on the financial card IC card issued by the bank to the customer, adding a security module. The storage and software interface of the customer's digital certificate and private key are stored in the security module. The digital certificate and private key are collectively referred to as security data. , and has the function of logical encryption operation, which can replace USBKEY to realize the function of user identity authentication. IC cards are small in size, and each bank will issue corresponding IC cards. In this embodiment, the bank IC card has an ISO7816 interface, and the card reader can read the security data in the card through the ISO7816 interface, and can also read the information in the card through a wireless method, such as a non-contact communication interface conforming to the ISO14443 standard.

Please refer to FIG. 2 , which is a flowchart of a remote secure payment method according to an embodiment of the present invention. Wherein the secure payment method includes the following steps:

S1. Provide a bank smart card with secure data stored therein;

S2. Provide a terminal and a card reader, read the smart card information through the card reader, authenticate the user between the bank smart card and the remote server, and after passing the verification, establish between the bank smart card and the remote server Secure data link for online transactions.

Wherein, the identity verification includes the following steps: the terminal reads the security data of the bank smart card, the remote server initiates a key negotiation process to the terminal through the Internet, and after the terminal key negotiation is successful, it returns success information to the remote server. The server, the two parties perform mutual authentication through the key negotiation process and generate a process key, which is used as an encryption key for exchanging data between the remote server and the terminal in the subsequent communication process, so that the server and the terminal A secure data transmission link is formed between the bank smart cards.

In this embodiment, the terminals include mobile terminals, non-mobile terminals, personal terminals, and commercial terminals. The mobile terminal includes a mobile phone, a PAD, a mobile PC, etc., and its corresponding remote server is an online banking server of a bank; Information, login online banking transactions; the commercial terminal can be a commercial POS machine, and its corresponding server is a POS server.

Wherein, the bank smart card is provided with an ISO7816 interface, and when the terminal has no card reading function, the card reader can read the security data in the card through the interface. The bank smart card can also be provided with a radio frequency card near-field communication interface, and the card reader reads the information in the card by using a wireless method such as a wireless radio frequency method.

Fig. 4 is an interaction diagram of identity verification between the smart card, the online banking client and the server in the present invention. Here, the common online banking login process is taken as an example to illustrate the process. The terminal is equipped with an online banking client, which needs to use a contact smart card to protect the transaction process. The smart card is equivalent to the function of U-key, which stores the digital certificate and private key used by the online bank to identify the customer's identity, and the processor inside the card can complete encryption and digital signature algorithms.

During the login process, there is mainly interaction between the smart card and the system server (remote system). The client software interacts with the smart card through the terminal, card reader, sends server commands and receives responses from the smart card to complete the login process.

In order to interact, the smart card and the system server each store a digital certificate and a corresponding private key. The certificate and private key on the smart card are called client certificate and client private key respectively, and the certificate and private key on the server are called server certificate and server private key respectively. Additionally, both the smart card and the server have corresponding root certificates for these certificates.

The interaction process between the smart card and the remote server is as follows:

1. The client makes the smart card generate a 32-byte random number, and packs some information to generate the client handshake information. Here, the client is a name relative to the server. It is the client software, terminal, smart card, certificate, etc. A series of components are treated as a whole. From the perspective of the server, the object interacting with the server is the client;

2. The client transmits the client handshake information to the server;

3. The server generates a 32-byte random number and packs some information to generate server handshake information;

4. The server sends the server handshake information and server certificate to the client;

5. The client sends the server certificate to the smart card, and the smart card verifies the received server certificate. If the verification passes, the login is successful; otherwise, the login fails;

6. The client uses the smart card to perform the following process:

Generate a 48-byte random number as the shared master key

This master key is encrypted with the public key in the server certificate to generate an encrypted shared master key

Calculate the hash value of the handshake information from the client side and the server side, and then encrypt it with the client's private key to generate a digital signature for the handshake information;

7. The client obtains the encrypted shared master key and the digital signature of the handshake information from the smart card;

8. The client sends the client certificate, encrypted shared master key, and digital signature of the handshake information to the server;

9. The server checks the validity of the client certificate, if valid, the handshake is successful; otherwise, the handshake fails;

10. The server uses the public key in the client certificate to verify whether the digital signature of the handshake information matches the handshake information between the client and the server. If they match, the handshake is successful; otherwise, the handshake fails and an error is returned;

11. The server uses the server private key to decrypt the shared master key to obtain the shared master key;

12. Both parties use the shared master key to calculate the session key. In the subsequent communication process, the session key is used to encrypt the data packet, that is, a secure channel is established and the login is successful.

Please refer to FIG. 3 , which is a structural diagram of a secure payment system according to an embodiment of the present invention. The safe payment system includes: a bank smart card for storing safe data; a card reader for reading the above safe data; a terminal installed with client software for online transactions; the terminal reads the smart card through the card reader Information, authenticate the user between the bank smart card and the remote server, and after passing the verification, establish a secure data link between the bank smart card and the remote server for online transactions. Among them, security data includes digital certificates and private keys. In this embodiment, taking the PC and the online banking server as an example, the online banking server initiates a key negotiation process to the above-mentioned PC terminal through the Internet, and after the key negotiation of the PC terminal is successful, it returns success information to the above-mentioned online banking server , the two parties perform mutual authentication through the key negotiation process and generate a process key, which is used as an encryption key for exchanging data between the online banking server and the terminal in the subsequent communication process, so that the online banking server and the terminal A secure data transmission link is formed between the smart cards, and subsequent transaction data is transmitted on this link.

Based on the existing financial IC card, the present invention adds storage of digital certificates and a software interface to verify the identity of the user and ensure the safety of the user's online transactions, and can realize the function of the existing U-shield, and the IC card processing chip volume It is small, and uses the widely existing ISO7816 interface, with low cost and mature processing technology, thus providing a safe and low-cost protection measure for users to use online banking.

The above is only an embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process conversion made by using the description of the present invention and the contents of the accompanying drawings, or directly or indirectly used in other related technologies fields, all of which are equally included in the scope of patent protection of the present invention.

Claims (11)

1. A remote safe payment method, characterized in that, comprising the following steps: Provide a bank smart card with stored security data; said security data includes digital certificates and private keys; Provide a terminal and a card reader, read the smart card information through the card reader, authenticate the user between the bank smart card and the remote server, and establish a secure connection between the bank smart card and the remote server after passing the verification Data link for online transactions; The identity verification includes the following steps: the terminal reads the security data of the bank smart card, the remote server initiates a key negotiation process to the terminal through the Internet, and after the terminal key negotiation is successful, it returns success information to the remote server. The server, the two parties perform mutual authentication through the key negotiation process and generate a process key, which is used as an encryption key for exchanging data between the remote server and the terminal in the subsequent communication process, so that the server and the terminal A secure data transmission link is formed between the bank's smart cards; Among them, the interaction process between the bank smart card and the remote server is as follows: The terminal asks the bank smart card to generate a 32-byte random number, and packs and generates terminal handshake information; The terminal transmits the terminal handshake information to the remote server; The remote server generates a 32-byte random number, which is packaged to generate server handshake information; The remote server sends the server handshake information and server certificate to the terminal; The terminal sends the remote server certificate to the bank smart card, and the bank smart card verifies the received remote server certificate. If the verification passes, the login is successful; otherwise, the login fails; The terminal uses the bank smart card to carry out the following process: Generate a 48-byte random number as the shared master key; The master key is encrypted with the public key in the remote server certificate to generate an encrypted shared master key; Calculate the hash value of the handshake information from the terminal handshake information and the remote server handshake information, and then encrypt it with the terminal private key to generate a digital signature for the handshake information; The terminal obtains the encrypted shared master key and the digital signature of the handshake information from the bank smart card; The terminal sends the terminal certificate, the encrypted shared master key, and the digital signature of the handshake information to the remote server; The remote server checks the validity of the terminal certificate, if valid, the handshake is successful; otherwise, the handshake fails; The remote server uses the public key in the terminal certificate to verify whether the digital signature of the handshake information matches the handshake information between the terminal and the server. If they match, the handshake is successful; otherwise, the handshake fails and an error is returned; The remote server uses the server private key to decrypt the shared master key to obtain the shared master key; Both parties use the shared master key to calculate the session key; the subsequent communication process uses the session key to encrypt the data packet, that is, a secure channel is established and the login is successful; The bank smart card is provided with an ISO7816 interface, and the card reader reads the security data in the card through the interface. 2. A remote secure payment method according to claim 1, wherein the terminal is a mobile phone, and the remote server is an online banking server of a bank. 3. A remote secure payment method according to claim 1, wherein the terminal is a PAD, and the remote server is an online banking server of a bank. 4. A remote secure payment method according to claim 1, wherein the terminal is a POS machine, and the remote server is a POS server. 5. A remote secure payment method according to claim 1, wherein the terminal is a mobile phone, the remote server is an online banking server, and the mobile phone communicates with the online banking server through a computer. 6. A remote secure payment method according to claim 1, wherein the bank smart card is provided with a contactless communication interface conforming to the ISO14443 standard, and the card reader reads the security data in the card through the interface . 7. A remote security payment system, characterized in that it comprises: A bank smart card for storing secure data; said secure data includes digital certificates and private keys; A card reader for reading the above security data; The terminal is installed with client software for online transactions; The terminal reads the smart card information through the card reader, authenticates the user between the bank smart card and the remote server, and after passing the verification, establishes a secure data link between the bank smart card and the remote server for online transactions ; Among them, the interaction process between the bank smart card and the remote server is as follows: The terminal asks the bank smart card to generate a 32-byte random number, and packs and generates terminal handshake information; The terminal transmits the terminal handshake information to the remote server; The remote server generates a 32-byte random number, which is packaged to generate server handshake information; The remote server sends the server handshake information and server certificate to the terminal; The terminal sends the remote server certificate to the bank smart card, and the bank smart card verifies the received remote server certificate. If the verification passes, the login is successful; otherwise, the login fails; The terminal uses the bank smart card to carry out the following process: Generate a 48-byte random number as the shared master key; The master key is encrypted with the public key in the remote server certificate to generate an encrypted shared master key; Calculate the hash value of the handshake information from the terminal handshake information and the remote server handshake information, and then encrypt it with the terminal private key to generate a digital signature for the handshake information; The terminal obtains the encrypted shared master key and the digital signature of the handshake information from the bank smart card; The terminal sends the terminal certificate, the encrypted shared master key, and the digital signature of the handshake information to the remote server; The remote server checks the validity of the terminal certificate, if valid, the handshake is successful; otherwise, the handshake fails; The remote server uses the public key in the terminal certificate to verify whether the digital signature of the handshake information matches the handshake information between the terminal and the server. If they match, the handshake is successful; otherwise, the handshake fails and an error is returned; The remote server uses the server private key to decrypt the shared master key to obtain the shared master key; Both parties use the shared master key to calculate the session key; the subsequent communication process uses the session key to encrypt the data packet, that is, a secure channel is established and the login is successful; The bank smart card is provided with an ISO7816 interface, and the card reader reads the security data in the card through the interface. 8. A remote secure payment system according to claim 7, wherein the terminal is a mobile phone, and the remote server is an online banking server of a bank. 9. A remote secure payment system according to claim 7, wherein the terminal is a POS machine, and the remote server is a POS server. 10. A remote secure payment system according to claim 7, wherein the terminal is a mobile phone, the remote server is an online banking server, and the mobile phone communicates with the online banking server through a computer. 11. A remote secure payment system according to claim 7, wherein the bank smart card is provided with a non-contact communication interface conforming to the ISO14443 standard, and the card reader reads the security data in the card through the interface .