Data signature authentication method and data signature authentication system

Abstract

The invention discloses a data signature authentication method and a data signature authentication system. The method comprises the following steps that: a universal serial bus (USB) key receives a data message to be signed and analyzes the data message to be signed to obtain data to be signed; the USB key judges whether acknowledge execution information is received within predetermined time; if the acknowledge execution information is received within the predetermined time, the USB key acquires a first dynamic password and processes the first dynamic password and the data to be signed to obtain signed data; if the acknowledge execution information is not received within the predetermined time, the USB key finishes operation; the USB key sends the data to be signed and the signed data to a background server by a client; the background server generates a validation window, wherein the validation window has at least two second dynamic passwords; and the validation window validates the signed data according to the data to be signed and the second dynamic passwords. In the data signature authentication method and the data signature authentication system, by using the dynamic passwords in signature as timestamps, the background server authenticates the dynamic passwords and the data to be signed, so the security of network data transmission is improved, and replay attack resistance is truly realized.

Description

technical field [0001] The invention relates to the field of information security, in particular to a data signature authentication method and system. Background technique [0002] With the rapid development of the Internet, online transactions have become more and more common, but due to the insecurity of the network, people often use smart key devices (ie USB Key) to ensure the security of online transactions. [0003] In the existing transaction process, for the user, the operations of confirmation or sending information required in the entire transaction process are realized on the client, and both the Internet and the mobile communication network are open systems, so It is possible to be maliciously attacked by third parties such as hackers and fake websites, and there is also the risk of being infected with viruses such as Trojan horses, resulting in the loss or tampering of transaction information and personal information, especially if the client receives during the ...

AI Technical Summary

Problems solved by technology

[0003] In the existing transaction process, for the user, the operations of confirmation or sending information required in the entire transaction process are realized on the client, and both the Internet and the mobile communication network are open systems, so It is possible to be maliciously attacked by third parties such as hackers and fake websites, and there is also the risk of being infected with viruses such as Trojan horses, resulting in the loss or tampering of transaction information and personal information, especially if the client receives during the transaction. In the case of remote control of third-party programs, it is also possible for the client to automatically complete the transaction under the remote control of the third party

[0004] In the prior art, the signature authentication process is generally: the client or the USB Key signs the transaction information and sends it to the background server for authentication. Due to the insecurity of the network, the USB Key will perform transaction information that has been attacked or tampered with by a Trojan horse. The result after the digital signature is sent to the server for verification. Even if the server verification fails, the underlying Trojan horse of the computer may return a successful verification result to the client, confusing the user to conduct transactions; some attackers may even send a package that the server has received , to achieve the purpose of deceiving the system, which will cause huge losses to users

Images