Data authentication method and system using same

Abstract

The invention provides a data authentication method and a system using the same. The system comprises a smart card, an authentication device, a networked computer and a server, wherein the authentication device comprises an interface circuit, a keyboard, a display screen and a smart card interface; the display screen is used for displaying information necessary for logon or a transaction; the keyboard is used for inputting a user password and operation of a signature; the interface circuit is a USB (Universal Serial Bus) interface; the smart card is used for storing user information and a private key; the authentication device is correspondingly electrically connected with the networked computer and the smart card through the USB interface and the smart card interface respectively; the networked computer is in communication connection with the server through a network; and the server is an authentication server or a transaction server.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a data authentication method and a system using the method. Background technique [0002] With the rapid development of the Internet and the great convenience it provides, people increasingly rely on the Internet for various activities, such as online banking, online shopping, online payment, etc.; while the Internet provides convenience for people, because of its Openness has also brought great security risks to people. Correspondingly, network information security has attracted more and more attention. The premise of network security is to accurately identify legitimate users and implement access control. [0003] User identity authentication and transaction authentication are an important part of the security system in network applications, and the access authorization of legitimate users is realized through identity authentication. At present, the identity auth...

AI Technical Summary

Problems solved by technology

[0008] There are some potential safety hazards and inconveniences in the above-mentioned existing technologies. When the mobile phone dynamic authentication technology is lost or the network is not smooth, it will affect the user's use; in the system using dynamic tokens for authentication, dynamic tokens have a fatal It cannot resist Trojan tampering attack, and the server needs to store the seed of the dynamic token, which has a huge security risk

Digital certificate is the safest way in theory, but there are still situations where certificates are lost or stolen. In order to solve this problem, patent 200410028723.9 describes a USBKEY device. USBKEY is an intelligent storage device that can be used to store digital The certificate has a security chip inside, which can perform digital signature and signature verification calculations. It has a small appearance and can be plugged into the USB port of the computer. With the increasing popularity of online banking, users who choose USBKEY to protect the security of online banking have reached a very objective level. Quantity, currently online banks mostly use it to authenticate customers

However, although this method solves the problem of digital certificate preservation, there are still problems of remote control, transaction hijacking and transaction tampering in use.

Images