Security authentication method, device and equipment in online banking scene and storage medium
By determining the information to be authenticated based on the request type in online banking transactions and using identity certificates or multi-dimensional information for security authentication, the problems of sessionID leakage and complex K-Key operation are solved, thereby improving transaction security and authentication accuracy.
Patent Information
- Application Number
- CN202510999043.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-18
- Publication Date
- 2025-10-31
AI Technical Summary
In existing technologies, online banking transactions rely on sessionID for security authentication, which can easily lead to sessionID leakage. Attackers can forge transaction information, posing a risk to the client's fund security. In addition, K-Key signature operations are complex and costly, making them unsuitable for large-scale application.
By establishing a session connection between the server and the client, determining the information to be authenticated based on the transaction request type, and using identity certificates or multi-dimensional information for security authentication, the system avoids reliance on a single session ID or K-key, thereby improving the comprehensiveness and accuracy of authentication.
It enhances the security of online banking transactions, protects customer information and funds, simplifies the authentication process, and reduces operational complexity and costs.
Smart Images
Figure CN120880725A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the fields of computer technology and financial technology, and in particular to a security authentication method, apparatus, device and storage medium for online banking scenarios. Background Technology
[0002] With the development of computer technology, online banking has become increasingly popular. Its convenience and speed have led more and more users to choose online banking for their banking transactions. Therefore, ensuring the security of online banking transactions has become a pressing technical issue that needs to be addressed.
[0003] In existing technologies, when processing transactions in online banking, the client mainly relies on the session ID (session identifier) distributed by the server to uniquely obtain the client's session information after logging into the online banking system, and then conducts online banking transactions based on the obtained session information.
[0004] This implementation relies primarily on session IDs for security authentication. However, if the connection between the client and server is intercepted, an attacker can illegally obtain the client's session ID, resulting in a session ID leak. In this case, the attacker can use the intercepted session ID to forge transaction information, thereby jeopardizing the client's funds. Summary of the Invention
[0005] This application provides a security authentication method, apparatus, device, and storage medium for online banking scenarios, in order to improve the effectiveness of security authentication and protect customer information security and fund security.
[0006] In a first aspect, embodiments of this application provide a security authentication method for online banking scenarios, including:
[0007] In response to a transaction processing request initiated by the client, a session connection is established between the server and the client, and the request type of the transaction processing request is determined; wherein, the request type is used to indicate whether the client has an online banking identity certificate;
[0008] Based on the request type, determine the matching authentication information; wherein, the authentication information is used to verify the identity of the client;
[0009] Based on the information to be authenticated, security authentication is performed, and after the security authentication is passed, transaction processing is performed according to the transaction processing request.
[0010] Secondly, embodiments of this application provide a security authentication device for online banking scenarios, comprising:
[0011] A response unit is used to respond to a transaction processing request initiated by a client, establish a session connection between the server and the client, and determine the request type of the transaction processing request; wherein, the request type is used to indicate whether the client has an online banking identity certificate;
[0012] The determining unit is configured to determine matching authentication information based on the request type; wherein the authentication information is used to verify the identity of the client.
[0013] The authentication unit is used to perform security authentication based on the information to be authenticated, and after the security authentication is passed, to perform transaction processing according to the transaction processing request.
[0014] Thirdly, embodiments of this application provide a computer device, including: a memory and a processor;
[0015] The memory stores computer-executed instructions;
[0016] The processor executes computer execution instructions stored in the memory, causing the processor to perform the implementation method described in the first aspect above.
[0017] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the embodiments described in the first aspect above.
[0018] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the implementation methods described in the first aspect above.
[0019] The security authentication method, apparatus, device, and storage medium for online banking scenarios provided in this application embodiment can respond to a transaction processing request initiated by a client, establish a session connection between the server and the client, and determine the request type of the transaction processing request. The request type indicates whether the client possesses an online banking identity certificate. At this point, different authentication methods can be determined based on whether the client possesses online banking identity information, thereby broadening the applicability of the security authentication method. Then, based on the request type, matching authentication information can be determined, and security authentication can be performed based on this information. This implementation avoids relying on a K-key or a single session ID for identity authentication of the request initiator, improving the comprehensiveness of security authentication and thus improving the accuracy of identity authentication. After successful security authentication, transaction processing is performed according to the transaction processing request, improving transaction security and protecting customer information and fund security. Attached Figure Description
[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0021] Figure 1 This is a schematic diagram illustrating an application scenario of an existing security authentication method provided in an embodiment of this application;
[0022] Figure 2 This is a schematic diagram illustrating an application scenario of another existing security authentication method provided in the embodiments of this application;
[0023] Figure 3 A flowchart illustrating a security authentication method in an online banking scenario provided in this application embodiment;
[0024] Figure 4 A flowchart illustrating another security authentication method for an online banking scenario provided in this application embodiment;
[0025] Figure 5 A schematic diagram illustrating the implementation process of a security authentication method with a certificate request type, provided for an embodiment of this application;
[0026] Figure 6 A schematic diagram illustrating the implementation process of a security authentication method for a certificateless request type provided in this application embodiment;
[0027] Figure 7 This application provides a schematic diagram of the structure of a security authentication device in an online banking scenario.
[0028] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application.
[0029] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation
[0030] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0031] First, let me explain the terms used in this application:
[0032] sessionID: A unique identifier created by the server for the client; when the client sends a request, the server obtains the session ID from the client's cookie, and then determines the corresponding client to perform the operation.
[0033] A session is a persistent interactive state established between a client and a server, storing information related to the client's state, such as sensitive client information.
[0034] K-Key: A physical medium used to store customer certificates and private keys. It looks similar to a USB flash drive and is also known as a USB-KEY.
[0035] Certificate: Also known as digital certificate or digital identifier (i.e., identity certificate in this application); it is a digital authentication that identifies the identity information of the parties in Internet communication and is used to identify the other party's identity;
[0036] HTTPS two-way authentication: The SSL (Secure Sockets Layer) protocol requires both the server and the client / user to have certificates. The client needs to verify access to the server, and the server also needs to verify access to the client.
[0037] HTTPS one-way authentication: The one-way authentication SSL protocol does not require the client to have a certificate. The client needs to verify the server, but the server does not need to verify the client's access.
[0038] With the development of computer technology, online banking has become increasingly popular. Its convenience and speed have led more and more users to choose online banking for their banking transactions. Therefore, ensuring the security of online banking transactions has become a pressing technical issue that needs to be addressed.
[0039] In existing technologies, when processing transactions in online banking, the client mainly relies on the session ID distributed by the server to uniquely obtain the client's session information after logging into the online banking system, and then conducts online banking transactions based on the obtained session information.
[0040] This implementation relies primarily on session IDs for security authentication. However, if the connection between the client and server is intercepted, an attacker can illegally obtain the client's session ID, resulting in a session ID leak. In this case, the attacker can use the intercepted session ID to forge transaction information, thereby jeopardizing the client's funds.
[0041] Based on this, see Figure 1 , Figure 1 This is a schematic diagram illustrating an application scenario of an existing security authentication method provided in an embodiment of this application, such as... Figure 1 As shown, in this application scenario, after the client initiates a transaction processing request to the server, the server can obtain the user's session information based on the sessionID, verify the transaction elements, and then execute the transaction processing.
[0042] like Figure 1 As shown by the dotted line, if the link between the client and the server is intercepted by an attacker, the attacker can construct messages based on the intercepted session ID, forge transaction information, and thus pose risks of customer information leakage and fund security.
[0043] To avoid security risks caused by session ID leakage, related technologies use K-Key signatures for online banking transactions, and the transaction is executed after the server verifies the signature.
[0044] See Figure 2 , Figure 2 This is a schematic diagram illustrating an application scenario of another existing security authentication method provided in the embodiments of this application, such as... Figure 2 As shown, in this application scenario, the client uses a K-Key to sign and sends the transaction processing request initiated by the client, along with the encrypted signature data, to the server for verification. At this point, the signature data can be decrypted using a unified public key infrastructure platform to obtain the original signature. The server then verifies the original signature, and upon successful verification, obtains the user's session information and executes the transaction processing.
[0045] This implementation requires users to sign each transaction processing request using a K-Key, which is complex and inconvenient. Furthermore, different transaction processing scenarios require the K-Key to display different content, leading to a large development and adaptation workload and increased costs. Consequently, the K-Key is only suitable for certain transaction processing scenarios and cannot be widely used.
[0046] To address the aforementioned technical issues, this application provides a security authentication method for online banking scenarios. This method can determine the matching authentication information for security authentication in scenarios with or without a K-Key, thereby improving the security of customer information and financial information and solving the above-mentioned technical problems.
[0047] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.
[0048] Figure 3 This is a flowchart illustrating a security authentication method for an online banking scenario provided in an embodiment of this application, as shown below. Figure 3 As shown, the method includes:
[0049] S301. In response to a transaction processing request initiated by the client, establish a session connection between the server and the client, and determine the request type of the transaction processing request.
[0050] The request type is used to indicate whether the client has an online banking identity certificate.
[0051] In one example, this embodiment of the application can be applied to the server side, and security authentication can be completed through the interaction between the server and the client, and transaction processing can be performed after the security authentication is passed.
[0052] In one example, the server can respond to a transaction processing request initiated by the client by establishing a session connection between the server and the client. At this time, the state memory (i.e., session) of the session connection stores relevant information about the client, and after successful security authentication, the transaction is processed according to the relevant information stored in the state memory.
[0053] In one example, if the transaction processing request includes an identity certificate, then the request type can be determined to be a certificated request type; if the transaction processing request does not include an identity certificate, then the request type can be determined to be a certificateless request type.
[0054] S302. Determine the matching authentication information based on the request type.
[0055] The authentication information is used to verify the client's identity.
[0056] In one example, different authentication information can correspond to certificate-based and certificateless request types. For instance, due to the security and accuracy of identity certificates, the authentication information can be determined based on the identity certificate in a certificate-based request type. Conversely, in a certificateless request type, the authentication information can be determined based on various interaction information between the client and the server, thereby ensuring the security and reliability of transaction processing requests.
[0057] S303. Perform security authentication based on the information to be authenticated, and process the transaction according to the transaction processing request after the security authentication is successful.
[0058] As described above, this embodiment of the application can establish a session connection between the server and the client in response to a transaction processing request initiated by the client, and determine the request type of the transaction processing request. The request type indicates whether the client possesses an online banking identity certificate. At this point, different authentication methods can be determined based on whether the client possesses online banking identity information, thereby broadening the applicability of the security authentication method. Then, based on the request type, matching authentication information can be determined, and security authentication can be performed based on this information. This implementation avoids relying on a K-key or a single session ID for identity authentication of the request initiator, improving the comprehensiveness of security authentication and thus improving the accuracy of identity authentication. After successful security authentication, transaction processing is performed according to the transaction processing request, improving transaction security and protecting customer information and financial security.
[0059] Figure 4 This is a flowchart illustrating another security authentication method for online banking scenarios provided in an embodiment of this application, as shown below. Figure 4 As shown, in this embodiment... Figure 3 Based on the examples, a detailed description of the security authentication method in online banking scenarios is provided. This method includes:
[0060] S401. In response to a transaction processing request initiated by the client, establish a session connection between the server and the client, and determine the request type of the transaction processing request.
[0061] The request type is used to indicate whether the client has an online banking identity certificate.
[0062] As can be seen from the above description, the request type can include a certificate-based request type and a certificate-free request type. Therefore, the corresponding security authentication methods are described below for the two request types respectively.
[0063] S402. If the request type indicates that the client has an online banking identity certificate, establish a bidirectional connection between the client and the server based on the identity certificate.
[0064] For example, after successful HTTPS mutual authentication between the client and the server, a bidirectional connection can be established between the client and the server.
[0065] To prevent attacks after a two-way connection is established between the client and the server, the authentication information can be determined based on the identity certificate to achieve two-factor authentication and improve security.
[0066] S403. After a successful bidirectional connection, determine the distinguishable name of the identity certificate; wherein, the distinguishable name is used to uniquely identify the identity certificate.
[0067] S404. Determine the authentication information based on the distinguishable name; wherein the authentication information is used to be concatenated into the Uniform Resource Locator corresponding to the transaction processing request, and to be added to the state storage of the session connection between the client and the server.
[0068] After determining the information to be authenticated according to the above steps, the transaction processing request is appended with a first distinguishable name; the state memory stores a second distinguishable name. At this point, security authentication can be performed based on the information to be authenticated.
[0069] S405. Compare the first distinguishable name and the second distinguishable name. If they match, the security authentication is confirmed to be successful.
[0070] S406. If the comparison is inconsistent, the security certification is confirmed to have failed.
[0071] See Figure 5 , Figure 5 This is a schematic diagram illustrating the implementation process of a security authentication method with a certificate request type, provided as an embodiment of this application. Figure 5 As shown, after initiating a transaction processing request, the client can first perform two-way authentication using the server's F5 load balancer. Upon successful authentication, a two-way connection is established between the client and the server, and the distinguishable name of the identity certificate is appended to the URL (uniform resource locator) of each transaction processing request initiated by the client. Simultaneously, the distinguishable name of the identity certificate is added to the state storage of the session connection between the client and the server.
[0072] Before processing each transaction request, the server compares the first distinguishable name concatenated in the transaction request with the second distinguishable name stored in the server's state memory. If the first and second distinguishable names match, the request is considered normal, and transaction processing can proceed. If the first and second distinguishable names do not match, the request is considered abnormal, and the transaction request is intercepted.
[0073] S407. If the request type indicates that the client does not have an online banking identity certificate, generate a universally unique identifier and store the universally unique identifier in the session connection's state memory.
[0074] S408. After sending the universally unique identifier and the server's timestamp to the client, determine the authentication information based on the universally unique identifier, the client's timestamp, and the single-valid random string generated by the client.
[0075] In one possible implementation, after generating the universally unique identifier, the universally unique identifier and the server's timestamp can be sent to the client. Then, the server's timestamp and the client's timestamp are compared to obtain a timestamp comparison result; where the timestamp comparison result indicates the time difference between the server's timestamp and the client's timestamp. If the time difference determines that a preset time difference requirement is met, the client can generate a single valid random string. If the time difference determines that the preset time difference requirement is not met, then the service can be rejected or the timestamp can be synchronized, thereby ensuring the real-time nature and validity of the timestamp.
[0076] In one example, the authentication information to be authenticated under the no-certificate request type may include the client's first authentication information and the server's second authentication information.
[0077] Specifically, a first signature can be generated based on the universally unique identifier, the client's timestamp, and a single valid random string generated by the client, and this first signature can be used as the first authentication information. Then, the first signature, the client's timestamp, and the single valid random string can be sent to the server. The server can then generate a second signature based on the client's timestamp, the single valid random string, and a pre-stored universally unique identifier, and use this second signature, the client's timestamp, the server's current timestamp, and the single valid random string as the second authentication information.
[0078] This implementation method can determine the information to be authenticated based on information from multiple dimensions, thereby ensuring the accuracy of authentication even without a certificate. Simultaneously, it utilizes timestamp information to prevent request interaction times from exceeding the valid range, and employs a single valid random string to prevent duplicate requests, further ensuring request security.
[0079] S409. Compare the first signature information and the second signature information. If they match, compare the client's timestamp with the server's current timestamp to obtain the time comparison result.
[0080] S410. If it is determined that the time comparison result is within the preset time window, then determine whether the single valid random string received by the server is repeated.
[0081] S411. If the verification is not repeated, the security authentication is confirmed to be successful; otherwise, the security authentication is confirmed to be unsuccessful.
[0082] See Figure 6 , Figure 6 This is a schematic diagram illustrating the implementation process of a security authentication method for a certificateless request type, as provided in an embodiment of this application. Figure 6As shown, the client can first send a transaction processing request to the server. The server can then generate a universally unique identifier (UUID), store it in a state memory, and send the UUID and the server's timestamp to the client. The client stores the received UUID and verifies the time difference between the server's timestamp and the client's timestamp to see if it meets a preset time difference requirement (i.e., timestamp verification). If it does, a single-use valid random string is generated, and the first signature information is generated based on the UUID, the single-use valid random string, and the client's timestamp.
[0083] Then, the first signature information, the client's timestamp, a single valid random string, and the message body can be placed in the message header of the transaction processing request and transmitted to the server.
[0084] After receiving the data, the server can generate a second signature based on the client's timestamp, a single valid random string, and a pre-stored universally unique identifier.
[0085] Then, signature verification, timestamp verification, and single-valid random string verification can be performed in sequence to ensure the accuracy and non-repetition of transaction processing requests, thereby ensuring the security of transaction processing requests.
[0086] After successful security authentication, transaction processing can proceed, and the result will be returned to the client. Otherwise, the transaction processing request will be intercepted.
[0087] S412. After security authentication is passed, the transaction is processed according to the transaction processing request.
[0088] In practice, after security authentication is passed, the client's relevant information stored in the state memory can be obtained; then, transaction processing can be performed based on the client's relevant information and transaction processing request.
[0089] Figure 7 This is a schematic diagram of the structure of a security authentication device in an online banking scenario provided in an embodiment of this application, as shown below. Figure 7 As shown, the security authentication device 70 for online banking scenarios provided in this embodiment includes:
[0090] The response unit 701 is used to respond to a transaction processing request initiated by the client, establish a session connection between the server and the client, and determine the request type of the transaction processing request; wherein, the request type is used to indicate whether the client has an online banking identity certificate.
[0091] The determining unit 702 is used to determine the matching authentication information based on the request type; wherein the authentication information is used to verify the identity of the client.
[0092] The authentication unit 703 is used to perform security authentication based on the information to be authenticated, and to process the transaction according to the transaction processing request after the security authentication is passed.
[0093] In one possible implementation, the request type indicates that the client has an online banking identity certificate; in this case, the determining unit 702 is used to:
[0094] If the request type indicates that the client has an online banking identity certificate, a bidirectional connection is established between the client and the server based on the identity certificate.
[0095] After a successful bidirectional connection, the distinguishable name of the identity certificate is determined; the distinguishable name is used to uniquely identify the identity certificate.
[0096] Based on the distinguishable name, the information to be authenticated is determined; wherein, the information to be authenticated is used to be concatenated into the Uniform Resource Locator corresponding to the transaction processing request, and to be added to the state storage of the session connection between the client and the server.
[0097] In one possible implementation, the transaction processing request is appended with a first distinguishable name; a second distinguishable name is stored in the state memory; at this time, the authentication unit 703 is used to:
[0098] The first distinguishable name and the second distinguishable name are compared. If they match, the security authentication is confirmed to be successful.
[0099] If the comparison is inconsistent, the security certification has failed.
[0100] In one possible implementation, the request type indicates that the client does not have an online banking identity certificate; in this case, the determining unit 702 is used to:
[0101] If the request type indicates that the client does not have an online banking identity certificate, a universally unique identifier is generated and stored in the session connection's state memory.
[0102] After sending the universally unique identifier and the server's timestamp to the client, the authentication information is determined based on the universally unique identifier, the client's timestamp, and the single-use random string generated by the client.
[0103] In one possible implementation, the information to be authenticated includes first authentication information from the client and second authentication information from the server; in this case, the determining unit 702 is used to:
[0104] Based on the universally unique identifier, the client's timestamp, and the single valid random string generated by the client, the first signature information is generated and the first signature information is determined as the first authentication information;
[0105] The first signature information, the client's timestamp, and a single valid random string are sent to the server so that the server can generate the second signature information based on the client's timestamp, the single valid random string, and a pre-stored universally unique identifier. The second signature information, the client's timestamp, the server's current timestamp, and the single valid random string are then used as the second authentication information.
[0106] In one possible implementation, the authentication unit 703 is used for:
[0107] The first signature information and the second signature information are compared. If they match, the client's timestamp is compared with the server's current timestamp to obtain the time comparison result.
[0108] If the time comparison result is determined to be within the preset time window, then it is determined whether the single valid random string received by the server is duplicated;
[0109] If the verification is not repeated, the security authentication is confirmed to be successful; otherwise, the security authentication is confirmed to be unsuccessful.
[0110] In one possible implementation, the authentication unit 703 is used for:
[0111] After security authentication is passed, the client-related information stored in the state memory is obtained;
[0112] Process transactions based on customer information and transaction processing requests.
[0113] The security authentication device for online banking scenarios provided in this embodiment can execute the methods provided in the above method embodiments. Its implementation principle and technical effect are similar, and will not be described in detail here.
[0114] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 8 As shown, the computer device 80 provided in this embodiment includes at least one processor 801 and a memory 802. Optionally, the computer device 80 further includes a communication component 803. The processor 801, memory 802, and communication component 803 are connected via a bus 804.
[0115] In a specific implementation, at least one processor 801 executes computer execution instructions stored in memory 802, causing at least one processor 801 to perform the above-described method.
[0116] The specific implementation process of processor 801 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.
[0117] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.
[0118] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.
[0119] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.
[0120] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.
[0121] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.
[0122] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.
[0123] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.
[0124] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.
[0125] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0126] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0127] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0128] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.
[0129] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.
Claims
1. A security authentication method for online banking scenarios, characterized in that, include: In response to a transaction processing request initiated by the client, a session connection is established between the server and the client, and the request type of the transaction processing request is determined; wherein, the request type is used to indicate whether the client has an online banking identity certificate; Based on the request type, determine the matching authentication information; wherein, the authentication information is used to verify the identity of the client; Based on the information to be authenticated, security authentication is performed, and after the security authentication is passed, transaction processing is performed according to the transaction processing request.
2. The method according to claim 1, characterized in that, The request type indicates that the client has an online banking identity certificate; Based on the request type, determine the matching authentication information, including: If the request type indicates that the client has an online banking identity certificate, a bidirectional connection is established between the client and the server based on the identity certificate. After a successful bidirectional connection, a distinguishable name for the identity certificate is determined; wherein, the distinguishable name is used to uniquely identify the identity certificate. Based on the distinguishable name, the information to be authenticated is determined; wherein the information to be authenticated is used to be concatenated into the Uniform Resource Locator corresponding to the transaction processing request, and to be added to the state storage of the session connection between the client and the server.
3. The method according to claim 2, characterized in that, The transaction processing request is concatenated with a first distinguishable name; the state memory stores a second distinguishable name; security authentication is performed based on the information to be authenticated, including: The first distinguishable name and the second distinguishable name are compared. If they match, the security authentication is confirmed to be successful. If the comparison is inconsistent, the security certification has failed.
4. The method according to claim 1, characterized in that, The request type indicates that the client does not have an online banking identity certificate; Based on the request type, determine the matching authentication information, including: If the request type indicates that the client does not have an online banking identity certificate, a universally unique identifier is generated and stored in the state memory of the session connection. After sending the universally unique identifier and the server's timestamp to the client, the authentication information is determined based on the universally unique identifier, the client's timestamp, and the single-valid random string generated by the client.
5. The method according to claim 4, characterized in that, The information to be authenticated includes the client's first authentication information and the server's second authentication information; the information to be authenticated is determined based on the universally unique identifier, the client's timestamp, and a single valid random string generated by the client, including: Based on the universally unique identifier, the client's timestamp, and the single valid random string generated by the client, a first signature is generated, and the first signature is determined as the first authentication information. The first signature information, the client's timestamp, and the single-valid random string are sent to the server so that the server generates second signature information based on the client's timestamp, the single-valid random string, and a pre-stored universal unique identifier, and determines the second signature information, the client's timestamp, the server's current timestamp, and the single-valid random string as the second authentication information.
6. The method according to claim 5, characterized in that, Based on the information to be authenticated, perform security authentication, including: The first signature information and the second signature information are compared. If they match, the timestamp of the client is compared with the current timestamp of the server to obtain a time comparison result. If it is determined that the time comparison result is within a preset time window, then it is determined whether the single valid random string received by the server is repeated. If the verification is not repeated, the security authentication is confirmed to be successful; otherwise, the security authentication is confirmed to be unsuccessful.
7. The method according to any one of claims 1-6, characterized in that, After security authentication is passed, transaction processing is performed according to the transaction processing request, including: After the security authentication is passed, the client-related information stored in the state memory is obtained; The transaction is processed based on the customer information and the transaction processing request.
8. A security authentication device for online banking scenarios, characterized in that, include: A response unit is used to respond to a transaction processing request initiated by a client, establish a session connection between the server and the client, and determine the request type of the transaction processing request; wherein, the request type is used to indicate whether the client has an online banking identity certificate; The determining unit is configured to determine matching authentication information based on the request type; wherein the authentication information is used to verify the identity of the client. The authentication unit is used to perform security authentication based on the information to be authenticated, and after the security authentication is passed, to perform transaction processing according to the transaction processing request.
9. A computer device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.