A bank-enterprise direct connection system and method based on embedded multi-bank fund management

Abstract

This invention relates to a bank-enterprise direct connection system and method based on embedded multi-bank fund management. The system includes an embedding module for installing the bank-enterprise direct connection programs and U-key drivers for each bank. The embedding module includes at least one sub-embedded module, where non-conflicting bank-enterprise direct connection programs are installed. A scheduling module allocates the sub-embedded module containing the bank-enterprise direct connection program corresponding to the transaction request and starts the corresponding program. A communication proxy module assigns corresponding U-key access permissions to each bank-enterprise direct connection program, sends encrypted transaction request messages to the corresponding program, and receives response messages. This system resolves the conflict problem between bank-enterprise direct connections and, through a proxy method, connects with banks, avoiding the risk of communication port attacks in standard or virtualized environments, thus improving the security of the bank-enterprise direct connection programs.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a bank-enterprise direct connection system and method based on embedded multi-bank fund management. Background Technology

[0002] The main implementation of direct bank-enterprise connection involves the enterprise deploying a bank direct connection client on a server (front-end server) within the enterprise network. The enterprise's internal management system sends transaction messages to the bank-enterprise client on the front-end server. The bank client, using a U-key provided by the bank and employing publicly known technology, encrypts and signs the messages before sending them to the bank. After decrypting and verifying the signature, the bank processes the enterprise's request and returns the processed result to the bank-enterprise direct connection client in the same manner. The bank-enterprise direct connection client, similarly decrypts and verifies the results using the bank's U-key and then sends the result back to the management system that sent the request.

[0003] Large enterprises typically connect directly with multiple banks. For ease of management, they often use a Multi-Bank Funds Management System (MBS). An MBS can simultaneously connect to multiple banks' direct bank-enterprise systems, resolving fund management issues in enterprise operations. It helps streamline a client's multi-bank account system, optimize multi-bank fund transfer processes, improve fund utilization efficiency, and reduce corporate financial risks.

[0004] However, the MBS system requires the installation of direct bank-enterprise connection systems from multiple banks. Sometimes, the U-key drivers or programs of these direct bank-enterprise connection systems may conflict. To avoid conflicts between the direct bank-enterprise connection systems of different banks, it is necessary to install the conflicting direct bank-enterprise connection systems on different systems, which requires the purchase of additional servers or the use of virtual machines.

[0005] Switching between the hostOS and multiple guestOS within a virtual machine incurs significant system resource overhead, impacting the performance of the MBS virtual machine, especially when deploying more than three virtual machines. An increase in virtual machines also increases management costs.

[0006] In addition, due to different operating systems, the installation process of the bank-enterprise direct connection program may occasionally encounter compatibility issues with the operating system. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention proposes a bank-enterprise direct connection system and method based on embedded multi-bank fund management. By setting up an embedded module, non-conflicting bank-enterprise direct connections are installed in the same sub-embedded module, resolving conflicts between different bank-enterprise direct connections. Furthermore, by using a proxy method to interface with banks, the risk of communication port attacks on the bank-enterprise direct connection program in standard or virtualized environments is avoided, thus improving the security of the bank-enterprise direct connection program.

[0008] To achieve the above objectives, the technical solution adopted by the present invention includes:

[0009] A bank-enterprise direct connection system based on embedded multi-bank fund management includes:

[0010] An embedded module is used to install the bank-enterprise direct connection program and UKEY driver of each bank; the embedded module includes at least one sub-embedded module, and the bank-enterprise direct connection programs that do not conflict with each other are installed in the same sub-embedded module;

[0011] The acquisition module is used to acquire transaction requests;

[0012] The parsing module is used to parse the transaction request message of the transaction request;

[0013] The scheduling module allocates the sub-embedded module containing the bank-enterprise direct connection program corresponding to the transaction request, and starts the bank-enterprise direct connection program corresponding to the transaction request.

[0014] The signature module is used to sign the transaction request message using the UKEY and generate a signed transaction request message.

[0015] The encryption module is used to encrypt the signed transaction request message using a UKEY to generate an encrypted transaction request message.

[0016] The communication proxy module is used to assign corresponding UKEY access permissions to each bank's direct bank-enterprise connection program, send encrypted transaction request messages to the bank-enterprise direct bank-enterprise connection program corresponding to the transaction request, and receive response messages.

[0017] Furthermore, the privilege level of the embedded module is RING1, RING2, or RING3.

[0018] Furthermore, the privilege level of the scheduling module is RING0.

[0019] Furthermore, the communication proxy module is also used to configure the login username, password, and service port parameters.

[0020] This invention also relates to a method for direct bank-enterprise connection based on embedded multi-bank fund management, comprising:

[0021] Install the bank-enterprise direct connection program and UKEY driver of each bank into the embedded module; the embedded module includes at least one sub-embedded module, and the bank-enterprise direct connection programs that do not conflict with each other are installed into the same sub-embedded module;

[0022] Obtain the transaction request and parse the transaction request message of the transaction request;

[0023] Allocate the sub-embedded module containing the bank-enterprise direct connection program corresponding to the transaction request, and start the bank-enterprise direct connection program corresponding to the transaction request;

[0024] The transaction request message is signed using a UKEY to generate a signed transaction request message;

[0025] The signed transaction request message is encrypted using a UKEY to generate an encrypted transaction request message.

[0026] Assign corresponding UKEY access permissions to each bank's direct bank-enterprise connection program, send encrypted transaction request messages to the bank's direct bank-enterprise connection program corresponding to the transaction request, and receive response messages.

[0027] The present invention also relates to a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0028] The present invention also relates to an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method.

[0029] The beneficial effects of this invention are as follows:

[0030] This invention resolves conflicts between different bank-enterprise direct connection protocols by embedding them into a single sub-embedded module. Furthermore, it uses a proxy method to interface with banks, avoiding the risk of communication port attacks in standard or virtualized environments, thus improving the security of the bank-enterprise direct connection program. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of the bank-enterprise direct connection system structure based on embedded multi-bank fund management according to the present invention.

[0032] Figure 2 This is a schematic diagram of the bank-enterprise direct connection method based on embedded multi-bank fund management according to the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] The first aspect of the present invention relates to a structure as follows Figure 1The bank-enterprise direct connection system based on embedded multi-bank fund management shown includes:

[0035] An embedded module is used to install the bank-enterprise direct connection program and UKEY driver of each bank; the embedded module includes at least one sub-embedded module, and the bank-enterprise direct connection programs that do not conflict with each other are installed in the same sub-embedded module;

[0036] Specifically, in this embodiment, a lightweight bank-enterprise direct connection embedded module is customized to ensure that the embedded module runs on RING1 or higher and does not require RING0 permissions, thus reducing system overhead. Within the embedded module, the UKEY drivers for each bank's bank-enterprise direct connection program are installed, creating embedded modules for each bank's bank-enterprise direct connection. Bank-enterprise direct connection programs and drivers without conflicts are installed in the same sub-embedded module, while conflicting programs and drivers are installed in different sub-embedded modules, reducing the number of modules installed at runtime.

[0037] The acquisition module is used to acquire transaction requests;

[0038] The parsing module is used to parse the transaction request message of the transaction request;

[0039] The scheduling module allocates the sub-embedded module containing the bank-enterprise direct connection program corresponding to the transaction request, and starts the bank-enterprise direct connection program corresponding to the transaction request.

[0040] Specifically, in this embodiment of the application, the privilege level of the scheduling module is RING0. The scheduling module loads the sub-embedded module containing the bank-enterprise direct connection program required by the customer and starts the bank-enterprise direct connection program required by the customer in the sub-embedded module.

[0041] The signature module is used to sign the transaction request message using the UKEY and generate a signed transaction request message.

[0042] The encryption module is used to encrypt the signed transaction request message using a UKEY to generate an encrypted transaction request message.

[0043] The communication proxy module is used to assign corresponding UKEY access permissions to each bank's direct bank-enterprise connection program, send encrypted transaction request messages to the bank-enterprise direct bank-enterprise connection program corresponding to the transaction request, and receive response messages.

[0044] Specifically, in this embodiment, the communication agent module controls the operation of the bank-enterprise direct connection program, and assigns corresponding UKEY access permissions to each bank for the bank-enterprise direct connection, and configures parameters such as login username, password, and service port.

[0045] It should be noted that although several modules of the bank-enterprise direct connection system based on embedded multi-bank fund management are mentioned in the above description, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided and embodied by multiple modules.

[0046] refer to Figure 2 This is a schematic diagram of a bank-enterprise direct connection method based on embedded multi-bank fund management, according to a specific embodiment of the present invention. It includes:

[0047] Install the bank-enterprise direct connection program and UKEY driver of each bank into the embedded module; the embedded module includes at least one sub-embedded module, and the bank-enterprise direct connection programs that do not conflict with each other are installed into the same sub-embedded module;

[0048] Obtain the transaction request and parse the transaction request message of the transaction request;

[0049] Allocate the sub-embedded module containing the bank-enterprise direct connection program corresponding to the transaction request, and start the bank-enterprise direct connection program corresponding to the transaction request;

[0050] The transaction request message is signed using a UKEY to generate a signed transaction request message;

[0051] The signed transaction request message is encrypted using a UKEY to generate an encrypted transaction request message.

[0052] Assign corresponding UKEY access permissions to each bank's direct bank-enterprise connection program, send encrypted transaction request messages to the bank's direct bank-enterprise connection program corresponding to the transaction request, and receive response messages.

[0053] Embodiments of the present invention also provide a computer-readable storage medium capable of implementing all steps of the bank-enterprise direct connection method based on embedded multi-bank fund management in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the bank-enterprise direct connection method based on embedded multi-bank fund management in the above embodiments.

[0054] Embodiments of the present invention also provide an electronic device for performing the above-described method. As an implementation device for the method, the electronic device includes at least a processor and a memory. In particular, the memory stores data and related computer programs required for performing the method. The processor calls the data and programs in the memory to execute all the steps of the method and obtain the corresponding technical effect.

[0055] Preferably, the electronic device may include a bus architecture, which may include any number of interconnected buses and bridges. The bus will include various circuits linked together by one or more processors and memories. The bus may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter may be the same element, i.e., a transceiver, providing a unit for communicating with various other systems over a transmission medium. The processor is responsible for managing the bus and general processing, while the memory may be used to store data used by the processor during operation.

[0056] Additionally, the electronic device may further include components such as a communication module, an input unit, an audio processor, a display, and a power supply. The processor (or controller, operating control) used may include a microprocessor or other processor device and / or logic device, which receives input and controls the operation of various components of the electronic device; the memory may be one or more of a buffer, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices, which can store the aforementioned data information, and may also store programs for executing the information, and the processor can execute the program stored in the memory to achieve information storage or processing, etc.; the input unit is used to provide input to the processor, for example, it can be a button or touch input device; the power supply is used to provide power to the electronic device; the display is used to display images and text, for example, it can be an LCD display. The communication module is a transmitter / receiver that transmits and receives signals via an antenna. The communication module (transmitter / receiver) is coupled to the processor to provide input signals and receive output signals, which can be the same as in conventional mobile communication terminals. Based on different communication technologies, multiple communication modules can be incorporated into the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module (transmitter / receiver) is also coupled to a speaker and microphone via an audio processor to provide audio output through the speaker and receive audio input from the microphone, thereby enabling typical telecommunications functions. The audio processor can include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor is coupled to a central processing unit, enabling on-device recording via the microphone and on-device playback of stored sound via the speaker.

[0057] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0058] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0059] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0060] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the functions specified in one or more boxes. Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0061] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A bank-enterprise direct connection system based on embedded multi-bank fund management, characterized in that, The application relates to a bank-enterprise direct connection system and a method thereof. The embedded module is a lightweight customized module running at a privilege level of RING1, RING2 or RING3, and comprises at least one sub-embedded module, and bank-enterprise direct connection programs which do not conflict with each other are installed into the same sub-embedded module. The acquisition module is used for acquiring a transaction request. The analysis module is used for analyzing a transaction request message of the transaction request. The scheduling module running at a privilege level of RING0 is used for allocating a sub-embedded module where a bank-enterprise direct connection program corresponding to the transaction request is located on demand, and starting the bank-enterprise direct connection program corresponding to the transaction request. The signature module is used for signing the transaction request message by using a UKEY to generate a signed transaction request message. The encryption module is used for encrypting the signed transaction request message by using the UKEY to generate an encrypted transaction request message. The communication agent module is used for allocating corresponding UKEY access permissions for the bank-enterprise direct connection programs, sending the encrypted transaction request message to the bank-enterprise direct connection program corresponding to the transaction request, and receiving a response message.

2. The system of claim 1, wherein, The communication agent module is also used for configuring parameters of a login username, a password and a service port.

3. A bank-enterprise direct connection method based on embedded multi-bank fund management, characterized in that, The method comprises the following steps. The embedded module is a lightweight customized module running at a privilege level of RING1, RING2 or RING3, and comprises at least one sub-embedded module, and bank-enterprise direct connection programs which do not conflict with each other are installed into the same sub-embedded module. The acquisition module is used for acquiring a transaction request. The scheduling module running at a privilege level of RING0 is used for allocating a sub-embedded module where a bank-enterprise direct connection program corresponding to the transaction request is located on demand, and starting the bank-enterprise direct connection program corresponding to the transaction request. The signature module is used for signing the transaction request message by using a UKEY to generate a signed transaction request message. The encryption module is used for encrypting the signed transaction request message by using the UKEY to generate an encrypted transaction request message. The communication agent module is used for allocating corresponding UKEY access permissions for the bank-enterprise direct connection programs, sending the encrypted transaction request message to the bank-enterprise direct connection program corresponding to the transaction request, and receiving a response message. The scheduling module running at a privilege level of RING0 is used for allocating a sub-embedded module where a bank-enterprise direct connection program corresponding to the transaction request is located on demand, and starting the bank-enterprise direct connection program corresponding to the transaction request.

4. A computer-readable storage medium, characterized in that, The storage medium has a computer program stored thereon, and the computer program is executed by the processor to realize the method of claim 3.

5. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the method of claim 3.

Images