A financial data security management system, device and method

Abstract

The present invention discloses a financial data security management system, device and method thereof, which ensure the uniqueness of a transaction terminal by setting a PUF chip in the transaction terminal, determine the unique identity of the transaction terminal according to the matching of a challenge value and a response value, and realize the legality authentication of the transaction terminal. Furthermore, after the transaction terminal is verified to be legal, the transaction terminal and the client obtain first verification information and second verification information respectively, and perform dual identity authentication of the ward and the guardian, finally realizing triple authentication through the transaction terminal, the ward and the guardian, and ensuring the security of financial payment.

Description

Technical Field

[0001] The present application belongs to the technical field of data security management, and in particular, relates to a financial data security management system, device and method thereof. Background Art

[0002] Financial data is related to people's private property, and its security is very important. However, in the current transaction transfer process, users are generally only required to provide a password. The user can pass the user verification by ensuring that the payment card number and password provided by the user are consistent with the card number and password saved on the server. However, this method cannot effectively guarantee the security of people with limited behavioral capacity who do not have the ability to judge. For example, minors or the elderly are easily misled by telecommunications fraud and hastily pay money to illegal organizations. At this time, if the parents of children or the children of the elderly review and confirm this type of financial transaction data, the success rate of timely stop loss will increase. Summary of the invention

[0003] In order to solve the above technical problems, the present disclosure provides a financial data security management system, device and method thereof.

[0004] In a first aspect, the present disclosure provides a financial data security management system, which includes: a transaction terminal, a server and a client, wherein the transaction terminal is provided with a PUF chip, wherein the transaction terminal is used to submit a payment application to the server, the payment application including a transaction terminal ID and a payment card number; the server is used to randomly select a challenge value based on the transaction terminal ID and send it to the transaction terminal; the transaction terminal is also used to calculate a response value based on the challenge value and send the response value to the server; the server is also used to verify the legitimacy of the transaction terminal based on the response value; the transaction terminal is also used to send first verification information for payment verification of a submitted financial payment order to the server based on the payment card number after being verified to be legitimate; the server is also used to send a payment confirmation request to the client corresponding to the guardian account of the payment card number after the first verification information is verified; the client is used to return the second verification information to the server after obtaining the second verification information in response to the payment confirmation request; the server is also used to verify the second verification information, and if the verification is successful, perform a payment operation on the payment card number according to the financial payment order submitted by the transaction terminal.

[0005] In one embodiment, the server is specifically used to verify the first verification information. If the verification is successful, the guardian account configured for the payment card number is searched, and a payment confirmation request is sent to the client corresponding to the determined guardian account. The matching relationship between the payment card number and the guardian account is pre-stored in the server's database.

[0006] In one embodiment, the first verification information includes first biometric information; the transaction terminal is used to collect the first biometric information in the first verification information; the second verification information includes second biometric information, and the client is used to collect the second biometric information in the second verification information; the server pre-stores a first biometric information database and a second biometric information database.

[0007] In one embodiment, the server is also used to verify the payment card number submitted by the transaction terminal. If the verification is successful, it triggers the transaction terminal to send first verification information to the server based on the payment card number after being verified to be legal, which is used to verify the payment of the submitted financial payment order.

[0008] In one embodiment, a paired dataset of challenge value and response value corresponding to any transaction terminal is pre-stored in the database of the server, and the legitimacy of the transaction terminal is verified based on the paired dataset of challenge value and response value.

[0009] In one embodiment, the server is used to generate a hash function and send the hash function to the transaction terminal; the transaction terminal is also used to use the payment card number, the response value calculated based on the challenge value, and the random value randomly generated by itself as inputs to the hash function to generate a first hash result, and send the first hash result and the random value to the server; the server is used to find the corresponding payment card number according to the first verification information, and find the corresponding response value according to the transaction terminal ID and the challenge value previously sent to the transaction terminal, use the payment card number, the response value, and the random value sent by the transaction terminal as inputs to the hash function to generate a second hash result, and match the first hash result with the second hash result.

[0010] In one embodiment, the client is used to save the payment card number of the guardian associated with it; the server is used to generate a hash function and send the hash function to the transaction terminal and each of the clients; the server is also used to randomly select a challenge value and a corresponding response value from the corresponding pairing data set according to the transaction terminal ID, and send the challenge value to the transaction terminal, and send the corresponding response value and the transaction terminal ID to the client corresponding to the guardian account of the current payment card number; the transaction terminal is used to use the payment card number, the response value and the random value randomly generated by itself as inputs to the hash function to generate a third hash result, and send the third hash result and the random value to the server; the client is used to use the payment card number of the guardian saved by itself, the response value given by the server and the random value sent by the transaction terminal as inputs to the hash function to generate a fourth hash result, and match the third hash result with the fourth hash result.

[0011] In one embodiment, the server is further configured to determine the IP address of the client based on the guardian account, and send the IP address to the transaction terminal.

[0012] In a second aspect, the present disclosure provides a financial data security management device, which includes: a receiving module, which is used to receive a payment application submitted by a transaction terminal, the payment application including a transaction terminal ID and a payment card number; a processing module, which is used to randomly select a challenge value based on the transaction terminal ID and send it to the transaction terminal; the receiving module is also used to receive a response value calculated based on the challenge value and sent by the transaction terminal; the processing module is also used to verify the legitimacy of the transaction terminal based on the response value; the receiving module is also used to receive first verification information sent by the transaction terminal based on the payment card number after the transaction terminal is verified to be legal, for performing payment verification on the submitted financial payment order; the processing module is also used to send a payment confirmation request to the client corresponding to the guardian account of the payment card number after the first verification information is verified; the receiving module is also used to receive the second verification information returned by the client after the client obtains the second verification information in response to the payment confirmation request; the processing module is also used to verify the second verification information, and if the verification is successful, perform a payment operation on the payment card number according to the financial payment order submitted by the transaction terminal.

[0013] In a third aspect, the present disclosure provides a financial data security management method, which method includes: a transaction terminal submits a payment application to a server, the payment application includes a transaction terminal ID and a payment card number; the server randomly selects a challenge value based on the transaction terminal ID, and sends it to the transaction terminal; the transaction terminal calculates a response value based on the challenge value, and sends the response value to the server; the server verifies the legitimacy of the transaction terminal based on the response value; after the transaction terminal is verified to be legal, the transaction terminal sends first verification information for payment verification of the submitted financial payment order to the server based on the payment card number; after the server verifies the first verification information, the server sends a payment confirmation request to the client corresponding to the guardian account of the payment card number; after the client obtains the second verification information in response to the payment confirmation request, the client returns the second verification information to the server; the server verifies the second verification information, and if the verification passes, performs a payment operation on the payment card number according to the financial payment order submitted by the transaction terminal.

[0014] Compared with the prior art, the technical solution provided by the present invention has the following advantages:

[0015] The present invention discloses a financial data security management system, device and method, which ensure the uniqueness of a transaction terminal by setting a PUF chip in the transaction terminal, and determine the unique identity of the transaction terminal according to the matching of a challenge value and a response value, thereby realizing the legitimacy authentication of the transaction terminal, and after the transaction terminal is verified to be legitimate, respectively obtains first verification information and second verification information through the transaction terminal and the client, thereby performing dual identity authentication of the ward and the guardian, and finally realizing triple authentication through the transaction terminal, the ward and the guardian, thereby ensuring the security of financial payment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0017] In order to more clearly illustrate the technical solutions in the present disclosure or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 A schematic diagram of the structure of a financial data security management system provided in an embodiment of the present application;

[0019] Figure 2 A flowchart of a financial data security management method provided in an embodiment of the present application;

[0020] Figure 3 A flowchart of another financial data security management method provided in an embodiment of the present application;

[0021] Figure 4 A schematic diagram of the structure of a financial data security management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In the description of the present application, the terms "first", "second", etc. are only used to distinguish the description and do not indicate the order of arrangement, nor can they be understood as indicating or implying relative importance.

[0023] In the description of the present application, the terms "include", "comprising", etc. indicate the existence of the described features, integers, steps, operations, elements and / or components, but do not exclude the existence or addition of one or more other features, steps, operations, elements, components and / or collections thereof.

[0024] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0025] At present, when people make financial payments, they basically need to verify the user's identity. The result of identity verification is used to decide whether to respond to the current user's transaction operation, thereby protecting the user's property safety. In the prior art, identity verification during the payment process is generally limited to the user providing the registered payment card number information and the corresponding password. In most payment information verification processes, as long as the payment card number and password submitted by the user are consistent with the account number and password saved on the server, the verification is passed. This single verification method leaves an opportunity for telecommunications fraud, especially for minors or the elderly who do not have the ability to judge, who are very likely to be misled by telecommunications fraud and hastily pay money to illegal organizations.

[0026] In order to improve the security of financial payments, the present application embodiment provides a financial data security management system. Figure 1 , which is a schematic diagram of the structure of a financial data security management system 100 shown in an embodiment of the present application. The financial data security management system 100 includes a server 110, a transaction terminal 120 and a client 130. The financial data security management system 100 can be a computing system composed of multiple computers, etc. The financial data security management system 100 can also include Figure 1 More or fewer components as shown, or with Figure 1 For example, the financial data security management system 100 also includes input and output devices for human-computer interaction.

[0027] The server 110 is connected to multiple transaction terminals 120 and the client 130 for receiving, storing and processing payment applications sent by the transaction terminals 120. The server 110 may be an independently-installed mobile phone, a laptop computer, a desktop computer, or a computing system composed of multiple computers.

[0028] A PUF (physically unclonable functions) chip is welded in the transaction terminal 120 to prevent the transaction terminal from being illegally replaced and ensure the security of card swiping. PUF (physically unclonable functions) is a hardware security technology that uses inherent device variations to generate a unique device response value that cannot be cloned for a given challenge value.

[0029] Due to imperfections in silicon processing technology, every chip produced is physically different. These process variations manifest themselves as different path delays, transistor threshold voltages, voltage gains, and countless other ways between different integrated circuits. PUF can take advantage of this inherent difference in chips to generate a unique encryption key for each chip.

[0030] The client 130 can be correspondingly set in a mobile smart device with network function, such as a tablet computer, a mobile phone, an e-reader, a remote control, a car-mounted device, a wearable device, etc., and the user can communicate with the server 110 through the client 130.

[0031] Please refer to Figure 2 , which is a flow chart of a financial data security management method according to an embodiment of the present application, the financial data security management method comprises the following steps S210-S240, which are described above Figure 1 The financial data security management system 100 shown is executed and used to ensure the security of financial payments.

[0032] Step S210: The transaction terminal submits a payment application to the server, where the payment application includes the transaction terminal ID and the payment card number;

[0033] A PUF (physically unclonable functions) chip is welded in the transaction terminal 120 to prevent the transaction terminal from being illegally replaced and ensure the security of card swiping.

[0034] Step S220: the server randomly selects a challenge value based on the transaction terminal ID and sends it to the transaction terminal;

[0035] The server 110 may be an independently-installed mobile phone, a laptop computer, a desktop computer, or a computing system composed of multiple computers.

[0036] In a specific embodiment, the server 110 pre-stores a pairing data set of challenge values ​​and response values ​​corresponding to any transaction terminal 120. For example, the server 110 pre-stores an association table about the transaction terminal 120: "Transaction terminal ID - pairing data set of challenge value and response value", the pairing data set of challenge value and response value comes from the pre-collection of each transaction terminal 120 by the server 110, and the "transaction terminal ID - pairing data set of challenge value and response value" is maintained by the database of the server 110.

[0037] Step S230: the transaction terminal calculates a response value based on the challenge value, and sends the response value to the server;

[0038] After receiving the challenge value sent by the server 110, the transaction terminal 120 sends it to the internal PUF chip. After the PUF chip calculates the response value, the transaction terminal 120 sends the response value to the server 110. Due to the physical unclonability of the PUF chip, the response value calculated by the PUF chip of the server 110 is unique.

[0039] Step S240: the server verifies the legitimacy of the transaction terminal based on the response value;

[0040] After receiving the response value sent by the transaction terminal 120, the server 110 determines whether the response value is consistent with the corresponding response value in the pre-stored paired data set. If they are consistent, the legitimacy of the transaction terminal 120 is passed; if they are inconsistent, the legitimacy of the transaction terminal 120 is not passed.

[0041] In a specific embodiment, when the legitimacy of the transaction terminal 120 is not passed, the server 110 initiates the termination of the payment process. Furthermore, the server 110 may also initiate an illegal payment reminder to the user corresponding to the current payment card number.

[0042] Through the above steps S210 to S240, the legitimacy verification of the transaction terminal 120 is completed, thereby improving the security of the user's financial payment.

[0043] Please continue to refer to Figure 3 , which is a flow chart of a financial data security management method according to an embodiment of the present application, the financial data security management method comprises the following steps S210-S280, which are described above Figure 1 The financial data security management system 100 shown is executed and used to ensure the security of financial payments.

[0044] In this embodiment, in order to ensure the financial payment security of persons with limited capacity for conduct (such as minors, the elderly, etc.), the guardian's (such as the parents of minors, the children of the elderly, etc.) account is associated for them. By adding the guardian's account, the financial payment behavior of the ward is reviewed and confirmed, which greatly avoids the probability of the ward being defrauded by financial fraud and improves the security of the ward's financial payment. Specifically, it includes:

[0045] Step S250: after being verified as legitimate, the transaction terminal sends first verification information for verifying the submitted financial payment order to the server based on the payment card number;

[0046] The first verification information includes the first biometric feature information, and the transaction terminal 120 supports reading of biometric features. For example, the transaction terminal 120 may be configured with a face recognition module, a fingerprint recognition module, or a voice recognition module.

[0047] Step S260: after verifying the first verification information, the server sends a payment confirmation request to the client corresponding to the guardian account of the payment card number;

[0048] In a specific embodiment, a database is pre-established in the server 110 that includes the first biometric information of the guardian (for example, under 14 years old, over 60 years old, or other people who need attention), payment card number, guardian's second biometric information, guardian account number and other information and their associated relationships.

[0049] In another specific embodiment, the server 110 may also regularly update the first biometric information of the guardian, the payment card number, the second biometric information of the guardian, the guardian account number and other information in the database.

[0050] Further, the server 110 verifies the first verification information based on the association between the payment card number and the first biometric information of the guardian stored in the database. If the verification is successful, the server 110 searches the database for the guardian account configured for the payment card number and sends a payment confirmation request to the client corresponding to the determined guardian account; if the verification fails, the payment process is terminated.

[0051] Furthermore, in this embodiment, each ward can be associated with one or more guardians, and this embodiment does not impose any limitation on this.

[0052] Step S270: After the client obtains the second verification information in response to the payment confirmation request, the client returns the second verification information to the server;

[0053] The second verification information includes second biometric information, and the client 130 also supports reading of biometric information. For example, the client 130 may be configured with a face recognition module, a fingerprint recognition module, or a voice recognition module.

[0054] In a specific embodiment, the first biometric feature information and the second biometric feature information are extracted through a biometric feature extraction network model built into the server.

[0055] Specifically, the server 110 may also periodically update the biometric feature extraction network model (eg, a face feature extraction model, a fingerprint feature extraction model, etc.), and send the updated biometric feature extraction network model to all transaction terminals 120 and clients 130 .

[0056] Furthermore, the response of the client 130 to the payment confirmation request includes "agree" or "disagree". If the guardian confirms "agree", the payment process is passed; if the guardian confirms "disagree", the payment process is terminated.

[0057] Step S280: the server verifies the second verification information. If the verification is successful, the server performs a payment operation on the payment card number according to the financial payment order submitted by the transaction terminal.

[0058] The server 110 verifies the second verification information based on the association between the payment card number and the guardian's second biometric information stored in the database. If the verification is successful, the server 110 performs a payment operation on the payment card number according to the financial payment order submitted by the transaction terminal 120; if the verification fails, the payment process is terminated.

[0059] In another specific embodiment of the present application, the server 110 is also used to verify the payment card number submitted by the transaction terminal 120. If the verification is successful, it triggers the transaction terminal 120 to send first verification information for payment verification of the submitted financial payment order based on the payment card number after being verified to be legal.

[0060] Specifically, a list of guardian's card numbers is pre-stored in the database of server 110, and after receiving the payment application submitted by transaction terminal 120, server 110 compares the payment card number associated with the payment application with the pre-stored list of guardian's card numbers. If the above payment card number falls into the list of guardian's card numbers pre-stored in server 110, it is determined that the current payment application is initiated by the guardian, and step S250 is triggered; if the above payment card number falls into the list of guardian's card numbers pre-stored in server 110, it is determined that the current payment application is not initiated by the guardian, and steps S250-S280 are not triggered.

[0061] In another specific embodiment of the present application, in order to prevent leakage of the payment card number and the response value of the transaction terminal 120, the present embodiment further encrypts the payment card number and the response value of the transaction terminal 120.

[0062] Specifically, the server 110 is further used to generate a hash function and send the hash function to the transaction terminal 120 . The input of the hash function includes: a payment card number, a response value, and a random value.

[0063] The transaction terminal 120 is further configured to use the payment card number, the response value calculated based on the challenge value, and the random value randomly generated by itself as inputs of the hash function to generate a first hash result, and send the first hash result and the random value to the server 110;

[0064] The server is also used to find the corresponding payment card number based on the first verification information, and find the corresponding response value based on the transaction terminal ID and the challenge value previously sent to the transaction terminal 120, and use the payment card number, response value and the random value sent by the transaction terminal 120 as inputs of the hash function to generate a second hash result, and match the first hash result with the second hash result.

[0065] In a specific embodiment, the encryption process may include:

[0066] When the transaction terminal 120 receives the card swipe action, it submits a payment application to the platform, which includes the transaction terminal ID;

[0067] After receiving the payment application from the transaction terminal 120, the server 110 first randomly selects a challenge value from the paired data set of challenge value and response value corresponding to the transaction terminal 120 according to the transaction terminal ID, and sends it to the transaction terminal;

[0068] After receiving the challenge value, the transaction terminal 120 sends it to the internal PUF chip, and calculates the response value through the internal PUF chip;

[0069] The transaction terminal 120 uses the payment card number of the card swiper, the response value calculated by the internal PUF chip, and the random value randomly generated by itself as three inputs of the hash function, and generates a first hash result, and sends the first hash result and the random value to the server 110;

[0070] After receiving the hash result and the random value, the server 110 sends a request for collecting the first biometric information of the card swiper to the transaction terminal 120;

[0071] After receiving the request, the transaction terminal 120 prompts the card user to scan the fingerprint or face by using sound and light. After the collection is completed, the transaction terminal 120 generates the first biometric information of the guardian through the biometric extraction network model and sends the first biometric information to the server 110;

[0072] The server 110 finds the corresponding payment account according to the first biometric information of the card swiper, and finds the corresponding response value according to the transaction terminal ID and the challenge value previously sent to the transaction terminal 120, and uses the payment account of the card swiper, the response value found, and the random value given by the transaction terminal ID as three inputs of the hash function to generate a second hash result. The second hash result is matched and reviewed with the first hash result given by the transaction terminal ID. After confirming that the two results match, the legitimacy review of the transaction terminal ID and the matching review of the guardian and the card number are passed.

[0073] If there is a match, the corresponding guardian account is found according to the first biometric information or payment card number of the card swipeer, and a second biometric extraction request is sent to the client 130 corresponding to the guardian account. After receiving the request, the client 130 corresponding to the guardian account performs the face or fingerprint swiping action, and confirms the agreement or disagreement according to the request. The client 130 generates the second biometric information from the collected face or fingerprint through the biometric extraction network model, and sends the second biometric information and the confirmation result to the server 110. The server 110 performs corresponding actions according to the guardian's confirmation. If the guardian confirms "agree", the payment process is passed. If the guardian confirms "disagree", the payment process is terminated.

[0074] In another specific embodiment of the present application, in order to prevent the server 110 from becoming a performance bottleneck and failure node due to excessive participation due to a large number of card swipes, this embodiment further opens the matching review authority to the client 130 corresponding to the guardian account.

[0075] Specifically, the client 130 is used to store the bank card number of the ward associated therewith.

[0076] The server 110 is further configured to generate a hash function and send the hash function to the transaction terminal 120 and each of the clients. The input of the hash function includes: a payment card number, a response value, and a random value.

[0077] The server is further used to randomly select a challenge value and a corresponding response value from the corresponding paired data set according to the transaction terminal ID, and send the challenge value to the transaction terminal, and send the corresponding response value and the transaction terminal ID to the client corresponding to the guardian account of the current payment card number;

[0078] The transaction terminal is further used to use the payment card number, the response value, and the random value randomly generated by itself as inputs of the hash function to generate a third hash result, and send the third hash result and the random value to the server;

[0079] The client is also used to use the payment card number of the guardian stored in itself, the response value given by the server and the random value sent by the transaction terminal as inputs of the hash function to generate a fourth hash result, and match the third hash result with the fourth hash result.

[0080] In a specific embodiment, the matching review process may include, for example:

[0081] When the transaction terminal 120 detects a card swiping behavior, it uses sound and light to prompt the card swiper to swipe the fingerprint or face to collect the first biometric information. After the collection is completed, the transaction terminal 120 generates the first biometric information of the card swiper through the biometric extraction network model, and submits a payment application to the server 110, which includes the transaction terminal ID and the first biometric information of the card swiper.

[0082] After receiving the payment application from the transaction terminal 120, the server 110 first randomly selects a challenge value and a corresponding response value from the challenge value and response value pairing data set corresponding to the transaction terminal 120 according to the transaction terminal ID. The server 110 then finds the client 130 corresponding to the guardian account according to the first biometric information of the card swiper, and notifies the client 130 to process the payment verification request from the transaction terminal ID.

[0083] Specifically, the above notification to the client 130 to process the payment verification request from the transaction terminal ID includes: finding the IP address of the mobile phone where the current client is located according to the guardian account, the server 110 sends the challenge value and the client's IP address to the transaction terminal 120, and at the same time sends the corresponding response value and transaction terminal ID to the client of the corresponding guardian account.

[0084] Further, after receiving the challenge value, the transaction terminal 120 sends it to the internal PUF chip, and calculates the response value of the feedback response through the internal PUF chip. After calculating the response value, the transaction terminal 120 uses the payment card number of the card swiper, the calculated response value, and the random value randomly generated by itself as three inputs of the hash function, and generates a third hash result, and sends the third hash result and the random value to the client of the corresponding IP address.

[0085] After receiving the information from the transaction terminal 120, the client uses the payment card number of the guardian stored in the client, the response value given by the server 110, and the random value given by the transaction terminal 120 as three inputs of the hash function to generate a fourth hash result. The fourth hash result is matched and reviewed with the third hash result given by the transaction terminal. After confirming that the two results match, the legitimacy review of the transaction terminal 120 and the matching review of the guardian and the payment card number are passed.

[0086] If a match is found, a second biometric feature extraction request is sent to the client 130 corresponding to the guardian account. After receiving the request, the client 130 corresponding to the guardian account performs a face or fingerprint scan action, and confirms whether to agree or disagree according to the request. The client 130 generates second biometric feature information from the collected face or fingerprint through the biometric feature extraction network model, and sends the second biometric feature information and the confirmation result to the server 110. The server 110 performs corresponding actions according to the guardian's confirmation. If the guardian confirms "agree", the payment process is passed. If the guardian confirms "disagree", the payment process is terminated.

[0087] Please refer to Figure 4 The present application also provides a financial data security management system device, Figure 4 This is a structural diagram of a financial data security management system device shown in an embodiment of the present application, and the financial data security management system device includes a receiving module 310 and a processing module 320. The receiving module 310 is used to receive a payment application submitted by a transaction terminal 120, wherein the payment application includes a transaction terminal ID and a payment card number; the processing module 320 is used to randomly select a challenge value based on the transaction terminal ID and send it to the transaction terminal 120; the receiving module 310 is also used to receive a response value calculated based on the challenge value and sent by the transaction terminal 120; the processing module 320 is also used to verify the legitimacy of the transaction terminal 120 based on the response value; the receiving module 310 is also used to receive a response value sent by the transaction terminal 120 based on the payment card number after the transaction terminal 120 is verified to be legitimate. The first verification information sent is used to verify the payment of the submitted financial payment order; the processing module 320 is also used to send a payment confirmation request to the client 130 corresponding to the guardian account of the payment card number after the first verification information is verified; the receiving module 310 is also used to receive the second verification information returned by the client 130 after the client 130 obtains the second verification information in response to the payment confirmation request; the processing module 320 is also used to verify the second verification information, and if the verification is successful, the payment operation is performed on the payment card number according to the financial payment order submitted by the transaction terminal 120.

[0088] Through the above-mentioned financial data security management system device, the legality of the transaction terminal 120 is reviewed and the guardian's payment behavior is verified twice, which effectively improves the security of financial payment.

[0089] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0090] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0091] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0092] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM) random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0093] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0094] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A financial data security management system, characterized by: It includes a transaction terminal, a server and a client, wherein the transaction terminal is provided with a PUF chip, wherein: The transaction terminal is used to submit a payment application to the server, wherein the payment application includes a transaction terminal ID and a payment card number; The server is used to randomly select a challenge value based on the transaction terminal ID and send it to the transaction terminal; The transaction terminal is further used to calculate a response value based on the challenge value and send the response value to the server; The server is further used to verify the legitimacy of the transaction terminal based on the response value; The transaction terminal is further used to send first verification information for performing payment verification on the submitted financial payment order to the server based on the payment card number after being verified to be legitimate; The server is further configured to send a payment confirmation request to a client corresponding to the guardian account of the payment card number after the first verification information is verified; The client is configured to return the second verification information to the server after obtaining the second verification information in response to the payment confirmation request; The server is further configured to verify the second verification information, and if the verification is successful, perform a payment operation on the payment card number according to the financial payment order submitted by the transaction terminal; The server has a database pre-stored with a paired dataset of challenge values ​​and response values ​​corresponding to any transaction terminal, and verifies the legitimacy of the transaction terminal based on the paired dataset of challenge values ​​and response values; The server is used to generate a hash function and send the hash function to the transaction terminal; The transaction terminal is further configured to use the payment card number, the response value calculated based on the challenge value, and the random value randomly generated by itself as inputs of a hash function to generate a first hash result, and send the first hash result and the random value to a server; The server is used to find the corresponding payment card number according to the first verification information, find the corresponding response value according to the transaction terminal ID and the challenge value previously sent to the transaction terminal, use the payment card number, the response value and the random value sent by the transaction terminal as inputs of the hash function, generate a second hash result, and match the first hash result with the second hash result; or, The client is used to store the payment card number of the guardian associated with it; The server is used to generate a hash function and send the hash function to the transaction terminal and each of the clients; The server is further configured to determine the IP address of the client based on the guardian account of the payment card number; The server is further configured to randomly select a challenge value and a corresponding response value from the corresponding paired data set according to the transaction terminal ID, and send the challenge value and the IP address of the client to the transaction terminal, and send the corresponding response value and the transaction terminal ID to the client corresponding to the guardian account of the current payment card number; The transaction terminal is used to use the payment card number, the response value and the random value randomly generated by itself as inputs of the hash function to generate a third hash result, and send the third hash result and the random value to the client of the corresponding IP address; The client is used to use the payment card number of the guardian stored in the client, the response value given by the server and the random value sent by the transaction terminal as inputs of the hash function to generate a fourth hash result, and match the third hash result with the fourth hash result.

2. The financial data security management system according to claim 1, characterized in that: The server is specifically used to verify the first verification information. If the verification is successful, it searches for the guardian account configured for the payment card number and sends a payment confirmation request to the client corresponding to the guardian account determined by the search. The matching relationship between the payment card number and the guardian account is pre-stored in the database of the server.

3. The financial data security management system according to claim 1, characterized in that: The first verification information includes first biometric information; the transaction terminal is used to collect the first biometric information in the first verification information; The second verification information includes second biometric information, and the client is used to collect the second biometric information in the second verification information; The server pre-stores the first biometric information database and the second biometric information database.

4. The financial data security management system according to claim 1, characterized in that: The server is also used to verify the payment card number submitted by the transaction terminal. If the verification is successful, it triggers the transaction terminal to send first verification information to the server based on the payment card number for payment verification of the submitted financial payment order after being verified to be legal.

5. A financial data security management device, characterized in that: include: A receiving module, used to receive a payment application submitted by a transaction terminal, wherein the payment application includes a transaction terminal ID and a payment card number; A processing module, used for randomly selecting a challenge value based on the transaction terminal ID and sending it to the transaction terminal; The receiving module is also used to receive a response value calculated based on the challenge value and sent by the transaction terminal; The processing module is further used to verify the legitimacy of the transaction terminal based on the response value; The receiving module is further used to receive first verification information sent by the transaction terminal based on the payment card number after the transaction terminal is verified to be legitimate, and is used to perform payment verification on the submitted financial payment order; The processing module is further configured to send a payment confirmation request to a client corresponding to the guardian account of the payment card number after the first verification information is verified; The receiving module is further used to receive the second verification information returned by the client after the client obtains the second verification information in response to the payment confirmation request; The processing module is further used to verify the second verification information, and if the verification is successful, perform a payment operation on the payment card number according to the financial payment order submitted by the transaction terminal; Also included is a database, in which a paired data set of challenge value and response value corresponding to any transaction terminal is pre-stored, and the legitimacy of the transaction terminal is verified based on the paired data set of challenge value and response value; A processing module, configured to generate a hash function and send the hash function to the transaction terminal; The receiving module is further used to receive the payment card number, the response value calculated based on the challenge value, and the random value randomly generated by the transaction terminal as inputs of the hash function to generate a first hash result and a random value; a processing module, configured to find a corresponding payment card number according to the first verification information, find a corresponding response value according to the transaction terminal ID and a challenge value previously sent to the transaction terminal, use the payment card number, the response value and a random value sent by the transaction terminal as inputs of a hash function, generate a second hash result, and match the first hash result with the second hash result; or, A receiving module, used for receiving the payment card number of the guardian associated with the client and stored by the client; A processing module, configured to generate a hash function and send the hash function to the transaction terminal and each of the clients; A processing module, configured to determine the IP address of the client based on the guardian account of the payment card number; The processing module is further used to randomly select a challenge value and a corresponding response value from the corresponding paired data set according to the transaction terminal ID, and send the challenge value and the IP address of the client to the transaction terminal, and send the corresponding response value and the transaction terminal ID to the client corresponding to the guardian account of the current payment card number; The receiving module is used to receive the payment card number, response value and random value randomly generated by the transaction terminal as inputs of the hash function to generate a third hash result, and send the third hash result and the random value to the client with the corresponding IP address. The client then uses the payment card number of the guardian stored in itself, the response value given by the server and the random value sent by the transaction terminal as inputs of the hash function to generate a fourth hash result, and matches the third hash result with the fourth hash result to obtain a matching result.

6. A financial data security management method, characterized in that: include: The transaction terminal submits a payment application to the server, wherein the payment application includes the transaction terminal ID and the payment card number; The server randomly selects a challenge value based on the transaction terminal ID and sends it to the transaction terminal; The transaction terminal calculates a response value based on the challenge value and sends the response value to the server; The server verifies the legitimacy of the transaction terminal based on the response value; After being verified as legitimate, the transaction terminal sends first verification information for verifying the submitted financial payment order to the server based on the payment card number; After the server verifies the first verification information, it sends a payment confirmation request to the client corresponding to the guardian account of the payment card number; After the client obtains the second verification information in response to the payment confirmation request, the client returns the second verification information to the server; The server verifies the second verification information, and if the verification is successful, performs a payment operation on the payment card number according to the financial payment order submitted by the transaction terminal; The server has a database pre-stored with a paired dataset of challenge values ​​and response values ​​corresponding to any transaction terminal, and verifies the legitimacy of the transaction terminal based on the paired dataset of challenge values ​​and response values; The server generates a hash function and sends the hash function to the transaction terminal; The transaction terminal uses the payment card number, the response value calculated based on the challenge value, and the random value randomly generated by itself as inputs of the hash function to generate a first hash result, and sends the first hash result and the random value to the server; The server finds the corresponding payment card number according to the first verification information, finds the corresponding response value according to the transaction terminal ID and the challenge value previously sent to the transaction terminal, uses the payment card number, the response value and the random value sent by the transaction terminal as inputs of the hash function, generates a second hash result, and matches the first hash result with the second hash result; or, The client saves the payment card number of the ward associated with it; The server generates a hash function and sends the hash function to the transaction terminal and each of the clients; The server determines the IP address of the client based on the guardian account of the payment card number; The server randomly selects a challenge value and a corresponding response value from the corresponding paired data set according to the transaction terminal ID, and sends the challenge value and the IP address of the client to the transaction terminal, and sends the corresponding response value and the transaction terminal ID to the client corresponding to the guardian account of the current payment card number; The transaction terminal uses the payment card number, the response value, and a random value randomly generated by itself as inputs of the hash function to generate a third hash result, and sends the third hash result and the random value to the client at the corresponding IP address; The client uses the payment card number of the guardian stored in itself, the response value given by the server, and the random value sent by the transaction terminal as inputs of the hash function to generate a fourth hash result, and matches the third hash result with the fourth hash result.

Images