Online transaction security management and control method and system

Abstract

The invention discloses an online transaction security management and control method and system, which comprises the following steps: through configured address information, access gateway information and channel information, and binding an address and a transaction, judging whether access is allowed or not according to the address information, the channel information and a transaction code after the online transaction is entered, and automatically refreshing to a cache after all configuration information is completed. Therefore, dynamic modification can be realized during online transaction operation, so that configuration takes effect in real time, dynamic management and control on an access address, a source channel corresponding to the address, the source channel and detailed transaction under the channel are realized, the security management and control strength is improved, the transaction risk is reduced, and secure and stable operation of transaction intermediate business is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the field of electronic financial technology, and in particular relates to an online transaction security management and control method and system. Background Art

[0002] Online transactions are an extension of traditional counter business, which can make transactions no longer restricted by business locations and business hours, and provide people with the financial services they need at any time. With the continuous enrichment of the types of intermediary business products in the banking industry, the number of innovative intermediary business products combined with different application scenarios continues to increase. At the same time, online transactions also face many security risks, such as: Judgment of transaction objects: The traditional judgment method is to judge by obtaining the address blacklist obtained by obtaining the information in the transaction. The blacklist extracted from this transaction information is weakly controlled, and its control strength does not meet the current online transaction standards. If these risks are not avoided in time, it will greatly infringe on the interests of banks and their customers and cause unnecessary economic losses. In addition, in order to ensure the safe and stable operation of intermediary businesses, various banks have different requirements for the security control of online transactions. Based on this, a set of high-standard security control technologies suitable for online transactions is needed. Summary of the invention

[0003] In view of the above-mentioned deficiencies in the prior art, the present application provides an online transaction security management method and system.

[0004] In a first aspect, the present application proposes an online transaction security management and control method, including an online transaction configuration step and an online transaction execution step; The online transaction configuration step includes: Obtain a transaction data table required for online transactions, configure a local address according to the transaction data table, the local address includes an address binding channel and an IP blacklist and whitelist, configure an access gateway according to the transaction data table, bind an online transaction corresponding to the local address according to the access gateway, configure a channel according to the transaction data table and bind the online transaction; The online transaction execution steps include: Step 1: Check whether the address source verification is enabled for online transactions. If the address source verification is not enabled, go directly to step 2. If the address source verification is enabled, obtain the source original IP of the online transaction, and perform blacklist and whitelist verification based on the source original IP. If the verification fails, directly return a transaction failure message. If the verification passes, go to step 2. Step 2: Perform channel source verification for online transactions, check whether the channel source verification is enabled for online transactions, if not, directly proceed to step 3, if enabled, obtain the online transaction channel, and make a judgment based on the configuration in the transaction data table, if the source channel of the online transaction exists in the transaction data table, proceed to step 3, otherwise directly return a transaction failure message; Step 3: Perform transaction access verification for online transactions, check whether the transaction access verification is enabled for online transactions, if not, directly proceed to step 4, if enabled, obtain the transaction code for online transactions, and make a judgment based on the configuration in the transaction data table, if the transaction code for online transactions exists in the transaction data table, proceed to step 4, otherwise, directly return a transaction failure message; Step 4: Perform channel matching verification for online transactions, check whether the channel matching verification is enabled for online transactions, if not, directly proceed to step 5, if enabled, obtain the online transaction channel and transaction code, and make a judgment based on the configuration in the transaction data table. The source channel and transaction code association relationship of the online transaction must exist in the transaction data table, if it does, proceed to step 5, if not, directly return a transaction failure message; Step 5: Call the real online transaction to perform actual transaction business processing and return a transaction success message. At the same time, the business processing results are recorded in the online transaction log for monitoring.

[0005] In some embodiments, the transaction data table includes an address information table, an address blacklist and whitelist information table, a channel information table, an access gateway address transaction table, a channel transaction table, an access gateway service information table, and an access gateway address table; The access gateway service information table is used to configure the access gateway service information, and the access gateway address table is used to configure the access gateway binding address information; The address information table and the address black and white list information table are used to perform black and white list verification in conjunction with the address source verification; The channel information table is used to perform source channel verification in conjunction with the channel source verification; The access gateway address transaction table is used to perform transaction code verification in conjunction with the transaction access verification; The channel transaction table is used to verify the association between the source channel and the transaction code in conjunction with the channel matching verification.

[0006] In some embodiments, if the address source verification is turned on, the source original IP of the online transaction is obtained, and the blacklist and whitelist verification is performed according to the source original IP, including: According to the configuration in the address blacklist and whitelist information table, a judgment is made. If blacklist verification is turned on, a blacklist check is performed. If the transaction object of this online transaction hits the blacklist IP in the address blacklist and whitelist information table, it means that the verification has failed. If whitelist verification is turned on, a whitelist check is performed. If the transaction object of this online transaction hits the whitelist IP in the address blacklist and whitelist information table, it means that the verification has passed.

[0007] In some embodiments, step 3 further includes obtaining a channel code and a transaction code according to the protocol configuration and the address information configuration, including: Set up a protocol configuration table and an address information configuration table, receive information about the configuration protocol, protocol listener and processor based on the protocol configuration table, receive information about the address, local address port and protocol for configuring the service provided based on the address information configuration table, and when accessing the gateway, search for the corresponding protocol listener and processor according to the protocol in the address information configuration table to perform service monitoring and receive messages; When entering channel transaction control, the transaction code and channel code of the online transaction are obtained according to the transaction code path and channel code path in the message.

[0008] In some embodiments, step 4 further includes channel verification control rules. When the channel matching verification is turned on, the channel verification control rules are judged. If the control rules are met, the transaction is run normally. If the control rules are not met, a transaction failure message is directly returned. The channel verification control rules include: Determine whether the source channel is allowed to be accessed, wherein, if the channel code does not exist in the channel transaction table, it is not allowed to be accessed and does not comply with the control rules.

[0009] In some embodiments, the channel verification control rule further includes: Determine whether the source channel access time period meets the configured time period. If the opening time of the channel matching check does not meet the configured time period, it does not meet the control rules.

[0010] In some embodiments, the step of simultaneously recording the business processing result in an online transaction log for monitoring includes: The transaction log is scanned according to the warning rules based on business needs. If the warning rules are triggered, a warning message is issued. The warning rules are: transactions at the same address fail more than 10 times within 10 minutes or transactions at the same channel fail more than 5 times within 5 minutes.

[0011] In a second aspect, the present application proposes an online transaction security management and control system, including an online transaction configuration module and an online transaction execution module; The online transaction configuration module is used to execute online transaction configuration steps, and the online transaction configuration steps include: Obtain a transaction data table required for online transactions, configure a local address according to the transaction data table, the local address includes an address binding channel and an IP blacklist and whitelist, configure an access gateway according to the transaction data table, bind an online transaction corresponding to the local address according to the access gateway, configure a channel according to the transaction data table and bind the online transaction; The online transaction execution module is used to execute the online transaction execution steps, and the online transaction execution steps include: Step 1: Check whether the address source verification is enabled for online transactions. If the address source verification is not enabled, go directly to step 2. If the address source verification is enabled, obtain the source original IP of the online transaction, and perform blacklist and whitelist verification based on the source original IP. If the verification fails, directly return a transaction failure message. If the verification passes, go to step 2. Step 2: Perform channel source verification for online transactions, check whether the channel source verification is enabled for online transactions, if not, directly proceed to step 3, if enabled, obtain the online transaction channel, and make a judgment based on the configuration in the transaction data table, if the source channel of the online transaction exists in the transaction data table, proceed to step 3, otherwise directly return a transaction failure message; Step 3: Perform transaction access verification for online transactions, check whether the transaction access verification is enabled for online transactions, if not, directly proceed to step 4, if enabled, obtain the transaction code for online transactions, and make a judgment based on the configuration in the transaction data table, if the transaction code for online transactions exists in the transaction data table, proceed to step 4, otherwise, directly return a transaction failure message; Step 4: Perform channel matching verification for online transactions, check whether the channel matching verification is enabled for online transactions, if not, directly proceed to step 5, if enabled, obtain the online transaction channel and transaction code, and make a judgment based on the configuration in the transaction data table. The source channel and transaction code association relationship of the online transaction must exist in the transaction data table, if it does, proceed to step 5, if not, directly return a transaction failure message; Step 5: Call the real online transaction to perform actual transaction business processing and return a transaction success message. At the same time, the business processing results are recorded in the online transaction log for monitoring.

[0012] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0013] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0014] Beneficial effects of the present invention: By configuring address information (including channels, address blacklist and whitelist information), access gateway information (including bound addresses, bound transactions), channel information (including channel bound transactions), and binding addresses and transactions, online transactions are allowed to enter based on address information, channel information and transaction codes. After all configuration information is completed, it is automatically refreshed to the cache. Therefore, dynamic modifications can be made during the operation of online transactions to make the configuration effective in real time, thereby achieving dynamic control of access addresses, source channels corresponding to addresses, source channels, and detailed transactions under channels, thereby improving the intensity of security control, reducing transaction risks, and ensuring the safe and stable operation of transaction intermediary businesses. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is the overall flow chart of the present invention.

[0016] Figure 2 It is a system principle diagram of the present invention. DETAILED DESCRIPTION

[0017] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein; on the contrary, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0018] In the first aspect, the present application proposes a method for online transaction security management and control, such as Figure 1 As shown, it includes online transaction configuration steps and online transaction execution steps; The online transaction configuration step includes: Obtain a transaction data table required for online transactions, configure a local address according to the transaction data table, the local address includes an address binding channel and an IP blacklist and whitelist, configure an access gateway according to the transaction data table, bind an online transaction corresponding to the local address according to the access gateway, configure a channel according to the transaction data table and bind the online transaction; In some embodiments, the transaction data table includes an address information table, an address blacklist and whitelist information table, a channel information table, an access gateway address transaction table, a channel transaction table, an access gateway service information table, and an access gateway address table; The access gateway service information table is used to configure the access gateway service information, and the access gateway address table is used to configure the access gateway binding address information; The address information table and the address black and white list information table are used to perform black and white list verification in conjunction with the address source verification; The channel information table is used to perform source channel verification in conjunction with the channel source verification; The access gateway address transaction table is used to perform transaction code verification in conjunction with the transaction access verification; The channel transaction table is used to verify the association between the source channel and the transaction code in conjunction with the channel matching verification.

[0019] Among them, address information belongs to basic configuration information (address binding channel, configuration source IP blacklist and whitelist). The subsequent access gateway needs to bind the address so that online transactions can be accessed through the address exposed by the access gateway. The core fields of the address information table and their functional annotations are shown in Table 1: Table 1 Serial number Field English name Field Chinese name 1 id Physical primary key 2 code protocol 3 name Address Name 4 name_ens Address English name 5 addr_type Address Type 6 addr_ip IP address 7 addr_port Address Port 8 addr_desc Address Description 9 msg_comp_id Protocol Handler 10 encrypt_type Encryption Type 11 algorithm Encryption Algorithm 12 model model 13 fill_type Filling method 14 cert_id Certificate 15 record_log_flag Log flag 16 server_status Service Status 17 form_status Whether to enable blacklist and whitelist 18 opponent_channel Channel Code 19 status state The address information table mainly configures the local address (access address) that needs to be exposed externally. The channel data comes from the channel information table data, which is mainly used to access the gateway binding address.

[0020] The core fields and their functional annotations of the address blacklist and whitelist information table are shown in Table 2: Table 2 Serial number Field English name Field Chinese name 1 id Physical primary key 2 addr_name_ens Gateway address English name 3 client_ip Client IP 4 remark illustrate The address black and white list information table mainly configures the address source IP black and white list, and the IP address is manually input and configured. It is mainly used for black and white list verification when online transactions enter the access gateway service.

[0021] The core fields of the access gateway service information table and their functional annotations are shown in Table 3: Table 3 Serial number Field English name Field Chinese name 1 id Physical primary key 2 name_ens English name 3 name_cns Chinese name 4 order_number Sorting 5 git_addr git address 6 org_code Institution Number The access gateway service information table mainly configures the access gateway service information, which is mainly used for subsequent binding addresses and binding transactions. Only after the address and transaction are bound can the external system access the bound transaction through the address. One access gateway corresponds to one physical microservice gateway project.

[0022] The core fields of the access gateway address table and their functional annotations are shown in Table 4: Table 4 Serial number Field English name Field Chinese name 1 id Physical primary key 2 port_name Port Name 3 port_desc Port Description 4 gateway_id Gateway ID 5 addr_id Address ID 6 addr_port Address Port The access gateway address table mainly configures the access gateway binding address information, which is mainly used for the access gateway binding address. Only after the address is bound can the transaction be bound. The running state is that the online transaction accesses the transaction through this address.

[0023] The core fields of the access gateway address transaction table and their functional annotations are shown in Table 5: Table 5 Serial number Field English name Field Chinese name 1 id Physical primary key 2 gateway_port_id Gateway port id 3 tran_code Transaction Code 4 TRAN_CODE_URL Transaction code corresponding URL 5 INTF_INDEX Interface Index 6 INTF_TYPE Interface Type 7 INTF_DESC Interface Description The access gateway address transaction table mainly configures the access gateway binding transaction information. It is mainly used for gateway binding transactions and configuring transaction codes. The transaction code is entered manually. The transaction code is generally agreed with a third party. Only bound transactions can be accessed through the address.

[0024] The core fields of the channel information table and their functional annotations are shown in Table 6: Table 6 Serial number Field English name Field Chinese name 1 ID Physical primary key 2 CHANNEL_ID Channel Code 3 CHANNEL_NAME Channel Name 4 CHANNEL_SWITCH Channel open or closed status 5 ONLINE_BEGIN_TIME Development start time 6 ONLINE_END_TIME Opening end time 7 REMARK Remark The channel information table is mainly used to configure channel information, which is mainly used for address binding channels and binding transactions. When channel control is turned on in the running state, transactions will be controlled according to the configuration. Among them, when the channel switch is turned on, the transaction time range of the channel and whether the accessed transaction has permission in the channel will be checked during online transaction access. If it is not within the access time range, the agreed error will be directly returned. When the channel is opened, the online uploaded channel must exist in the channel management, and the transaction time range must comply with the channel configuration time range.

[0025] The core fields of the channel transaction table and their functional annotations are shown in Table 7: Table 7 Serial number Field English name Field Chinese name 1 ID Physical primary key 2 CHANNEL_ID Channel Code 3 INTF_NAME_ENS Interface Coding 4 INTF_NAME_CNS Interface Name 5 TRAN_CODE Transaction Code 6 TRAN_URL Transaction URL 7 PROJECT_NAME_ENS Project Code 8 PROJECT_NAME_CNS Project Name 9 GATEWAY_NAME_ENS Gateway Encoding 10 GATEWAY_NAME_CNS Gateway Name 11 GATEWAY_PORT port The channel transaction table mainly configures channel transaction information and is mainly used for channel binding transactions. When channel control is enabled in the running state, transactions will be controlled according to this configuration, and only bound transactions can be accessed.

[0026] The online transaction execution steps include: Step 1: Check whether the address source verification is enabled for online transactions. If the address source verification is not enabled, go directly to step 2. If the address source verification is enabled, obtain the source original IP of the online transaction, and perform blacklist and whitelist verification based on the source original IP. If the verification fails, directly return a transaction failure message. If the verification passes, go to step 2. In some embodiments, if the address source verification is turned on, the source original IP of the online transaction is obtained, and the blacklist and whitelist verification is performed according to the source original IP, including: According to the configuration in the address blacklist and whitelist information table, a judgment is made. If blacklist verification is turned on, a blacklist check is performed. If the transaction object of this online transaction hits the blacklist IP in the address blacklist and whitelist information table, it means that the verification has failed. If whitelist verification is turned on, a whitelist check is performed. If the transaction object of this online transaction hits the whitelist IP in the address blacklist and whitelist information table, it means that the verification has passed.

[0027] Step 2: Perform channel source verification for online transactions, check whether the channel source verification is enabled for online transactions, if not, directly proceed to step 3, if enabled, obtain the online transaction channel, and make a judgment based on the configuration in the transaction data table, if the source channel of the online transaction exists in the transaction data table, proceed to step 3, otherwise directly return a transaction failure message; Step 3: Perform transaction access verification for online transactions, check whether the transaction access verification is enabled for online transactions, if not, directly proceed to step 4, if enabled, obtain the transaction code for online transactions, and make a judgment based on the configuration in the transaction data table, if the transaction code for online transactions exists in the transaction data table, proceed to step 4, otherwise, directly return a transaction failure message; In some embodiments, step 3 further includes obtaining a channel code and a transaction code according to the protocol configuration and the address information configuration, including: Set up a protocol configuration table and an address information configuration table, receive information about the configuration protocol, protocol listener and processor based on the protocol configuration table, receive information about the address, local address port and protocol for configuring the service provided based on the address information configuration table, and when accessing the gateway, search for the corresponding protocol listener and processor according to the protocol in the address information configuration table to perform service monitoring and receive messages; When entering channel transaction control, the transaction code and channel code of the online transaction are obtained according to the transaction code path and channel code path in the message. It can be understood that the access gateway defaults to json message, and the non-json message is converted to json message according to the address configuration information to obtain the channel code and transaction code.

[0028] Among them, the XML sample message (TranCode is the transaction code, sourceType is the channel code): configure the path to obtain the channel code and transaction code in address management, and the XML configuration xpath is as follows. The message can configure the transaction code path xmlRequest / TranCode, and the channel code path: xmlRequest / sourceType. When entering the channel transaction management and control, you can obtain the transaction code (T001) and channel code (BH) of the online transaction. <xmlrequest> <name> Zhang Shanlisi< / name> <usrbusyno> 229893< / usrbusyno> <sourcetype> BH< / sourcetype> <trancode> T001< / trancode> <itemid> 120001< / itemid> <seqno> 1668774369880< / seqno> <branchid> 001< / branchid> <trancode> QUR< / trancode> <userid> BH01< / userid> <wsid> 01< / wsid> <accno> 102011000000112533< / accno> < / xmlrequest> Fixed-length message (10-15 bits are transaction code, 118-124 bits are channel code): Configure the path to obtain channel code and transaction code in address management. The fixed-length configuration transaction code starting position is as follows: The message can be configured with transaction code path 10-15, channel code path: 118-124. When entering channel transaction control, you can obtain the transaction code (E02303) and channel code (AC0841) of the online transaction. Among them, online transactions are all subject to strong control rules. As long as the control is turned on, it must comply with the control rules. For example, if the channel configured by the address is M001, as long as the channel code of the sent message is not M001, the prompt information will be directly returned as a failed message as agreed.

[0029] Example: For example, gateway A only configures transaction codes T001, T002, and T003 in the access gateway address transaction table. If the channel sends a T001 transaction to Gateway A, it can be accessed normally. If it sends a T004 transaction, it will be controlled and the prompt message will be returned directly according to the agreed failure message, such as: The [XX] transaction you sent is not allowed to be accessed; Step 4: Perform channel matching verification for online transactions, check whether the channel matching verification is enabled for online transactions, if not, directly proceed to step 5, if enabled, obtain the online transaction channel and transaction code, and make a judgment based on the configuration in the transaction data table. The source channel and transaction code association relationship of the online transaction must exist in the transaction data table, if it does, proceed to step 5, if not, directly return a transaction failure message; In some embodiments, step 4 further includes channel verification control rules. When the channel matching verification is turned on, the channel verification control rules are judged. If the control rules are met, the transaction is run normally. If the control rules are not met, a transaction failure message is directly returned. The channel verification control rules include: Determine whether the source channel is allowed to be accessed, wherein, if the channel code does not exist in the channel transaction table, it is not allowed to be accessed and does not comply with the control rules.

[0030] In some embodiments, the channel verification control rule further includes: Determine whether the source channel access time period meets the configured time period. If the opening time of the channel matching check does not meet the configured time period, it does not meet the control rules.

[0031] Among them, each step of the security control of online transactions has a channel verification switch that can be dynamically turned on and off. When the online transaction is accessed, the transaction time range of the channel and whether the accessed transaction has permission in the channel will be verified. If it is not within the access time range, the agreed error will be directly returned, such as: the channel you submitted is not allowed to be accessed during this time period; Example: For example, if channel M001 is bound to transaction T001, T002, and T003, then transaction T001 can be accessed normally. The channel code M001 and transaction code T001 sent by the channel end can be accessed normally; the channel code M001 and transaction code T004 sent by the channel end are controlled, and the prompt message is returned directly according to the agreed failure message, such as: the [XX] transaction you sent is not allowed to be accessed in the [XX] channel; Step 5: Call the real online transaction to perform actual transaction business processing and return a transaction success message. At the same time, the business processing results are recorded in the online transaction log for monitoring.

[0032] Among them, the transaction failure message mainly includes the serial number, error code, and error message, which are agreed upon during the design of the actual business interface. For example: System A is {"errorcode":"90000"."errormsg":"XXXXXX"}; System B is {"faultcode":"90000"."faultstring":"XXXXXX"}.

[0033] In some embodiments, the step of simultaneously recording the business processing result in an online transaction log for monitoring includes: The transaction log is scanned according to the warning rules based on business needs. If the warning rules are triggered, a warning message is issued. The warning rules are: transactions at the same address fail more than 10 times within 10 minutes or transactions at the same channel fail more than 5 times within 5 minutes.

[0034] In the second aspect, the present application proposes an online transaction security management system, such as Figure 2 As shown, it includes an online transaction configuration module and an online transaction execution module; The online transaction configuration module is used to execute online transaction configuration steps, and the online transaction configuration steps include: Obtain a transaction data table required for online transactions, configure a local address according to the transaction data table, the local address includes an address binding channel and an IP blacklist and whitelist, configure an access gateway according to the transaction data table, bind an online transaction corresponding to the local address according to the access gateway, configure a channel according to the transaction data table and bind the online transaction; The online transaction execution module is used to execute the online transaction execution steps, and the online transaction execution steps include: Step 1: Check whether the address source verification is enabled for online transactions. If the address source verification is not enabled, go directly to step 2. If the address source verification is enabled, obtain the source original IP of the online transaction, and perform blacklist and whitelist verification based on the source original IP. If the verification fails, directly return a transaction failure message. If the verification passes, go to step 2. Step 2: Perform channel source verification for online transactions, check whether the channel source verification is enabled for online transactions, if not, directly proceed to step 3, if enabled, obtain the online transaction channel, and make a judgment based on the configuration in the transaction data table, if the source channel of the online transaction exists in the transaction data table, proceed to step 3, otherwise directly return a transaction failure message; Step 3: Perform transaction access verification for online transactions, check whether the transaction access verification is enabled for online transactions, if not, directly proceed to step 4, if enabled, obtain the transaction code for online transactions, and make a judgment based on the configuration in the transaction data table, if the transaction code for online transactions exists in the transaction data table, proceed to step 4, otherwise, directly return a transaction failure message; Step 4: Perform channel matching verification for online transactions, check whether the channel matching verification is enabled for online transactions, if not, directly proceed to step 5, if enabled, obtain the online transaction channel and transaction code, and make a judgment based on the configuration in the transaction data table. The source channel and transaction code association relationship of the online transaction must exist in the transaction data table, if it does, proceed to step 5, if not, directly return a transaction failure message; Step 5: Call the real online transaction to perform actual transaction business processing and return a transaction success message. At the same time, the business processing results are recorded in the online transaction log for monitoring.

[0035] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0036] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0037] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0038] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0039] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0040] In the embodiments provided in the present disclosure, it should be understood that the disclosed apparatus / computer equipment and methods can be implemented in other ways. For example, the apparatus / computer equipment embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of the apparatus or unit, which may be electrical, mechanical or other forms.

[0041] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0042] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0043] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0044] The above are only preferred implementations of the present invention. It should be pointed out that a number of modifications and improved technical solutions made by those skilled in the art without departing from the technical solution should also be deemed to fall within the scope of protection required by the claims.

Claims

1. A method for online transaction security management and control, characterized by: It includes online transaction configuration steps and online transaction execution steps; The online transaction configuration step includes: Obtain a transaction data table required for online transactions, configure a local address according to the transaction data table, the local address includes an address binding channel and an IP blacklist and whitelist, configure an access gateway according to the transaction data table, bind an online transaction corresponding to the local address according to the access gateway, configure a channel according to the transaction data table and bind the online transaction; The online transaction execution steps include: Step 1: Check whether the address source verification is enabled for online transactions. If the address source verification is not enabled, go directly to step 2. If the address source verification is enabled, obtain the source original IP of the online transaction, and perform blacklist and whitelist verification based on the source original IP. If the verification fails, directly return a transaction failure message. If the verification passes, go to step 2. Step 2: Perform channel source verification for online transactions, check whether the channel source verification is enabled for online transactions, if not, directly proceed to step 3, if enabled, obtain the online transaction channel, and make a judgment based on the configuration in the transaction data table, if the source channel of the online transaction exists in the transaction data table, proceed to step 3, otherwise directly return a transaction failure message; Step 3: Perform transaction access verification for online transactions, check whether the transaction access verification is enabled for online transactions, if not, directly proceed to step 4, if enabled, obtain the transaction code for online transactions, and make a judgment based on the configuration in the transaction data table, if the transaction code for online transactions exists in the transaction data table, proceed to step 4, otherwise, directly return a transaction failure message; Step 4: Perform channel matching verification for online transactions, check whether the channel matching verification is enabled for online transactions, if not, directly proceed to step 5, if enabled, obtain the online transaction channel and transaction code, and make a judgment based on the configuration in the transaction data table. The source channel and transaction code association relationship of the online transaction must exist in the transaction data table, if it does, proceed to step 5, if not, directly return a transaction failure message; Step 5: Call the real online transaction to perform actual transaction business processing and return a transaction success message. At the same time, the business processing results are recorded in the online transaction log for monitoring.

2. The method according to claim 1, characterized in that: The transaction data table includes an address information table, an address blacklist and whitelist information table, a channel information table, an access gateway address transaction table, a channel transaction table, an access gateway service information table and an access gateway address table; The access gateway service information table is used to configure access gateway service information, and the access gateway address table is used to configure access gateway binding address information; The address information table and the address black and white list information table are used to perform black and white list verification in conjunction with the address source verification; The channel information table is used to perform source channel verification in conjunction with the channel source verification; The access gateway address transaction table is used to perform transaction code verification in conjunction with the transaction access verification; The channel transaction table is used to verify the association between the source channel and the transaction code in conjunction with the channel matching verification.

3. The method according to claim 2, characterized in that: If the address source verification is turned on, the source original IP of the online transaction is obtained, and the blacklist and whitelist verification is performed based on the source original IP, including: According to the configuration in the address blacklist and whitelist information table, a judgment is made. If blacklist verification is turned on, a blacklist check is performed. If the transaction object of this online transaction hits the blacklist IP in the address blacklist and whitelist information table, it means that the verification has failed. If whitelist verification is turned on, a whitelist check is performed. If the transaction object of this online transaction hits the whitelist IP in the address blacklist and whitelist information table, it means that the verification has passed.

4. The method according to claim 3, characterized in that: The step 2 also includes obtaining a channel code and a transaction code according to the protocol configuration and the address information configuration, including: Set up a protocol configuration table and an address information configuration table, receive information about the configuration protocol, protocol listener and processor based on the protocol configuration table, receive information about the address, local address port and protocol for configuring the service provided based on the address information configuration table, and when accessing the gateway, search for the corresponding protocol listener and processor according to the protocol in the address information configuration table to perform service monitoring and receive messages; When entering channel transaction control, the transaction code and channel code of the online transaction are obtained according to the transaction code path and channel code path in the message.

5. The method according to claim 4, characterized in that: The step 4 also includes channel verification control rules. When the channel matching verification is turned on, the channel verification control rules are judged. If the control rules are met, the transaction will run normally. If the control rules are not met, a transaction failure message will be directly returned. The channel verification control rules include: Determine whether the source channel is allowed to be accessed, wherein, if the channel code does not exist in the channel transaction table, it is not allowed to be accessed and does not comply with the control rules.

6. The method according to claim 5, characterized in that: The channel verification control rules also include: Determine whether the source channel access time period meets the configured time period. If the opening time of the channel matching check does not meet the configured time period, it does not meet the control rules.

7. The method according to claim 6, characterized in that: The business processing results are recorded in the online transaction log for monitoring, including: The transaction log is scanned according to the warning rules based on business needs. If the warning rules are triggered, a warning message is issued. The warning rules are: transactions at the same address fail more than 10 times within 10 minutes or transactions at the same channel fail more than 5 times within 5 minutes.

8. An online transaction security management and control system, characterized by: It includes an online transaction configuration module and an online transaction execution module; The online transaction configuration module is used to execute online transaction configuration steps, and the online transaction configuration steps include: Obtain a transaction data table required for online transactions, configure a local address according to the transaction data table, the local address includes an address binding channel and an IP blacklist and whitelist, configure an access gateway according to the transaction data table, bind an online transaction corresponding to the local address according to the access gateway, configure a channel according to the transaction data table and bind the online transaction; The online transaction execution module is used to execute the online transaction execution steps, and the online transaction execution steps include: Step 1: Check whether the address source verification is enabled for online transactions. If the address source verification is not enabled, go directly to step 2. If the address source verification is enabled, obtain the source original IP of the online transaction, and perform blacklist and whitelist verification based on the source original IP. If the verification fails, directly return a transaction failure message. If the verification passes, go to step 2. Step 2: Perform channel source verification for online transactions, check whether the channel source verification is enabled for online transactions, if not, directly proceed to step 3, if enabled, obtain the online transaction channel, and make a judgment based on the configuration in the transaction data table, if the source channel of the online transaction exists in the transaction data table, proceed to step 3, otherwise directly return a transaction failure message; Step 3: Perform transaction access verification for online transactions, check whether the transaction access verification is enabled for online transactions, if not, directly proceed to step 4, if enabled, obtain the transaction code for online transactions, and make a judgment based on the configuration in the transaction data table, if the transaction code for online transactions exists in the transaction data table, proceed to step 4, otherwise, directly return a transaction failure message; Step 4: Perform channel matching verification for online transactions, check whether the channel matching verification is enabled for online transactions, if not, directly proceed to step 5, if enabled, obtain the online transaction channel and transaction code, and make a judgment based on the configuration in the transaction data table. The source channel and transaction code association relationship of the online transaction must exist in the transaction data table, if it does, proceed to step 5, if not, directly return a transaction failure message; Step 5: Call the real online transaction to perform actual transaction business processing and return a transaction success message. At the same time, the business processing results are recorded in the online transaction log for monitoring.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images