Security authentication method, device and equipment

Abstract

The invention discloses a security authentication method, device and equipment, and relates to the technical field of financial or information security, the method comprises the following steps: first authentication information sent by a first server is received, the first authentication information comprises user data and first security equipment data, and the first server comprises a server deployed by a first mechanism; when it is judged that the binding relation exists between the user data and the first safety equipment data, the value of an authentication identifier is inquired according to the user data, and the authentication identifier is used for servers of multiple mechanisms to inquire the safety authentication state of a user; if the value is a first numerical value, security authentication operation is executed, and the first numerical value indicates that security authentication is not passed; after the authentication is passed, the value is updated to be a second numerical value, and the second numerical value indicates that the security authentication is passed; and feeding back an authentication success message to the first server. According to the invention, repeated security authentication is not needed, the operation time of user security authentication can be reduced, and the authentication and business handling efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of finance or information security technology, and in particular to a security authentication method, device and equipment. Background Art

[0002] U shield is a security authentication tool or security authentication device, which can store the user's digital certificate, key and other confidential information in it to ensure the security of the user's account. Different banks use different security authentication tools. When users need to apply for online banking services at different banks, each bank will send the user the corresponding U shield of their bank. Users can use the corresponding bank's U shield for security authentication before conducting online transactions.

[0003] However, the existing security authentication methods have the following problems: (1) There are a large number of U-Shields, which are not easy to manage, and users cannot accurately and quickly find the bank U-Shield they need when using it, so they cannot perform security authentication in time; (2) When users conduct business in online banking, they need to repeat security authentication, which is cumbersome. If users need to conduct business in the online banking of different banks, they must complete a series of operations such as logging out, switching U-Shields, and secure login. If there are many banks involved, the user's invalid operations are likely to increase, resulting in increased time costs.

[0004] To address the above problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of this specification provide a security authentication method, device and equipment for a security authentication tool to solve the problem that the prior art cannot handle business in multiple institutions through a single security authentication.

[0006] In a first aspect, an embodiment of the present specification provides a security authentication method, the method comprising:

[0007] Receiving first authentication information sent by a first server, the first authentication information including user data and first security device data, the first server including a server deployed by a first organization;

[0008] When it is determined that there is a binding relationship between the user data and the first security device data, query the value of the authentication identifier according to the user data, and the authentication identifier is used for servers of multiple institutions to query the security authentication status of the user;

[0009] If the value is a first value, a security authentication operation is performed, and the first value indicates that the security authentication has not been passed;

[0010] After the authentication is passed, the value is updated to a second value, where the second value indicates that the security authentication has been passed;

[0011] Feedback a successful authentication message to the first server.

[0012] In one embodiment, the first authentication information further includes first institution data, and when determining that there is a binding relationship between the user data and the first security device data, querying the value of the authentication identifier according to the user data includes:

[0013] When it is determined that there is a binding relationship between the user data and the first security device data, querying from a preset database whether there is a binding relationship between the first organization data and the first security device data;

[0014] When there is a binding relationship between the first organization data and the first security device data, the value of the authentication identifier is queried according to the user data.

[0015] In one embodiment, the method further comprises:

[0016] When there is no binding relationship between the first organization data and the first security device data, sending a verification request to the first server;

[0017] Receiving the user's verification result fed back by the first server;

[0018] When the verification result is successful, sending a verification question to the user;

[0019] Receive the user's response to the verification question;

[0020] Determine whether the reply information matches the preset verification information;

[0021] When the reply information matches the preset verification information, a binding relationship between the first organization data and the first security device data is established.

[0022] In one embodiment, if the value is the first value, performing a security authentication operation includes:

[0023] Sending a security authentication request to the first server;

[0024] Receiving a security authentication result of the user fed back by the first server;

[0025] Determine whether the security authentication result is authentication passed.

[0026] In one embodiment, the method further comprises:

[0027] If the value is the second value, a message of successful authentication is fed back to the first server.

[0028] In one embodiment, the method further comprises:

[0029] receiving second authentication information sent by a second server, the second authentication information including the user data and second security device data, the second server including a server deployed by a second organization;

[0030] When it is determined that there is a binding relationship between the user data and the second security device data, querying the value of the authentication identifier according to the user data;

[0031] If the value is the second value, a message of successful authentication is fed back to the second server.

[0032] In one embodiment, the method further comprises:

[0033] The length of time during which the value of the detection authentication mark remains at the second value;

[0034] When the duration exceeds the safety threshold, the value of the authentication identifier is updated to a first value.

[0035] In a second aspect, the embodiments of this specification also provide a security authentication device, the device comprising:

[0036] A receiving module, configured to receive first authentication information sent by a first server, wherein the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first organization;

[0037] A query module, used to query the value of the authentication identifier according to the user data when it is determined that there is a binding relationship between the user data and the first security device data, wherein the authentication identifier is used for servers of multiple institutions to query the security authentication status of the user;

[0038] An authentication module, configured to perform a security authentication operation if the value is a first value, the first value indicating that the security authentication has not been passed; and update the value to a second value after the authentication has been passed, the second value indicating that the security authentication has been passed;

[0039] The feedback module is used to feed back a message indicating successful authentication to the first server.

[0040] In a third aspect, an embodiment of the present specification also provides a security authentication device, including a processor and a memory for storing processor executable instructions, wherein the processor implements the security authentication method in the above embodiment when executing the instructions.

[0041] In a fourth aspect, an embodiment of the present specification further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the security authentication method in the above embodiment is implemented.

[0042] The embodiment of this specification provides a security authentication method, device and equipment. First, a first authentication information sent by a first server is received, the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first institution. Secondly, when it is determined that there is a binding relationship between the user data and the first security device data, the value of the authentication identifier is queried according to the user data, and the authentication identifier is used for the servers of multiple institutions to query the security authentication status of the user. Then, if the value is a first value, a security authentication operation is performed, and the first value indicates that the security authentication has not been passed. After the authentication is passed, the value is updated to a second value, and the second value indicates that the security authentication has been passed. Finally, a message of successful authentication is fed back to the first server. In the embodiment of this specification, by establishing a binding relationship between user data and the first security device data, on the one hand, it can facilitate the management of security devices, and at the same time enable users to obtain the required security devices in time to complete online transactions. On the other hand, it can provide a basis or premise for the use of the authentication identifier, that is, under the premise of establishing a binding relationship, the servers of multiple institutions can share the authentication identifier to query the security authentication status of the user, without repeating the security authentication, thereby improving the efficiency of security authentication and business handling efficiency. After the authentication is passed, by updating the value of the authentication identifier, the authentication success message can be fed back to the server in a timely manner, thereby improving the efficiency and accuracy of security authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0044] Figure 1 It is a flowchart of a security authentication method provided in an embodiment of this specification;

[0045] Figure 2 It is a schematic diagram of the interactive process of the security authentication method provided in the embodiment of this specification;

[0046] Figure 3 It is a schematic diagram of a process of establishing a binding relationship provided in an embodiment of this specification;

[0047] Figure 4 It is a schematic diagram of the internal structure of the security authentication device provided in the embodiment of this specification;

[0048] Figure 5 It is a schematic diagram of the structure of a security authentication device provided in an embodiment of this specification;

[0049] Figure 6 It is a structural diagram of a security authentication device provided in an embodiment of this specification;

[0050] Figure 7 It is a schematic diagram of a computer device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0052] With the development of online banking services, U-shield is the most important security authentication device for online banking clients. However, different banks now use different security authentication devices. When users need to apply for online banking services at different banks, each bank will issue the user a U-shield that is suitable for its own bank. This will lead to:

[0053] 1. When a user applies for online banking at N banks, he will get N different bank U-shiels. If the person using the U-shield changes frequently, it will make the U-shield difficult to manage;

[0054] 2. The shapes of U-shiels of various banks are similar and do not have clear characteristics. Although some U-shiels are equipped with their own bank's exclusive logo, ordinary users cannot completely distinguish them. When there are many U-shiels, users cannot accurately and quickly find the bank U-shield they need when using U-shiels, which brings a lot of inconvenience to users;

[0055] 3. Currently, when users operate online banking, they face the following situations. First, when users operate in a bank, they must log in securely before they can conduct transactions. However, only a few transactions (such as inquiries) do not require repeated security verification after logging in. Most transactions (such as registration and account changes) require at least one security authentication. This will result in users having to repeat security authentication when making multiple transactions in one bank, which is cumbersome. Second, if users need to conduct business in online banking of different banks, they must complete a series of operations such as logging out, switching U-shields, and secure login. If many banks are involved, users will have to perform more invalid operations, resulting in a higher time cost for users.

[0056] In view of the above-mentioned problems existing in the existing methods and the specific reasons for the above-mentioned problems, this application considers introducing a security authentication method, device and equipment to enable users to complete security authentication only once to achieve signature-free verification in subsequent transactions and switching of online banking, without the need to repeat security authentication and switch U-shield, thereby reducing the user's operation steps and operation time.

[0057] Based on the above ideas, this specification proposes a security authentication method, first, receiving first authentication information sent by a first server, the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first organization. Secondly, when it is determined that there is a binding relationship between the user data and the first security device data, the value of the authentication identifier is queried according to the user data, and the authentication identifier is used for servers of multiple organizations to query the user's security authentication status. Then, if the value is a first value, a security authentication operation is performed, and the first value indicates that the security authentication has not passed. After the authentication passes, the value is updated to a second value, and the second value indicates that the security authentication has passed. Finally, a message of successful authentication is fed back to the first server.

[0058] Figure 1 It is a flowchart of a security authentication method provided by an embodiment of this specification. Although this specification provides method operation steps or device structures as shown in the following embodiments or drawings, more or fewer operation steps or module units may be included in the method or device based on routine or no creative labor. In the steps or structures that do not logically have a necessary causal relationship, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure is applied in an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiment or drawings (for example, a parallel processor or multi-threaded processing environment, or even a distributed processing, server cluster implementation environment). For specific implementation, refer to Figure 1 As shown, the method can be applied to a security authentication system or to a security authentication device, and may include the following contents.

[0059] S101: Receive first authentication information sent by a first server, where the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first organization.

[0060] In some embodiments, the first server may be deployed on a first institution, which may be Bank A. The user data may include at least the user's name and ID number, and the user data may also include the enterprise data of the user's enterprise, which may include at least the group number, group name, group ID, business license number, organization code, and enterprise master account information. The first security device data may be the exclusive or unique identification data of the first security authentication device or the first security authentication tool, which may include a U-shield, and the first security device data, i.e., the exclusive identification data of the first security authentication device or the first security authentication tool, may include at least the U-shield security authentication serial number, the U-shield key, or other data that can uniquely identify the U-shield, which is not specifically limited in this specification.

[0061] In some embodiments, when a user opens the online banking of a first institution (such as Bank A), the first server of the first institution (such as Bank A's first server) sends an authentication request to a security authentication system or a security authentication device. The authentication request may carry first authentication information. The security authentication system may receive the authentication request sent by the first server of the first institution, and then obtain the first authentication information in the authentication request.

[0062] In some embodiments, the first authentication information may also include first institution data, which may include at least a dedicated domain name of the first institution and the name of the first institution. The first institution data may also include other data that can uniquely identify the first institution, which is not specifically limited in this specification.

[0063] It should be noted that the information and data related to users involved in this application are obtained and used with the knowledge and consent of the users. In addition, the acquisition, storage, use and processing of the above information and data are in compliance with the relevant provisions of national laws and regulations.

[0064] S102: When it is determined that there is a binding relationship between the user data and the first security device data, a value of an authentication identifier is queried according to the user data, where the authentication identifier is used by servers of multiple institutions to query the security authentication status of the user.

[0065] In some embodiments, it is possible to determine whether there is a binding relationship between user data and first security device data by querying whether there is a binding relationship between user data and first security device data in a preset database. The preset database may pre-store the binding relationship between user data and first security device data. When it is determined that there is a binding relationship between user data and first security device data, the value of the authentication identifier can be further queried based on the user data, and the authentication identifier can be used for servers of multiple institutions to query the security authentication status of the user. By first establishing a binding relationship and then querying the value of the authentication identifier, one or more institutions with a binding relationship can implement security authentication based on a common authentication identifier without having to repeat security authentication.

[0066] In some embodiments, when determining that there is a binding relationship between the user data and the first security device data, querying the value of the authentication identifier according to the user data may include:

[0067] When it is determined that there is a binding relationship between the user data and the first security device data, querying from a preset database whether there is a binding relationship between the first organization data and the first security device data;

[0068] When there is a binding relationship between the first organization data and the first security device data, the value of the authentication identifier is queried according to the user data.

[0069] In some embodiments, after receiving the first authentication information sent by the first server, the security authentication system can establish a binding relationship between the user data and the first security device data and store the binding relationship between the user data and the first security device data in a preset database. It is also possible to establish a binding relationship between the first mechanism data and the first security device data and store the binding relationship between the first mechanism data and the first security device data in a preset database. The security authentication system can first query whether there is a binding relationship between the user data and the first security device data in the preset database. If there is a binding relationship between the user data and the first security device data, it can further query the binding relationship between the first mechanism data and the first security device data. If there is a binding relationship between the first mechanism data and the first security device data, the value of the authentication identifier can be queried based on the user data. By establishing the binding relationship between the user data and the first security device data and the binding relationship between the first mechanism data and the first security device data, on the one hand, it can facilitate the management of security devices, and enable users to accurately and quickly obtain the required security devices. On the other hand, it provides a prerequisite for using the authentication identifier, that is, it is necessary to use the authentication identifier to query the security authentication status under the premise of establishing the binding relationship, thereby improving the security and reliability of security authentication.

[0070] In some embodiments, after querying from the preset database whether there is a binding relationship between the first organization data and the first security device data, during specific implementation, the following may also be included:

[0071] When there is no binding relationship between the first organization data and the first security device data, sending a verification request to the first server;

[0072] Receiving the user's verification result fed back by the first server;

[0073] When the verification result is successful, sending a verification question to the user;

[0074] Receive the user's response to the verification question;

[0075] Determine whether the reply information matches the preset verification information;

[0076] When the reply information matches the preset verification information, a binding relationship between the first organization data and the first security device data is established.

[0077] In some embodiments, if there is no binding relationship between the first institution data and the first security device data in the preset database, it is necessary to establish a binding relationship between the first institution data and the first security device data. Specifically, the security authentication system may first send a verification request to the first server of the first institution. After receiving the verification request sent by the security authentication system, the first server may then send the verification request to the user's terminal device, and the user's terminal device may include a smart phone, a tablet computer, a laptop, a desktop computer, a smart watch, and software that can run in the above terminal devices. The user can enter the verification information through the terminal device and send the verification information to the first server. The first server can determine whether the verification information entered by the user is correct, and then feedback the user's verification result to the security authentication system. After receiving the verification result fed back by the first server, the security authentication system can first determine whether the verification result is successful. If so, it can continue to send verification questions to the user terminal, and then receive the reply information of the user terminal to the verification question, and then determine whether the reply information matches the pre-set verification information. If it matches, the binding relationship between the first institution data and the first security device data can be established. The verification question can be set according to actual needs, and can be one or more. The verification question can be information reserved by the user in advance, such as the user's office address, user phone number, name of the legal person of the user's company, number of people in the user's company, and other related questions. If the verification result is a verification failure, the binding relationship is rejected. If the reply information does not match the pre-set verification information, the binding relationship is rejected.

[0078] In this embodiment, before establishing the binding relationship between the first institution data and the first security device data, the verification result of the user fed back by the first server is received first, so that it can be known in time whether the user is a normal user of the first institution (such as: Bank A). After the verification is successful, the verification question is sent to the user and the user's reply information to the verification question is received, so that it can be known in time whether the user is the real holder of the U shield. After the double verification is passed, the binding relationship is established, which can improve the accuracy and reliability of the establishment of the binding relationship and provide a reliable foundation for subsequent accurate and rapid security authentication.

[0079] In some embodiments, the above binding relationship only needs to be established once, and the established binding relationship can be stored in a preset database. For security reasons, the storage time of the binding relationship can also be set. The storage time can be set according to actual needs, and this specification does not make specific limitations on this.

[0080] S103: If the value is a first value, a security authentication operation is performed, and the first value indicates that the security authentication has not been passed.

[0081] S104: After the authentication is passed, the value is updated to a second value, where the second value indicates that the security authentication is passed.

[0082] S105: Feedback a message indicating successful authentication to the first server.

[0083] In some embodiments, when it is determined that there is a binding relationship between the user data and the first security device data, the value of the authentication identifier can be queried. If the value of the authentication identifier is the first value, it means that the user has not passed the security authentication, and it is necessary to perform a security authentication operation to verify the authenticity of the user's identity. Among them, the authentication identifier can include start and wait for startup, the first value can be 0, and the value of the authentication identifier can be the first value "0-wait for startup". When "0-wait for startup" appears, it means that the user has not passed the security authentication. At this time, it is necessary to perform a security authentication operation on the user to complete the security authentication.

[0084] In some embodiments, if the value is the first value, performing the security authentication operation may include:

[0085] Sending a security authentication request to the first server;

[0086] Receiving a security authentication result of the user fed back by the first server;

[0087] Determine whether the security authentication result is authentication passed.

[0088] In some embodiments, the security authentication system may first send a security authentication request to the first server, and the first server may then send the security authentication request to the user end. After receiving the security authentication request, the user may enter the user authentication information during the security authentication and then send the user authentication information to the first server. The first server may obtain the user authentication information and determine whether the user authentication information is correct. If correct, the security authentication result of the user is fed back to the security authentication system. The security authentication system may receive the security authentication result of the user fed back by the first server, and determine whether the security authentication result of the user is authenticated (or determine whether the security authentication result of the user is authenticated successfully). If so, the value of the authentication identifier may be updated from the first value to the second value (e.g., the value of the authentication identifier may be changed from "0-to be started" to "1-success" or "0-to be started" to "1-start"). When updated to the second value, it may indicate that the user has performed security authentication and passed the security authentication. By querying the value of the authentication identifier, users who have not passed the security authentication can perform security authentication in a timely manner, thereby improving the efficiency of security authentication.

[0089] In some embodiments, after querying the value of the authentication identifier according to the user data, the specific implementation may also include:

[0090] If the value is the second value, a message of successful authentication is fed back to the first server.

[0091] In some embodiments, if the value of the authentication identifier is the second value (for example, the value of the authentication identifier is "1-success"), the security authentication operation may not be repeated, and a message of successful authentication may be directly fed back to the first server, thereby reducing the time of the user's security authentication operation and improving the authentication efficiency. After the first server receives the message of successful authentication, it may allow the user to conduct related business at the first institution (such as conducting online transactions at the first institution's online bank), thereby improving the efficiency of business handling.

[0092] In some embodiments, the method may further include:

[0093] receiving second authentication information sent by a second server, where the second authentication information may include the user data and second security device data, and the second server may include a server deployed by a second institution;

[0094] When it is determined that there is a binding relationship between the user data and the second security device data, querying the value of the authentication identifier according to the user data;

[0095] If the value is the second value, a message of successful authentication is fed back to the second server.

[0096] In some embodiments, the second server may be deployed on a second institution, which is different from the first institution, such as Bank B which is different from Bank A. The second security device data may be exclusive identification data of a second security authentication device or a second security authentication tool, which may include a U-shield. The second security device data, i.e., the exclusive identification data of the second security authentication device or the second security authentication tool, may include at least a U-shield security authentication serial number, a U-shield key, or other data that can uniquely identify the U-shield, which is not specifically limited in this specification. The second authentication information may also include second institution data, which may include at least a dedicated domain name of the second institution and the name of the second institution. The second institution data may also include other data that can uniquely identify the second institution, which is not specifically limited in this specification.

[0097] In some embodiments, the second authentication information sent by the second server can be received first, and then it can be determined whether there is a binding relationship between the user data and the second security device data. When there is a binding relationship between the user data and the second security device data, it can be queried from the preset database whether there is a binding relationship between the second institution data and the second security device data. If there is a binding relationship between the second institution data and the second security device data, the authentication identifier that is common to the first institution can be used to query the value of the authentication identifier, thereby achieving the purpose of multiple institutions (such as multiple banks) and multiple transactions using the same authentication identifier, thereby reducing the number of times users perform security authentication and improving operational convenience.

[0098] In some embodiments, after the value is updated to the second value, the specific implementation may further include:

[0099] The length of time during which the value of the detection authentication mark remains at the second value;

[0100] When the duration exceeds the safety threshold, the value of the authentication identifier is updated to a first value.

[0101] In some embodiments, when the value of the authentication mark is the second numerical value, the duration of the authentication mark being maintained as the second numerical value can be detected, and then the duration of being maintained as the second numerical value is compared with the security threshold. If the duration of being maintained as the second numerical value does not exceed the security threshold, a message of successful authentication can be fed back to the first server or the second server. If the duration of being maintained as the second numerical value exceeds the security threshold, it means that the value of the authentication mark will face failure when the value is the second numerical value at this time, and the value of the authentication mark needs to be updated to the first numerical value, and then the security authentication operation is re-executed. After the authentication is passed, the value of the authentication mark can be updated from the first numerical value to the second numerical value. Among them, the security threshold can be a numerical value, such as: 10min (minutes), or a time range, such as: (10min, 20min), which is not specifically limited in this specification. By detecting the duration of the authentication mark being maintained as the second numerical value and judging whether the duration exceeds the security threshold, the security and reliability of the user when handling the business can be improved, that is, once the security threshold is exceeded, the user needs to re-perform security authentication.

[0102] In some embodiments, in order to achieve visa-free authentication when a user switches between different institutions (such as switching from online banking of Bank A to online banking of Bank B) and improve the user's business handling efficiency, when the user logs in to the online banking of Bank A and obtains the value of the authentication identifier as a second value, that is, when "1-Success" appears, the duration of "1-Success" is set to 10 minutes. When the user switches to the online banking of Bank B, if the value of the authentication identifier is also the second value "1-Success", and the duration of "1-Success" of 10 minutes does not exceed the security threshold of 20 minutes, then the authentication success message can be directly fed back to the server of Bank B to complete the visa-free authentication.

[0103] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. For details, please refer to the description of the above-mentioned related processing related embodiments, and no further description is given here.

[0104] The above is an explanation of the present invention, however, it is worth noting that the specific embodiments are only for the purpose of better illustrating the present application, and the specific embodiments are described in the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] The above method is described below in conjunction with a specific embodiment. However, it should be noted that this specific embodiment is only for better illustrating the present application and does not constitute an improper limitation on the present application.

[0106] Before specific implementation, first, the first authentication information sent by the first server of the first organization can be received (the first authentication information may include user data, first security device data and first organization data), and then the second authentication information sent by the second server of the second organization can be received (the second authentication information may include user data, second security device data and second organization data), wherein the first organization is different from the second organization, the first server is different from the second server, and the first security device is different from the second security device. The first authentication information and the second authentication information can be pre-stored in a preset database. It is also possible to establish a binding relationship between user data and first security device data, a binding relationship between user data and second security device data, a binding relationship between first organization data and first security device data, and a binding relationship between second organization data and second security device data, and then store the binding relationship in the preset database.

[0107] In specific implementation, when a user logs in to the first institution (such as using the online banking of bank A), it can first query whether there is a binding relationship between the user data and the first security device data. When the user data and the first security device data are in a binding relationship, it can then query whether there is a binding relationship between the first institution data and the first security device data. When the first institution data and the first security device data are in a binding relationship, it can further query the value of the authentication identifier based on the user data to determine whether the user has passed the security authentication. When the value of the authentication identifier is the second value, it means that the user has passed the security authentication. At this time, a message of successful authentication can be fed back to the first server. When the user logs in to the second institution (such as using the online banking of bank B), it can first query whether there is a binding relationship between the user data and the second security device data. When the user data and the second security device data are in a binding relationship, it can then query whether there is a binding relationship between the second institution data and the second security device data. When the second institution data and the second security device data are in a binding relationship, the authentication identifier can be shared with the first institution. When the value of the authentication identifier is the second value, a message of successful authentication can be directly fed back to the second server, so that as long as the institution with a binding relationship is established, the authentication identifier can be used, reducing the number of times the user performs security authentication and improving the convenience of operation.

[0108] In a specific scenario example, the first institution is Bank A, the second institution is Bank B, Bank A and Bank B represent different banks, and the A online banking server is deployed on Bank A, and the B online banking server is deployed on Bank B. Figure 2 As shown, Figure 2An interactive flow chart of a security authentication method is shown. The method can be applied to a security authentication device or system and may include the following steps:

[0109] Step 1: The security authentication system or device first obtains the authentication information from the A online banking server, which may include the identification information of Bank A, the corporate user information to be verified, the U shield identification information, etc.

[0110] Step 2: The security authentication system or device queries the corporate user's USB-shield binding relationship at Bank A and outputs the authentication status.

[0111] In this step, based on the bank identification information, the corporate user identification information to be verified, the U-Shield identification information, etc. sent by the A online banking server, the storage unit of the security authentication device can be searched for a binding relationship identification with the U-Shield identification holder. If a binding relationship identification exists, the authentication status is searched and finally the authentication status is output. The authentication status can be divided into two situations: Situation 1 is that the authentication status is 1-successful, which means that the corporate user has done the security authentication and directly returns the bank authentication success identification. The online banking end does not need to perform security authentication operations; Situation 2 is 0-to be started, which means that the corporate user has not performed security authentication and needs to verify the authenticity of the identity on the online banking end, and execute step 3.

[0112] Step 3: The output unit of the security authentication system or device outputs a verification request for the user to Bank A.

[0113] The output unit sends the security authentication prompt information to the online banking terminal for display, so that the corporate user knows that he has not completed the security authentication. After the corporate user obtains the information, he enters the security authentication information reserved by Bank A on the online banking terminal. The online banking server A makes a judgment on the authentication information and faces two situations: Situation 1 is that the authentication is successful and step 4 is executed; Situation 2 is that the authentication fails and the transaction is terminated.

[0114] Step 4: The acquisition unit of the security authentication system or device obtains the verification result of the A online banking server and transmits the verification result to the authentication unit of the security authentication system or device. The authentication unit determines the verification result. If the verification is successful, the authentication status is changed to 1-successful; if the verification fails, the authentication status is maintained at 0-pending status.

[0115] In this step, in order to achieve the purpose of visa-free authentication when switching banks, the authentication status will be maintained as "1-success" within a certain effective time range. The specific time range can be set according to the actual situation. During the effective time, when the corporate user conducts other transactions to be verified or switches to other bound banks, the security authentication system or device will output an instruction with an authentication status of "1-success". If the effective time range is exceeded, the authentication status will be changed to "0-to be started". When the corporate user operates on the online banking side, the authentication status output by the security authentication system or device is "0-to be started", and the corporate user needs to re-verify to trigger the change of the authentication status. The effective time calculation can be based on the timestamp of the latest authentication status of "1-success" as the starting time point. It should be noted that when the security authentication system or device is disconnected from the online banking or U-Shield, the authentication status will also be changed to "0-to be started".

[0116] Step 5: When the corporate user switches to Bank B, the authentication information of Bank B will be obtained from the online banking server of Bank B. The authentication information may include Bank B identification information, the corporate information to be verified, and U-Shield identification information.

[0117] Step 6: After finding the U-Shield binding relationship of the corporate user in Bank B, if the security authentication status is "1-Success", you can directly send a verification success instruction to the B online banking server to complete the visa-free verification.

[0118] In this step, the scope of visa-free verification may include but is not limited to multiple signature verification transactions performed by corporate users at the same bank. For example, transactions such as transfer, registration, and cancellation. It should be noted that when corporate users switch between online banking of Bank A and Bank B, they need to perform verification login and signature verification transactions.

[0119] After obtaining the bank identification information and user information used to describe the user sent by A's online banking server, the security authentication system or device can query the U-shield authentication identification binding relationship of the enterprise user information in the storage unit, obtain the query result, and output the instruction to be verified. According to the verification result, the authentication status is changed to "1-successful" so that this status can provide verification success instructions to multiple banks and multiple signature verification transactions, thereby achieving the purpose of completing security authentication only once for multiple banks or multiple signature verification transactions.

[0120] In order to ensure the security of visa-free verification, before implementing visa-free verification, it is necessary to complete the binding of the bank identification information with the U-shield authentication identification information corresponding to the enterprise user information. Figure 3 As shown, Figure 3 The schematic diagram of the process of establishing a binding relationship is shown. The following steps may be included:

[0121] Step 1: Obtain bank authentication information, including identification information sent by the bank, corporate user information to be verified, and U-Shield identification information.

[0122] Step 2: Find the binding relationship of the corporate user in the bank.

[0123] In this step, according to the bank's online banking server sending bank identification information and corporate user information, the security authentication system or device can search in the storage unit whether there is a binding relationship identifier with the U shield identifier, and obtain the query result. If it exists, refer to Figure 2 If it does not exist, proceed to step 3.

[0124] Step 3: The output unit outputs the verification request to the bank.

[0125] In this step, the output unit of the security authentication system or device can send a prompt message to the online banking end for display, so that the corporate user knows that he has not undergone security authentication. After the corporate user obtains the prompt message, he enters the security authentication information reserved in the bank on the online banking end. The online banking server then makes a judgment on the verification information and faces two situations: Situation 1 is successful authentication; Situation 2 is failed authentication, and the online banking end ends the transaction.

[0126] Step 4: The acquisition unit acquires the bank verification result and transmits the verification result to the authentication unit, which determines the verification result. If the verification is successful, step 5 is executed. If the verification fails, the proposed binding relationship is rejected.

[0127] Step 5: Enter at least one prompt question for the enterprise user to be bound, and the enterprise user enters the reply information

[0128] In this step, the prompt question can be information reserved in advance by the enterprise user, such as office address, enterprise phone number, name of legal person, number of employees, etc. The output prompt question can be one or more, and can be set according to actual needs.

[0129] Step 6: The acquisition unit obtains the reply information, and the authentication unit verifies whether the reply information matches the pre-reserved target verification information corresponding to the prompt question. If they match, a binding relationship is established between the bank identification information and the U-shield authentication identification information corresponding to the enterprise user information, and the relationship is stored in the storage unit. If they do not match, the binding relationship is refused to be established.

[0130] In this step, the relationship binding condition here can be matched with at least one reply message or with multiple messages, and this specification does not specifically limit this. The binding relationship only needs to be established once, and after establishment, the binding relationship can be stored in the storage unit. For security reasons, the storage time of the binding relationship can be set.

[0131] See also Figure 4 As shown, Figure 4 A schematic diagram of the structure of a security authentication device is shown, which may include:

[0132] (1) An acquisition unit, used to acquire authentication information sent by the server of Bank A and the server of Bank B (A online banking server and B online banking server), including bank identification information, corporate user information to be verified, and U-Shield identification information sent by the server; used to acquire transaction information instructions to be processed sent by the bank; used to acquire actual verification information from the bank, etc.

[0133] (2) A query unit, which is used to query the identification information of Bank A, the enterprise user information to be verified, the identification information of the U-shield and their binding relationship to obtain specific query results; and is used to query the security authentication status.

[0134] (3) a relationship binding unit, used to establish a binding relationship between the bank identification information and the USB shield identification information corresponding to the enterprise information if at least one reply information matches the pre-reserved target verification information corresponding to the prompt question, and store the binding relationship in a storage unit.

[0135] (4) A storage unit, used to store bank identification information, enterprise user information to be verified, U-shield identification information, and their binding relationship.

[0136] (5) An output unit, used to output the prompt questions, query results, verification results and security authentication status of the bound enterprise user.

[0137] (6) An authentication unit, used to verify the matching degree between the response information and the prompt question; used to change the security authentication status.

[0138] After obtaining the authentication information of Bank A, first query in the storage unit whether there is a binding relationship between the user information and the U-Shield identification information, obtain the query result, then establish the binding relationship between the identification information of Bank A and the U-Shield identification information, and store the relationship in the storage unit, so that Bank A can use the security authentication status, so that as long as the bank with a binding relationship is established, the security authentication status can be used, thereby achieving the purpose of multiple banks and multiple transactions using the same security authentication status, reducing the number of times users perform security authentication and improving the convenience of operation.

[0139] See also Figure 5 As shown, Figure 5 A schematic diagram of the structure of a security authentication device is shown, which may include:

[0140] (1) USB communication port, which can be used for authentication and information transmission between the device and online banking of various banks.

[0141] (2) USB-shield connection module, which can be used to connect the USB-shield to the device.

[0142] (3) A processor that can be used to execute any implementation method of the security authentication method.

[0143] Although this specification provides examples such as the following embodiments or the attached Figure 6 The method operation steps or device structure shown in the figure, but based on routine or without creative labor, the method or device may include more or fewer operation steps or module units after partial merger. In the steps or structures where there is no necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure described is applied in an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiment or drawings (for example, a parallel processor or multi-threaded processing environment, or even a distributed processing, server cluster implementation environment).

[0144] Based on the above security authentication method, this specification also proposes an embodiment of a security authentication device. Figure 6 As shown, the device may specifically include the following modules:

[0145] The receiving module 601 may be configured to receive first authentication information sent by a first server, wherein the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first organization;

[0146] The query module 602 may be used to query the value of the authentication identifier according to the user data when it is determined that the user data and the first security device data have a binding relationship, and the authentication identifier is used for servers of multiple institutions to query the security authentication status of the user;

[0147] The authentication module 603 may be configured to perform a security authentication operation if the value is a first value, the first value indicating that the security authentication has not been passed; and after the authentication has been passed, update the value to a second value, the second value indicating that the security authentication has been passed;

[0148] The feedback module 604 may be configured to feed back a message indicating successful authentication to the first server.

[0149] In one embodiment, the first authentication information in the above-mentioned receiving module 601 may also include first institution data.

[0150] In one embodiment, the query module 602 can be specifically used to query from a preset database whether there is a binding relationship between the first organization data and the first security device data when it is determined that there is a binding relationship between the user data and the first security device data; when there is a binding relationship between the first organization data and the first security device data, query the value of the authentication identifier based on the user data.

[0151] In one embodiment, the query module 602 can also be used to send a verification request to the first server when there is no binding relationship between the first organization data and the first security device data; receive the user's verification result fed back by the first server; when the verification result is successful, send a verification question to the user; receive the user's reply information to the verification question; determine whether the reply information matches the pre-set verification information; and when the reply information matches the pre-set verification information, establish a binding relationship between the first organization data and the first security device data.

[0152] In one embodiment, the query module 602 may be further configured to feedback a message of successful authentication to the first server if the value is the second value.

[0153] In one embodiment, the authentication module 603 can be specifically used to send a security authentication request to the first server; receive the security authentication result of the user fed back by the first server; and determine whether the security authentication result is authentication passed.

[0154] In one embodiment, the authentication module 603 may be further configured to detect the duration for which the value of the authentication identifier remains at the second value; when the duration exceeds a safety threshold, the value of the authentication identifier is updated to the first value.

[0155] In one embodiment, the above-mentioned feedback module 604 can also be specifically used to receive second authentication information sent by a second server, wherein the second authentication information includes the user data and the second security device data, and the second server includes a server deployed by a second organization; when it is determined that there is a binding relationship between the user data and the second security device data, the value of the authentication identifier is queried according to the user data; if the value is a second numerical value, a message of successful authentication is fed back to the second server.

[0156] It should be noted that the units, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. For the convenience of description, the above devices are described separately by functions divided into various modules. Of course, when implementing this specification, the functions of each module can be implemented in the same or more software and / or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0157] As can be seen from the above, a security authentication device provided in the embodiments of this specification can solve the problem that enterprises or users must use self-configured U-shields to perform multiple security authentications when using online banking of different banks. By establishing a binding relationship, institutions with a binding relationship can share an authentication identifier. When the value of the authentication identifier is the second value, switching to any institution can achieve visa-free authentication without the need for repeated authentication.

[0158] An embodiment of the present specification also provides an electronic device based on the above-mentioned security authentication method, including a processor and a memory for storing processor executable instructions. When the processor is implemented, it can perform the following steps according to the instructions: receiving first authentication information sent by a first server, the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first organization; when it is determined that there is a binding relationship between the user data and the first security device data, querying the value of the authentication identifier according to the user data, and the authentication identifier is used for servers of multiple organizations to query the user's security authentication status; if the value is a first value, performing a security authentication operation, and the first value indicates that the security authentication has not passed; after the authentication passes, updating the value to a second value, and the second value indicates that the security authentication has passed; and feeding back a message of successful authentication to the first server.

[0159] In order to complete the above instructions more accurately, refer to Figure 7 As shown, the embodiment of this specification also provides another specific electronic device, wherein the electronic device includes a network communication port 701, a processor 702 and a memory 703, and the above structures are connected through internal cables so that each structure can perform specific data interaction.

[0160] The network communication port 701 can be specifically used to receive first authentication information sent by a first server, wherein the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first organization.

[0161] The processor 702 can be specifically used to query the value of the authentication identifier based on the user data when determining that there is a binding relationship between the user data and the first security device data, and the authentication identifier is used for servers of multiple institutions to query the user's security authentication status; if the value is a first value, perform a security authentication operation, and the first value indicates that the security authentication has not passed; after the authentication is passed, update the value to a second value, and the second value indicates that the security authentication has passed; and feedback a message of successful authentication to the first server.

[0162] The memory 703 may be specifically used to store corresponding instruction programs.

[0163] In this embodiment, the network communication port 701 can be a virtual port that is bound to different communication protocols so that different data can be sent or received. For example, the network communication port can be a port responsible for web data communication, a port responsible for FTP data communication, or a port responsible for email data communication. In addition, the network communication port can also be a physical communication interface or communication chip. For example, it can be a wireless mobile network communication chip, such as GSM, CDMA, etc.; it can also be a Wifi chip; it can also be a Bluetooth chip.

[0164] In this embodiment, the processor 702 may be implemented in any appropriate manner. For example, the processor may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) executable by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, etc. This specification does not limit this.

[0165] In this embodiment, the memory 703 may include multiple levels. In a digital system, anything that can store binary data can be a memory; in an integrated circuit, a circuit with a storage function that has no physical form is also called a memory, such as RAM, FIFO, etc.; in a system, a storage device with a physical form is also called a memory, such as a memory stick, TF card, etc.

[0166] The embodiments of this specification also provide a computer storage medium based on the above-mentioned security authentication method, wherein the computer storage medium stores computer program instructions, which, when executed, implement the following: receiving first authentication information sent by a first server, wherein the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first organization; when determining that there is a binding relationship between the user data and the first security device data, querying the value of an authentication identifier based on the user data, wherein the authentication identifier is used for servers of multiple organizations to query the user's security authentication status; if the value is a first value, performing a security authentication operation, wherein the first value indicates that the security authentication has not passed; after the authentication passes, updating the value to a second value, wherein the second value indicates that the security authentication has passed; and feeding back a message of successful authentication to the first server.

[0167] In this embodiment, the storage medium includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a cache, a hard disk (HDD), or a memory card. The memory may be used to store computer program instructions. The network communication unit may be an interface for network connection communication set in accordance with the standard specified by the communication protocol.

[0168] In this embodiment, the functions and effects specifically implemented by the program instructions stored in the computer storage medium can be explained in comparison with other implementations and will not be described in detail here.

[0169] Although the present specification provides method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent a unique execution order. When the device or client product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or device. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or device including the elements. The first, second, etc. words are used to represent the name, and do not represent any particular order.

[0170] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0171] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media including storage devices.

[0172] Through the description of the above embodiments, it can be known that those skilled in the art can clearly understand that the present specification can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present specification can essentially be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in each embodiment of the present specification or some parts of the embodiments.

[0173] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. This specification can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0174] Although the present specification is described through embodiments, persons skilled in the art will appreciate that there are many variations of the present specification without departing from the spirit of the present specification, and it is intended that the appended claims include these variations without departing from the spirit of the present specification.

Claims

1. A security authentication method, characterized in that: include: Receiving first authentication information sent by a first server, the first authentication information including user data and first security device data, the first server including a server deployed by a first organization; When it is determined that there is a binding relationship between the user data and the first security device data, query the value of the authentication identifier according to the user data, and the authentication identifier is used for servers of multiple institutions to query the security authentication status of the user; If the value is a first value, a security authentication operation is performed, and the first value indicates that the security authentication has not been passed; After the authentication is passed, the value is updated to a second value, where the second value indicates that the security authentication has been passed; Feedback a successful authentication message to the first server.

2. The method according to claim 1, characterized in that The first authentication information also includes first institution data, and when determining that there is a binding relationship between the user data and the first security device data, querying the value of the authentication identifier according to the user data includes: When determining whether there is a binding relationship between the user data and the first security device data, querying from a preset database whether there is a binding relationship between the first organization data and the first security device data; When there is a binding relationship between the first organization data and the first security device data, the value of the authentication identifier is queried according to the user data.

3. The method according to claim 2, characterized in that The method further comprises: When there is no binding relationship between the first organization data and the first security device data, sending a verification request to the first server; Receiving the user's verification result fed back by the first server; When the verification result is successful, sending a verification question to the user; Receive the user's response to the verification question; Determine whether the reply information matches the preset verification information; When the reply information matches the preset verification information, a binding relationship between the first organization data and the first security device data is established.

4. The method according to claim 1, characterized in that If the value is the first value, performing a security authentication operation includes: Sending a security authentication request to the first server; Receiving a security authentication result of the user fed back by the first server; Determine whether the security authentication result is authentication passed.

5. The method according to claim 1, characterized in that The method further comprises: If the value is the second value, a message of successful authentication is fed back to the first server.

6. The method according to claim 1, characterized in that The method further comprises: receiving second authentication information sent by a second server, the second authentication information including the user data and second security device data, the second server including a server deployed by a second organization; When it is determined that there is a binding relationship between the user data and the second security device data, querying the value of the authentication identifier according to the user data; If the value is the second value, a message of successful authentication is fed back to the second server.

7. The method according to claim 1, characterized in that The method further comprises: The length of time during which the value of the detection authentication mark remains at the second value; When the duration exceeds the safety threshold, the value of the authentication identifier is updated to a first value.

8. A security authentication device, characterized in that: include: A receiving module, configured to receive first authentication information sent by a first server, wherein the first authentication information includes user data and first security device data, and the first server includes a server deployed by a first organization; A query module, used to query the value of the authentication identifier according to the user data when it is determined that there is a binding relationship between the user data and the first security device data, wherein the authentication identifier is used for servers of multiple institutions to query the security authentication status of the user; An authentication module, configured to perform a security authentication operation if the value is a first value, the first value indicating that the security authentication has not been passed; and update the value to a second value after the authentication has been passed, the second value indicating that the security authentication has been passed; The feedback module is used to feed back a message of successful authentication to the first server.

9. A security authentication device, characterized in that: The invention comprises a processor and a memory for storing processor-executable instructions, wherein the processor implements the steps of the method according to any one of claims 1 to 7 when executing the instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any one of the methods of claims 1 to 7 are implemented.

Images