Method applied to transaction access path self-adaption system

Abstract

The invention relates to the technical field of network transaction security, in particular to a method applied to a transaction access path self-adaption system, which comprises a collaborative signature client, a collaborative signature server, a service server, a centralized storage module and a certificate issuing server, and the collaborative signature client, the collaborative signature server, the business server, the centralized storage module and the certificate issuing server are connected in sequence. According to the invention, the network risk of security transactions is reduced, the emergency processing efficiency is improved, the maintenance workload is reduced, the system security is enhanced, the user experience is optimized, and the system has the advantages of high availability design, flexibility, expandability and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of network transaction security, and in particular to a method applied to a transaction access path adaptive system. Background Art

[0002] As a widely used commercial application system, the securities trading system has particularly significant characteristics, namely, it has very high requirements for security, real-time, accuracy, and continuity. In particular, as an open online trading and service platform, its security plays a vital role in the entire system. How to provide powerful security services and redundant services is one of the key issues faced in establishing an online trading system.

[0003] With the development of Internet technology, online securities trading has become the main trading method, providing investors with high-speed, stable real-time market information and safe and reliable entrusted trading services. Securities trading access is a key link in the trading process. With the transformation of the access function of the trading system, the number of system nodes relied on in the access process continues to increase, and the risks in the access stage also increase exponentially.

[0004] Currently, there are two access methods: SSL one-way authentication and two-way authentication. The SSL server provides two different network connection ports. The collaborative signature client accesses RA through SSL one-way authentication service port 1 for business identity verification, and completes the issuance of SSL dual certificates through the certificate issuance server cloud interface. Finally, the collaborative signature client accesses the backend transaction server through SSL two-way authentication service port 2 to complete securities information query and trading at the business layer.

[0005] In the existing authentication access method, the client must maintain two sets of SSL certificates, which is difficult to maintain. The server must maintain two network ports, which doubles the network risk. The server must maintain two sets of SSL certificates (one-way SSL certificate and two-way SSL certificate), which has a large maintenance workload. The newly added RA system is maintained separately, and the system is complex. At the same time, if the key management system KMS fails, emergency handling is troublesome and requires manual intervention to manually switch the SSL server authentication method from two-way authentication to one-way authentication access method, and the emergency switching time is long.

[0006] Therefore, there is an urgent need to provide a method for applying to the transaction access path adaptive system. Under the premise of ensuring network security, improving the system's risk resistance and improving the switching efficiency of emergency scenarios are problems that technical personnel in this field urgently need to solve. Summary of the invention

[0007] In order to overcome the shortcomings of the prior art, the present invention provides a method applied to the transaction access path adaptive system, which can complete business queries and transactions through the GMSSL private dual certificate collaborative signature channel, save network port resources, reduce network risks, and improve the switching efficiency of emergency scenarios.

[0008] The technical solution is:

[0009] A method applied to a transaction access path adaptive system, comprising a collaborative signature client, a collaborative signature server, a business server, a centralized storage module and a certificate issuance server, wherein the collaborative signature client, the collaborative signature server, the business server, the centralized storage module and the certificate issuance server are sequentially connected, wherein the collaborative signature client comprises a client and a collaborative signature SDK, wherein the client, the collaborative signature SDK and the collaborative signature server are sequentially connected;

[0010] The collaborative signing client performs the following operations in the scenario where there is no SSL private dual certificate:

[0011] S1: The collaborative signature SDK, collaborative signature server, and business server receive user legitimacy verification information from the client in turn;

[0012] S2: The client receives the verification information from the service server;

[0013] S3: The centralized storage module cooperates with the business server to save the identity authentication result;

[0014] S4: The collaborative signature SDK receives the certificate request from the client and extracts the terminal identification code;

[0015] S5: The collaborative signature server receives the certificate request, collaborative signature public key and terminal identification information from the collaborative signature SDK;

[0016] S6: The centralized storage module performs secondary verification on the information of the collaborative signature server;

[0017] S7: The collaborative signature server sends a certificate request to the certificate issuing server;

[0018] S8: The certificate issuing server responds to the collaborative signing server with a certificate;

[0019] S9: The centralized storage module stores the co-signing public key and terminal identification information;

[0020] S10: The centralized storage module feeds back a storage response message to the collaborative signature server;

[0021] S11: The collaborative signature server requests the certificate issuing server to issue a certificate;

[0022] S12: The certificate issuing server responds to the certificate issuing request;

[0023] S13: The collaborative signature server feeds back a certificate response message to the collaborative signature SDK;

[0024] S14: The collaborative signature SDK feeds back the decryption certificate information to the client;

[0025] The collaborative signing client performs the following operations in the scenario of SSL private dual certificates:

[0026] S15: After the collaborative signature SDK receives the extraction terminal identification code sent by the client, the collaborative signature SDK and the collaborative signature server perform national secret SSL two-way authentication;

[0027] S16: The centralized storage module queries the co-signing public key information;

[0028] S17: The collaborative signature SDK interacts with the collaborative signature server for collaborative signature verification;

[0029] S18: The collaborative signature SDK and the collaborative signature server encrypt and send information;

[0030] S19: The collaborative signature SDK and the collaborative signature server receive and decrypt information.

[0031] Preferably, in a scenario where there is no SSL private dual certificate, the collaborative signature client first establishes a channel with the backend through a preset certificate and password, verifies the legitimacy of the identity of the business layer, and the centralized storage module cooperates with the business server to save the identity authentication result. After the collaborative signature client and the collaborative signature server complete the secondary identity verification, the collaborative signature server forwards the certificate request sent by the collaborative signature client to the certificate issuance server. Finally, the collaborative signature client obtains the SM dual certificate and SSL encryption private key issued by the certificate issuance server, and the collaborative signature client completes the collaborative signature SSL channel that meets the requirements through the private dual certificate.

[0032] Preferably, the SSL preset dual certificate password channel is only set for three scenarios: application, update, and emergency of SSL private dual certificates.

[0033] Preferably, the GMSSL access server only needs to open one network port, and preset a 5-year valid SSL dual certificate when the collaborative signature client is packaged. Through the preset SSL dual certificate password channel, the initial business layer identity verification and the issuance of the SM2 national secret private dual certificate are completed, and business queries and transactions are completed through the GMSSL private dual certificate collaborative signature channel, saving network port resources and reducing network risks.

[0034] Preferably, the collaborative signature client actively detects the centralized storage status through the SSL dual-certificate collaborative signature channel. In the event of an abnormal centralized storage, the collaborative signature client automatically switches to the SSL preset dual-certificate password channel to complete business inquiries and transactions. No manual emergency switching and operation by the server is required, and no manual guarding and switching operations are required. Compared with the manual discovery and manual operation of ordinary solutions, the efficiency of emergency handling is improved.

[0035] Preferably, the certificate issuance server is abnormal, resulting in abnormal certificate issuance. The collaborative signature client autonomously uses the current password channel as an emergency channel to continue to complete business queries and transactions without the need for manual emergency switching and operation on the server. Compared with the manual discovery and manual operation of ordinary solutions, the efficiency of emergency handling is improved.

[0036] Preferably, the above method applied to the transaction access path adaptive system also includes an emergency process, and also includes an emergency process, the emergency process is aimed at centralized storage module failure and certificate issuance server failure.

[0037] Preferably, the centralized storage failure is divided into the loss of the collaborative signature public key and the abnormality of the centralized storage network port. The emergency process for the loss of the collaborative signature public key is as follows:

[0038] The centralized storage system contains the collaborative signature public key data required for the collaborative signature client to log in. The data between the master and slave are automatically synchronized in real time. If the collaborative signature public key data is lost in extreme scenarios, the collaborative signature client will automatically go through the SSL private dual certificate application process again.

[0039] The emergency procedures for centralized storage network port abnormalities are as follows:

[0040] If a network port abnormality occurs, the centralized storage adopts a master-slave deployment mode. If a complete system downtime occurs under extreme circumstances, the collaborative signature client directly switches to the SSL preset dual certificate password channel to ensure business continuity.

[0041] Preferably, the emergency process for certificate issuance server failure is as follows:

[0042] The certificate issuance server is an SSL dual certificate issuance service. It achieves high availability by attaching multiple IP addresses to the domain name. If it is unavailable under extreme circumstances, the collaborative signature client will automatically switch to the SSL preset dual certificate password channel to ensure business continuity.

[0043] A transaction access path adaptive security system, characterized in that the system comprises:

[0044] Collaborative signature client, used to initiate user legitimacy verification information and certificate requests;

[0045] The collaborative signature server is used to receive and process information from the collaborative signature client and send certificate requests to the certificate issuing server;

[0046] The business server is used to receive and process information from the collaborative signature server and send receipt verification information to the client;

[0047] Centralized storage module, used to store identity authentication results, co-signing public keys, terminal identification information and certificate-related information, and perform secondary verification on the information;

[0048] The certificate issuing server is used to respond to the certificate request from the collaborative signing server.

[0049] Compared with the prior art, the above technical solution conceived by the present invention has the following advantages:

[0050] 1. Reduce network risks: GMSSL access server only needs to open one network port, which reduces the number of network ports and thus reduces the network risks caused by the increase in ports. The collaborative signature client is packaged with a pre-set 5-year valid SSL dual certificate, which reduces the complexity of certificate management and maintenance.

[0051] 2. Improve emergency handling efficiency: The collaborative signature client can automatically detect the centralized storage status and automatically switch to the SSL preset dual certificate password channel under abnormal circumstances to complete business inquiries and transactions. There is no need for manual emergency switching and operation on the server side. The emergency switching time is shortened to less than 1 second. When the certificate issuance server or KMS fails, the collaborative signature client can autonomously use the current password channel as an emergency channel to continue to complete business inquiries and transactions, ensuring business continuity.

[0052] 3. Reduce maintenance workload: The server does not need to maintain two network ports and two sets of SSL certificates (one-way SSL certificate, two-way SSL certificate), which reduces the maintenance workload of certificates and ports. There is no need to maintain the newly added RA system separately, which reduces the complexity and maintenance cost of the system.

[0053] 4. Enhance system security: Adopt GMSSL protocol for encrypted communication and data integrity protection, support SSL / TSLS secure communication protocol based on SM2 commercial secret dual certificate, improve system security, establish two-way authenticated secure channel through SSL preset dual certificate password channel and SSL private dual certificate collaborative signature channel, enhance system identity authentication and access control.

[0054] 5. Optimize user experience: In emergency situations, the collaborative signature client can automatically perform emergency switching without the need for manual operation by the user, which improves the user experience. By optimizing emergency handling processes and innovative technologies, it ensures the continuity of business in abnormal situations and protects users' normal transactions.

[0055] 6. High availability design: The centralized storage system contains the collaborative signature public key data required for the collaborative signature client to log in. The data between the master and slave are automatically synchronized in real time, which improves the availability and fault tolerance of the system. The certificate issuance server serves as an SSL dual certificate issuance service, and achieves high availability by hanging multiple IP addresses behind the domain name, further enhancing the stability and reliability of the system.

[0056] 7. Flexibility and scalability: It provides a variety of emergency response solutions to deal with abnormal situations in different scenarios, ensuring the flexibility and scalability of the system, with reasonable design and easy upgrade and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a schematic diagram of the overall process of the present invention.

[0058] Figure 2 It is a schematic diagram of the national secret transformation process of the present invention. DETAILED DESCRIPTION

[0059] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0060] Example

[0061] A method for applying a transaction access path adaptive system, such as Figure 1 As shown, it includes a collaborative signature client, a collaborative signature server, a business server, a centralized storage module and a certificate issuance server, and the collaborative signature client, the collaborative signature server, the business server, the centralized storage module and the certificate issuance server are connected in sequence.

[0062] Collaborative Signature Client

[0063] The collaborative signature client consists of the client and the collaborative signature SDK. The client is the entry point for user interaction and is responsible for receiving user instructions and input information. The collaborative signature SDK serves as a bridge between the client and the server and is responsible for handling communication and data exchange with the collaborative signature server.

[0064] Collaborative signature server

[0065] The collaborative signature server is responsible for receiving the certificate request and identity authentication information from the collaborative signature client. After secondary verification, it forwards the request to the certificate issuing server, receives the response from the certificate issuing server, and finally feeds back the certificate response message to the collaborative signature client.

[0066] Business Server

[0067] The business server is responsible for processing the securities trading business logic, receiving the identity authentication results and transaction requests from the collaborative signature server, and returning the results to the client after business processing.

[0068] Centralized storage module

[0069] The centralized storage module is responsible for storing key data such as identity authentication results, co-signing public keys, and terminal identification information to ensure data integrity and security. At the same time, the centralized storage module is also responsible for cooperating with the business server to query and update identity authentication results.

[0070] Certificate Issuing Server

[0071] The certificate issuing server is responsible for issuing SSL private dual certificates to ensure the communication security between the co-signing client and the co-signing server. At the same time, the certificate issuing server is also responsible for processing certificate renewal and revocation requests from the co-signing server.

[0072] A method applied to a transaction access path adaptive system, the method comprising the following steps:

[0073] No certificate

[0074] 1. The client sends user legitimacy verification information to the collaborative signature server through the collaborative signature SDK.

[0075] 2. After receiving the verification information, the collaborative signature server forwards it to the business server for identity verification.

[0076] 3. After the business server verifies the user's identity, it returns the verification result to the collaborative signature server and saves the verification result through the centralized storage module.

[0077] 4. The collaborative signature client sends a certificate request and extracts the terminal identification code to the collaborative signature server through the collaborative signature SDK.

[0078] 5. After receiving the certificate request, the collaborative signature server forwards the request information, the collaborative public key and the terminal identification information to the certificate issuing server.

[0079] 6. The centralized storage module performs secondary verification on the information of the collaborative signature server to ensure the accuracy and completeness of the information.

[0080] 7. The certificate issuance server responds to the certificate request from the co-signing server and issues an SSL private dual certificate.

[0081] 8. The centralized storage module stores the cooperative signature public key and terminal identification information, and feeds back the storage response message to the cooperative signature server.

[0082] 9. The collaborative signature server feeds back the certificate response message to the collaborative signature SDK, and the collaborative signature SDK finally feeds back the decrypted certificate information to the client.

[0083] With certificate

[0084] 1. The collaborative signature client sends a request to extract the terminal identification code to the collaborative signature server through the collaborative signature SDK.

[0085] 2. The collaborative signature SDK and the collaborative signature server perform national secret SSL two-way authentication to ensure the identity security of both communicating parties.

[0086] 3. The centralized storage module queries the co-signed public key information to ensure the accuracy and validity of the public key.

[0087] 4. The collaborative signature SDK interacts with the collaborative signature server to verify the signature and ensure the integrity and authenticity of the data.

[0088] 5. The collaborative signature SDK and the collaborative signature server perform two-way encrypted information transmission to ensure the confidentiality and security of the information.

[0089] 6. The collaborative signature server decrypts the encrypted information and forwards it to the business server for business processing.

[0090] To further optimize the above solution, the GMSSL access server only needs to open one network port, and preset the SSL preset dual certificate password channel with a 5-year validity period of the SSL dual certificate when the collaborative signature client is packaged. Through the preset SSL dual certificate password channel, the first business layer identity verification and the issuance of the SM2 national secret dual certificate are completed, and the SSL private dual certificate is issued. Business queries and transactions are completed through the GMSSL private dual certificate collaborative signature channel, saving network port resources and reducing network risks.

[0091] To further optimize the above solution, the collaborative signature client actively detects the centralized storage status through the SSL dual-certificate collaborative signature channel. In the event of an abnormal centralized storage, the collaborative signature client automatically switches to the SSL preset dual-certificate password channel to complete business queries and transactions. No manual emergency switching and operation is required on the server side, and no manual guarding and switching operations are required. Compared with the manual discovery and manual operation of ordinary solutions (emergency switching at the minute level), automatic emergency response within 1 second is achieved, which improves the efficiency of emergency response and is only one thousandth of the time spent on emergency response of ordinary solutions.

[0092] To further optimize the above solution, if the third-party certificate issuance server is abnormal, resulting in abnormal certificate issuance, the collaborative signature client will autonomously use the current password channel as the emergency channel to continue to complete business queries and transactions. There is no need for manual emergency switching and operation on the server. Compared with the manual discovery and manual operation of ordinary solutions (15-minute emergency switching), automatic emergency switching within 1 second can be achieved, which is seamless for customers and improves the efficiency of emergency handling. It is only one thousandth of the time spent on emergency response of ordinary solutions.

[0093] A method for applying a transaction access path adaptive system, such as Figure 2 As shown, the emergency procedures are as follows:

[0094] Centralized storage failure

[0095] 1. The collaborative signature public key is lost

[0096] The centralized storage system contains the collaborative signature public key data required for the collaborative signature client to log in. The data between the master and slave are automatically synchronized in real time. If the collaborative signature public key data is lost in extreme scenarios, the collaborative signature client will automatically go through the SSL private dual certificate application process again.

[0097] 2. Centralized storage network port abnormality

[0098] If a network port anomaly occurs, the centralized storage adopts a master-slave deployment mode. If a complete system downtime occurs in an extreme situation, the collaborative signature client directly switches to the SSL preset dual certificate password channel to ensure business continuity.

[0099] Certificate issuance server failure

[0100] The certificate issuance server is an SSL dual certificate issuance service. It achieves high availability by attaching multiple IP addresses to the domain name. If it is unavailable under extreme circumstances, the collaborative signature client will automatically switch to the SSL preset dual certificate password channel to ensure business continuity.

[0101] A transaction access path adaptive security system, characterized in that the system comprises:

[0102] Collaborative signature client, used to initiate user legitimacy verification information and certificate requests;

[0103] The collaborative signature server is used to receive and process information from the collaborative signature client and send certificate requests to the certificate issuing server;

[0104] The business server is used to receive and process information from the collaborative signature server and send receipt verification information to the client;

[0105] Centralized storage module, used to store identity authentication results, co-signing public keys, terminal identification information and certificate-related information, and perform secondary verification on the information;

[0106] The certificate issuing server is used to respond to the certificate request from the collaborative signing server.

[0107] Although the present disclosure has been shown and described with reference to specific exemplary embodiments of the present disclosure, it should be understood by those skilled in the art that various changes in form and details may be made to the present disclosure without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents. Therefore, the scope of the present disclosure should not be limited to the above-mentioned embodiments, but should be determined not only by the appended claims, but also by the equivalents of the appended claims.

Claims

1. A method applied to a transaction access path adaptive system, characterized in that: It includes a collaborative signature client, a collaborative signature server, a business server, a centralized storage module and a certificate issuance server, which are connected in sequence. The collaborative signature client includes a client and a collaborative signature SDK, and the client, the collaborative signature SDK and the collaborative signature server are connected in sequence. The collaborative signing client performs the following operations in the scenario where there is no SSL private dual certificate: S1: The collaborative signature SDK, collaborative signature server, and business server receive user legitimacy verification information from the client in turn; S2: The client receives the verification information from the service server. S3: The centralized storage module cooperates with the business server to save the identity authentication result; S4: The collaborative signature SDK receives the certificate request from the client and extracts the terminal identification code; S5: The collaborative signature server receives the certificate request, collaborative signature public key and terminal identification information from the collaborative signature SDK; S6: The centralized storage module performs secondary verification on the information of the collaborative signature server; S7: The collaborative signature server sends a certificate request to the certificate issuing server; S8: The certificate issuing server responds to the collaborative signing server with a certificate; S9: The centralized storage module stores the co-signing public key and terminal identification information; S10: The centralized storage module feeds back a storage response message to the collaborative signature server; S11: The collaborative signature server requests the certificate issuing server to issue a certificate; S12: The certificate issuing server responds to the certificate issuing request; S13: The collaborative signature server feeds back a certificate response message to the collaborative signature SDK; S14: The collaborative signature SDK feeds back the decryption certificate information to the client; The collaborative signing client performs the following operations in the scenario of SSL private dual certificates: S15: After the collaborative signature SDK receives the extraction terminal identification code sent by the client, the collaborative signature SDK and the collaborative signature server perform national secret SSL two-way authentication; S16: The centralized storage module queries the co-signing public key information; S17: The collaborative signature SDK interacts with the collaborative signature server for collaborative signature verification; S18: The collaborative signature SDK and the collaborative signature server encrypt and send information; S19: The collaborative signature SDK and the collaborative signature server receive and decrypt information.

2. A method for applying to a transaction access path adaptive system according to claim 1, characterized in that: In the scenario where there is no SSL private dual certificate, the collaborative signature client first establishes a channel with the backend through the preset certificate and password, verifies the legitimacy of the identity of the business layer, and the centralized storage module cooperates with the business server to save the identity authentication result. After the collaborative signature client and the collaborative signature server complete the secondary identity verification, the collaborative signature server forwards the certificate request sent by the collaborative signature client to the certificate issuance server. Finally, the collaborative signature client obtains the SM dual certificate and SSL encryption private key issued by the certificate issuance server, and the collaborative signature client completes the collaborative signature SSL channel that meets the requirements through the private dual certificate.

3. A method for applying to a transaction access path adaptive system as claimed in claim 2, characterized in that: The SSL preset dual certificate password channel is only set for three scenarios: application, update, and emergency of SSL private dual certificates.

4. A method for applying to a transaction access path adaptive system as claimed in claim 3, characterized in that: GMSSL access server only needs to open a network port, and preset a 5-year valid SSL dual certificate when the collaborative signature client is packaged. Through the preset SSL dual certificate password channel, the first business layer identity verification and the issuance of SM2 national secret private dual certificate are completed, and business queries and transactions are completed through the GMSSL private dual certificate collaborative signature channel, saving network port resources and reducing network risks.

5. A method for applying to a transaction access path adaptive system as claimed in claim 4, characterized in that: The collaborative signature client actively detects the centralized storage status through the SSL dual-certificate collaborative signature channel. In the event of an abnormal centralized storage, the collaborative signature client automatically switches to the SSL preset dual-certificate password channel to complete business inquiries and transactions. There is no need for manual emergency switching and operation on the server side, and no need for manual guarding and switching operations. Compared with the manual discovery and manual operation of ordinary solutions, the efficiency of emergency handling is improved.

6. A method for applying to a transaction access path adaptive system as claimed in claim 5, characterized in that: The certificate issuance server is abnormal, resulting in abnormal certificate issuance. The collaborative signature client autonomously uses the current password channel as an emergency channel to continue to complete business queries and transactions. There is no need for manual emergency switching and operation on the server. Compared with the manual discovery and manual operation of ordinary solutions, the efficiency of emergency handling is improved.

7. A method for applying to a transaction access path adaptive system as claimed in claim 6, characterized in that: It also includes emergency procedures for failures in the centralized storage module and the certificate issuance server.

8. A method for applying to a transaction access path adaptive system as claimed in claim 7, characterized in that: The centralized storage failures are classified into the loss of the collaborative signature public key and the abnormality of the centralized storage network port. The emergency process for loss of collaborative signature public key is as follows: The centralized storage system contains the collaborative signature public key data required for the collaborative signature client to log in. The data between the master and slave are automatically synchronized in real time. If the collaborative signature public key data is lost in extreme scenarios, the collaborative signature client will automatically go through the SSL private dual certificate application process again. The emergency procedures for centralized storage network port abnormalities are as follows: If a network port abnormality occurs, the centralized storage adopts a master-slave deployment mode. If a complete system downtime occurs under extreme circumstances, the collaborative signature client directly switches to the SSL preset dual certificate password channel to ensure business continuity.

9. A method for applying to a transaction access path adaptive system as claimed in claim 8, characterized in that: The emergency process for certificate issuance server failure is as follows: The certificate issuance server is an SSL dual certificate issuance service. It achieves high availability by attaching multiple IP addresses to the domain name. If it is unavailable under extreme circumstances, the collaborative signature client will automatically switch to the SSL preset dual certificate password channel to ensure business continuity.

10. A transaction access path adaptive system, characterized in that: The system comprises: Collaborative signature client, used to initiate user legitimacy verification information and certificate requests; The collaborative signature server is used to receive and process information from the collaborative signature client and send certificate requests to the certificate issuing server; The business server is used to receive and process information from the collaborative signature server and send receipt verification information to the client; Centralized storage module, used to store identity authentication results, co-signing public keys, terminal identification information and certificate-related information, and perform secondary verification on the information; The certificate issuing server is used to respond to the certificate request from the collaborative signing server.

Images