Security authentication and bank-enterprise direct connection docking method and system based on open platform

Abstract

The invention discloses a security authentication and bank-enterprise direct connection docking method and system based on an open platform, and relates to the technical field of bank business systems, and the method comprises the steps: constructing a bank open platform, and deploying an SDK (Software Development Kit) matched with the bank open platform in an enterprise; after the enterprise signs a contract with the bank based on the operation platform, the information of the signed enterprise and the public and private key pair are synchronized to the bank open platform; the bank open platform automatically creates enterprise account docking information based on the signed enterprise information, and feeds back the enterprise account docking information to the enterprise; enterprise account docking information is input based on the SDK, an API of a bank open platform is called, and digital signature and encryption are performed by using public and private keys; and calling an API based on the SDK to complete bank-enterprise direct connection and docking business service. Through the technical scheme of the invention, the deployment cost is reduced, the deployment efficiency is improved, and the earlier-stage investment and long-term maintenance expenditure are greatly reduced.

Description

Technical Field

[0001] This invention relates to the field of banking business system technology, and in particular to a secure authentication and bank-enterprise direct connection method based on an open platform, as well as a secure authentication and bank-enterprise direct connection system based on an open platform. Background Technology

[0002] Currently, traditional bank-enterprise direct connections employ a two-sided interface structure. On the enterprise side, a front-end server or proxy application is deployed to communicate with the bank. These components convert enterprise system calls into encrypted messages conforming to bank standards, send them to the bank, and receive corresponding responses. On the bank side, a receiving module is deployed to connect the received messages with the bank's core system for authentication, decryption, processing, signing, and response return.

[0003] However, the above technical solution has the following objective drawbacks: (1) High technical complexity: Front-end / agent applications usually require independent installation and environment configuration (such as JDK version, port settings, etc.), resulting in high integration costs; front-end applications of different banks vary significantly, with inconsistent interface specifications, operation steps, and certificate processing, leading to long debugging cycles.

[0004] (2) High maintenance costs: Physical equipment (front-end machine, U-Key) is required, which brings hardware procurement and maintenance investment; from preparation to joint debugging and launch, the cycle is generally several weeks to several months, especially involving the procurement and configuration of hardware equipment and U-Key.

[0005] (3) Limited concurrent performance: Although the common mode (front-end machine + U-Key) is secure, its concurrent processing capability is limited. It is recommended that the concurrent processing capacity not exceed tens of messages per second. Expansion requires attaching more U-Keys or deploying multiple proxy nodes, which greatly increases complexity and cost. Summary of the Invention

[0006] To address the aforementioned issues, this invention provides a secure authentication and bank-enterprise direct connection method and system based on an open platform. By connecting the bank's open platform with an appropriate SDK (Software Development Kit), it eliminates the need for a front-end machine or U-Key hardware device to call the bank's API (Application Programming Interface), requiring no additional hardware, thus reducing deployment costs, improving deployment efficiency, and significantly compressing upfront investment and long-term maintenance expenses. Digital signatures and encryption using "software certificates" prevent man-in-the-middle attacks and eavesdropping, meeting security and compliance requirements.

[0007] To achieve the above objectives, this invention provides a secure authentication and direct bank-enterprise connection method based on an open platform, comprising: Build an open platform for the bank and deploy an SDK adapted to the open platform within the enterprise; After the enterprise signs an agreement with the bank based on the operating platform, the enterprise's information and public / private key pair will be synchronized to the bank's open platform. The bank's open platform automatically creates enterprise account connection information based on the information of the contracted enterprise, and then feeds back the enterprise account connection information to the enterprise. Based on the SDK, the enterprise account connection information is input, the API of the bank's open platform is called, and the public and private keys are used for digital signature and encryption. The API is called based on the SDK to complete the direct connection service between banks and enterprises.

[0008] In the above technical solution, preferably, after the enterprise signs an agreement with the bank based on the operating platform, it synchronizes the enterprise's information and public / private key pair to the bank's open platform. The specific process includes: The enterprise initiates a signing application at the bank counter, and completes the offline signing and business setup by reading the signing agreement and determining the products to be activated based on the operation platform; After the signing is completed, the company information and product information will be synchronized to the bank's open platform; The enterprise inputs a key, which is then converted into a security key based on a key derivation function, and the public and private key pairs are stored in an encrypted manner.

[0009] In the above technical solution, preferably, the bank open platform automatically creates enterprise account connection information based on the contracted enterprise information, and the specific process includes: The bank's open platform automatically completes the account creation, information completion, application creation, and product application process based on the received enterprise and product information.

[0010] In the above technical solution, preferably, the API of the bank's open platform is called, and the public and private keys are used for digital signature and encryption. The specific process includes: The enterprise calls the API to the bank's open platform based on the SDK; The signature request is constructed using fragments of the first private key, and a collaborative signature is requested from the bank's open platform. The bank's open platform uses a second private key fragment corresponding to the enterprise for pre-signing processing and returns the pre-signing result to the enterprise's SDK, which then uses the first private key fragment to construct the final signature.

[0011] In the above technical solution, preferably, the specific process of converting the input key into a security key based on the key derivation function includes: By triggering a key generation request, current machine information is collected, and a digest is calculated based on the collected information. The calculated digest is then used as seed data. Based on the preset output key length, the seed data and the initialization counter are hashed, and the calculation results are concatenated until the generated key length meets the output key length, thus obtaining the final key.

[0012] This invention also proposes a secure authentication and bank-enterprise direct connection system based on an open platform, applying the secure authentication and bank-enterprise direct connection method based on an open platform disclosed in any of the above technical solutions, including: The bank-enterprise deployment module is used to build a bank open platform and deploy an SDK adapted to the bank open platform in the enterprise. The bank-enterprise signing module is used to synchronize the enterprise's information and public / private key pair to the bank's open platform after the enterprise signs an agreement with the bank based on the operating platform. The information synchronization module is used by the bank's open platform to automatically create enterprise account connection information based on the contracted enterprise information and to feed back the enterprise account connection information to the enterprise. The encryption and signature module is used to input the enterprise account connection information into the SDK, call the API of the bank's open platform, and perform digital signature and encryption using the public and private key pair; The business integration module is used to call the API based on the SDK to complete the direct connection business service between banks and enterprises.

[0013] In the above technical solution, preferably, the bank-enterprise signing module is specifically used for: The enterprise initiates a signing application at the bank counter, and completes the offline signing and business setup by reading the signing agreement and determining the products to be activated based on the operation platform; After the signing is completed, the company information and product information will be synchronized to the bank's open platform; The enterprise inputs a key, which is then converted into a security key based on a key derivation function, and the public and private key pairs are stored in an encrypted manner.

[0014] In the above technical solution, preferably, the information synchronization module is specifically used for: The bank's open platform automatically completes the account creation, information completion, application creation, and product application process based on the received enterprise and product information.

[0015] In the above technical solution, preferably, the encryption signature module is specifically used for: The enterprise calls the API to the bank's open platform based on the SDK; The signature request is constructed using fragments of the first private key, and a collaborative signature is requested from the bank's open platform. The bank's open platform uses a second private key fragment corresponding to the enterprise for pre-signing processing and returns the pre-signing result to the enterprise's SDK, which then uses the first private key fragment to construct the final signature.

[0016] In the above technical solution, preferably, the specific process by which the bank-enterprise signing module converts the input key into a security key based on the key derivation function includes: By triggering a key generation request, current machine information is collected, and a digest is calculated based on the collected information. The calculated digest is then used as seed data. Based on the preset output key length, the seed data and the initialization counter are hashed, and the calculation results are concatenated until the generated key length meets the output key length, thus obtaining the final key.

[0017] Compared with existing technologies, the beneficial effects of this invention are as follows: by connecting the bank's open platform and the adapted SDK through direct bank-enterprise connection, there is no need to rely on the front-end machine or U-Key hardware device to call the bank's API. No additional hardware is required, which reduces deployment costs, improves deployment efficiency, and significantly reduces upfront investment and long-term maintenance expenses. Digital signature and encryption are performed through "software certificates" to prevent man-in-the-middle attacks and eavesdropping, which meets security and compliance requirements. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a security authentication and bank-enterprise direct connection method based on an open platform, as disclosed in one embodiment of the present invention. Figure 2 This is a schematic diagram of a bank-enterprise signing process disclosed in one embodiment of the present invention; Figure 3 This is a schematic diagram of the key derivation process disclosed in one embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] The present invention will now be described in further detail with reference to the accompanying drawings: like Figure 1and Figure 2 As shown, a secure authentication and bank-enterprise direct connection method based on an open platform provided by the present invention includes: Build an open platform for banks and deploy SDKs that are compatible with the open platform within enterprises; After an enterprise signs an agreement with a bank based on the operating platform, the enterprise's information and public / private key pair will be synchronized to the bank's open platform. The bank's open platform automatically creates enterprise account connection information based on the information of the contracted enterprises and then feeds the enterprise account connection information back to the enterprises. Based on the SDK, input the enterprise account information, call the API of the bank's open platform, and use public and private keys to perform digital signature and encryption; Based on the SDK, call the API to complete the direct connection business service between banks and enterprises.

[0021] In this implementation, the bank's open platform and the adapted SDK are connected directly between the bank and the enterprise, eliminating the need to rely on a front-end machine or U-Key hardware device to call the bank's API. This reduces deployment costs, improves deployment efficiency, and significantly reduces upfront investment and long-term maintenance expenses. Digital signatures and encryption are performed through "software certificates" to prevent man-in-the-middle attacks and eavesdropping, thus meeting security and compliance requirements.

[0022] Specifically, through this system, enterprise systems or ERP (Enterprise Resource Planning) can directly call the bank's API via the network (Internet / IP whitelist), reducing dimensional costs through a no-pre-connection approach while improving concurrency performance. Standardized APIs are provided through the bank's open platform, avoiding deployment on each client side; users only need to call the API to perform business integrations such as account inquiries and payment initiation. Digital signatures and encryption are performed using a "software certificate" provided by the bank, rather than inserting a U-Key.

[0023] The bank-enterprise direct connection interface system based on the open platform refers to a system where enterprises no longer need to deploy local front-end machines, U-Keys, or other devices. Instead, they use the bank-enterprise direct connection SDK provided by the open platform to complete the "encrypted signature + standardized API access" process, thereby connecting with the bank system to realize business functions such as fund inquiry, transfer, and receipt, which greatly simplifies the operation and maintenance difficulty and improves concurrency capabilities and cloud-native compatibility.

[0024] In the above implementation, preferably, after the enterprise signs an agreement with the bank based on the operating platform, the enterprise's information and public / private key pair are synchronized to the bank's open platform. The specific process includes: Enterprises initiate a signing application at the bank counter, read the signing agreement and determine the products to be activated based on the operation platform, and complete the offline signing and business settings through the counter; After the signing is completed, the company information and product information will be synchronized to the bank's open platform; The enterprise inputs a key, which is then converted into a security key based on a key derivation function, and the public and private key pairs are stored in an encrypted manner.

[0025] In the above implementation method, preferably, the bank's open platform automatically creates enterprise account connection information based on the contracted enterprise information, and the specific process includes: The bank's open platform automatically completes the account creation, information completion, application creation, and product application process based on the received enterprise and product information, and sends the relevant parameters required for technical integration testing to the enterprise. The enterprise conducts its own integration testing, submits a test report after passing the test, and applies for product launch. Once the launch is approved, the platform updates the enterprise's API call permission information, allowing the enterprise to officially call the relevant APIs.

[0026] In the above implementation, preferably, the API of the bank's open platform is invoked, and digital signature and encryption are performed using public and private keys. The specific process includes: Enterprises can use the SDK to access APIs from banks' open platforms. Use the first private key fragment to construct a signature request and apply for a collaborative signature from the bank's open platform; The bank's open platform uses a second private key fragment corresponding to the enterprise for pre-signing processing and returns the pre-signing result to the enterprise's SDK, which then uses the first private key fragment to construct the final signature.

[0027] like Figure 3 As shown, in the above embodiment, preferably, the specific process of converting the input key into a security key based on the key derivation function includes: By triggering a key generation request, information such as the current machine's IP, MAC, and disk serial number is collected, and a digest is calculated based on the collected information. The calculated digest is then used as the seed data Z. Based on the preset output key length klen, the seed data Z and the initialization counter ct (initial value is 1) are used to perform SM3 hash calculation, and the calculation results are concatenated until the generated key length meets the output key length klen, thus obtaining the final key.

[0028] This invention also proposes a secure authentication and bank-enterprise direct connection system based on an open platform, applying the secure authentication and bank-enterprise direct connection method based on an open platform disclosed in any of the above embodiments, including: The bank-enterprise deployment module is used to build a bank open platform and deploy an SDK that is compatible with the bank's open platform in the enterprise. The bank-enterprise signing module is used to synchronize the information of the signing enterprise and the public and private key pairs of the signing enterprise to the bank's open platform after the enterprise signs an agreement with the bank based on the operating platform. The information synchronization module is used by the bank's open platform to automatically create enterprise account connection information based on the contracted enterprise information and then feed the enterprise account connection information back to the enterprise. The encryption and signature module is used to input enterprise account information based on the SDK, call the API of the bank's open platform, and perform digital signature and encryption using public and private key pairs; The business integration module is used to call APIs based on the SDK to complete the direct connection business service between banks and enterprises.

[0029] In the above embodiments, preferably, the bank-enterprise signing module is specifically used for: Enterprises initiate a signing application at the bank counter, and based on the operation platform, read the signing agreement and determine the products to be activated, and complete the offline signing and business setup; After the signing is completed, the company information and product information will be synchronized to the bank's open platform; The enterprise inputs a key, which is then converted into a security key based on a key derivation function, and the public and private key pairs are stored in an encrypted manner.

[0030] In the above embodiments, preferably, the information synchronization module is specifically used for: The bank's open platform automatically completes the account creation, information completion, application creation, and product application process based on the received enterprise and product information.

[0031] In the above embodiments, preferably, the encryption signature module is specifically used for: Enterprises can use the SDK to access APIs from banks' open platforms. Use the first private key fragment to construct a signature request and apply for a collaborative signature from the bank's open platform; The bank's open platform uses a second private key fragment corresponding to the enterprise for pre-signing processing and returns the pre-signing result to the enterprise's SDK, which then uses the first private key fragment to construct the final signature.

[0032] In the above embodiments, preferably, the specific process by which the bank-enterprise signing module converts the input key into a security key based on the key derivation function includes: By triggering a key generation request, current machine information is collected, and a digest is calculated based on the collected information. The calculated digest is then used as seed data. Based on the preset output key length, the seed data and the initialization counter are hashed, and the calculation results are concatenated until the generated key length meets the output key length, thus obtaining the final key.

[0033] According to the above-described implementation method, the functions to be implemented by each module of the security authentication and bank-enterprise direct connection system based on the open platform correspond to the steps of the security authentication and bank-enterprise direct connection method based on the open platform disclosed in the above-described implementation method. During implementation, the above-described implementation method shall be referred to for operation, and will not be described again here.

[0034] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for secure authentication and direct bank-enterprise connection based on an open platform, characterized in that, include: Build an open platform for the bank and deploy an SDK adapted to the open platform within the enterprise; After the enterprise signs an agreement with the bank based on the operating platform, the enterprise's information and public / private key pair will be synchronized to the bank's open platform. The bank's open platform automatically creates enterprise account connection information based on the information of the contracted enterprise, and then feeds back the enterprise account connection information to the enterprise. Based on the SDK, the enterprise account connection information is input, the API of the bank's open platform is called, and the public and private keys are used for digital signature and encryption. The API is called based on the SDK to complete the direct connection service between banks and enterprises.

2. The security authentication and direct bank-enterprise connection method based on an open platform as described in claim 1, characterized in that, After the enterprise signs an agreement with the bank based on the operating platform, it will synchronize the enterprise's information and public / private key pair to the bank's open platform. The specific process includes: The enterprise initiates a signing application at the bank counter, and completes the offline signing and business setup by reading the signing agreement and determining the products to be activated based on the operation platform; After the signing is completed, the company information and product information will be synchronized to the bank's open platform; The enterprise inputs a key, which is then converted into a security key based on a key derivation function, and the public and private key pairs are stored in an encrypted manner.

3. The security authentication and direct bank-enterprise connection method based on an open platform according to claim 1, characterized in that, The bank's open platform automatically creates enterprise account integration information based on the signed enterprise information. The specific process includes: The bank's open platform automatically completes the account creation, information completion, application creation, and product application process based on the received enterprise and product information.

4. The security authentication and direct bank-enterprise connection method based on an open platform according to claim 1, characterized in that, The process involves calling the API of the bank's open platform and using the public and private keys to perform digital signatures and encryption. The specific steps include: The enterprise calls the API to the bank's open platform based on the SDK; The signature request is constructed using fragments of the first private key, and a collaborative signature is requested from the bank's open platform. The bank's open platform uses a second private key fragment corresponding to the enterprise for pre-signing processing and returns the pre-signing result to the enterprise's SDK, which then uses the first private key fragment to construct the final signature.

5. The security authentication and bank-enterprise direct connection method based on an open platform according to claim 2, characterized in that, The specific process of converting the input key into a secure key based on the key derivation function includes: By triggering a key generation request, current machine information is collected, and a digest is calculated based on the collected information. The calculated digest is then used as seed data. Based on the preset output key length, the seed data and the initialization counter are hashed, and the calculation results are concatenated until the generated key length meets the output key length, thus obtaining the final key.

6. A secure authentication and bank-enterprise direct connection system based on an open platform, characterized in that, The method for secure authentication and direct bank-enterprise connection based on an open platform, as described in any one of claims 1 to 5, includes: The bank-enterprise deployment module is used to build a bank open platform and deploy an SDK adapted to the bank open platform in the enterprise. The bank-enterprise signing module is used to synchronize the enterprise's information and public / private key pair to the bank's open platform after the enterprise signs an agreement with the bank based on the operating platform. The information synchronization module is used by the bank's open platform to automatically create enterprise account connection information based on the contracted enterprise information and to feed back the enterprise account connection information to the enterprise. The encryption and signature module is used to input the enterprise account connection information into the SDK, call the API of the bank's open platform, and perform digital signature and encryption using the public and private key pair; The business integration module is used to call the API based on the SDK to complete the direct connection business service between banks and enterprises.

7. The security authentication and bank-enterprise direct connection system based on an open platform as described in claim 6, characterized in that, The bank-enterprise signing module is specifically used for: The enterprise initiates a signing application at the bank counter, and completes the offline signing and business setup by reading the signing agreement and determining the products to be activated based on the operation platform; After the signing is completed, the company information and product information will be synchronized to the bank's open platform; The enterprise inputs a key, which is then converted into a security key based on a key derivation function, and the public and private key pairs are stored in an encrypted manner.

8. The security authentication and bank-enterprise direct connection system based on an open platform according to claim 6, characterized in that, The information synchronization module is specifically used for: The bank's open platform automatically completes the account creation, information completion, application creation, and product application process based on the received enterprise and product information.

9. The security authentication and bank-enterprise direct connection system based on an open platform according to claim 6, characterized in that, The encryption signature module is specifically used for: The enterprise calls the API to the bank's open platform based on the SDK; The signature request is constructed using fragments of the first private key, and a collaborative signature is requested from the bank's open platform. The bank's open platform uses a second private key fragment corresponding to the enterprise for pre-signing processing and returns the pre-signing result to the enterprise's SDK, which then uses the first private key fragment to construct the final signature.

10. The security authentication and bank-enterprise direct connection system based on an open platform according to claim 7, characterized in that, The specific process by which the bank-enterprise signing module converts the input key into a security key based on the key derivation function includes: By triggering a key generation request, current machine information is collected, and a digest is calculated based on the collected information. The calculated digest is then used as seed data. Based on the preset output key length, the seed data and the initialization counter are hashed, and the calculation results are concatenated until the generated key length meets the output key length, thus obtaining the final key.

Images