Transaction authentication method and device, equipment, storage medium and product

Abstract

The invention discloses a transaction authentication method, device and equipment, a storage medium and a product, and relates to the technical field of data security, and the transaction authentication method comprises the steps: receiving transaction information sent by terminal equipment through a first trusted security channel; acquiring card information of the SIM card through a second trusted secure channel with the SIM card; and performing transaction authentication according to the transaction information and the card information to obtain a transaction authentication result. According to the invention, after the transaction information sent by the terminal device through the first trusted secure channel is received, the transaction authentication is carried out on the transaction information through the card information acquired from the SIM card. Compared with an existing mode of carrying out authentication and transaction directly according to the transaction information sent by the terminal equipment, the mode provided by the invention can improve the security of the transaction and avoid transaction fraud.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a transaction authentication method and device, equipment, storage medium and product. BACKGROUND

[0002] With the deepening of digital transformation, the application of new technologies and new products is constantly breaking the security boundaries between systems, and transaction information security is facing unprecedented challenges. Due to the diversification of user identity and access terminal, the continuous innovation and strengthening of business integration, in order to better user experience, after the user completes the verification in one terminal, switching between different front-end channels often only needs to pass through one verification, and can be switched to another system through single sign-on and other methods without sensing or with little sensing. This way breaks the data boundary between systems, and the risk of data misuse is greater. The fusion of high and low security level data leads to permission pollution, passively raises the overall security level, breaks the balance between security and user experience. If the entry terminal is attacked, the system that trusts its single sign-on function will also be affected, and the attack will be difficult to close loop quickly, and it is difficult to form a global defense.

[0003] Whether the transaction sent by the front end to the back end is reliable, usually uses the verification signature method to confirm whether the ciphertext file received by the receiver is really sent by the sender, and whether it has been tampered with. The existing client-side signature verification is usually a collaborative encryption algorithm, which has high use cost and threshold, and there is a risk of transaction fraud. Therefore, how to improve the transaction authentication efficiency and avoid transaction fraud has become a technical problem to be solved. SUMMARY

[0004] The main purpose of the present application is to provide a transaction authentication method, device, equipment, storage medium and product, which aims to solve the technical problem of transaction fraud risk existing in the existing transaction authentication method.

[0005] To achieve the above purpose, the present application provides a transaction authentication method applied to a cloud server, the transaction authentication method comprising:

[0006] receiving transaction information sent by a terminal device through a first trusted secure channel;

[0007] obtaining card information of a SIM card through a second trusted secure channel between the SIM card and the terminal device;

[0008] performing transaction authentication according to the transaction information and the card information to obtain a transaction authentication result.

[0009] Optionally, before the step of receiving transaction information sent by a terminal device through a first trusted secure channel, the present application further comprises:

[0010] When receiving the connection message sent by the terminal device, a key index list corresponding to the terminal device is queried to obtain a decryption key;

[0011] The connection message is decrypted based on the decryption key to obtain a decryption result;

[0012] When the decryption result is decryption success, the decrypted connection message is subjected to HMAC verification to obtain a verification result;

[0013] According to the verification result, a first trusted secure channel is established with the terminal device.

[0014] Optionally, the step of establishing the first trusted secure channel with the terminal device according to the verification result comprises:

[0015] When the verification result is verification pass, a verification flag is added in a key negotiation parameter list, and a target port is opened;

[0016] Receiving certificate information sent by the terminal device;

[0017] According to the certificate information, the authority information of the terminal device is verified, and after the authority verification is passed, the validity of the connection certificate in the certificate information is verified to obtain a certificate verification result;

[0018] According to the certificate verification result, the target port, the verification flag and the terminal device, a first trusted secure channel is established.

[0019] Optionally, before the step of receiving the transaction information sent by the terminal device through the first trusted secure channel, the method further comprises:

[0020] A second trusted secure channel is established with the SIM card, and transaction parameter information sent by the SIM card based on the second trusted secure channel is received;

[0021] According to the transaction parameter information, a signature public key and a cloud key negotiation parameter are generated, and the signature public key and the cloud key negotiation parameter are sent to the SIM card;

[0022] The key negotiation parameter list and the key index list fed back by the SIM card based on the signature public key and the cloud key negotiation parameter are obtained, and the key negotiation parameter list and the key index list are stored.

[0023] In addition, to achieve the above-mentioned purpose, the application further provides a transaction authentication method applied to a terminal device, which comprises:

[0024] SIM card information is obtained through a third trusted secure channel established with the SIM card;

[0025] Generate transaction information according to the SIM card information and the transaction basic information, and send the transaction information to a cloud server through a first trusted secure channel;

[0026] Receive a transaction result fed back by the cloud server.

[0027] Optionally, before the step of sending the transaction information to the cloud server through the first trusted secure channel, the method further comprises:

[0028] Determine an encryption key according to an authorized access list and transaction parameter information;

[0029] Encrypt connection information based on the encryption key to obtain a connection message;

[0030] Send the connection message to the cloud server and receive a check result fed back by the cloud server;

[0031] When the check result is a check pass, generate certificate information and send the certificate information to the cloud server;

[0032] Receive a digital certificate fed back by the cloud server based on the certificate information, and perform identity authentication on the cloud server according to the data certificate;

[0033] When the identity authentication result is an authentication pass, establish a first trusted secure channel with the cloud server.

[0034] Optionally, before the step of generating transaction information according to the SIM card information and the transaction basic information, the method further comprises:

[0035] Establish a third trusted secure channel with a SIM card, and receive transaction parameter information sent by the SIM card based on the third trusted secure channel;

[0036] Generate terminal key negotiation parameters according to the transaction parameter information, and send the terminal key negotiation parameters to the SIM card;

[0037] Obtain an authorized access list fed back by the SIM card based on the terminal key negotiation parameters, and store the authorized access list.

[0038] In addition, to achieve the above object, the application further provides a transaction authentication device applied to a terminal device, which comprises:

[0039] A SIM card information acquisition module is configured to acquire SIM card information through a third trusted secure channel established with a SIM card;

[0040] The transaction information generation module is configured to generate transaction information according to the SIM card information and the basic transaction information, and send the transaction information to the cloud server through the first trusted secure channel.

[0041] The transaction result receiving module is configured to receive a transaction result fed back by the cloud server.

[0042] In addition, to achieve the above object, the application further provides a transaction authentication device applied to a cloud server, which comprises:

[0043] The receiving module is configured to receive transaction information sent by a terminal device through a first trusted secure channel.

[0044] The obtaining module is configured to obtain card information of a SIM card through a second trusted secure channel between the SIM card.

[0045] The transaction authentication module is configured to perform transaction authentication according to the transaction information and the card information, and obtain a transaction authentication result.

[0046] In addition, to achieve the above object, the application further provides a transaction authentication device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the transaction authentication method.

[0047] In addition, to achieve the above object, the application further provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the transaction authentication method.

[0048] In addition, to achieve the above object, the application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the transaction authentication method.

[0049] The application receives transaction information sent by a terminal device through a first trusted secure channel, obtains card information of a SIM card through a second trusted secure channel between the SIM card, and performs transaction authentication according to the transaction information and the card information to obtain a transaction authentication result. Since the application performs transaction authentication on the transaction information by using the card information obtained from the SIM card after receiving the transaction information sent by the terminal device through the first trusted secure channel, compared with the prior art of directly performing authentication and transaction according to the transaction information sent by the terminal device, the above method of the application can improve the security of transaction and avoid transaction fraud. BRIEF DESCRIPTION OF DRAWINGS

[0050] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the application and, together with the description, further serve to explain the principles of the application.

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings required by the embodiments or the prior art description will be briefly introduced as follows. Obviously, those skilled in the art can obtain other drawings from these drawings without any creative effort.

[0052] Figure 1 A flowchart provided for the transaction authentication method embodiment one of the present application;

[0053] Figure 2 A flowchart provided for the transaction authentication method embodiment two of the present application;

[0054] Figure 3 A flowchart provided for the transaction authentication method embodiment three of the present application;

[0055] Figure 4 A transaction diagram provided for the transaction authentication method embodiment three of the present application;

[0056] Figure 5 A flowchart provided for the transaction authentication method embodiment four of the present application;

[0057] Figure 6 An authorization authentication flowchart provided for the transaction authentication method embodiment four of the present application;

[0058] Figure 7 A security channel establishment flowchart provided for the transaction authentication method embodiment four of the present application;

[0059] Figure 8 A module structure diagram of the transaction authentication device embodiment one of the present application;

[0060] Figure 9 A module structure diagram of the transaction authentication device embodiment two of the present application;

[0061] Figure 10 A device structure diagram of the hardware running environment involved in the transaction authentication method in the embodiments of the present application.

[0062] The object implementation, functional features and advantages of the present application will be further explained with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0063] It should be understood that the specific embodiments described herein are merely intended to explain the technical solutions of the present application, and are not used to limit the present application.

[0064] For better understanding of the technical solutions of the present application, the following will be described in detail in combination with the drawings of the specification and specific embodiments.

[0065] The main solution of the embodiments of the present application is that a receiving terminal device sends transaction information through a first trusted secure channel; card information of a SIM card is obtained through a second trusted secure channel between the SIM card; transaction authentication is performed according to the transaction information and the card information, and a transaction authentication result is obtained. Since the present application performs transaction authentication on transaction information through card information obtained from a SIM card after the receiving terminal device sends the transaction information through a first trusted secure channel, compared with the prior art of directly performing authentication and transaction according to transaction information sent by a terminal device, the above-mentioned method of the present application can improve the security of transaction and avoid transaction fraud.

[0066] Based on this, the embodiments of the present application provide a transaction authentication method, which refers to Figure 1 , Figure 1 The flowchart of the first embodiment of the transaction authentication method of the present application is shown in the figure.

[0067] In the present embodiment, the transaction authentication method is applied to a cloud server, and the transaction authentication method comprises steps S10-S30:

[0068] Step S10, receiving transaction information sent by a terminal device through a first trusted secure channel;

[0069] It should be noted that the terminal device can be a terminal such as a user's mobile phone initiating transaction. The transaction information can be transaction details containing transaction amount, transaction subject and other information, for example, transaction such as charging fee. The first trusted secure channel can be a channel for transmitting information previously established between the terminal device and the cloud server.

[0070] Step S20, obtaining card information of a SIM card through a second trusted secure channel between the SIM card;

[0071] It should be noted that the card information can include a security element identifier (SEID) of the SIM card and token and other identifiers that can be used to confirm the unique identification and validity of the card. The second trusted secure channel can be a secure channel established between the cloud server and the SIM card through digital certificate and other means, in order to improve security, a digital certificate of a national encryption algorithm can be selected. The SIM card is a super SIM card installed on the terminal device.

[0072] Step S30, performing transaction authentication according to the transaction information and the card information, and obtaining a transaction authentication result.

[0073] It should be noted that the transaction authentication according to the transaction information and the card information to obtain the transaction authentication result can be to compare the card information in the transaction information with the card information obtained from the SIM card, and specifically can be to compare the SEID and other information. If the comparison is consistent, the authentication result is that the authentication is passed. Otherwise, the authentication is not passed, and the transaction is terminated.

[0074] The embodiment receives transaction information sent by a terminal device through a first trusted secure channel, obtains card information of a SIM card through a second trusted secure channel between the SIM card, and performs transaction authentication according to the transaction information and the card information to obtain a transaction authentication result. Since the embodiment performs transaction authentication on the transaction information through the card information obtained from the SIM card after receiving the transaction information sent by the terminal device through the first trusted secure channel, compared with the existing way of directly performing authentication and transaction according to the transaction information sent by the terminal device, the above-mentioned way of the embodiment can improve the security of the transaction and avoid transaction fraud.

[0075] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as the above-mentioned first embodiment can be referred to the above introduction, and will not be described in detail. On this basis, please refer to Figure 2 , before the step S10, further comprising steps S001-S004:

[0076] Step S001: When receiving a connection message sent by a terminal device, querying a key index list corresponding to the terminal device to obtain a decryption key;

[0077] It should be noted that the connection message can be a message requesting to establish a secure channel with a cloud service area, and can include connection port, protocol and other information. The key index list can include key negotiation parameters and a decryption key for decrypting data sent by the terminal device by the cloud server. Before step S001, the terminal device (i.e. client) and the cloud server (referred to as cloud) respectively establish a secure channel with a super SIM card, record the accessible cloud side information and signature credentials on the terminal device side through the super SIM card; record the client side key negotiation parameters and the key index list on the cloud side. Specifically, before step S001, further comprising: establishing a second trusted secure channel with the SIM card, and receiving transaction parameter information sent by the SIM card based on the second trusted secure channel;

[0078] Generating a signature public key and a cloud key negotiation parameter according to the transaction parameter information, and sending the signature public key and the cloud key negotiation parameter to the SIM card;

[0079] Obtaining a key negotiation parameter list and a key index list fed back by the SIM card based on the signature public key and the cloud key negotiation parameter, and storing the key negotiation parameter list and the key index list.

[0080] It should be noted that the second trusted secure channel with the SIM card can be established by a digital certificate. After the SIM card establishes a secure channel with the terminal device and the cloud server respectively, the super SIM card side selects a p-order additive cyclic group G and a p-order multiplicative cyclic group GT (p is a large prime number), and selects a generator Q of G; a true random number is generated by using a coprocessor of the super SIM card for generating a true random number. Given a bilinear mapping e: G x G→ G T , select a hash function H1: {0, 1} * → G and a hash function H2: Random signature private key and calculate S = sQ; randomly select Calculate the key parameter T = tQ. The super SIM card publishes the system parameters <G, G T , e, Q, S, T, H1, H2>, that is, the transaction parameter information, to the terminal device and the cloud server. The terminal device and the cloud server store the transaction parameter information respectively. The signature public key and the cloud key negotiation parameter generated according to the transaction parameter information can be generated by executing a key generation algorithm to generate a signature private key v sevr , and calculate the signature public key V sevr = v sevr Q, randomly select the private key Calculate the cloud key negotiation parameter PV sevr = A = aQ. The signature public key and the cloud key negotiation parameter can be sent to the SIM card by sending the identity ID sevr , the digital certificate Cert sevr , the network information Net sevr required for accessing the cloud side, the signature public key V sevr , the cloud key negotiation parameter PV sevr , and other information to the SIM card. The SIM card also receives the identity ID app , the digital certificate Cert app , the client key negotiation parameter PV app , and other information sent by the terminal device based on the transaction parameter information.

[0081] After the super SIM card receives the information from the cloud side and the terminal device, the following process is executed: verifying the identity and the digital certificate of the terminal device, and if the verification is passed, <ID app , Cert app , PV appStore into appList.

[0082] The super SIM card checks the identity and digital certificate of the cloud server, and records the information sent by the cloud server to serverList sevr , Cert sevr , Net sevr , V sevr , PV sevr > after verification.

[0083] The super SIM card records the terminal device and its authorized access cloud server association information app , ID sevr > to the authorization list authList. According to the correspondence of authList, the corresponding appList and serverList data can be obtained.

[0084] The super SIM card queries appList and authList, generates an appAuth sevr including all client key negotiation parameters with access permission, and sends it to the cloud server. The cloud server calculates the key Key1 sevr = H1(e(T, B) a ) in appAuth sevr , and establishes a key index list KeyList sevr = <B, Key1>.

[0085] It should be noted that the key index list corresponding to the terminal device can be queried according to the keyword B, that is, the client key negotiation parameter PV app , to obtain the decryption key Key1.

[0086] Step S002: decrypt the connection message based on the decryption key to obtain a decryption result;

[0087] In specific implementation, the cloud server decrypts the connection message according to the decrypted key to obtain plaintext data.

[0088] Step S003: when the decryption result is decryption success, perform HMAC verification on the decrypted connection message to obtain a verification result;

[0089] It should be noted that the HMAC verification is a message authentication code algorithm based on hash function and key, which is used to verify whether the message has been changed in the transmission process.

[0090] Step S004: according to the verification result, a first trusted secure channel is established with the terminal device.

[0091] It should be noted that the first trusted secure channel can be established according to the connection information in the connection message and the terminal device according to the verification result.

[0092] Further, in order to improve transaction security, the step S004. can include: when the verification result is verified, adding a verification flag in the key negotiation parameter list, and opening a target port;

[0093] Receiving the certificate information sent by the terminal device;

[0094] According to the certificate information, the permission information of the terminal device is verified, and after the permission verification is passed, the validity of the connection certificate in the certificate information is verified, and the certificate verification result is obtained;

[0095] According to the certificate verification result, the target port, the verification flag and the terminal device, a first trusted secure channel is established.

[0096] It should be noted that the verification flag can be added in the key negotiation parameter list appAuth sevr The corresponding parameter B is added, and the terminal device sends the certificate information. The signature algorithm Sign(m,s)→δ can be executed to sign the message using the random private key s to generate the signature voucher δ and the connection certificate m. The connection certificate information m=B||Lifetime||ID card , Lifetime is used to represent the validity period of the connection certificate, and ID card is used to represent the card ID, that is, the card application AID. According to the certificate information, the permission information of the terminal device can be verified according to the key B in the connection certificate m. The appAuth sevr list is queried, and the validity of the access permission of the terminal device is verified. The validity of the connection certificate in the certificate information can be verified by executing the designated signature verification algorithm DesignationVer(m,δ)→(0,1) to verify the correctness of the connection certificate m held by the terminal device. The verification method is: calculating δ=e(v sevrS, H1(m)) is equal, then it is verified. At the same time, whether the connection certificate is in the valid period is judged according to the life cycle Lifetime of the connection certificate m. The first trusted secure channel can be established between the terminal device and the cloud server according to the certificate verification result, the target port, the verification flag and the terminal device, that is, when the certificate verification result is verified, the digital certificate is sent to the terminal device, and the terminal device completes the identity authentication of the cloud server by using the digital certificate held by the cloud server. After the terminal device identity authentication is passed, the cloud server generates a transaction parameter according to the appAuth sevr The public key B in the certificate sent by the terminal device is verified whether the verification flag corresponding to the public key B is valid, and the TLS secure channel is established with the terminal device after the verification is passed.

[0097] In the embodiment, when the connection message sent by the terminal device is received, the key index list corresponding to the terminal device is queried to obtain a decryption key; the connection message is decrypted based on the decryption key to obtain a decryption result; when the decryption result is decryption success, the decrypted connection message is subjected to HMAC verification to obtain a verification result; and the first trusted secure channel is established with the terminal device according to the verification result. The first trusted secure channel is established between the terminal device and the cloud server based on the transaction parameter information generated by the SIM card, which ensures the security of the data transmission with the terminal device and reduces the transaction fraud risk.

[0098] Based on the above embodiments, the application provides a transaction authentication method, which is described with reference to Figure 3 , Figure 3 The flowchart of the third embodiment of the transaction authentication method of the application is shown.

[0099] In the embodiment, the transaction authentication method is applied to a terminal device, and the transaction authentication method includes steps S100-S300:

[0100] In step S100, the SIM card information is obtained through the third trusted secure channel established with the SIM card.

[0101] It should be noted that the third trusted secure channel established with the SIM card can be a secure channel established between the terminal device and the SIM card through a machine card channel or a digital certificate.

[0102] In step S200, the transaction information is generated according to the SIM card information and the transaction basic information, and the transaction information is sent to the cloud server through the first trusted secure channel.

[0103] It should be noted that generating transaction information based on the SIM card information and basic transaction information can be achieved by encrypting the aforementioned information using the cloud server's public key (a public key pre-negotiated with the cloud service for encrypting communication data). The basic transaction information may include information such as the transaction amount and transaction method. The first trusted secure channel can be a trusted channel established between the terminal device and the cloud service.

[0104] Step S300: Receive the transaction result from the cloud server.

[0105] It should be noted that after the terminal device sends the transaction information to the cloud server, the cloud server uses its private key to decrypt the transaction information and verifies the transaction. Upon successful verification, the cloud server will return the transaction result to the terminal device. The steps for the cloud server to verify the transaction can be found in the above embodiment.

[0106] In specific implementation, it can be referred to Figure 4 , Figure 4 This is a transaction illustration provided in Embodiment 3 of the transaction authentication method of this application. The transaction process is as follows: The terminal device obtains card information from the Super SIM card using a secure channel, including SEID, token, and other information that can be used to confirm the unique identifier and validity of the card. The terminal device encrypts the basic transaction information initiated by the user, such as the transaction amount and transaction method, together with the card information, using the cloud server's public key, and sends it to the cloud server through the first trusted secure channel. The cloud server decrypts the message using its private key, obtains the card information through the secure channel between the cloud server and the Super SIM card, and compares the card information with the card information sent by the terminal device. If they match, it indicates that there is no transaction fraud problem. The transaction is completed according to the transaction information, and the transaction result is fed back.

[0107] This embodiment obtains SIM card information through a third trusted secure channel established with the SIM card; generates transaction information based on the SIM card information and basic transaction information, and sends the transaction information to the cloud server through a first trusted secure channel; and receives the transaction result from the cloud server. This embodiment uses the SIM card to perform identity authentication for the user without their awareness, ultimately achieving dual authentication of the transmission channel and the user's identity, ensuring the trustworthiness of the transaction.

[0108] Based on the third embodiment described above, this application provides a transaction authentication method, referring to... Figure 5 , Figure 5 This is a flowchart illustrating the fourth embodiment of the transaction authentication method for this application.

[0109] In this embodiment, before step S200, steps S101 to S106 are also included:

[0110] Step S101, determining an encryption key according to an authorized access list and transaction parameter information;

[0111] It should be noted that the authorized access list can be an authorized access list sevrAuth sevr , Net sevr , V sevr , PV sevr > sent by the SIM, containing cloud side information app . Specifically, before step S101, it further includes: establishing a third trusted secure channel with the SIM card, and receiving transaction parameter information sent by the SIM card based on the third trusted secure channel;

[0112] Generating terminal key negotiation parameters according to the transaction parameter information, and sending the terminal key negotiation parameters to the SIM card;

[0113] Obtaining the authorized access list fed back by the SIM card based on the terminal key negotiation parameters, and storing the authorized access list.

[0114] It should be noted that the third trusted secure channel with the SIM card can be a secure channel established with the SIM card by selecting a machine card channel or a digital certificate. The receiving of the transaction parameter information sent by the SIM card based on the third trusted secure channel can refer to the steps of the above-mentioned embodiment two, and will not be repeated here. According to the transaction parameter information, a private key is randomly selected to calculate the terminal key negotiation parameter PV app = key B = bQ. The terminal key negotiation parameters can be sent to the super SIM card through the third trusted secure channel, and the request content includes identity ID app , digital certificate Cert app , key negotiation parameter PV app and other information. The SIM card also receives the identity ID sevr , digital certificate Cert sevr , network information Net sevr required for accessing the cloud side, signature public key V sevr , key negotiation parameter PV sevr and other information sent by the cloud server based on the transaction parameter information. Specifically, it can refer to the above-mentioned embodiment two. The super SIM card generates cloud side information accessible by the terminal side sevr , Net sevr , V sevr , PV sevr > through serverList and authList, and generates an authorized access list sevrAuthapp . Specifically, the identity of the super SIM card is ID card . The super SIM card generates connection certificate information m = B || Lifetime || ID card , and uses a random signature private key s to perform a signature algorithm on the signature information m to generate a credential σ = s · H2(m), and sends (m, σ) and sevrAuth app list to the terminal device. The terminal device performs a signature verification algorithm to check the validity of the credential σ, and after the check passes, stores (m, σ) and sevrAuth app list sent by the SIM card.

[0115] It should be noted that the determination of the encryption key according to the authorized access list and the transaction parameter information can be that the terminal device queries cloud key negotiation parameters PV app from the authorized access list sevrAuth sevr , and calculates the encryption key Key2 = H1(e(T, PV sevr ) b ) according to related parameters in the transaction parameter information and a function.

[0116] Step S102, encrypt the connection information based on the encryption key to obtain a connection message;

[0117] It should be noted that the connection information can include connection port, protocol and other information, and encrypting the connection information based on the encryption key to obtain a connection message can be encrypting the connection information using the key Key2.

[0118] Step S103, send the connection message to the cloud server, and receive a check result fed back by the cloud server;

[0119] It should be noted that sending the connection message to the cloud server can be that the message is encrypted and HMAC authenticated using the key Key2, and then sent to the cloud server. After receiving the connection message, the cloud server confirms whether B is in the key index list KeyList sevr according to the key B. The corresponding Key1 is queried and associated, Key1 is used to decrypt the connection message and perform HMAC verification. The check result is fed back. If the check passes, the cloud side confirms the access permission of the terminal device, adds a verification flag to the corresponding parameter B in the appAuth sevr list, and opens the corresponding port, and prepares to establish a TLS secure channel with the terminal device.

[0120] Step S104, when the check result is a check pass, generating certificate information, and sending the certificate information to the cloud server;

[0121] It should be noted that the generation of the certificate information can be to generate a signature certificate δ by performing a predefined signature algorithm, and to generate the certificate information (m, δ) by connecting the certificate m, and to send to the cloud server. The cloud server verifies (m, δ) using a signature verification algorithm (such as SM2), completes the signature verification, and confirms whether the transaction is tampered with.

[0122] Step S105, receiving the digital certificate fed back by the cloud server based on the certificate information, and performing identity authentication on the cloud server according to the data certificate;

[0123] It should be noted that the cloud server will feed back the digital certificate after the verification is passed. Specifically, the verification process of the cloud server on the certificate information is as follows: the cloud server queries the appAuth sevr list in the connection certificate m according to the keyword B to verify the validity of the access permission of the terminal device, and performs a specified signature verification algorithm to verify the correctness of the connection certificate m held by the terminal device. At the same time, it is judged whether the connection certificate is in the valid period according to the life cycle Lifetime of the connection certificate m.

[0124] Step S106, when the identity authentication result is authentication passed, establishing a first trusted secure channel with the cloud server.

[0125] In specific implementation, reference can be made to Figure 6 and Figure 7 , Figure 6 the authorization authentication process schematic diagram provided by Embodiment Four of the transaction authentication method of the present application; Figure 7 the establishment of a secure channel process schematic diagram provided by Embodiment Four of the transaction authentication method of the present application, and the end and the cloud in the figure respectively represent the terminal device and the cloud server. Specifically, the terminal device queries the cloud server information and its key negotiation parameter PV app from the authorized access list sevrAuth sevr , calculates the key Key2 = H1 (e (T, PV sevr ) b ). The terminal device encrypts and HMAC authenticates the message using the key Key2, and sends it to the cloud side. After receiving the data packet, the cloud side confirms whether it is in the key index list KeyList sevr according to the keyword B. The corresponding Key1 is associated with the query B, and the data packet is decrypted and HMAC verified using Key1. After the verification is passed, the cloud side confirms the access permission of the terminal device, and the appAuth sevrThe verification flag corresponding to the parameter B is added in the list, and the corresponding port is opened, so as to be ready to establish a TLS secure channel with the terminal device. At this time, the condition for establishing a secure channel has been met. Then, a three-party key negotiation algorithm can be used to perform signature verification and establish a TLS secure channel. Preferably, the national encryption algorithm is used preferentially. Specifically, the terminal device performs a signature algorithm to generate a signature credential δ, and sends (m, δ) to the cloud server. The cloud server queries the appAuth sevr list according to the key B in the connection certificate m, verifies the validity of the access right of the terminal device, and performs a specified signature verification algorithm to verify the correctness of the connection certificate m held by the terminal device. At the same time, whether the connection certificate is within the valid period is judged according to the life cycle Lifetime of the connection certificate m. The terminal device completes the identity authentication of the cloud server by using the digital certificate held by the cloud server. The cloud server verifies whether the public key B in the certificate sent by the terminal device is valid according to the appAuth sevr list, and establishes a TLS secure channel with the terminal device after the verification is passed. At this time, the cloud, the terminal, and the card have all established secure channels with each other, and can perform transactions.

[0126] The embodiment determines an encryption key according to an authorized access list and transaction parameter information, encrypts connection information based on the encryption key to obtain a connection message, sends the connection message to a cloud server, and receives a verification result fed back by the cloud server. When the verification result is verified, certificate information is generated and sent to the cloud server. The cloud server feeds back a digital certificate based on the certificate information, and the identity of the cloud server is authenticated according to the data certificate. When the identity authentication result is authenticated, a first trusted secure channel is established with the cloud server. Through the above steps, the terminal device needs to calculate a key according to corresponding key negotiation parameters when accessing the cloud side. The terminal device and the cloud side respectively query corresponding key negotiation parameters from respective lists to calculate the key. In this process, the terminal device and the cloud server do not need to interact with other participants. The identity information of the terminal device and the cloud server is not exposed to the outside, so that anonymous authorization authentication is realized, and the security of the key is ensured.

[0127] It should be noted that the above examples are only used for understanding the present application and do not limit the transaction authentication method of the present application. More forms of simple transformation based on the technical concept are within the protection scope of the present application.

[0128] The present application also provides a transaction authentication device, which is applied to a terminal device and includes Figure 8 , the transaction authentication device includes

[0129] The SIM card information acquisition module 100 is configured to acquire SIM card information through a third trusted secure channel established with the SIM card.

[0130] The transaction information generation module 200 is configured to generate transaction information according to the SIM card information and transaction basic information, and send the transaction information to the cloud server through the first trusted secure channel.

[0131] The transaction result receiving module 300 is configured to receive a transaction result fed back by the cloud server.

[0132] The embodiment acquires SIM card information through a third trusted secure channel established with the SIM card, generates transaction information according to the SIM card information and transaction basic information, and sends the transaction information to the cloud server through the first trusted secure channel, and receives a transaction result fed back by the cloud server. The embodiment uses the SIM card to perform identity authentication without user awareness, and finally realizes double authentication of a transmission channel and user identity, and ensures the credibility of a transaction.

[0133] The application further provides a transaction authentication device, please refer to Figure 9 , the transaction authentication device is applied to a cloud server, and the transaction authentication device comprises:

[0134] The receiving module 10 is configured to receive transaction information sent by a terminal device through a first trusted secure channel.

[0135] The acquisition module 20 is configured to acquire card information of the SIM card through a second trusted secure channel between the SIM card.

[0136] The transaction authentication module 30 is configured to perform transaction authentication according to the transaction information and the card information, and obtain a transaction authentication result.

[0137] The embodiment receives transaction information sent by a terminal device through a first trusted secure channel, acquires card information of the SIM card through a second trusted secure channel between the SIM card, performs transaction authentication according to the transaction information and the card information, and obtains a transaction authentication result. Since the embodiment performs transaction authentication on the transaction information through the card information acquired from the SIM card after receiving the transaction information sent by the terminal device through the first trusted secure channel, compared with the prior authentication and transaction mode directly according to the transaction information sent by the terminal device, the above mode of the embodiment can improve the security of the transaction and avoid transaction fraud.

[0138] The transaction authentication device provided in the present application adopts the transaction authentication method in the above embodiments, and can solve the technical problem of transaction fraud risk existing in the existing transaction authentication method. Compared with the prior art, the transaction authentication device provided in the present application has the same beneficial effects as the transaction authentication method provided in the above embodiments, and other technical features in the transaction authentication device are the same as the features disclosed in the above embodiments, which will not be repeated here.

[0139] The present application provides a transaction authentication device, which comprises at least one processor and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the transaction authentication method in the above embodiment one.

[0140] Reference will be made to the following description of the embodiments of the present application, taken in conjunction with the accompanying drawings, in which Figure 10 which shows a structural schematic diagram of a transaction authentication device suitable for being used to implement the embodiments of the present application. The transaction authentication device in the embodiments of the present application can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 10 The transaction authentication device shown is only an example, and should not bring any limitation to the functions and use range of the embodiments of the present application.

[0141] As Figure 10As shown, the transaction authentication device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1002 or loaded from a storage device 1003 into a random access memory (RAM) 1004. Various programs and data required for operation of the transaction authentication device are also stored in the RAM 1004. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the transaction authentication device to communicate with other devices wirelessly or by wire to exchange data. Although the transaction authentication device with various systems is shown in the figure, it should be understood that all of the systems shown are not required to be implemented or possessed. More or fewer systems can be alternatively implemented or possessed.

[0142] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by the communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of embodiments of the present disclosure are performed.

[0143] The transaction authentication device provided by the present disclosure adopts the transaction authentication method in the above-mentioned embodiments, and can solve the technical problem of transaction fraud risk existing in the existing transaction authentication method. Compared with the prior art, the transaction authentication device provided by the present disclosure has the same beneficial effects as the transaction authentication method provided by the above-mentioned embodiments, and other technical features in the transaction authentication device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0144] It should be understood that portions of the application disclosed can be implemented in hardware, software, firmware, or combinations thereof. In the description of the embodiments above, specific features, structures, materials or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0145] The above description is merely illustrative of the application and is not intended to limit the scope of the application. Any changes and modifications that can be made to the application in accordance with the principles of the application would be readily apparent to those skilled in the art and the present application is therefore not limited to the description and examples contained herein but is only limited by the claims.

[0146] The application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e. a computer program) for performing the transaction authentication method in the above-described embodiments.

[0147] The computer readable storage medium provided by the application may, for example, be a U disk, but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more conductive wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted in any suitable medium, including but not limited to electrical wire, optical cable, RF (Radio Frequency), etc., or any suitable combination of the above.

[0148] The above-described computer readable storage medium can be included in a transaction authentication device; or can exist separately and not be assembled into a transaction authentication device.

[0149] The above-described computer readable storage medium carries one or more programs, which, when executed by the transaction authentication device, cause the transaction authentication device to perform the above-described transaction authentication method.

[0150] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0151] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0152] The modules involved in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0153] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e., a computer program) for executing the above transaction authentication method, and can solve the technical problem of transaction fraud risk existing in the existing transaction authentication method. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the transaction authentication method provided by the above embodiments, and will not be described here.

[0154] The application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the transaction authentication method as described above.

[0155] The computer program product provided by the application can solve the technical problem of transaction fraud risk existing in the existing transaction authentication method. Compared with the prior art, the beneficial effects of the computer program product provided by the application are the same as those of the transaction authentication method provided by the above-mentioned embodiments, which will not be repeated here.

[0156] The above-mentioned embodiments are only part of the embodiments of the application, and do not limit the patent scope of the application. Any equivalent structural transformation, direct / indirect application in other related technical fields, or direct / indirect application in other related technical fields based on the technical concept of the application and the content of the specification and drawings are included in the patent protection scope of the application.

Claims

1. A transaction authentication method, characterized by, The transaction authentication method applied to a cloud server comprises the following steps: receiving transaction information sent by a terminal device through a first trusted secure channel; obtaining card information of a SIM card through a second trusted secure channel between the SIM card and the cloud server; performing transaction authentication according to the transaction information and the card information to obtain a transaction authentication result.

2. The transaction authentication method of claim 1, wherein, Before the step of receiving the transaction information sent by the terminal device through the first trusted secure channel, the method further comprises the following steps: when receiving a connection message sent by the terminal device, querying a key index list corresponding to the terminal device to obtain a decryption key; decrypting the connection message based on the decryption key to obtain a decryption result; when the decryption result is decryption success, performing HMAC verification on the decrypted connection message to obtain a verification result; establishing the first trusted secure channel with the terminal device according to the verification result.

3. The transaction authentication method of claim 2, wherein, The step of establishing the first trusted secure channel with the terminal device according to the verification result comprises the following steps: when the verification result is verification success, adding a verification flag in a key negotiation parameter list and opening a target port; receiving certificate information sent by the terminal device; verifying authority information of the terminal device according to the certificate information, and verifying validity of a connection certificate in the certificate information after the authority verification is passed to obtain a certificate verification result; establishing the first trusted secure channel with the terminal device according to the certificate verification result, the target port, the verification flag.

4. The transaction authentication method of claim 3, wherein, Before the step of receiving the transaction information sent by the terminal device through the first trusted secure channel, the method further comprises the following steps: establishing a second trusted secure channel with the SIM card, and receiving transaction parameter information sent by the SIM card based on the second trusted secure channel; generating a signature public key and a cloud key negotiation parameter according to the transaction parameter information, and sending the signature public key and the cloud key negotiation parameter to the SIM card; obtaining a key negotiation parameter list and a key index list fed back by the SIM card based on the signature public key and the cloud key negotiation parameter, and storing the key negotiation parameter list and the key index list.

5. A transaction authentication method characterized by, The transaction authentication method applied to a terminal device comprises the following steps: obtaining SIM card information through a third trusted secure channel established with the SIM card; generating transaction information according to the SIM card information and transaction basic information, and sending the transaction information to a cloud server through a first trusted secure channel; receiving a transaction result fed back by the cloud server.

6. The transaction authentication method of claim 5, wherein, Before the step of sending the transaction information to the cloud server through the first trusted secure channel, the method further comprises the following steps: determining an encryption key according to an authorized access list and transaction parameter information; encrypting connection information based on the encryption key to obtain a connection message; sending the connection message to the cloud server, and receiving a verification result fed back by the cloud server; when the verification result is verification success, generating certificate information, and sending the certificate information to the cloud server; receiving a digital certificate fed back by the cloud server based on the certificate information, and performing identity authentication on the cloud server according to the digital certificate. When the identity authentication result is authentication passed, a first trusted secure channel is established with the cloud server.

7. The transaction authentication method of claim 6, wherein, Before the step of generating transaction information according to the SIM card information and transaction basic information, the method further comprises: A third trusted secure channel is established with the SIM card, and transaction parameter information sent by the SIM card based on the third trusted secure channel is received; Terminal key negotiation parameters are generated according to the transaction parameter information, and the terminal key negotiation parameters are sent to the SIM card; An authorized access list fed back by the SIM card based on the terminal key negotiation parameters is acquired, and the authorized access list is stored.

8. A transaction authentication device, characterized by The transaction authentication device applied to a terminal device comprises: A SIM card information acquisition module is configured to acquire SIM card information through a third trusted secure channel established with the SIM card; A transaction information generation module is configured to generate transaction information according to the SIM card information and transaction basic information, and send the transaction information to a cloud server through a first trusted secure channel; A transaction result receiving module is configured to receive a transaction result fed back by the cloud server.

9. A transaction authentication device, characterized by The transaction authentication device applied to a cloud server comprises: A receiving module is configured to receive transaction information sent by a terminal device through a first trusted secure channel; An acquisition module is configured to acquire card information of a SIM card through a second trusted secure channel between the SIM card and the cloud server; A transaction authentication module is configured to perform transaction authentication according to the transaction information and the card information, and obtain a transaction authentication result.

10. A transaction authentication device, characterized by The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the transaction authentication method according to any one of claims 1 to 4 or 5 to 7.

11. A storage medium, characterized by The storage medium is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the transaction authentication method according to any one of claims 1 to 4 or 5 to 7.

12. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by a processor to implement the steps of the transaction authentication method according to any one of claims 1 to 4 or 5 to 7.

Images