CN101131759A - One-time password generation and application method for network transaction and system for executing method - Google Patents

Abstract

The present invention relates to a method for generating and applying a one-time password for online transactions and a system for executing the method. The method for generating and applying a one-time password for online transactions is used to generate a set of exclusive one-time passwords (OTP) for each online transaction. The OTP is calculated using transaction identification information, such as transaction type, transaction date, etc., and is sent to the user through another channel other than the Internet, such as SMS and other methods. Only when the OTP matches the transaction content can the online transaction be carried out, thereby cracking the crisis caused by Trojan horse programs, online phishing, etc.

Description

One-time password generation and application method for network transaction and system for executing the method

technical field

The present invention relates to a network transaction security mechanism, in particular to a method for generating and applying a one-time password for network transactions, which can generate a dedicated password according to the characteristics of the current transaction without increasing the burden on users, and the method for executing the same system.

Background technique

In recent years, with the rapid development of Internet technology, e-commerce such as online shopping and online auctions has emerged accordingly, and various banks have also launched online banking services. Users/customers can choose not to go out to shop, not to visit the counter in person, and not to wait in line , You only need to log in to the shopping website or online banking website through your computer at home, and you can perform various transactions such as payment and transfer.

The common point of the above-mentioned online transactions is that users must enter their own financial information on the computer, such as credit card information, bank account, password, login account number, transaction information, etc., and transmit them to the credit card center or online bank through the network. The server of the website. While users enjoy this convenient service, it also creates great opportunities for cyber hackers to log or steal financial information; once hackers steal these private financial information, the losses of users and banks can be imagined. According to the anti-phishing working group (Anti-Phishing Working Group, APWG) statistics, more than 70% of online frauds are directly targeting online banking and online cash flow services, with the purpose of stealing account information and looting internet banking.

The currently known methods of cyber-hacker fraud include:

1. Internet phishing (phishing, homophonic and similar to fishing)

The main method is to use forged emails as bait and link to fake websites. For example, pretending to be a well-known bank or online service provider, notifying the user that the information is outdated or invalid and needs to be updated, or requiring identity verification for security reasons, requiring the user to link to the website directed in the email to re-confirm the bank Account password or credit card number. Due to the subtlety of the fraudulent techniques, it is difficult for users to distinguish the authenticity from the fake. Once the account password is entered on the website, it is like taking the bait.

2. Trojan horse program or spyware

Trojan horse programs or spyware include programs such as keyloggers and screen interceptors. Hackers package Trojan horse programs or spyware into interesting or useful tool programs, and use emails or broadcast them on websites. When users are attracted to download or open the attached files of emails, these Trojan horse programs or spyware Software has the opportunity to invade the computer. For example, the incident that happened on both sides of the Taiwan Strait a few days ago-hackers widely sent "43 computer viruses will break out on Black Friday, October 13th, Microsoft users download the patch quickly" emails, tricking users into downloading "system update programs" disguised as Trojan horse programs. exe" or fake "Detox.exe". This kind of Trojan horse program will not immediately occur or make the computer abnormal, but as long as the user opens a browser, receiving software or even a text editing tool, and enters any "account number", "password" and other information, the Trojan horse program will be linked with the corresponding website or browsing path. Write it down together, so all private account numbers and passwords will be blocked.

The packages of the above-mentioned phishing baits and Trojan horse programs are all kinds of strange and constantly updated. It is very difficult to completely intercept or even find out the network hackers one by one. In recent years, under the circumstances that Internet banking has been unbearably disturbed, in order to prevent the continuous expansion of losses, Taiwan, China closed the SSL (Secure Socket Layer, SSL, hereinafter referred to as SSL) non-agreed transfer function of Internet banking in 2004, and stipulated that it must be viewed as a transaction. To avoid risks, the SSL non-agreed transaction business can only be opened by using the following strict technical protection measures individually or in combination:

1. SSL agreement account transaction password - only open the agreement account for transactions, which is equivalent to the practice of giving up food because of choking, restricting the content of online banking transactions, and avoiding theft.

2. Public key infrastructure (Public Key Infrastructure, hereinafter referred to as PKI) - is a system that uses public key technology to achieve e-commerce security. It is composed of basic components such as the security policy of closing/opening the key. However, when all account passwords of the user are stolen by skimming, and the private key protection device used by the user is not safe (such as a disk), this encryption and authentication method is useless.

3. One-time password (One Time Password, hereinafter referred to as OTP) - also known as dynamic password, is to use a dynamic password generator (Key Token), chip financial card or other methods to randomly generate a password that is limited to one use. Cooperating with the chip card user, the code generator must be inserted into the user's chip card, and can only be used after entering the code of the chip card, adding an additional layer of protection to the above-mentioned anti-theft mechanism.

The above-mentioned password generator is specially owned by the user and can be connected to the online bank. It generates a set of OTP passwords for each transaction with random characters. A combination of the above two conditions is produced. During the transaction process of online banking, the user may need to input the OTP password generated by the password generator one by one or within a predetermined time (for example, 20 seconds). Operate the password generator again. Although in the above OTP mechanism, the OTP password is different each time, and in principle only the user who owns the generator can know it, the security should be higher than that of a person who usually signs in with a fixed password, but in fact, this OTP generator The password method cannot prevent phishing or a third party intervening in the transaction (Manin the Middle) to tamper with the transaction. The reason is that the OTP password is only incremented by the password generator itself or randomly generated or time-related. The password is not related to the transaction content, user identity, chip card serial number or card password, and the generator is not limited to inserting the chip card, which means that the OTP password will not be invalidated because the transaction content or user information is changed . Therefore, there are the following problems: (1) In the case of phishing, if the user enters the account number and OTP password on the fake website, the hacker can immediately go to the real website to engage in illegal transactions such as stealing, but the user does not know it; (2) As for the third party intervening in the transaction, as long as the user enters his OTP password, any third party may intervene to tamper with the transaction.

To sum up the above, in order to prevent the passwords of online trading accounts from being stolen, stolen, and swiped, the added protection measures often add inconvenience to users; and although various network encryption, authentication, and protection mechanisms have been developed at present , but in the face of endless cybercriminal methods or hidden crises around us, there is still the risk of a hundred secrets and one sparse. Therefore, it is necessary to develop a method that can effectively prevent blocking and stealing and does not increase the burden on users for online financial transactions.

In view of this, based on years of rich practical experience and professional knowledge engaged in the design and manufacture of such products, and in conjunction with the application of academic theories, the inventor actively researches and innovates, in order to create a new generation and application of one-time passwords for online transactions The method and the system for implementing the method make it more practical. Through continuous research, design, and after repeated trials and improvements, the present invention with practical value is finally created.

Contents of the invention

The purpose of the present invention is to provide a one-time password generation and application method that can generate a unique password according to the characteristics of the current transaction without increasing the burden on the user, and a system for executing the method, so that it is more suitable for practical use.

The purpose of the present invention and the solution to its technical problems are achieved by adopting the following technical solutions. According to a method for generating and applying a one-time password for online transactions proposed by the present invention, a dedicated one-time password is generated for a user's online transaction behavior, and the user uses a different first user interface and a different The second user interface; it includes the following steps: (A), receiving the transaction data input by the user; (B), according to the transaction data and the data provided by the system, logical operation generates a set of exclusive corresponding one-time passwords, the one-time The sex code includes a transaction code and a transaction verification code; (C), the transaction code and the transaction verification code are respectively transmitted and displayed on the first user interface and the second user interface through different channels; ( D), receiving the transaction verification code sent back from the user through the first user interface; and (E), checking whether the returned transaction verification code is correct.

The purpose of the present invention and its technical problems can also be further realized by adopting the following technical measures.

In the aforementioned method for generating and applying a one-time password for online transactions, the step (C) is to transmit the transaction code to the first user interface through the Internet, and transmit the transaction verification code to the second user interface through the mobile communication network. 2. user interface.

In the aforementioned one-time password generation and application method for online transactions, the transaction verification code is transmitted through non-Internet global information network mechanisms such as SMS, GPRS, MMS, fax, voice, and email.

The aforementioned one-time password generation and application method for online transactions, wherein the method also includes a step (F) between steps (B) and (C) to generate a password for passing through the mobile communication network according to the transaction verification code and transaction content. SMS sent.

In the aforementioned method for generating and applying a one-time password for network transactions, the transaction code generated in step (B) is in text form, and the transaction verification code is in digital form.

In the aforementioned method for generating and applying a one-time password for network transactions, the step (A) also receives the personal identification data input from the user; the step (B) is also based on the personal identification data, including user account number, password, door No., ID number, date of birth at least one of logical operation.

In the aforementioned one-time password generation and application method for online transactions, the transaction data used in the calculation in step (B) includes at least one of activation transaction, financial transaction type, transaction account, transaction amount, and transaction time.

In the aforementioned method for generating and applying a one-time password for online transactions, the step (C) is to send the short message through a mobile communication network through a short message gateway and display it on the second user interface.

In the aforementioned one-time password generation and application method for online transactions, the short message gateway is connected to a short message sending service provider, and the short message sending service provider sends the short message to the telecom operator through a dedicated line.

In the aforementioned method for generating and applying one-time passwords for online transactions, the system-provided data in step (B) includes a preset variable that can be adjusted in batches according to requirements.

In the aforementioned method for generating and applying a one-time password for online transactions, the step (B) includes the detailed step (B-1) using the random number function of the system to generate the transaction code through calculation; and the step (B-2) according to the transaction The code, together with the transaction data, personal identification data, and variables generated by the system, is logically operated to generate the transaction verification code.

In the aforementioned method for generating and applying one-time passwords for online transactions, the variables in the step (B-2) are adjusted in batches according to requirements.

In the aforementioned method for generating and applying a one-time password for online transactions, the step (A) is to receive data from the first user interface.

The purpose of the present invention and the solution to its technical problem also adopt the following technical solutions to achieve. A system for generating and applying one-time passwords for network transactions according to the present invention can be connected with a user's first user interface and second user interface through a website server of an online bank, and the system includes: A receiving module, which receives the personal identification data, transaction data, and subsequent data sent from the first user interface; a user database, which stores the user's personal identification data in advance, including a default mobile phone door No.; an operation module, which generates a set of one-time passwords corresponding to the transaction based on the transaction data and the data provided by the system. The one-time passwords include a transaction code and a transaction verification code; A module for sending the transaction code through the Internet and displaying it on the first user interface; a second sending module for sending the transaction verification code to the second user through a non-Internet global information network mechanism Interface: and a management module to check whether the transaction verification code returned by the user is correct.

The purpose of the present invention and its technical problems can also be further realized by adopting the following technical measures.

The aforementioned one-time password generation and application system for network transactions, wherein the system cooperates with a short message sending service provider and connects with the telecommunications operator through a dedicated line for short messages.

The aforementioned one-time password generation and application system for online transactions, wherein the second sending module sends the transaction verification code through SMS, wireless packet switching service (GPRS), multimedia messaging service (MMS), fax, voice, electronic Non-Internet World Wide Web mechanisms for mail delivery.

The aforementioned one-time password generation and application system for online transactions, wherein the second sending module is a short message generation module, generates a short message according to the transaction code and transaction verification code, and transmits it through the mobile communication network and displays it on the Second user interface.

In the aforementioned one-time password generation and application system for network transactions, the transaction code generated by the computing module is in text form, and the transaction verification code is in digital form.

In the aforementioned system for generating and applying one-time passwords for online transactions, the calculation module also performs logic operations based on at least one of the personal identification data, including user account number, password, door number, ID card number, and date of birth.

In the aforementioned one-time password generation and application system for online transactions, the transaction data on which the operation module operates includes at least one of enabled transaction, financial transaction type, transaction account, transaction amount, and transaction time.

In the aforementioned system for generating and applying one-time passwords for online transactions, the data provided by the system on which the computing module operates includes preset variables adjusted in batches according to requirements.

The above-mentioned one-time password generation and application system for online transactions, wherein the calculation module uses the system random number function to generate the transaction code through calculation; and based on the transaction code, plus transaction data, personal identification data, and variables generated by the system , the logic operation generates the transaction verification code.

Compared with the prior art, the present invention has obvious advantages and beneficial effects. As can be seen from the above, in order to achieve the above object, the method for generating and applying a one-time password for online transactions of the present invention generates a proprietary one-time password (OTP) for a user's online transaction behavior, and the user uses a different one-time password (OTP). A first user interface and a second user interface; the method includes the following steps: (A), receiving transaction data input from a user. (B) According to the transaction data and the data provided by the system, logical operation generates a set of corresponding one-time passwords. The one-time passwords include a transaction code and a transaction verification code. (C), the transaction code and transaction verification code are transmitted and displayed on the first user interface and the second user interface respectively through different channels; the transaction code is transmitted to the first user interface through the Internet, and the transaction The verification code is transmitted to the second user interface through the non-Internet mechanism of SMS, Wireless Packet Switching Service (GPRS), and Multimedia Message Service (MMS) through the mobile communication network. (D) receiving the transaction code and transaction verification code returned from the first user interface, the transaction verification code is input by the user; and (E) checking whether the returned transaction verification code is correct.

By means of the above-mentioned technical scheme, the method for generating and applying a one-time password for network transactions of the present invention and the system for executing the method thereof at least have the following advantages: the beneficial effect of the present invention is that, due to the One Time Password (OTP ) generation method is to use transaction identification data to generate a set of exclusive OTP for each online transaction, and send the OTP to the user through another channel different from the Internet; only when the OTP matches the transaction content Online transactions can only be carried out under certain circumstances, which can really prevent stolen claims and stolen brushes.

To sum up, the present invention provides a method for generating and applying a one-time password that can generate a unique password according to the characteristics of the current transaction without increasing the burden on the user, and a system for implementing the method. The online transaction uses a one-time password generation and application method to generate a set of exclusive one-time passwords (One Time Password, OTP) for each online transaction behavior; the OTP uses transaction identification data, such as: transaction type , transaction date, etc., and send the OTP to the user through another channel different from the Internet, such as SMS, etc.; only when the OTP matches the transaction content can online transactions be carried out , so as to solve the crisis caused by Trojan horse programs and phishing. The present invention has the above-mentioned many advantages and practical value, and it has great improvements in the method, structure or function of the application system, and has made remarkable progress in technology, and has produced easy-to-use and practical effects, and has enhanced The outstanding effect, thus more suitable for practicality, is a novel, progressive, practical new design.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the following preferred embodiments are specifically cited below, and are described in detail as follows in conjunction with the accompanying drawings.

Description of drawings

FIG. 1 is a schematic diagram of a preferred embodiment of a system for generating a one-time password for network transactions according to the present invention.

Fig. 2 is a flow chart of enabling SMS OTP transactions in a preferred embodiment of the method for generating and applying one-time passwords for online transactions of the present invention.

FIG. 3 is a flow chart similar to FIG. 2, illustrating a pre-flow process for performing a financial transaction using an SMS OTP transaction.

FIG. 4 is a schematic diagram of a preferred embodiment of a method for generating and applying a one-time password for network transactions of the present invention to execute transactions.

Detailed ways

In order to further explain the technical means and effects of the present invention to achieve the intended purpose of the invention, the following in conjunction with the accompanying drawings and preferred embodiments, the method for generating and applying one-time passwords for network transactions proposed according to the present invention and its implementation The system of the method and its specific implementation, method steps, structure, features and effects thereof are described in detail below.

Please refer to FIG. 1 , which is a schematic diagram of a preferred embodiment of the one-time password generation system for online transactions of the present invention. The preferred embodiment of the system 2 and method for generating one-time passwords for Internet transactions of the present invention is suitable for online transactions of an Internet bank, and is used to generate a set of unique transaction data for each online transaction. One-time password (One Time Password, referred to as OTP), and through SMS, wireless packet switching service (GPRS), multimedia messaging service (MMS), fax, voice, email, etc., non-Internet (internet) World Wide Web The (WWW) mechanism sends the OTP to the hands of the user; only when the OTP matches the transaction content can the transaction be continued in the online bank, so that it can be cracked due to Trojan horse programs, phishing, etc. crisis.

The one-time password generating system 2 of this embodiment includes a receiving module 21, a user database 22, a computing module 23, a short message generating module 24, a sending module 25, and a management module 26, And cooperate with a short message sending service provider 3, connect with various telecommunications operators 4 through the short message dedicated line.

The receiving module 21 and the sending module 25 are connected with the web server 51 of the online bank, thereby receiving messages input from users through a first user interface 11 via the Internet, or sending messages to the first user interface 11 A user interface 11 .

The user database 22 can be connected to the online banking host 50 or directly installed in the host 50, and stores the user's personal identification data, including the default mobile phone number. Chip financial card to automatic teller machine (ATM) setting, or other methods that can confirm the identity, the mobile phone number is set to receive SMS OTP, which can be different from the contact number recorded in the bank user information. When the user handles the data modification, after authentication, the channels that can confirm the identity such as the branch staff computer 32 are connected to the database 22 for modification.

The calculation module 23 can generate an OTP transaction code and a transaction verification code according to the received transaction identification data, and the detailed calculation content will be described below.

The short message generation module 24 integrates and generates a short message according to transaction codes, transaction verification codes, etc., and connects with a short message gateway (SMS Gateway) 40, thereby passing the short message through the communication network and sending the service provider by the short message The merchant 3 sends to the preset door number through the dedicated line through the telecommunications operator 4 for the user to read through a second user interface 12 .

The above-mentioned first user interface 11 is various computers, personal digital assistants (PDAs) etc. that can be connected to the Internet, and the second user interface 12 is a mobile phone carried by the user, or a PDA combined with a mobile phone function .

Please refer to Figure 1, Figure 2 and Figure 4 at the same time. After the user goes to the bank counter (or the aforementioned other ways to confirm the identity) to handle the SMS OTP transaction with the identity certificate and the original seal in advance, the first use must After the user logs into the online bank through the first user interface 11, the OTP generation system 2 cooperates with the gateway 40 and the SMS sending service provider 3 to jointly execute steps 611-65, and the telecom operator executes step 9a 1. After the user responds to steps 81a-83a, the OTP generating system 2 continues to execute steps 66-67. The detailed process is now described as follows:

0TP generation system

Step 611 - The receiving module 21 receives the user's personal identification information; the user is connected to the Internet through the first user interface 11 to log in to the online bank, and the personal identification information includes login account number and password.

Step 612 - The receiving module 21 receives the information of the phone number; after the user logs into the online banking, he inputs the phone number of the mobile phone that is preset to receive the OTP SMS when applying for the SMS OTP transaction.

Step 613 - The management module 26 checks the account number and door number, and checks whether this behavior is performed at the counter or at the ATM to set up an application, or after the SMS OTP transaction is processed in other ways that can confirm the identity. The time limit (such as: one week) If the verified identity is correct, proceed to step 621; if the verification is inconsistent, the transaction cannot be continued; if the activation is not performed within the predetermined time, the system will cancel the application qualification.

Step 621 - generate an OTP transaction code; the operation module 23 uses the random number function of the system to generate a transaction code, such as ABCD, but it is not limited to a text form, nor is it limited to four codes. After the transaction code is generated in this step, in addition to proceeding to step 622 and step 623, step 65 is also proceeded synchronously.

Step 622-generate the transaction verification code of OTP digital part; Calculation module 23 is based on this transaction code of step 621, adds " transaction data " (can comprise transaction date, time, transaction kind (Fig. 2 is to open transaction, Fig. 3 is Other financial transactions), account number, amount, etc., the number of items is not limited), "user personal identification information" (may include user account number, password, door number, ID card number, date of birth, etc., the number of items is not limited), and system generated variables, logic operations (X0R/AND/OR...etc) generate transaction verification codes. The above-mentioned variables can be adjusted in batches according to the needs, such as different settings for specific transaction projects, and encrypted with Triple Data Encryption Standard (3DES), and then logical operations (XOR/AND/OR...etc ) to generate a set of OTP numbers exclusive to this activation behavior, such as 123456.

Combining steps 621 and 622, the OTP includes a text part (ie. transaction code) and a number part (ie. transaction verification code). Although the text part and the number part are not necessarily one-to-one, they are identified by the same transaction Data (including user input and data provided by the system), the system will calculate a single exclusive OTP, and send the text part and number part separately through different channels (will be described in detail in steps 63-65).

In addition, the above-mentioned transaction identification data is not limited to the number of items, that is to say, the OTP is produced by multiple data, which is different from the past, and it also improves its proprietary, privacy, and security.

Step 623—generate the content of the short message; integrate the OTP transaction code, the transaction verification code generated in the above steps 622 and 623, and the words and sentences related to this transaction behavior "SMS OTP transaction activation", and even the web page identification code, as the content of the short message.

Step 63 - Send the SMS content to the gateway 40 . Since the short message in this embodiment is transmitted through a mobile communication network different from the Internet, the gateway 40 needs to be used for connection conversion and transmission.

Step 64 - Send the content of the SMS and the preset phone number to the telecom operator 4 . In this embodiment, it is carried out through the pre-contracted short message sending service provider 3, and the provider 3 and the telecom operator 4 are transmitted in a leased line (Lease-Line), which is equivalent to using an exclusive short message transmission channel, independent of General SMS transmission business, so as to meet the security of transaction SMS and improve the efficiency of SMS transmission.

Step 65—transmitting the transaction code, sending the transaction code generated in step 621 to the first user interface 11 via the Internet for user review and subsequent comparison.

telecom operator

Step 9a - Send SMS to preset door number.

user

Step 81a—use the first user interface 11 (computer as shown in FIG. 4 ) to receive the transaction code (ABCD as shown in FIG. 4 ) transmitted by the system in step 65 .

Step 82a - use the second user interface 12 to receive the SMS sent by the telecom operator in step 9a; that is to say, the transaction verification code of the OTP is displayed on the mobile phone, and the transaction verification code is not only closely related to the transaction identification data, In addition, it is sent to the second user interface 12, which can prevent situations such as phishing.

Step 83a-In the first user interface 11 below the transaction code as shown in Figure 4, input the transaction verification code in digital form displayed in the content of the text message on the column for inputting the verification code, such as 123456; thereby, the transaction code together with The transaction verification code is sent back to the system together.

The above transaction code ABCD plus the transaction verification code 123456, that is, the complete OTP, is unique for this transaction.

OTP generation system

Step 66 - the receiving module 21 receives the verification code.

Step 67 - Firstly, the calculation module 23 performs reverse calculations based on the verification code and the transaction code issued by the system (step 65) to deduce various transaction identification data. If the reverse derivation is successful, the management module 26 checks with the original transaction identification data , if they match, the activation is completed, otherwise, the activation fails.

Once the management module 26 checks that it does not match, it means that the transaction verification code input by the user is wrong, or that it does not correspond to the transaction code. The SMS OTP transaction mechanism executes the transaction, and the unlocking operation needs to be handled according to the regulations.

After the SMS OTP transaction is enabled, you can use the SMS OTP mechanism to conduct online financial transactions such as transfers and payments in online banking. Please mainly refer to Figure 3, and refer to Figure 1 and Figure 4 together, the main difference between the online financial transaction process and the aforementioned activation process is that the user has to input transaction data such as transfer account number and transfer amount (step 712) , and can be designed so that no need to input the door number data again, the system directly reads the user's preset door number from the user database 22 according to the user's personal identification data (step 72). As for the activation process, the user logs in and enters any data It can be regarded as the input transaction data in a broad sense, and the transaction content is to enable the OTP transaction mechanism. The principle of the intermediate process is the same - the OTP generation system generates transaction codes and transaction verification codes (steps 751, 752) based on personal identification data, transaction data, transaction time, etc. 762, 9), respectively presented in the user's first user interface 11, second user interface 12 (steps 81, 82), after the user inputs the transaction verification code (step 83) in the first user interface 11, the system Check (step 79), if the check is successful, the transaction will be executed by the network bank host 50; if the verification code is wrong, the message of transaction failure will be replied.

To sum up the above, the method for generating and applying one-time passwords of the present invention is different from the previous method of generating passwords with incremental or random numbers. The present invention can generate exclusive OTP for the current transaction identification data such as user identity, transaction content, time, etc. Password, once the transaction content changes, the OTP password will become invalid immediately; therefore, even if the user's computer has been implanted with a Trojan horse program or the account password is stolen due to phishing, hackers or any third party cannot additionally or intervene in other transactions . In addition, the present invention uses mobile phones that almost everyone is used to. Not only is it extremely difficult for hackers to know the transaction verification code of the OTP password, but also the user does not need to store/carry an additional password generator, which is very convenient to use.

The above description is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. Anyone familiar with this field Those skilled in the art, without departing from the scope of the technical solution of the present invention, may use the technical content disclosed above to make some changes or modify them into equivalent embodiments with equivalent changes, but as long as they do not depart from the technical solution of the present invention, the Technical Essence Any simple modifications, equivalent changes and modifications made to the above embodiments still fall within the scope of the technical solution of the present invention.

Claims (22)

1. a disposal password used for internet trade produces and application process, produces a proprietary disposal password at an online trading behavior of a user, and this user uses one first different user's interface and one second user's interface; It is characterized in that it comprises following steps:

(A), receive the transaction data of importing from the user;

(B), give information, logical operation produces the disposal password of one group of exclusive correspondence, and this disposal password comprises a transaction code, and a transaction identifying code according to this transaction data and a system;

(C), by different pipeline this transaction code, transaction verification sign indicating number are transmitted respectively and be shown in this first user interface, second user's interface;

(D), receive the transaction verification sign indicating number by this first user interface passback from this user; And

Whether (E), check the transaction verification sign indicating number of this passback correct.

2. disposal password used for internet trade according to claim 1 produces and application process, it is characterized in that wherein said step (C) is to make transaction code be transferred to this first user interface by Internet, the transaction verification sign indicating number is transferred to this second user interface by mobile communication network.

3. disposal password used for internet trade according to claim 1 produces and application process, it is characterized in that wherein said step (C) is to make transaction code be transferred to this first user interface by Internet, the transaction verification sign indicating number is the world wide web mechanism transmission by the non-Internet of news in brief, wireless packet-switched service, multimedia short message service, fax, voice, Email.

4. disposal password used for internet trade according to claim 2 produces and application process, it is characterized in that this method comprises that also the step (F) between a step (B), (C) produces one in order to the news in brief by the mobile communication network transmission according to this transaction verification sign indicating number and transaction content.

5. produce and application process according to claim 1,2,3 or 4 described disposal password used for internet trade, it is characterized in that the transaction code that wherein said step (B) is produced is a written form, the transaction verification sign indicating number then is a digital form.

6. produce and application process according to claim 1,2,3 or 4 described disposal password used for internet trade, it is characterized in that wherein said step (A) also receives the individual identification data from user's input; This step (B) is also according to the individual identification data, comprises that user account number, password, door number, I.D. font size, date of birth wherein carry out one of at least logical operation.

7. produce and application process according to claim 1,2,3 or 4 described disposal password used for internet trade, the transaction data that it is characterized in that computing foundation in the wherein said step (B) comprises and enables transaction, financial transaction kind, transaction account, transaction limit, exchange hour wherein one of at least.

8. disposal password used for internet trade according to claim 4 produces and application process, it is characterized in that wherein said step (C) be with this news in brief through a news in brief gateway, send and be shown in this second user interface by mobile communication network.

9. disposal password used for internet trade according to claim 8 produces and application process, it is characterized in that wherein said news in brief gateway is connected to a news in brief and sends the service supplier, this news in brief sends the service supplier and sends news in brief to the telecommunications dealer with special line.

10. disposal password used for internet trade according to claim 1 produces and application process, and the system that it is characterized in that wherein said step (B) gives information and comprises a default parameter.

11. produce and application process according to the described disposal password used for internet trade of claim 10, it is characterized in that wherein said step (B) comprises that thin step (B-1) utilizes the random number function of system to produce this transaction code through computing; Step (B-2) adds transaction data, individual identification data according to this transaction code, and the parameter of system's generation, and logical operation produces this transaction verification sign indicating number.

12. produce and application process according to the described disposal password used for internet trade of claim 11, it is characterized in that the described parameter of wherein said step (B-2), be according to demand batch adjustment.

13. disposal password used for internet trade according to claim 1 produces and application process, it is characterized in that wherein said step (A) is the data that receives from first user's interface.

14. a disposal password used for internet trade produces and application system, can link by the website servomechanism of a networking bank and a user one first different user's interface, one second user's interface, it is characterized in that this system comprises:

One receives module, receives the individual identification data that transmits from this first user interface, transaction data, and the data of follow-up passback;

One subscriber data storehouse, the individual identification data of stored user in advance comprises a default mobile phone door number;

One computing module is given information according to this transaction data and a system, computing produce one group exclusive to disposal password that should transaction, this disposal password comprises a transaction code, and a transaction identifying code;

One first sends module, and this transaction code is transmitted and be shown in this first user interface by Internet;

One second sends module, and this transaction verification sign indicating number is transmitted in this second user interface by non-Internet world wide web mechanism; And

One management module, whether the transaction verification sign indicating number of checking this user's passback is correct.

15. produce and application system according to the described disposal password used for internet trade of claim 14, it is characterized in that this second transmission module is that the world wide web mechanism of this transaction verification sign indicating number by the non-Internet of news in brief, wireless packet-switched service, multimedia short message service, fax, voice, Email is transmitted.

16. produce and application system according to the described disposal password used for internet trade of claim 14, it is characterized in that this second transmission module is that a news in brief produces module, integrate generation one news in brief according to this transaction code, transaction verification sign indicating number, transmit and be shown in this second user interface by mobile communication network.

17. produce and application system according to claim 14,15 or 16 described disposal password used for internet trade, it is characterized in that the transaction code that this computing module produces is a written form, the transaction verification sign indicating number then is a digital form.

18. produce and application system according to claim 14,15 or 16 described disposal password used for internet trade, it is characterized in that this computing module also according to this individual identification data, comprise that user account number, password, door number, I.D. font size, date of birth wherein carry out one of at least logical operation.

19. produce and application system according to claim 14,15 or 16 described disposal password used for internet trade, the transaction data that it is characterized in that this computing module computing foundation comprises and enables transaction, financial transaction kind, transaction account, transaction limit, exchange hour wherein one of at least.

20. produce and application systems according to the described disposal password used for internet trade of claim 14, it is the default parameter that comprises the demand of looking batch adjustment that the system that it is characterized in that this computing module computing foundation gives information.

21. produce and application system according to the described disposal password used for internet trade of claim 20, it is characterized in that this computing module utilizes the random number function of system to produce this transaction code through computing; And according to this transaction code, add transaction data, individual identification data, and the parameter of system's generation, logical operation produces this transaction verification sign indicating number.

22. produce and application system according to the described disposal password used for internet trade of claim 14, it is characterized in that this system sends the service supplier with a news in brief to cooperate, and link by news in brief special line and telecommunications dealer.

Images