TW202319998A - System for using multiple security levels to verify customer identity and transaction services and method thereof - Google Patents

Abstract

A system for using multiple security levels to verify customer identity and transaction services and a method thereof are provided. By using Fast Identity Online framework to login a financial institution with biometrics by a client, choosing a security verification method corresponding risk level of a transaction service to verify customer's identity when the client requests the transaction service from the financial institution, and publishing an evidence data that can verify transaction data of the transaction service and verification data generated during the customer's identity verification to a blockchain by related nodes on the blockchain, the system and the method can establish verification procedures and standards that allow financial institutions to trust each other, and can achieve the effect of increasing complexity and cost of crime, reducing wasted resources of financial institutions, and taking care of security and convenience of transactions.

Description

System and method for verifying customer identity and transaction services using multiple security levels

An identity and transaction verification system and method thereof, in particular a system and method for verifying client identity and transaction services using multiple security levels.

The Common Criteria for Information Technology Security Assessment (CC, ISO/IES15408) is an information security product certification framework established for more than 20 years. It is divided into seven security assessment levels. The first to fourth levels are for evaluating general products or systems. Security level, the fifth level and above are the standards for evaluating the design of national security or military equipment products. Under such a clear, unified and common standard, the IT products produced by countries that adopt the CC standard can gain the trust of the government, enterprises and the general public on a large scale, and various systems designed using these products can be quantified Its security, or conversely, select suitable IT products according to the security strength required by the system.

Transferring to the domestic financial industry scene, comprehensive digitization has become the trend, but digital financial risk control and information security standards are lacking. For the insurance industry, each insurance company's underwriting, claims, and preservation Although the verification workflow is handled in accordance with the regulations, the regulations are only a guiding structure and do not specify the procedures and standards. This leads to the fact that the procedures and verification standards of each insurance company are usually different. In this way, financial institutions cannot trust each other, that is, they cannot trust the verification results of other financial institutions, so each financial institution needs to perform the same verification process, resulting in a waste of resources.

To sum up, it can be seen that there has been a long-term problem in the prior art that domestic financial institutions do not have mutual trustworthy verification procedures and standards. Therefore, it is necessary to propose improved technical means to solve this problem.

In view of the problem in the prior art that domestic financial institutions do not have mutual trustworthy verification procedures and standards, the present invention discloses a system and method for verifying customer identities and transaction services using multiple security levels, in which:

The system disclosed in the present invention that uses multiple security levels to verify customer identity and transaction services includes at least: a client terminal, which is installed with a trusted module, and the trusted module stores transaction verification data; a financial institution terminal, which is used by the client terminal The Fast IDentity Online (FIDO) architecture uses biometrics to log in, and when the client requests transaction services, it judges whether the transaction service meets the basic transaction level. When the transaction service is at the basic transaction level, an identity verification request is generated; the platform The terminal is used to receive the identity verification request sent by the financial institution, and requires the client to perform identity verification, so that the client encrypts the transaction verification data to generate transaction encryption data and transmits the transaction encryption data to the platform, and is used to decrypt the transaction encryption After obtaining the identity verification data and confirming that the identity verification data is consistent with the transaction verification data, generate the first certificate data according to the identity verification request and transaction encryption data and publish the first certificate data to the blockchain, and send the identity verification The result is sent to the financial institution side, so that the financial institution side generates the transaction data corresponding to the requested transaction service when the identity verification result indicates that the verification is passed; For the transaction data sent, sign the transaction data to generate an authentic signature, and send the authentic signature to the platform; the authentication end is used to receive the authentic signature sent by the platform, and generate the second deposit certificate based on the authentic signature data, and release the second deposit certificate data to the block chain.

The method disclosed in the present invention for verifying client identity and transaction services with multiple security levels includes at least the following steps: the client uses an online quick authentication framework to log in to the financial institution with biometric features; the financial institution determines when the client requests transaction services When the transaction service is at the basic transaction level, the identity verification request is sent to the platform, so that the platform requires the client to perform identity verification; the client encrypts the transaction verification data to generate transaction encryption data and sends the transaction encryption data to the platform; the platform decrypts the transaction Encrypt the data to obtain the identity verification data and confirm that the identity verification data is consistent with the transaction verification data, and then send the identity verification result to the financial institution; the platform generates the first certificate data based on the identity verification request and transaction encryption data and publishes the first Store the certificate data in the blockchain; when the identity verification result indicates that the financial institution has passed the verification, it will generate the transaction data corresponding to the transaction service; when the financial institution judges that the transaction service is the actual transaction level, it will send the transaction data to the trusted unit; The public trust unit signs the transaction data to generate a public trust seal, and transmits the public trust seal to the platform; the platform transmits the public trust seal to the authentication terminal, and the certification terminal generates the second deposit certificate data based on the public trust signature and publishes the second depository. certificate data to the blockchain.

The system and method disclosed in the present invention are as above, and the difference between the present invention and the prior art is that after the client uses the online quick authentication framework to log in to the financial institution with biometric features, when the financial institution requests a transaction service from the client, it will The risk level of the requested transaction service selects the corresponding security verification method to verify the identity of the customer, and publishes the proof data that can verify the verification data generated during the verification process and the transaction data of the requested transaction service to the block In order to solve the problems existing in the previous technology, it can achieve the technical effect of increasing the complexity and cost of crime, reducing the resources wasted by financial institutions, and taking into account transaction security and convenience.

The features and implementation methods of the present invention will be described in detail below in conjunction with the drawings and embodiments, the content is enough to enable anyone familiar with the relevant art to easily and fully understand the technical means used to solve the technical problems of the present invention and implement them accordingly, thereby realizing The effect that the present invention can achieve.

The present invention allows the financial institution to use different security verification technologies through the platform according to the different risk levels of the transaction services of the client. Among them, transaction services include financial services that do not involve money, financial transactions that involve small amounts of money, financial transactions that involve large amounts of money, and the like.

The system operation of the present invention will be described below with "Fig. 1", the system architecture diagram of the present invention using multiple security levels to verify customer identity and transaction services. As shown in "Fig. 1", the system of the present invention includes a client terminal 110, a financial institution terminal 130, a platform terminal 150, a trust unit terminal 160, an authentication terminal 170, and an additional server terminal 120. Among them, the client 110, the server 120, the financial institution 130, the platform 150, the trustworthy unit 160, and the authentication terminal 170 can be computing devices, and the client 110 and the financial institution 130/platform 150, the server 120 and the financial institution terminal 130/platform terminal 150, between the financial institution terminal 130 and the platform terminal 150/trusted unit terminal 160, and between the platform terminal 150 and the public trust unit terminal 160 can be connected through wired or wireless communication, so as to communicate with each other transmit information or signals.

The client 110 is equipped with a trusted module. The trusted module is a physical component that can store data such as a SIM card, a sensor chip, and an expansion card. The sensor chip can be attached to the SIM card, and the expansion card can be embedded with a SIM card. The client 110 can apply for a trusted module from the platform terminal 150 or the financial institution terminal 130, and can install the trusted module after the trusted module is enabled. In some embodiments, the trusted module can be connected with the client 110 device identification data binding. It should be noted that the trusted module only provides writing data or reading data to prevent data from being tampered with.

The client 110 can use the real-name verification to register on the platform 150, and can also receive the login verification data and transaction verification data sent by the platform 150 after the registration is completed, and can use the trusted module to store the received login verification data and Transaction verification data. Among them, real-name verification includes but is not limited to mobile identity identification (Mobile ID, MID) or digital identity identification (eID).

The client 110 can also receive the client authentication information sent by the platform 150, and store the received client authentication information. In general, the client 110 can use a trusted module to store client authentication information.

The client 110 can also register on the blockchain 190 through a distributed digital identity (Decentralized Identity, DID) registry service to obtain distributed digital identity identification data corresponding to the blockchain 190 .

The client terminal 110 is also responsible for logging into the financial institution terminal 130 with biometric features, and is responsible for requesting transaction services from the financial institution terminal 13 . For example, the client 110 can use the Fast IDentity Online (FIDO) framework to log in to the financial institution 130 with biometric features. More specifically, the client 110 can verify the user's biometrics when logging in to the financial institution 130. And after the user's biometric feature has passed the feature identification, the login verification data and organization login data can be read from the trusted module, and the login verification data and organization login data can be sent to the platform terminal 150, so as to pass the platform terminal 150 Send the institution login information to the financial institution terminal 130 . Among them, the biometric features mentioned in the present invention include fingerprint features, face features, iris features, etc., but the present invention is not limited thereto; the institution login information is the information registered by the user of the client terminal 110 in the financial institution terminal 130 in advance , including but not limited to account passwords, etc.

The client 110 can also read out the login verification data from the trusted module after performing biometric identification on the user, and can encrypt the read out login verification data to generate corresponding login encryption data, and can store all the login verification data The generated login encryption data is transmitted to the platform terminal 150; the client terminal 110 is also responsible for reading the transaction verification data from the trusted module when receiving the identity verification request sent by the platform terminal 150, and encrypting the read transaction verification data to generate transaction encryption data, and transmit the generated transaction encryption data to the platform terminal 150. In some embodiments, the client terminal 110 may also require the platform terminal 150 to issue a verifiable statement (Verifiable Credential , VC); the client 110 can also read the trusted security information from the trusted module when receiving the module verification request sent by the platform terminal 150, and encrypt the read trusted security information to generate a model Set encrypted data, and send the generated module encrypted data to the platform terminal 150 . Wherein, the trusted security data is all or part of the data or specific data stored by the trusted module.

The client 110 can use the private key to encrypt the data to be encrypted (such as login verification data, transaction verification data, trusted security data, etc.) to generate corresponding encrypted result data (such as login encryption data, transaction encryption data, module encryption data, etc.) , you can also use the Time-based One-Time Password (TOTP) received from the platform terminal 150 to encrypt the data to be encrypted to generate the encrypted result data, or you can first use the private key to encrypt the data to be encrypted to generate intermediate After the ciphertext, use a time-based one-time password to encrypt the intermediate ciphertext to generate encrypted result data, but the client 110 generates login encrypted data/transaction encrypted data/modules from login verification data/transaction verification data/trusted security data The method of encrypting data is not limited to the above. Wherein, the client 110 can use AES, RSA or other similar symmetric or asymmetric algorithm to encrypt the data to be encrypted.

The server 120 can provide the device identification data input to the client 110 so that the platform 150 or the financial institution 130 can enable the trusted module applied by the client 110 . Generally speaking, the server 120 can transmit the device identification data to the platform 150 or the financial institution 130 where the client 110 applies for a trusted module through a wired or wireless network. Wherein, the device identification data of the client 110 is data capable of identifying the client 110 , including but not limited to the product serial number or machine number of the client 110 .

The financial institution terminal 130 can generate login verification data and transaction verification data corresponding to the client terminal 110 when the client terminal 110 completes registration through real-name verification, and send the generated login verification data and transaction verification data to the client terminal 110 . Generally speaking, the financial institution terminal 130 can randomly generate login verification data/transaction verification data, but the present invention is not limited thereto. For example, calculations such as hash or bit rearrangement can also be performed on the current time to generate login Verification data/transaction verification data. Wherein, the login verification data/transaction verification data may be composed of a certain number of characters, letters, numbers, and symbols arranged in any order.

The financial institution terminal 130 can also authenticate the personal information of the user of the client terminal 110 .

The financial institution terminal 130 is responsible for providing the client terminal 110 to log in with biometric features, such as using the FIDO framework. The financial institution terminal 130 can generate a login verification request when requesting the client terminal 110 to log in, and can transmit the generated login verification request to the platform terminal 150, and can also receive the institutional login information transmitted by the platform terminal 150, and check the received information. When the institution login information is obtained, the client terminal 110 is allowed to log in to the financial institution terminal 130 when the institution login information passes the check. Wherein, the financial institution terminal 130 can check the institution login information registered by the client terminal 110 in a conventional manner, so details are not repeated here.

The financial institution terminal 130 is also responsible for determining the risk level of the received transaction service when receiving the transaction service from the client terminal 110 . In the present invention, the risk level may include the basic transaction level and the actual transaction level. In some embodiments, the risk level may also include the supervisory transaction level, but the risk level mentioned in the present invention is not limited to the above. Among them, the basic transaction level can include all transaction services, that is, it can include transaction services such as inquiries or settings that do not involve money transactions, and all transaction services that involve money; the actual transaction level can include all transaction services that involve money; regulatory transactions The level can be transaction services involving large amounts of money (the amount is greater than the threshold), but the basic transaction level, actual transaction level, and regulatory transaction level are not limited to the above. It should be noted that a transaction service may belong to multiple risk levels at the same time, and the financial institution terminal 130 may further determine whether the transaction service also belongs to a smaller risk level when judging that the transaction service belongs to a wider risk level, for example, The financial institution terminal 130 can determine whether the transaction service also belongs to the actual transaction level when the transaction service belongs to the basic transaction level, and can determine whether the transaction service also belongs to the supervisory transaction level when the transaction service belongs to the actual transaction level.

The financial institution terminal 130 is also responsible for generating an identity verification request when judging that the received transaction service is a basic transaction level, and sending the generated identity verification request to the platform end 150, and responsible for receiving the identity verification generated by the platform end 150 As a result, when it is judged that the content recorded in the identity verification result indicates that the user of the client terminal 110 has passed the verification, the transaction data corresponding to the requested transaction service is generated to complete the transaction. In some embodiments, the identity verification request may include a request to obtain a verifiable statement related to the financial institution end 130 issued with the distributed digital identification information of the user of the client end 110, and the identity verification result may be the platform end 150 issued a verifiable statement, at this time, the financial institution 130 may not receive the identity verification result sent by the platform 150, but can use the distributed digital identification data of the user of the client 110 to be transmitted by the blockchain 190 obtains the corresponding verifiable statement, and can use the public key of platform 150 to verify the signature in the obtained verifiable statement (and confirm the validity and expiration time) to verify the obtained verifiable statement. After the verification statement is verified and the identity of the user of the client terminal 110 is confirmed in the verifiable statement, the financial institution terminal 130 can determine that the identity verification result indicates that the verification is passed.

The financial institution terminal 130 is also responsible for judging whether the received transaction service is at the actual transaction level, and if so, the generated transaction data can be sent to the trust unit terminal 160; the financial institution terminal 130 can also determine whether the transaction service is at the supervisory transaction level , if so, then the financial institution terminal 130 can generate a module verification request, and can transmit the generated module verification request to the platform terminal 150; Execution can be concluded after transaction services are provided.

The financial institution terminal 130 can also receive the declaration form sent by the platform terminal 150 , and can generate the first declaration data according to the received declaration form, and can transmit the generated first declaration data to the platform terminal 150 .

The platform end 150 is responsible for receiving the identity verification request sent by the financial institution end 130, and requires the client terminal 110 to perform identity verification according to the received identity verification request; the platform end 150 can also receive the module verification request sent by the financial institution end 130 , and require the client 110 to verify the trusted module according to the received module verification request; the platform side 150 can also receive the login verification request sent by the financial institution side 130, and according to the received login verification request request The client 110 provides login verification information.

The platform terminal 150 can also receive the login verification data and the organization login data sent by the client 110, and verify the login verification data, that is, compare whether the received login verification data is the same as the stored login verification data, and if so, then Indicates that the login verification information has been verified; if not, it indicates that the login verification information has not been verified. The platform terminal 150 may also transmit the received institution login information to the financial institution terminal 130 when the login verification information is verified.

The platform end 150 is also responsible for receiving the transaction encryption data sent by the client 110, and decrypting the received transaction encryption data to obtain the identity verification data; the platform end 150 can also receive the module encryption data sent by the client 110, and Decrypt the received module encrypted data to obtain the module verification data; the platform 150 can also receive the login encrypted data sent by the client 110, and decrypt the login encrypted data to obtain the login verification data. Among them, the method for the platform 150 to decrypt the encrypted result data (such as login encrypted data, transaction encrypted data, module encrypted data, etc.) varies with the way the encrypted result data is encrypted. For example, when the encrypted result data is When the terminal 110 encrypts the generated data with the private key, the platform terminal 150 can use the public key of the client 110 to decrypt the encrypted result data to generate decrypted data (such as login verification data, identity verification data, module verification data, etc.); When the resulting data is encrypted by the client 110 with a time-based one-time password generated by the platform 150, the platform 150 can use the generated one-time password to decrypt and decrypt the encrypted result data to generate the original data; and when the encrypted result data When the client 110 encrypts the data with the private key and the one-time password successively, the platform 150 can first use the one-time password to decrypt the encrypted result data to generate an intermediate ciphertext, and then use the public key of the client 110 to decrypt the intermediate ciphertext to generate Original data, but the method for the client 110 to decrypt login encrypted data/transaction encrypted data/module encrypted data to obtain login verification data/identity verification data/module verification data is not limited to the above.

The platform 150 is also responsible for confirming whether the identity verification data obtained by decrypting the encrypted transaction data is consistent with the pre-stored transaction verification data of the client 110, and can generate an identity verification result corresponding to the confirmation result. The platform side 150 can transmit the identity verification result to the client terminal 110 and/or the financial institution side 130 when the identity verification data does not match the transaction verification data; the platform side 150 is also responsible for Send the generated identity verification result to the financial institution terminal 130, and be responsible for generating the first deposit data according to the identity verification request and transaction encryption data, and publish the block containing the generated first deposit data to the block chain 190 in. Generally speaking, the platform 150 can first perform a specific operation on the identity verification request and the transaction encryption data to generate the first certificate data, and then generate a block containing the first certificate data, but the present invention is not limited thereto. For example, the platform end 150 may also generate the first evidence deposit information including the identity verification request and transaction encryption information. Wherein, the above specific operations include but not limited to hash operations.

The platform 150 can also receive the statement issuance request sent by the client terminal 110, and can read out the corresponding user name according to the received issuance request when confirming that the obtained identity verification data is consistent with the pre-stored transaction verification data. information, and generate disclosure information based on all or part of the user information, and use the private key of the platform 150 to sign the disclosure information to generate a verifiable statement, and the issued verifiable statement can be issued to the blockchain 190 . Wherein, the disclosed information may be all or part of the user data read by the client 110, but the present invention is not limited thereto, and the disclosed information may also be sorted user data; the verifiable statement and the client 110 The distributed digital identification information of the user corresponds to and also corresponds to the statement issuance request received.

The platform terminal 150 can also compare whether the module verification data generated by decrypting the encrypted data of the module is consistent with the pre-stored trusted security data. If not, the platform terminal 150 can generate a notification message indicating that the transaction is terminated, and can send the The generated notification message is transmitted to the financial institution terminal 130; and when the module verification data matches the credible security information, the platform terminal 150 can generate or read the declaration form, and transmit the declaration form to the financial institution terminal 130, the platform The terminal 150 can also receive the first declaration data sent by the financial institution terminal 130, generate the second declaration data including the first declaration data, and send the second declaration data to the supervision terminal (not shown in the figure) for storage.

The platform terminal 150 can also generate the third certificate storage data according to the received module verification request, module encryption data and the generated second declaration data, and can publish the generated third certificate storage data to the block chain 190, but the method of generating the third certificate data in the present invention is not limited to the above, for example, the platform 150 can generate the third certificate data including the module verification request, the module encryption data and the second declaration data.

The platform terminal 150 can also compare whether the login verification data generated by decrypting the login encrypted data is consistent with the login verification data generated and stored when the client 110 is registered. If not, the platform terminal 150 can generate a corresponding notification message And the generated notification message is sent to the client terminal 110; and when the login verification data is consistent with the login verification data, the platform terminal 150 can carry out data collection operations, for example, the platform terminal 150 can obtain individuals certified by the financial institution terminal 130 data, and perform specific operations on the obtained personal data to generate corresponding customer authentication data, and send the generated customer authentication data to the client 110. Wherein, the above specific operations include but are not limited to hash operations such as MD5 or encoding operations such as base64.

The platform terminal 150 is also responsible for receiving the public trust signature sent by the public trust unit terminal 160 , and responsible for transmitting the received public trust signature to the authentication terminal 170 .

The trust unit terminal 160 is responsible for receiving the transaction data sent by the financial institution terminal 130 , and signing the received transaction data to generate a trust signature, and responsible for sending the generated trust signature to the platform terminal 150 .

The authentication terminal 170 is responsible for receiving the public trust signature sent by the platform terminal 150, and can store the received public trust signature. The verification terminal 170 is also responsible for generating the second certificate data according to the public trust signature or can generate the second certificate data containing the public trust signature, and can publish the generated second certificate data to the block chain 190 .

Next, an embodiment is used to explain the operating system and method of the present invention, and please refer to "Fig. 2A" for the flow chart of the method of using multiple security levels to verify customer identity and transaction services proposed by the present invention. In this embodiment, it is assumed that the client 110 may be a mobile phone or a computer, but the present invention is not limited thereto.

After the user operates the client terminal 110 to connect to the financial institution terminal 130 , he can operate the client terminal 110 to log in to the financial institution terminal 130 with biometric features (step 210 ). In this embodiment, it is assumed that the client terminal 110 can use the FIDO architecture to log in to the financial institution terminal 130. Further, in this embodiment, as shown in the process of "Figure 2B", when the client terminal 110 connects to the financial institution terminal 130 , the financial institution terminal 130 may require the client terminal 110 to log in, and may transmit a login verification request to the platform terminal 150, so that the platform terminal 150 requests the client terminal 110 to provide login verification information (step 211). After receiving the request from the platform 150 to provide login verification information, the client 110 can ask the user to perform biometric identification using biometric features such as fingerprints, faces, irises, etc., and can obtain the user's biometrics and After judging that the obtained biometrics pass the biometrics identification, the pre-stored login verification data and the institutional login data of the financial institution terminal 130 are read from the trusted module, and the read login verification data and institutional login data can be read Transmit to platform side 150 (step 215). After the platform terminal 150 receives the login verification data and the organization login data sent by the client 110, it can verify the received login verification data. If the login verification information passes the verification of the platform terminal 150, the platform terminal 150 may transmit the received institution login information to the financial institution terminal 130 after judging that the login verification information has passed the verification, so that the financial institution terminal 130 allows the client terminal 110 to log in ( step 219).

Going back to "Figure 2A", after the client 110 uses the FIDO architecture to log in to the financial institution terminal 130 with biometric features (step 210), the client 110 can request transaction services from the financial institution terminal 130, that is, send a transaction service to the financial institution terminal 130. Transaction service requests. The financial institution terminal 130 can determine the risk level of the requested transaction service when receiving the transaction service request from the client terminal 110 . When the risk level of the requested transaction service belongs to the basic transaction level, that is, when the requested transaction service is the basic transaction level, the financial institution terminal 130 can generate an identity verification request, and can send the generated identity verification request to the platform The terminal 150 makes the platform terminal 150 require the client 110 to perform identity verification (step 220 ). In this embodiment, it is assumed that all transaction services are at the basic transaction level.

When the client 110 receives the identity verification request sent by the platform 150, the client 110 can read the transaction verification data from the trusted module, and encrypt the read transaction verification data to generate transaction encryption data, and The generated transaction encryption data can be sent to the platform 150 (step 231). In this embodiment, it is assumed that the client 110 and the platform 150 agree in advance to use the private key of the client 110 and the time-based one-time password generated by the platform 150 to encrypt the transaction verification data to generate transaction encryption data, for example, the client 110 can first use the private key to encrypt the transaction verification data with the RSA algorithm to generate intermediate ciphertext, and then use the one-time password obtained by synchronizing with the platform terminal 150 every predetermined time (such as 60 seconds) to encrypt the intermediate ciphertext to generate At the same time, the client terminal 110 can also generate a statement issuance request and send it to the platform terminal 150 together with the confidential encrypted information.

After the platform 150 receives the transaction encryption data sent by the client 110, it can decrypt the received transaction encryption data to obtain the identity verification data, and can confirm the obtained identity verification data and send them to the client 110 in advance. Check whether the transaction verification information matches to generate an identity verification result, and send the generated identity verification result to the financial institution terminal 130 (step 235). In this embodiment, it is assumed that the platform 150 can use the last generated time-based one-time password to decrypt the transaction encrypted data to generate intermediate ciphertext, and then use the public key of the client 110 to decrypt the intermediate ciphertext to obtain identity verification data , then, the platform terminal 150 can read the transaction verification data of the client terminal 110, and can compare whether the obtained identity verification data is consistent with the transaction verification data read out, and when the two match, the platform terminal 150 can generate indicates that the identity verification result passed the verification, and when the two do not match, the platform 150 may generate an identity verification result indicating that the verification has not passed. In addition, the platform 150 can also generate a certificate corresponding to the distributed digital identification data of the user of the client according to the statement issuance request received from the client 110 when the identity verification data matches the transaction verification data. The statement is verified, and the issued verifiable statement can be published to the blockchain 190.

Similarly, after the platform terminal 150 receives the transaction encryption data sent by the client terminal 110, it can generate the first deposit certificate data according to the identity verification request received from the financial institution terminal 130 and the transaction encryption data received from the client terminal 110, and can store The generated first certificate data is released to the blockchain 190 (step 240 ), so as to deposit the data through the blockchain 190 . In this embodiment, it is assumed that the platform 150 can perform a hash operation on the identity verification request and the encrypted transaction data to generate the first evidence deposit data.

After the financial institution terminal 130 receives the identity verification result generated by the platform terminal 150, it can judge whether the received identity verification result indicates that the verification is passed, and if not, the financial institution end 130 can reject the transaction service requested by the client terminal 110 , and if the identity verification result indicates that the verification is passed, the financial institution terminal 130 may generate transaction data corresponding to the transaction service requested by the client terminal 110 (step 250 ). Among them, the financial institution terminal 130 can directly judge whether the identity verification result indicates passing the verification according to the identity verification result sent by the platform end 150, or can obtain it from the blockchain 190 according to the distributed digital identification information of the user of the client terminal 110. verifiable statement (identity verification result), and can use the public key of platform 150 to verify the signature in the obtained verifiable statement, and confirm the validity and expiration time, so as to verify the obtained verifiable statement. After the verification statement is verified by the financial institution terminal 130 and the identity of the user of the client terminal 110 is confirmed in the verifiable statement, the financial institution terminal 130 can determine that the identity verification result indicates that the verification is passed.

Next, the financial institution terminal 130 can determine whether the transaction service requested by the client terminal 110 is the actual transaction level, that is, determine whether the risk level of the transaction service belongs to the actual transaction level, and if not, the financial institution terminal 130 can execute the requested transaction Services, such as data query, etc.; and if the transaction service requested by the client terminal 110 is the actual transaction level, that is, the risk level of the transaction service belongs to the actual transaction level, then the financial institution terminal 130 can transmit the generated transaction data to the public trust unit terminal 160 (step 261). In this embodiment, it is assumed that the actual transaction level is a transaction service involving money transactions, and the transaction data includes relevant data of commodities in money transactions.

After the public trust unit terminal 160 receives the transaction data sent by the financial institution terminal 130, the public trust unit terminal 160 can sign the transaction data to generate a public trust seal, and can transmit the produced public trust seal to the platform terminal 150 (step 263).

After the platform terminal 150 receives the public trust signature sent by the public trust unit terminal 160 , it may transmit the received public trust signature to the client terminal 110 or to the authentication terminal 170 . After the client 110 receives the public trust signature transmitted by the platform terminal 150, it can store the received public trust signature in the trusted module; after the authentication terminal 170 receives the public trust signature transmitted by the platform terminal 150 , can generate the second certificate data according to the received public trust signature, and can release the generated second certificate data to the blockchain 190 (step 265), so as to store the data through the blockchain 190 certificate. In this embodiment, it is assumed that the authenticator 170 can perform a hash operation on the trusted signature to generate the second certificate storage material.

In this way, through the present invention, the financial institution terminal 130 can select the security verification mechanism to be executed according to the risk level of the transaction service requested by the client 110, so as to use different security verification technologies to complete transaction services with different risk levels, just like using multiple keys Opening different transaction doors, even if one of the keys is lost, the attacker still cannot use a single key to carry out a fake transaction attack. Therefore, the present invention can increase the cost of crime while taking into account transaction security and convenience.

In the above-mentioned embodiment, the risk level of the transaction service may also include the supervision transaction level, as shown in the process of "Fig. 2C", after the financial institution terminal 130 transmits the transaction data to the public trust unit terminal 160 (step 261) (practical (or after the platform 150 transmits the public trust signature generated by the public trust unit terminal 160 to the client terminal 110 and/or the verification terminal 170), the financial institution terminal 130 can further determine whether the transaction service requested by the client terminal 110 is supervision Transaction level, that is, to determine whether the risk level of the transaction service belongs to the regulatory transaction level, if not, the financial institution terminal 130 can execute the requested transaction service, such as small transactions; and if the transaction service is a regulatory transaction level, the financial institution terminal 130 130 may generate a module verification request, and may transmit the generated module verification request to the platform 150 , so that the platform 150 requires the client 110 to perform trusted module verification (step 271 ).

When the client 110 receives the request for authenticating the trusted module sent by the platform 150, the client 110 can read the trusted security information from the trusted module, and encrypt the read trusted security information to generate Module encryption data, and the generated module encryption data can be sent to the platform 150 (step 273). In this embodiment, it is assumed that the client 110 and the platform 150 agree in advance to use the private key of the client 110 and the time-based one-time password generated by the platform 150 to encrypt the trusted security data to generate module encrypted data, that is, In other words, similar to the encrypted transaction verification data, the client 110 can first read all, part, or specific data from the trusted module as trusted security data, and can use the private key to encrypt the trusted security data. Generate the intermediate ciphertext, and then encrypt the intermediate ciphertext with the one-time password obtained by synchronizing with the platform terminal 150 every predetermined time (such as 30 seconds or less) to generate module encrypted data.

After the platform terminal 150 receives the module encryption data sent by the client 110, it can decrypt the received module encryption data to obtain the module verification data, and can compare the obtained module verification data with the Whether the stored credible security information matches (step 275). In this embodiment, it is assumed that the platform 150 can use the last generated time-based one-time password to decrypt the encrypted data of the module to generate an intermediate ciphertext, and then use the public key of the client 110 to decrypt the intermediate ciphertext to obtain the module ID. Then, the platform terminal 150 can read the credible security information of the client 110, and can compare whether the acquired identity verification information is consistent with the read transaction verification information.

When the module verification information does not match the trusted security information, the financial institution terminal 130 can refuse to execute the transaction service requested by the client 110; and when the module verification information matches the trusted security information, the financial institution terminal 130 The first declaration data can be generated and transmitted to the platform 150 (step 277 ), and the transaction service requested by the client 110 can be executed. In this embodiment, it is assumed that the platform terminal 150 can generate a comparison result indicating whether the module verification data is consistent with the trusted security data, and can transmit the generated comparison result to the financial institution terminal 130, wherein, when the module When the group verification information matches the credible security information, the platform terminal 150 can generate a declaration form, and can transmit the declaration form and the comparison result to the financial institution terminal 130; When the result indicates that the module verification information does not match the trusted security information, choose to refuse service to the client 110, and when the comparison result indicates that the module verification information is consistent with the trusted security information, choose to rely on the information sent by the platform terminal 150. The declaration form generates the first declaration data, and completes the large-value transaction requested by the client 110 .

After the platform terminal 150 receives the first declaration material sent by the financial institution terminal 130, the platform terminal 150 can generate the second declaration material containing the first declaration material, and can transmit the generated second declaration material to the supervisory terminal , and can generate the third deposit certificate data according to the module verification request received from the financial institution terminal 130, the module encryption data received from the client terminal 110, and the generated second declaration data, and the generated third deposit certificate data The certificate data is published to the block chain 190 (step 279), so as to store the data through the block chain 190. In this embodiment, it is assumed that the platform 150 can perform a hash operation on the module verification request, the module encryption data, and the second declaration data to generate the third certificate storage data.

In addition, in the above-mentioned embodiment, as shown in the process of "Figure 3A", before the client 110 uses the FIDO framework to log in to the financial institution terminal 130 with biometric features (step 210), the client 110 can send a request to the platform terminal 150 or The financial institution terminal 130 applies for a trusted module (step 311 ). The platform side 150 or the financial institution side 130 can notify the cooperating telecommunications provider to make a trusted module, and deliver the trusted module to the user of the client terminal 110 by delivery or post.

Then, the service personnel of the platform 150 or the financial institution 130 that the client 110 applies for a trusted module can operate the server 120 to input the device identification data of the client 110, and can transmit the device identification data to the platform 150 through the network Or the financial institution terminal 130, so as to enable the trusted module online (step 313), that is, the platform terminal 150 or the financial institution terminal 130 records the corresponding relationship between the trusted module and the identification data of the client terminal 110, so that the platform terminal 150 or The financial institution terminal 130 can confirm that the computing device that accesses the trusted module is the client 110 that applies for the trusted module. In this way, after the trusted module is enabled, the user of the client 110 can install the trusted module in the client 110 (step 315), and then the user of the client 110 can operate the client 110 to perform biometric For identification, the client 110 can access the trusted module after the user's biometrics are authenticated, so as to confirm whether the trusted module is successfully activated.

In addition, before the client 110 uses the FIDO framework to log in to the financial institution 130 with biometric features (step 210), as shown in the process of "Figure 3B", the user can operate the client 110 to connect to the platform After 150, operate the client 110 to register on the platform 150, so that the client 110 completes the registration on the platform 150 through real-name verification (step 351).

The platform 150 can generate login verification data and transaction verification data corresponding to the client 110 after the client 110 completes the registration, and can store the generated login verification data, transaction verification data, and the public key of the client 110, and The generated login verification data and transaction verification data can be sent to the client 110 (step 353), so that the client 110 stores the login verification data, transaction verification data, and private key sent by the platform 150 in the trusted module middle.

Afterwards, when the client 110 receives a request for identity verification, the client 110 can require the user to perform biometric identification, and after the user's biometric has passed the biometric identification, the client 110 can read out from the trusted module Login verification data, and encrypt the read login verification data to generate login encryption data, and send the generated login encryption data to the platform 150 (step 361). Wherein, the process of encrypting the login verification data by the client 110 is the same as the encryption process described above, and will not be repeated here.

After the platform terminal 150 receives the login encrypted data sent by the client terminal 110, the platform terminal 150 can decrypt the login encrypted data to obtain the login verification data, and can compare the login verification data with the stored login data corresponding to the client terminal 110. Login verification data (step 365). Wherein, the process for the platform 150 to decrypt the login encrypted data to obtain the login verification data is the same as the decryption process described above, and will not be repeated here.

When the platform terminal 150 judges that the login verification information obtained by decryption is consistent with the read login verification information, the platform terminal 150 can obtain the personal information certified by the financial institution terminal 130, and the platform terminal 150 or the trust unit terminal 160 can verify the platform The personal data obtained by the terminal 150 is used for specific operations to generate corresponding customer authentication data and the generated customer certification data is sent to the client 110, so that the client 110 can store the received customer certification data in a trusted module. In the group, or the financial institution terminal 130 can obtain customer authentication information (authorization permission) from the client terminal 110 through the mechanism of oAuth 2.0 and send the customer authentication information to the platform terminal 150, so as to download the personal information corresponding to the customer authentication information from the platform terminal 150 (step 370).

To sum up, it can be seen that the difference between the present invention and the prior art lies in that after the client uses the online quick authentication framework to log in to the financial institution with biometric features, when the financial institution requests a transaction service from the client, it will The risk level of the service selects the corresponding security verification method to verify the identity of the customer, and publishes the proof data that can verify the verification data generated during the verification process and the transaction data of the requested transaction service to the blockchain. Technical means, through this technical means, can solve the problem of lack of mutual trust verification process and standards among domestic financial institutions in the previous technology, and then achieve the goal of increasing the complexity and cost of crimes, reducing the resources wasted by financial institutions, and taking into account transactions Technical efficacy for safety and convenience.

Furthermore, the method of using multiple security levels to verify customer identity and transaction services of the present invention can be implemented in hardware, software, or a combination of hardware and software, and can also be implemented in a centralized manner in a computer system or distributed with different components Implemented in a decentralized manner over several interconnected computer systems.

Although the embodiments disclosed in the present invention are as above, the content described is not intended to directly limit the scope of protection of the present invention. Anyone with ordinary knowledge in the technical field of the present invention, without departing from the spirit and scope disclosed in the present invention, makes some changes and modifications to the form and details of the implementation of the present invention, all of which belong to the patent protection of the present invention scope. The scope of patent protection of the present invention shall still be defined by the scope of the attached patent application.

110: client 120: server 130: Financial institution side 150: Platform end 160: Public trust unit end 170: authentication terminal 190: Blockchain Step 210: the client logs in to the financial institution with biometric features Step 211: The financial institution sends a login verification request to the platform when requesting the client to log in, so that the platform requests the client for login verification information Step 215: After the client passes the biometric identification, read the institution login information and login verification information of the financial institution, and send the login verification information and institution login information to the platform Step 219: After the login verification information is verified on the platform side, send the organization login information to the financial institution side, so that the financial institution side allows the client to log in Step 220: When the financial institution requests the transaction service from the client terminal and determines that the transaction service is at the basic transaction level, it sends an identity verification request to the platform side, so that the platform side requires the client side to perform identity verification Step 231: The client encrypts the transaction verification data to generate the transaction encryption data and sends the transaction encryption data to the platform Step 235: The platform side decrypts the transaction encryption data to obtain the identity verification data and sends the identity verification result indicating whether the identity verification data matches the transaction verification data to the financial institution side Step 240: The platform side generates the first evidence deposit data according to the identity verification request and transaction encryption data and publishes it to the blockchain Step 250: The financial institution generates transaction data corresponding to the transaction service when the identity verification result indicates that the verification is passed Step 261: When the financial institution judges that the transaction service is at the actual transaction level, send the transaction data to the trusted entity Step 263: The trusted unit signs the transaction data to generate a trusted signature, and sends the trusted signature to the platform Step 265: The platform side transmits the public trust signature to the authentication side, and the verification side generates the second certificate storage data according to the public trust signature and publishes it to the blockchain Step 271: When the financial institution side judges that the transaction service is a regulatory transaction level, it sends a module verification request to the platform side, so that the platform side asks the client side for trusted module verification Step 273: The client encrypts the trusted security data stored in the trusted module to generate module encrypted data, and sends the module encrypted data to the platform Step 275: The platform side decrypts the encrypted data of the module to obtain the module verification data and compares the module verification data with the trusted security data Step 277: When the module verification information matches the credible security information, the financial institution side generates the first declaration information and transmits it to the platform side Step 279: The platform side generates the second declaration data including the first declaration data, and generates the third certificate storage data according to the module verification request, the module encryption data and the second declaration data and publishes it to the blockchain Step 311: The client applies to the platform or the financial institution for the trusted module of the entity Step 313: The server enters the device identification information of the client online to activate the trusted module Step 315: the client installs a trusted module Step 351: The client completes the registration with the real-name verification on the platform side Step 353: The platform sends the login verification data and transaction verification data to the client terminal Step 361: After the client performs biometric identification on the user, encrypt the login verification data to generate login encrypted data and send the login encrypted data to the platform Step 365: The platform side decrypts the login encrypted data to obtain the login verification data and compares the login verification data with the login verification data Step 370: When the login verification information matches the login verification information, the platform side obtains the personal data certified by the financial institution side, and the platform side or the public trust unit side calculates the personal data to generate corresponding customer authentication data and sends it to Stored by the client, or the financial institution obtains the customer authentication information from the client, and sends the customer authentication information to the platform to download personal information from the platform

Figure 1 is a system architecture diagram of the present invention using multiple security levels to verify customer identity and transaction services. FIG. 2A is a flow chart of the method for verifying customer identity and transaction services using multiple security levels proposed by the present invention. FIG. 2B is a flow chart of the method for the client to log in to the financial institution according to the present invention. FIG. 2C is a flowchart of an additional method for verifying customer identity and transaction services using multiple security levels proposed by the present invention. FIG. 3A is a flowchart of a method for installing a trusted module on a client terminal according to the present invention. FIG. 3B is a flow chart of the method for completing the registration of the client on the platform according to the present invention.

Step 210: the client logs in to the financial institution with biometric features

Step 220: When the financial institution requests the transaction service from the client terminal and determines that the transaction service is at the basic transaction level, it sends an identity verification request to the platform side, so that the platform side requires the client side to perform identity verification

Step 231: The client encrypts the transaction verification data to generate the transaction encryption data and sends the transaction encryption data to the platform

Step 235: The platform side decrypts the transaction encryption data to obtain the identity verification data and sends the identity verification result indicating whether the identity verification data matches the transaction verification data to the financial institution side

Step 240: The platform side generates the first evidence deposit data according to the identity verification request and transaction encryption data and publishes it to the blockchain

Step 250: The financial institution generates transaction data corresponding to the transaction service when the identity verification result indicates that the verification is passed

Step 261: When the financial institution judges that the transaction service is at the actual transaction level, send the transaction data to the trusted entity

Step 263: The trusted unit signs the transaction data to generate a trusted signature, and sends the trusted signature to the platform

Step 265: The platform side transmits the public trust signature to the authentication side, and the verification side generates the second certificate storage data according to the public trust signature and publishes it to the blockchain

Claims (10)

A method for verifying customer identity and transaction services using multiple security levels, the method at least includes the following steps: A client logs in to a financial institution with biometric features; When the client terminal requests a transaction service, the financial institution determines that the transaction service is at the basic transaction level, and sends an identity verification request to a platform, so that the platform requires the client to perform identity verification; The client encrypts a transaction verification data to generate a transaction encryption data and transmits the transaction encryption data to the platform; The platform side decrypts the transaction encryption data to obtain an identity verification data, and after confirming that the identity verification data matches the transaction verification data, sends an identity verification result to the financial institution side; The platform side generates a first deposit data according to the identity verification request and the transaction encrypted data, and releases the first deposit data to a block chain; The financial institution generates a transaction data corresponding to the transaction service when the identity verification result indicates that the verification is passed; When the financial institution determines that the transaction service is at the actual transaction level, it transmits the transaction data to a trusted entity; The credible unit signs the transaction data to generate a credible signature, and transmits the credible signature to the platform; and The platform transmits the public trust signature to an authentication terminal, and the certification terminal generates a second certificate storage data based on the public trust signature and releases the second certificate storage data to the block chain. The method for verifying customer identity and transaction service using multiple security levels as described in Claim 1, wherein the method further includes the determination of the financial institution side after the step of judging that the requested transaction service is an actual transaction level at the financial institution side When the transaction service is at the supervisory transaction level, a module verification request is sent to the platform, and the platform requests the client to verify the trusted module, so that the client encrypts the trusted module installed on the client. Generating a module encrypted data and sending the module encrypted data to the platform side, the platform side decrypts the module encrypted data to obtain a module verification data and compares the module Group verification data and the credible safety data, when the module verification data is consistent with the credible safety data, the financial institution side generates a first declaration data and sends it to the platform side, and the platform side generates a first declaration data containing the The second declaration data of the first declaration data is sent to a supervisory terminal, and a third certificate deposit data is generated according to the module verification request, the module encryption data and the second declaration data, and the third deposit certificate is released Steps to verify data to the blockchain. The method for verifying client identity and transaction services using multiple security levels as described in claim 1, wherein the method further includes the client registering the client with a real name on the platform before the client logs in to the financial institution using biometric features After the registration is completed, the platform sends a login verification data and a transaction verification data to the client, and the client encrypts the login verification data to generate a login encryption data and transmits the login encryption data after biometric identification of the user. data to the platform side, the platform side decrypts the login encrypted data to obtain a login verification data and compares the login verification data with the login verification data, and when the login verification data matches the login verification data, the The platform side obtains the personal data certified by the financial institution side, and the platform side or the trusted unit side performs calculations on the personal data to generate a corresponding customer authentication data and sends it to the client side for storage, or the financial institution side is The client terminal obtains the client authentication information, and transmits the client authentication information to the platform to download the personal information from the platform. The method for verifying client identity and transaction services using multiple security levels as described in claim 1, wherein the step of the client logging in to the financial institution with biometric features further includes the financial institution requiring the client to use online fast authentication (Fast IDentity Online, FIDO) framework to send a login verification request to the platform side, so that the platform side requests a login verification data from the client side, and the client side obtains the institutional login data of the financial institution side after passing biometric identification and After reading out the login verification information, send the login verification information and the institution’s login information to the platform, and the platform will send the institution’s login information to the financial institution after successfully verifying the login verification information sent by the client , the step of enabling the financial institution to allow the client to log in. The method for verifying client identity and transaction services using multiple security levels as described in claim 1, wherein the method further includes sending the client to the platform or the financial institution before the client uses biometrics to log in to the financial institution. After the financial institution side applies for a trusted module of the entity, a server side inputs the device identification data of the client terminal online to activate the trusted module, and the client installs the trusted module. A system for verifying customer identity and transaction services using multiple security levels, the system at least includes: A client, installed with a trusted module, the trusted module stores a transaction verification data; A financial institution terminal is used to provide the client terminal to log in with biometric features, and when the client terminal requests a transaction service, judge whether the transaction service meets the basic transaction level, and when the transaction service is the basic transaction level, generate a identity verification request; A platform end, used to receive the identity verification request sent by the financial institution end, and request the client end to perform identity verification, make the client end encrypt the transaction verification data to generate a transaction encryption data, and send the transaction encryption data to On the platform side, it is used to decrypt the transaction encryption data to obtain an identity verification data and after confirming that the identity verification data matches the transaction verification data, generate a first deposit certificate data according to the identity verification request and the transaction encryption data And release the first deposit certificate information to a block chain, and send an identity verification result to the financial institution, so that the financial institution will generate a transaction corresponding to the requested transaction service when the identity verification result indicates that the verification is passed. one transaction data; A credible unit end, used to receive the transaction data sent by the financial institution when it judges that the transaction service is an actual transaction level, sign the transaction data to generate a credible signature, and send the credible signature to the platform end; and An authentication terminal is used to receive the public trust signature sent by the platform terminal, generate a second certificate storage data according to the public trust signature, and release the second certificate storage data to the block chain. As described in Claim 6, the system using multiple security levels to verify customer identity and transaction services, wherein the financial institution is further used to send A module verification request is sent to the platform, so that the platform requests the client to verify the trusted module, and the client is further used to encrypt a trusted module stored in the trusted module installed on the client. Secure data to generate a module encrypted data and send the module encrypted data to the platform side, and the platform side is used to decrypt the module encrypted data to obtain a module verification data and compare the module verification data With the credible security data, when the module verification data matches the credible security data, the financial institution generates a first declaration data and transmits it to the platform, and the platform generates the first declaration data including the first declaration data One of the second declaration data is sent to a supervisory terminal, and a third certificate storage data is generated according to the module verification request, the module encryption data and the second declaration data, and the third certificate storage data is released to the blockchain. The system using multiple security levels to verify customer identity and transaction services as described in claim item 6, wherein the platform is further used to send a login verification data and the transaction verification data to the client when the client completes registration with real-name verification terminal, the client is further used to encrypt the login verification data to generate a login encrypted data after biometric identification of the user, and send the login encrypted data to the platform, so that the platform can decrypt the login encrypted data to obtain a The login verification information is compared with the login verification information. When the login verification information matches the login verification information, the platform side obtains a personal data certified by the financial institution side, and the platform The terminal or the trustworthy unit terminal performs calculations on the personal data to generate a corresponding customer authentication information and transmits it to the client for storage, or the financial institution obtains the customer authentication information from the client and sends the customer authentication information to the client platform to download the personal data from the platform. The system using multiple security levels to verify customer identity and transaction services as described in claim 6, wherein the financial institution is further used to send a login verification request to the platform when requiring the client to log in using an online fast authentication framework, Make the platform side request a login verification data from the client terminal, and the client terminal is further used to obtain the institutional login data of the financial institution side through biometric identification and read out the login verification data by the trusted module, Send the login verification information and the institution's login information to the platform, and the platform is further used to send the institution's login information to the financial institution after successfully verifying the login verification information sent by the client, so that the financial institution The institution allows the client to log in. The system using multiple security levels to verify customer identity and transaction services as described in claim item 9, wherein the platform is further used to receive a statement issuance request sent by the client, and confirm the identity verification information and the transaction When the verification information matches, issue a verifiable statement corresponding to the distributed digital identification information of the user of the client and the request for issuing the statement, and publish the verifiable statement to the block chain, and the financial institution terminal will use Obtaining and verifying the verifiable statement from the block chain based on the distributed digital identity information of the user of the client, and judging that the identity verification result indicates that the verification is passed when the verifiable statement is verified.

Images