TWI901928B - Method and system for identity verification applied to financial system - Google Patents

Abstract

A method and a system for identity verification are provided. The system provides a financial machine back-end server and a user device back-end server that provides verification service for a user device. In the method, a verification process is initiated by a financial machine for verifying a permission that allows the user device to perform a financial service. The financial machine generates a verification service request. The financial machine back-end server asks the user device back-end server to generate a verification data after receiving the request. The user device back-end server generates the verification data and forwards the verification data to the financial machine via the financial machine back-end server. The user device obtains the verification data from the financial machine, and then transmits to the user device back-end server for verification. The user device is allowed to perform the financial service if the verification is successful.

Description

Identity verification methods and systems applied to financial systems

The manual discloses a technology for verifying specific financial services using different devices, and in particular, a method and system for cross-device identity verification using financial information machines.

Driven by fintech, which makes it easier for people to access various financial services, various information security technologies have been developed, including identity verification technologies. Commonly, when users want to access specific financial services, in addition to traditional passwords and accounts, they are required to undergo secondary verification via their devices. For example, bank websites accessing financial services may require users to verify their mobile phone number registered with their telecommunications service provider using a one-time password (OTP). This time-limited OTP allows users to verify their identity and obtain financial services.

In order to provide more secure financial services through cross-device authentication, the disclosure proposes an identity verification method and system. The identity verification system includes a financial information machine backend for connecting financial information machines located in various locations to provide information exchange services between financial information machines, and a user device backend for providing authentication services for user devices to obtain financial services.

The identity verification method executed by the identity verification system mainly involves initiating an verification process through a financial information terminal to verify whether the user device is allowed to perform specific financial services. The financial information terminal generates a request for verification service information to its backend. Then, the financial information terminal's backend requests the user device's backend to generate verification information. That is, the user device's backend generates the verification information and sends it back to the financial information terminal's backend, which then forwards it to the financial information terminal.

Afterwards, the user operates the user device to obtain verification information from the financial information machine, and then sends it to the user device's backend. The user device's backend compares the received verification information with the verification information generated according to the requirements of the financial information machine's backend, and generates a verification result. When the verification result is successful, the user device is notified to execute the financial service.

Preferably, the identity verification system also includes an application running on the user's device, which, when performing the financial service, waits for the verification result from the financial information machine before determining whether to continue performing the financial service.

Preferably, the financial information terminal can receive user identification data from the wireless signal of the financial card or user device. The user identification data, along with the information requesting the verification service, is transmitted to the backend of the financial information terminal and then to the backend of the user device, so that the backend of the user device can verify the received verification information based on the user identification data.

Furthermore, the method for generating verification information in the user device backend includes: first, generating a time-sensitive first random number and a second random number using a random number generator; storing the second random number and user identification data obtained from the financial information machine backend using a storage device; then, calculating a hash value using a hash algorithm based on the first random number and a fixed string; and finally, calculating a linear password using a cryptographic algorithm based on the user identification data, the hash value, and the second random number. This linear password and the first random number together form the verification information.

Furthermore, when the user device backend receives authentication information from the user device, it obtains the primary password and the first random number from this authentication information, and then obtains the second random number and user identification data corresponding to this authentication process from the storage device. It then calculates another hash value for authentication, which can be called the second hash value. Based on the user identification data, the second hash value, and the second random number, it calculates the primary password for authentication again using a cryptographic algorithm, which can be called the second primary password, and uses it to verify the primary password received from the user device.

To further understand the features and technical content of this invention, please refer to the following detailed description and drawings of this invention. However, the drawings provided are for reference and illustration only and are not intended to limit this invention.

The following specific embodiments illustrate the implementation of this invention. Those skilled in the art can understand the advantages and effects of this invention from the content disclosed in this specification. This invention can be implemented or applied through other different specific embodiments, and various details in this specification can also be modified and changed based on different viewpoints and applications without departing from the concept of this invention. In addition, the accompanying drawings of this invention are only simple illustrative drawings and are not depictions based on actual dimensions, as stated in advance. The following embodiments will further explain the relevant technical content of this invention in detail, but the disclosed content is not intended to limit the scope of protection of this invention.

It should be understood that although terms such as "first," "second," and "third" may be used in this document to describe various components or signals, these components or signals should not be limited by these terms. These terms are primarily used to distinguish one component from another, or one signal from another. Furthermore, the term "or" used in this document should, as appropriate, include any combination of one or more of the related listed items.

The disclosure reveals an identity verification method and system applied to the financial system. The main technical concept is to confirm that a user can perform a specific financial service by exchanging verification information between the user device, the financial information machine, and their respective back-end servers, thereby achieving the goal of identity verification and providing a more secure financial environment.

Referring first to Figure 1, which shows an example of the system architecture for implementing the aforementioned identity verification method, the system architecture includes various terminal devices interconnected via network 10. The main devices include a financial information machine 101 (such as an ATM or a card reader for financial cards) located at the customer end and a financial information machine backend 103 located on the financial system server end. The financial information machine backend 103 is a backend management server implemented using computer systems, databases, and other software and hardware components and architecture for the financial information machines 101 located in various locations. It can provide financial information services via network 10. The communication device 101 provides information exchange services; the user holds a user device 105 that runs a specific application (such as a mobile banking APP), and the server side has a corresponding user device backend 107. The user device backend 107 is a management server for the application running on the user device 105, which is implemented by computer system and database software components and hardware architecture. The user device backend 107 is like the backend of the mobile device, providing the user device with verification services to obtain financial services, and has a corresponding database 109 serving the user device 105.

Based on the implementation method of identity verification, it can be mainly divided into the process of generating verification information and the process of executing specific financial services. The user device 105 obtains verification information in ways including, but not limited to, two-dimensional barcodes (such as QR codes), push notifications, near-field communication (NFC) information, and SMS messages, and can also directly present text input by the user into the user device 105. The following implementation examples illustrate the processes of device binding, non-contractual transfers, and mobile phone number payment settings. The verification information process mainly involves the financial information machine 101 verifying the user's handheld user device 105 and the user's identity, thereby securely verifying that the financial services offered by the application executed through the user device 105 can be performed.

The method of running the identity verification system can be referred to the process described in Figure 1. At the beginning, after the financial information machine 101 is triggered, an verification process is started to verify whether a financial service is allowed to be performed (step S101). The verification process can be triggered by the user inserting a financial card or by the user device 105 approaching the financial information machine 101 and starting through the wireless signal exchanged therein.

In the above-mentioned verification activation process, the financial information machine 101 receives the user identification data, and then the financial information machine 101 generates a verification service request to the financial information machine backend 103. The verification service request will include the user identification data (step S103).

In the above process, the financial information machine 101 can receive user identification data (such as user ID) from the wireless signal of the financial card or user device 105. The user identification data, along with the information requesting verification service, is sent to the financial information machine backend 103, requesting the user device backend 107 to generate verification information (step S105). When the user device backend 107 generates verification information, it sends the verification information back to the financial information machine backend 103 (step S107), and then forwards it to the financial information machine 101 (step S109).

After receiving the verification information, the financial information machine 101 can provide it to the user device 105 in the form of a verification graphic or a verification code (step S111). The user device 105 obtains the verification information from the financial information machine 101 and then transmits it to the user device backend 107. The user device backend 107 compares the received verification information with the verification information generated in this verification process according to the requirements of the financial information machine backend 103 based on the obtained user identification data, and generates a verification result (step S113). The verification result is then transmitted to the user device 105. When the verification result is successful, the user device 105 is notified that it can continue to perform financial services (step S115).

According to the implementation method, the relevant details can be found in Figure 2, which shows the implementation flowchart of the identity verification method running between the user device 105, the financial information machine 101, the user device backend 107, and the financial information machine backend 103, as well as the process description in Figure 3.

Initially, the user operates the financial information machine 101, for example, by inserting a debit card, credit card, or other identifiable financial card. Verification is then performed by the financial information machine 101, which obtains user identification data from the financial card (step S301). In another embodiment, the user device 105 emits a wireless signal, such as an RFID signal, which the financial information machine 101 receives and retrieves the identification code.

It's worth mentioning that the main purpose of the verification process is to verify the financial services that the user intends to perform on their device 105. Users can select the financial services they wish to perform through the application. Specifically, financial services can refer to services requiring identity verification through specific transaction security designs, such as (but not limited to) device 105 binding, transfers, withdrawals, deposits, or loans. The primary goal is to ensure customers can verify the details of each transaction and prevent the tampering of identity verification data and transaction information. This financial service can be performed before, during, or after the verification process is initiated.

Next, the financial information machine 101 initiates the verification process by connecting to the network and notifying the financial information machine backend 103 to request verification service (step S303). After the financial information machine backend 103 responds with information, the financial information machine 101 can display information to ask the user to confirm the start of the verification service, such as displaying a start verification button, which the user can press to confirm the start of the verification process (step S305).

Once the user confirms and the verification process begins, the relevant information is transmitted to the financial information machine backend 103 (step S307). The financial information machine backend 103 then notifies the user device backend 107 to generate verification information. The user device backend 107 can obtain the user identification data (such as user ID) from the received information (step S309).

In an embodiment of generating verification information, the user device backend 107 first generates a verification value. For example, a random number generator can generate a random number. According to one embodiment, a first random number (random1) and a second random number (random2) with time expiration can be generated. The user device backend can set a validity period, after which the value expires and the verification fails. The user device backend 107 stores the currently acquired user identification data and the second random number through its storage device for use in verifying the verification information transmitted by the user device 105 (step S311).

The user device backend 107 then uses a password algorithm to calculate a one-time password (OTP) based on the obtained information (such as user identification data and a specific value). The specific value can be a hash value calculated by a hash algorithm based on a first random number and a specific value (such as a fixed string provided by the system) (step S313). For example, the password algorithm executed by the user device backend 107 uses user identification data (such as the user ID obtained by the backend), a hash value calculated based on a first random number and a specific value, and a second random number calculation to generate an One-Time Password (OTP) for the user device to obtain. It can also be a One-Time Password based on HMAC (HMAC: hashed message authentication code).

It should be noted that the descriptions of random numbers and one-dimensional cryptography in the above embodiments are not intended to limit the scope of the identity verification method proposed in the disclosure, but can be applied to transmit a set of randomly generated random values or any calculated parameter values in a cryptographic manner.

The aforementioned one-time password and the first random number generated based on the verification process of this case will form verification information. The user device backend 107 will then transmit this verification information to the financial information machine backend 103 (step S315), and the financial information machine backend 103 will then forward the verification information to the financial information machine 101 (step S317).

In the financial information machine 101, a one-time password (or with a first random number added) can be converted into a verification image, such as a QR code (or other forms of verification information), through a conversion program. The QR code is then displayed on the screen as verification data provided to the user (step S319). Alternatively, a wireless verification code, such as a radio frequency signal encoded in Near Field Communication (NFC) format, can be transmitted to the user device 105 via wireless communication.

When a user sees a verification graphic or information requiring specific verification, the user can operate an application (such as an online banking app) on their user device 105 to select the financial service to be performed (step S321), such as binding the user device 105, transferring funds, withdrawing money, depositing money, or borrowing. This step can be performed before, during, or after the above process. Then, the user operates the application to read the verification information displayed on the financial information machine 101, or receives the verification information wirelessly, which is to obtain the one-time password generated by the user device backend 107 for this verification requirement (step S323).

The user continues to operate the application, sending the obtained verification information to the user device backend 107 (step S325). The verification program in the user device backend 107 converts the information into a password string and compares it with the one-time password generated in this process for verification (step S327). If the verification is successful, the user is allowed to continue to perform the financial service selected on the user device 105 (step S329).

Furthermore, in the aforementioned identity verification process, a key feature is that the verification information is generated by the user device backend 107. The method primarily combines software and hardware computation. First, a random number generator generates a first random number (random1) and a second random number (random2) with timeliness. Then, a storage device stores the second random number and the user identification data obtained from the financial information machine backend for use in verifying the verification information returned by the user device.

Next, in the user device backend, a hash value is calculated using a hash algorithm based on the first random number and a fixed string. Then, based on the user identification data, the hash value, and the second random number, a cryptographic algorithm is used to calculate a linear password. This linear password and the first random number can form the verification information transmitted to the user device.

In the verification process, after the user device reads the verification information from the financial information machine, it transmits it to the user device's backend. The software program in the user device's backend can obtain the linear password and the first random number from the verification information. Then, it retrieves the previously stored second random number and user identification data from the storage device, and calculates the second hash value used for verification again using the same algorithm. Based on the user identification data, the second hash value, and the second random number, it calculates the second linear password again using the password algorithm (such as Equation 1). This second linear password is used to compare with the linear password generated for this verification process, that is, to verify the linear password received from the user device, and to generate the verification result.

It is worth mentioning that the one-time password used in the identity verification method can be time-sensitive, and the time is controlled by the user's device backend; another implementation method is to use the time-based one-time password algorithm (TOTP algorithm) to generate time-sensitive one-time passwords.

In one embodiment, a user device 105 executes an application for a related financial service. When the application executes a specific financial service, it will wait for the verification result of identity verification through the financial information machine 101. Finally, when the user device 105 obtains the verification success information from the backend, it will continue to execute the financial service originally intended, such as device binding, non-contractual transfer, and mobile phone number payment services as described in the following embodiments.

One example of an identity verification method applied to the verification process of a specific transaction procedure can be found in the implementation flowchart of user device binding shown in Figure 4, which can be used in conjunction with Figures 5A to 5E.

The user operates a user device to enter a binding process (step S401). The user can use an application installed on the user device. As shown in Figure 5A, the device binding page 501 at the start of the application is an example diagram. The user can click on the button to start the binding process.

The application then guides the user to the verification method selection page 502 shown in Figure 5B. Examples shown include options such as voice OTP 503, SIM card authentication 504, and ATM verification 505. The identity verification method is mainly performed through a financial information machine (option 505) (step S403).

According to the above-mentioned identity verification method and process implementation example, the verification process is initiated through the financial information machine. The financial information machine requests verification services from its backend, and then the financial information machine's backend requests the user device's backend to generate verification information. After the user device's backend generates the verification information for this verification process, it is forwarded to the financial information machine in front of the user through the financial information machine's backend.

When the financial information machine receives verification information from its backend, a conversion program converts the verification information into a verification image (such as a QR code), a verification code string, or a wireless verification code, enabling the user device to read the verification information (step S405). One embodiment can be seen in Figure 5C, which shows an ATM verification scanning page 506. The application starts a scanning window 507 to scan the verification image displayed on the financial information machine. Another embodiment can be seen in Figure 5D, which shows a user device 50 using its application to scan the verification image 510 displayed on the financial information machine 500, reading the verification information, and then transmitting the verification information to the user device's backend (step S407).

Next, on the server side, the user device's backend verifies the authentication information sent from the user device, generates an authentication result, and then the user device receives the authentication result (step S409) to determine whether the authentication was successful (step S411). If the authentication fails, the device binding process will be terminated, and an authentication error message will be displayed (step S413); if the authentication is successful, the user device will receive the relevant information and display the binding success page 508 as shown in Figure 5E, allowing the user to confirm and click the button to continue the binding process (step S415).

In summary, the identity verification methods and systems applied to financial systems as described in the above embodiments address the increasingly important information security needs of financial services. The technical concept of the identity verification method is to use financial information terminals (such as ATMs or card readers) located in various places to verify the financial services that users want to perform when operating user devices (such as mobile devices such as mobile phones). The implementation adopts a two-stage verification process. The first stage of verification is for the user to log in to the application provided by the financial institution. The second stage is to obtain verification information through the financial information terminal and then verify it in the backend of the user device. This can effectively improve the security of user transactions.

The above-disclosed content is merely a preferred feasible embodiment of the present invention and is not intended to limit the scope of the patent application of the present invention. Therefore, all equivalent technical changes made using the contents of the present invention's description and drawings are included within the scope of the patent application of the present invention.

10: Network 101: Financial Information Machine 103: Financial Information Machine Backend 105: User Device 107: User Device Backend 109: Database 50: User Device 500: Financial Information Machine 510: Verification Graphic 501: Device Binding Page 502: Verification Method Selection Page 503: Voice OTP 504: SIM Card Authentication 505: ATM Verification 506: ATM Verification Scan Page 507: Scan Window 508: Binding Success Page Steps S101～S115: Identity Verification Process Steps S301～S329: Identity Verification Process Steps S401～S415: User Device Binding Process

Figure 1 shows a schematic diagram of a system architecture implementation example for performing the identity verification method;

Figure 2 shows a flowchart of an implementation example of an identity verification method operating between a user device, a financial information terminal, a user device backend, and a financial information terminal backend;

Figure 3 shows a flowchart of an implementation example of the identity verification method;

Figure 4 shows a flowchart illustrating an implementation example of user device binding using identity verification methods; and

Figures 5A to 5E show examples of user device execution device binding.

101: Financial Information Machine

103: Financial Information Machine Backend

105: User Device

107: User Device Backend

Steps S301~S329: Identity Verification Process

Claims (8)

An identity verification method applied to a financial system includes: initiating an verification process through a financial information terminal (FIC) to verify whether a user device is allowed to perform a financial service; the FIC receiving user identification data from a financial card or a wireless signal from the user device; the FIC generating a verification service request and transmitting the verification service request information along with the user identification data to the FIC backend; the FIC backend transmitting the user identification data to the user device backend to request the user device backend to generate verification information based on the user identification data; and the user device backend sending the verification information back to the FIC backend. The system then forwards the verification information to the financial information machine. The user device obtains the verification information from the financial information machine and then transmits the verification information to the user device's backend. The user device's backend compares the verification information received from the user device with the verification information generated by the user device's backend based on the request from the financial information machine's backend. Thus, the user device's backend compares the verification information generated based on a user's user identification data with the verification information transmitted from the user device to verify the identity of the user holding the user device and generate a verification result. When the verification result is successful, the user device is notified to execute the financial service. The identity verification method described in claim 1, wherein the user device executes an application, and while the application is performing the financial service, it waits for the verification result of identity verification performed through the financial information machine; when the user device obtains the verification success information from the backend, it continues to perform the financial service. In the identity verification method described in claim 1, when the financial information machine receives the verification information from the backend of the financial information machine, the verification information is converted into a verification image or a wireless verification code by a conversion program, and then the user device reads and obtains the verification information. The identity verification method as described in any one of claims 1 to 3, wherein the method for generating the verification information in the user device backend includes: generating a first random number and a second random number with timeliness using a random number generator, wherein the second random number and the user identification data obtained from the financial information machine backend are stored in a storage device of the user device backend; calculating a hash value using a hash algorithm based on the first random number and a fixed string; and calculating a linear password using a cryptographic algorithm based on the user identification data, the hash value and the second random number, wherein the linear password and the first random number form the verification information. The identity verification method as described in claim 4, wherein when the user device receives the verification information from the user device in the background, the linear password and the first random number are obtained from the verification information, the second random number and the user identification data are obtained from the storage device, a second hash value for verification is calculated again based on the first random number and the fixed string using the hash algorithm, and a second linear password is calculated again based on the user identification data, the second hash value and the second random number using the password algorithm, and a second linear password is calculated again to compare with the linear password received from the user device to generate the verification result. An identity verification system includes: a financial information machine backend connected to the financial information machine, providing information exchange services between the financial information machine and a user device backend, providing verification services for a user device to obtain a financial service; wherein an identity verification method performed by the identity verification system includes: initiating an verification process through the financial information machine to verify whether the user device is allowed to perform the financial service; the financial information machine receiving user identification data from a financial card or a wireless signal from the user device; the financial information machine generating a request for verification service information and transmitting the request for verification service information along with the user identification data to the financial information machine backend; the financial information machine backend transmitting the user identification data to the user device backend to request the user device backend to perform a verification service based on... The user identification data generates verification information; the user device backend sends the verification information back to the financial information machine backend, which then forwards it to the financial information machine; the user device obtains the verification information from the financial information machine and then sends the verification information back to the user device backend; the user device backend compares the verification information received from the user device with the verification information generated by the user device backend according to the request from the financial information machine backend. Thus, the user device backend compares the verification information generated based on a user's user identification data with the verification information transmitted from the user device to verify the identity of the user holding the user device and generates a verification result; and when the verification result is successful, the user device is notified to execute the financial service. The identity verification system as described in claim 6 further includes an application running on the user's device, which performs the financial service and, after waiting for the verification result of identity verification performed through the financial information machine, determines whether to continue performing the financial service. The identity verification system as described in claim 6 or 7, wherein the method by which the user device backend generates the verification information includes: generating a first random number and a second random number with timeliness using a random number generator, wherein the second random number and the user identification data obtained from the financial information machine backend are stored in a storage device of the user device backend; calculating a hash value using a hash algorithm based on the first random number and a fixed string; and calculating a linear password using a cryptographic algorithm based on the user identification data, the hash value and the second random number, wherein the linear password and the first random number form the verification information.