银行信息系统统一认证的应用安全研究

发布时间：2018-12-12 18:28

【摘要】：随着经济的快速发展,中国国内银行普遍进入飞速发展阶段。各银行的电话银行、网上银行、手机银行、电视银行等电子渠道日益扩充和完善;同时,银行客户对交易安全性、认证工具多样性和易用性也是高度关注而且要求不断提高。然而,目前主流的基于用户名口令的认证方式是一种弱身份认证方式,由于其具有容易被猜测、字典攻击、非法拦截、责任认定无法到人等系列弱点,在当前银行应用环境中已经无法满足银行信息系统的安全需要。在上述背景下,银行信息系统身份认证安全在信息安全研究和建设中已经成为重中之重的第一道安全保障,其普遍被认为是银行信息安全建设中的首要环节。随着银行互联网业务的迅速发展,电子交易越来越普及。电子交易的应用包括:电子银行(网上银行、ATM应用、POS应用、电话银行、手机银行、卡支付)、网上证券、第三方支付、电子商城等。近几年来,电子交易有40%以上的年增长率;其中,电子银行呈现出多种电子渠道的并行发展到融合的趋势,渠道的融合可以使业务发展和营销更加灵活。各种电子渠道应用对安全性需求具有共性,都有对用户认证、交易认证的需求;同时,还有日志的需求、访问授权的需求、风险监控和防范的需求。为了更好地支持各种电子渠道的业务发展和融合,急需建立一套适合于所有电子渠道的统一认证平台,来统一处理用户的认证、交易的认证、风险监控和防范,进行日志统一等。本文就是研究在银行多信息系统和多认证终端工具环境下的统一认证,实现同时将统一动态口令认证和统一数字证书认证这两种主流认证技术进行无缝整合为统一认证。在统一认证试运行和方案验证阶段,统一认证确实可以实现整个银行多个信息系统、多种认证终端、多种用户类型的统一认证、集中控制、认证安全的统一管理。同时统一认证也是银行信息安全的发展趋势,也是银行的信息安全发展战略。统一认证建立的宗旨就是提高银行服务水平,加强银行风险管控,降低系统后续建设成本和运营维护成本,从而加快银行产品响应市场需求的速度。
[Abstract]:With the rapid development of economy, China's domestic banks have generally entered the stage of rapid development. Telephone banking, internet banking, mobile phone banking, television banking and other electronic channels are increasingly expanded and improved. At the same time, bank customers are highly concerned about transaction security, authentication tools diversity and ease of use. However, the current mainstream authentication method based on user name and password is a weak identity authentication method, because it has a series of weaknesses such as easy to guess, dictionary attack, illegal interception, responsibility determination, etc. In the current banking application environment, it can not meet the security needs of bank information system. Under the above background, the security of bank information system identity authentication has become the most important security in the research and construction of information security, and it is generally considered to be the primary link in the construction of bank information security. With the rapid development of bank Internet business, electronic trading is becoming more and more popular. Electronic trading applications include: electronic banking (online banking, ATM applications, POS applications, telephone banking, mobile banking, card payments), online securities, third-party payments, electronic stores, and so on. In recent years, electronic transactions have an annual growth rate of more than 40%. Among them, electronic banking shows a trend of parallel development to integration of various electronic channels, and the integration of channels can make business development and marketing more flexible. All kinds of electronic channel applications have common requirements for security, such as user authentication, transaction authentication, logging, access authorization, risk monitoring and prevention. In order to better support the business development and integration of various electronic channels, there is an urgent need to establish a unified authentication platform suitable for all electronic channels to handle user authentication, transaction authentication, risk monitoring and prevention. To unify the log, etc. This paper is to study the unified authentication under the environment of bank multi-information system and multi-authentication terminal, and realize the seamless integration of unified dynamic password authentication and unified digital certificate authentication into unified authentication. In the stage of unified certification trial operation and scheme verification, unified authentication can realize the unified management of multiple information systems, multiple authentication terminals, multiple user types, centralized control and authentication security in the whole bank. At the same time, unified authentication is also the development trend of bank information security and the development strategy of bank information security. The purpose of establishing unified certification is to improve banking service level, strengthen bank risk control, reduce the cost of system construction and operation and maintenance, so as to speed up the response of bank products to market demand.
【学位授予单位】：华南理工大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP309

【相似文献】