基于贴片智能卡的手机银行APP软件安全性问题研究

发布时间：2018-05-28 06:36

本文选题：贴片智能卡 + APP支付安全　；参考：《广西师范大学》2017年硕士论文

【摘要】：随着手机银行用户飞速增长,移动互联网的支付安全问题日益突出。欺诈分子通过病毒、钓鱼网站和木马远程控制等方式窃取客户银行卡信息,盗取客户资金,给移动金融安全带来更多挑战。因此,研究出移动环境能够适用的安全支付方案成为当下迫切需要解决的问题。本文通过分析与研究移动终端在无线环境中的安全隐患,将公钥证书技术与贴片智能卡相结合,提出了符合银行安全需求的手机银行安全解决方案。手机银行的安全架构包含客户端身份认证的安全、交易数据传输的安全和交易数据抗抵赖性,贴片智能卡通过结合公钥证书技术,保护手机银行安全。同时,贴片智能卡直接与SIM卡贴合安装于手机内部,解决了音频Key和蓝牙Key携带不便捷问题,也解决了 SDKey无法兼容iOS问题。具体工作如下:(1)分析手机银行安全问题及需求:对手机银行系统进行了安全问题分析,主要针对用户系统和手机银行系统进行安全需求分析和安全风险分析,得出手机银行主要需求解决身份认证问题、传输安全问题和抗抵赖问题。针对问题,本文结合公钥证书技术,设计了手机银行系统安全流程,包括客户端银行PIN码保护,客户端与应用服务器间消息完整性和关键域加密流程,证书申请流程,证书登录流程,数据签名及验证签名流程。(2)设计与实现COS安全体系:本文参考国家密码局智能卡相关规范,设计并实现贴片智能卡安全COS。安全COS设置指令解析和权限控制机制为上层应用提供入口,设置密钥管理机制保证密钥安全,设置访问认证机制保证贴片智能卡的访问安全,还设置了敏感数据硬隔离等方案,保护COS的安全。根据监管要求,金融行业信息安全产品需要进行国密改造,逐步禁止使用国外产品。结合银行实际需求,安全COS除了支持RSA算法外,同时还支持SM2非对称算法,手机银行可根据需求修改证书参数,即可支持国密证书。(3)设计与实现安全中间件:设计并实现安全且便于集成的中间件,安全中间件由API接口、通道管理、安全状态控制和分散密钥存储四个部分组成。安全中间件API接口参考CSP接口设计,为手机银行提供数据加解密,签名和验证签名等API,使得贴片智能卡可以便捷的集成到已有的手机银行APP中。通道管理、安全状态控制和分散密钥存储部分共同作用控制API访问安全,提升手机银行APP的安全性。(4)贴片智能卡综合测试:通过编写正向用例和反向用例,分别对安全中间件和安全COS进行了全面的测试。测试实际输出结果与预期一致,验证了安全中间件和安全COS的各项功能,安全性达到预期要求。本文设计与实现的贴片智能卡安全解决方案基本能解决手机银行交易的安全问题,同时提供较好的便捷性,并在银行实际应用中取得不错的效果。
[Abstract]:With the rapid growth of mobile bank users, the payment security of mobile internet is becoming more and more serious. Fraudsters steal customer bank card information through virus, phishing website and Trojan horse remote control, steal customer funds, bring more challenges to the security of mobile finance. Therefore, it is urgent to solve the problem of security payment scheme which can be applied in mobile environment. By analyzing and studying the security hidden danger of mobile terminal in wireless environment, this paper combines the technology of public key certificate with the chip smart card, and puts forward a mobile bank security solution that meets the security requirements of the bank. The security architecture of mobile banking includes the security of client authentication, the security of transaction data transmission and the non-repudiation of transaction data. At the same time, the chip smart card is installed directly with the SIM card in the mobile phone, which solves the problem that audio Key and Bluetooth Key are not convenient to carry, and that SDKey is not compatible with iOS. The specific work is as follows: (1) analyzing the security problems and requirements of mobile banking: the security problems of mobile banking system are analyzed, mainly for the security requirements analysis and security risk analysis of user systems and mobile banking systems. The main requirements of mobile banking are to solve the problem of identity authentication, transmission security and non-repudiation. Aiming at the problem, this paper designs the security flow of mobile banking system, including the PIN code protection of client bank, the message integrity between client and application server, the encryption flow of key domain, the certificate application process, and the security flow of mobile banking system combined with public key certificate technology. Certificate login process, data signature and verification signature flow. 2) Design and implementation of COS security system: this paper designs and implements the security COSs of smart card with reference to the relevant specification of smart card of the State Cryptography Bureau. The security COS setting instruction parsing and permission control mechanism provides the entrance for the upper layer application, the key management mechanism guarantees the key security, the access authentication mechanism guarantees the access security of the smart card, and sets the sensitive data hard isolation and so on. Secure COS. According to the regulatory requirements, financial industry information security products need to be modified, gradually prohibit the use of foreign products. Considering the actual requirements of the bank, the secure COS not only supports the RSA algorithm, but also supports the SM2 asymmetric algorithm. The mobile bank can modify the certificate parameters according to the demand. Security middleware is designed and implemented. The middleware is composed of four parts: API interface, channel management, security state control and decentralized key storage. The API interface of security middleware refers to the design of CSP interface, and provides data encryption, decryption, signature and verification signature for mobile bank, so that the chip smart card can be easily integrated into the existing mobile bank APP. Channel management, security state control and decentralized key storage part work together to control API access security, enhance the security of mobile bank APP. The security middleware and the security COS are tested respectively. The test results are consistent with the expected results and verify the functions of the security middleware and the security COS. The security meets the expected requirements. The security solution of the chip smart card designed and implemented in this paper can solve the security problems of mobile banking transactions and provide good convenience, and achieve good results in the practical application of the bank.
【学位授予单位】：广西师范大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：F49;TP311.56;TP309

【相似文献】