SYMBIAN網銀流程備忘

好久沒寫東西了，Widget先放了一段時間，最近把PKCS#11庫移植到Symbian下，在Symbian下做了一個CS模式的網銀Demo。做點筆記備忘。

基本設計概念與處理流程color:windowtext">總體設計

Symbian"Times New Roman"'>下網銀用戶端通過PKCS11"Times New Roman"'>庫和TF宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>卡介面庫與終端中的TFmso-hansi-font-family:"Times New Roman"'>卡進行通訊，獲得卡內認證和私密金鑰對象等，然後運用認證和私密金鑰與伺服器進行安全連結握手，如果完成驗證過程，便產生一個對稱金鑰用來作為工作階段金鑰和伺服器進行安全通訊。用戶端進行的每一項交易都要用自己的私密金鑰進行簽名。

color:windowtext">登入功能安全流程

 

mso-bidi-font-size:10.0pt;line-height:150%" lang="EN-US"> 

mso-hansi-font-family:"Times New Roman"'>由於終端的運算能力有限，我們並不做雙向認證，假設終端有伺服器頒發的認證並信任它。另上述並非標準SSL"Times New Roman"'>過程，只是協商工作階段金鑰密鑰值的過程，並沒有協商對稱密碼演算法和非對稱密碼演算法，因此我們事先約定：

mso-hansi-font-family:"Times New Roman"'>對稱式加密演算法，如3DES"Times New Roman"'>；

mso-hansi-font-family:"Times New Roman"'>非對稱演算法，採用1024"Times New Roman"'>位的RSA宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>。

mso-hansi-font-family:"Times New Roman"'>協商過程：

mso-hansi-font-family:"Times New Roman"'>假設終端A"Times New Roman"'>與伺服器B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>進行通訊。

1)       
A宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>將Camso-hansi-font-family:"Times New Roman"'>發送給B"Times New Roman"'>，Ca宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>是Amso-hansi-font-family:"Times New Roman"'>的認證

2)       
B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>通過CAmso-hansi-font-family:"Times New Roman"'>的根憑證驗證認證Ca"Times New Roman"'>的合法性。

3)       
B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>驗證認證主體的資訊(mso-hansi-font-family:"Times New Roman"'>是否為應用對應要求的資訊，例如如果應用定義終端CNmso-hansi-font-family:"Times New Roman"'>滿足什麼要求，OU"Times New Roman"'>滿足什麼要求等等)"Times New Roman"'>。

4)       
B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>產生一個隨機數R (mso-hansi-font-family:"Times New Roman"'>產生隨機數的位元組數為對稱密碼演算法密鑰所對應的位元組數)

5)       
B "Times New Roman"'>構造一條資訊，M="Times New Roman"'>（Tb, R, Ia"Times New Roman"'>），其中Tb宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>是Bmso-hansi-font-family:"Times New Roman"'>的時間標記，Ia"Times New Roman"'>是A 宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>的身份資訊。

6)       
B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>將Ea(M)mso-hansi-font-family:"Times New Roman"'>發送A"Times New Roman"'>，Ea宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>是Amso-hansi-font-family:"Times New Roman"'>的公開金鑰。

7)       
A宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>用Damso-hansi-font-family:"Times New Roman"'>去解密Ea(M)

8)       
A宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>檢查Mmso-hansi-font-family:"Times New Roman"'>中的Ia

9)       
A宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>檢查Mmso-hansi-font-family:"Times New Roman"'>中的Tb"Times New Roman"'>以證實訊息是剛發來的

10)    
A宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>檢查隨機數確保不是訊息重發

11)    
A宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>構造一條訊息，Mm=(Ta,R, Ib)"Times New Roman";mso-hansi-font-family:"Times New Roman"'>，其中Tamso-hansi-font-family:"Times New Roman"'>是A"Times New Roman"'>的時間標記，Ib"Times New Roman"'>是B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>的身份資訊。

12)    
A宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>將Eb(Mm)mso-hansi-font-family:"Times New Roman"'>發送給B"Times New Roman"'>，Eb宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>是Bmso-hansi-font-family:"Times New Roman"'>的公開金鑰

13)    
B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>用Dbmso-hansi-font-family:"Times New Roman"'>解密Eb(Mm), Db"Times New Roman"'>是B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>的私密金鑰

14)    
B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>檢查Mmmso-hansi-font-family:"Times New Roman"'>中的Ib

15)    
B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>檢查Mmmso-hansi-font-family:"Times New Roman"'>中的Ta"Times New Roman"'>確定訊息是剛發送來的

16)    
B宋體;mso-ascii-font-family:"Times New Roman";mso-hansi-font-family:"Times New Roman"'>檢查Mmmso-hansi-font-family:"Times New Roman"'>中的R"Times New Roman"'>是否一致；後續用此R"Times New Roman"'>作為工作階段金鑰。