没有合适的资源?快使用搜索试试~ 我知道了~
Security Procedures 安全程序分析.pdf
0 下载量 89 浏览量
2024-05-10
09:16:33
上传
评论
收藏 586KB PDF 举报
温馨提示
试读
11页
Security Procedures 安全程序分析.pdf
资源推荐
资源详情
资源评论
Treasury and Trade Solutions
1. Introduction
引言
These “Security Procedures”, as referenced in the Communications section of the Master Account and
Service Terms (“MAST”) (or other applicable account terms and conditions), are designed to authenticate
the Customer’s log-on to the Bank’s connectivity channels and to verify the origination of Communications
between Bank and Customer in connection with the following Services or connectivity channels (the
availability of which may vary across local markets).
如客户与银行之间订立的账户和服务主协议(“账户和服务主协议”)(或其他适用的账户条款和条件)的通讯部分
所述,以下安全程序设计用于校验用户登录银行的连接渠道以及与以下服务或连接渠道(可用性可能因当地市场而
异)相关的银行与客户之间通讯的来源。
• CitiDirect BE
®
(including WorldLink
®
)
CitiDirect BE
®
网银系统(包括 WorldLink
®
)
• CitiConnect
®
CitiConnect
®
• Society for Worldwide Interbank Financial Telecommunication (“SWIFT”)
环球银行同业金融电信协会(”SWIFT”)
• Manual Initiated Funds Transfer (“MIFT”)
人 工 资 金 转 账( “ M I F T ” )
• Interactive Voice Response (“IVR”)
交互式语音应答(“IVR”)
• Email/Fax/Mail/Messenger/Phone with the Bank
和银行往来的电子邮件/传真/信件/信使/电话
• Other local electronic connectivity channels
其他本地电子连接渠道
These Security Procedures are to be read together with the MAST and may be updated and advised to the
Customer from time-to-time by electronic or other means, including but not limited to posting updates to the
Security Procedures on CitiDirect BE. Unless otherwise provided by law, Customer’s continued use of any of
the above noted Services or connectivity channels after being advised of updated Security Procedures shall
constitute Customer’s acceptance of such updated Security Procedures. These Security Procedures cover the
following:
本安全程序应与账户和服务主协议一起阅读。本安全程序可能会通过电子或其他方式不时更新并通知给客户,包括
但不限于在CitiDirect BE网银系统上所发布的对安全程序的更新。除非法律另有规定,客户在收到更新安全程序的
通知后,如继续使用上述任何服务或连接渠道,则表示客户已接受该等更新的安全程序。本安全程序涵盖以下内容:
A. Authentication Methods
认证方式
B. Customer Responsibilities
用户责任
Security Procedures
安全程序
Introduction
引言
2
Security Procedures
安全程序
C. Data Integrity and Secured Communications
数据完整性和安全通讯
D. Security Manager and Related Functions
安全经理和相关权限
2. Authentication Methods
认证方式
The Security Procedures include certain secure authentication methods (“Authentication Methods”) which
are used to uniquely identify and verify the authority of the Customer and/or any of its users authorized by
the Customer typically through one or a combination of mechanisms such as user ID/password pairs, digital
certificates, biometrics, security tokens (deployed via hardware or software), seal/signature verification, and/or
devices associated with the Authentication Methods (collectively, the “Credentials”). Authentication Methods and
associated Credentials allow the Bank to verify the origin of Communications received by the Bank.
本安全程序包括特定的安全认证方式(“认证方式”),该等认证方式将通过诸如用户ID /密码对、数字证书、生物特
征、安全令牌(通过硬件或软件部署)、印章/签字验证,和/或与认证方式关联的设备等一个或多个组合的验证方法
(统称为“密钥”)来识别和验证客户和/或其任何用户的权限。 通过这些认证方式和相关密钥,银行可以验证所收
到通讯的来源。
More information regarding Authentication Methods for access to Services and/or connectivity channels may be
accessed on the CitiDirect BE Login Help website. Customer may at any time select an available Authentication
Method. During implementation of Services or connectivity channels, Bank may set-up a default Authentication
Method, which Customer may change at any time to another available Authentication Method.
您可登录CitiDirect BE网银系统的登录帮助网站以了解更多与登录服务和/或连接渠道的认证方式相关的信息。客户
可以随时选择一种适用的认证方式。在设置服务或连接渠道时,银行会设置一种默认的认证方式,客户可以随时更
改至另一种适用的认证方式。
The following Authentication Methods are available to access the services and/or connectivity channels:
以下认证方式可用于访问上述服务和/或连接渠道:
CitiDirect BE Authentication Methods
CitiDirect 认证方式
Biometrics
生物特征
A digital authentication method that utilizes a user’s unique physical traits, (such as a
fingerprint and facial recognition), built-in biometric technology on the user’s mobile device,
and cryptographic techniques to gain access to CitiDirect BE. Physical trait data is not
transferred to the Bank when the user selects this authentication method.
一种数字化认证方式,其利用用户独特的物理特征(例如指纹和面部特征)、用户移动设备上
内置的生物识别技术及加密技术来访问CitiDirect BE。 当用户选择此认证方式时,物理特征
数据不会传输至银行。
Challenge
Response Token
询问应答令牌
Either (i) a mobile application based soft token (e.g. MobilePASS) or (ii) a physical token
(e.g. SafeWord Card, Vasco), which in each case is used to generate a dynamic password
after authenticating with a PIN (e.g. 4-digit PIN). When accessing CitiDirect BE, the system
generates a challenge and a response passcode is generated by the utilized token and entered
into the system. This authentication method, when combined with a secure password results
in multifactor authentication.
(i)基于移动应用程序的软令牌(例如MobilePASS)或(ii)物理令牌(例如SafeWord
卡、Vasco),用于在使用数字认证(如4位数字认证)之后生成动态密码。 当访问CitiDirect
BE时,系统生成一个质询,并且通过所使用的令牌生成响应密码并输入到系统中。该认证方
式搭配安全密码使用构成多因素认证。
Authentication Methods
认证方式
3
Security Procedures
安全程序
One-Time
Password Token
一次性密码令牌
Either (i) a mobile application based soft token (e.g. MobilePASS); or (ii) a physical token (e.g.
SafeWord Card, Vasco) that is used to generate a dynamic password after authenticating with
a PIN (e.g. 4-digit PIN). This dynamic password is entered into the system to gain access.
(i)基于移动应用程序的软令牌(例如MobilePASS)或(ii)物理令牌(例如SafeWord
卡,Vasco),用于在使用数字认证(例如4位数字认证)之后生成动态密码。 将此动态密码输
入系统以获得访问权限。
Secure Password
安全密码
A user enters his or her secure password to access the system. A secure password typically
limits a user’s capabilities on the system, for example, by only permitting that certain
information be viewed by the user. This authentication method, when combined with
a challenge response token results in multifactor authentication.
用户可以通过输入其安全密码访问系统。安全密码通常限制用户在系统中使用的功能,例
如,用户仅可浏览特定的信息。该认证方式搭配质疑应答令牌使用构成多因素认证。
SMS One-Time
Code
短信一次性密码
A dynamic password delivered to users via SMS, after which the user enters the dynamic
password and a secure password to gain access to the system.
通过短信发送给用户的动态密码,此后用户输入动态密码和安全密码以访问系统。
Voice One-Time
Code
语音一次性密码
A dynamic password delivered to users via an automated voice call, after which the user
enters the dynamic password and a secure password to gain access to the system.
通过自动语音呼叫发送给用户的动态密码,此后用户输入动态密码和安全密码以访问系统。
Digital
Certificates
数字证书
A digital certificate is an electronic identification issued by an approved certificate authority
for authentication and authorization. Digital certificates may be attributed to corporate
legal entities (“Corporate Seals”) or individuals (“Personal Certificates”). The Customer is
responsible for properly verifying the identity of all users of Personal Certificates acting on
behalf of the Customer in accordance with local law.
数字证书是一种经批准的认证机构颁发,用于认证和授权的电子身份证明。数字证书可归属
于公司(“公司印鉴”)或个人(“个人证书”)。客户有责任根据当地法律正确验证所有代表公
司行事的个人证书用户的身份。 。
The Bank and the Customer are required to use digital certificates provided by authorized
persons, to ensure all Communications exchanged via a public Internet connection or an
otherwise unsecure Internet connection are fully encrypted and protected.
银行和用户必须使用授权人员的数字证书,以确保所有通过公共或其他不安全网络连接所
传输的通讯均已加密且受到保护。
CitiConnect for Files Authentication Methods
CitiConnect for Files 认证方式
Digital
Certificates
数字证书
See description above.
请参考以上描述
IP Address
Whitelist When
Using CitiConnect
使用CitiConnet的
IP地址白名单
Certain Internet communications received by the Bank, for example, via a Virtual Private
Network (VPN), may also rely on the parties exchanging information using pre-agreed
Internet Protocol (IP) addresses. The Bank will only accept communications originating
from the Customer’s designated IP address, and vice versa; and the Bank will only transmit
Communications to the Customer’s designated IP address, and vice versa. Used in conjunction
with Digital Certificate method above.
某些银行接收的特定互联网通讯(例如通过虚拟专用网络传输信息)可能还依赖于各方通过
使用一个提前约定的互联网协议地址(IP地址)来进行信息交换。 银行只接受来自用户指定
IP地址发起的通讯,反之亦然; 银行只会向用户指定地址传送通讯,反之亦然。该认证方式
配合上述数字证书方法使用。
Authentication Methods
认证方式
剩余10页未读,继续阅读
资源评论
百态老人
- 粉丝: 2129
- 资源: 2万+
上传资源 快速赚钱
- 我的内容管理 展开
- 我的资源 快来上传第一个资源
- 我的收益 登录查看自己的收益
- 我的积分 登录查看自己的积分
- 我的C币 登录后查看C币余额
- 我的收藏
- 我的下载
- 下载帮助
安全验证
文档复制为VIP权益,开通VIP直接复制
信息提交成功