TWI619042B - System and method for online transaction security, SIM card, mobile phone and online transaction system realized by the method - Google Patents

Abstract

The invention discloses a method and a system for confirming the safety of online transactions through a mobile phone. The method includes: a two-dimensional code generating step for generating transaction data and requests based on online transactions, generating a two-dimensional code, and displaying the two-dimensional code on a client. Two-dimensional code; The two-dimensional code acquisition step is used to scan the two-dimensional code displayed on the client through the mobile APP to obtain and send the two-dimensional code; the transaction security confirmation step is used to receive and analyze the two-dimensional code sent by the mobile app to restore transaction data And request, confirm the transaction information and request through the mobile STK menu to generate the transaction confirmation result; the transaction security operation steps are used to digitally sign the transaction confirmation result using the function of the mobile phone smart card security module; the transaction completion step sends the signature confirmation result Go to the system platform and complete the entire online transaction.

Description

System and method for online transaction security, SIM card, mobile phone and online transaction system implemented by the method

The invention relates to the field of online transaction security, in particular to a method and system for confirming online transaction security through a mobile phone.

With the development of smart network terminal technology, mobile phone scanning QR codes are more and more widely used due to its convenient and fast use and good user experience. In addition, with the continuous evolution of IC technology, many wireless communication technologies such as Bluetooth communication have been integrated into smart cards such as mobile phone SIM cards, thereby opening up mobile network terminals and wisdom in addition to traditional data messaging channels. The high-speed data channel between the cards enables the mobile phone SIM card not only to provide telecommunication functions, but also to support the download and operation of various new business and new applications. In addition, smart cards such as mobile phone SIM cards also provide hardware of a security module (SE Security Element) for data encryption / decryption, signing / verification of signatures and other security operations to achieve financial-level security, thereby forming a secure smart card.

In the current prior art, an independent smart key (USBKey) is generally used on a network terminal to perform functions such as transaction display, digital signature, and user confirmation, that is, to complete the so-called "second-generation KEY" function. However, this technology of using a separate smart password key on a network terminal has many disadvantages, such as the following.

1) The user is inconvenient to use. In the process of conducting transactions on the network terminal, the USBKey must be inserted and removed in order to perform online transaction authentication.

2) The security is low. The separate smart password key is easy to forget to carry, and it is easy to be stolen by others after being lost.

The present invention hopes to provide a method and system for confirming the security of online transactions through a mobile phone, which can confirm the security of online transactions by using a mobile phone STK (SIM Tool Kit, user identification application development tool) menu, which guarantees online transactions on a network terminal Safety, easy to carry at any time, and convenient for users to use.

The technical solution of the embodiment of the present invention is implemented in this way.

The invention provides a system for confirming the security of online transactions through a mobile phone, including: a client: for performing online transactions, the client generates transaction data and requests according to the online transactions; a system platform: for performing the Related background business processing of online transactions, generating a two-dimensional code based on the transaction data and request, and sending the two-dimensional code to the client for display; mobile phone APP: used to scan the display of the client The two-dimensional code is used to obtain and send the two-dimensional code; a transaction security confirmation module is configured to receive and analyze the two-dimensional code sent by the mobile phone APP, restore the transaction data and requests, and pass the mobile phone STK menu Confirming the transaction information and request to generate a transaction confirmation result; a transaction security operation module: for digitally signing the transaction confirmation result by using a mobile phone smart card security module function; a main control module: for The transaction security operation module performs central control, and digitally signs the transaction confirmation result via the transaction security The full confirmation module is sent to the system platform to complete the online transaction, or the main control module sends the digitally signed transaction confirmation result to the system platform via the mobile phone APP to complete the online transaction.

The present invention also provides a system for confirming the security of online transactions through a mobile phone, including: a client: for performing online transactions, the client generates transaction data and requests according to the online transactions, and generates and displays a two-dimensional code; System platform: used to perform related background business processing of the online transaction; mobile phone APP: used to obtain and send the two-dimensional code by scanning the two-dimensional code displayed by the client; transaction security confirmation module : For receiving and analyzing the two-dimensional code sent by the mobile APP, restoring the transaction data and requests, confirming the transaction data and requests through a mobile STK menu, and generating a transaction confirmation result; a transaction security operation module : Used for digitally signing the transaction confirmation result by using the function of the mobile phone smart card security module; main control module: used for centrally controlling the transaction security operation module and digitally signing the transaction confirmation result Send to the system platform via the transaction security confirmation module to complete the online transaction, or the main control module will digitally sign the transaction confirmation If sent via the mobile phone to the APP platform, complete the online transaction.

The invention also provides a method for confirming the security of online transactions through a mobile phone, which is applied to the system for confirming the security of online transactions through a mobile phone as described above. The system includes: a client, a system platform, a mobile phone APP, a transaction security confirmation module, The transaction security operation module and the main control module. The method includes a two-dimensional code generating step for generating a two-dimensional code based on transaction data and requests generated by online transactions, and displaying the two codes on the client. Dimensional code A code obtaining step is used to scan the two-dimensional code displayed on the client through the mobile phone APP to obtain and send the two-dimensional code; a transaction security confirmation step is used to receive and analyze all the data sent by the mobile phone app. The two-dimensional code is used to restore the transaction data and request, and the transaction data and request are confirmed through the mobile phone STK menu to generate a transaction confirmation result. The transaction security operation steps are used to use the mobile smart card security module function to verify the transaction data and request. The transaction confirmation result is digitally signed; in the transaction completion step, the transaction security confirmation module sends the signed transaction confirmation result to the system platform, and the system platform decides whether to continue the transaction based on the signed transaction confirmation result, If the transaction is continued, the system platform executes a transaction request and completes the entire online transaction.

The method for confirming the security of online transactions through a mobile phone as described above, the step of generating a two-dimensional code includes the step of generating a two-dimensional code of a client, and the client generates transaction data and requests according to the online transaction, and directly generates and displays the same. A two-dimensional code; or a system platform two-dimensional code generating step, generating a two-dimensional code based on the transaction data and a request, and sending the two-dimensional code to the client for display.

As described above, the method for confirming the security of online transactions on a network terminal through a mobile phone, the step of obtaining a two-dimensional code includes the step of scanning a two-dimensional code, using the mobile phone APP to scan and display on the client terminal of the network terminal. The two-dimensional code corresponding to the transaction data and the request; in the two-dimensional code sending step, the mobile phone APP transmits the two-dimensional code to the transaction security confirmation module.

The method for confirming the security of online transactions through a mobile phone as described above, the sending step of the two-dimensional code includes a mobile network sending step, and the mobile phone APP Sending the two-dimensional code to the system platform through a mobile network, and the system platform then sends the two-dimensional code to the transaction security confirmation module through a data message; or a communication channel sending step, all The mobile phone APP sends the two-dimensional code to the SIM card through a data channel between the mobile phone and the SIM card, and the transaction security confirmation module obtains the two-dimensional code from the SIM card.

The method for confirming the security of online transactions through a mobile phone as described above, the transaction security confirmation step includes a two-dimensional code analysis step, and the transaction security confirmation module obtains the transaction to be signed for confirmation by analyzing the two-dimensional code. Data and request; transaction confirmation step, a STK menu pops up in the transaction security confirmation module to display the transaction data and request to be signed for confirmation, and waits for the user to confirm the transaction in the STK menu to generate a transaction confirmation result.

The method for confirming the security of online transactions through a mobile phone as described above. The transaction security operation steps include a signature step. If the user confirms the transaction, the transaction security operation module uses the security module function on the SIM card to perform the transaction. Confirm the result signature.

The method for confirming the security of an online transaction through a mobile phone as described above, the transaction completion step includes: a short message transaction completion step, and the transaction security confirmation module directly returns the signed transaction confirmation result to the agency via a text message. The system platform; or the communication channel transaction completion step, the transaction security confirmation module sends the signed transaction confirmation result to the mobile APP through the data channel between the mobile phone and the SIM card, and the mobile APP passes the mobile network Way to the system platform.

The invention also provides a method for confirming the security of online transactions through a mobile phone. The SIM card implemented by the method adopts the method for confirming the security of online transactions through a mobile phone as described above. The SIM card includes: a card-end communication module for data communication with the mobile phone; and a transaction security operation module for using the mobile phone. The smart card security module function digitally signs the transaction confirmation results of online transactions; the main control module is used to centrally control and process the card-side communication module and the transaction security operation module to digitally sign The result of the transaction confirmation is sent to the system platform via a mobile phone to complete the online transaction.

The present invention also provides a mobile phone implemented based on a method for confirming the security of online transactions through a mobile phone. The method for confirming online transaction security by using a mobile phone as described above is provided. The mobile phone includes a mobile phone communication module for communicating with a SIM card. Data communication; mobile phone APP for scanning the two-dimensional code displayed on the client to obtain the two-dimensional code and sending the two-dimensional code through the mobile phone communication module; transaction security confirmation module for receiving and Parse the two-dimensional code sent by the mobile APP, restore transaction data and requests for online transactions, confirm the transaction data and requests through the mobile STK menu, and generate transaction confirmation results.

The present invention also provides an online transaction system implemented based on a method for confirming the security of online transactions through a mobile phone. The method for confirming the security of online transactions through a mobile phone as described above is adopted. The online transaction system includes: a client for conducting For online transactions, the client generates transaction data and requests based on the online transactions; a system platform for performing related background business processing of the online transactions, generates a two-dimensional code based on the transaction data and requests, and Sending the two-dimensional code to the client for display; a mobile phone system for acquiring the two-dimensional code by scanning the two-dimensional code displayed by the client Code, parses the two-dimensional code, restores the transaction data and request, confirms the transaction data and request through the mobile STK menu, and generates a transaction confirmation result; a SIM card is used to use the mobile smart card security module function to The transaction confirmation result is digitally signed, and the digitally signed transaction confirmation result is sent to the system platform via the mobile phone system to complete the entire online transaction.

The present invention also provides an online transaction system implemented based on a method for confirming the security of online transactions through a mobile phone. The method for confirming the security of online transactions through a mobile phone as described above is adopted. The online transaction system includes: For online transactions, the client generates transaction data and requests based on the online transactions, and generates and displays a two-dimensional code; a system platform for performing related background business processing of the online transactions; a mobile phone system for Scan the two-dimensional code displayed by the client, obtain the two-dimensional code, parse the two-dimensional code, restore the transaction data and requests, confirm the transaction data and requests through the mobile STK menu, and generate Transaction confirmation result; SIM card for digitally signing the transaction confirmation result with the function of the mobile phone smart card security module, and sending the digitally signed transaction confirmation result to the system platform via the mobile phone system, completing the entire Online Trading.

The online transaction system implemented based on the method for confirming the security of online transactions through a mobile phone as described above, the mobile phone system includes: a mobile phone communication module for data communication with the SIM card; a mobile phone APP for Scanning the two-dimensional code displayed on the client to obtain and send the two-dimensional code through the mobile phone communication module; a transaction security confirmation module for receiving and analyzing the second code sent by the mobile phone APP Dimension code, restore the transaction data Material and request, confirm the transaction information and request through the mobile phone STK menu, and generate a transaction confirmation result.

As described above, the online transaction system implemented based on the method for confirming the security of online transactions through a mobile phone, the SIM card includes: a card-end communication module for data communication with the mobile phone system; a transaction security operation module, It is used for digitally signing the transaction confirmation result by using the function of the mobile phone smart card security module; the main control module is used to centrally control and process the card-side communication module and the transaction security operation module, and The digitally signed transaction confirmation result is sent to the system platform via a mobile phone to complete an online transaction.

A method and a system for confirming the security of online transactions through a mobile phone provided by embodiments of the present invention. The mobile phone scans a two-dimensional code displayed on a client to obtain transaction data and requests for signature confirmation, and uses a STK menu to secure transactions. Confirmation: Use the security module on the security smart card to digitally sign the transaction data and request for signature confirmation. The invention enables a smart phone with a secure smart card to have a "second-generation Key" function for online transactions on a network terminal, which not only ensures the security of online transactions on the network terminal, but also is convenient to carry at any time and is convenient for users.

The present invention has the following beneficial effects.

1) Easy to use. The system of the present invention enables users to confirm the transaction through a two-dimensional code without the need to plug and unplug the USBKey during the transaction process on the network terminal.

2) The security is high. The two-dimensional code transaction confirmation method of the present invention is not easy to be lost and stolen by others, which greatly improves the security of user accounts.

1‧‧‧client

2‧‧‧system platform

3‧‧‧Mobile APP

4‧‧‧Transaction Security Confirmation Module

5‧‧‧Transaction Security Operation Module

6‧‧‧Master Control Module

10‧‧‧Card-side communication module

11‧‧‧Transaction Security Operation Module

12‧‧‧Master Control Module

21‧‧‧Mobile communication module

22‧‧‧Mobile APP

23‧‧‧Transaction Security Confirmation Module

31‧‧‧Client

32‧‧‧system platform

33‧‧‧Mobile phone system

331‧‧‧Mobile communication module

332‧‧‧Mobile APP

333‧‧‧Transaction Security Confirmation Module

34‧‧‧SIM card

341‧‧‧Card-side communication module

342‧‧‧Transaction Security Operation Module

343‧‧‧Master Control Module

S1‧‧‧Two-dimensional code generation steps

S2‧‧‧ QR code acquisition steps

S3‧‧‧Transaction Security Confirmation Steps

S4‧‧‧Transaction security operation steps

S5‧‧‧Transaction Completion Steps

S11‧‧‧Client QR code generation steps

S12‧‧‧System platform QR code generation steps

S21‧‧‧ QR code scanning steps

S22‧‧‧ QR code sending steps

S221‧‧‧ Mobile network sending steps

S222‧‧‧Communication channel sending steps

S31‧‧‧Two-dimensional code analysis steps

S32‧‧‧Transaction Confirmation Steps

S41‧‧‧Signing steps

S50 ~ S60‧‧‧step

S501‧‧‧SMS completion steps

S502‧‧‧Communication channel transaction completion steps

FIG. 1 is a logic block diagram of a system for confirming online transaction security through a mobile phone according to the present invention.

FIG. 2 is a schematic flowchart of a method for confirming online transaction security through a mobile phone according to the present invention.

3 to 5 are detailed flowcharts of a method for confirming the security of online transactions through a mobile phone according to the present invention.

FIG. 6 is a schematic flowchart of a specific embodiment of a method according to the present invention.

FIG. 7 is a logic block diagram of a SIM card implemented based on a method for confirming online transaction security through a mobile phone according to the present invention.

FIG. 8 is a logic block diagram of a mobile phone implemented based on a method for confirming online transaction security through a mobile phone according to the present invention.

FIG. 9 is a logic block diagram of an online transaction system implemented by a method for confirming online transaction security through a mobile phone according to the present invention.

In order to explain the embodiments and technical solutions of the present invention more clearly, the technical solutions of the present invention will be described in more detail with reference to the drawings and the embodiments. Obviously, the described embodiments are part of the present invention, but not all of them. Examples. Based on the embodiments of the present invention, all other embodiments obtained by those with ordinary knowledge in the technical field without departing from the spirit of the present invention belong to the protection scope of the present invention.

The present invention provides a system for confirming the security of online transactions through a mobile phone. FIG. 1 is a logic block diagram of a system for confirming the security of online transactions through a mobile phone. As shown in FIG. 1, the system of the present invention includes:

Client 1: used for online transactions, the client is based on online transactions Generate transaction information and requests.

System platform 2: It is used to perform related background business processing of online transactions, generate a QR code based on transaction data and requests, and send the QR code to the client for display.

Mobile APP 3: It is used to obtain and send the QR code by scanning the QR code displayed on the client.

Transaction security confirmation module 4: It is used to receive and analyze the QR code sent by mobile APP 3, restore transaction data and requests, confirm transaction data and requests through the mobile STK menu, and generate transaction confirmation results.

Transaction security operation module 5: Used to digitally sign the transaction confirmation result using the smart card security module function.

Main control module 6: It is used to centrally control the transaction security operation module 5 and send the digitally signed transaction confirmation results to the system platform 2 via the transaction security confirmation module 4 to complete online transactions, or the main control module 6 The digitally signed transaction confirmation result is sent to the system platform 2 via the mobile APP 3 to complete the online transaction.

In another specific embodiment of the system of the present invention, FIG. 1 is a logic block diagram of a system for confirming the security of online transactions through a mobile phone according to the present invention. As shown in FIG. 1, the system of the present invention includes:

Client 1 is used for online transactions. Client 1 generates transaction data and requests based on online transactions, and generates and displays a QR code.

System platform 2: Used for related background business processing of online transactions.

Mobile APP 3: It is used to obtain and send the QR code by scanning the QR code displayed on the client.

Transaction security confirmation module 4: It is used to receive and analyze the QR code sent by mobile APP 3, restore transaction data and requests, confirm transaction data and requests through the mobile STK menu, and generate transaction confirmation results.

Transaction security operation module 5: Used to digitally sign the transaction confirmation result using the smart card security module function.

Main control module 6: It is used to centrally control the transaction security operation module 5 and send the digitally signed transaction confirmation results to the system platform 2 via the transaction security confirmation module 4 to complete online transactions, or the main control module 6 The digitally signed transaction confirmation result is sent to the system platform 2 via the mobile APP 3 to complete the online transaction.

The transaction security operation module provides security functions such as encryption and decryption and digital signature services.

There are two cases of sending the transaction signature confirmation result to the system platform:

1. Completed by the transaction confirmation module

After the transaction confirmation module calls the transaction operation module for signature through the main control module, the main control module returns the transaction signature confirmation result to the transaction confirmation module, and the transaction confirmation module sends the data to the system platform through data messaging.

2. Completed by APP

After the transaction confirmation module calls the transaction operation module signature through the main control module, the main control module returns the transaction signature confirmation result to the APP through the machine card high-speed data channel, and the APP sends it to the system platform through the mobile network.

The client of the present invention is a personal device or a self-service terminal with a display screen that can support online transactions, including but not limited to PC, IPAD, mobile phone, ATM Machine and so on.

The STK (Sim Tool Kit) menu in this solution is a system function call triggered by the SIM or the system platform. Malicious programs in the phone cannot intervene and change the display and input in the STK. At this time, the user sees the transaction in the STK menu. The situation is the transaction data and request for signature confirmation that is parsed by the system platform through the QR code sent by the data message, or the signature confirmation that is parsed by the QR code that is transmitted by the APP through the high-speed data channel of the machine card Transaction information and requests, if the user wishes to continue the transaction, the transaction is "confirmed" in the STK menu, otherwise the transaction is "canceled". After obtaining the manual confirmation operation result in the STK menu, use the security function provided by the security module in SIM to sign the transaction and other operations.

The high-speed data channel of the machine card according to the present invention may be any communication method that can be provided between a mobile phone and a smart card, such as Bluetooth, WiFi, Zigbee and other communication methods. Typically, the high-speed data channel of the machine card is the Bluetooth channel between the mobile phone and the smart card. That is, using the method of the present invention can make the Bluetooth SIM have the "second-generation Key" security function, so that the wisdom with the Bluetooth SIM The mobile phone can have the "second-generation Key" security function for online transactions on the network terminal, which can be used to replace the USBKey used in online transactions on the network terminal to ensure the security of online transactions on the network terminal.

The security smart card in the present invention refers to a smart card that integrates security module (SE) or secure element hardware, including but not limited to communication smart cards of various forms and sizes, such as standard SIM, UIM, USIM, MicroSIM, NanoSIM and the like.

The system platform according to the present invention refers to a remote server that performs transaction service processing. Server platform.

FIG. 2 is a schematic flowchart of a method for confirming online transaction security through a mobile phone according to the present invention. As shown in FIG. 2, the present invention also provides a method for confirming online transaction security through a mobile phone, which is applied to confirm online transaction security through a mobile phone as described above The system includes a client, a system platform, a mobile phone APP, a transaction security confirmation module, a transaction security operation module, and a main control module. The method includes:

Step S1 for generating a two-dimensional code: generating a two-dimensional code based on the transaction data and requests generated by the online transaction, and displaying the two-dimensional code on the client; during the client transaction, the client generates transaction data to be signed for confirmation With request.

Step S2 for obtaining a two-dimensional code: It is used to scan the two-dimensional code displayed on the client through the mobile phone APP, and obtain and send the two-dimensional code.

Transaction security confirmation step S3: It is used to receive and analyze the QR code sent by the mobile phone APP, restore the transaction data and requests, confirm the transaction data and requests through the mobile STK menu, and generate a transaction confirmation result.

Transaction security operation step S4: It is used to digitally sign the transaction confirmation result using the smart card security module function.

Transaction completion step S5: The transaction security confirmation module sends the signed transaction confirmation result to the system platform. The system platform decides whether to continue the transaction based on the signed transaction confirmation result. If the transaction is continued, the system platform executes the transaction request and completes the entire online transaction.

FIG. 3 to FIG. 5 are detailed flowcharts of a method for confirming the security of online transactions through a mobile phone according to the present invention, as shown in FIG. 3, where the two-dimensional code generating step S1 includes:

The client QR code generation step S11: The client generates transaction data and requests based on online transactions, and directly generates and displays the QR code.

Alternatively, the system platform two-dimensional code generating step S12: generating a two-dimensional code based on the transaction data and the request, and sending the two-dimensional code to the client for display.

If the client generates a two-dimensional code, the client generates a two-dimensional code based on the transaction data and request to be signed for confirmation, and then sends the two-dimensional code to the system platform through the network.

As shown in FIG. 3, where the two-dimensional code obtaining step S2 includes:

Step S21 for scanning a two-dimensional code: Use a mobile phone APP to scan a two-dimensional code corresponding to transaction data and requests displayed on a client terminal of a network terminal.

Step S22 of sending the two-dimensional code: The mobile phone APP transmits the two-dimensional code to the transaction security confirmation module.

As shown in FIG. 4, where the two-dimensional code sending step S22 includes:

Mobile network sending step S221: The mobile phone APP sends the two-dimensional code to the system platform through the mobile network, and the system platform sends the two-dimensional code to the transaction security through a data message. Confirm the module.

Alternatively, the communication channel sends step S222: the mobile phone APP sends the two-dimensional code to the SIM card through the data channel between the mobile phone and the SIM card, and the transaction security confirmation module obtains the two-dimensional code from the SIM card.

Among them, as shown in FIG. 3, the transaction security confirmation step S3 includes:

Step S31 for analyzing the two-dimensional code: The transaction security confirmation module obtains transaction data and requests for signature confirmation by analyzing the two-dimensional code.

Transaction confirmation step S32: The STK menu pops up in the transaction security confirmation module to display the transaction data and request for signature confirmation, waiting for the user to wait for STK Confirm the transaction in the menu to generate the transaction confirmation result.

Among them, as shown in FIG. 3, the transaction security operation step S4 includes:

Signature step S41: If the user confirms the transaction, the transaction security operation module uses the security module function on the SIM card to sign the transaction confirmation result.

As shown in FIG. 5, the transaction completion step S5 includes:

The short message transaction completion step S501: The transaction security confirmation module directly returns the signed transaction confirmation result to the system platform through a data message.

Alternatively, the communication channel transaction completion step S502: The transaction security confirmation module sends the signed transaction confirmation result to the mobile phone APP through the data channel between the mobile phone and the SIM card, and the mobile phone APP sends the system platform through the mobile network.

FIG. 6 is a schematic flowchart of a method for confirming online transaction security through a mobile phone according to a specific embodiment of the present invention, as shown in FIG. 6.

Taking mobile phone online bank transfer as an example, the method for confirming the security of online transactions through a mobile phone is further explained as follows.

In the specific embodiment of the present invention, the client is a personal device or a self-service terminal with a display screen that can support online transactions, including, but not limited to, a PC, an IPAD, a mobile phone, and an ATM machine.

Step S50: During the online transaction process of the client, the client generates transaction data and a transfer request to be signed for confirmation. For example, on the client's online banking transfer page, the user is prompted to enter transaction information, such as: counterparty account number, transfer amount, and so on.

Step S51: the system platform generates a two-dimensional code: the client will confirm the signature The recognized transaction information and the transfer request are sent to the system platform via the network, and the system platform generates a corresponding two-dimensional code based on the transaction data and the transfer request to be signed for confirmation, and then sends the two-dimensional code to the client through the network; Or the client generates a two-dimensional code: The client generates a corresponding two-dimensional code based on the transaction data to be signed and the transfer request, and then sends the two-dimensional code to the system platform through the network.

Step S52: The client terminal displays the QR code: the client terminal displays the transaction data to be signed for confirmation and the transfer request, and the corresponding QR code on the transaction confirmation page.

Step S53: The user scans the QR code on the client using the mobile phone APP.

Step S54: The APP transmits the two-dimensional code to the mobile phone system: The APP sends the two-dimensional code to the system platform through the mobile network, and the system platform sends the two-dimensional code to the mobile phone system through a data message; During the channel, the APP sends the QR code to the SIM through the Bluetooth channel of the SIM card. The SIM parses the QR code to obtain the information and requests to be signed, and the mobile phone system obtains the QR code / to-be-signed data and requests from the SIM. The specific methods for obtaining QR code / material to be signed and request are as follows.

(1) After the APP sends the QR code to the SIM card through the Bluetooth module on the mobile phone, the APP notifies the system platform to send a specific data message to the mobile phone, triggering the mobile phone system to obtain the QR code / material to be signed and request from the SIM.

And / or (2) After the SIM receives the QR code through the card-side Bluetooth module, the SIM sets a specific response status word in the subsequent 7816 normal command response to notify the mobile phone system to obtain the QR code / waiting on the card. Signature information and request. The mobile phone system obtains the QR code / material to be signed and request from the SIM by specifying the command after receiving the “Reading Material” notification from the SIM. For example, the mobile phone system can obtain the QR code / material to be signed and request from the SIM through the Fetch command.

The mobile network includes, but is not limited to, a mobile data network and / or a WiFi wireless network provided by an operator.

Step S55: The mobile phone system parses the QR code to obtain the to-be-signed confirmation data and transfer request, or obtains the to-be-signed signature data and request from the SIM, and then pops up the STK menu to display the to-be-signed confirmation transaction data and transfer request, waiting for the user to wait in the STK menu Confirm the transaction.

Step S56: The user confirms the transaction in the STK menu. The user selects "confirm" or "cancel" on the STK menu to manually confirm the transaction.

Step S57: If the user confirms to continue the transaction, the mobile phone system uses the security function provided by the security module on the card to perform security operations such as transaction signature.

Step S58: The mobile phone system directly returns the result of the signature confirmation to the system platform through a text message; or when there is a Bluetooth channel of the mobile phone card, the mobile phone system returns the signature confirmation result to the APP through the mobile phone's Bluetooth channel, and the APP sends it through the mobile network To the system platform.

Step S59: After the system platform receives the signature confirmation result, it determines whether to continue the subsequent transaction process according to the user signature confirmation result. If the system platform determines to continue the transaction, the system platform executes the transaction request, and then sends the transaction result to the client through the network.

Step S60: After receiving the transaction result, the client terminal displays it for the user. Check it out.

The present invention also provides a SIM card implemented based on a method for confirming the security of online transactions through a mobile phone, which uses the method for confirming the security of online transactions through a mobile phone as described above. As shown in FIG. 7, the SIM card logic block diagram includes at least a card-side communication module 10, a transaction security operation module 11, and a main control module 12. The card-side communication module 10 is used for Bluetooth connection and communication with the mobile-phone-side communication module 21, and transmits information such as two-dimensional codes and signature confirmation results; the main control module 12 is used for security control and processing of card-side processes; transaction security The operation module 11 is used for security operations such as digital signatures. The security module can be an independent module on the card or integrated with the security master control module in one module.

The SIM card includes:

Card-side communication module 10: used for data communication with mobile phones.

Transaction security operation module 11: It is used to digitally sign the transaction confirmation result of online transactions using the function of the smart card security module.

Main control module 12: It is used to centrally control and process the card-end communication module and transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via the mobile phone to complete the online transaction.

The present invention also provides a mobile phone implemented based on a method for confirming online transaction security through a mobile phone. FIG. 8 is a logic block diagram of a mobile phone implemented based on a method for confirming online transaction security through a mobile phone. As shown in FIG. Describes the method of confirming the security of online transactions through a mobile phone. The mobile phone includes:

Mobile phone communication module 21: used for data communication with SIM card.

Mobile APP 22: used to scan the QR code displayed on the client to obtain Taking the two-dimensional code and sending the two-dimensional code through the mobile phone communication module;

Transaction security confirmation module 23: used to receive and parse the two-dimensional code sent by the mobile phone APP, restore transaction data and requests for online transactions, confirm the transaction data and requests through the mobile STK menu, and generate transactions verify results.

The mobile phone APP 22 is responsible for scanning and processing of the two-dimensional code; the mobile phone communication module 21 is used to perform Bluetooth connection and communication with the SIM card-side Bluetooth module, and transmit information such as the two-dimensional code and signature confirmation results; the transaction security confirmation module 23 is used to parse the QR code, pop up the STK menu to display the data to be signed and the transaction request, and accept the user's confirmation input.

The present invention also provides an online transaction system implemented based on a method for confirming the security of online transactions through a mobile phone, which uses the method for confirming the security of online transactions through a mobile phone as described above. The logic block diagram of the online trading system implemented by the method is shown in Figure 9. The online trading system includes:

Client 31: It is used for online transactions. Client 31 generates transaction data and requests according to the online transactions.

System platform 32: It is used to perform related background business processing of online transactions, generate a two-dimensional code based on transaction data and requests, and send the two-dimensional code to the client for display.

Mobile phone system 33: used to scan the two-dimensional code displayed on the client to obtain the two-dimensional code, parse the two-dimensional code, restore the transaction data and requests, and conduct the transaction through the mobile phone STK menu Information and Requests Line confirmation to generate transaction confirmation results.

SIM card 34: It is used to digitally sign the transaction confirmation result by using a smart card security module function, and send the digitally signed transaction confirmation result to the system platform via a mobile phone system to complete the entire online transaction.

In another specific embodiment of the present invention, an online transaction system implemented based on a method for confirming the security of online transactions through a mobile phone is also provided. The method for confirming the security of online transactions through a mobile phone as described above is adopted. FIG. The logical block diagram of the online transaction system implemented by the method of confirming the security of online transactions with a mobile phone, as shown in FIG. 9, the online transaction system includes:

The client 31 is used for online transactions. The client 31 generates transaction data and requests according to the online transactions, and generates and displays a two-dimensional code.

System platform 32: related background business processing for online transactions.

Mobile phone system 33: used to scan the two-dimensional code displayed on the client to obtain the two-dimensional code, parse the two-dimensional code, restore the transaction data and requests, and conduct the transaction through the mobile phone STK menu The data is confirmed with the request, and the transaction confirmation result is generated.

SIM card 34: It is used to digitally sign the transaction confirmation result by using a smart card security module function, and send the digitally signed transaction confirmation result to the system platform via a mobile phone system to complete the entire online transaction.

As shown in FIG. 9, the mobile phone system 33 includes:

Mobile phone communication module 331: used for data communication with SIM card.

Mobile phone APP 332: used to scan the QR code displayed on the client to obtain and send the QR code through the mobile phone's communication module.

Transaction security confirmation module 333: It is used to receive and analyze the QR code sent by the mobile APP, restore transaction data and requests, confirm transaction data and requests through the mobile STK menu, and generate transaction confirmation results.

As shown in FIG. 9, the SIM card 34 includes:

Card-side communication module 341: used for data communication with the mobile phone system.

Transaction security operation module 342: It is used to digitally sign the transaction confirmation result by using the function of the smart card security module.

Main control module 343: It is used to centrally control and process the card-side communication module and transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via the mobile phone to complete the online transaction.

In summary, the method and system for confirming online transaction security through a mobile phone according to the present invention can enable a smart phone with a secure smart card to have a "second-generation Key" function for online transactions, and the user does not need to use a special smart password. The key (USBKey) is a smart phone with a security smart card according to the present invention, which can ensure the security of online transactions, and is convenient to carry at any time, which is more convenient for users.

The above description is only the preferred embodiments of the present invention, and is not intended to limit the protection scope of the present invention.

S1‧‧‧Two-dimensional code generation steps

S2‧‧‧ QR code acquisition steps

S3‧‧‧Transaction Security Confirmation Steps

S4‧‧‧Transaction security operation steps

S5‧‧‧Transaction Completion Steps

Claims (15)

A system for confirming the security of online transactions through a mobile phone includes a client, which is used to conduct online transactions, and the client generates transaction data and requests based on the online transactions; a system platform, which is used to perform the Related background business processing of online transactions, generating a QR code based on the transaction data and request, and sending the QR code to the client for display; a mobile APP, which is used to scan the client displayed by the Two-dimensional code, obtain and send the two-dimensional code; transaction security confirmation module, the transaction security confirmation module is used to receive and parse the two-dimensional code sent by the mobile APP, restore the transaction data and requests, and use the mobile STK menu Confirm the transaction information and request to generate a transaction confirmation result; a transaction security operation module, which is used to digitally sign the transaction confirmation result using the function of the mobile phone smart card security module; the main control module, The main control module is used to control the transaction security operation module, and digitally sign the transaction confirmation result via the transaction security confirmation. Module is sent to the system platform to complete online transactions, or the digital signature of the master module will confirm the results of the transaction is sent via the mobile phone to the APP platform, complete the online transaction. A system for confirming the security of online transactions through a mobile phone, including: Client, which is used to conduct online transactions. The client generates transaction information and requests based on the online transactions, and generates and displays QR codes. System platform, which is used to perform the related background of the online transactions. Business processing; mobile APP, which is used to obtain and send the QR code by scanning the QR code displayed by the client; transaction security confirmation module, which is used to receive and parse the mobile phone The two-dimensional code sent by the APP restores the transaction data and request, confirms the transaction data and request through the mobile STK menu, and generates the transaction confirmation result; the transaction security operation module, which is used to use mobile smart phone The card security module function digitally signs the transaction confirmation result; the main control module is used to centrally control the transaction security operation module and digitally sign the transaction confirmation result via the transaction security The confirmation module is sent to the system platform to complete the online transaction, or the main control module passes the digitally signed transaction confirmation result via the mobile APP The system platform to complete online transactions. A method for confirming the security of online transactions through a mobile phone is applied to a system for confirming the security of online transactions through a mobile phone as described in claim 1 or 2. The system includes: a client, a system platform, a mobile APP, and a transaction security confirmation module. Group, transaction security operation module and main control module, wherein the method for confirming the security of online transactions through a mobile phone includes: Two-dimensional code generation step: used to generate a two-dimensional code based on transaction data and requests generated by online transactions, and display the two-dimensional code on the client; the two-dimensional code acquisition step: used to scan the customer through the mobile APP The two-dimensional code displayed on the mobile terminal is used to obtain and send the two-dimensional code; the transaction security confirmation step is used to receive and parse the two-dimensional code sent by the mobile APP, restore the transaction data and requests, and use the mobile STK menu to process the transaction. Confirm the information with the request to generate the transaction confirmation result. Transaction security operation steps: Use the mobile smart card security module function to digitally sign the transaction confirmation result. Transaction completion steps: The transaction security confirmation module will sign the transaction. The confirmation result is sent to the system platform. The system platform decides whether to continue the transaction based on the signed transaction confirmation result. If the transaction is continued, the system platform executes the transaction request and completes the entire online transaction. The method for confirming the security of online transactions through a mobile phone as described in claim 3, wherein the two-dimensional code generation step includes: a client two-dimensional code generation step: the client generates transaction data and requests according to the online transaction, and directly generates and Display the two-dimensional code; or the system platform two-dimensional code generation step: generate a two-dimensional code based on the transaction data and the request, and send the two-dimensional code to the client for display. The method for confirming the security of online transactions on a network terminal through a mobile phone as described in claim 3, wherein the step of obtaining the two-dimensional code includes: a step of scanning the two-dimensional code: scanning the displayed on the client terminal of the network terminal using the mobile phone APP The two-dimensional code corresponding to the transaction information and request; the two-dimensional code sending step: the mobile phone APP transmits the two-dimensional code to the transaction security confirmation module. The method for confirming the security of online transactions through a mobile phone as described in claim 5, wherein the step of sending the two-dimensional code includes: a mobile network sending step: the mobile APP sends the two-dimensional code to the system platform through the mobile network, The system platform then sends the two-dimensional code to the transaction security confirmation module through a data message; or the communication channel sending step: The mobile phone APP sends the two-dimensional code to the data channel through the data channel between the mobile phone and the SIM card. SIM card, the transaction security confirmation module obtains the two-dimensional code from the SIM card. The method for confirming the security of an online transaction through a mobile phone as described in claim 3, wherein the transaction security confirmation step includes a two-dimensional code analysis step: the transaction security confirmation module obtains the transaction to be signed for confirmation by parsing the two-dimensional code. Data and request; transaction confirmation step: The STK menu pops up in the transaction security confirmation module to display the transaction data and request to be signed for confirmation, waiting for the user to confirm the transaction in the STK menu to generate a transaction confirmation result. The method for confirming the security of online transactions through a mobile phone as described in claim 3, wherein the transaction security operation steps include: a signature step: if the user confirms the transaction, the transaction security operation module uses the security module function on the SIM card Sign the transaction confirmation result. The method for confirming the security of an online transaction through a mobile phone as described in claim 3, wherein the transaction completion step includes: a short message transaction completion step: the transaction security confirmation module directly returns the signed transaction confirmation result to the text message The system platform; or communication channel transaction completion steps: The transaction security confirmation module sends the signed transaction confirmation result to the mobile APP through the data channel between the mobile phone and the SIM card, and the mobile APP sends the mobile APP to the mobile network through the mobile network. the system platform. A SIM card based on a method for confirming the security of online transactions through a mobile phone adopts the method for confirming the security of online transactions through a mobile phone as described in any one of claims 3-9, wherein the SIM card includes: a card-end communication module Group, the card-side communication module is used for data communication with the mobile phone; transaction security operation module, the transaction security operation module is used to digitally sign the transaction confirmation result of online transactions using the function of the mobile phone smart card security module; Main control module, which is used to centrally control and process the card-end communication module and the transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via a mobile phone to complete the online transaction. A mobile phone implemented based on a method for confirming the security of online transactions through a mobile phone, using the method for confirming online transaction security through a mobile phone as described in any one of claims 3-9, wherein the mobile phone includes: a mobile phone communication module, The mobile communication module is used for data communication with the SIM card; the mobile APP is used to scan the two-dimensional code displayed on the client to obtain the two-dimensional code and send the two-dimensional code through the mobile communication module Code; transaction security confirmation module. The transaction security confirmation module is used to receive and parse the two-dimensional code sent by the mobile APP, restore transaction data and requests for online transactions, and perform transaction data and requests through the mobile STK menu. Confirm, generate transaction confirmation result. An online transaction system implemented based on a method for confirming the security of online transactions through a mobile phone adopts the method for confirming the security of online transactions through a mobile phone as described in any one of claims 3-9, wherein the online transaction system includes: Client, which is used for online transactions, and the client generates transaction data and requests based on the online transactions; System platform, which is used to perform related background business processing of the online transaction, generate a two-dimensional code based on the transaction data and request, and send the two-dimensional code to the client for display; mobile phone system, the mobile phone system It is used to scan the two-dimensional code displayed on the client to obtain the two-dimensional code, parse the two-dimensional code, restore the transaction data and request, confirm the transaction data and request through the mobile STK menu, and generate a transaction confirmation result. ; SIM card, which is used to digitally sign the transaction confirmation result using the mobile phone smart card security module function, and send the digitally signed transaction confirmation result to the system platform via the mobile phone system to complete the entire online transaction. An online transaction system implemented based on a method for confirming the security of online transactions through a mobile phone adopts the method for confirming the security of online transactions through a mobile phone as described in any one of claims 3-9, wherein the online transaction system includes: Client, which is used to conduct online transactions. The client generates transaction information and requests based on the online transactions, and generates and displays QR codes. System platform, which is used to perform the related background of the online transactions. Business processing; mobile phone system, which is used to scan the two-dimensional code displayed on the client to obtain the two-dimensional code, parse the two-dimensional code, restore the transaction data and requests, and use the STK menu of the mobile phone to process the transaction data. Confirm with the request to generate transaction confirmation results; SIM card. The SIM card is used to digitally sign the transaction confirmation result using the function of the mobile phone smart card security module, and the digitally signed transaction confirmation result is sent to the system platform via the mobile phone system to complete the entire online transaction. The online transaction system implemented based on the method for confirming the security of online transactions through a mobile phone as described in claim 13, wherein the mobile phone system includes a mobile phone communication module, and the mobile phone communication module is used to communicate with the SIM card. Data communication; mobile phone APP, which is used to scan the two-dimensional code displayed on the client to obtain and send the two-dimensional code through the mobile phone communication module; transaction security confirmation module, the transaction security confirmation module It is used to receive and parse the two-dimensional code sent by the mobile APP, restore the transaction data and request, confirm the transaction data and request through the mobile STK menu, and generate a transaction confirmation result. The online transaction system based on the method for confirming the security of online transactions through a mobile phone as described in claim 13, wherein the SIM card includes a card-side communication module, and the card-side communication module is used to communicate with the mobile phone system. Data communication; transaction security operation module, which is used to digitally sign the transaction confirmation result using the function of the mobile phone smart card security module; Main control module, which is used to centrally control and process the card-end communication module and the transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via a mobile phone to complete the online transaction.