WO2013023499A1

WO2013023499A1 - Mobile phone payment security control method and system

Info

Publication number: WO2013023499A1
Application number: PCT/CN2012/078151
Authority: WO
Inventors: 罗攀峰; 韩英彬; 霍国杰
Original assignee: 广州广电运通金融电子股份有限公司
Priority date: 2011-08-17
Filing date: 2012-07-04
Publication date: 2013-02-21
Also published as: CN102254264A

Abstract

A mobile phone payment security control method and system. The method includes: logging onto a transaction platform via a mobile phone and accessing a security token via the voice channel of the mobile phone; the transaction platform and the security token performing bidirectional authentication; after the bidirectional authentication is passed, the mobile phone importing user payment data, and transmitting the user payment data to the security token via the voice channel; the security token invoking an encryption algorithm and key data embedded therein, encrypting the user payment data, and returning to the mobile phone the encrypted user payment data and the corresponding digital signature information; and the mobile phone transmitting to the transaction platform the encrypted user payment data and the corresponding digital signature information. Applying the embodiments of the present invention can reduce the risks that the user identity is forged, the transaction information is tampered and the account fund is stolen, improving the security of mobile phone payment.

Description

Mobile payment security control method and system

The present application claims priority to Chinese Patent Application No. 201110235656.8, entitled "Mobile Payment Security Control Method and System", filed on August 17, 2011, the entire contents of which is incorporated herein by reference. .

Technical field

The present invention relates to the field of financial technology, and in particular, to a mobile phone payment security control method and system.

Background technique

Mobile payment, also known as mobile payment, is a way for mobile users to use their mobile terminals (usually mobile phones) to pay for goods or services they consume. Domestic commercial banks have opened their own mobile banking in some areas, providing convenient personalized financial services and fast payment channels for mobile phone users. However, the overall security status of mobile payment is not satisfactory. How to ensure the security of mobile payment has become the focus of attention of users and banks.

The related parties of mobile payment mainly include: acquirer system, mobile billing system, mobile banking and shopping website. Among them, the acquirer system refers to the settlement unit or enterprise that collects the purchase price from major banks and UnionPay systems; the mobile phone billing system is the mobile phone holder that supports mobile payment, and belongs to the entity of the issuer; mobile banking is one of the trading platforms.

When a user pays by mobile phone, the transaction process is as follows: (1) trading platform access authentication; (2) the merchant or website inputs a specific collection amount according to the purchased goods; (3) the customer uses the mobile phone to the trading platform Import their identity information; (4) The trading platform submits the merchant and customer information to the bank back office for corresponding settlement. Currently, the security protection method for mobile payment is: The payment account is bound to the mobile phone, and the static password and the dynamic password based on the short message are used for identity authentication.

The existing mobile payment authentication method has the following disadvantages: When paying by mobile phone, the payment account and the mobile phone must be bound, if the mobile phone is accidentally lost, and the payment password set by the user is too

1 The order will be easily stolen by others. Moreover, the current mobile phone virus has been able to steal the user's payment account password by intercepting the keyboard record, intercepting the tomb-changing network data packet, or illegally changing the transaction information, and even can achieve the purpose of malicious consumption or transfer through the analog button.

Summary of the invention

The embodiment of the invention provides a mobile phone payment security control method and system, which can reduce the risk of fraudulent use of the user identity, the transaction information being tombed and the account funds being stolen, and improve the security of the mobile payment.

The mobile phone payment security control method provided by the embodiment of the invention includes:

Sl, logging in to the trading platform through the mobile phone, and the voice channel of the mobile phone accesses the security token; the transaction platform and the security token perform mutual authentication;

After the two-way authentication is passed, the mobile phone imports user payment data, and transmits the user payment data to the security token through a voice channel.

53. The security token invokes a built-in encryption algorithm and key data, performs encryption processing on the user payment data, and returns the encrypted user payment data and corresponding digital signature information to the mobile phone.

54. The mobile phone transmits the encrypted user payment data and the corresponding digital signature information to the transaction platform.

The security token is a 25mm earphone plug or a 35mm earphone plug conforming to the YD/T 1538-2006 5.1.2.6 specification, and is connected to the voice interface of the mobile phone.

Further, a protocol converter, a micro control unit and a memory are disposed on the security token;

The protocol converter is configured to perform analog-to-digital conversion on data transmitted by the mobile phone, filter out the sound signal, and transmit the signal to the micro control unit for authentication or encryption processing;

The protocol converter is further configured to perform digital-to-analog conversion on the authenticated or encrypted data, generate a voice signal, and transmit the voice signal to the mobile phone through the voice channel;

The memory includes a transaction data storage area, a program storage area, and a key storage area that can only be read and written, and is used to store transaction data, encryption algorithms, and key data, respectively.

2 Correspondingly, the mobile payment system provided by the embodiment of the invention includes a mobile phone, a security token and an online banking server;

The mobile phone is used to log in to the transaction platform to establish a communication connection with the online banking server; and the mobile phone has a voice interface for accessing the security token;

The mobile phone is further configured to send the authentication information and the user payment data to the security token; the security token stores an encryption algorithm and key data, and is used to authenticate the authentication information sent by the mobile phone, to the mobile phone Sending user payment data for encryption processing, and returning the encrypted user payment data and corresponding digital signature information to the mobile phone;

The mobile phone transmits the encrypted user payment data and the corresponding digital signature information to the online banking server.

Further, the security token includes a headphone plug, a switch, a protocol converter, a micro control unit, a memory, and a power source;

The earphone plug is connected to a voice interface of the mobile phone;

The switch is disposed at the earphone plug, and when the earphone plug is connected to the mobile phone, the switch is turned on, and the power is turned on;

The protocol converter is respectively connected to the earphone plug and the micro control unit for converting data and filtering out the sound signal;

The memory is connected to the micro control unit for storing an encryption algorithm and key data; the micro control unit receives data of the mobile phone through a voice channel, and reads an encryption algorithm and key data from the memory. And performing encryption authentication processing on the data.

The mobile phone payment security control method and system provided by the embodiments of the present invention have the following beneficial effects:

The encryption algorithm and the key data are stored in the security token. When the mobile phone uses the mobile phone to pay, the mobile phone and the security token establish communication through the voice channel, and the mobile phone payment data needs to be authenticated and encrypted through the security token, thereby reducing the user identity. The risk of using the transaction information to be altered by the tomb and the account funds being stolen. Moreover, the voice interface is a universal interface of the mobile phone, and the security token is connected to the mobile phone through the voice channel, which is highly versatile.

DRAWINGS

3 1 is a schematic flowchart of a mobile phone payment security control method according to Embodiment 1 of the present invention; FIG. 2 is a schematic structural diagram of a mobile phone payment system according to Embodiment 2 of the present invention;

3 is a schematic structural diagram of a security token according to Embodiment 3 of the present invention;

4 is a schematic diagram of an interface of a mobile phone and a security token according to Embodiment 4 of the present invention; and FIG. 5 is a schematic diagram of a workflow of a mobile payment system according to Embodiment 5 of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Referring to FIG. 1 , it is a schematic flowchart of a mobile phone payment security control method according to Embodiment 1 of the present invention. The method includes the following steps:

Sl, login to the trading platform through the mobile phone, and the voice channel of the mobile phone accesses the security token; the transaction platform and the security token perform two-way authentication;

The transaction platform corresponds to an online banking server; when the mobile phone logs into the trading platform, a communication connection is established with the online banking server.

52. After the two-way authentication is passed, the mobile phone imports the user payment data, and transmits the user payment data to the security token through the voice channel;

53. The security token invokes the built-in encryption algorithm and key data, encrypts the user payment data, and returns the encrypted user payment data and the corresponding digital signature information to the mobile phone;

54. The mobile phone transmits the encrypted user data and the corresponding digital signature information to the transaction platform.

Specifically, in step S1, the transaction platform and the security token use the RSA security protocol for mutual authentication, including:

Sll, the mobile phone login trading platform, obtains the authentication information, and transmits the authentication information to the security token; the authentication information includes a random number, and the random number is encrypted by the public key and then encrypted by the public key

4 Obtained ciphertext;

512. The security token reads the random number from the authentication information, and calls the built-in HASH algorithm to calculate the random number, and obtains a digital summary of the random number;

513. The security token reads the ciphertext from the authentication information, and decrypts the ciphertext by using the built-in private key; compares the decrypted data with the digital digest, and if the two are the same, the transaction platform is determined to be legal; otherwise, the S16 is executed. ;

514. The security token performs HASH calculation on the random number and the authentication parameter, and then encrypts the data calculated by the HASH with the private key, and returns the encrypted data to the mobile phone, and the mobile phone transmits the data to the transaction platform;

S15. The transaction platform decrypts the data returned by the security token with the public key, compares the decrypted data with the corresponding HASH information, and if the same, determines that the security token is legal; otherwise, executing S16;

S16. Terminate the mobile payment service.

The user payment data includes account information, password information, and transaction information. In step S3, the security token encrypts the user payment data using a TLS, SSL or RSA encryption algorithm.

More specifically, the security token uses a 25mm headphone plug or a 35mm headphone plug that conforms to the YD/T 1538-2006 5.1.2.6 specification to access the voice interface of the handset.

A protocol converter, a micro control unit and a memory are arranged on the security token; the protocol converter is used for inputting analog-to-digital conversion of the data transmitted by the mobile phone, filtering out the sound signal, and transmitting the signal to the micro control unit for authentication or encryption processing; The converter is also used for digital-to-analog conversion of the authenticated or encrypted data to generate a voice signal, which is then transmitted to the mobile phone through the voice channel.

The mobile phone payment security control method provided by the embodiment of the invention can be applied to a mobile phone payment system, which can reduce the risk of fraudulent use of the user identity, transaction information being tombed and account funds stolen, and improve the security of mobile payment.

FIG. 2 is a schematic structural diagram of a mobile payment system according to Embodiment 2 of the present invention. The mobile payment security protection device provided in this embodiment includes: a mobile phone 10, a security token 20, and an online banking server 30. Among them, the mobile phone 10 is used to log in to the trading platform, and the online banking service

5 The server 30 establishes a communication connection; and the mobile phone 10 has a voice interface 11 for accessing the security token 20. The mobile phone 10 is further configured to send the authentication information and the user payment data to the security token 20;

The security token 20 stores an encryption algorithm and key data for authenticating the authentication information sent by the mobile phone 10, encrypting the user payment data sent by the mobile phone 10, and encrypting the processed user payment data and corresponding numbers. The signature information is returned to the mobile phone 10;

The mobile phone 10 transmits the encrypted user payment data and the corresponding digital signature information to the online banking server 30.

Specifically, as shown in FIG. 2, the security token 20 includes a headphone plug 21, a switch 22, a protocol converter 23, a micro control unit 24, a memory 25, and a power source 26;

The earphone plug 21 is connected with the voice interface 11 of the mobile phone 10 to establish a voice channel;

Preferably, the power source 26 uses a +5V button electronic battery;

The switch 22 is disposed at the earphone plug 21, and when the earphone plug 21 is connected to the mobile phone 10, the switch 22 is turned on, and the power is turned on;

The protocol converter 23 is respectively connected to the earphone plug 21 and the micro control unit 24 for converting data and filtering out the sound signal;

The memory 25 is connected to the micro control unit 24 for storing the encryption algorithm and the key data. The micro control unit 24 receives the data of the mobile phone through the voice channel, and reads the encryption algorithm and the key data from the memory 25 to encrypt and authenticate the data. deal with.

Preferably, the memory 25 of the security token is a flash memory, including a transaction data storage area, a program storage area, and a key storage area that can only be read and written. The transaction data storage area is used for storing transaction data of the mobile phone payment; the program storage area is used for storing the processing procedure of the bank authentication protocol (ie, the encryption algorithm); and the key storage area is for storing the key data.

FIG. 3 is a schematic structural diagram of a security token according to Embodiment 3 of the present invention.

More specifically, the earphone plug 21 of the security token 20 includes a data input terminal I and a data output terminal 0; the protocol converter 23 includes an analog to digital converter and a digital to analog converter. The data input terminal I is connected to the analog to digital converter, and the data output terminal 0 is connected to the digital to analog converter.

Preferably, the voice interface of the mobile phone is a 25mm headphone channel interface or a 35mm headphone channel interface conforming to the YD/T 1538-2006 5.1.2.6 specification.

FIG. 4 is a schematic diagram of an interface between a mobile phone and a security token according to Embodiment 4 of the present invention.

6 The voice interface 11 of the mobile phone includes a left channel 1, a right channel 2, a GND return line 3, a receiver MIC port 4, and a receiver MIC port 5. When the voice interface 11 of the mobile phone is connected to the earphone plug 21 of the security token, the left channel 1 and the right channel 2 are both connected to the data input terminal I of the security token; the MIC port 4 of the receiver and the MIC port 5 of the receiver are both secure. The data output 0 of the token is connected.

The working process of the security token provided by the present invention is as follows:

(1), power up

The security token supports hot plugging technology. When the security token is inserted into the voice interface of the mobile phone, the switch is turned on, the system starts to supply power, all devices start to work, the micro control unit MCU loads the program from the flash memory, and reads the key data. .

(2), receiving of authentication information data

After the channel of the mobile phone and the security token is established, the data that needs to be authenticated and encrypted is transmitted to the security token. After the security token receives the authentication information data transmitted from the headphone channel, the analog-to-digital converter converts and filters the data to shield the sound data.

In the specific implementation, the carrier frequency of the authentication information data is much higher than the sound frequency, so the filtering technique can be used to filter out the sound.

(3) Processing of authentication information data

The MCU of the security token encrypts the received data information, and authenticates the data according to the key in the FLASH memory. If the authentication passes, the encrypted digital signature information is returned, and the related transaction information is stored in the flash. In memory.

(4), data transmission

The MCU of the security token transmits the encrypted and processed data to the digital-to-analog converter, converts it into a voice signal, and sends it to the mobile phone through the voice channel, and then sends it to the mobile banking server for authentication.

(5), go to electricity

Remove the security token from the phone, the switch is disconnected, the power supply will stop supplying power, and the MCU will safely shut down the system.

In the embodiment of the present invention, the encryption algorithm and the key data are stored in the security token. When the user uses the mobile phone to pay, the user needs to authenticate and encrypt the mobile payment data through the security token, thereby reducing the user identity being fraudulently used and the account funds being stolen. The risk of improving the security of mobile payment. FIG. 5 is a schematic diagram showing the workflow of a mobile payment system according to Embodiment 5 of the present invention. The workflow of the mobile payment system is as follows:

5101. The mobile phone login trading platform establishes a communication connection with the online banking server;

5102. The mobile phone obtains a security certificate of the trading platform;

S103, determining whether the voice interface of the mobile phone accesses the security token; if yes, executing S104; otherwise, executing S108;

5104. The security token authenticates the security certificate according to the built-in encryption algorithm and key data; this step is a two-way authentication process of the security token and the transaction platform;

5105. Determine whether the two-way authentication is passed; if yes, execute S106; otherwise, execute S108; S106, start a secure transaction platform;

The secure trading platform requires a security token to authenticate and encrypt mobile payment related data to improve mobile payment security;

S107. The mobile phone imports user payment data, and transmits the user payment data to a security token;

S108, starting a general trading platform;

The general trading platform refers to the mobile payment transaction according to the traditional method, and does not require a security token to authenticate and encrypt the data;

S109. Determine whether the voice interface of the mobile phone is connected to the security token; if yes, execute S111; otherwise, execute S110;

S110, closing the secure trading platform, switching to the universal trading platform;

5111. The security token invokes the built-in encryption algorithm and key data, encrypts the user payment data, and returns the encrypted user payment data and the corresponding digital signature information to the mobile phone;

5112. The mobile phone submits the encrypted user data and the corresponding digital signature information to the online banking server;

5113. The online banking server feeds back the transaction result to the mobile phone.

The mobile phone payment security control method and system provided by the embodiments of the present invention store the encryption algorithm and the key data in the security token. When the mobile phone uses the mobile phone to pay, the mobile phone and the security token establish communication through the voice channel, and need to pass the security token pair. Mobile payment data is authenticated and encrypted, thereby reducing

8 The low user identity is fraudulently used, the transaction information is being altered by the tomb and the account funds are stolen. Moreover, the voice interface is a universal interface of the mobile phone, and the security token is connected to the mobile phone through the voice channel, which is highly versatile.

The above is a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. These improvements and retouchings are also considered. It is the scope of protection of the present invention.

9

Claims

A mobile phone payment security control method, characterized in that:

51. Log in to the transaction platform through the mobile phone, and the voice channel of the mobile phone accesses the security token; the transaction platform and the security token perform mutual authentication;

The mobile phone payment security control method according to claim 1, wherein in the step S1, the transaction platform and the security token are authenticated by using an RSA security protocol, including:

511. The mobile phone logs in to the transaction platform, obtains the authentication information, and transmits the authentication information to the security token. The authentication information includes a random number, and the ciphertext obtained by the HASH calculation and then encrypted by the public key;

512. The security token reads a random number from the authentication information, and invokes a built-in HASH algorithm to calculate the random number to obtain a digital digest of the random number.

513. The security token reads the ciphertext from the authentication information, and decrypts the ciphertext by calling the built-in private key; comparing the decrypted data with the digital digest, and if the two are the same, determining the transaction. The platform is legal; otherwise, execute S16;

514. The security token performs HASH calculation on the random number and the authentication parameter, and then encrypts the HASH calculated data by using a private key, and returns the encrypted data to the mobile phone, and the mobile phone transmits the data to the transaction platform;

515. The transaction platform decrypts the data returned by the security token by using a public key, and compares the decrypted data with the corresponding HASH information. If the same, the security token is legally determined;

10 Then execute S16;

S16. Terminate the mobile payment service.

3. The mobile payment security control method according to claim 2, wherein the user payment data comprises account information, password information, and transaction information.

The mobile phone payment security control method according to claim 3, wherein in the step S3, the security token encrypts the user payment data by using a TLS, SSL or RSA encryption algorithm.

The mobile phone payment security control method according to any one of claims 1 to 4, wherein the security token is a 25mm earphone plug or a 35mm earphone plug conforming to the YD/T 1538-2006 5.1.2.6 specification. Access the voice interface of the mobile phone.

6. The mobile payment security control method according to claim 5, wherein a protocol converter, a micro control unit, and a memory are disposed on the security token;

7. A mobile payment system, comprising: a mobile phone, a security token, and an online banking server;

11

8. The mobile payment system according to claim 7, wherein the security token comprises a headphone plug, a switch, a protocol converter, a micro control unit, a memory, and a power source;

The earphone plug is connected to a voice interface of the mobile phone;

9. The mobile payment system according to claim 8, wherein the voice interface of the mobile phone is a 25 mm earphone channel interface or a 35 mm earphone channel interface conforming to the YD/T 1538-2006 5.1.2.6 specification.

10. The mobile payment system according to claim 8, wherein the memory of the security token is a flash memory, and includes a transaction data storage area, a program storage area, and a key storage area that can only be read and written.

12