WO2015085809A1

WO2015085809A1 - Mobile payment security system with wireless data private network physically isolated from internet

Info

Publication number: WO2015085809A1
Application number: PCT/CN2014/087307
Authority: WO
Inventors: 朱雄关; 刘晓岩
Original assignee: 成都达信通通讯设备有限公司
Priority date: 2013-12-09
Filing date: 2014-09-24
Publication date: 2015-06-18
Also published as: CN103619020B; CN103619020A

Abstract

The present invention provides a mobile payment security system with a wireless data private network physically isolated from Internet, aiming to provide a mobile payment security system that is strong in interaction, can prevent intrusion from the Internet, makes payment information be not prone to be stolen by a Trojan horse, transmits intranet data securely and reliably, does not affect Internet access and can prevent an SIM card from being duplicated. The present invention is implemented through a following technical scheme: an application system comprising a payment server and authentication devices being constructed in a mobile payment secure data network that is isolated from the Internet, the mobile payment secure data network linking to an APN network or a VPDN network that is isolated from the Internet and connected to a GSN mobile gateway, and the payment server setting up four-in-one multi-authentication with an account, a mobile number, an IMSI number, and a password bound through a password authentication device and a mobile number authentication device; when the mobile payment secure data network is networked, automatically shutting off an Internet access channel and, when the Internet is physically isolated successfully, performing graphic verification code information interaction with the mobile payment server through a base station.

Description

Wireless data private network physical isolation internet mobile payment security system

This application claims the priority of the Chinese Patent Application filed on Dec. 9, 2013, the Chinese Patent Office, the application number 201310660556.9, and the invention titled "Mobile Payment Security System for Wireless Data Private Network Physical Isolation Internet", the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The invention relates to a wireless data private network for physical isolation of the Internet to construct a mobile payment security application system, which ensures information and transaction security, and a system for switching the network access channel and the secure payment application switching network channel on the mobile terminal.

Background technique

Mobile payment combines the mobile network with the financial system, and uses the mobile communication network as a tool and means to realize mobile payment, providing customers with financial services such as commodity trading, payment, and bank account management. The mobile payment system establishes a payment account bound to the mobile phone number for each mobile phone customer, and the customer can transfer and pay the cash through the mobile phone. The mobile terminal used for the mobile payment may be a mobile phone, a PDA (Personal Digital Assistant), a mobile PC (Personal Computer), or the like, and includes a mobile phone short message, an interactive voice response, and a WAP (Wireless Application Protocol, Wireless application communication protocol) and other methods. In the mobile payment industry, the whole system consists of consumers, commercial organizations, payment platform operators, banks, mobile operators and other links. The main principle is to build a mobile data value-added service on the mobile operation support platform, and to move customers. The mobile phone number is treated as an associated payment account, enabling mobile customers to perform identity verification and transaction activities via their mobile phones. There are five main types of mobile payment access: the first is SMS STK (SIMTOOL KIT, User Identification Application Development Tool); the second is Voice Mode IVR (Interactive Voice Response); the third is Utilizing USSD (Unstructured Supplementary Service Data); the fourth is implemented using the WAP protocol; the fifth is implemented using the WEB method. At present, the main methods are voice, STK and WEB. According to the different transmission methods, mobile payment is mainly divided into near-field payment and remote payment. The so-called near-field payment is to use the mobile phone to swipe the card to buy a car, to buy things, etc., which is very convenient. Remote payment means: by sending payment instructions (such as online banking, telephone banking, mobile payment, etc.) or by payment The payment methods of tools (such as mailing, remittance), such as the palm-and-cash e-commerce launched by the palm of the hand, the palm recharge, and the video in the palm of the hand are remote payment. The current payment standards are not uniform, causing a lot of confusion for the related promotion work. Near-field payment is the use of radio frequency, infrared or Bluetooth technology to realize the communication and information exchange between mobile phones and other intelligent terminals, and then complete the transaction payment. The specific implementation techniques are as follows:

(1) Infrared Radiation and Bluetooth: The former has low cost and is not easily interfered; the latter has a long transmission distance and the signal has no directivity.

(2) Radio Frequency Identification (RFID) technology has high security, high speed and large storage capacity, but its infrastructure investment is high, cost is high, and terminal requirements are high.

Remote payment is to use the wireless network to send a transaction request to a merchant that provides a certain commodity (or service) through a mobile phone, and complete the transaction payment. The specific implementation techniques are as follows:

(1) Interactive Voice Response Technology (IVR): The payment process is realized by making a call with a mobile phone. Its stability and real-time performance are good, but due to the complicated operation, it takes a long time, the communication cost is high, and the security performance is not good, which is only suitable for small payment.

(2) Short Message Service (SMS): The payment is completed by sending a short message. This type of user base is broad in base, low in cost, easy to operate, and can be implemented in ordinary mobile phones, but the security is poor, and the response time of sending and receiving of text messages cannot be determined.

(3) Unstructured Supplementary Data Service Technology (USSD): The communication network provides users with corresponding services after the user sends a predetermined number or symbol to the network using the mobile phone. The technology is simple in operation, low in transaction cost, and has high security, but has high requirements on terminals and requires specific terminal support.

(4) Wireless Application Protocol (WAP): Use the mobile phone to connect to the Internet to complete the payment. The method is highly interactive, but due to network instability, the response speed of the command cannot be determined, the usage cost is high, and terminal support is required.

(5) K.Java/Brew (J2ME/Wireless Binary Runtime Environment): Connect to the Internet by downloading K.Java/Brew. It is highly portable, consumes low network resources, has low server load, and the interface is easily accepted by users, but requires terminal device support. Regardless of the technology used for mobile payments, its security is a key factor affecting the development of payment services. The security of mobile payment involves the confidentiality of user information, the security of user funds and payment information, and the security risks it faces mainly come from wireless links, service networks and terminals. In order to solve the security problem faced by mobile payment, in terms of management, the quota control and signing mechanism are generally adopted; technically, access control technology is generally used to make payment The transaction information is not obtained and falsified by illegal users. The identity authentication technology is used to realize the identity authentication of the parties to the transaction, and the digital signature technology is used to realize the confidentiality of the information. In order to ensure the security of data transmission in the network during the transaction process, the mobile payment system must establish a complete network security mechanism, including the firewall system and virus prevention system. The system adopts a dual-network networking structure to prevent single-point equipment failures and links. Faults, ensure the smooth flow of the entire network; system hardware double backup, redundancy and load sharing mechanism, and data transmission security mechanism; network segment isolation for each bank, mobile communication network element and other entities connected to the system to ensure different The network is interconnected with the mobile payment system. At present, the prior art transaction security mechanism is to authenticate the user identity through the mobile payment service account opening process, and establish a binding relationship between the user identity and the mobile phone number; the mobile operator ensures the authentication of the user mobile phone and the legality of the subscription relationship. Right, for incomplete transactions, the commercial organization or payment platform operator is required to issue a rush request to cancel the incomplete transaction operation. To prevent unauthorized users from invading the host, the mobile payment center is deployed behind the firewall of the mobile operator network based on IP (Internet Protocol); the control mechanism is set, the payment limit is set, and the account is implemented. Security management; implement security module for encryption algorithm, key length, key security exchange, key update time, signature algorithm, etc.; realize security audit trail of transaction records, so that when a dispute occurs, it can provide complete, Accurate and credible transaction records are checked.

WEB and WAP page security: Check whether the system adopts login anti-exhaustion measures, whether to provide security controls, digital certificates and independent payment passwords, whether the page adopts SQL (Structured Query Language) injection, cross-site scripting attack, Source code exposure and hacking prevention, as well as tamper-proof and anti-phishing measures;

Coding security: whether the system source code and plug-ins are checked for security, check the review report, whether there is a coding specification constraint system, whether the source code and version are effectively managed, and the management system is checked;

Electronic authentication application: Whether to use third-party electronic certification authority certificates for internal and external business and key business, whether to use valid electronic signatures, and whether to effectively protect the server certificate private key;

Offline data authentication: Check whether keys and certificates that meet business requirements, static data authentication, and dynamic data authentication are used.

Application of ciphertext and card issuer certification: check application ciphertext generation, card issuer authentication and key management;

Security packet: Checks whether the packet format meets the requirements, verifies the integrity of the packet, the privacy of the packet, and how to manage the key.

Card security: check the security of the card, whether the key is independent, the internal security system of the card, the type of key in the card, the storage of the key and the personal identification number, etc.

Terminal security: Review the security requirements of the terminal data and equipment, as well as the key management requirements, and check whether the application terminal is strictly implemented as required;

Key management system: detects how to manage the certificate authority public key, the card issuer public key, and the card issuer symmetric key;

Approved algorithms: Which symmetric encryption algorithm, asymmetric encryption algorithm or hash algorithm is used in the system, and what functions these algorithms apply to the system, and detect corresponding system functions;

Client program security: How to protect client applications and configuration files, check whether their version is up to date, and ensure the security of login password and payment password. With the rapid development of the mobile Internet, the mobile internet financial business presents a huge market demand, but various illegal means such as hacking and phishing websites infringe on the security of Internet finance all the time, various pre-installed software, virus packaging and other threats to mobile phone network security. The problem has become increasingly prominent and has gradually formed a black industrial chain. The security of Internet application systems has increasingly become the focus of attention. After the prism door, it was discovered that in the face of the US government with strong technical strength, any Internet company, including Apple and Google, which currently has the most advanced technology of Internet technology, has all kinds of security measures as long as it establishes an information system on the Internet. There is no way to avoid security vulnerabilities in which information is stolen. Security issues have always occupied an extremely important position in the mobile payment business. On the one hand, the bank needs to encrypt the user's transaction password, such as hardware encryption and corresponding log management for some important data. On the other hand, communication operators need to strengthen security issues in signal transmission to prevent signals from being intercepted. Mobile payment is a typical multi-application. It needs to manage multiple applications with multiple channels, determine various states of applications, application life cycle, etc., and focus on ensuring the coexistence of concurrent applications, concurrent and application security, and mutual application security. Wait. As the proportion of virtualized transactions rises, security risks have become a common concern. Mobile payment tool operating system and non-standard application download, phishing websites, Trojans frequently appear, seriously affecting the terminal security environment of mobile payment. In addition, if the mobile phone used for near-field payment is lost, the possibility of being stolen is extremely high. The security issue of mobile payment has always been a bottleneck for the rapid promotion of mobile payment. Confidentiality, integrity, non-repudiation, authenticity, payment model, authentication, payment terminal (mobile phone) security, mobile payment The legal protection of the link is not perfect (contract signing, delivery, payment, breach of contract, after-sales responsibility, return, tax payment, invoicing, payment audit).

In the traditional technology field, physical isolation is the most important and effective measure to ensure internal network security. Both the banking information system and the government information system use internal networks that are physically isolated from the Internet to ensure information security. The use of an internal network physically isolated from the Internet has prevented all hackers from intruding by eliminating the Internet's networking channels. For ordinary users, APN (Access Point Name) is a set of parameters that are pre-configured or manually set on the mobile terminal for Internet access. For mobile networks, APN is an indispensable identifier for routing user Internet Protocol IP packets to the corresponding GPRS (General Packet Radio Service) network router GGSN and external network. Including: APN as a route identifier: The GPRS service support node SGSN queries the Domain Name System (DNS) server to query the GGSN IP address corresponding to the APN according to the APN to determine the GGSN that the user should access; the APN is used as the service domain identifier: The GGSN sends the service flow of the user to different service domains according to different APNs, and the different service domains correspond to different service bearer networking modes, user identity acquisition modes, and charging modes. As an important component of the GPRS/TD-SCDMA (WCDMA) core network packet domain equipment, the service support node SGSN mainly completes the routing and forwarding, mobility management, session management, logical link management, authentication and encryption, and CDR of packet data packets. Functions such as generation and output. The SGSN is a GPRS service support node, which provides a connection with the wireless packet controller PCU through the Gb interface, and performs mobile data management, such as user identification, encryption, compression, etc.; through the Gr interface and the HLR (Home Location Register, home location) The register is connected to perform user database access and access control; it is also connected to the GGSN through the Gn interface to provide functions such as transmission path and protocol conversion between the IP data packet and the wireless unit; the SGSN can also provide the MSC (Mobile Switching) Center, mobile switching center) Gs interface connection and Gd interface connection with SMSC (Short Message Service Center) to support the cooperation of data services and circuit services and text messaging. The SGSN cooperates with the GGSN to jointly assume the PS function of TD-SCDMA (WCDMA). When it is a basic network element of the GPRS network, it is connected to the base station subsystem BSS through the Gb interface. Its main role is to perform mobility management for the mobile station MS of the SGSN service area, and forward the input/output IP packets, which is similar to the VMSC in the GSM circuit network. In addition, the SGSN also integrates a VLR similar to the GSM network. (Visitor Location Register, visit location register), when the user is in the GPRS Attach state, the SGSN stores user information and location information related to the group. When the SGSN is the PS domain function node of the TD-SCDMA (WCDMA) core network, it is connected to the UTRAN through the Iu_PS interface, and mainly provides the functions of routing forwarding, mobility management, session management, authentication and encryption of the PS domain. GGSN9811 mainly mentions two APNs, CMWAP and CMNET, which are the earliest provided by China Mobile and are currently the most widely used by users:

1) CMWAP APN

CMWAP and CMNET are two GPRS access channels divided by China Mobile. The former is set up for mobile WAP access, while the latter is mainly used for PC, laptop, PDA and other GPRS Internet services. At the beginning of the design, CMWAP APN is mainly for HTTP-based (Hypertext Transfer Protocol)-based services, such as WAP Internet browsing, MMS, and so on. With the continuous development of data services, in order to support the gradually introduced non-hypertext transfer protocol HTTP services, the WAP domain of the wireless application protocol has gradually evolved into a default service for most self-operated services and cooperative services through upgrading and configuration. Domain, providing users with MMS, PIM, streaming media, universal download, newsletter, music player, games and other services. The CMWAP APN uses the WAP gateway as a proxy node for HTTP access, and provides some auxiliary functions for users, such as free mobile phone number, content conversion, and adaptive pre-judgment.

2) CMNET APN

CMNET is an APN set up for open Internet access services. Users can access the Internet using any protocol without any control and restriction policies, but also do not provide other accessibility features. When the CMNET APN is used, the mobile terminal accesses the GGSN through the access SGSN, and the service data stream is translated into the Internet by NAT (Network Address Translation) address translation through the firewall corresponding to the GGSN.

VPDN is an abbreviation of Virtual Private Dialup Network. It is based on the virtual private dial-up network service of dial-up users. It can establish a secure virtual private network by using the bearer functions of IP and other networks, combined with the corresponding authentication and authorization mechanisms. . The VPDN business is primarily for business and government administration. After the enterprise applies for the service, it only needs to access its intranet through a dedicated line to the Internet. Users can dial VPDN service anywhere in the country to enter the virtual private network and securely access the information resources they need. . Users can easily and flexibly The line performs operations such as opening an account, canceling an account, and setting user rights to the dial-up user.

Currently, the VPDN network built by the operator is divided into two types: the fixed network VPDN and the wireless VPDN. The physical locations of the two VPDN networks are different. The fixed network VPDN network is located on the Internet and can be accessed by all terminals; the wireless VPDN network is located in the operator's wireless data network, which is isolated from the Internet and cannot be accessed through the WIFI network; when the mobile terminal is connected to the wireless VPDN network, the first connection is required. The APN network carried by the wireless VPDN cannot be accessed by users of other APN networks or networked channels.

The wireless VPDN network is a virtual private network built on the APN network. The connection process of the wireless VPDN network is to first connect the APN channel carrying the VPDN network, then perform VPDN dialing to establish a VPDN network. The networking parameters of the VPDN network include the networking parameters of the carried APN network and the networking parameters of the VPDN.

After the VPDN is connected, the mobile terminal can only connect to the VPDN network, which is a limitation of the system implementation of routing management in the network management. The master can implement the APN and VPDN networking at the same time by modifying the routing table of the mobile terminal operating system. At the same time, the networked APN must be the APN network carried by the VPDN.

Since the VPDN network is not physically isolated, it is isolated on software and its security is lower than that of the APN network. The security of the VPDN network depends on the security of the APN network that is carried. If the APN network that is carried is physically isolated from the Internet, the VPDN network is secure.

Although dedicated channels can guarantee the security of information and systems, today's Internet applications are becoming more and more popular. People need to take into account the two application modes of Internet applications and security applications on mobile terminals. Especially in the field of mobile payment, on the one hand, people need to browse goods in the online shopping mall, on the one hand, they need to completely guarantee the security of transactions.

However, the current mobile terminal operating system, whether the browser or the API interface of the application, only provides a single-channel Internet access mode. At the same time, the intelligent system of the mobile terminal lacks an interface for automatically switching different channels to each other for different business applications. bring inconvenience. How to rely on the public network to realize secure communication and data exchange between mobile terminals and bank intranets has become an urgent problem for major enterprises. Remote access usually involves three parts: access terminal, access channel and intranet application. The lack of protection for any of these three parts will bring security risks to the entire remote access process. The traditional virtual private network-based mobile terminal access scheme focuses on the establishment of a secure transmission channel, although to some extent logarithm According to the security transmission, the guarantee is provided, but the need for mobile payment to browse the goods on the Internet cannot be solved, and the requirement for the mobile user to access the Internet and secure the transaction cannot be satisfied.

The traditional bank payment model includes bank card and UKEY payment system, which are all three-in-one binding of account, password, bank card or UKEY, which can ensure the uniqueness of payment. The current Internet payment system basically uses the short message dynamic code as the confirmation information, and the short message dynamic code has a certain timeliness, so that the phishing website can make payment through another terminal after stealing the user's dynamic code. This creates a security risk for the account.

Therefore, ensuring the uniqueness of payment is a requirement for payment security.

In addition, the current online exposure of many mobile phone SIM (Subscriber Identity Module) card technology, the single binding mobile phone number payment service has a large security risks.

With the increasing embarrassment of current smartphone viruses, it is very easy for mobile phone Trojans to steal simple passwords composed of numbers. Mobile payments must prevent Trojans from stealing digital passwords.

In summary, the security of mobile payments involves two major parts:

1. Network and system security;

2. The security of the mobile terminal.

Summary of the invention

The purpose of the present invention is to provide a security application guarantee for the majority of mobile payment networks and systems and mobile terminals in the prior art, and to provide a strong interaction and evade Internet intrusion on the network and the system. The payment information is not easily stolen by the Trojan horse. The intranet application system data transmission is safe and reliable, and does not affect the Internet access, and can prevent the SIM card from being copied, the account, the mobile phone number, and the IMSI (International Mobile Subscriber Identification Number) number. The wireless data private network bound by the four-in-one password is a mobile payment security system that physically isolates the Internet.

The above object of the present invention can be achieved by the following measures: a wireless data private network physically isolated Internet mobile payment security system, including a payment server, a mobile phone number authentication device, a password authentication device, and a GSN mobile network gateway device. APN network or VPDN network, characterized in that the application system including the payment server and the authentication device is built in a mobile payment security data network isolated from the Internet, and the mobile payment security data network link and the Internet The isolated APN network or VPDN network connected to the GSN mobile gateway, the payment server establishes the account, the mobile phone number, the IMSI number, and the password in a four-in-one binding multiple authentication through the password authentication device and the mobile phone number authentication device; the mobile terminal is connected to the network. When the mobile payment security data network is used, the Internet access channel is automatically turned off, and after the physical isolation of the Internet is successful, the graphic verification code information is exchanged between the base station and the mobile payment server.

Optionally, in the mobile payment security system in which the wireless data private network physically isolates the Internet, the system model of the mobile phone number binding function is used, the mobile phone turns off the Internet access channel, and the networked mobile payment security network establishes communication with the mobile phone number authentication device. In the process of establishing a communication tunnel, when the mobile phone sends a time domain request, the GGSN or SGSN first links the mobile network gateway GSN through the access point name APN leased line and/or the virtual private dial-up network VPDN dedicated line to store the user in the SIM card. The international mobile subscriber identity IMSI is sent to the mobile phone number authentication device as a digital call calling-number paging request parameter, and the IMSI authentication and the account address binding are implemented by the mobile phone number authentication device, and then the password authentication device and the payment server are used. Communication.

Optionally, the mode of password authentication includes a numeric password, or a biometric password.

Optionally, in a mobile payment security system in which the wireless data private network physically isolates the Internet, a mobile secure payment system model using a graphic verification code authentication, the mobile secure payment system model includes a mobile terminal, a dedicated data channel, an authentication device, and a payment server. .

Optionally, each time the mobile terminal sends a transaction request, the payment server sends a random and secure graphic verification code as a transaction label, and submits the request in the mobile terminal payment request, and uses the graphic verification code of the successive transaction to secure the verification code. Cannot be copied.

Optionally, in the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses a dedicated browser to perform a system model for automatic switching of the network channel, and the dedicated browser networking channel automatic switching system model includes an embedded channel switching program. Dedicated browser and/or embedded channel switcher client and application and mobile terminal networking subsystem.

Optionally, a dedicated browser or client and application embedded with the channel switching program monitors the pages, services, and functions used by the user, and when the mobile payment service needs to be used, the browser or the client and the application call the embedded The channel switching procedure sends a channel switching command and connects to the network via the mobile terminal networking subsystem, networked Internet or mobile secure payment data network.

Optional, the embedded channel switcher receives a dedicated browser or client and application life After the order is closed, the current networked network is closed, and the networking parameters of the mobile terminal are modified to be the APN or VPDN networking parameters specified or preset by the browser or the client and the application, and the request for the networked mobile payment security data network is initiated to the mobile terminal networking subsystem. After the networking is successful, the success message is fed back to the browser or the client and the application, the networking fails, and the failure message is fed back to the browser or the client and the application.

Optionally, after the dedicated browser or the client and the application receive the networking success message, the mobile payment security data network channel is used to exchange information with the mobile payment security system; after the browser or the client and the application end the mobile payment service, , the embedded channel switching program is called to switch the mobile terminal networking channel back to the Internet access channel.

Optionally, in the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses a channel switching module embedded in the mobile terminal to perform a system model for automatically switching the network channel, and the network channel automatic switching system model includes an application layer and a mobile a terminal operating system, and the mobile terminal operating system includes a channel switching module and a mobile terminal networking subsystem; the application layer includes a browser, a browser plug-in, a client or an application; and the application layer links the channel switching module through an application programming interface API, The channel switching module is connected to the mobile terminal operating system.

Optionally, in the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses an independent channel switching software to perform a system model for automatically switching the networked channel, and the independent channel switching software networking channel automatically switches the system model, including the application layer. The channel switching program software and the mobile terminal operating system, wherein the application layer comprises a browser, a browser plug-in or a client and an application, the mobile terminal operating system comprises a mobile terminal networking subsystem, and the application layer links the channel through an application programming interface API The switching software, the channel switching software links the mobile terminal networking subsystem to interact with the mobile terminal operating system data.

Optionally, when the channel switching software is started, it resides in the memory, provides an application programming interface API to the application layer, and performs a channel switching operation according to the application layer instruction; the application layer invokes the activated channel through the application programming interface API. The switching software performs switching of different networking channels; after the channel switching software exits the memory, the application layer programming interface API in the memory disappears.

The present invention has the following beneficial effects compared to the prior art:

According to the present invention, on the mobile terminal, the application layer meets different requirements and needs to switch the networked channel to meet the security switching requirements of different services of the network service and the secure payment; In the above, a wireless data private network physically separated from the Internet is used to provide a mobile secure payment system constructed by mobile phone number authentication and password authentication, and provides a mobile terminal to automatically switch between the Internet access channel and the dedicated payment secure channel. Methods. Completely eliminate the intrusion from the Internet and secure mobile payment through dual security certification.

The mobile terminal includes a mobile terminal application layer of a browser, a client or an application software to monitor a webpage, a service and a function used by the user, and a browser plug-in or a client and an application embedded by the embedded channel when the payment service is required. The channel switching module performs the switching of the networked channel to ensure that the mobile terminal is uniquely connected to the dedicated mobile secure payment data network during the payment operation, thereby ensuring the security of the mobile payment system.

The present invention uses a dedicated mobile data network physically isolated from the Internet, including APN or VPDN data channels to secure information and data security of the application system. The three-level deep protection of the secure access of the mobile terminal is realized from the three aspects of the secure transmission channel of the access terminal and the protection of the intranet application system, thereby improving the security of the terminal, ensuring the security of access from the source, and providing high-strength data security transmission. The channel ensures the security of the data transmission process; the security access control technology ensures the security of the intranet application system.

The invention constructs an application system including an application server and an authentication device in a mobile payment security data network isolated from the Internet, and double authentication of mobile phone number authentication and password authentication ensures a mobile phone number, an IMSI number, a bank account and a password. Four-in-one binding relationship; mobile payment security data is connected to the gateway GPRS support node GGSN of the mobile network using the APN or VPDN line isolated from the Internet to ensure physical isolation from the Internet and information interaction with the mobile terminal; The graphical verification code ensures that the transaction information is not stolen by the Trojan; the mobile payment uses a graphical verification code to ensure that the payment information is not stolen by the Trojan.

The mobile secure payment system uses the mobile phone number and password for dual authentication to ensure the separation of the mobile phone number and password, avoiding the risk of the mobile phone SIM card being copied, and ensuring the binding relationship between the account, the mobile phone number, the IMSI, the password and the unique payment. relationship;

The browser, client or application on the mobile terminal can switch the networking channel according to different applications. This connection mode can avoid the direct connection between the private data network and the Internet, thus completely avoiding the intrusion from the Internet and ensuring that the Internet access of the mobile terminal is not Affected, it can meet the technical needs of the mobile terminal to switch when using different applications for browsing shopping and payment.

DRAWINGS

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

1 is a schematic diagram of a mobile payment security system model for physically isolating the Internet of the wireless data private network of the present invention;

2 is a schematic diagram of a system model for automatically switching a different channel networking interface by a mobile terminal of the present invention using a dedicated browser;

3 is a schematic diagram of a system model of a mobile terminal of the present invention automatically switching different channel networking interfaces using a universal browser;

4 is a schematic diagram of a system model for a mobile terminal to automatically switch between different channel networking interfaces by using an embedded channel switching program module;

FIG. 5 is a schematic diagram of a system model in which a mobile terminal automatically switches between different channel networking interfaces using an independent channel switching procedure.

detailed description

Example 1:

See Figure 1. In a preferred embodiment described below, the wireless data private network physically isolates the mobile payment security system of the Internet, including the payment server, the mobile phone number authentication device, the password authentication device, and the mobile payment security data network, respectively, including the Internet. An APN or VPDN network connected to the GSN gateway. The application system including the payment server and the authentication device is built in a mobile payment security data network isolated from the Internet, and the payment server establishes an account, a mobile phone number, an IMSI number, and a password through a password authentication device and a mobile phone number authentication device. The multi-authentication mode of the bit-in-one binding, the mobile network gateway GSN is connected via the mobile payment security data network access point name APN private line and/or the virtual private dial-up network VPDN private line; the mobile terminal automatically turns off the Internet access when using the mobile payment service Channel, networked mobile payment security network, physical isolation After the networking is successful, the graphic verification code information is exchanged between the base station and the mobile payment server; the mobile payment operation is always switched in the process of the wireless data private network secure payment data network that is uniquely connected to the mobile terminal. The GGSN (Gateway GSN) functions mainly as a gateway. It can be connected to a variety of different data networks, such as ISDN (Integrated Services Digital Network) and PSPDN (Packet Switched Public Data Network). Exchange public data network) and LAN (Local Area Network). In some literatures, the GGSN is called a GPRS router. The GGSN can perform protocol conversion on GPRS packet data packets in the GSM network, so that these packet data packets can be transmitted to a remote TCP/IP or X.25 network. SGSN is the abbreviation of English Serving GPRS SUPPORT NODE. As an important component of GPRS/TD-SCDMA (WCDMA) core network packet domain equipment, SGSN mainly completes packet forwarding, mobility management, session management, logical link management, authentication and encryption, bill generation and output. And other functions. The SGSN is a GPRS service support node, which provides a connection with a wireless packet controller PCU (Package Control Unit) through the Gb interface, and performs mobile data management, such as user identification, encryption, compression, etc.; and is connected to the HLR through a Gr interface. Accessing and access control of the user database; it is also connected to the GGSN through the Gn interface, providing functions such as transmission path and protocol conversion between the IP data packet and the wireless unit; the SGSN can also provide a Gs interface connection with the MSC and the SMSC The Gd interface is connected to support the cooperation of data services and circuit services and the function of sending and receiving text messages. The GGSN and the SGSN (collectively, the GSN) use the UDP port 2123 to listen for GTP-C packets, and the UDP port 2152 listens for GTP-U packets. The connection mode described in the above embodiment can avoid the direct connection of the private data network to the Internet, thereby completely avoiding the intrusion from the Internet.

Embodiment 2: Mobile phone number binding account function

In FIG. 1, in the mobile payment security system in which the wireless data private network physically isolates the Internet, the system model of the mobile phone number binding function is used, and the mobile phone number binding function system model includes the GSN device and the mobile phone number authentication device in sequence. The mobile phone turns off the Internet access channel, and the networked mobile payment security network establishes a communication tunnel with the mobile phone number authentication device. During the process of establishing the communication tunnel, when the mobile phone sends the time domain request, the mobile phone sends the time domain session (the session refers to an end user). The time interval for communicating with the interactive system, usually refers to the time elapsed between registration and entry into the system; and the GGSN or SGSN first passes the access point name APN line and/or The virtual private dial-up network VPDN private line links the mobile network gateway GSN, and automatically stores the international mobile subscriber identity IMSI stored in the SIM card as a digital call calling-number paging request parameter to the mobile phone number authentication device, and authenticates by mobile phone number. The device implements IMSI authentication and user account address binding, and then communicates with the payment server via the password authentication device. When the mobile phone number authentication device server receives the payment request sent by the mobile terminal client, the user name is taken out, and the IMSI number sent by the digital call calling-numbei sent by the GSN and the IMSI number stored in the mobile phone number authentication device are The binding relationship of the account address is compared, and the matching is performed by the authentication, thereby realizing the binding function of the mobile phone number and the user account address.

The IMSI number used for mobile phone number authentication is derived from the underlying access information of the mobile phone chip, and is the SIM card authentication information of the mobile phone on the GGSN or the SGSN, and has nothing to do with the application layer communication of the mobile terminal.

IMSI is the only mobile subscriber identity code on the whole network and in the world. It is the only one that uniquely identifies a mobile subscriber. SIM card authentication belongs to the underlying hardware communication category of mobile terminals, all built into the chip hardware and cannot be modified by software. Using such an authentication mode can effectively block false registrations by Trojans, viruses, or hackers.

Embodiment 3: Password Authentication Mode

See Figure 1. In the above embodiment 1, the mode of password authentication includes a digital password, or a biometric password such as a fingerprint, a face or a pupil, and the like. Password authentication can be a single form such as a number, or a superposition of multiple forms. Such as the form of digital plus fingerprint.

Embodiment 4: Graphic verification code

Figure 1. In the mobile payment security system in which the wireless data private network physically isolates the Internet, a mobile secure payment system model using a graphic verification code authentication, the mobile secure payment system model includes a mobile terminal, a dedicated data channel, an authentication device, and a payment server. Each time the mobile terminal sends a transaction request, the payment server sends a random secure graphic verification code as a transaction label and submits it in the mobile terminal payment request. The verification code can be used to ensure that the verification code cannot be copied. Using a random and secure graphical verification code can effectively avoid the invasion of the system by Trojans or viruses.

The mobile terminal performs a switching mode of the networking channel for two different applications of Internet access and mobile payment, including the following four system modes:

Embodiment 5: Dedicated browser switching mode

See Figure 2. In the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses a dedicated browser to perform a system model for automatic switching of the networked channel, and the dedicated browser networking channel automatic switching system model includes a dedicated browser with an embedded channel switching program and / or embedded channel switch program client and application and mobile terminal networking subsystem. A dedicated browser or client with embedded channel switching program and application through the mobile terminal networking subsystem networking channel, networked Internet or mobile secure payment data network.

A dedicated browser or client and application embedded with the channel switching program monitors the pages, services, and functions used by the user. When a mobile payment service is required, the browser or the client and the application call the embedded channel switching program. Send channel switching commands and connect to the network through the mobile terminal networking subsystem, networked Internet or mobile secure payment data network.

After receiving the command of the dedicated browser or the client and the application, the embedded channel switching program closes the current networked network, and modifies the networking parameters of the mobile terminal to be the browser or the client and the APN or VPDN specified or preset by the application. The parameter initiates a request for the networked mobile payment security data network to the mobile terminal networking subsystem. After the networking is successful, the success message is fed back to the browser or the client and the application, the networking fails, and the failure message is fed back to the browser or the client and the application. .

After the dedicated browser or the client and the application receive the networking success message, the mobile payment security data network channel is used to exchange information with the mobile payment security system; after the dedicated browser or the client and the application end the mobile payment service, the call is made within the call. The embedded channel switching program switches the mobile terminal networking channel back to the Internet access channel.

The mobile terminal networking subsystem refers to a software and hardware system including functions such as storage and modification of network parameters of the mobile terminal, network management, and networking operations.

Embodiment 6: Generic Browser Plugin Mode

See Figure 3. In the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses a universal browser plug-in to perform a system model for automatic switching of the network channel; the universal browser plug-in network channel automatically switches the system model, including the embedded channel switching program. Plug-in universal dedicated browser and mobile terminal networking subsystem. A universal dedicated browser for plug-ins that embed channel switching programs, via a mobile terminal networking subsystem, a networked Internet or mobile secure payment data network.

The universal browser monitors the pages, services, and functions used by the user. When encountering the need to use the mobile payment service, the browser invokes the embedded channel switching plug-in, sends a channel switching command, and the embedded channel switching plug-in receives the common browser command. After that, the current networked network is closed, and the networking parameters of the mobile terminal are modified to the APN or VPDN networking parameters specified or preset by the browser, and the request for the networked mobile payment security data network is initiated to the mobile terminal networking subsystem. After the networking is successful, the browsing is performed. The device feeds back the success message, the network fails, and the failure message is fed back to the browser.

After receiving the networking success message, the universal browser uses the mobile payment secure data network channel to exchange information with the mobile payment security system; after the universal browser completes the mobile payment service, the embedded channel switching plug-in is invoked to switch the mobile terminal networking channel. Go back to the internet access channel.

Embodiment 7: Inline channel switching module mode

See Figure 4. In the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses the channel switching module embedded in the mobile terminal to perform a system model for automatically switching the network channel, and the network channel automatic switching system model includes an application layer and a mobile terminal operating system. And the mobile terminal operating system includes a channel switching module and a mobile terminal networking subsystem; the application layer includes a browser, a browser plug-in, a client or an application; and the application layer links the channel switching module through an application programming interface API (Application Programming Interface) The channel switching module is connected to the mobile terminal networking subsystem.

The channel switching module is a module built in the mobile terminal operating system and linked with the mobile terminal networking subsystem to perform the channel switching operation function.

The application layer monitors the pages, services, and functions used by the user. When a mobile payment service is required, the channel switching plug-in is invoked to send a channel switching command. After receiving the message that the channel switching succeeds, the application layer uses the mobile payment security data network for information interaction. After the application layer completes the mobile payment security service, the channel switching module is invoked to switch the networked channel back to the Internet access channel.

Embodiment 8: Independent channel switching software mode

See Figure 5. In the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses an independent channel switching software to perform a system model for automatic switching of the network channel, and the independent channel switching software networking channel automatically switches the system model, including the application layer and the channel switching program. Software and mobile terminal operating system, wherein the application layer comprises a browser, a browser plug-in or a client and an application, the mobile terminal operating system comprises a mobile terminal networking subsystem, and the application layer passes The application programming interface API links the channel switching software, and the channel switching software links the mobile terminal networking subsystem to interact with the mobile terminal operating system data.

Channel switching is an application that needs to be manually started, independent of the mobile terminal's operating system. After the channel switching software is manually started, it resides in the memory, provides an application programming interface API to the application layer, and performs channel switching operation according to the application layer instruction; the application layer invokes the channel switching software after startup through the application programming interface API. Switching between different networking channels; after the channel switching software exits the memory, the application layer programming interface API in the memory disappears.

What has been described above is only a preferred embodiment of the invention. It should be noted that some variations and modifications may be made by those skilled in the art without departing from the principles of the present invention. For example, the mobile payment security application system may be applied to mailboxes, OAs, or other security requirements. The service or application system, the program may be stored in a mobile terminal readable storage medium. Alternatively, each module/unit of the terminal in the above embodiment may be implemented in the form of hardware or in the form of a software function module. . The present invention is not limited to the combination of any specific form of hardware and software, and is intended to be within the scope of the present invention.

Claims

A wireless data private network physically isolated Internet mobile payment security system, comprising a payment server, a mobile phone number authentication device, a password authentication device and an APN network or a VPDN network linked with a GSN mobile network gateway device, characterized in that: payment The application system including the server and the authentication device is built in a mobile payment security data network isolated from the Internet, and the mobile payment security data network link is connected to the APN network or the VPDN network connected to the GSN mobile gateway by the Internet, and the payment server passes the password. The authentication device and the mobile phone number authentication device establish a four-in-one binding of the account, the mobile phone number, the IMSI number, and the password. The mobile terminal automatically shuts down the Internet access channel when the mobile payment security data network is connected, and physically isolates the Internet. Then, the graphic verification code information is exchanged with the mobile payment server through the base station.
The mobile data security system for physically isolating the Internet of the wireless data private network according to claim 1, characterized in that: in the mobile payment security system in which the wireless data private network is physically isolated from the Internet, the system model using the mobile phone number binding function, the mobile phone Turn off the Internet access channel, connect the mobile payment security network, and establish a communication tunnel with the mobile phone number authentication device. During the process of establishing the communication tunnel, when the mobile phone sends the time domain request, the GGSN or SGSN first passes the access point name APN line and / Or the virtual private dial-up network VPDN private line links the mobile network gateway GSN, and the international mobile subscriber identity IMSI stored by the user in the SIM card is sent to the mobile phone number authentication device as a digital call calling-number paging request parameter, and authenticated by the mobile phone number. The device implements IMSI authentication and account address binding, and then communicates with the payment server via the password authentication device.
The mobile data security system for physically isolating the Internet by the wireless data private network according to claim 1, wherein the password authentication mode comprises a digital password or a biometric password.
The mobile data security system for physically isolating the Internet of the wireless data private network according to claim 1, characterized in that: in the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile secure payment system model using the graphic verification code authentication The mobile secure payment system model includes a mobile terminal, a dedicated data channel, an authentication device, and a payment server.
The mobile data security system for physically separating the Internet by the wireless data private network according to claim 4, wherein the payment server sends a random secure graphic verification code as a transaction each time the mobile terminal sends a transaction request. The tag is submitted in the mobile terminal payment request, and the verification code of the successive transaction is used to ensure that the verification code cannot be copied.
The mobile data security system for physically isolating the Internet of the wireless data private network according to claim 1, wherein in the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses a dedicated browser to automatically switch the networked channel. The system model, dedicated browser networking channel automatic switching system model includes a dedicated browser with embedded channel switching program and / or embedded channel switching program client and application and mobile terminal networking subsystem.
The mobile data security system for physically isolating the Internet of the wireless data private network according to claim 6, wherein the dedicated browser or the client and the application embedded in the channel switching program monitor the pages, services and functions used by the user. When it is necessary to use the mobile payment service, the browser or the client and the application call the embedded channel switching program, send a channel switching command, and connect to the network through the mobile terminal networking subsystem, networked Internet or mobile secure payment data network.
The mobile data security system for physically isolating the Internet by the wireless data private network according to claim 7, wherein the embedded channel switching program closes the current network after receiving the command of the dedicated browser or the client and the application, The networking parameter of the mobile terminal is modified to be a connection or a preset APN or VPDN networking parameter of the client and the application, and a request for the networked mobile payment security data network is initiated to the mobile terminal networking subsystem. After the networking is successful, the browser or the browser The client and the application feed back the success message, the network fails, and the failure message is fed back to the browser or the client and the application.
The mobile data security system for physically isolating the Internet of the wireless data private network according to claim 8, wherein the dedicated browser or the client and the application receive the network success message, use the mobile payment security data network channel, and move The payment security system performs information exchange; after the browser or the client and the application end the mobile payment service, the embedded channel switching program is invoked to switch the mobile terminal networking channel back to the Internet access channel.
The mobile data security system for physically isolating the Internet of the wireless data private network according to claim 1, wherein in the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses the channel switching module embedded in the mobile terminal. The system model for automatic switching of the networked channel, the network channel automatic switching system model includes an application layer and a mobile terminal operating system, and the mobile terminal operating system includes a channel switching module and a mobile terminal networking subsystem; the application layer includes a browser and a browser plug-in , client or application; application layer is programmed through the application The interface API links the channel switching module, and connects the mobile terminal operating system via the channel switching module.
The mobile data security system for physically isolating the Internet of the wireless data private network according to claim 1, wherein in the mobile payment security system in which the wireless data private network physically isolates the Internet, the mobile terminal uses an independent channel switching software to perform the networking channel. Automatic switching system model, independent channel switching software networking channel automatic switching system model, including application layer, channel switching program software and mobile terminal operating system, wherein the application layer includes browser, browser plug-in or client and application, mobile The terminal operating system includes a mobile terminal networking subsystem, and the application layer links the channel switching software through the application programming interface API, and the channel switching software links the mobile terminal networking subsystem to interact data with the mobile terminal operating system.
The mobile data security system for physically isolating the Internet of the wireless data private network according to claim 1, wherein: when the channel switching software is started, the system resides in the memory, and provides an application programming interface API to the application layer, and according to the application. The layer instruction performs channel switching operation; the application layer invokes the channel switching software after startup by the application programming interface API to switch between different networking channels; after the channel switching software exits the memory, the application layer programming interface API in the memory disappears.