WO2015188718A1

WO2015188718A1 - Mobile terminal-based payment method and apparatus, and mobile terminal

Info

Publication number: WO2015188718A1
Application number: PCT/CN2015/080711
Authority: WO
Inventors: 孟齐源; 高祎玮
Original assignee: 北京奇虎科技有限公司; 奇智软件（北京）有限公司
Priority date: 2014-06-10
Filing date: 2015-06-03
Publication date: 2015-12-17

Abstract

A mobile terminal-based payment method and apparatus, and mobile terminal. The mobile terminal-based payment method comprises: determining a mobile terminal has entered a payment scenario (S202); detecting the network connection type of the mobile terminal (S204); on the basis of the network connection type, establishing a secure network transmission channel from the mobile terminal to a payment server (S206); and using the secure network transmission channel to transmit payment data until the payment is complete (S208). Using a VPN or other tunnelling transmission technology to implement a secure network transmission channel for implementing mobile payment fulfils the secure switching requirements of different network service and secure payment applications, ensuring that during the process of a payment operation, the mobile terminal only connects to a dedicated mobile secure payment data network, eliminating the security risks of mobile payment caused by the transmission channel.

Description

Mobile terminal based payment method, device and mobile terminal

Technical field

The present invention relates to the field of mobile communications, and in particular, to a mobile terminal-based payment method, apparatus, and mobile terminal.

Background technique

Mobile payment combines terminal equipment, the Internet, application providers, and financial institutions to provide users with financial services such as money payment and payment. With the rapid development of mobile e-commerce, third-party payment, banking and other companies are rushing to launch mobile payment clients. Shopping clients such as shopping, wealth management and life services are also emerging, which greatly enriches the market application environment of mobile payment.

The mobile payment uses the user's mobile phone number or other identification as an associated payment account, and the payment transaction activity is performed through identity confirmation. The mobile payment access method may include a short message, a voice, a network connection, and the like. At present, in the field of remote mobile payment, the network connection method is the most widely used, and the user sends a transaction request to a merchant that provides a certain commodity or service by using a mobile network, and transmits the transaction data and completes the transaction payment by using the wireless network.

The security of mobile payments is a key factor affecting the development of payment services. The security of mobile payment involves the confidentiality of user information, the security of user funds and the security of payment information. The security risks are mainly from two aspects: network and system security, and terminal security.

When mobile payment data is transmitted in a wireless network, there are security risks such as interception of signals. For example, some malware can be disguised as a public WiFi network without encryption, and after the user connects, intercept the user to transmit mobile data.

Some Trojans and phishing websites on the terminal and network side will pretend to be payment websites and payment clients, defrauding the user's account password or directly conducting financial fraud.

Therefore, the security issue of mobile payment is the main bottleneck and hidden danger of mobile payment promotion.

Summary of the invention

In view of the above problems, the present invention has been made in order to provide a mobile terminal-based payment method, apparatus, and mobile terminal that overcome the above problems or at least partially solve the above problems.

According to an aspect of the present invention, a mobile terminal-based payment method is provided, including: determining that a mobile terminal enters a payment scenario; detecting a network connection type of the mobile terminal; and establishing a secure network transmission channel of the mobile terminal to the payment server according to the network connection type. Transfer the payment data using the secure network transmission channel until the payment is completed.

According to another aspect of the present invention, a mobile terminal-based payment device is further provided, the mobile terminal-based payment device comprising: a payment scenario determining module configured to determine that the mobile terminal enters a payment scenario; and a network connection detecting module configured to Detecting a network connection type of the mobile terminal; the transmission channel establishing module is configured to establish a secure network transmission channel of the mobile terminal to the payment server according to the network connection type; the payment data transmission module is configured to transmit the payment data by using the secure network transmission channel until the payment is withdrawn Scenes.

According to another aspect of the present invention, a mobile terminal is also provided. The mobile terminal includes the mobile terminal based payment device described above.

The beneficial effects of the invention are:

The mobile terminal-based payment method and device of the present invention establishes a secure network connection channel according to the network connection condition after entering the payment scenario, thereby avoiding network interception of payment data, and eliminating the security risk of mobile payment from the aspect of network transmission.

Further, in the connection method of the secure network transmission channel and the data transmission process, the payment method of the present invention adopts the reconnection and prompting manner to ensure the working reliability of the network channel, reduce the operation of the user, and improve the user experience.

In addition, the present invention specifically identifies the payment scenario to its active interface, that is, corresponding to its active component, enhances the intelligence of the recognition, eliminates unnecessary frame harassment of the user operation, and makes the service function of the application more Humanized, both to meet security needs and to meet usage habits.

According to still another aspect of the present invention, a computer program is provided, comprising computer readable code, when said computer readable code is run on a computing device, causing said computing device to perform a mobile based operation as described above The payment method of the terminal.

According to still another aspect of the present invention, a computer readable medium storing the above computer program is provided.

The above description is only an overview of the technical solutions of the present invention, and the above-described and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 is a schematic diagram of a mobile terminal based payment device according to an embodiment of the present invention;

2 is a schematic diagram of a mobile terminal based payment method according to an embodiment of the present invention;

3 is a flowchart of determining a mobile terminal entering a payment scenario in a mobile terminal-based payment method according to an embodiment of the present invention;

4 is an optional detailed flowchart of a mobile terminal based payment method according to an embodiment of the present invention;

FIG. 5 schematically shows a block diagram of a computing device for performing a mobile terminal based payment method in accordance with the present invention;

Fig. 6 schematically shows a storage unit for holding or carrying program code implementing a mobile terminal based payment method according to the present invention.

detailed description

The invention is further described below in conjunction with the drawings and specific embodiments.

1 is a schematic diagram of a mobile terminal-based payment device 100, which is based on an embodiment of the present invention. The payment device 100 of the mobile terminal may generally include a payment scenario determining module 110, a network connection detecting module 120, a transmission channel establishing module 130, a payment data transmission module 140, a transmission state monitoring module 150, a payment channel exit module 160, and the above module. The configuration may be flexibly performed according to the functional requirements of the mobile terminal-based payment device 100 of the present embodiment. In some optional environments, all the above modules may not be configured.

The mobile terminal-based payment device 100 of the present embodiment can be installed in the mobile terminal or other mobile payment device of the embodiment, and runs in the process of the mobile terminal performing mobile payment to ensure the transmission security of the payment data of the mobile terminal.

In each component of the mobile terminal-based payment device 100 of the present embodiment, the payment scenario determining module 110 is configured to determine that the mobile terminal enters a payment scenario. The determination of the payment scenario may be determined according to the client initiated by the mobile terminal. When it is detected that the mobile terminal has a new client startup, it is determined whether the newly activated client is a mobile payment client, and if it is determined that the mobile terminal starts the payment client. And determining that the mobile terminal enters the payment scenario. The process of determining whether the newly launched client is a mobile payment client can be implemented by local client list verification and client feature matching.

A specific structure of the payment scenario determining module 110 may be configured: a data comparison sub-module and a feature analysis sub-module. The data comparison sub-module compares the client information with the client information of the preset payment client list. If there is a list item with the matching result, the comparison is successful, and the payment client list is pre-stored. Characteristic information of various payment class clients. The feature analysis sub-module extracts the package name and the tag name in the client information, and queries whether the package name and the tag name include the feature keyword of the payment client, and if so, the comparison is successful. The list of payment clients used by the data comparison sub-module can be dynamically adjusted according to the specific usage of the mobile terminal to record information of all installed payment clients. The features used in the feature analysis sub-module generally include a package name and a tag name (lable), and may also include signatures, version numbers, and the like. The feature analysis can be performed locally on the mobile terminal, or the feature information can be uploaded to the cloud, and the judgment result is returned to the mobile terminal after being judged by the cloud.

The network connection detecting module 120 detects the network connection type of the mobile terminal. The general network connection type may include various network standard mobile communication networks provided by mobile operators (for example, mobile networks such as CDMA, GPRS, WCDMA, TD-CDMA, and LTE provided by various operators) and various wireless local area networks (for example, WIFI). . For wireless LANs, they can be divided into public networks and encrypted networks. For example, users can use their wireless routers to set up their own WIFI networks, and in some public places, they also provide some public WIFI hotspots. Some malicious WIFIs pretend to be wireless hotspots. When there is a mobile terminal connection, intercept the communication data of the terminal, thereby obtaining information such as the user name and password. The network connection detecting module 120 can determine whether there is a hidden danger of information transmission leakage by detecting the type of network connection in which the mobile terminal is involved. For example, when the network accessed by the mobile terminal is a wireless network that is initially connected or has no encryption, the wireless network is considered to have a hidden danger of information transmission leakage. The network connection detecting module 120 can detect the network connection of the mobile terminal by using a process similar to the WiFi physical check, for example, detecting the security of the management account of the wireless router (for example, using a default password), and whether the DNS of the router's WAN port is maliciously falsified. Whether the DNS of the router's DHCP service has been tampered with, whether the router is allowed to be remotely controlled, etc., when the above check items may have security risks, the user is reminded to use the secure network transmission channel for mobile payment.

The transmission channel establishing module 130 establishes a secure network transmission channel of the mobile terminal to the payment server according to the network connection type. An optional structure of the transmission channel establishing module 130 may include: determining a submodule, prompting Submodule, execution submodule.

The determining sub-module determines whether the network connection type is a wireless transmission network with a risk of information leakage; for example, when the network accessed by the mobile terminal is a wireless network that is initially connected or has no encryption, the wireless network is considered to have a hidden danger of information transmission leakage. In addition, when the DNS of the router's WAN port is maliciously tampered with, the DNS of the router's DHCP service is tampered with, and the router is allowed to be remotely controlled, etc., it is also considered that there is a risk of information leakage on the current network.

The prompt sub-module prompts the payment risk of the network connection through the interface of the mobile terminal when the judgment result of the sub-module is YES, and provides an operation option for starting the preset virtual private network transmission. For example, the interface may prompt the risk of the current network connection through a pop-up window, prompt the user to use the network connection to transmit the hidden danger of the payment, and provide corresponding options, such as providing a preset virtual private network connection by means of a menu or a button. Operational entrance.

After receiving the operation of the user, the execution sub-module connects to the corresponding virtual private network according to the operation of the operation option by the user. For example, the user selects a button or menu in the operation option to pay with a secure network, and the execution sub-module switches the network connection of the mobile terminal to a secure transmission state, for example, repackaging the data packet and then transmitting it through IP tunneling technology, The method of selecting is to use a virtual private network (VPN) technology for data transmission, and pre-establish a virtual private network for processing data transmission of the mobile terminal. A workflow of the execution sub-module is: initiating a connection request to a preset virtual private network; determining whether the connection is successful within a predetermined time; if yes, transmitting the payment data by using the virtual private network, and transmitting the payment data by using the secure network transmission channel; If not, a reconnection request is initiated to the preset virtual private network until the connection is successful or the number of connections exceeds a preset threshold, for example, reconnection is more than 2 times or 3 times, and the connection is deemed unsuccessful. If the connection VPN is unsuccessful, the execution sub-module may also prompt the virtual private network connection to be unsuccessful through the mobile terminal after the connection number exceeds the preset threshold, and generate a prompt option for the next operation, and perform corresponding operation according to the user's selection of the prompt option. The operation, prompt options include any one or more of the following: temporarily stop the payment, try to connect to other virtual private networks, ignore the risk to continue to pay.

After the transmission channel establishing module 130 completes the transmission channel establishment, the payment data transmission module 140 can transmit the payment data by using the secure network transmission channel until the payment is completed. During the transmission process, the payment data transmission module 140 can perform interactive data exchange between the mobile terminal and the payment server by means of transparent transmission, that is, the length and content of the data of the sender and the receiver are completely consistent, and the compatibility of data transmission is ensured.

The transmission status monitoring module 150 monitors the transmission status of the secure network transmission channel during the data transmission by the payment data transmission module 140, and retransmits the transmission channel to the secure network when an abnormality occurs in the transmission status, such as a disconnection or a data error. Initiate a connection request. Thereby ensuring the reliability of the network connection and improving the user experience.

The payment channel exit module 160 disconnects the secure network transmission channel after exiting the payment scenario. Release the link capability of the secure transmission channel, reduce the load pressure of the secure transmission channel, and ensure the normal operation of other functions of the mobile terminal.

The above secure transmission channel can implement transparent forwarding of payment data by using various IP tunnel technologies including VPN.

In an embodiment of the present invention, the secure network transmission channel established based on the virtual private network, that is, the communication tunnel implemented based on the virtual private network protocol, specifically, any one of PPTP, L2TP, and IPSEC may be adopted. The protocol is implemented, and the remote communication data involved in the mobile terminal payment scenario, particularly related to the active interface related to the payment, is encrypted and transmitted through the communication tunnel, thereby further ensuring the security of the related payment data, making it difficult to be stolen or cracked.

In order to implement the establishment and maintenance of the communication tunnel, in the method of the present invention, a service module may be registered in advance with the system, and the system operating environment is monitored by the service module to obtain control rights for establishing and maintaining the communication tunnel. The service module is flexible in implementation form and can be integrated into the same program together with each module of the aforementioned device.

The service module, after monitoring the incoming payment scenario, does not establish the communication tunnel, and then prompts the user interface to prompt the user whether to establish the communication tunnel, when the user selects to establish the communication tunnel. The service module is responsible for invoking the system function and establishing a communication tunnel based on the virtual private network protocol; otherwise, the communication tunnel is not established. That is, the service module gives control of whether to establish a communication tunnel to the user for processing, and determines whether to establish the communication tunnel based on the user selection.

Further, when the communication tunnel no longer exists, the payment scenario is exited.

The communication tunnel no longer exists, which means that the service module fails to establish the communication tunnel successfully through multiple attempts, or although the communication tunnel is successfully established once, but after the subsequent disconnection, the communication tunnel cannot be established again. Or the user forcibly disconnects the communication tunnel through a third-party application. In this case, it means that the payment scenario will work in a public connection environment and cannot achieve the construction purpose of the secure payment environment to be achieved by the present invention. Therefore, the method of the present invention forcibly withdraws from the payment scenario and rejects the user's Subsequent payment operations.

Before exiting the payment scenario, the active interface for executing the payment instruction may be closed, and then the entire application is exited to complete the exit of the payment scenario. Before the final exit of the payment scenario, you can further check whether the communication tunnel still exists, and then completely shut it down before exiting, so as not to affect the subsequent operation of the system.

The above embodiments of the present invention are capable of ensuring that the operation of the payment scenario and the remote transmission of the data are performed based on a secure communication tunnel, thereby ensuring the security of the payment operation of the mobile terminal.

However, in the above example, the basis for performing the secure connection payment method is based on the identification of the payment scenario, and the identification of such a payment scenario is located at the level of the application package, that is, for a specific application. Identification and processing. For example, once a third-party payment application such as WeChat or Alipay is activated, it means that the payment scenario is activated, that is, the service module described in the present invention is triggered, and the service module will try to query the frame or directly establish the service module. Communication tunnels (implemented in some undescribed embodiments), and the purpose of the user's use of such applications is not to make online payments each time, such that frequent human interactions will cause the user to bother.

To this end, according to an embodiment of the present invention, the following manner is also provided to determine that the mobile terminal enters a payment scenario, or determines that a payment scenario is initiated.

First, the determination of the payment scenario in this embodiment is specific to the level of the active interface of the third-party payment application. Specifically, the present invention can identify an active interface in a payment scenario by:

Take the Android system as an example. In the application, each active interface corresponds to an active component, that is, Activity, and Activity is one of the executable components of Android. From a functional point of view, payment applications often include multiple activity interfaces, including an activity interface for performing payment operations (instructions), and an activity interface for presenting information. The call between the various activities, implemented by means of Intent technology, through HOOK (hook) The technology intercepts the Intent to know the calling intention of the active component corresponding to the current active interface, thereby determining whether the user has the real activity intention of performing the payment operation, and determining that the user has the intention of the real activity, The determination that the payment scenario is initiated, that is, the concept of the payment scenario in the previous embodiment is narrowly understood, and only a series of active interfaces for performing payment operations in the payment application are regarded as payment scenarios, and key features are identified. After one or more of the active interfaces are invoked, it is determined whether the payment application has entered the payment scenario. One or more referred to herein, for example, when invoking an active interface for determining whether to pay immediately, may inevitably be determined to be in a payment scenario; when calling for a selected bank card, for querying a bill, etc. When the active interface is different, but the active interfaces related to the payment are successively called, the user is deemed to be interested in entering the payment scenario. Therefore, by identifying the calling relationship of the active interface, it is sufficient to determine whether the current process starts the payment scenario. The so-called key feature recognition activity interface, for example, involves the acquisition of process information in the HOOK technology, and the keyword of the class name related to the activity interface, as a basis for logical judgment, etc., which are known to those skilled in the art, and will not be described . In this example, the determination of the payment scenario is performed before the active interface is invoked, and the active interface is not yet activated. The present invention can establish a communication tunnel first, and the response is timely and the identification is efficient.

Also take Android as an example, with the help of Android's broadcast messaging mechanism. The method of the present invention can obtain the active interface that has been activated from the message queue through the service module provided by the method, and the key feature information of the current active interface can be used as a basis for determining whether to start the payment scenario. Determine if the communication tunnel needs to be established.

In the present invention, whether through the Intent or the broadcast message, the logic analysis of the key feature information of the active interface can be utilized to realize the judgment of the behavior track of the user's operating habit. For example, when the WeChat is running, entering the "wallet" activity interface, and then clicking the "transfer" page, it can be determined that the payment operation needs to be performed, and then the payment scenario is deemed to be initiated, and as a technical basis for establishing the communication tunnel. .

It can be seen that if the broadcast message is used to realize the identification of the key feature information of the active interface, the active interface is already in an active state at the top of the stack before establishing the communication tunnel; if the Intent is used to obtain the Calling the relevant active interface key feature information, before the communication tunnel is established, the active interface may be in an inactive state, including a pause, stop, end, etc., until the communication tunnel is successfully established, and then the related activity is activated. This shows the active interface.

Secondly, in this embodiment, the role of the communication tunnel is mainly for transmitting data related to payment, and does not care whether the data involved in the active component corresponding to the other payment-independent active interface of the current payment application needs to be performed through the communication tunnel. transmission.

When the determination basis of whether the payment scenario is initiated is specific to the active interface of the application, and then the communication tunnel is established, the communication tunnel is mainly used to transmit an active interface for executing the payment instruction included in the payment scenario. The data, in theory, understood in the broad sense of data transmission, is only used to transmit the data used by such active interfaces. In fact, these data include not only the payment-related passwords, amounts, and instructions involved, but also related data that determines the correct transmission of such data. However, for the purposes of the present invention, the focus is on these various types of data related to payment, ensuring that it is securely transmitted through the communication tunnel.

The above determines the manner in which the payment scenario is initiated, further ensuring the implementation of secure communication, and improving the user experience of human-computer interaction.

The embodiment of the present invention further provides a mobile terminal-based payment method, which can be executed by the mobile terminal-based payment device of the above embodiment to eliminate the security risk of the mobile payment and ensure the security of the user's property information. A mobile terminal-based payment method according to an embodiment of the present invention. As shown in the figure, the mobile terminal-based payment method includes:

Step S202, determining that the mobile terminal enters a payment scenario;

Step S204, detecting a network connection type of the mobile terminal;

Step S206, establishing a secure network transmission channel of the mobile terminal to the payment server according to the network connection type;

Step S208, the payment data is transmitted by using the secure network transmission channel until the payment is completed.

The determining of the payment scenario in step S202 may be determined according to the client initiated by the mobile terminal. When it is detected that the mobile terminal has a new client, it is determined whether the newly activated client is a mobile payment client, and if it is determined that the mobile terminal is activated. The payment client determines that the mobile terminal enters the payment scenario. The process of determining whether the newly launched client is a mobile payment client can be implemented by local client list verification and client feature matching. FIG. 3 is a flowchart of determining a mobile terminal entering a payment scenario in a mobile terminal-based payment method according to an embodiment of the present invention, where the process includes:

Step S302, monitoring whether a new client is started in the mobile terminal;

Step S304, determining whether the newly started client is a client recorded in the local payment client list, and if yes, determining to enter the payment scenario, and if not, performing step S306 to determine that the payment scenario is not entered;

Step S306, determining whether the feature of the newly activated client matches the payment type client feature keyword, if yes, determining to enter the payment scenario, and if not, determining not to enter the payment scenario;

In step S304, the mobile terminal may pre-store a payment client list for recording the payment client information installed by the mobile terminal. When the newly launched client is not in the list, the cloud query may be further used. It is determined that, for example, the characteristics such as the package name, the tag name, and the version information of the client are matched with the feature keywords of the payment type client saved in the cloud. Therefore, after determining to open the payment type client, the mobile terminal can be considered to enter the payment scenario. The above payment client list can be dynamically adjusted according to the usage of the mobile terminal to record information of all installed payment clients.

In another embodiment of the present invention, the key features of the active interface of the third-party payment application mentioned above may be determined to determine whether the payment scenario has been entered, and details are not described herein again.

After step S202, the payment client may also be first verified by the version, and the payment is cleared, that is, the process unrelated to the payment is closed.

An optional process of step S204 is: determining whether the network connection type is a wireless transmission network with a risk of information leakage; if yes, prompting the payment risk of the network connection through the interface of the mobile terminal, and providing the preset virtual private network transmission Operation options; connect the corresponding virtual private network according to the user's operation on the operation options. For example, when the network accessed by the mobile terminal is a wireless network that is initially connected or has no encryption, the wireless network is considered to have a hidden danger of information transmission leakage, and when the DNS of the router's WAN port is maliciously tampered with, the router's DHCP service is In the case where the DNS is tampered with, the router is allowed to be remotely controlled, etc., the current network is also considered to be at risk of information leakage.

When the user selects to use the secure network transmission channel provided by the mobile terminal-based payment method of the embodiment, an optional process of step S206 is: initiating a connection request to the preset virtual private network; Whether the connection is successful within a certain time; if yes, the virtual private network is used to transmit the payment data; if not, the reconnection request is initiated to the preset virtual private network until the connection is successful or the number of connections exceeds a preset threshold. The reconnection threshold can be configured according to the actual situation, for example, configured as 2 or 3 times.

If the number of connections exceeds the preset threshold, that is, the virtual private network cannot be successfully connected: the mobile terminal may also prompt the virtual private network connection to be unsuccessful, and generate a prompt option for the next operation, and the prompt option includes any of the following options. Or multiple: temporarily stop the payment, try to connect to other virtual private networks, ignore the risk to continue to pay; follow the user's choice of prompt options to perform the corresponding operations.

If the secure network transmission channel formed by the virtual private network is successfully established, step S206 can implement transparent transmission of the interaction data between the mobile terminal and the payment server through the secure network transmission channel. During the transmission process, the transmission status of the secure network transmission channel can also be monitored, and when the transmission status is abnormal, the connection request is re-initiated to the virtual private network.

After completing the payment in step S208, the method further includes: disconnecting the secure network transmission channel and exiting the payment scenario, thereby releasing the load of the virtual private network, and restoring the operation of other processes.

The above security service channel can be implemented by using VPN technology or other IP tunneling technology. The VPN can utilize the bearer function of IP and other networks, and combine the corresponding authentication and authorization mechanisms to establish a secure virtual private network. The executor of the mobile terminal-based payment method of this embodiment can access its internal network to the internet through a dedicated line, and the user can use the VPN channel service to enter the virtual private network anywhere in the country, and securely access the network. The information resources needed.

In this embodiment, a wireless VPN network can be used. The VPN network can be located in the wireless data network of the operator and is isolated from the Internet. The mobile terminal is connected to the wireless VPN network, and firstly, the network of the access point name carried by the wireless VPN is connected. (Access Point Name, APN for short) network, users of other APN networks or networked channels cannot access the VPN network.

The wireless VPN network can adopt a virtual private network built on the APN network. The connection process of the wireless VPN network is to first connect the APN channel carrying the VPN network, and then establish a VPN network. The networking parameters of the VPN network include the networking parameters of the carried APN network and the networking parameters of the VPN. After the VPN connection, the mobile terminal can only connect to the VPN network, which is a limitation of the system implementation of the route management in the network management. Therefore, you need to exit the VPN network after completing the payment.

4 is an optional detailed flowchart of a mobile terminal-based payment method according to an embodiment of the present invention. As shown in the figure, after determining that a mobile terminal enters a payment scenario and closes an unrelated process to complete the clearing, the following steps are performed:

In step S402, it is determined that the network accessed by the mobile terminal is a public WiFi. If yes, step S404 is performed, and if no, step S416 is performed; in addition to determining the public WiFi, the network judgment may be further performed in a manner similar to the WiFi physical check, for example, detecting the wireless router. Security of the management account (for example, using the default password), whether the DNS of the router's WAN port has been maliciously tampered, whether the DNS of the router's DHCP service has been tampered with, whether the router is allowed to be remotely controlled, etc., when the above check items may appear safe In case of hidden danger, step S404 is performed;

Step S404, popping up the risk prompt interface, suggesting to use a secure payment VPN, and providing a user selection button or a selection menu;

Step S406, detecting whether the user chooses to use the secure payment VPN, and if so, executing step S408, and if not, executing step S424;

Step S408, attempting to connect to a secure payment VPN;

In step S410, it is determined whether the secure payment VPN is successfully connected within 5 seconds. If yes, step S412 is performed. If no step S418 is performed, the threshold of 5 seconds may be modified according to the actual use situation, which is merely an example, not the embodiment. limits;

Step S412, performing a subsequent payment operation using a secure payment VPN;

Step S414, the VPN is interrupted during the subsequent operation, and if so, returning to step S408 to perform reconnection, if not, executing step S416;

Step S416, completing the mobile payment operation;

In step S418, it is determined whether the number of connections has exceeded the threshold, for example, the connection has failed twice. If the step S420 is performed, if the step S422 is performed, the threshold of the number of reconnections can be modified according to the actual usage, and the two times here are only examples. It is not a limitation of this embodiment;

Step S420, prompting that the VPN is temporarily unavailable, suggesting that the user temporarily not perform the payment operation, and providing an option to withdraw the payment and continue to pay;

Step S422, if the option of receiving the user to try to connect again is returned to step S408, if not step S424;

Step S424, completing a subsequent payment operation by using the currently connected public WiFi network;

Step S426, determining whether the user selects the option of "temporarily not performing the payment operation", if not, returning to step S424, if yes, executing step S428;

Step S428, exiting the payment client, thereby exiting the payment scenario;

In step S430, it is determined whether the secure payment VPN is still connected. If the secure payment VPN is disconnected, the process ends. If it is disconnected, the process is directly terminated, and the state of the mobile terminal before entering the payment scenario is restored.

It should be noted that the threshold of the number of reconnection times and the setting of the connection time are not limited to two times and five seconds, and can be flexibly adjusted according to the application environment, and the VPN can also adopt various other IP tunnel technologies that implement data transparent forwarding. . In addition, multiple VPNs can be provided for users to choose, further improving the reliability of network connections.

The mobile terminal-based payment method and apparatus of the present embodiment and the mobile terminal for mobile payment, use the VPN or other IP tunnel transmission technology to perform mobile payment by switching the networking channel, and satisfy the security switching requirements of the network service and the secure payment for different applications. In the process of payment operation, the mobile terminal only has a unique networked dedicated mobile secure payment data network, which eliminates the security risks of the transmission channel to mobile payment, and combines other measures and means to ensure the security of the mobile payment system. Further, in the connection method of the secure network transmission channel and the data transmission process, the payment method of the present invention adopts the reconnection and prompting manner to ensure the working reliability of the network channel, reduce the operation of the user, and improve the user experience.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

Similarly, it should be understood that in order to streamline the present disclosure and to help understand one or more of the various inventive aspects, In the above description of the exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together in a single embodiment, figure, or description. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a mobile terminal or a digital signal processor (DSP) can be implemented in practice to implement a mobile terminal-based payment device and mobile terminal according to an embodiment of the present invention, and a device for protecting payment security of a mobile terminal. And some or all of the functions of some or all of the components of the mobile terminal. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, Figure 5 illustrates a computing device that can implement a method of transferring data between smart terminals. The computing device conventionally includes a processor 510 and a computer program product or computer readable medium in the form of a memory 520. The memory 520 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Memory 520 has a memory space 530 for program code 531 for performing any of the method steps described above. For example, storage space 530 for program code may include various program code 531 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to FIG. The storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 520 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 531', code that can be read by a processor such as 510, such generations The code, when run by the computing device, causes the computing device to perform various steps in the methods described above.

"an embodiment," or "an embodiment," or "an embodiment," In addition, it is noted that the phrase "in one embodiment" is not necessarily referring to the same embodiment.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to be limiting, and that the invention may be devised without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

In addition, it should be noted that the language used in the specification has been selected for the purpose of readability and teaching, and is not intended to be construed or limited. Therefore, many modifications and changes will be apparent to those skilled in the art without departing from the scope of the invention. The disclosure of the present invention is intended to be illustrative, and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

A payment method based on a mobile terminal, comprising:

Determining that the mobile terminal enters a payment scenario;

Detecting a network connection type of the mobile terminal;

Establishing a secure network transmission channel of the mobile terminal to the payment server according to the network connection type;

The payment data is transmitted using the secure network transmission channel until the payment scenario is exited.
The method of claim 1, wherein establishing the secure network transmission channel of the mobile terminal to the payment server according to the network connection type comprises:

Determining whether the network connection type is a wireless transmission network with a risk of information leakage;

If yes, prompting the payment risk of the network connection through the interface of the mobile terminal, and providing an operation option for starting a preset virtual private network transmission;

The secure network transmission channel is established over the virtual private network in accordance with user operations on the operational options.
The method according to claim 2, wherein the establishing the secure network transmission channel through the virtual private network according to the operation of the operation option by the user comprises:

Initiating a connection request to the virtual private network;

Determine whether the connection is successful within the predetermined time;

If yes, transmitting the payment data by using the virtual private network;

If not, a reconnection request is initiated to the virtual private network until the connection is successful or the number of connections exceeds a preset threshold.
The method according to claim 3, wherein after the number of connections exceeds a preset threshold, the method further comprises:

The mobile terminal prompts that the virtual private network connection is unsuccessful, and generates a prompt option for the next operation, where the prompting option includes any one or more of the following: temporarily stopping the payment, attempting to connect to other virtual private networks, and ignoring The risk continues to be paid;

The corresponding operation is performed according to the user's selection of the prompt option.
The method of claim 3 or 4, wherein transmitting the payment data using the virtual private network comprises:

Transparent transmission of interaction data between the mobile terminal and the payment server is completed by the virtual private network.
The method according to any one of claims 1 to 5, wherein, in the process of transmitting the payment data by using the secure network transmission channel, the method further comprises:

Monitoring a transmission status of the secure network transmission channel, and re-initiating a connection request to the secure network transmission channel when the transmission status is abnormal.
The method according to any one of claims 1 to 6, further comprising: after exiting the payment scenario, further comprising:

Disconnect the secure network transmission channel.
The method of claim 2 wherein the active interface of the payment scenario is adjusted It is determined that the mobile terminal enters the payment scenario.
The method of claim 8, wherein the payment scenario comprises one or more activity interfaces that determine whether a payment scenario has been entered by determining a key feature of the active interface.
The method of claim 8 or 9, wherein the secure network transmission channel established by the virtual private network is only used to transmit data of an active interface for executing payment instructions included in the payment scenario.
The method of claim 8 or 9, wherein each of the active interfaces corresponds to an executable activity component.
The method of claim 8 or 9, wherein the active interface is already in an active state prior to establishing the secure network transmission channel.
The method according to claim 8 or 9, wherein the active interface is in an inactive state before the secure network transmission channel is established, and the active interface is in an active state after the secure network transmission channel is established.
The method according to claim 2, wherein before the secure network transmission channel is established, the bullet box queries whether to establish the secure network transmission channel, and determines whether to establish the secure network transmission channel based on the user selection.
The method according to claim 2, wherein the secure network transmission channel is implemented by any one of PPTP, L2TP, and IPSEC.
The method according to claim 8 or 9, wherein when the secure network transmission channel is interrupted, the active interface for executing the payment instruction is exited first, and then the payment scenario is exited.
The method of claim 2 wherein said secure network transmission channel is established only for a current connection determined to be a public network access point.
A payment device based on a mobile terminal, comprising:

a payment scenario determining module, configured to determine that the mobile terminal enters a payment scenario;

a network connection detecting module configured to detect a network connection type of the mobile terminal;

a transmission channel establishing module, configured to establish a secure network transmission channel of the mobile terminal to the payment server according to the network connection type;

A payment data transmission module is configured to transmit payment data using the secure network transmission channel until exiting the payment scenario.
The apparatus of claim 18, wherein the transmission channel establishing module comprises:

a determining submodule configured to determine whether the network connection type is a wireless transmission network with a risk of information leakage;

a prompting sub-module configured to prompt the payment risk of the network connection by using an interface of the mobile terminal, and provide an operation option for starting a preset virtual private network transmission, if the determination result of the determining sub-module is YES ;

The execution sub-module is configured to establish the secure network transmission channel through the virtual private network according to a user operation of the operation option.
The apparatus of claim 19, wherein the execution sub-module is further configured to:

Initiating a connection request to a preset virtual private network;

Determine whether the connection is successful within the predetermined time;

If yes, transmitting the payment data by using the virtual private network;

If not, a reconnection request is initiated to the virtual private network until the connection is successful or the number of connections exceeds a preset threshold.
The apparatus of claim 20, wherein the execution sub-module is further configured to:

After the number of connections exceeds the preset threshold, the mobile terminal prompts that the virtual private network connection is unsuccessful, and generates a prompt option for the next operation, and performs a corresponding operation according to the user's selection of the prompt option, the prompt Options include any one or more of the following: Temporarily stop paying, try to connect to other virtual private networks, and ignore the risk to continue paying.
The apparatus according to claim 20 or 21, wherein the payment data transmission module is further configured to:

Transparent transmission of interaction data between the mobile terminal and the payment server is implemented through the virtual private network.
The apparatus according to any one of claims 20 to 22, further comprising:

The transmission status monitoring module is configured to monitor a transmission status of the secure network transmission channel, and re-initiate a connection request to the secure network transmission channel when the transmission status is abnormal.
The apparatus according to any one of claims 18 to 23, further comprising:

The payment channel exit module is configured to disconnect the secure network transmission channel after exiting the payment scenario.
A mobile terminal includes:

A mobile terminal-based payment device according to any one of claims 18 to 24.
A computer program comprising computer readable code that, when executed on a computing device, causes the computing device to perform the method of any one of claims 1-17.
A computer readable medium storing the computer program of claim 26.