WO2017080355A1

WO2017080355A1 - Method for confirming on-line transaction security by means of mobile phone and system thereof

Info

Publication number: WO2017080355A1
Application number: PCT/CN2016/103047
Authority: WO
Inventors: 邓煜平; 杨贤伟
Original assignee: 国民技术股份有限公司
Priority date: 2015-11-10
Filing date: 2016-10-24
Publication date: 2017-05-18
Also published as: CN106682899A; TW201717081A; TWI619042B

Abstract

Disclosed are a method and system for confirming on-line transaction security by means of a mobile phone. The method comprises: a two-dimensional code generation step, used for generating a two-dimensional code based on transaction data, which is generated by means of an on-line transaction, and a request, and displaying the two-dimensional code on a client; a two-dimensional code acquisition step, used for scanning the two-dimensional code displayed on the client by means of a mobile phone APP to acquire and send the two-dimensional code; a transaction security confirmation step, used for receiving and parsing the two-dimensional code sent by the mobile phone APP, restoring the transaction data and the request, confirming the transaction data and the request by means of a mobile phone STK menu, and generating a transaction confirmation result; a transaction security operation step, used for adopting a mobile phone smart card security module function to perform digital signature on the transaction confirmation result; and a transaction completion step, used for sending a signature confirmation result to a system platform and completing the entire on-line transaction.

Description

Method and system for confirming online transaction security by mobile phone

Technical field

The invention relates to the field of online transaction security, and in particular to a method and system for confirming online transaction security through a mobile phone.

Background technique

With the development of intelligent Internet terminal technology, mobile phone scanning QR code is more and more widely used due to its convenient use and good user experience. Moreover, with the continuous evolution of IC technology, many wireless communication technologies, such as Bluetooth communication, are integrated into smart cards such as mobile phone SIM cards, thereby opening up a gap between mobile Internet terminals and smart cards in addition to traditional data short message channels. The high-speed data channel of the machine card enables the mobile phone SIM card to not only provide telecom functions, but also support the downloading and operation of new applications and new applications. In addition, the smart card such as the mobile phone SIM card also provides the security module (SE Security Element) hardware for data encryption/decryption, signature/checking and other security operations to achieve financial level security, thereby forming a security smart card.

In the current prior art, a separate smart cipher key (USBKey) is commonly used on an Internet terminal to perform functions such as transaction display, digital signature, and user confirmation, that is, the function of the so-called "second generation KEY" is completed. However, this kind of technology that uses a separate smart cipher key on an Internet terminal has many disadvantages, such as:

1) The user is inconvenient to use, and the USBKey must be inserted and removed during the transaction of the Internet terminal to perform online transaction authentication;

2) The security is low, and the individual smart password key is easy to forget to carry, and is easily stolen and stolen by others, causing hidden dangers of the user account.

Summary of the invention

The present invention is intended to provide a method and system for confirming online transaction security through a mobile phone, and can confirm online transaction security by using a mobile phone STK (SIM Tool Kit) menu to ensure the security of online transactions on the Internet terminal. It is also easy to carry at any time and is convenient for users to use.

The technical solution of the embodiment of the present invention is implemented as follows:

The invention provides a system for confirming online transaction security through a mobile phone, comprising:

Client: for conducting online transactions, the client generates transaction data and a request according to the online transaction;

a system platform: related background service processing for performing the online transaction, generating a two-dimensional code based on the transaction data and the request, and sending the two-dimensional code to the client for display;

a mobile phone APP: configured to acquire and send the two-dimensional code by scanning the two-dimensional code displayed by the client;

a transaction security confirmation module: for receiving and parsing the two-dimensional code sent by the mobile phone APP, restoring the transaction data and the request, confirming the transaction data and the request through a STK menu of the mobile phone, and generating a transaction confirmation result;

Transaction security operation module: for digitally signing the transaction confirmation result by using a mobile phone smart card security module function;

a main control module: configured to centrally control the transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via the transaction security confirmation module to complete an online transaction, or the main control The module sends the digitally signed transaction confirmation result to the system platform via the mobile phone APP to complete the online transaction.

The invention also provides a system for confirming the security of online transactions through a mobile phone, comprising:

Client: used for online transaction, the client generates transaction data and request according to the online transaction, and generates and displays a two-dimensional code;

System platform: related background service processing for performing the online transaction;

The invention also provides a method for confirming the security of online transactions by using a mobile phone, which is applied to a system for confirming online transaction security through a mobile phone as described above, the system comprising: a client, a system platform, a mobile APP, a transaction security confirmation module, and transaction security. An operation module and a main control module, the method comprising:

a two-dimensional code generating step: generating a two-dimensional code based on the transaction data and the request generated by the online transaction, and displaying the two-dimensional code on the client;

a two-dimensional code acquisition step of: scanning, by the mobile phone APP, the two-dimensional code displayed by the client, acquiring and transmitting the two-dimensional code;

a transaction security confirmation step: receiving and parsing the two-dimensional code sent by the mobile phone APP, restoring the transaction data and the request, and confirming the transaction data and the request through a STK menu of the mobile phone to generate a transaction confirmation result;

Transaction security operation step: for digitally signing the transaction confirmation result by using a mobile phone smart card security module function;

a transaction completion step: the transaction security confirmation module sends the signed transaction confirmation result to the system platform, and the system platform determines whether to continue the transaction based on the signed transaction confirmation result, and if the transaction continues, the system platform Execute the transaction request and complete the entire online transaction.

The method for confirming online transaction security by using a mobile phone as described above, the two-dimensional code generating step includes:

Client QR code generation step: the client generates transaction data and request according to the online transaction, and directly generates and displays a two-dimensional code;

or

The system platform two-dimensional code generating step: generating a two-dimensional code based on the transaction data and the request, and transmitting the two-dimensional code to the client for display.

The method for confirming the security of the online transaction of the Internet terminal by using the mobile phone as described above, the step of acquiring the two-dimensional code includes:

a two-dimensional code scanning step: scanning, by using the mobile phone APP, the two-dimensional code displayed on the client of the Internet terminal corresponding to the transaction data and the request;

The two-dimensional code transmitting step: the mobile phone APP transmits the two-dimensional code to the transaction security confirmation module.

The method for confirming the security of online transactions by using a mobile phone as described above, the step of transmitting the two-dimensional code includes:

a mobile network sending step: the mobile phone APP sends the two-dimensional code to the system platform through a mobile network, and the system platform sends the two-dimensional code to the transaction security confirmation module by using a data short message;

or

The communication channel sending step: the mobile phone APP sends the two-dimensional code to the SIM card through a data channel between the mobile phone and the SIM card, and the transaction security confirmation module acquires the two-dimensional code from the SIM card.

The method for confirming online transaction security through a mobile phone as described above, the transaction security confirmation step includes:

The two-dimensional code parsing step: the transaction security confirmation module obtains the transaction data and the request to be signed and confirmed by parsing the two-dimensional code;

The transaction confirmation step: the STK menu pops up in the transaction security confirmation module displays the transaction data and the request to be signed and confirmed, and waits for the user to confirm the transaction in the STK menu to generate a transaction confirmation result.

The method for confirming online transaction security by using a mobile phone as described above, the transaction security operation steps include:

Signature step: If the user confirms the transaction, the transaction security operation module performs the transaction confirmation result signature using the security module function on the SIM card.

The method for confirming the security of online transactions by a mobile phone as described above, the transaction completion steps include:

The short message transaction completion step: the transaction security confirmation module directly returns the signed transaction confirmation result to the system platform through the data short message;

or

a communication channel transaction completion step: the transaction security confirmation module sends the signed transaction confirmation result to the mobile phone APP through a data channel between the mobile phone and the SIM card, and the mobile phone APP is sent to the system platform through the mobile network. .

The present invention also provides a SIM card implemented based on a method for confirming online transaction security by using a mobile phone, which adopts a method for confirming online transaction security by using a mobile phone as described above, and the SIM card includes:

Card end communication module: used for data communication with a mobile phone;

Transaction security operation module: used to digitally sign the transaction confirmation result of online transaction by using the mobile phone smart card security module function;

The main control module is configured to centrally control and process the card end communication module and the transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via the mobile phone to complete the online transaction.

The present invention also provides a mobile phone implemented based on a method for confirming online transaction security by using a mobile phone, which adopts a method for confirming online transaction security through a mobile phone as described above, the mobile phone comprising:

Mobile terminal communication module: used for data communication with the SIM card;

The mobile phone APP is configured to: acquire the two-dimensional code by scanning a two-dimensional code displayed by the client, and send the two-dimensional code by using the mobile terminal communication module;

The transaction security confirmation module is configured to receive and parse the two-dimensional code sent by the mobile phone APP, restore the transaction data and the request of the online transaction, and confirm the transaction data and the request through the STK menu of the mobile phone to generate a transaction confirmation result.

The present invention also provides an online transaction system based on a method for confirming online transaction security by using a mobile phone, which adopts a method for confirming online transaction security through a mobile phone as described above, and the online transaction system includes:

a mobile phone system: configured to scan the two-dimensional code by scanning the two-dimensional code displayed by the client, parse the two-dimensional code, restore the transaction data and request, and use the mobile phone STK menu to process the transaction data. Confirm with the request to generate a transaction confirmation result;

SIM card: used to digitally sign the transaction confirmation result by using the mobile phone smart card security module function, and send the digitally signed transaction confirmation result to the system platform via the mobile phone system to complete the entire online transaction.

An online transaction system based on a method for confirming online transaction security by a mobile phone as described above, the mobile phone system comprising:

The mobile phone APP is configured to acquire and send the two-dimensional code by using the mobile phone end communication module by scanning the two-dimensional code displayed by the client;

The transaction security confirmation module is configured to receive and parse the two-dimensional code sent by the mobile phone APP, restore the transaction data and the request, and confirm the transaction data and the request through the STK menu of the mobile phone to generate a transaction confirmation result.

The online transaction system based on the method for confirming the security of online transactions by using a mobile phone as described above, the SIM card includes:

Card end communication module: used for data communication with the mobile phone system;

A method and system for confirming online transaction security by using a mobile phone according to an embodiment of the present invention, using a mobile phone to scan a QR code displayed on a client, obtaining transaction data and a request to be signed and confirming, and using the STK menu to secure the transaction Confirm that the transaction data and the request for signature verification are digitally signed using the security module on the security smart card. The invention enables the smart phone with the security smart card to have the "second generation Key" function of the online transaction of the internet terminal, which not only ensures the security of the online transaction of the internet terminal, but also is convenient to carry at any time and is convenient for the user to use.

The beneficial effects of the invention are:

1) Easy to use, the system of the invention enables the user to insert and unplug the USBKey in the process of conducting the transaction in the Internet terminal, and confirms the transaction through the two-dimensional code;

2) The security is high, and the verification method of the QR code transaction of the invention is not easy to be lost and stolen by others, which greatly improves the security of the user account.

DRAWINGS

1 is a logic block diagram of a system for confirming online transaction security by using a mobile phone according to the present invention;

2 is a schematic flow chart of a method for confirming online transaction security by using a mobile phone according to the present invention;

3 to FIG. 5 are schematic diagrams showing a detailed flow of a method for confirming online transaction security by using a mobile phone according to the present invention;

6 is a schematic flow chart of a specific embodiment of a method according to the present invention;

7 is a logic block diagram of a SIM card implemented by a method for confirming online transaction security by using a mobile phone according to the present invention;

8 is a logic block diagram of a mobile phone implemented by a method for confirming online transaction security by using a mobile phone according to the present invention;

FIG. 9 is a logic block diagram of an online transaction system implemented by a method for confirming online transaction security through a mobile phone according to the present invention.

detailed description

In order to explain the embodiments and technical solutions of the present invention more clearly, the technical solutions of the present invention will be described in more detail below with reference to the accompanying drawings and embodiments. It is obvious that the described embodiments are a part of the embodiments of the present invention, and not all Example. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without departing from the inventive scope are the scope of the present invention.

The invention provides a system for confirming online transaction security through a mobile phone. FIG. 1 is a logic diagram of a system for confirming online transaction security through a mobile phone according to the present invention. As shown in FIG. 1, the system of the present invention includes:

Client 1: For online transactions, the client generates transaction data and requests based on online transactions;

System platform 2: related background business processing for conducting online transactions, generating a two-dimensional code based on the transaction data and the request, and transmitting the two-dimensional code to the client for display;

Mobile APP3: used to obtain and send a two-dimensional code by scanning a two-dimensional code displayed by the client;

The transaction security confirmation module 4 is configured to receive and parse the two-dimensional code sent by the mobile phone APP3, restore the transaction data and the request, confirm the transaction data and the request through the STK menu of the mobile phone, and generate a transaction confirmation result;

Transaction security operation module 5: for digitally signing the transaction confirmation result by using the smart card security module function;

The main control module 6 is configured to perform central control on the transaction security operation module 5, send the digitally signed transaction confirmation result to the system platform 2 via the transaction security confirmation module 4, complete the online transaction, or the main control module 6 will digitally sign the transaction. The confirmation result is sent to the system platform 2 via the mobile APP3 to complete the online transaction.

In another specific embodiment of the system of the present invention, FIG. 1 is a logic diagram of a system for confirming online transaction security by using a mobile phone according to the present invention. As shown in FIG. 1, the system of the present invention includes:

Client 1 is used for online transactions, and client 1 generates transaction data and requests according to online transactions, and generates and displays a two-dimensional code;

System platform 2: related background business processing for online transactions;

The Transaction Security Module provides security features such as encryption and decryption and digital signature services.

The work of sending a transaction signature confirmation result to the system platform is divided into two cases:

1. Completed by the transaction confirmation module:

After the transaction confirmation module calls the transaction operation module for signature by the main control module, the main control module returns the transaction signature confirmation result to the transaction confirmation module, and the transaction confirmation module sends the data message to the system platform.

2. Completed by the APP:

After the transaction confirmation module calls the transaction operation module signature by the main control module, the main control module returns the transaction signature confirmation result to the APP through the high-speed data channel of the machine card, and the APP sends the information to the system platform through the mobile network.

The client of the present invention is a personal device or self-service terminal that can support online transactions and has a display screen, including but not limited to a PC, an IPAD, a mobile phone, an ATM machine, and the like.

The STK (Sim Tool Kit) menu in this solution is a system function call triggered by the SIM or system platform. The malicious program in the mobile phone cannot intervene and change the display and input in the STK. At this time, the user sees the transaction in the STK menu. The situation is the transaction data and request to be signed and confirmed by the two-dimensional code transmitted by the system platform through the data short message, or the two-dimensional code transmitted by the APP through the high-speed data channel of the machine card to be signed and confirmed. Transaction Data and request, if the user wishes to continue the transaction, the transaction is “confirmed” in the STK menu, otherwise the transaction is “cancelled”. After obtaining the result of the manual confirmation operation in the STK menu, the transaction is signed by the security function provided by the security module in the SIM.

The high-speed data channel of the machine card of the present invention can be any communication method that can be provided between the mobile phone and the smart card, such as Bluetooth, WiFi, Zigbee and the like. Typically, the high-speed data channel of the card is a Bluetooth channel between the mobile phone and the smart card, that is, the method of the present invention can make the Bluetooth SIM have the "second generation Key" security function, thereby enabling the smart phone with the Bluetooth SIM. It can be equipped with the "second generation Key" security function of Internet terminal online transaction, which can be used to replace the USBKey used in Internet terminal online transactions to ensure the security of online transactions on the Internet terminal.

The security smart card of the present invention refers to a smart card integrated with a security module (SE) or a security component hardware, including but not limited to standard SIM, UIM, USIM, MicroSIM, NanoSIM and other communication smart cards of various forms and sizes.

The system platform of the present invention refers to a remote server platform for processing transaction processing.

2 is a schematic flow chart of a method for confirming online transaction security by using a mobile phone according to the present invention. As shown in FIG. 2, the present invention also provides a method for confirming online transaction security through a mobile phone, which is applied to a system for confirming online transaction security through a mobile phone as described above. The system includes: a client, a system platform, a mobile APP, a transaction security confirmation module, a transaction security operation module, and a main control module, and the method includes:

The two-dimensional code generating step S1 is: generating transaction code and request based on the online transaction, generating a two-dimensional code, and displaying the two-dimensional code on the client; in the client transaction process, the client generates the transaction data to be signed and confirmed request.

Step 2: acquiring the two-dimensional code displayed by the client through the mobile phone APP, and acquiring and transmitting the two-dimensional code;

Transaction security confirmation step S3: for receiving and parsing the QR code sent by the mobile APP, restoring the transaction data and the request, confirming the transaction data and the request through the STK menu of the mobile phone, and generating a transaction confirmation result;

Transaction security operation step S4: for digitally signing the transaction confirmation result by using the smart card security module function;

The transaction completion step S5: the transaction security confirmation module sends the signed transaction confirmation result to the system platform, and the system platform determines whether to continue the transaction based on the signed transaction confirmation result. If the transaction continues, the system platform executes the transaction request to complete the entire online transaction.

3 to FIG. 5 are schematic flowcharts of a method for confirming online transaction security by using a mobile phone according to the present invention. As shown in FIG. 3, the two-dimensional code generating step S1 includes:

Client QR code generation step S11: the client generates transaction data and requests according to the online transaction, and directly generates and displays the two-dimensional code;

Or,

The system platform two-dimensional code generating step S12: generating a two-dimensional code based on the transaction data and the request, and transmitting the two-dimensional code to the client for display.

If the two-dimensional code is generated by the client, the client generates a two-dimensional code based on the transaction data and the request to be signed and confirmed, and then sends the two-dimensional code to the system platform via the Internet.

As shown in FIG. 3, the two-dimensional code obtaining step S2 includes:

The two-dimensional code scanning step S21: scanning, by using the mobile phone APP, a two-dimensional code corresponding to the transaction data and the request displayed on the client of the Internet terminal;

The two-dimensional code is transmitted in step S22: the mobile phone APP transmits the two-dimensional code to the transaction security confirmation module.

As shown in FIG. 4, the two-dimensional code transmitting step S22 includes:

The mobile network sends a step S221: the mobile phone APP sends the two-dimensional code to the system platform through the mobile network, and the system platform sends the two-dimensional code to the transaction security confirmation module by using a data message.

or,

The communication channel sends a step S222: the mobile phone APP sends the two-dimensional code to the SIM card through the data channel between the mobile phone and the SIM card, and the transaction security confirmation module acquires the two-dimensional code from the SIM card.

Wherein, as shown in FIG. 3, the transaction security confirmation step S3 includes:

The two-dimensional code parsing step S31: the transaction security confirmation module obtains the transaction data and the request to be signed and confirmed by parsing the two-dimensional code;

The transaction confirmation step S32: the STK menu pops up in the transaction security confirmation module displays the transaction data and the request to be signed and confirmed, and waits for the user to confirm the transaction in the STK menu to generate a transaction confirmation result.

Wherein, as shown in FIG. 3, the transaction security operation step S4 includes:

Signature Step S41: If the user confirms the transaction, the transaction security operation module uses the security module function on the SIM card to perform a transaction confirmation result signature.

Wherein, as shown in FIG. 5, the transaction completion step S5 includes:

The SMS transaction completion step S501: the transaction security confirmation module directly returns the signed transaction confirmation result to the system platform through the data short message;

or,

The communication channel transaction completion step S502: the transaction security confirmation module sends the signed transaction confirmation result to the mobile phone APP through the data channel between the mobile phone and the SIM card, and the mobile phone APP is sent to the system platform through the mobile network.

FIG. 6 is a schematic flowchart of a method for confirming online transaction security by using a mobile phone according to an embodiment of the present invention, as shown in FIG. 6 :

Taking the mobile online banking transfer as an example, the method for confirming the security of online transactions through the mobile phone is further explained as follows:

In a specific embodiment of the present invention, the client is a personal device or a self-service terminal that can support online transactions and has a display screen, including but not limited to a PC, an IPAD, a mobile phone, an ATM machine, and the like.

Step S50: During the client online transaction process, the client generates transaction data and a transfer request to be signed and confirmed. For example, in the online banking transfer page of the client, the user is prompted to input transaction data, such as the account number of the other party, the amount of the transfer, and the like.

Step S51: The system platform generates a two-dimensional code: the client sends the transaction data and the transfer request to be signed and confirmed to the system platform via the Internet, and the system platform generates a corresponding two-dimensional code based on the transaction data and the transfer request to be signed and confirmed. And sending the two-dimensional code to the client through the Internet; or the client generates the two-dimensional code: the client generates a corresponding two-dimensional code based on the transaction data and the transfer request to be signed and confirmed, and then passes the two-dimensional code through the Internet. Send to the system platform.

Step S52: The client displays the two-dimensional code: the client displays the transaction data and the transfer request to be signed and confirmed, and the corresponding two-dimensional code on the transaction confirmation page.

Step S53: The user scans the QR code on the client by using the mobile phone APP.

Step S54: The APP transmits the two-dimensional code to the mobile phone system: the APP sends the two-dimensional code to the system platform through the mobile network, and the system platform sends the two-dimensional code to the mobile phone system through the data short message; or when there is a Bluetooth channel of the machine card The APP sends the QR code to the SIM through the Bluetooth channel of the machine card, and the SIM parses the QR code to obtain the data and the request to be signed, and the mobile phone system acquires the QR code/to be signed data and the request from the SIM, wherein the mobile phone system obtains the second data from the SIM. The specific method of the dimension code/to be signed data and request is as follows:

(1) After the APP sends the QR code to the SiM card through the Bluetooth module of the mobile phone, the APP notifies the system platform to send a specific data message to the mobile phone, triggering the mobile phone system to obtain the QR code/to be signed data and the request from the SIM, and/ or

(2) After the SIM receives the two-dimensional code through the card-end Bluetooth module, the SIM sets the specific response status word in the subsequent 7816 normal command response, and notifies the mobile phone system to obtain the two-dimensional code/signature data and request on the card. . After obtaining the "read data" notification of the SIM, the mobile phone system obtains the two-dimensional code/to-signature data and the request from the SIM by using a specified command. For example, the mobile phone system can obtain the two-dimensional code/to-signature data and the request from the SIM through the Fetch command.

The mobile network includes, but is not limited to, a mobile data network and/or a WiFi wireless network provided by an operator.

Step S55: The mobile phone system parses the two-dimensional code to obtain the to-be-signed verification data and the transfer request, or obtains the data to be signed and the request from the SIM, and then pops up the STK menu to display the transaction data and the transfer request to be signed and confirmed, waiting for the user to be in the STK menu. Confirm the transaction.

Step S56: The user confirms the transaction in the STK menu. The user manually confirms the transaction by selecting "confirm" or "cancel" on the STK menu.

Step S57: If the user confirms to continue the transaction, the mobile phone system uses the security function provided by the security module on the card to perform security operations such as transaction signature.

Step S58: the mobile phone system directly returns the signature confirmation result to the system platform through the data short message; or when the machine card has the Bluetooth channel, the mobile phone system returns the signature confirmation result to the APP through the Bluetooth channel of the machine card, and the APP sends the solution to the system through the mobile network. platform.

Step S59: After receiving the signature confirmation result, the system platform determines whether to continue the subsequent transaction process according to the user signature confirmation result. If the system platform determines to continue the transaction, the system platform executes the transaction request and then sends the transaction result to the client via the Internet.

Step S60: After receiving the transaction result, the client displays it for the user to view.

The present invention also provides a SIM card implemented based on a method for confirming online transaction security by using a mobile phone, and adopting a method for confirming online transaction security by using a mobile phone as described above, and FIG. 7 is a SIM implemented by the method for confirming online transaction security by using a mobile phone according to the present invention. The card logic block diagram, as shown in FIG. 7, includes at least one card end communication module 10, a transaction security operation module 11, and a main control module 12. The card end communication module 10 is configured to perform Bluetooth connection and communication with the mobile terminal communication module 10, and transmit information such as a two-dimensional code and a signature confirmation result; the main control module 12 is used for security control and processing of the card end process; and the transaction security operation module 11 For security operations such as digital signatures, the security module can be a separate module on the card or integrated into a module with the security master module.

The SIM card includes:

Card end communication module 10: for data communication with a mobile phone;

The transaction security operation module 11 is configured to digitally sign the transaction confirmation result of the online transaction by using the smart card security module function;

The main control module 12 is configured to centrally control and process the card end communication module and the transaction security operation module, and send the digital signature transaction confirmation result to the system platform via the mobile phone to complete the online transaction.

The invention also provides a mobile phone realized based on a method for confirming online transaction security by using a mobile phone, and FIG. 8 is a logic block diagram of a mobile phone realized by a method for confirming online transaction security by using a mobile phone, as shown in FIG. The mobile phone confirms the security of online transactions. The mobile phone includes:

The mobile terminal communication module 21 is configured to perform data communication with the SIM card;

The mobile phone APP22 is configured to: acquire the two-dimensional code by scanning a two-dimensional code displayed by the client, and send the two-dimensional code by using the mobile phone end communication module;

The transaction security confirmation module 23 is configured to receive and parse the two-dimensional code sent by the mobile phone APP, restore transaction data and request of the online transaction, and confirm the transaction data and the request through the STK menu of the mobile phone to generate a transaction confirmation result. .

The mobile phone APP22 is responsible for completing the scanning and processing of the two-dimensional code; the mobile terminal communication module 21 is configured to perform Bluetooth connection and communication with the SIM card terminal Bluetooth module, and transmit information such as the two-dimensional code and the signature confirmation result; the transaction security confirmation module 23 is configured to analyze The QR code pops up the STK menu to display the data to be signed and the transaction request, and accepts the user's confirmation input.

The present invention also provides an online transaction system based on a method for confirming online transaction security through a mobile phone, which adopts a method for confirming online transaction security through a mobile phone as described above, and FIG. 9 is a method for confirming online transaction security by using a mobile phone. The logical block diagram of the online trading system, as shown in Figure 9, the online trading system includes:

Client 31: for conducting an online transaction, the client 31 generates transaction data and a request according to the online transaction;

System platform 32: related background service processing for performing online transactions, generating a two-dimensional code based on the transaction data and the request, and transmitting the two-dimensional code to the client for display;

The mobile phone system 33 is configured to: acquire the two-dimensional code by scanning the two-dimensional code displayed by the client, parse the two-dimensional code, restore the transaction data and request, and use the mobile phone STK menu to perform the transaction. The data is confirmed with the request to generate a transaction confirmation result;

The SIM card 34 is configured to digitally sign the transaction confirmation result by using a smart card security module function, and send the digitally signed transaction confirmation result to the system platform via the mobile phone system to complete the entire online transaction.

In another embodiment of the present invention, an online transaction system based on a method for confirming online transaction security by using a mobile phone is provided, and a method for confirming online transaction security by using a mobile phone as described above is used. FIG. 9 is based on the present invention. The online trading system logic block diagram implemented by the online transaction security method, as shown in Figure 9, the online trading system includes:

The client 31 is configured to perform online transactions, and the client 31 generates transaction data and requests according to the online transaction, and generates and displays a two-dimensional code;

System platform 32: related background business processing for conducting online transactions;

As shown in FIG. 9, the mobile phone system 33 includes:

The mobile terminal communication module 331 is configured to perform data communication with the SIM card;

The mobile phone APP 332 is configured to obtain and send a two-dimensional code through the mobile terminal communication module by scanning the two-dimensional code displayed by the client;

The transaction security confirmation module 333 is configured to receive and parse the two-dimensional code sent by the mobile phone APP, restore the transaction data and the request, and confirm the transaction data and the request through the STK menu of the mobile phone to generate a transaction confirmation result.

As shown in FIG. 9, the SIM card 34 includes:

The card end communication module 341 is configured to perform data communication with the mobile phone system;

Transaction security operation module 342: for digitally signing the transaction confirmation result by using the smart card security module function;

The main control module 343 is configured to perform central control and processing on the card end communication module and the transaction security operation module, and send the digital signature transaction confirmation result to the system platform via the mobile phone to complete the online transaction.

In summary, the method and system for confirming online transaction security through a mobile phone according to the present invention can enable a smart phone with a secure smart card to have a "second generation Key" function for online transactions, and the user does not need to use a special smart key (USBKey). Rather, the smart phone with the smart smart card of the present invention can ensure the security of the online transaction, and is convenient to carry at any time, and the user is more convenient to use.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

A system for confirming the security of online transactions through a mobile phone, which is characterized by comprising:

Client: for conducting online transactions, the client generates transaction data and a request according to the online transaction;

a system platform: related background service processing for performing the online transaction, generating a two-dimensional code based on the transaction data and the request, and sending the two-dimensional code to the client for display;

a mobile phone APP: configured to acquire and send the two-dimensional code by scanning the two-dimensional code displayed by the client;

a transaction security confirmation module: for receiving and parsing the two-dimensional code sent by the mobile phone APP, restoring the transaction data and the request, confirming the transaction data and the request through a STK menu of the mobile phone, and generating a transaction confirmation result;

Transaction security operation module: for digitally signing the transaction confirmation result by using a mobile phone smart card security module function;

a main control module: configured to control the transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via the transaction security confirmation module to complete an online transaction, or the main control module The transaction confirmation result of the digital signature is sent to the system platform via the mobile phone APP to complete the online transaction.
A system for confirming the security of online transactions through a mobile phone, which is characterized by comprising:

Client: used for online transaction, the client generates transaction data and request according to the online transaction, and generates and displays a two-dimensional code;

System platform: related background service processing for performing the online transaction;

a mobile phone APP: configured to acquire and send the two-dimensional code by scanning the two-dimensional code displayed by the client;

a transaction security confirmation module: for receiving and parsing the two-dimensional code sent by the mobile phone APP, restoring the transaction data and the request, confirming the transaction data and the request through a STK menu of the mobile phone, and generating a transaction confirmation result;

Transaction security operation module: for digitally signing the transaction confirmation result by using a mobile phone smart card security module function;

a main control module: configured to centrally control the transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via the transaction security confirmation module to complete an online transaction, or the main control The module sends the digitally signed transaction confirmation result to the system platform via the mobile phone APP to complete the online transaction.
A method for confirming online transaction security by using a mobile phone, which is applied to a system for confirming online transaction security by using a mobile phone according to claim 1 or 2, the system comprising: a client, a system platform, a mobile phone APP, a transaction security confirmation module, The transaction security operation module and the main control module are characterized in that: the method comprises:

a two-dimensional code generating step: generating a two-dimensional code based on the transaction data and the request generated by the online transaction, and displaying the two-dimensional code on the client;

a two-dimensional code acquisition step of: scanning, by the mobile phone APP, the two-dimensional code displayed by the client, acquiring and transmitting the two-dimensional code;

a transaction security confirmation step: receiving and parsing the two-dimensional code sent by the mobile phone APP, restoring the transaction data and the request, and confirming the transaction data and the request through a STK menu of the mobile phone to generate a transaction confirmation result;

Transaction security operation step: for digitally signing the transaction confirmation result by using a mobile phone smart card security module function;

a transaction completion step: the transaction security confirmation module sends the signed transaction confirmation result to the system platform, and the system platform determines whether to continue the transaction based on the signed transaction confirmation result, and if the transaction continues, the system platform Execute the transaction request and complete the entire online transaction.
The method for confirming the security of an online transaction by using a mobile phone according to claim 3, wherein the step of generating the two-dimensional code comprises:

Client QR code generation step: the client generates transaction data and request according to the online transaction, and directly generates and displays a two-dimensional code;

or

The system platform two-dimensional code generating step: generating a two-dimensional code based on the transaction data and the request, and transmitting the two-dimensional code to the client for display.
The method for confirming the security of an online transaction of an internet terminal by using a mobile phone according to claim 3, wherein the step of acquiring the two-dimensional code comprises:

a two-dimensional code scanning step: scanning, by using the mobile phone APP, the two-dimensional code displayed on the client of the Internet terminal corresponding to the transaction data and the request;

The two-dimensional code transmitting step: the mobile phone APP transmits the two-dimensional code to the transaction security confirmation module.
The method for confirming the security of an online transaction by using a mobile phone according to claim 5, wherein the step of transmitting the two-dimensional code comprises:

a mobile network sending step: the mobile phone APP sends the two-dimensional code to the system platform through a mobile network, and the system platform sends the two-dimensional code to the transaction security confirmation module by using a data short message;

Or

The communication channel sending step: the mobile phone APP sends the two-dimensional code to the SIM card through a data channel between the mobile phone and the SIM card, and the transaction security confirmation module acquires the two-dimensional code from the SIM card.
The method for confirming online transaction security by using a mobile phone according to claim 3, wherein the transaction security confirmation step comprises:

The two-dimensional code parsing step: the transaction security confirmation module obtains the transaction data and the request to be signed and confirmed by parsing the two-dimensional code;

The transaction confirmation step: the STK menu pops up in the transaction security confirmation module displays the transaction data and the request to be signed and confirmed, and waits for the user to confirm the transaction in the STK menu to generate a transaction confirmation result.
The method for confirming the security of an online transaction by using a mobile phone according to claim 3, wherein the transaction security operation step comprises:

Signature step: If the user confirms the transaction, the transaction security operation module performs the transaction confirmation result signature using the security module function on the SIM card.
The method for confirming online transaction security by using a mobile phone according to claim 3, wherein the transaction completion step comprises:

The short message transaction completion step: the transaction security confirmation module directly returns the signed transaction confirmation result to the system platform through the data short message;

or

a communication channel transaction completion step: the transaction security confirmation module sends the signed transaction confirmation result to the mobile phone APP through a data channel between the mobile phone and the SIM card, and the mobile phone APP is sent to the system platform through the mobile network. .
A SIM card implemented by a method for confirming the security of an online transaction by using a mobile phone, the method for confirming the security of an online transaction by using a mobile phone according to any one of claims 2-9, wherein the SIM card comprises:

Card end communication module: used for data communication with a mobile phone;

Transaction security operation module: used to digitally sign the transaction confirmation result of online transaction by using the mobile phone smart card security module function;

The main control module is configured to centrally control and process the card end communication module and the transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via the mobile phone to complete the online transaction.
A mobile phone based on a method for confirming the security of an online transaction by a mobile phone, the method for confirming the security of an online transaction by using a mobile phone according to any one of claims 2-9, wherein the mobile phone comprises:

Mobile terminal communication module: used for data communication with the SIM card;

The mobile phone APP is configured to: acquire the two-dimensional code by scanning a two-dimensional code displayed by the client, and send the two-dimensional code by using the mobile terminal communication module;

The transaction security confirmation module is configured to receive and parse the two-dimensional code sent by the mobile phone APP, restore the transaction data and the request of the online transaction, and confirm the transaction data and the request through the STK menu of the mobile phone to generate a transaction confirmation result.
An online transaction system based on a method for confirming the security of an online transaction by using a mobile phone, the method for confirming the security of an online transaction by using a mobile phone according to any one of claims 2-9, wherein the online transaction system comprises:

Client: for conducting online transactions, the client generates transaction data and a request according to the online transaction;

a system platform: related background service processing for performing the online transaction, generating a two-dimensional code based on the transaction data and the request, and sending the two-dimensional code to the client for display;

a mobile phone system: configured to scan the two-dimensional code by scanning the two-dimensional code displayed by the client, parse the two-dimensional code, restore the transaction data and request, and use the mobile phone STK menu to process the transaction data. Confirm with the request to generate a transaction confirmation result;

SIM card: used to digitally sign the transaction confirmation result by using the mobile phone smart card security module function, and send the digitally signed transaction confirmation result to the system platform via the mobile phone system to complete the entire online transaction.
An online transaction system based on a method for confirming the security of an online transaction by using a mobile phone, the method for confirming the security of an online transaction by using a mobile phone according to any one of claims 2-9, wherein the online transaction system comprises:

Client: used for online transaction, the client generates transaction data and request according to the online transaction, and generates and displays a two-dimensional code;

System platform: related background service processing for performing the online transaction;

a mobile phone system: configured to scan the two-dimensional code by scanning the two-dimensional code displayed by the client, parse the two-dimensional code, restore the transaction data and request, and use the mobile phone STK menu to process the transaction data. Confirm with the request to generate a transaction confirmation result;

SIM card: used to digitally sign the transaction confirmation result by using the mobile phone smart card security module function, and send the digitally signed transaction confirmation result to the system platform via the mobile phone system to complete the entire online transaction.
The online transaction system based on the method for confirming the security of an online transaction by using a mobile phone according to claim 13, wherein the mobile phone system comprises:

Mobile terminal communication module: used for data communication with the SIM card;

The mobile phone APP is configured to acquire and send the two-dimensional code by using the mobile phone end communication module by scanning the two-dimensional code displayed by the client;

The transaction security confirmation module is configured to receive and parse the two-dimensional code sent by the mobile phone APP, restore the transaction data and the request, and confirm the transaction data and the request through the STK menu of the mobile phone to generate a transaction confirmation result.
The online transaction system based on the method for confirming the security of an online transaction by using a mobile phone according to claim 13, wherein the SIM card comprises:

Card end communication module: used for data communication with the mobile phone system;

Transaction security operation module: for digitally signing the transaction confirmation result by using a mobile phone smart card security module function;

The main control module is configured to centrally control and process the card end communication module and the transaction security operation module, and send the digitally signed transaction confirmation result to the system platform via the mobile phone to complete the online transaction.