WO2018019134A1 - 验证码短信的处理方法及终端 - Google Patents

验证码短信的处理方法及终端 Download PDF

Info

Publication number
WO2018019134A1
WO2018019134A1 PCT/CN2017/092863 CN2017092863W WO2018019134A1 WO 2018019134 A1 WO2018019134 A1 WO 2018019134A1 CN 2017092863 W CN2017092863 W CN 2017092863W WO 2018019134 A1 WO2018019134 A1 WO 2018019134A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification code
short message
terminal
certificate
code short
Prior art date
Application number
PCT/CN2017/092863
Other languages
English (en)
French (fr)
Inventor
李茹
彭峰
王梓
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to MYPI2019000194A priority Critical patent/MY201886A/en
Publication of WO2018019134A1 publication Critical patent/WO2018019134A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Definitions

  • the present application relates to the field of communications, and in particular, to a method and a terminal for processing a verification code short message.
  • SMS verification code is a common means to improve security.
  • the terminal when the terminal receives the verification code short message, the terminal automatically parses the verification code short message and obtains the verification code from the verification code short message.
  • the present invention provides a verification code short message processing method and a terminal, and aims to solve the problem that the manner in which the terminal automatically obtains the verification code is not high.
  • a first aspect of the present application provides a method for processing a verification code short message, including the following steps: a terminal receives a verification code short message including a sender identity information of a verification code short message, and performs a query according to a correspondence between the stored information and the certificate.
  • the certificate corresponding to the sender identity information of the verification code short message if the certificate corresponding to the sender identity information of the verification code short message matches the certificate of the webpage currently accessed by the terminal, the terminal passes the
  • the verification code short message is encrypted in the trusted execution environment TEE to obtain a ciphertext, and the verification code is obtained by decrypting the ciphertext in the rich execution environment REE.
  • the terminal after receiving the verification code short message, the terminal does not directly parse the verification code from the verification code short message, but the certificate corresponding to the identity information of the sender of the verification code short message and the webpage currently accessed by the terminal.
  • the terminal obtains the verification code, and the terminal obtains the verification code by encrypting the verification code short message in the TEE first, and then decrypting the ciphertext in the REE, which has higher security.
  • a second aspect of the present application provides a terminal, including: a communication module, a query module, an encryption module, and a verification code acquisition module.
  • the communication module is configured to receive a verification code short message including the sender identity information of the verification code short message.
  • the querying module is configured to query, according to the correspondence between the stored information and the certificate, a certificate corresponding to the identity information of the sender of the verification code short message.
  • the cryptographic module is configured to encrypt the verification code short message in the trusted execution environment TEE if the certificate corresponding to the sender identity information of the verification code short message matches the certificate of the webpage currently accessed by the terminal , get the ciphertext.
  • the verification code acquisition module is configured to obtain a verification code by decrypting the ciphertext in the rich execution environment REE.
  • the terminal matches the certificate corresponding to the sender identity information of the verification code short message and the certificate of the webpage currently accessed by the terminal, the terminal acquires the verification code, and the terminal first encrypts the verification code short message in the TEE, and then decrypts in the REE.
  • the ciphertext method is verified by a verification code and has higher security.
  • the communication module and the query module are disposed in a baseband communication system. Because the baseband communication system is the underlying system for the terminal to communicate with other devices, the advantage of storing the corresponding relationship in the baseband processing system and judging whether the certificates match is that the upper layer application does not need to participate in the query and judgment, that is, the upper layer application is non-inductive, so It can reduce the possibility of interference judgment by application software.
  • the verification code acquisition module includes: a decryption module and a browser module.
  • the solution The secret module is configured to obtain the verification code short message by decrypting the ciphertext in the REE by using the key obtained from the TEE when the type of the ciphertext is a verification code short message.
  • the browser module is configured to obtain the verification code short message, and obtain the verification code from the verification code short message.
  • the specific implementation manner of the browser module acquiring the verification code short message is: acquiring the verification code short message by using a security interface.
  • the goal is to improve safety.
  • the decrypting module is further configured to: after the obtaining the verification code short message, send a notification to the browser module, where the notification carries sender identity information of the verification code short message.
  • the specific implementation manner of the browser module acquiring the verification code from the verification code short message is: when the certificate of the currently accessed webpage matches the sender identity information of the verification code short message, The verification code is obtained in the verification code short message.
  • the purpose of the browser module to verify again is that the browser module once again confirms whether the currently accessed web page is a web page that needs to be verified, so as to further improve security.
  • the specific implementation manner of obtaining the verification code by decrypting the ciphertext in the REE is: if it is determined that the type of the ciphertext is a verification code type short message, the method obtained from the TEE is used. The key decrypts the ciphertext in the REE to obtain a verification code.
  • the purpose of determining the ciphertext type as the verification code type message and then decrypting the ciphertext is to avoid unnecessary decryption process and save resources.
  • a third aspect of the present application provides a method for processing a verification code short message, including the following steps: the terminal receives a verification code short message, and the verification code short message includes sender identity information of the verification code short message. And the terminal, according to the correspondence between the stored information and the certificate, querying a certificate corresponding to the sender identity information of the verification code short message, and the certificate corresponding to the sender identity information of the verification code short message and the terminal In the case that the certificates of the currently accessed web pages match, the terminal acquires the verification code from the verification code short message.
  • the terminal After receiving the verification code short message, the terminal does not directly parse the verification code from the verification code short message, and the certificate corresponding to the sender identity information of the verification code short message matches the certificate of the webpage currently accessed by the terminal. In this case, the terminal obtains the verification code, which is more secure.
  • a fourth aspect of the present application provides a terminal, including: a communication module, a query module, and a verification code acquisition module.
  • the communication module is configured to receive a verification code short message, where the verification code short message includes sender identity information of the verification code short message.
  • the querying module is configured to query, according to the correspondence between the stored information and the certificate, a certificate corresponding to the identity information of the sender of the verification code short message.
  • the verification code acquisition module is configured to obtain a verification code from the verification code short message if the certificate corresponding to the sender identity information of the verification code short message matches the certificate of the webpage currently accessed by the terminal.
  • the verification code acquisition module includes: a determination module and a browser module.
  • the determining module is configured to determine whether the certificate corresponding to the sender identity information of the verification code short message matches the certificate of the webpage currently accessed by the terminal.
  • the browser module is configured to acquire the verification code short message when the certificate corresponding to the sender identity information of the verification code short message matches the certificate of the webpage currently accessed by the terminal, and obtain the verification code from the verification code Get the verification code in the SMS.
  • the determining module is further configured to: before determining whether the certificate corresponding to the sender identity information of the verification code short message matches the certificate of the webpage currently accessed by the terminal, The browser module sends a notification, and the notification carries the certificate corresponding to the sender identity information.
  • the browser module is further configured to: when the certificate corresponding to the sender identity information matches the certificate of the currently accessed webpage, send the certificate of the currently visited webpage to the determining module .
  • the method before the receiving the verification code short message, further includes: the terminal determining to access the currently visited webpage for the first time, or sending the login or registration information to the server of the currently accessed webpage.
  • the server that obtains the sender identity information of the verification code short message is sent to the server of the currently visited webpage.
  • Receiving, by the terminal, the sender identity information of the verification code short message sent by the server of the currently accessed webpage and the certificate of the currently accessed webpage, and storing the sender identity information of the verification code short message and the current The correspondence of the certificates of the visited web pages.
  • the first time accessing the currently visited webpage or sending the login or registration information to the server of the currently visited webpage indicates that the terminal has the possibility of obtaining the verification code, and only sends the verification code when the authentication code is available. Get the request to save resources.
  • 1 is a schematic structural view of a terminal
  • FIG. 2 is a flowchart of a method for processing a verification code short message disclosed in an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 4 is a flowchart of processing a verification code short message by a terminal according to an embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of setting a verification code short message open API in a terminal according to an embodiment of the present disclosure
  • FIG. 6 is a schematic diagram of an interface for processing a verification code short message by a terminal according to an embodiment of the present disclosure
  • FIG. 7 is a flowchart of still another method for processing a verification code short message according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of still another terminal according to an embodiment of the present disclosure.
  • FIG. 9 is a flowchart of still processing a verification code short message by a terminal according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of still another terminal disclosed in an embodiment of the present application.
  • Figure 1 shows a terminal.
  • Rich Execution Environment with powerful processing and multimedia functions, such as Android environment, and trusted execution environment.
  • TEE Trusted Executive Environment
  • Android environment can run an operating system, running SMS APK (English: Android Package) in the operating system.
  • TEE is an operating environment that coexists with REE on the terminal. Compared to REE, TEE is a security area in the main processor, ensuring that all kinds of sensitive data are stored, processed and protected in a trusted environment, thus being REE.
  • the operating system provides security services. It has its own execution space and is more secure than the REE operating system.
  • TEE is not a stand-alone physical security chip, but a security architecture that overlaps with the hardware architecture of the application processor currently in use.
  • the hardware and software resources that TEE can access are separate from the REE operating system and provide hardware-supported isolation.
  • the trusted application runs in the TEE and is separate from the REE operating system to prevent malware attacks.
  • the terminal may need to verify the server through the webpage. Specifically, the terminal receives the verification code short message sent by the server of the webpage, and after obtaining the verification code from the verification code short message, sends the verification code to the server of the webpage. The server of the web page verifies the verification code.
  • the method for processing the verification code short message provided by the application is applied to the terminal shown in FIG. 1 , and the purpose is to improve the security of the terminal to obtain the verification code from the received verification code short message.
  • FIG. 2 is a flowchart of a method for processing a verification code short message according to an embodiment of the present application, including the following steps:
  • S201 The terminal determines whether to access the currently visited webpage for the first time, or whether the login or registration instruction is sent to the server of the currently accessed webpage, if yes, execute S202, if no, do not process or periodically execute S201.
  • the first time accessing the currently visited web page, or sending a login or registration command to the server of the currently accessed web page means that the terminal may obtain the verification code short message from the server of the currently accessed web page. That is to say, S201 is a process in which the terminal predicts whether it is possible to obtain a verification code short message.
  • the terminal may determine whether there is an optional way to obtain the verification code short message, which is only an option for saving resources, and the purpose is to save resources, and S201 may be directly executed by skipping S201.
  • S202 The terminal sends a request for acquiring the sender identity information of the verification code short message to the server of the currently accessed webpage.
  • the sender identity information of the verification code short message may be a phone number used for sending the verification code short message, or information about the related enterprise of the webpage (including but not limited to the name of the enterprise), or a phone number and a webpage used for sending the verification code short message. Information about related companies.
  • the identity information of the sender of the verification code SMS can be the customer service telephone number 95566 of the Bank of China and the name: Bank of China.
  • S203 The terminal receives the sender identity information of the verification code short message sent by the server of the currently accessed webpage.
  • S204 The terminal acquires a certificate of the currently accessed webpage.
  • S204 may also be executed before S201, S202 or S203.
  • the terminal stores a correspondence between a certificate of the currently accessed webpage and a sender identity information of the verification code short message.
  • the above is a process of the correspondence between the sender identity information of the terminal registration verification code short message and the certificate of the webpage, and the stored correspondence relationship is used as a judgment basis for whether to obtain the verification code from the verification code short message.
  • S206 The terminal sends a verification code acquisition request to the server of the currently accessed webpage.
  • the terminal may send a verification code acquisition request to the server of the currently accessed webpage according to the operation of the user.
  • the user registers on the official website of the Bank of China through the terminal, and according to the prompt information of the official website of the Bank of China, clicks the button of “acquire verification code” to trigger the terminal to send a verification code acquisition request to the server of the official website of the Bank of China.
  • S207 The verification code short message sent by the server that receives the webpage by the terminal.
  • the verification code text message includes a verification code, a phone number for sending a verification code text message, and a business name.
  • S208 The terminal queries the certificate corresponding to the sender identity information (phone number and/or enterprise name) of the verification code short message received in S207 according to the correspondence between the sender identity information of the stored verification code short message and the certificate.
  • S209 The terminal determines whether the queried certificate matches the certificate of the currently accessed webpage, and if yes, executes S210, and if not, processes the verification code short message according to the existing short message processing flow.
  • S210 The terminal encrypts the verification code short message in the TEE to obtain the ciphertext.
  • the trusted code application (English: Trusted Application, TA) can be used to encrypt the verification code SMS in the TEE.
  • the verification code short message ciphertext obtained in the TEE has higher security.
  • S211 The terminal determines, in the REE, whether the type of the ciphertext is a verification code short message, and if yes, executes S212, and if not, processes according to the existing short message processing flow.
  • S212 The terminal decrypts the ciphertext in the REE to obtain a verification code.
  • S213 The terminal sends the verification code to the server of the webpage for verification.
  • the terminal when the terminal matches the certificate corresponding to the sender of the verification code with the locally registered certificate, the terminal obtains the verification code from the verification code short message, and for any verification.
  • the code short message automatically obtains the verification code, it can effectively avoid the attack by the verification code short message (for example, changing the phone number after intercepting the verification code message, thereby intercepting the verification code), thereby achieving higher security.
  • FIG. 3 is a specific structure of the terminal shown in FIG. 1, including: a communication module, a query module, an encryption module, a decryption module, a browser module, a judgment module, and a storage module.
  • the encryption module may be set in the TEE
  • the communication module, the storage module, the query module, and the judgment module may be disposed in the baseband communication system of the terminal.
  • the browser module and the decryption module can be set in the REE.
  • the decryption module and the browser module together form a verification code acquisition module.
  • FIG. 4 is a flowchart of a method for cooperatively acquiring a verification code between each module in the terminal shown in FIG. 3, including the following steps:
  • the browser module determines whether to access the currently accessed webpage for the first time, or whether the login or registration instruction is sent to the server of the currently accessed webpage, if yes, execute S402, if not, do not process or periodically execute S401.
  • the communication module sends a request for obtaining a phone number to the server of the webpage (in this embodiment, the verification code SMS sender identity information is exemplified by a phone number).
  • the communication module sends a phone number sent by the server of the webpage that may send the verification code short message, and sends the phone number to the storage module.
  • the browser module acquires a certificate of the currently accessed webpage.
  • the browser module sends the obtained certificate to the storage module.
  • the storage module stores a correspondence between a phone number and a certificate.
  • a whitelist may be stored in the baseband communication system, and the storage module stores the correspondence between the phone number and the certificate into the whitelist.
  • S401 to S406 are registration procedures for the correspondence between the telephone number and the certificate.
  • the difference from the procedure shown in FIG. 2 is that in the present embodiment, the correspondence between the telephone number and the certificate is stored in the baseband communication system.
  • the browser module receives the verification code acquisition command input by the user.
  • the communication module sends a verification code acquisition request to a server of the currently accessed webpage.
  • the browser module requests a verification code short message from the decryption module.
  • the communication module sends a verification code short message sent by a server of the webpage.
  • the query module queries, according to the correspondence between the phone number and the certificate of the webpage, the certificate of the webpage corresponding to the phone number of the verification code SMS included in the verification code short message.
  • the determining module determines whether the certificate of the webpage corresponding to the phone number of the verification code text message is the same as the certificate of the webpage currently accessed by the browser module. If yes, execute S413. If not, send the short message to the related device in the REE environment. It is processed by the relevant device in the REE environment according to the traditional SMS processing flow.
  • the baseband processing system is the underlying system for the terminal to communicate with other devices, the advantage of storing the correspondence in the baseband processing system and determining whether the certificates match is that the upper layer application does not need to participate in the query and judgment, that is, the upper layer application is non-inductive, so It can reduce the possibility of interference judgment by application software.
  • the communication module sends the verification code short message to the encryption module.
  • the encryption module encrypts the verification code short message. Specifically, the encryption module may encrypt the verification code short message by using a trusted application (TA: Trusted Application, TA) in the TEE.
  • TA Trusted Application
  • the encryption module sends the verification code short message ciphertext and the encryption key to the decryption module.
  • the encryption key is a one-time use key to further improve the security of the verification code ciphertext.
  • the decryption module decrypts the short message ciphertext and analyzes the text, and determines that the encrypted short message is the verification code short message type. If the verification code is the short message, the process proceeds to S417, otherwise (for example, an advertisement short message), and processes according to the existing short message processing flow.
  • the decryption module stores the verification code short message ciphertext in the transaction short message encryption database of the REE.
  • the decryption module sends a notification of receiving the short message to the browser module, where the notification carries a certificate corresponding to the phone number for sending the verification short message.
  • the browser module determines whether the certificate of the current webpage is the same as the certificate carried in the notification, and if yes, executes S420, and if not, does not respond.
  • S419 is an optional step, and the purpose is that if the browser module opens multiple web pages (multi-tags) at the same time, if the currently displayed webpage is not a webpage that needs to obtain a verification code, the user may temporarily In the operation of the original webpage, the browser module does not respond, and the current webpage is not allowed to obtain the verification code, which can improve the security and user experience.
  • the browser module sends a verification code short message acquisition request to the decryption module through the security interface.
  • the decryption module obtains the verification code short message ciphertext from the transaction short message encryption database, and decrypts the verification code short message ciphertext by using the encryption key.
  • the decryption module sends the plaintext of the verification code short message to the browser module through the security interface.
  • the security interface is an authentication API short message open API shown in FIG. 5, and the security interface is characterized by high security, and can be used in plaintext between an application that is legally authenticated in advance, such as a browser module.
  • the browser module extracts the verification code from the verification code short message and fills in the verification code input box in the webpage.
  • the communication module sends a verification code to a server of the webpage.
  • the server of the webpage verifies the verification code and returns a verification result to the receiving module.
  • the browser module performs a corresponding operation according to the verification result.
  • the webpage certificate is bound to the short message number, and the system does not broadcast the message of receiving the verification code short message, and the directional notification browser module receives the notification of the short message, and the browser module determines whether the current page is legal through the certificate, and Directly obtain verification code SMS, so that the browser can automatically obtain the verification code, which is open to the existing browser module.
  • SMS read rights which reduces the risk of sensitive information disclosure compared to browser modules that can read all text messages.
  • the security of the verification code can be further improved, and the risk of the verification code being leaked and stolen is reduced.
  • FIG. 6 A schematic diagram of an interface for automatically extracting a verification code based on the flow shown in FIG. 4 is shown in FIG. 6.
  • FIG. 7 is still another method for processing a verification code short message according to an embodiment of the present application, which includes the following steps:
  • S701 The terminal determines whether to access the currently accessed webpage for the first time, or whether to send a login or registration instruction to the server of the currently accessed webpage, if yes, execute S702, if no, do not process or periodically execute S701.
  • S702 The terminal sends a request for obtaining the sender identity information of the verification code short message to the server of the currently accessed webpage.
  • S703 The terminal receives the sender identity information of the verification code short message sent by the server of the currently accessed webpage.
  • S704 The terminal acquires a certificate of the currently accessed webpage.
  • the terminal stores a correspondence between a certificate of the currently accessed webpage and a sender identity information of the verification code short message.
  • the above is a process of the correspondence between the sender identity information of the terminal registration verification code short message and the certificate of the webpage, and the stored correspondence relationship is used as a judgment basis for whether to obtain the verification code from the verification code short message.
  • S706 The terminal sends a verification code acquisition request to the server of the currently accessed webpage.
  • S707 The verification code short message sent by the server that receives the webpage by the terminal.
  • S708 The terminal queries the certificate corresponding to the sender identity information (phone number and/or enterprise name) of the verification code short message received in S707 according to the correspondence between the sender identity information of the stored verification code short message and the certificate.
  • S709 The terminal determines whether the queried certificate matches the certificate of the currently accessed webpage, and if yes, executes S710, and if not, processes the verification code short message according to the existing short message processing flow.
  • S710 The terminal obtains the verification code from the verification code short message.
  • S711 The terminal sends the verification code to the server of the webpage for verification.
  • FIG. 8 is a schematic structural diagram of another terminal according to an embodiment of the present disclosure, including: a communication module, a query module, and a verification code acquisition module.
  • a communication module including: a communication module, a query module, and a verification code acquisition module.
  • the verification code acquisition module includes a browser module and a determination module.
  • Each module in the terminal shown in FIG. 9 implements automatic acquisition of the verification code by the following steps:
  • the browser module determines whether the terminal accesses the currently accessed webpage for the first time, or sends a login or registration information to the server of the currently accessed webpage. If yes, execute S802. If no, do not process or cycle. S901 is executed.
  • the communication module sends a phone number that may be sent by the server of the webpage to send a verification code short message.
  • the browser module sends the certificate of the currently accessed webpage to the storage module.
  • the storage module checks whether the correspondence between the phone number and the certificate has been stored. If not, stores the correspondence between the phone number and the certificate. If yes, execute S905.
  • the whitelist of the verification code short message processing device may be preset, and the correspondence between the phone number and the certificate is closed.
  • the system is stored in the white list.
  • S901 to S904 are processes for registering the correspondence between the telephone number and the certificate in the verification code short message processing device.
  • the browser module receives the verification code acquisition command.
  • the verification code acquisition command is a command that the user starts by clicking a button (possibly a virtual button) of the “acquire verification code” displayed on the webpage.
  • the communication module sends a verification code acquisition request to a server of the currently accessed webpage.
  • the communication module receives the verification code short message sent by the server of the currently accessed webpage.
  • the query module query and the verification code short message include a certificate corresponding to the sender's phone number.
  • the determining module broadcasts the notification of receiving the short message, and the notification carries the certificate queried in S908.
  • the browser module determines whether the certificate of the currently displayed webpage is the same as the certificate carried in the notification, and if yes, executes S911, and if not, does not respond.
  • the S910 is an optional step, and the purpose is that if the webpage that is currently displayed is not a webpage that needs to obtain a verification code when the browser opens multiple webpages (multi-tag) at the same time, the user may temporarily not operate the original webpage.
  • the browser module does not respond, and does not allow the current web page to obtain a verification code, which can improve security and user experience.
  • the browser module sends a certificate of the currently accessed webpage to the determining device.
  • the determining module determines whether the received certificate is the same as the certificate queried in S908. If yes, execute S913. If no, execute S918.
  • the determining module sends a verification code short message to the browser module.
  • the browser module extracts the verification code from the verification code short message and fills in the verification code input box in the webpage.
  • the communication module sends a verification code to a server of the currently accessed webpage.
  • the server of the currently accessed webpage verifies the verification code and returns a verification result to the browser.
  • the browser module performs a corresponding operation according to the verification result.
  • the determining module refuses to send a verification code short message to the browser module.
  • the verification code text message is sent to the browser module, and the browser module can obtain the verification code from the verification code short message.
  • the browser can automatically obtain the verification code.
  • the automatic verification code acquisition process described in this embodiment is different from the automatic acquisition and filling of the verification code in the prior art.
  • the application obtains the right to read the short message, and receives the short message. After that, the verification code can be automatically extracted. Based on this mechanism, once the application obtains the right to read the short message, the application can obtain the right to read any short message, which will undoubtedly increase the risk of leakage of sensitive information, and the application can not only read the normal verification code message. It can also read other text messages sent and received when the user normally uses the SMS application, which is easy to cause leakage of user privacy.
  • the browser module when the certificate of the webpage that obtains the verification code matches the certificate sent by the registered verification code, the browser module can obtain the verification code short message, and does not open the short message to the browser module. Permissions enable the browser module to read all text messages. Therefore, the method described in this embodiment achieves the purpose of automatically filling the verification code by the browser on the basis of ensuring high security.
  • FIG. 10 is still another terminal disclosed in the embodiment of the present application, including a communication component, a memory, and a processor.
  • the storage is used to store the correspondence between the identity information of the sender of the verification code short message and the certificate, and the storage The application and the data generated during the running of the application.
  • the communication component is configured to receive a verification code short message including the sender identity information of the verification code short message
  • the processor is configured to query, according to the correspondence between the stored information and the certificate, a certificate corresponding to the identity information of the sender of the verification code short message, and If the certificate corresponding to the sender identity information of the verification code short message matches the certificate of the webpage currently accessed by the terminal, the ciphertext is obtained by encrypting the verification code short message in the trusted execution environment TEE. And obtaining the verification code by decrypting the ciphertext in the rich execution environment REE.
  • the specific implementation manner of obtaining the verification code by decrypting the ciphertext in the REE may be: if it is determined that the type of the ciphertext is a verification code type short message, the method obtained from the TEE is used. The key decrypts the ciphertext in the REE to obtain a verification code.
  • the processor is further configured to determine whether to access the currently accessed webpage for the first time, or whether to send login or registration information to the server of the currently accessed webpage
  • the communication component is further configured to receive the verification code short message.
  • the processor determines to access the currently accessed webpage for the first time, or sends login or registration information to the server of the currently accessed webpage, sending the verification code to the server of the currently accessed webpage.
  • a request for the sender identity information of the short message and receiving the sender identity information of the verification code SMS sent by the server of the currently accessed webpage and the certificate of the currently accessed webpage.
  • the processor is further configured to store a correspondence between the sender identity information of the verification code short message and the certificate of the currently accessed webpage.
  • the function of the terminal shown in FIG. 10 may also be as follows: the processor is configured to query, according to the correspondence between the stored information and the certificate, a certificate corresponding to the sender identity information of the verification code short message, and in the When the certificate corresponding to the sender identity information of the verification code message matches the certificate of the webpage currently accessed by the terminal, the verification code is obtained from the verification code short message.
  • the functions of the communication components are as described above and will not be described here. The specific implementation process of the function can be seen in Figure 7.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Accounting & Taxation (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Finance (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • Information Transfer Between Computers (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Telephonic Communication Services (AREA)
  • Telephone Function (AREA)

Abstract

本申请提供了一种验证码短信的处理方法及终端，终端接收包括验证码短信的发送方身份信息的验证码短信，依据信息与证书的对应关系，查询与验证码短信的发送方身份信息对应的证书，在与验证码短信的发送方身份信息对应的证书与当前访问的网页的证书匹配的情况下，通过在可信执行环境TEE中加密验证码短信，得到密文，并通过在富执行环境REE中解密密文，得到验证码。可见，终端在接收到验证码短信后，不是直接从验证码短信中解析出验证码，而在验证码短信的发送方身份信息对应的证书与当前访问的网页的证书匹配的情况下，才获取验证码，并且，终端以先在TEE中加密验证码短信，再在REE中解密密文的方式得到验证码，具有更高的安全性。

Description

验证码短信的处理方法及终端 技术领域
本申请涉及通信领域，尤其涉及验证码短信的处理方法及终端。
背景技术
随着移动支付产业的兴起，移动支付的安全问题越来越受到关注，而传统的密码登陆已经不能满足移动支付的安全需求，短信验证码为一种提高安全性的常用手段。
目前，为了实现浏览器自动获取验证码的目的，当终端接收到验证码短信后，会自动解析验证码短信，从验证码短信中获取验证码。
而这种自动从验证码短信中获取验证码的方式的安全性不高。
发明内容
本申请提供了一种验证码短信处理方法及终端，目的在于解决终端自动获取验证码的方式安全性不高的问题。
为了实现上述目的，本申请提供了以下技术方案：
本申请的第一方面提供了一种验证码短信的处理方法，包括以下步骤：终端接收包括验证码短信的发送方身份信息的验证码短信，并依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书，在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，所述终端通过在可信执行环境TEE中加密所述验证码短信，得到密文，并通过在富执行环境REE中解密所述密文，得到验证码。可见，与现有技术相比，终端在接收到验证码短信后，不是直接从验证码短信中解析出验证码，而在验证码短信的发送方身份信息对应的证书与终端当前访问的网页的证书匹配的情况下，终端才获取验证码，并且，终端以先在TEE中加密验证码短信，再在REE中解密密文的方式得到验证码，具有更高的安全性。
本申请的第二方面提供了一种终端，包括：通信模块、查询模块、加密模块和验证码获取模块。其中，通信模块用于接收包括验证码短信的发送方身份信息的验证码短信。查询模块用于依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书。加密模块用于在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，通过在可信执行环境TEE中加密所述验证码短信，得到密文。验证码获取模块用于通过在富执行环境REE中解密所述密文，得到验证码。终端在验证码短信的发送方身份信息对应的证书与终端当前访问的网页的证书匹配的情况下，终端才获取验证码，并且，终端以先在TEE中加密验证码短信，再在REE中解密密文的方式得到验证码，具有更高的安全性。
在一个实现方式中，所述通信模块和所述查询模块设置在基带通信系统中。因为基带通信系统为终端与其它设备通信的底层系统，因此，在基带处理系统中存储对应关系并判断证书是否匹配的优点在于，无需上层应用参与查询和判断，即上层应用是无感的，所以能够降低通过应用软件干扰判断的可能性。
在一个实现方式中，所述验证码获取模块包括：解密模块和浏览器模块。其中，解 密模块用于在所述密文的类型为验证码短信的情况下，使用从所述TEE中获取的所述密钥，通过在所述REE中解密所述密文，得到所述验证码短信。浏览器模块用于获取所述验证码短信，并从所述验证码短信中获取所述验证码。
在一个实现方式中，所述浏览器模块获取所述验证码短信的具体实现方式为：通过安全接口，获取所述验证码短信。目的在于提高安全性。
在一个实现方式中，所述解密模块还用于：在所述得到所述验证码短信之后，向所述浏览器模块发送通知，所述通知携带所述验证码短信的发送方身份信息。所述浏览器模块从所述验证码短信中获取所述验证码的具体实现方式为：在所述当前访问的网页的证书与所述验证码短信的发送方身份信息匹配的情况下，从所述验证码短信中获取所述验证码。解密模块向浏览器模块通知后，浏览器模块再次验证的目的在于，浏览器模块再一次确认当前访问的网页是否为需要进行验证的网页，以进一步提高安全性。
在一个实现方式中，通过在REE中解密所述密文，得到验证码的具体实现方式为：如果确定所述密文的类型为验证码类短信，则使用从所述TEE中获取的所述密钥在所述REE中解密所述密文，得到验证码。先确定密文的类型为验证码类短信再解密密文的目的在于，能够避免不必要的解密过程，从而节省资源。
本申请的第三方面提供了一种验证码短信的处理方法，包括以下步骤：终端接收验证码短信，所述验证码短信中包括所述验证码短信的发送方身份信息。所述终端依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书，在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，所述终端从所述验证码短信中获取验证码。与现有技术相比，终端在接收到验证码短信后，不是直接从验证码短信中解析出验证码，而在验证码短信的发送方身份信息对应的证书与终端当前访问的网页的证书匹配的情况下，终端才获取验证码，从而具有更高的安全性。
本申请的第四方面提供了一种终端，包括：通信模块、查询模块和验证码获取模块。其中，通信模块用于接收验证码短信，所述验证码短信中包括所述验证码短信的发送方身份信息。查询模块用于依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书。验证码获取模块用于在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，从所述验证码短信中获取验证码。
在一个实现方式中，所述验证码获取模块包括：判断模块和浏览器模块。其中，判断模块用于判断所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书是否匹配。浏览器模块用于在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，获取所述验证码短信，并从所述验证码短信中获取验证码。
在一个实现方式中，所述判断模块还用于：在所述判断所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书是否匹配之前，向所述浏览器模块发送通知，所述通知携带所述与所述发送方身份信息对应的证书。所述浏览器模块还用于：在所述与所述发送方身份信息对应的证书与所述当前访问的网页的证书匹配的情况下，向所述判断模块发送所述当前访问的网页的证书。
在一个实现方式中，所述接收验证码短信之前，还包括：所述终端在确定第一次访问所述当前访问的网页，或者向所述当前访问的网页的服务器发送过登陆或注册信息的情况下，则向所述当前访问的网页的服务器发送获取所述验证码短信的发送方身份信息的请求。所述终端接收所述当前访问的网页的服务器发送的所述验证码短信的发送方身份信息和所述当前访问的网页的证书，并存储所述验证码短信的发送方身份信息与所述当前访问的网页的证书的对应关系。第一次访问所述当前访问的网页，或者向所述当前访问的网页的服务器发送过登陆或注册信息则说明终端有获取验证码的可能性，在有获取验证码的可能情况下，才发送获取请求，目的在于节省资源。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为终端的结构示意图；
图2为本申请实施例公开的验证码短信的处理方法的流程图；
图3为本申请实施例公开的一种终端的结构示意图；
图4为本申请实施例公开的一种终端进行验证码短信的处理的流程图；
图5为本申请实施例公开的终端中设置验证码短信开放API的示意图；
图6为本申请实施例公开的一种终端进行验证码短信的处理的界面示例图；
图7为本申请实施例公开的又一种验证码短信的处理方法的流程图；
图8为本申请实施例公开的又一种终端的结构示意图；
图9为本申请实施例公开的又一种终端进行验证码短信的处理的流程图；
图10为本申请的实施例公开的又一种终端的结构示意图。
具体实施方式
图1所示为一种终端，为了提升安全性，终端上设置有两个环境：运行具有强大处理能力和多媒体功能的富执行环境(Rich Execution Environment，REE)例如Android环境，以及可信执行环境(Trusted Executive Environment，TEE)。其中，在Android环境中可以运行有操作系统，在操作系统中运行短信APK(英文：Android Package)。
TEE是终端上与REE并存的运行环境，相对于REE而言，TEE是主处理器中的一个安全区域，确保各种敏感数据在一个可信环境中被存储、处理和受到保护，从而为REE操作系统提供安全服务。它具有其自身的执行空间，比REE操作系统的安全级别更高。TEE并不是独立的物理安全芯片，而是与目前使用的应用处理器的硬件架构重叠在一起的安全架构。TEE所能访问的软硬件资源是与REE操作系统分离的，提供硬件支持的隔离。可信应用程序运行于TEE中，与REE操作系统分开，可防止恶意软件攻击。
终端在访问网页的过程中，可能需要通过网页的服务器的验证，具体的，终端接收到网页的服务器发送的验证码短信，从验证码短信中获取验证码后，向网页的服务器发送验证码，网页的服务器对于验证码进行验证。
本申请提供的验证码短信的处理方法，应用在图1所示的终端上，目的在于，提升终端从接收到的验证码短信中获取验证码的安全性。
图2为本申请实施例公开的验证码短信的处理方法的流程，包括以下步骤：
S201：终端判断是否第一次访问当前访问的网页，或者，是否向当前访问的网页的服务器发送过登陆或注册指令，如果是，则执行S202，如果否，则不作处理或周期性执行S201。
第一次访问当前访问的网页，或者，向当前访问的网页的服务器发送过登陆或注册指令，意味着终端有可能从当前访问的网页的服务器获取验证码短信。也就是说，S201是终端对于是否可能获取验证码短信的一个预判的过程。
需要说明的是，终端判断是否有获取验证码短信的可能仅为节省资源的一种可选方式，目的在于节省资源，也可以跳过S201直接执行S202。
S202：终端向当前访问的网页的服务器发送获取验证码短信的发送方身份信息的请求。
具体地，验证码短信的发送方身份信息可以为发送验证码短信使用的电话号码、或者网页的相关企业的信息(包括但不限于企业的名称)、或者发送验证码短信使用的电话号码和网页的相关企业的信息。
例如，对于中国银行的官网，验证码短信的发送方身份信息可以为中国银行的客服电话号码95566以及名称：中国银行。
S203：终端接收当前访问的网页的服务器发送的验证码短信的发送方身份信息。
S204：终端获取当前访问的网页的证书。
S204也可能在S201、S202或者S203之前执行。
S205：终端存储当前访问的网页的证书和验证码短信的发送方身份信息的对应关系。
以上为终端注册验证码短信的发送方身份信息与网页的证书的对应关系的过程，存储的对应关系作为是否从验证码短信中获取验证码的判断依据。
S206：终端向当前访问的网页的服务器发送验证码获取请求。
具体的，终端可以依据用户的操作向当前访问的网页的服务器发送验证码获取请求。例如，用户通过终端在中国银行的官网上进行注册，根据中国银行的官网上的提示信息，点击“获取验证码”的按钮，触发终端向中国银行的官网的服务器发送验证码获取请求。
S207：终端接收网页的服务器发送的验证码短信。
通常，验证码短信中包括验证码、发送验证码短信的电话号码和企业名称。
S208：终端依据已存储的验证码短信的发送方身份信息与证书的对应关系，查询与S207中接收到的验证码短信的发送方身份信息(电话号码和/或企业名称)对应的证书。
S209：终端判断查询到的证书与当前访问的网页的证书是否匹配，如果是，执行S210，如果否，按照现有的短信处理流程处理验证码短信。
需要说明的是，本实施例中所述“匹配”是指相同或本质相同等情况。所述本质相同是指，两个证书表示的是同一个网页。
S210：终端在TEE中加密验证码短信，得到密文。
具体的，在TEE中可以使用可信应用(英文：Trusted Application，TA)对验证码短信进行加密。
因为TEE的安全性更高，因此，在TEE中得到的验证码短信密文，具有更高的安全性。
S211：终端在REE中判断密文的类型是否为验证码短信，如果是，执行S212，如果否，按照现有的短信处理流程处理。
S212：终端在REE中解密所述密文，得到验证码。
S213：终端将验证码发给网页的服务器，以进行验证。
从图2所示的过程可以看出，本实施例中，终端在验证码的发送方对应的证书与本地注册的证书匹配的情况下，才从验证码短信中获取验证码，与对于任何验证码短信均自动获取验证码的现有技术相比，能够有效避免通过验证码短信进行的攻击(例如截获验证码短信后更改其中的电话号码，从而截获验证码)，从而具有更高的安全性。
图3为图1所示的终端的具体结构，包括：通信模块、查询模块、加密模块、解密模块、浏览器模块、判断模块和存储模块。具体的，加密模块可以设置在TEE中，通信模块、存储模块、查询模块和判断模块可以设置在终端的基带通信系统中。浏览器模块和解密模块可以设置在REE中。解密模块和浏览器模块共同构成验证码获取模块。
图4为图3所示的终端中的各个模块之间进行协作获取验证码的流程，包括以下步骤：
S401、浏览器模块判断是否第一次访问当前访问的网页，或者，是否向当前访问的网页的服务器发送过登陆或注册指令，如果是，则执行S402，如果否，则不作处理或者周期性执行S401。
S402：通信模块向网页的服务器发送获取电话号码(本实施例中，验证码短信发送方身份信息以电话号码为例)的请求。
S403、通信模块接收网页的服务器发送的可能发送验证码短信的电话号码，并将电话号码发给存储模块。
S404、浏览器模块获取当前访问的网页的证书。
S405、浏览器模块将获取的证书发送给存储模块。
S406、存储模块存储电话号码以及证书的对应关系。
可选地，基带通信系统中可以存储有白名单，存储模块将电话号码以及证书的对应关系存储到白名单中。
S401～S406为电话号码与证书的对应关系的注册过程，与图2所示的过程的区别在于，本实施例中，将电话号码与证书的对应关系存储在基带通信系统中。
S407、浏览器模块接收由用户输入的验证码获取命令。
S408、通信模块向当前访问的网页的服务器发送验证码获取请求。
S409、浏览器模块向解密模块请求验证码短信。
S410、通信模块接收网页的服务器发送的验证码短信。
S411、查询模块依据电话号码与网页的证书的对应关系，查询与验证码短信中包含的发送验证码短信的电话号码对应的网页的证书。
S412、判断模块判断与发送验证码短信的电话号码对应的网页的证书与浏览器模块当前访问的网页的证书是否相同，如果是，执行S413，如果否，将短信发给REE环境中的相关装置，由REE环境中的相关装置按照传统的短信处理流程进行处理。
因为基带处理系统是终端与其它设备通信的底层系统，因此，在基带处理系统中存储对应关系并判断证书是否匹配的优点在于，无需上层应用参与查询和判断，即上层应用是无感的，所以能够降低通过应用软件干扰判断的可能性。
S413、通信模块将验证码短信发给加密模块。
S414、加密模块对验证码短信进行加密，具体地，加密模块可以使用TEE中的可信应用(英文：Trusted Application，TA)对验证码短信进行加密。
S415、加密模块将验证码短信密文以及加密密钥发送给解密模块。
可选地，加密密钥为一次性使用密钥，以进一步提高验证码密文的安全性。
S416、解密模块解密短信密文，并分析文本，判断加密短信为验证码短信类型，如果为验证码短信，则执行S417，否则(例如为广告短信)，按照现有的短信处理流程进行处理。
S417、解密模块将验证码短信密文存储到REE的交易短信加密数据库中。
S418、解密模块向浏览器模块发送收到短信的通知，通知中携带发送验证短信的电话号码对应的证书。
S419、浏览器模块判断当前网页的证书与通知中携带的证书是否相同，如果是，执行S420，如果否，不作响应。
需要说明的是，S419为可选步骤，其目的在于，在浏览器模块同时打开多个网页(多标签)的情况下，如果当前显示的网页不是需要获取验证码的网页，则说明用户可能暂时不在原有网页的操作，浏览器模块不响应，不让当前网页获取验证码，可以提高安全性和用户体验。
S420、浏览器模块通过安全接口，向解密模块发送验证码短信获取请求。
S421、解密模块从交易短信加密数据库中获得验证码短信密文，并使用加密密钥解密验证码短信密文。
S422、解密模块通过安全接口，向浏览器模块发送验证码短信的明文。
本实施例中，安全接口为图5中所示的验证码短信开放API，此安全接口的特点是具有较高的安全性，可以与预先经过合法认证的应用例如浏览器模块之间使用明文进行数据传输，并提示用户与此接口进行明文数据传输的应用的合法性，目的在于进一步降低验证码泄露以及被盗取的可能性，并提高用户的安全性体验。
S423、浏览器模块从验证码短信中提取验证码并填入网页中的验证码输入框中。
S424、通信模块向网页的服务器发送验证码。
S424与S423的执行顺序可以交换。
S425、网页的服务器检验验证码并向接收模块返回校验结果。
S426、浏览器模块依据校验结果执行相应的操作。
本实施例中，将网页证书与短信号码绑定存储，系统不广播收到验证码短信的消息，而定向通知浏览器模块收到短信的通知，浏览器模块通过证书判断当前页面是否合法，并定向获取验证码短信，使得浏览器可以自动获取验证码，与现有的向浏览器模块开放 短信读取权项，而使得浏览器模块能够读取所有短信的方式相比，能够降低敏感信息泄露的风险。
并且，基于TEE，能够进一步提高验证码的安全性，降低验证码被泄露及窃取的风险。
基于图4所示的流程进行验证码自动提取的界面示意图如图6所示。
图7为本申请实施例公开的又一种验证码短信的处理方法，包括以下步骤：
S701：终端判断是否第一次访问当前访问的网页，或者，是否向当前访问的网页的服务器发送过登陆或注册指令，如果是，则执行S702，如果否，则不作处理或周期性执行S701。
S702：终端向当前访问的网页的服务器发送获取验证码短信的发送方身份信息的请求。
S703：终端接收当前访问的网页的服务器发送的验证码短信的发送方身份信息。
S704：终端获取当前访问的网页的证书。
S705：终端存储当前访问的网页的证书和验证码短信的发送方身份信息的对应关系。
以上为终端注册验证码短信的发送方身份信息与网页的证书的对应关系的过程，存储的对应关系作为是否从验证码短信中获取验证码的判断依据。
S706：终端向当前访问的网页的服务器发送验证码获取请求。
S707：终端接收网页的服务器发送的验证码短信。
S708：终端依据已存储的验证码短信的发送方身份信息与证书的对应关系，查询与S707中接收到的验证码短信的发送方身份信息(电话号码和/或企业名称)对应的证书。
S709：终端判断查询到的证书与当前访问的网页的证书是否匹配，如果是，执行S710，如果否，按照现有的短信处理流程处理验证码短信。
S710：终端从验证码短信中获取验证码。
S711：终端将验证码发给网页的服务器，以进行验证。
图8为本申请实施例公开的又一种终端的结构，包括：通信模块、查询模块和验证码获取模块。可选的，还包括存储模块。具体的，验证码获取模块包括浏览器模块和判断模块。
图9所示的终端中的各个模块通过以下步骤实现验证码的自动获取：
S901、浏览器模块判断终端是否第一次访问当前访问的网页，或者，是否向所述当前访问的网页的服务器发送过登陆或注册信息，如果是，执行S802，如果否，不做处理或者周期性执行S901。
S902、通信模块接收网页的服务器发送的可能发送验证码短信的电话号码。
S903、浏览器模块将当前访问的网页的证书发给存储模块。
S904、存储模块检查电话号码与证书的对应关系是否已经存储，如果否，存储电话号码与证书的对应关系，如果是，则执行S905。
可选地，验证码短信处理装置中可以预先设置白名单，将电话号码与证书的对应关 系存储在白名单中。
S901～S904为在验证码短信处理装置中注册电话号码与证书的对应关系的过程。
S905、浏览器模块接收验证码获取命令。
举例说明，验证码获取命令为用户点击网页上显示的“获取验证码”的按键(可能为虚拟按键)而出发的命令。
S906、通信模块向当前访问的网页的服务器发送验证码获取请求。
S907、通信模块接收当前访问的网页的服务器发送的验证码短信。
S908、查询模块查询与验证码短信中包括发送方的电话号码对应的证书。
S909、判断模块广播收到短信的通知，通知中携带S908中查询到的证书。
S910、浏览器模块判断当前显示的网页的证书与通知中携带的证书是否相同，如果是，执行S911，如果否，不作响应。
S910为可选步骤，其目的在于，在浏览器同时打开多个网页(多标签)的情况下，如果当前显示的网页不是需要获取验证码的网页，则说明用户可能暂时不在原有网页的操作，浏览器模块不响应，不让当前网页获取验证码，可以提高安全性和用户体验。
S911、浏览器模块发送当前访问的网页的证书给判断装置。
S912、判断模块判断接收到的证书是否与S908中查询到的证书相同，如果是，执行S913，如果否，执行S918。
S913、判断模块向浏览器模块发送验证码短信。
S914、浏览器模块从验证码短信中提取验证码并填入网页中的验证码输入框中。
S915、通信模块向当前访问的网页的服务器发送验证码。
S916、当前访问的网页的服务器检验验证码并向浏览器返回校验结果。
S917、浏览器模块依据校验结果执行相应的操作。
S918、判断模块拒绝向浏览器模块发送验证码短信。
从图9所示的过程可以看出，用户如果在浏览器的网页上点击“获取验证码”的按键，则在接收到网页的服务器发送的验证码短息后，通过对网页的验证，能够将验证码短信发给浏览器模块，浏览器模块则可以从验证码短信中获取验证码。相比于传统的浏览器，本实施例中，浏览器能够自动获取验证码。
需要强调的是，本实施例中所述的验证码自动获取过程与现有技术中应用自动获取并填充验证码的方式不同，现有技术中，应用获得读取短信的权限，在接收到短信后可以自动提取验证码，基于此机制，应用一旦获得读取短信的权限就获得读取任何短信的权限，这无疑会增加敏感信息泄露的风险，并且，应用不仅可以读取正常的验证码短信，还可以读取用户正常使用短信应用时收发的其它短信，容易造成用户隐私的泄露。
而本实施例所述的方法，在获取验证码的网页的证书与注册的验证码发送发的证书匹配的情况下，浏览器模块才能获取验证码短信，而并不是向浏览器模块开放读短信的权限使得浏览器模块能够读取全部的短信。因此，本实施例所述的方法，在保证较高的安全性的基础上实现了浏览器自动填充验证码的目的。
图10为本申请的实施例公开的又一种终端，包括通信组件、存储器和处理器。
其中，存储器用于存储验证码短信的发送方身份信息与证书的对应关系，以及存储 应用程序以及应用程序运行过程中产生的数据。通信组件用于接收包括验证码短信的发送方身份信息的验证码短信，处理器用于依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书，并在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，通过在可信执行环境TEE中加密所述验证码短信，得到密文，以及通过在富执行环境REE中解密所述密文，得到验证码。
具体的，处理器通过在REE中解密所述密文，得到验证码的具体实现方式可以为：如果确定所述密文的类型为验证码类短信，则使用从所述TEE中获取的所述密钥在所述REE中解密所述密文，得到验证码。
进一步的，处理器还用于判断是否第一次访问所述当前访问的网页，或者是否向所述当前访问的网页的服务器发送过登陆或注册信息，通信组件还用于，在接收验证码短信之前，如果处理器确定第一次访问所述当前访问的网页，或者向所述当前访问的网页的服务器发送过登陆或注册信息，则向所述当前访问的网页的服务器发送获取所述验证码短信的发送方身份信息的请求，并接收所述当前访问的网页的服务器发送的所述验证码短信的发送方身份信息和所述当前访问的网页的证书。处理器还用于存储所述验证码短信的发送方身份信息与所述当前访问的网页的证书的对应关系。
以上功能的具体实现过程可以参见图2。
图10所示的终端的功能还可能如下所述：处理器用于依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书，并在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，从所述验证码短信中获取验证码。通信组件的功能如前所述，这里不再赘述。功能的具体实现过程可以参见图7。
本说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其它实施例的不同之处，各个实施例之间相同或相似部分互相参见即可。
对所公开的实施例的上述说明，使本领域专业技术人员能够实现或使用本发明。对这些实施例的多种修改对本领域的专业技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本发明的范围的情况下，在其它实施例中实现。因此，本发明将不会被限制于本文所示的这些实施例，而是要符合与本文所公开的原理和新颖特点相一致的最宽的范围。

Claims (15)

  1. 一种验证码短信的处理方法，其特征在于，包括：
    终端接收验证码短信，所述验证码短信中包括所述验证码短信的发送方身份信息；
    所述终端依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书；
    在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，所述终端通过在可信执行环境TEE中加密所述验证码短信，得到密文；
    所述终端通过在富执行环境REE中解密所述密文，得到验证码。
  2. 根据权利要求1所述的方法，其特征在于，所述通过在REE中解密所述密文，得到验证码包括：
    如果确定所述密文的类型为验证码类短信，则使用从所述TEE中获取的所述密钥在所述REE中解密所述密文，得到验证码。
  3. 根据权利要求1或2所述的方法，其特征在于，在所述接收验证码短信之前，还包括：
    所述终端在确定第一次访问所述当前访问的网页，或者向所述当前访问的网页的服务器发送过登陆或注册信息的情况下，则向所述当前访问的网页的服务器发送获取所述验证码短信的发送方身份信息的请求；
    所述终端接收所述当前访问的网页的服务器发送的所述验证码短信的发送方身份信息和所述当前访问的网页的证书；
    所述终端存储所述验证码短信的发送方身份信息与所述当前访问的网页的证书的对应关系。
  4. 一种验证码短信的处理方法，其特征在于，包括：
    终端接收验证码短信，所述验证码短信中包括所述验证码短信的发送方身份信息；
    所述终端依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书；
    在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，所述终端从所述验证码短信中获取验证码。
  5. 根据权利要求4所述的方法，其特征在于，所述在所述接收验证码短信之前，还包括：
    所述终端在确定第一次访问所述当前访问的网页，或者向所述当前访问的网页的服务器发送过登陆或注册信息的情况下，则向所述当前访问的网页的服务器发送获取所述验证码短信的发送方身份信息的请求；
    所述终端接收所述当前访问的网页的服务器发送的所述验证码短信的发送方身份信息和所述当前访问的网页的证书；
    存储所述验证码短信的发送方身份信息与所述当前访问的网页的证书的对应关系。
  6. 一种终端，其特征在于，包括：
    通信模块，用于接收验证码短信，所述验证码短信中包括所述验证码短信的发送方身份信息；
    查询模块，用于依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书；
    加密模块，用于在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，通过在可信执行环境TEE中加密所述验证码短信，得到密文；
    验证码获取模块，用于通过在富执行环境REE中解密所述密文，得到验证码。
  7. 根据权利要求6所述的终端，其特征在于，所述验证码获取模块包括：
    解密模块，用于在所述密文的类型为验证码短信的情况下，使用从所述TEE中获取的所述密钥，通过在所述REE中解密所述密文，得到所述验证码短信；
    浏览器模块，用于获取所述验证码短信，并从所述验证码短信中获取所述验证码。
  8. 根据权利要求7所述的终端，其特征在于，所述浏览器模块用于获取所述验证码短信包括：
    所述浏览器模块具体用于，通过安全接口，获取所述验证码短信。
  9. 根据权利要求7或8所述的终端，其特征在于，所述解密模块还用于：
    在所述得到所述验证码短信之后，向所述浏览器模块发送通知，所述通知携带所述验证码短信的发送方身份信息；
    所述浏览器模块用于从所述验证码短信中获取所述验证码包括：
    所述浏览器模块具体用于，在所述当前访问的网页的证书与所述验证码短信的发送方身份信息匹配的情况下，从所述验证码短信中获取所述验证码。
  10. 根据权利要求7所述的终端，其特征在于，还包括：存储模块；
    所述浏览器模块还用于：
    确定所述终端是否第一次访问所述当前访问的网页，或者，是否向所述当前访问的网页的服务器发送过登陆或注册信息；
    所述通信模块还用于：
    在所述浏览器模块确定所述终端第一次访问所述当前访问的网页，或者，是否向所述当前访问的网页的服务器发送过登陆或注册信息的情况下，向所述当前访问的网页的服务器发送获取所述验证码短信的发送方身份信息的请求，并接收所述当前访问的网页的服务器发送的所述验证码短信的发送方身份信息和所述当前访问的网页的证书；
    所述存储模块用于存储所述验证码短信的发送方身份信息与所述当前访问的网页的证书的对应关系。
  11. 根据权利要求6所述的终端，其特征在于，所述通信模块和所述查询模块设置在基带通信系统中。
  12. 一种终端，其特征在于，包括：
    通信模块，用于接收验证码短信，所述验证码短信中包括所述验证码短信的发送方身份信息；
    查询模块，用于依据存储的信息与证书的对应关系，查询与所述验证码短信的发送方身份信息对应的证书；
    验证码获取模块，用于在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，从所述验证码短信中获取验证码。
  13. 根据权利要求12所述的终端，其特征在于，所述验证码获取模块包括：
    判断模块，用于判断所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书是否匹配；
    浏览器模块，用于在所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书匹配的情况下，获取所述验证码短信，并从所述验证码短信中获取验证码。
  14. 根据权利要求13所述的终端，其特征在于，所述判断模块还用于：
    在所述判断所述与所述验证码短信的发送方身份信息对应的证书与所述终端当前访问的网页的证书是否匹配之前，向所述浏览器模块发送通知，所述通知携带所述与所述发送方身份信息对应的证书；
    所述浏览器模块还用于：在所述与所述发送方身份信息对应的证书与所述当前访问的网页的证书匹配的情况下，向所述判断模块发送所述当前访问的网页的证书。
  15. 根据权利要求13所述的终端，其特征在于，还包括：存储模块；
    所述浏览器模块还用于：
    确定所述终端是否第一次访问所述当前访问的网页，或者，是否向所述当前访问的网页的服务器发送过登陆或注册信息；
    所述通信模块还用于：
    在所述浏览器模块确定所述终端第一次访问所述当前访问的网页，或者，是否向所述当前访问的网页的服务器发送过登陆或注册信息的情况下，向所述当前访问的网页的服务器发送获取所述验证码短信的发送方身份信息的请求，并接收所述当前访问的网页的服务器发送的所述验证码短信的发送方身份信息和所述当前访问的网页的证书；
    所述存储模块用于存储所述验证码短信的发送方身份信息与所述当前访问的网页的证书的对应关系。
PCT/CN2017/092863 2016-07-29 2017-07-13 验证码短信的处理方法及终端 WO2018019134A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
MYPI2019000194A MY201886A (en) 2016-07-29 2017-07-13 Verification code short message processing method and terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610615989.6 2016-07-29
CN201610615989.6A CN107666469B (zh) 2016-07-29 2016-07-29 验证码短信的处理方法及终端

Publications (1)

Publication Number Publication Date
WO2018019134A1 true WO2018019134A1 (zh) 2018-02-01

Family

ID=61015544

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/092863 WO2018019134A1 (zh) 2016-07-29 2017-07-13 验证码短信的处理方法及终端

Country Status (3)

Country Link
CN (1) CN107666469B (zh)
MY (1) MY201886A (zh)
WO (1) WO2018019134A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110336769A (zh) * 2019-03-18 2019-10-15 上海飓金嵘通网络科技有限公司 一种基于手机钱包的跨部门电子证件申请方法及装置

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109522731A (zh) * 2018-11-07 2019-03-26 温州杉果数据科技有限公司 一种大数据信息安全存储加密系统及其方法
CN111246404A (zh) * 2018-11-28 2020-06-05 中国移动通信集团浙江有限公司 验证码短信的处理方法及装置
CN109587683B (zh) * 2019-01-04 2022-04-26 中国联合网络通信集团有限公司 短信防监听的方法及系统、应用程序和终端信息数据库
CN109600725A (zh) * 2019-01-04 2019-04-09 广东安创信息科技开发有限公司 一种基于sm9算法的短信加密方法
CN113553573B (zh) * 2021-07-09 2024-02-06 深圳市高德信通信股份有限公司 一种数据安全验证方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013100967A1 (en) * 2011-12-28 2013-07-04 Intel Corporation Web authentication using client platform root of trust
CN104144146A (zh) * 2013-05-10 2014-11-12 中国电信股份有限公司 一种访问网站的方法和系统
CN105207775A (zh) * 2014-05-30 2015-12-30 北京奇虎科技有限公司 验证信息的读取方法及装置
CN105429760A (zh) * 2015-12-01 2016-03-23 神州融安科技（北京）有限公司 一种基于tee的数字证书的身份验证方法及系统
CN106507352A (zh) * 2016-10-28 2017-03-15 北京奇虎科技有限公司 短信验证码的网站识别方法及识别终端
CN106559419A (zh) * 2016-10-28 2017-04-05 北京奇虎科技有限公司 短信验证码的应用识别方法及识别终端

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7904360B2 (en) * 2002-02-04 2011-03-08 Alexander William EVANS System and method for verification, authentication, and notification of a transaction
CN104980580B (zh) * 2015-06-17 2018-03-23 小米科技有限责任公司 短信息查看方法及装置
CN105553663A (zh) * 2015-12-09 2016-05-04 小米科技有限责任公司 验证码输入方法及装置
CN105512576A (zh) * 2015-12-14 2016-04-20 联想(北京)有限公司 一种数据安全存储的方法及电子设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013100967A1 (en) * 2011-12-28 2013-07-04 Intel Corporation Web authentication using client platform root of trust
CN104144146A (zh) * 2013-05-10 2014-11-12 中国电信股份有限公司 一种访问网站的方法和系统
CN105207775A (zh) * 2014-05-30 2015-12-30 北京奇虎科技有限公司 验证信息的读取方法及装置
CN105429760A (zh) * 2015-12-01 2016-03-23 神州融安科技（北京）有限公司 一种基于tee的数字证书的身份验证方法及系统
CN106507352A (zh) * 2016-10-28 2017-03-15 北京奇虎科技有限公司 短信验证码的网站识别方法及识别终端
CN106559419A (zh) * 2016-10-28 2017-04-05 北京奇虎科技有限公司 短信验证码的应用识别方法及识别终端

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110336769A (zh) * 2019-03-18 2019-10-15 上海飓金嵘通网络科技有限公司 一种基于手机钱包的跨部门电子证件申请方法及装置

Also Published As

Publication number Publication date
CN107666469B (zh) 2020-12-25
CN107666469A (zh) 2018-02-06
MY201886A (en) 2024-03-22

Similar Documents

Publication Publication Date Title
WO2018019134A1 (zh) 验证码短信的处理方法及终端
CN111191286B (zh) Hyperledger Fabric区块链隐私数据存储与访问系统及其方法
CN107743133B (zh) 移动终端及其基于可信安全环境的访问控制方法和系统
CN105095696B (zh) 对应用程序进行安全认证的方法、系统及设备
CN105446713B (zh) 安全存储方法及设备
US9867043B2 (en) Secure device service enrollment
WO2019218919A1 (zh) 区块链场景下的私钥管理方法、装置及系统
WO2015180691A1 (zh) 验证信息的密钥协商方法及装置
WO2018152519A1 (en) Performance of distributed system functions using a trusted execution environment
US9769654B2 (en) Method of implementing a right over a content
WO2016011778A1 (zh) 数据处理的方法和装置
WO2022028289A1 (zh) 数据加密方法、数据解密方法、装置、终端和存储介质
CN112825520B (zh) 用户隐私数据处理方法、装置、系统及存储介质
CN112632581A (zh) 用户数据处理方法、装置、计算机设备及存储介质
CN107506659A (zh) 一种基于sgx的通用数据库的数据保护系统及方法
JP2013138508A (ja) Ｏｔａサービスを提供するためのシステムおよびその方法
WO2015180689A1 (zh) 验证信息的获取方法及装置
WO2017147890A1 (zh) 一种验证码短信显示方法及移动终端
CN111274611A (zh) 数据脱敏方法、装置及计算机可读存储介质
US20140157394A1 (en) Authentication system
WO2015117523A1 (zh) 访问控制方法及装置
CN108449322B (zh) 身份注册、认证方法、系统及相关设备
CN115037552A (zh) 鉴权方法、装置、设备及存储介质
US20230362018A1 (en) System and Method for Secure Internet Communications
CN113434882A (zh) 应用程序的通讯保护方法、装置、计算机设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17833437

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17833437

Country of ref document: EP

Kind code of ref document: A1