WO2019134494A1

WO2019134494A1 - Verification information processing method, communication device, service platform, and storage medium

Info

Publication number: WO2019134494A1
Application number: PCT/CN2018/121311
Authority: WO
Inventors: 乐祖晖
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2018-01-08
Filing date: 2018-12-14
Publication date: 2019-07-11
Also published as: CN110022536A

Abstract

Disclosed are a verification information processing method, a communication device, a service platform, and a storage medium. The verification information processing method comprises: determining whether a service application has a permission of accessing a subscriber identity module; if the service application has the permission of accessing the subscriber identity module, reading an SMS message from the subscriber identity module, wherein the SMS message comprises verification information; and transmitting the SMS message to the service application.

Description

Verification information processing method, communication device, service platform, and storage medium

Cross-reference to related applications

The present application is filed on the basis of the Chinese Patent Application No. 201810013801, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present application relates to the field of communications technologies, but is not limited to the field of communications technologies, and in particular, to a verification information processing method, a communication device, a service platform, and a storage medium.

Background technique

Using SMS for authentication is a common security method in many businesses. For example, the third-party payment service needs to request the banking system to send a short message before the payment is determined. The short message carries the short message verification code, and the short message verification is input to the verification interface and sent to the banking system. After the banking system receives it, it determines whether it is a verification code issued by itself, and if so, may perform a payment operation.

Although SMS verification improves the security of certain business functions, there may be a problem that if a communication device that receives a short message is installed with a malicious application (such as a malicious code such as a Trojan), the malicious application can read the The short message is sent to the illegal user or the device, which leads to the leakage of the verification code, which may result in insecure execution of business operations such as payment.

Summary of the invention

The embodiment of the present application is expected to provide a verification information processing method, a communication device, and a storage medium.

The technical solution of the present application is implemented as follows:

In a first aspect, an embodiment of the present application provides a verification information processing method, including:

Determining whether the business application has the right to access the user identification card;

When the service application has the right to access the user identification card, the short message is read from the user identification card, where the short message includes verification information;

Transmitting the short message to the service application.

In a second aspect, the embodiment of the present application provides a verification information processing method, including:

Sending an acquisition request for verification information to the service platform;

Sending a read request to the access control middleware;

And receiving, by the access control middleware, the short message that is read from the user identity card based on the read request, where the short message carries the verification information, and is sent by the service platform to the user identity based on the obtaining request. Identification card.

In a third aspect, the embodiment of the present application provides a verification information processing method, including:

Receiving an acquisition request of the verification information sent by the service application;

And sending, according to the obtaining request, a short message carrying the verification information to the user identity identification user card of the designated device.

In a fourth aspect, the embodiment of the present application provides a communication device, where the communication device runs an access control middleware, and the access control middleware includes:

a determining unit, configured to determine whether the service application has permission to access a user identity user identification card;

a reading unit configured to read a short message from the user identification card when the service application has the right to access the user identification card, where the short message includes verification information;

And a transmission unit configured to transmit the short message to the service application.

In a fifth aspect, a communications device is installed in the communications device, where the communications device is installed with a service application, where the service application includes:

a first sending unit, configured to send an acquisition request of the verification information to the service platform;

a second sending unit, configured to send a read request to the access control middleware;

a first receiving unit, configured to receive a short message that is read by the access control middleware from the user identity card based on the read request, where the short message carries verification information, and the service platform is based on the service platform The acquisition request is sent to the user identification card.

In a sixth aspect, the embodiment of the present application provides a service platform, including:

a second receiving unit, configured to receive an acquisition request of the verification information sent by the service application;

The third sending unit is configured to send, according to the obtaining request, a short message carrying the verification information to the user identity identification user identifier card of the designated device.

In a seventh aspect, an embodiment of the present application provides a communication device, including: a transceiver, a memory, a processor, and a computer program stored on the memory and executed by the processor;

The processor is coupled to the transceiver and the memory, respectively, for implementing the verification information processing method provided by one or more of the foregoing technical solutions by executing the computer program.

In an eighth aspect, the embodiment of the present application is a computer storage medium, where the computer storage medium stores a computer program; after the computer program is executed, the verification information processing method provided by the one or more technical solutions can be implemented.

The embodiment of the present application provides a verification information processing method, a communication device, a service platform, and a storage medium. The service platform is not directly sent by the short message processing module that carries the verification information to the communication device, but is directly sent to the short message processing module. The user identification card, if the business application on the device needs to read the short message on the user identification card, it needs to pass the authorization identification before the short message can be read from the user identification card. Obviously, this increases the difficulty of malicious applications such as Trojans reading the verification information, and improves the security of the verification information.

DRAWINGS

FIG. 1 is a schematic structural diagram of a processing system for verifying information according to an embodiment of the present application;

2 is a schematic flowchart of a first verification information processing method according to an embodiment of the present application;

FIG. 3 is a schematic flowchart diagram of a second verification information processing method according to an embodiment of the present disclosure;

4 is a schematic flowchart of a third verification information processing method according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a communication device according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of another communication device according to an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of a service platform according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of still another communication device according to an embodiment of the present application;

FIG. 9 is a schematic flowchart diagram of a fourth verification information processing method according to an embodiment of the present application.

Detailed ways

The technical solutions of the present application are further elaborated below in conjunction with the drawings and specific embodiments.

In order to ensure the security of the authentication information, the malicious application is used to steal the authentication information in the short message. In the embodiment of the present application, the short message carrying the verification information is directly sent to the user identification card, and is stored by the user identification card. If the application needs to access the user identification card or read the short message carrying the authentication information on the user identification card, the authorization verification is required, and only the corresponding short message can be read through the authorization verification, so that the verification information can be obtained. The security of the verification information is improved relative to the short message processing module that stores the short message in the short message application or is open to all applications. In view of this, as shown in FIG. 1, this embodiment first provides a system architecture for processing a short message carrying authentication information. The system architecture includes a service platform that sends a text message to the user identification card, and triggers a service application that sends a text message on the service platform. An Application Programming Interface (API) is also provided in the device. The API is provided with an access control middleware, which can realize the authorization of the service application by interacting with the information of the user identification card. There may also be a mobile device in Figure 1, which is required to be written to other devices. The communication device in the embodiment of the present application may be: a mobile phone, a tablet computer, a wearable device, an in-vehicle device, or an Internet of Things terminal, and the like, which can perform network communication. The access control application is also configured on the user identification card in FIG. 1, and the access control application can be used for data interaction with the access control middleware in the API, for example, performing SMS interaction according to a pre-configured control rule. The control rule may be sent by the access control application to the access control middleware, and the access control middleware controls the access of the service application to the user identification card according to the control rule. For example, according to the control rule, the business application is authenticated for accessing the user identification card or the short message on the user identification card. The control rule may further include: access control information, the information may include information such as an application identifier that allows access to an application on the user identification card.

The user identification card, which may also be referred to as a smart card, may be various cards carrying user identity information, such as a Subscriber Identity Module (SIM), a User Identity Model (UIM), Universal Customer Identification Module (Universa Subscriber Identity Module), nano-SIM card, SIM card. It is smaller than the micro-SIM card being used, which is an upgraded version of the SIM. The nano-SIM card, also referred to as a fourth form factor integrated circuit board, is a new generation SIM. The SIM card, also known as the Miro SIM card, is another upgraded version of SIM that is smaller than a normal SIM card.

The user identity card may include a separate SIM card detachable from the mobile terminal and an eSIM card integrated with the circuit chip of the mobile device according to the form of the card.

As shown in FIG. 2, this embodiment provides a verification information processing method, including:

Step S110: determining whether the service application has the right to access the user identity identification card;

Step S120: When the service application has the right to access the user identification card, the short message is read from the user identification card, where the short message includes verification information;

Step S130: transmitting the short message to the service application.

The verification information processing method provided in this embodiment may be applied to an access control middleware in a communication device, and the access control middleware may be an integral part of an API installed in the device.

In this embodiment, the short message carrying the verification information is directly sent to the user identification card.

For example, the request for obtaining the verification information sent by the communication device to the service platform, after receiving the acquisition request, the service platform constructs a short message, and the short message is directly sent to the user identification card. For example, the packet header part of the short message carries an identifier bit, and when the identifier bit is the first value, the short message indicates that the short message is a special short message sent to the user identification card, and if the identifier bit is the second value, the short message is indicated. A normal short message for sending a short message processing module of the communication device. The first value and the second value are different. The special short message is stored by the user identification card, and only the storage record of the short message is stored in the user identification card. Ordinary text messages can be stored in other storage media in the communication device.

Various applications are also installed in the communication device. When these applications need to access the user identification card, they first need to authenticate and verify whether they have the right to access the user identification card.

Generally, an application identifier (AID) of a service application having access to the user identity card is stored in a specific storage area or user identification card of the communication device. The application identifier of a generally illegal application or a malicious application is not stored on the specific storage area or the user identification card. For example, a specific storage area of the user identification card or the communication device has an AID list in which an application that can access the user identification card is encrypted, and the AID of the malicious application or the illegal application or other legitimate application without permission is not written. The AID list can be used to determine whether the service application currently requesting access to the user identification card has the right to access the user identification card.

The business application may be an application that can provide various business services, such as a payment application that can perform online payment, a shopping application that can make a purchase, a social application that can be socialized, and the like.

In this embodiment, the access control middleware only sends the short message read on the user identification card to the authorized application. In this case, if the verification information is stored as the information content of the short message on the user identification card, it is obviously more difficult to illegally apply the information to be stolen than the short message processing module directly stored in the communication device, thereby reducing the verification. The risk of information being stolen increases the security of the verification information. The verification information may include: a payment verification code for payment verification, an unlock verification code that can be used to unlock a certain function or perform an operation.

There are many ways to determine whether the business application has the right to access the user identification card. Several options are provided below:

Optional one:

The step S120 may include:

Determining, according to the application identifier of the service application, whether the service application has the right to access the user identity card.

Option 2:

The step S120 may include:

Matching a first verification identifier provided by the service application and a second verification identifier provided by the user identity card;

And determining, according to the result of the matching, whether the service application has the right to access the user identity card, wherein the second verification identifier is corresponding to the short message stored on the user identity card.

The first verification identifier may be a first session identifier of the service application and the service platform, and the second verification identifier may also be a session identifier sent by the service platform to the user identification card. The identifier may be referred to as a second session identifier, and the session identifier is usually a session identifier of a session in which the service platform sends a text message.

The short message sent by the service platform to the user identification card is requested by the service application, and the session between the service application and the service platform is assigned a verification identifier. The service platform sends the verification information to the user identity card, and sends the verification information to the user identification card together with the verification identifier of the session of the service application, that is, the second verification identifier is sent by the service platform. of. The verification information and the second verification identifier may be used as the short message content, and sent by the service platform to the user identification card. In some embodiments, the verification information and the second verification identifier may be located in different short messages sent by the service platform. If the user identification card receives two verification information and verification identifiers respectively sent from the same service platform, The short message correspondingly stores two short messages, or extracts the verification information and the second verification identifier, and stores the verification information and the second verification identifier correspondingly.

The service application provides a first verification identifier to the access control middleware, and the access control middleware further acquires a second verification identifier from the user identification card, and matches the first verification identifier and the second verification. The identifier, if the first verification identifier and the second verification identifier are consistent, may be considered that the service application currently requesting access to the user identification card has the right to access the user identification card. In this way, the AID of the business application is not recorded in advance on a specific storage area or user identification card. In this case, if the service application sends the short message carrying the verification information and the second verification identifier to the user identification card, the corresponding business application has the right to temporarily access the user identification card, but the access is The right to the SMS on the user ID card.

Option 3:

The step S120 may include:

Determining, according to the application identifier of the service application, whether the service application is located in an application that can access the user identification card;

Matching the first session identifier and the second session identifier;

Determining that the service application has access to the user identification card only when the service application has access to the user identification card, and the first verification identifier and the second verification identifier are consistent. The right message; the short message corresponding to the second verification application is transmitted to the service application for use by the business application.

Option 4:

The step S120 may include: sending a first verification identifier provided by the service application to the user identity identification card, where the first verification identifier is used for the user identification card and the second The verification identifier is matched, wherein the second verification identifier is corresponding to the short message stored on the user identification card;

The step S130 may include: receiving the short message sent by the user identity card when the first check identifier and the second check identifier match.

The first verification identifier and the second verification identifier may be various information having a verification function. Similarly, the first verification identifier may be a first session identifier, and the second verification identifier may be The second session identifier.

In the embodiment, the first session identifier and the second session identifier are matched to be a user identification card, and the user identifier card only passes the first session identifier and the second session identifier when the first session identifier and the second session identifier match. Access control middleware is transmitted to the business application.

In some embodiments, the short message further carries the time-sensitive information. After receiving the short message, the user identification card parses the information content of the short message, and saves the valid time range indicated by the time-effect information. If the short message exceeds the valid time range, the short message is deleted or the short message is invalidated, and the storage resource storing the short message is released, and other information may be stored so that the information content of the short message is cover.

In some embodiments, the method further includes:

Determining whether the current time is within a valid time range of the short message of the service application accessible user identification card, and reading the short message from the user identification card if the current time is within the valid time range, otherwise rejecting the service application A request to access the user identification card to ensure the security of the information on the user identification card.

In some embodiments, the user identification card is provided with a storage queue of short messages, and the queue may be a First Input First Output (FIFO) queue, such that if a message is stored in the user identification card If the number exceeds the number of storage queues, the first SMS that enters the queue will be discarded, thus solving the problem of insufficient storage space on the user ID card.

In some embodiments, in order to reduce the leakage phenomenon of the short message during the transmission process, the short message is encrypted and transmitted, usually adopting end-to-end encrypted transmission, and the intermediate forwarding node may directly transmit the data packet without parsing the short message. Further improve the security of the verification information in the short message.

In some embodiments, the access control middleware further receives the short message identifier from the service application; in step S120, the short message is requested from the user identity card according to the short message identifier. The short message identifier may be an identifier that is specifically assigned by the service platform to identify a short message that is sent to the user identification card. In some embodiments, the short message identifier may be a session identifier of a session of the service application with a service platform. In this case, the reuse of the session identifier is implemented again, and no special short message identifier is allocated. If the service platform generates a special short message identifier, the service platform needs to separately send the short message identifier to the user identity card and the service application. Preferably, the first check code and the second check code are both session identifiers, and the short message identifier is also a session identifier. In this way, the service application on the device submits the read request for reading the short message to the access control middleware, and the session identifier of the session with the service platform can be carried in the access control middleware, and the access control middleware can send the session representation to the user identification card, and the user identity After the identification card is received, the session identifier stored corresponding to the short message is matched. If the matching is successful, the short message is sent to the access control middleware, and is forwarded to the corresponding application by the access control middleware. In this case, when the user identity card performs the matching of the session identifier, on the one hand, it is actually determining whether the service application on the device has the right of the user identity card, and also locates the short message that the current service application wants to access; Such an operation implements multiple functions. If the session identifier is not successfully matched, the user identity card may return a message of denying access or access failure to the service application through the access control middleware. If this is the case, the malicious application needs to obtain the short message stored on the user identification card, and also needs to obtain the session identifier corresponding to the short message, which obviously increases the difficulty for the malicious application to obtain the verification information, and improves the security of the verification information.

As shown in FIG. 3, this embodiment provides a verification information processing method, including:

Step S210: The service application sends an acquisition request of the verification information to the service platform.

Step S220: The service application sends a read request to the access control middleware;

Step S230: The service application receives the short message read by the access control middleware from the user identification card based on the read request, where the short message carries the verification information, and the service platform is based on the obtaining request. Is issued to the user identification card.

The method provided in this embodiment is applied to a service application. If the service application needs to verify the information, for example, a function that requires authentication information to be verified based on the user operation, the service request is automatically sent to the corresponding service platform on the network side, and the request is triggered by the service platform. A text message with verification information. In this embodiment, the short message is not sent to the ordinary short message of the communication device, but is sent to the special identifier of the user identification card in the communication device. After receiving the short message, the communication device can determine that the short message is sent to the user identification card by reading the identifier of the packet header of the short message, and directly hand the short message to the user identification card for storage, instead of It is then forwarded to the SMS application of the normal SMS for processing.

In this case, the service application needs to read the short message in the user identification card. At this time, the short message carrying the verification information needs to be read to the user identification card through the access control middleware. In this embodiment, the access control middleware needs to send the short message in the user identification card to the service application after verifying that the service application has the access right, thereby reducing the verification information in the short message being illegal. The probability of stealing is applied, thereby improving the security of the verification information. For details on how to verify whether the service application has the right to access the user identification card or the short message on the user identification card, refer to the foregoing embodiment.

Optionally, the method further includes:

Receiving a sending notification returned by the service platform after sending a short message carrying the verification information;

The step S220 may include:

After receiving the transmission notification, the read request is sent to the access control middleware.

In some embodiments, the service application may begin sending a read request to the access control middleware after transmitting the acquisition request. In some embodiments, in order to reduce the phenomenon that the service platform has not sent a short message, the access control middleware cannot successfully read the short message from the user identification card based on the read request. In this embodiment, the service application may also be used. Receiving the sending notification sent by the service platform, and requesting the access control middleware to access the short message on the user identification card after receiving the sending notification, the privileged business application cannot be successfully obtained or cannot be accessed. The probability of the card.

Optionally, the read request carries an application identifier of the service application and/or a first session identifier that is in a session with the service platform;

The application identifier and/or the session identifier are used by the access control middleware to determine whether the service application has permission to access the user identity card.

In some embodiments, in order to sufficiently ensure the security of the verification information, the service application may obtain a first verification identifier, for example, the first verification identifier may be generated by the service platform and carried in the Sending a check code sent to the service application for the access control of the short message stored on the user identification card. In some embodiments, the first check code may be identification information that is known by some service applications, for example, a first session identifier of the service application in a session with the service platform, and the like.

The application identifier is identifier information that is known by the application after being installed and installed on the communication device, and can be used for the access control middleware to identify the access authority of the service application.

If the first verification identifier is the session identifier of the session between the service application and the service platform, the service platform does not need to send the verification identifier to the service application. The service application acquires the session when the service platform establishes the session. The identifier, when the subsequent request to access the short message on the user identification card, directly reads the locally stored session identifier and carries it in the read request. Moreover, the service platform does not need to generate the verification identifier for the permission check, but reuses the session identifier, thereby realizing the multiple use of one information, thereby simplifying the operation of the service platform and realizing the versatility of the information.

As shown in FIG. 4, this embodiment provides a verification information processing method, including:

Step S310: The service platform receives an acquisition request of the verification information sent by the service application.

Step S320: The service platform sends a short message carrying the verification information to the user identification user identification card of the designated device according to the obtaining request.

The verification information processing method provided in this embodiment may be applied to a method in a service platform. The service platform receives the acquisition request sent by the service application, and the service platform generates a verification code according to the acquisition request, and generates a short message based on the verification code. And the short message is sent to the user identification card in the communication device installed by the service application, so the service platform constructs a special short message carrying the verification information. The difference between a special short message and a normal short message can be distinguished by the identifier in the packet header of the short message. For example, if the identifier is the first value, it is a special short message, and if the second value is a normal short message. In this way, the difficulty of reading the verification information by the illegal application is reduced, thereby improving the security of the verification information.

The designated device may be a communication device installed for the service application, or may be another electronic device. For example, device A requests authentication information from the service platform, and the service platform sends a text message to the user identification card of device B. For example, a user's mobile phone and a computer run a social account at the same time, and the user operates the computer to request verification information, and the short message carrying the verification information is finally sent to the user identification card of the mobile phone bound to the social account. The application running on the social account can read the verification information in the short message from the user identification card of the mobile phone.

Optionally, the method further includes:

Sending a notification that the short message has been sent to the business application.

The sending notification is used to notify the service application that the verification information has been sent or that the short message carrying the verification information has been sent. In this case, after receiving the sending notification, the service application reads the corresponding short message to the user identification card of the communication device where the communication device is located.

In some embodiments, the sending notification may further carry a first check identifier for the service application to read the right to check the short message, where the first check identifier may be the first session identifier, but is not limited to the session. Logo.

Optionally, the method further includes:

Sending a second verification identifier to the user identification card, where the second verification identifier is used alone or in combination with an application identifier of the service application, for verifying whether the service application has rights from the user The identification card reads the short message.

Sending the second verification identifier to the access control middleware, and the matching between the first verification identifier and the second verification identifier may be performed by the access control middleware itself or the user identification card, thereby determining the service Whether the application has the right to read the short message carrying the verification information from the user identification card, thereby improving the security of the verification information again.

The second verification identifier is a session identifier of the session between the service platform and the service application.

As shown in FIG. 5, the embodiment provides a communication device, where the communication device runs an access control middleware, and the access control middleware includes:

The determining unit 110 is configured to determine whether the service application has permission to access the user identity user identity card;

The reading unit 120 is configured to: when the service application has the right to access the user identification card, read the short message from the user identification card, where the short message includes the verification information;

The transmitting unit 130 is configured to transmit the short message to the service application.

The determining unit 110 and the reading unit 120 can implement a processor in the application communication device, and the processor can implement the above operation by accessing execution of the code in the middleware. The transmission unit 130 may correspond to a communication bus or the like within the device, and may implement data interaction between different parts within the device.

As shown in FIG. 5, one or more applications may be installed in the communication device, for example, application 1, application 2, application 3, etc.; the service application may be one of an application installed in the communication device. . Each application can interact with the access control middleware via a bus within the communication device to complete the transmission of the short message between the user identification card and the service application.

In some embodiments, the user identification card can be a separate card that can be separated from the communication device. In other embodiments, the user identification card can be an electronic virtual identity card (eSIM) card. The eSIM card is integrated on the chip of the electronic device itself, for example, integrated on the motherboard of the mobile phone. The eSIM card is also assigned its own storage area, which can store short messages and/or applications.

Optionally, the determining unit 110 is configured to determine, according to the application identifier of the service application, whether the service application is authorized to access the user identity card.

The determining unit 110 is further configured to match the first verification identifier provided by the service application and the second verification identifier provided by the user identity card; and determining, according to the result of the matching, whether the service application has permission to access The user identification card, wherein the second verification identifier is corresponding to the short message stored on the user identification card.

Further, the determining unit 110 may be further configured to send the first verification identifier provided by the service application to the user identity identification card, where the first verification identifier is used for the user identity The identification card is matched with the second verification identifier, wherein the second verification identifier is corresponding to the short message stored on the user identification card; the reading unit 120 is specifically configured to receive the user The short message sent by the identity card when the first check identifier and the second check identifier match.

Optionally, the first verification identifier is a first session identifier that is used by the service application to perform a session with the service platform, and the second verification identifier is sent by the service platform to the user identifier card. Two session ID.

As shown in FIG. 6, the embodiment provides a communication device, where the communication device is installed with a service application, and the service application includes:

The first sending unit 210 is configured to send an acquisition request of the verification information to the service platform;

a second sending unit 220, configured to send a read request to the access control middleware;

The first receiving unit 230 is configured to receive a short message that is read by the access control middleware from the user identity card according to the read request, where the short message carries verification information, which is based on the service platform. The obtaining request is sent to the user identification card.

The first sending unit 210 may correspond to an external communication interface of the device, for example, a network interface or a transceiver antenna, etc., and may be used to send the acquisition request to a service platform located on the network side.

The second sending unit 220 and the first receiving unit 230 may correspond to an internal communication interface within the device, for example, an interface connected to the integrated circuit bus, and may be used to communicate with other components or applications within the device, thereby Send a read request and/or receive a text message.

Optionally, the second receiving unit may be configured to receive a sending notification that is returned after the service platform sends the short message carrying the authentication information, where the second sending unit is configured to receive the sending notification. After receiving the notification of the transmission, the read request is sent to the access control middleware.

Further, the read request carries an application identifier of the service application and/or a first verification identifier that is in a session with the service platform; wherein the application identifier/or the first verification identifier is used by And determining, by the access control middleware, whether the service application has permission to access the user identification card.

Optionally, the first verification identifier is a first session identifier of the service application that performs a session with the service platform.

As shown in FIG. 7, the embodiment further provides a service platform, including:

The second receiving unit 310 is configured to receive an acquisition request of the verification information sent by the service application.

The third sending unit 320 is configured to send, according to the obtaining request, a short message carrying the verification information to the user identity identification card of the device where the service application is located.

In the embodiment of the present application, the second receiving unit 310 and the third sending unit 320 may each correspond to a communication interface, and may be used for a read request sent from a service application and send a short message to a user identity card of a device where the service application is located. . Optionally, the third sending unit 320 is further configured to send, to the service application, a sending notification that the short message has been sent.

In some embodiments, the third sending unit 320 is further configured to send the second verification identifier to the user identity card, where the second verification identifier is used alone or with an application of the service application. The identification combination is used to verify whether the business application has permission to read the short message from the user identification card.

Optionally, the second verification identifier is a session identifier of the session between the service platform and the service application.

As shown in FIG. 8, the embodiment of the present application provides a communication device, including: a transceiver 410, a memory 420, a processor 430, and a computer program stored on the memory 420 and executed by the processor 430;

The communication device can include a transceiver 410, a memory 420, a processor 430, and a computer program stored on the memory 420 and executed by the processor 430;

The processor 430 is connected to the transceiver 410 and the memory 420, respectively, for example, to the network interface and the memory 420 via the integrated circuit bus IIC.

The processor 430 is configured to execute the verification information processing method provided by the foregoing one or more technical solutions by executing the computer program, for example, the verification information processing method executed by the access control middleware and the verification information executed by the business application The processing method or the verification information processing method executed by the service platform.

The transceiver 410 can be any type of interface that can be used for communication, such as a cable interface or a fiber optic cable interface.

The memory 420 may be a storage device including a storage medium in the communication device, and may be a random access memory, a read only memory, a storage hard disk, or the like.

The processor 430 can be various types of processors, central processing units, microprocessors, application processors, programmable arrays or application specific integrated circuits, and the like.

The communication device can be a terminal or a service server of the service platform.

When the communication device is a terminal device that interfaces with the service platform, the communication device is provided with a installation slot of the user identification card, which can be installed by the user identification card; the processor has a line connected to the installation slot, Thereby, a connection can be established with the user identification card by means of tapping, etc., and data interaction is performed. In some cases, an eSIM card is integrated on the chip of the communication device itself.

The embodiment of the present application provides a computer storage medium, where the computer storage medium stores a computer program; after the computer program is executed by the processor, the verification information processing method provided by the foregoing one or more technical solutions may be implemented, for example, The verification information processing method executed by the access control middleware, the verification information processing method executed by the business application, or the verification information processing method executed by the service platform.

The computer storage medium may be: a mobile storage device, a read-only memory (ROM, Read-Only Mem or y), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. medium. Optionally, the computer storage medium is preferably a non-transitory storage medium, or a non-volatile storage medium.

Several specific examples are provided below in conjunction with the above embodiments:

Example 1:

This example provides a method of verifying the transmission of a short message. The verification message here can be a text message carrying verification information. The method may specifically include the following parts.

The first part: the service platform can use the operator's existing SIM card management platform, Trusted Service Management (TSM) to set control rules in the SIM card, so that only the mobile device applications allowed by the rule (in Figure 1) The "business application" can access the application on the SIM card ("SIM card application" in Figure 1).

The second part: the device applies the identification information such as the mobile phone number to apply for the dynamic short message code to the service platform. In the embodiment of the present application, the service application is installed on the device, instead of being installed on the SIM card.

After receiving the application, the service platform generates the SMS verification code and the session ID. (Note: The session ID can be used to support concurrent access of the same user, and can also prevent malicious attacks. If the service platform does not support the function, the subsequent process does not. The Session ID field appears).

The service platform sends a text message to the specified mobile phone number, which is a special short message and is directly sent to the SIM card of the device where the mobile phone number is located.

After receiving the short message, the application on the SIM card reads the SMS verification code and the Session ID content and saves it;

After receiving the response that the short message is successfully received, the service platform notifies the device that the application short message has been successfully sent;

The API(s) on the device requests to read the short message content (the request includes the application AID, the Session ID);

API(s) verifies whether the application on the device has permission to access the application on the SIM card of the specified AID;

If the verification is passed, the device API(s) first selects the application specified by the SIM card;

The device API(s) sends an SMS content reading application to the application on the SIM card;

The application on the SIM card returns the short message content according to the Session ID;

The application on the SIM card returns the text message content;

API(s) returns the text message content;

After the application obtains the content of the short message on the device, the user manually or automatically fills in the dynamic short message code;

The application sends the dynamic short message code to the service platform for verification.

The service platform verifies the content of the short message;

If the verification returns a successful verification response, the user can perform subsequent operations.

With the transmission method of the verification information provided by the example, if the illegal terminal forges the mobile phone number to request the verification information, the SIM card of the corresponding device cannot receive the short message, so the application on the device using the fake mobile phone number does not obtain the short message verification. code. In the embodiment of the present application, the mobile phone number may be identification information of the communication device that receives the short message, and may further replace the mobile phone with a network protocol address (IP) or an international mobile device identifier of the communication device during specific implementation. number. Even if the user SIM card receives a text message of unknown origin, it will not affect the user's own business (Session ID protection).

In other embodiments, if the user applies for a dynamic short message code on another device, and needs to hold the mobile phone corresponding to the mobile phone number and obtain the short message verification code through the application on the device, the problem of the existing short message verification code can be avoided.

If the session ID function is supported, you need to save the SMS content for each session ID (by the capacity limit, you can set the maximum number of saved SMS messages. If the first-in first-out principle is exceeded, the first received SMS content will be discarded) Return the corresponding SMS verification code according to the Session ID included in the application.

If the Session ID function is not supported, you need to save the received SMS content. If you receive a new SMS content, it will overwrite the previous one to ensure the timeliness of the SMS.

Business platform and SIM card applications can use end-to-end encryption to protect the security of SMS content.

Example two:

As shown in FIG. 9, the example provides a method for transmitting authentication information, including:

1: Applying an application SMS verification code on the device, for example, sending an application or request for requesting a short message carrying the verification information to the service platform based on the mobile phone number; the short message verification code here is one of the foregoing verification information carried in the short message.

2: The service platform generates a short message verification code and a session identifier;

3: The service platform sends the SMS verification code and the session identifier to the application on the SIM card; the application on the SIM card is installed and runs on the SIM card;

4: The application saves the SMS verification code and the session identifier on the SIM card;

5: The application on the SIM card sends a successful SMS response to the service platform;

6: The service platform returns a response, for example, sending a return response to the application on the device based on the session identifier, and the response may send a notification to the device to notify the device that the application has sent the SMS verification code.

7: The application reads the short message request, and the short message request carries the AID and the session identifier.

8: The API(s) on the device performs permission verification;

9: Select the application (AID) on the SIM card;

10: The API(s) sends a read short message request to the selected SIM card, where the request carries a session identifier provided by the application on the device;

11: The application on the SIM card queries the short message according to the session identifier;

12: The application on the SIM card sends the short message content to the API(s);

13: API(s) forwards the short message content to the application on the device;

14: The application on the device fills in the content of the short message (ie, the short message verification code) into the corresponding location;

15: Verify through interaction with business applications

The service platform checks the short message verification code after receiving the verification request that carries the session identifier and the short message content sent by the application on the device;

17: The service platform returns the verification result to the application on the device.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.

The units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing module, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; The unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage device includes the following steps: the foregoing storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. A medium that can store program code.

The foregoing is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present application. It should be covered by the scope of protection of this application. Therefore, the scope of protection of the present application should be determined by the scope of the claims.

Claims

A verification information processing method, comprising:

Determine whether the business application has permission to access the user identification card;

When the service application has the right to access the user identification card, the short message is read from the user identification card, where the short message includes verification information;

Transmitting the short message to the service application.
The method of claim 1 wherein

Determining whether the service application has the right to access the short message stored on the user identification user identification card, including:

Determining, according to the application identifier of the service application, whether the service application has the right to access the user identity card.
The method according to claim 1 or 2, wherein

The determining whether the service application has the right to access the short message stored on the user identification user identification card further includes:

Matching a first verification identifier provided by the service application and a second verification identifier provided by the user identity card;

And determining, according to the result of the matching, whether the service application has the right to access the user identity card, wherein the second verification identifier is corresponding to the short message stored on the user identity card.
The method of claim 1 wherein

Determining whether the service application has the right to access the short message stored on the user identification user identification card, including:

Transmitting, by the service identifier, the first verification identifier that is sent by the service application to the user identifier card, where the first verification identifier is used to match the user identifier card with the second verification identifier, where The second verification identifier is corresponding to the short message stored on the user identification card;

When the service application has the right to access the user identification card, the short message is read from the user identification card, including:

Receiving, by the user identity card, the short message sent when the first check identifier and the second check identifier match.
The method according to claim 3 or 4, wherein the first verification identifier is a first session identifier of the service application in a session with the service platform;

The second verification identifier is a second session identifier sent by the service platform to the user identity card.
A verification information processing method includes:

Sending an acquisition request for verification information to the service platform;

Sending a read request to the access control middleware;

And receiving, by the access control middleware, the short message that is read from the user identity card based on the read request, where the short message carries the verification information, and is sent by the service platform to the user identity based on the obtaining request. Identification card.
The method of claim 6 wherein

The method further includes:

Receiving a sending notification returned by the service platform after sending a short message carrying the verification information;

The sending a read request to the access control middleware includes:

After receiving the transmission notification, the read request is sent to the access control middleware.
The method according to claim 6 or 7, wherein

The read request carries an application identifier of the service application and/or a first verification identifier that is in a session with the service platform;

The application identifier and/or the first verification identifier are used by the access control middleware to determine whether the service application has permission to access the user identity card.
The method of claim 8 wherein

The first verification identifier is a first session identifier of the service application that performs a session with the service platform.
A verification information processing method, comprising:

Receiving an acquisition request of the verification information sent by the service application;

And sending, according to the obtaining request, a short message carrying the verification information to the user identity identification user card of the designated device.
The method of claim 10, wherein the method further comprises:

Sending a notification that the short message has been sent to the business application.
The method according to claim 10 or 11, wherein

The method further includes:

Sending a second verification identifier to the user identification card, where the second verification identifier is used alone or in combination with an application identifier of the service application, for verifying whether the service application has rights from the user The identification card reads the short message.
The method of claim 12, wherein

The second verification identifier is a session identifier of the session between the service platform and the service application.
A communication device running an access control middleware, the access control middleware comprising:

a determining unit configured to determine whether the business application has permission to access the user identification user identification card;

a reading unit configured to read a short message from the user identification card when the service application has the right to access the user identification card, where the short message includes verification information;

a transmitting unit, configured to transmit the short message to the service application.
A communication device is installed with a service application, and the service application includes:

a first sending unit, configured to send an acquisition request of the verification information to the service platform;

a second sending unit, configured to send a read request to the access control middleware;

The first receiving unit is configured to receive the short message that is read by the access control middleware from the user identification user identification card based on the read request, where the short message carries verification information, which is based on the service platform The obtaining request is sent to the user identification card.
A business platform that includes:

a second receiving unit, configured to receive an acquisition request of the verification information sent by the service application;

The third sending unit is configured to send, according to the obtaining request, a short message carrying the verification information to the user identity identification user identifier card of the designated device.
A communication device comprising: a transceiver, a memory, a processor, and a computer program stored on the memory and executed by the processor;

The processor is coupled to the transceiver and the memory, respectively, for implementing the verification information processing method provided by any one of claims 1 to 5, 6 to 9, and 10 to 13 by executing the computer program.
A computer storage medium storing a computer program; the computer program being executed to implement the verification information processing method provided by any one of claims 1 to 5, 6 to 9 and 10 to 13 .