CN101561956A - Method and system for information interaction - Google Patents

Abstract

The invention discloses an information interaction method and system. Wherein, the method includes: the business platform receives the order information sent by the personal computer, and sends a transaction request to the payment system through the Internet, the transaction request includes the order information, and the payer information includes the payer mobile phone identification; The mobile phone sends an unconfirmed transaction message, which includes order information; the payment system receives the transaction confirmation message returned by the mobile phone; after the payment system verifies the payer account and password, it transfers the purchase amount included in the confirmation message from The account of the payer is transferred to the account of the payer. The information exchange is completed through two network channels. Specifically, the information exchanged through the Internet in the prior art needs to be confirmed by the mobile phone before corresponding processing can be performed in the present invention, thereby improving the security of information exchange.

Description

Method and system for information exchange

technical field

The present invention relates to network communication technology, in particular to a method and system for information interaction.

Background technique

In the process of information exchange between the two parties through the Internet, the exchanged information is often stolen, which causes the problem of low security of information exchange. The following takes an example of the theft of information exchanged by both parties through the Internet during an online transaction.

With the large-scale popularization of the Internet, various banks have gradually opened their own online banking systems. Some online banking systems are limited to account information inquiries, some include online transaction functions such as transfer payments, and some have already involved loans, investments, etc. content. The following is a detailed description of the payment process for online transactions, which includes the following steps:

Step 101, the business platform authenticates the identity of the user.

The business platform receives a login request sent by a personal computer (PC, Personal Computer) through the Internet (Internet), and authenticates the user according to the username and password included in the login request. At the same time, the PC can also authenticate the relevant business websites provided by the business platform.

Step 102, the PC logs into the business platform.

In step 103, the PC sends order information to the business platform.

The order information includes the purchase item selected by the user, the purchase amount and the account number of the charging party.

Step 104, the business platform sends a transaction request to the payment system.

The transaction request includes order information. The corresponding relationship between the account number and the stored amount is stored in the payment system.

Step 105, the payment system receives the account number and password of the payer sent by the PC, and after verifying the account number and password, transfers the purchase amount contained in the order information from the account number of the payer to the account number of the payer.

The process of verifying the account number and password of the payer includes: the payment system extracts the stored password corresponding to the account number sent by the PC, and compares the extracted password with the password sent by the PC. If they are the same, the verification is successful; then verification fails.

Criminals steal users' account numbers and passwords by means of online banking transactions, thereby stealing a large amount of users' funds. Common methods of stealing user accounts and passwords are accomplished through Trojan horse programs. For example, a hacker first injects a Trojan horse program into the PC system, and the monitoring system residing in the PC system can intercept the system and the online bank account opened by the user when surfing the Internet. and password window. That is, when the user enters the account number and password of the payer in the online banking program, the computer will automatically send the code of the relevant information to the hacker, and the hacker will read it back to decipher it, and then use the deciphered account number and password of the payer In addition, when the user enters the account number of the payer in the online banking program, the computer may also modify the account number of the payer, or modify the account number and purchase amount of the payer at the same time, so as to steal the user's funds.

In the existing payment process realized through the Internet, the payment system first receives the transaction request containing the order information sent by the PC through the business platform, and then receives the payer account number and password sent by the PC, and then transfers the purchase amount. In this process, since the information sent by the PC to the payment system is likely to be modified, an error occurs in the transfer processing of the payment system's purchase amount.

It can be seen that the existing solutions for information exchange through the Internet have the disadvantage of low security.

Contents of the invention

The invention provides a method for information interaction, which can improve the security of information interaction.

The invention provides an information interaction system, which can improve the security of information interaction.

A method for information interaction, the method comprising:

The business platform receives the order information sent by the personal computer, and sends a transaction request to the payment system through the Internet. The transaction request includes order information. Fang mobile phone ID;

The payment system sends an unconfirmed transaction message to the mobile phone corresponding to the mobile phone identifier of the payer, and the unconfirmed transaction message includes order information;

The payment system receives the transaction confirmation message returned by the mobile phone, the transaction confirmation message includes the purchase amount, account number of the charging party, account number of the paying party and password;

After the payment system verifies the account number and password of the payer, the purchase amount included in the confirmation message is transferred from the account number of the payer to the account number of the payer.

An information interaction system, the system includes a business platform, a payment system and a mobile phone;

The business platform is used to receive the order information sent by the personal computer, and send a transaction request to the payment system through the Internet, the transaction request includes order information, and the order information includes purchased items, purchase amount, payer information and charge party account number, The payer information includes the payer mobile phone identifier;

The payment system is used to send an unconfirmed transaction message to the mobile phone corresponding to the mobile phone identifier of the payer, the unconfirmed transaction message includes order information; the receiving mobile phone returns a transaction confirmation message, the transaction confirmation message includes the purchase amount, the account number of the charging party . Payer account number and password; after the payment system verifies the payer account number and password, transfer the purchase amount included in the confirmation message from the payer account to the charge party account;

The mobile phone is used to receive an unconfirmed transaction message sent by the payment system, and return a transaction confirmation message to the payment system.

It can be seen from the above scheme that in the present invention, the business platform sends a transaction request to the payment system through the Internet; the payment system sends an unconfirmed transaction message to the mobile phone corresponding to the mobile phone identifier of the payer, and receives the transaction confirmation message returned by the mobile phone. Including the purchase amount, the account number of the payer, the account number of the payer, and the password; then, after the payment system verifies the account number and password of the payer, the purchase amount is transferred from the account number of the payer to the account number of the payer. The invention sends a transaction request to the payment system through the Internet, and then performs transaction confirmation and fee payment through the mobile phone network and the mobile phone. The information exchange is completed through two network channels, and the information exchanged through the Internet needs to be confirmed by the mobile phone before it can be processed accordingly, thereby improving the security of the information exchange.

Description of drawings

FIG. 1 is a flowchart of a method for information interaction in the prior art;

Fig. 2 is a schematic flowchart of a method for information interaction in the present invention;

Fig. 3 is a flow chart example 1 of the method of information interaction in the present invention;

FIG. 4 is the second example of the flow chart of the method for information interaction in the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the embodiments and accompanying drawings.

In the prior art, the information exchange is completed through the Internet. In order to improve the security of the information exchange, the present invention enables the information exchange to be completed through two network channels. For the convenience of description, the two parties performing information exchange are denoted as party A and party B here. Specifically, after Party A receives the information processing request sent by Party B, it sends the content included in the information processing request to a third party through the mobile phone network, and the third party confirms that it is correct and returns a confirmation message. Treat accordingly. In the present invention, the information exchanged by both parties through the Internet is sent to the third party through the mobile phone mobile network for confirmation, and then corresponding processing is performed. If criminals modify the information exchanged through the Internet, the third party does not confirm it, nor No further processing will be performed. Thus, the effectiveness and security of information exchange are improved.

There are many kinds of information to be interacted with, and the information transmitted during the online transaction is taken as an example below for illustration. Specifically, firstly, the PC sends a transaction request to the payment system through the Internet, the transaction request includes order information, the order information includes purchased items, purchase amount, payer information, and the account number of the payer, and the payer information includes the payer mobile phone identification; The system then confirms the transaction with the mobile phone through the mobile phone network. The payment system receives the transaction confirmation message sent by the mobile phone and then proceeds to transfer the fee. The transaction confirmation message includes the confirmed purchase amount, the account number of the charging party, the account number of the paying party and the password. It is difficult to track the information interaction process completed through the two networks simultaneously. For example, suppose the account number of the payer included in the transaction request sent by the computer to the payment system is modified, but because the subsequent payment system needs to conduct transactions with the mobile phone Confirmation, once the payer discovers that the account number of the payer or the purchase amount has been modified, the order information will not be confirmed and the transaction will be terminated. Therefore, the security of information exchange is improved.

The content of the transaction confirmation message sent by the mobile phone to the payment system generally cannot be changed. In order to further improve the security of information interaction, for future possible situations where the content of the transaction confirmation message is illegally changed, for example, for the In the case where the purchase amount or the account number of the charge party is changed, the payment system in the present invention compares the purchase amount and account number of the charge party included in the order information with the purchase amount and account number of the charge party included in the transaction confirmation message before performing the fee transfer process. If they are the same, the fee transfer processing is performed; otherwise, the fee transfer processing is not performed.

In the present invention, an intelligent memory card is also installed on the mobile phone of the payer, and identity authentication, signature authentication, etc. are performed through the intelligent memory card and the payment system. Referring to Fig. 2, it is an exemplary flow chart of the method for information interaction of the present invention, and the process includes the following steps:

Step 201, the business platform receives the order information sent by the personal computer through the Internet.

The order information includes purchased items, purchase amount, information of the payer and account number of the payer, and the information of the payer includes the mobile phone identifier of the payer.

Step 202, the business platform sends a transaction request to the payment system through the Internet.

The transaction request includes order information.

Step 203, the payment system sends an unconfirmed transaction message to the mobile phone corresponding to the mobile phone identifier of the payer through the mobile phone network.

The unconfirmed transaction message includes order information.

This step can be automatically triggered by the payment system after receiving the transaction request; it can also be triggered after the payment system receives the unconfirmed transaction message sending request sent by the mobile phone, that is, triggered by the mobile phone. For the situation triggered by the mobile phone, the mobile phone needs to log in to the payment system before sending an unconfirmed transaction message to the payment system to issue a request. Optionally, before the payment system receives the mobile phone login, identity authentication is performed between the payment system and the smart memory card to improve security.

There are many ways to implement identity authentication between the payment system and the smart memory card. Here, the method of using the root certificate for identity authentication is taken as an example for illustration. The payment system stores the corresponding relationship between the account number opened by the user and the corresponding password. The authentication center is set up in the payment system. During the account opening process, the payment system notifies the user of the root certificate adopted by the authentication center to save the root certificate. to the Smart Memory Card. When performing identity authentication, the smart storage card receives the payment system certificate sent by the payment system, and uses the root certificate to verify the payment system certificate. If the verification is passed, the smart storage card passes the authentication of the payment system; the payment system receives the payment system certificate sent by the smart storage card. The smart memory card certificate uses the root certificate to verify the smart memory card certificate, and if the verification is passed, the payment system passes the authentication of the smart memory card.

Step 204, the payment system receives the transaction confirmation message returned by the mobile phone.

The transaction confirmation message includes the purchase amount, the account number of the charging party, the account number of the paying party, and the password.

Step 205: After the payment system verifies the account number and password of the payer included in the transaction confirmation message, it transfers the purchase amount included in the transaction confirmation message from the account of the payer to the account of the payer.

The method of the present invention is illustrated below through the flow charts in Figures 3 and 4. Figure 3 shows the situation in which the payment system automatically triggers the subsequent process after receiving the transaction request sent by the business platform, and Figure 4 shows that the payment system receives the transaction request sent by the business platform. The case where the mobile phone triggers the follow-up process.

Referring to Fig. 3, it is an example 1 of the flow chart of the method for information interaction in the present invention, and the process includes the following steps:

Step 301, the business platform authenticates the identity of the user.

The business platform receives the login request sent by the PC through the Internet, and authenticates the user according to the user name and password included in the login request. At the same time, the PC can also authenticate the relevant business websites provided by the business platform.

In step 302, the PC logs into the business platform.

In step 303, the PC sends order information to the business platform.

The order information includes purchased items, purchase amount, information of the payer and account number of the payer, and the information of the payer includes the mobile phone identifier of the payer.

Step 304, the business platform sends a transaction request to the payment system.

The transaction request includes order information.

Step 305, the mobile phone sends a login request to the payment system, and performs identity authentication with the smart memory card on the mobile phone.

The root certificate authentication method can be used for identity authentication described in this step.

In this step, the mobile phone executes the mobile client program to access the payment system, starts the identity authentication process between the smart memory card on the mobile phone and the payment system, and establishes a secure data transmission channel between the mobile phone and the payment system after strict identity authentication.

The authentication process described in this step is optional.

Step 306, the mobile phone logs into the payment system.

Step 307, the mobile phone sends an unconfirmed transaction message delivery request to the payment system, and the unconfirmed transaction delivery request includes the related information of the order information; then the payment system obtains the stored order information according to the related information of the order information, and sends the message to the mobile phone including the order information. Unconfirmed transaction messages for information. The associated information of the order information may be an order number associated with the order information and the like.

Step 308, the mobile phone confirms the order information.

Step 309, the mobile phone sends a transaction confirmation message to the payment system.

The transaction confirmation message includes the purchase amount, the account number of the charging party, the account number of the paying party, and the password.

In order to further improve the security of information interaction, this step can encrypt the confirmation transaction message according to the method agreed with the payment system, and send the encrypted confirmation transaction message to the payment system. It decrypts.

Step 310: After the payment system verifies the account number and password of the payer included in the transaction confirmation message, it transfers the purchase amount contained in the transaction confirmation message from the account number of the payer to the account number of the payer.

The process of verifying the payer’s account includes: the payment system extracts the stored password corresponding to the payer’s account, and compares the extracted password with the password sent by the mobile phone. If they are the same, the verification is successful; if they are not the same, the verification fails. .

Step 311, the payment system returns the transaction result to the business platform and the mobile phone.

Referring to Fig. 4, it is the second example of the flow chart of the method for information interaction in the present invention, the process includes the following steps:

Steps 401-404 are the same as steps 301-304.

Step 405, the payment system signs the unconfirmed transaction message including the order information.

Step 406, the payment system sends the signed unconfirmed transaction message to the mobile phone.

The mobile phone mentioned in this step is the mobile phone corresponding to the mobile phone identification contained in the order information.

In step 407, the mobile phone confirms the order information after verifying the signature.

During the process of opening an account, the payment system and the user agree on their respective signatures, and then the payment system's signature is saved in the smart memory card, and the user's signature is saved in the payment system. When the mobile phone verifies the signature of the payment system, the smart memory card of the mobile phone judges whether the saved signature of the payment system is the same as the signature sent by the payment system. If they are the same, the verification is passed; otherwise, the verification fails; When verifying the signature, the payment system judges whether the stored predetermined signature is the same as the signature sent by the mobile phone. If they are the same, the verification is passed, otherwise the verification fails.

Step 408, the mobile phone signs the transaction confirmation message.

Step 409, the mobile phone sends a signed confirmation transaction message to the payment system.

The transaction confirmation message includes the purchase amount, the account number of the charging party, the account number of the paying party, and the password.

Step 410: After verifying the signature, the payment system verifies the account number and password of the payer included in the transaction confirmation message, and transfers the purchase amount included in the transaction confirmation message from the account of the payer to the account of the payer after the verification is passed.

Step 411, the payment system returns the transaction result to the business platform and the mobile phone.

In the above process, signatures are performed in both step 405 and step 408 to further improve the security of information exchange. Certainly, no signature may be performed in step 405 and step 408 .

The present invention also provides an information interaction system, the system includes a business platform, a payment system and a mobile phone;

The business platform is used to receive the order information sent by the personal computer, and send a transaction request to the payment system through the Internet, the transaction request includes order information, and the order information includes purchased items, purchase amount, payer information and charge party account number, The payer information includes the payer mobile phone identifier;

The payment system is used to send an unconfirmed transaction message to the mobile phone corresponding to the mobile phone identifier of the payer, the unconfirmed transaction message includes order information; the receiving mobile phone returns a transaction confirmation message, the transaction confirmation message includes the purchase amount, the account number of the charging party . Payer account number and password; after the payment system verifies the payer account number and password, transfer the purchase amount included in the confirmation message from the payer account to the charge party account;

The mobile phone is used to receive an unconfirmed transaction message sent by the payment system, and return a transaction confirmation message to the payment system.

Optionally, the payment system includes an unconfirmed transaction message sending module, a transaction confirmation message receiving module and a transfer module;

The unconfirmed transaction message issuing module sends an unconfirmed transaction message to the mobile phone corresponding to the mobile phone identifier of the payer;

The transaction confirmation message receiving module receives the transaction confirmation message returned by the mobile phone, and sends the transaction confirmation message to the transfer module;

The transfer module, after verifying the account number and password of the payer included in the transaction confirmation message, transfers the purchase amount included in the confirmation message from the account of the payer to the account of the payer.

Optionally, the payment system includes a sending request receiving module, and the mobile phone includes a sending request sending module;

The sending request sending module is used to send an unconfirmed transaction message sending request to the payment system;

The sending request receiving module is used to receive the unconfirmed transaction message sending request sent by the sending request sending module, and send a start command to the unconfirmed transaction message sending module to start the unconfirmed transaction message sending module to send the payment The mobile phone corresponding to the party's mobile phone ID sends an unconfirmed transaction message.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope, within the spirit and principles of the present invention, any modification, equivalent replacement, improvement, etc., shall be included in the protection scope of the present invention.

Claims (8)

1, a kind of information interactive method, it is characterized in that, this method comprises: business platform receives the sequence information that personal computer sends, send transaction request by the internet to payment system, this transaction request comprises sequence information, comprise in this sequence information and buy article, the purchase amount of money, payer information and payment collector number of the account, payer information comprises the payer mobile phone logo;

Payment system sends transaction message unconfirmed to the mobile phone of payer mobile phone logo correspondence, comprises sequence information in this transaction message unconfirmed;

Payment system receives the trade confirmation message that mobile phone returns, and comprises in this trade confirmation message buying the amount of money, payment collector number of the account, payer number of the account and password;

Payment system is transferred to the payment collector number of the account with the purchase amount of money that comprises in the acknowledge message from the payer number of the account after described payer number of the account and password are verified.

2, the method for claim 1, it is characterized in that, described the purchase amount of money that comprises in the acknowledge message is transferred to the payment collector number of the account from the payer number of the account before, this method comprises: the purchase amount of money and payment collector number of the account that payment system comprises sequence information, compare with the purchase amount of money that comprises in the trade confirmation message and payment collector number of the account, if identical, then carry out the purchase amount of money that comprises in the described acknowledge message and transfer to the payment collector number of the account from the payer number of the account.

3, the method for claim 1 is characterized in that, described payment system is before the mobile phone of payer mobile phone logo correspondence sends transaction message unconfirmed, and this method comprises:

The transaction message unconfirmed that payment system receives the mobile phone transmission of this payer mobile phone logo correspondence issues request.

4, method as claimed in claim 3 is characterized in that, on the described mobile phone intelligent memory card is set, and the transaction message unconfirmed that described payment system receives the mobile phone transmission of this payer mobile phone logo correspondence issues before the request, and this method comprises:

Carry out authentication between the intelligent memory card on payment system and the mobile phone.

5, as each described method in the claim 1 to 3, it is characterized in that, on the described mobile phone intelligent memory card is set, the transaction message unconfirmed that payment system is signed for band to the transaction message described unconfirmed of the mobile phone transmission of payer mobile phone logo correspondence;

Described payment system is after the mobile phone of payer mobile phone logo correspondence sends transaction message unconfirmed, this method comprises: the intelligent memory card on the mobile phone authenticates the transaction message unconfirmed of band signature, after authentication was passed through, intelligent memory card sent to payment system after trade confirmation message is signed;

Before the trade confirmation message that described payment system reception mobile phone returns, this method comprises: payment system authenticates the trade confirmation message of band signature.

6, a kind of system of information interaction is characterized in that, this system comprises business platform, payment system and mobile phone;

Described business platform, be used to receive the sequence information that personal computer sends, send transaction request by the internet to payment system, this transaction request comprises sequence information, comprise in this sequence information and buy article, the purchase amount of money, payer information and payment collector number of the account, described payer information comprises the payer mobile phone logo;

Described payment system is used for sending transaction message unconfirmed to the mobile phone of payer mobile phone logo correspondence, comprises sequence information in this transaction message unconfirmed; Receive mobile phone and return trade confirmation message, comprise in this trade confirmation message and buy the amount of money, payment collector number of the account, payer number of the account and password; Payment system is transferred to the payment collector number of the account with the purchase amount of money that comprises in the acknowledge message from the payer number of the account after described payer number of the account and password are verified;

Described mobile phone is used to receive the transaction message unconfirmed that payment system sends, and returns trade confirmation message to payment system.

7, system as claimed in claim 6 is characterized in that, described payment system comprises that transaction message unconfirmed issues module, trade confirmation message sink module and the module of transferring accounts;

Described transaction message unconfirmed issues module, sends transaction message unconfirmed to the mobile phone of payer mobile phone logo correspondence;

Described trade confirmation message sink module receives mobile phone and returns trade confirmation message, and trade confirmation message is sent to the module of transferring accounts;

The described module of transferring accounts after payer number of the account that trade confirmation message is comprised and password are verified, is transferred to the payment collector number of the account with the purchase amount of money that acknowledge message comprises from the payer number of the account.

8, system as claimed in claim 6 is characterized in that, described payment system comprises and issue the request receiver module, and described mobile phone comprises and issues request sending module;

The described request sending module that issues is used for sending transaction message unconfirmed to payment system and issues request;

The described request receiver module that issues, be used to receive and describedly issue the transaction message unconfirmed that request sending module sends and issue request, issue module to transaction message unconfirmed and send startup command and issue module and send transaction message unconfirmed to the mobile phone of payer mobile phone logo correspondence to start transaction message unconfirmed.

Images