CN109587683B - Method and system, application program and terminal information database for SMS anti-monitoring - Google Patents

Abstract

The invention belongs to the field of Internet and communication, and relates to a method, a system, an application program and a terminal information database for anti-monitoring of short messages. The method includes: receiving plaintext related to an account user; randomly generating an encryption code corresponding to the plaintext, and encrypting the plaintext by using the encryption code to obtain the original ciphertext code; extracting the terminal identifier of the terminal receiving the SMS verification code, and at least The terminal information including the terminal identification, the encrypted password and the original ciphertext code is sent to the terminal information database; the same plaintext and terminal identification inputted by the account user are received again; according to the terminal identification input by the account user, the terminal information database is queried for the corresponding terminal identification. The latest encrypted password and original cipher text code; and according to the plain text input by the account user again, encrypt the plain text with the encrypted password to obtain the review cipher text code; judge whether to trust the SMS verification code according to the original cipher text code and the review cipher text code. It can effectively ensure the security of authentication through SMS.

Description

Method and system, application program and terminal information database for anti-monitoring of short messages

technical field

The invention belongs to the field of Internet and communication, and particularly relates to a method for preventing monitoring of short messages, a system for preventing monitoring of short messages, an application program and a terminal information database.

Background technique

With the increasing popularity of the mobile phone real-name system, more and more enterprises use the mobile phone SMS verification code as their own security barrier. Online banking, online shopping malls, group buying websites, ticketing companies and other enterprises of major banks use SMS verification, and choose to conduct security verification through mobile phone SMS. SMS verification codes have now become the main method of identity verification. Using mobile phone SMS verification codes, users can log in, change passwords, etc., and directly or indirectly use applications associated with funds. However, currently, short messages are mainly transmitted through 2G network (GSM), and the one-way authentication adopted by GSM has serious security defects, that is to say, GSM transmits short messages without encryption.

The base station can authenticate the legitimacy of the terminal (such as a mobile phone), but the terminal has no right to authenticate the legitimacy of the base station. A "pseudo base station" is a fake base station, which generally consists of a host computer and a laptop or a mobile phone. As long as the fake base station can send a signal similar to that of the real base station, it can deceive the mobile phone to access its network and conduct illegal activities. Taking advantage of this vulnerability, criminals disguise themselves as the operator's base station through a fake base station, and use other people's terminals to forcibly send SMS messages such as fraud and advertising sales to the user's mobile phone. Taking the mobile phone card information and short messages within a certain radius as the center, and using the monitored short messages to disguise the user for authentication, it will bring very serious problems, such as stealing the user's payment account information, etc. Financial security brings hidden problems.

How to ensure the security of verification through SMS has become a technical problem that needs to be solved urgently.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is aimed at the above-mentioned deficiencies in the prior art, and provides a method for anti-monitoring of short messages, a system for anti-monitoring of short messages, an application program and a terminal information database, which can effectively ensure the security of identity verification through short messages.

The technical solution adopted to solve the technical problem of the present invention is the method for preventing monitoring of short messages. Before the application program receives the short message verification code, it also includes the steps of verifying the account user:

Receive clear text related to account users;

Randomly generate an encryption code corresponding to the plaintext, and use the encryption code to encrypt the plaintext to obtain the original ciphertext code;

extracting the terminal identifier of the terminal receiving the short message verification code, and at least sending the terminal information including the terminal identifier, the encryption code and the original ciphertext code to the terminal information database;

receiving the same plaintext and the terminal identifier input again by the account user;

According to the terminal identifier input by the account user, query the terminal information database for the latest encrypted password and the original ciphertext code corresponding to the terminal identifier;

and, according to the plaintext input by the account user again, encrypting the plaintext using the encryption code to obtain a review ciphertext code;

According to whether the original cipher text code is consistent with the review cipher text code, it is judged whether to trust the short message verification code.

Preferably, the plaintext is input by the account user;

Alternatively, the plaintext is randomly generated by the application program logged in by the account user according to a predetermined rule, and the plaintext is returned to the account user.

Preferably, the information sent to the terminal information database further includes the name, version number, and developer information of the application to be logged in.

Preferably, the plaintext is any one of random characters, the ID number of the account user, the name of the account user, and one of the TOP10 contacts that the account user frequently calls recently.

A method for anti-monitoring of short messages, before an application program receives the short message verification code, further comprising the step of verifying an account user:

Receive and save the terminal identification, encryption code and cipher text code;

According to the query request, the latest encrypted code and the original cipher text code corresponding to the terminal identification are returned to the application program.

Preferably, before verifying the account user, it also includes a step of authenticating and registering the terminal in the terminal information database, including:

The account user sends the operator customer service password of the terminal to the terminal information database through a mobile switching network, and the mobile switching network includes sending a text message, a voice message, or making a voice call;

The terminal information database identifies the terminal identifier corresponding to the terminal, and extracts the operator's customer service password;

The terminal information database queries the operator's customer service password corresponding to the terminal identification in the operator's customer service system according to the terminal identification;

According to whether the passwords of the operator's customer service are consistent, it is determined whether the terminal is operated by a hacker.

Preferably, the step of judging whether the terminal is operated by a hacker according to whether the operator's customer service passwords are consistent, includes:

If the operator's customer service password is the same, it is considered to be the service authentication and registration performed by the account user;

If the operator's customer service password is the same, it is considered that the hacker pretends to be the account user to perform service authentication and registration.

Preferably, the information sent to the terminal information database further includes the name, version number, and developer information of the application to be logged in.

An application program comprising a verification module for verifying an account user, the verification module comprising an interface module, an encryption module, a transmission module, a review module and a judgment module, wherein:

The interface module is used to receive the plaintext related to the account user; and, receive the same plaintext and the terminal identifier input again by the account user;

The encryption module is used to randomly generate an encryption code corresponding to the plaintext, and use the encryption code to encrypt the plaintext to obtain the original ciphertext code;

The transmission module is configured to extract the terminal identifier of the terminal receiving the short message verification code, and at least send the terminal information including the terminal identifier, the encryption code and the original cipher text code to the terminal an information database; and, according to the terminal identification input by the account user, query the terminal information database for the latest encrypted password and the original cipher text code corresponding to the terminal identification;

The review module is configured to encrypt the plaintext using the encryption code according to the plaintext input by the account user again to obtain a review ciphertext code;

The judging module is configured to judge whether to trust the short message verification code according to whether the original ciphertext code is consistent with the review ciphertext code.

A terminal information database, which includes a storage module and a query module, wherein:

The storage module is used to receive and save the terminal identification, encryption code and cipher text code;

The query module is configured to return the latest encrypted password and the original cipher text code corresponding to the terminal identification to the application program according to the query request.

An anti-monitoring system for short messages includes the above-mentioned application program and the above-mentioned terminal information database.

The beneficial effects of the present invention are:

The method for anti-monitoring of short messages, the system for anti-monitoring of short messages, the application program and the terminal information database provided by the present invention can effectively prevent the harm caused by the pseudo base station, and completely solve the problem that the existing mobile phone receives a large number of junk short messages or mobile phones after connecting to the pseudo base station. The transmission information of the fake base station is stolen by the fake base station, especially to solve the problem that the fake base station can currently monitor the short message and make the authentication invalid, which brings very serious problems, such as stealing the payment account information inside, which leads to the hidden danger of the user's fund security. problem, avoid the harm caused by the user connecting to the pseudo base station, and ensure the normal use and security of the user account.

Description of drawings

1 is a flowchart of a method for preventing short message monitoring in Embodiment 1 of the present invention;

2 is a structural block diagram of a verification module in an application program in Embodiment 1 of the present invention;

3 is a flowchart of a method for preventing short message monitoring in Embodiment 2 of the present invention;

4 is a structural block diagram of a terminal information database in Embodiment 2 of the present invention;

5 is a structural block diagram of a system for preventing short message monitoring in Embodiment 3 of the present invention;

6 is a flowchart of a method for preventing short message monitoring in Embodiment 3 of the present invention;

In the attached drawings:

1-verification module; 11-interface module; 12-encryption module; 13-transmission module; 14-review module; 15-judgment module;

2-terminal information database; 21-storage module; 22-query module.

Detailed ways

In order to make those skilled in the art better understand the technical solutions of the present invention, the method for preventing short message monitoring, the system for preventing short message monitoring, the application program and the terminal information database of the present invention are further described in detail below with reference to the accompanying drawings and specific embodiments.

At present, SMS verification code is the main authentication method for modifying login passwords, payment passwords and other network activities, that is, the only authentication factor at present is to confirm the account user's identity through SMS verification code. The technical idea of the present invention is: based on the current status of identity verification, verifying the user identity of the account before the SMS verification code is input, that is, adding some is very simple for the account owner or terminal owner to implement, but for attackers It is very laborious and difficult to implement, thereby reducing the probability of success of an attacker who listens through SMS.

The method for anti-monitoring of short messages, the system for anti-monitoring of short messages, the application program and the terminal information database provided by the present invention can effectively solve the problem that an existing terminal (such as a mobile phone) receives a large number of junk short messages after connecting to a pseudo base station or transmits information to be blocked by the pseudo base station. Theft, or even the short message being monitored by the fake base station, makes the authentication invalid, preventing the user from connecting to the fake base station, thus effectively preventing the harm caused by the fake base station, and ensuring the normal use and security of the user account.

Example 1:

This embodiment provides a method for anti-monitoring of short messages and a corresponding application program, which can effectively realize the account user identity verification of the application program before receiving the short message verification code, and ensure the security of the user account.

As shown in Figure 1, the method for preventing SMS monitoring further includes the steps of verifying the account user before the application receives the SMS verification code:

Step S11): Receive plaintext related to the account user.

In this step, there are two ways to obtain the plaintext. One is that the plaintext is input by the account user, that is, the user manually inputs it into the application program. Second, the plaintext is randomly generated by the application logged in by the account user according to predetermined rules, and the plaintext is returned to the account user. That is to say, there is no need for the user to manually enter the plaintext. After the user instructs to verify the identity, the application automatically generates a random plaintext and sends it to the interface to inform the user that the plaintext is generated under the rules agreed upon by both parties. Of course, the plaintext may be any one of random characters, the ID number of the account user, the name of the account user, and one of the top 10 contacts that the account user frequently calls recently.

Step S12): randomly generate an encryption code corresponding to the plaintext, and use the encryption code to encrypt the plaintext to obtain the original ciphertext code.

In this step, the encryption code may be various current encryption algorithms, which are not limited here, and remain unchanged in the first authentication stage of the user.

Step S13): extracting the terminal identifier of the terminal receiving the SMS verification code, and at least sending the terminal information including the terminal identifier, the encryption code and the original ciphertext code to the terminal information database.

In this step, preferably, the information sent to the terminal information database also includes the name of the application that needs to be logged in, the version number, and the developer's application information, so as to be able to better distinguish the establishment of the application-encryption and password Correspondence to ciphertext.

Step S14): Receive the same plaintext and terminal identifier input again by the account user.

In this step, the account user needs to manually input the plaintext input in step S11), or the plaintext generated by the application and returned to the account user.

Step S15): According to the terminal identifier input by the account user, query the terminal information database for the latest encrypted password and original ciphertext code corresponding to the terminal identifier.

In this step, the encrypted code and the original ciphertext code are exchanged between the application program and the terminal information base through the network.

Step S16): according to the plaintext input by the account user again, encrypt the plaintext with an encryption code to obtain a review ciphertext code.

In this step, the application program simply encrypts the plaintext manually input in step S14) according to the account, using the encryption code used in step S12) to obtain the review ciphertext code.

Step S17): According to whether the original cipher text code is consistent with the review cipher text code, it is judged whether to trust the SMS verification code.

In this step, whether the original ciphertext code is consistent with the review ciphertext code determines the degree of trust of the application in the subsequent SMS verification code transmitted through the 2G GSM network.

Through the above method, the application will generate a random encryption password twice to encrypt and review the plaintext before logging in through the SMS verification code each time. In this way, the verification of the account user also establishes a solid security line in advance before the SMS verification code, so as to ensure the authenticity of the application verification by the acceptable SMS verification code, and avoid the use of the monitored SMS verification code to cause account security risks. .

Correspondingly, as shown in FIG. 2, this embodiment also provides an application program, which includes a verification module for verifying account users, and the verification module 1 includes an interface module 11, an encryption module 12, a transmission module 13, The review module 14 and the judgment module 15, wherein:

The interface module 11 is used to receive the plaintext related to the account user; and, to receive the same plaintext and the terminal identification input by the account user again;

The encryption module 12 is used for randomly generating an encryption code corresponding to the plaintext, and encrypting the plaintext by using the encryption code to obtain the original ciphertext code;

The transmission module 13 is used to extract the terminal identifier of the terminal, and at least send the terminal information including the terminal identifier, the encryption code and the original ciphertext code to the terminal information database; Query the latest encrypted code and original cipher text code corresponding to the terminal identification in the information database;

The review module 14 is configured to encrypt the plaintext with an encryption code according to the plaintext input by the account user again to obtain a review ciphertext code;

The judgment module 15 is used for judging whether to trust the SMS verification code according to whether the original ciphertext code is consistent with the review ciphertext code.

On the basis of the above random plaintext, some other factors can also be added. For example, the application as the verifier not only asks the verified party to provide the terminal and the corresponding SMS verification code within a fixed time, but also adds the account user ID number, The name of the account user, or one of the TOP10 contacts of the account user who have frequently called recently; the application as the verifier can confirm the correctness of these information with the telecom operator. This information is easy for the verified party to provide, but for the attacker, in addition to monitoring the SMS verification code, other information is difficult to obtain as a pseudo base station attacker, so as to ensure the security of verification through SMS .

In addition, in the above-mentioned method, the order in which steps S14)-step S16) obtain the original ciphertext code from the terminal information database and the rechecked ciphertext code calculated by itself is not limited, as long as the original ciphertext code and the rechecked ciphertext code can be obtained And make a consistency comparison.

It should be understood that the verification module can be integrated in the application as a functional component of the application, which can be stored in the memory in the form of code; it can also be run independently as an independent applet, and the application has SMS verification requirements. When you associate the applet to call to verify the account user; or, directly call the applet, and ensure that the application and the applet's messages are synchronized, and directly receive the returned verification result after the verification is completed, which is not limited here.

The method and application program for anti-monitoring of short messages are applicable to APPs installed on mobile terminals (such as mobile phones), and are also applicable to web application programs on network terminals such as computers and notebooks, which are not limited here.

The SMS anti-monitoring method and the corresponding application program can effectively guarantee the security of the user who authenticates the account.

Example 2:

This embodiment provides a method for anti-monitoring of short messages and a corresponding terminal information database, which can effectively cooperate to realize the account user identity verification of the application program before receiving the short message verification code, and ensure the security of the user account.

As shown in Figure 3, the method for preventing SMS monitoring further includes the steps of verifying the account user before the application receives the SMS verification code:

Step S21): Receive and save the terminal identification, encryption code and cipher text code.

In this step, the information sent to the terminal information database also includes the name of the application that needs to be logged in, the version number, and the developer's application information, so that the correspondence between the application-encryption code and the cipher text code can be better distinguished. .

Step S22): According to the query request, return to the application the latest encrypted code and original cipher text code corresponding to the terminal identification.

In this step, the terminal information database returns the latest encrypted code and original cipher text code corresponding to the terminal identification to the application program.

Preferably, before verifying the terminal user, it also includes step S20): the step of the terminal performing authentication and registration in the terminal information database, including:

The account user sends the terminal operator's customer service password to the terminal information database through the mobile switching network, and the mobile switching network includes sending text messages, voice messages or making voice calls;

The terminal information database identifies and extracts the terminal identification and operator customer service password corresponding to the terminal;

The terminal information database queries the operator's customer service password corresponding to the terminal identification in the operator's customer service system according to the terminal identification;

According to whether the operator's customer service password is correct, determine whether the terminal is operated by a hacker. Among them, according to whether the operator's customer service password is correct, the steps of judging whether the terminal is operated by a hacker include:

If the operator's customer service password is correct, it is considered to be the service authentication and registration performed by the account user;

If the operator's customer service password is incorrect, it is considered that the hacker pretends to be an account user for business authentication and registration.

Correspondingly, as shown in FIG. 4 , this embodiment further provides a terminal information database 2, which includes a storage module 21 and a query module 22, wherein:

The storage module 21 is used to receive and save the terminal identification, encryption code and cipher text code;

The query module 22 is configured to, according to the query request, return the latest encrypted code and original cipher text code corresponding to the terminal identification to the application program.

The method for preventing monitoring of short messages and the corresponding terminal information database provide data support for verifying the security of account users.

Example 3:

This embodiment provides a system for anti-monitoring of short messages, which is based on the application program of Embodiment 1 and the terminal information database of Embodiment 2, and comprehensively realizes the method of anti-monitoring of short messages, so as to realize the account user of the application program before receiving the SMS verification code Authentication to ensure the security of user accounts.

When the terminal as the verified party chooses to be verified, for example, when it needs to log in to an application or a browser portal, before choosing to verify by sending an SMS verification code, the real identity of the account user is verified first. As shown in FIG. 5 , the SMS anti-monitoring system includes a verification module 1 and a terminal information database 2 in an application program. The following will describe the process of anti-monitoring of short messages in detail with reference to the methods and corresponding structures for anti-monitoring of short messages provided in Embodiment 1 and Embodiment 2. Please refer to FIG. 6 for the flowchart.

Embodiment 1:

Step S31): The terminal is authenticated and registered in the terminal information database.

In this step, the specific method of authentication and registration in the terminal information database is: the account user sends a request authentication and registration message including the terminal operator's customer service password to the terminal information database by means of a mobile switching network, such as sending a text message , a voice message, or a voice call. After receiving the request authentication and registration message, the terminal information database identifies and extracts the terminal identification corresponding to the terminal and the operator's customer service password, and queries the customer service system in the support system of the operator's background according to the terminal identification. If the password is correct, it is considered to be the authentication and registration of the service applied for by the account user, not the authentication and registration performed by the hacker pretending to be the account user; if the operator's customer service password is incorrect, it is considered to be the business authentication and registration performed by the hacker pretending to be the account user. register.

Step S32): The application program receives the plaintext related to the account user.

In this step, the account user himself enters a random plaintext in the application, such as "ABCDEFG".

Step S33): The application program randomly generates an encryption code corresponding to the plaintext, and uses the encryption code to encrypt the plaintext to obtain the original ciphertext code.

In this step, the application program generates a random encryption code KEY1, and then encrypts the plaintext "ABCDEFG" using the encryption code KEY1 for the first time to obtain the original ciphertext code, such as "1234567".

Step S34): the application program extracts the terminal identification of the terminal, and at least sends the terminal information including the terminal identification, the encryption code and the original ciphertext code to the terminal information database; correspondingly, the terminal information database receives and saves the terminal identification, encryption code and ciphertext.

In this step, the application program as the verifier sends the encrypted code KEY1 and the cipher text code "1234567" to the terminal information database for storage and recording.

Step S35): The application program receives the same plaintext and terminal identification input again by the account user.

In this step, the account user as the authenticated party sends his own plaintext "ABCDEFG" and the terminal identification (eg mobile phone number) to the application as the authenticator again.

Step S36): the application program queries the terminal information database for the latest encrypted password and original cipher text code corresponding to the terminal identification according to the terminal identification input by the account user; correspondingly, the terminal information database returns to the application program according to the query request. The latest encrypted code and original cipher text code corresponding to the terminal identification.

In this step, the application program serving as the verifier queries the terminal information database for the encryption code and cipher text code corresponding to the terminal according to the terminal identification. After receiving the query request, the terminal information database sends the encryption code KEY1 and the cipher text code "1234567" stored in itself to the application program.

Step S37): the application program encrypts the plaintext with an encryption code according to the plaintext input by the account user again to obtain a review ciphertext code.

In this step, according to the pre-agreed algorithm, the application program uses the plaintext "ABCDEFG" and the encrypted password KEY1 to calculate for the second time, and obtains the ciphertext code "1234567".

Step S38): The application program determines whether to trust the SMS verification code according to whether the original ciphertext code is consistent with the review ciphertext code.

In this step, if the original ciphertext code is the same as the review ciphertext code, and both are "1234567", the ciphertext code verification is passed, that is to say, the account user is the real holder of the terminal, and the application accepts and approves Trust subsequent SMS verification codes; if the original ciphertext is the same as the review ciphertext, the app does not trust subsequent SMS verification codes.

The application as a verifier, before accepting the account user's input of the SMS verification code transmitted through the 2G GSM network, verifies the ciphertext code through plaintext encryption twice, and only when the ciphertext code is verified can it confirm that the account user is the real one The holder of the terminal then performs the traditional SMS verification code verification.

Embodiment 2:

Step S31): The terminal is authenticated and registered in the terminal information database.

In this step, the specific method of authentication and registration in the terminal information database is: the account user sends a request authentication and registration message including the terminal operator's customer service password to the terminal information database by means of the mobile switching network, such as sending a text message , a voice message, or a voice call. After receiving the request authentication and registration message, the terminal information database identifies and extracts the terminal identification corresponding to the terminal and the operator's customer service password, and queries the customer service system in the support system of the operator's background according to the terminal identification. If the password is correct, it is considered to be the authentication and registration of the service applied for by the account user, not the authentication and registration performed by the hacker pretending to be the account user; if the operator's customer service password is incorrect, it is considered to be the business authentication and registration performed by the hacker pretending to be the account user. register.

Step S32): The application program receives the plaintext related to the account user.

In this step, the account user of the terminal first sends a verification request to the application. After receiving the verification request, the application generates a random plaintext such as "ABCDEFG" and sends it to the terminal interface to inform the account user. The plaintext here only needs to be the plaintext agreed upon by both parties. In this embodiment, the application program automatically generates the plaintext without requiring the terminal's plaintext input, and is directly and actively sent to the terminal interface.

Step S33): The application program randomly generates an encryption code corresponding to the plaintext, and uses the encryption code to encrypt the plaintext to obtain the original ciphertext code.

In this step, the application program generates a random encryption code KEY1, and then encrypts the plaintext "ABCDEFG" with the encryption code KEY1 to obtain the ciphertext code "1234567".

Step S34): the application program extracts the terminal identification of the terminal, and at least sends the terminal information including the terminal identification, the encryption code and the original ciphertext code to the terminal information database; correspondingly, the terminal information database receives and saves the terminal identification, encryption code and ciphertext.

In this step, the application program as the verifier sends the encrypted code KEY1 and the cipher text code "1234567" to the terminal information database for storage and recording. In order to avoid abuse of the encrypted password and the ciphertext code, the sent message may also include the corresponding application name, version number, developer and other related information to be logged in.

Step S35): the application program queries the terminal information database for the latest encrypted password and the original cipher text code corresponding to the terminal identification according to the terminal identification input by the account user; correspondingly, the terminal information database returns to the application program according to the query request. The latest encrypted code and original cipher text code corresponding to the terminal identification.

In this step, the application as the verifier searches the terminal information database for the encryption code and cipher text code corresponding to the terminal and the application according to the terminal identification and related information including the application name, version number, developer, etc. After receiving the query request, the terminal information database sends the latest ciphertext code "1234567" stored in itself and corresponding to the terminal identification to the application.

Step S36): the application program receives the same plaintext and terminal identification input again by the account user.

In this step, the account user as the verified party sends the plaintext "ABCDEFG" and the terminal identification (eg mobile phone number) received by himself to the application as the verifying party again.

Step S37): the application program encrypts the plaintext with an encryption code according to the plaintext input by the account user again to obtain a review ciphertext code.

In this step, the application program uses the plaintext "ABCDEFG" and the encrypted password KEY1 to perform the second calculation according to the pre-agreed algorithm, and obtains the ciphertext code "1234567".

Step S38): The application program determines whether to trust the SMS verification code according to whether the original ciphertext code is consistent with the review ciphertext code.

In this step, if the original ciphertext code is the same as the review ciphertext code, and both are "1234567", the ciphertext code verification is passed, that is to say, the account user is the real holder of the terminal, and the application accepts and approves Trust subsequent SMS verification codes; if the original ciphertext is the same as the review ciphertext, the app does not trust subsequent SMS verification codes.

The application as a verifier, before accepting the account user's input of the SMS verification code transmitted through the 2G GSM network, verifies the ciphertext code through plaintext encryption twice, and only when the ciphertext code is verified can it confirm that the account user is the real one The holder of the terminal then performs the traditional SMS verification code verification.

Embodiment three:

Step S31): The terminal is authenticated and registered in the terminal information database.

In this step, the specific method of authentication and registration in the terminal information database is: the account user sends a request authentication and registration message including the terminal operator's customer service password to the terminal information database by means of the mobile switching network, such as sending a text message , a voice message, or a voice call. After receiving the request authentication and registration message, the terminal information database identifies and extracts the terminal identification corresponding to the terminal and the operator's customer service password, and queries the customer service system in the support system of the operator's background according to the terminal identification. If the password is correct, it is considered to be the authentication and registration of the service applied for by the account user, not the authentication and registration performed by the hacker pretending to be the account user; if the operator's customer service password is incorrect, it is considered to be the business authentication and registration performed by the hacker pretending to be the account user. register.

Step S32): The application program receives the plaintext related to the account user.

In this step, the account user of the terminal first sends a plaintext request to the application. After receiving the request, the application generates a random plaintext such as "ABCDEFG" and sends it to the terminal interface to inform the account user. The plaintext here only needs to be the plaintext agreed upon by both parties, or it can be automatically generated by the application program without the need for a plaintext application of the terminal, and sent directly to the terminal.

Step S33): The application program randomly generates an encryption code corresponding to the plaintext, and uses the encryption code to encrypt the plaintext to obtain the original ciphertext code.

In this step, after the application receives the plaintext "ABCDEFG", it calls the authentication function in the terminal, the verification module generates a random encryption code KEY1, and then encrypts the plaintext "ABCDEFG" with the encryption code KEY1 to obtain the ciphertext Code "1234567".

Step S34): the application program extracts the terminal identification of the terminal, and at least sends the terminal information including the terminal identification, the encryption code and the original ciphertext code to the terminal information database; correspondingly, the terminal information database receives and saves the terminal identification, encryption code and ciphertext.

In this step, the application program as the verifier invokes the terminal identity verification function, and the verification module sends the encrypted code KEY1 and the cipher text code "1234567" to the terminal information database for storage and recording. In order to avoid abuse of the encrypted password and the ciphertext code, the sent message may also include the corresponding application name, version number, developer and other related information to be logged in.

Step S35): the application program queries the terminal information database for the latest encrypted password and the original cipher text code corresponding to the terminal identification according to the terminal identification input by the account user; correspondingly, the terminal information database returns to the application program according to the query request. The latest encrypted code and original cipher text code corresponding to the terminal identification.

In this step, the application as the verifier invokes the terminal identity verification function, and according to the terminal and relevant information including the application name, version number, developer, etc., queries the terminal information database for the encryption password and the corresponding encryption code of the terminal and the application. ciphertext. After receiving the query request, the terminal information database sends the ciphertext code "1234567" stored in itself to the verification module.

Step S36): the application program receives the same plaintext and terminal identification input again by the account user.

In this step, the account user as the authenticated party sends his own plaintext "ABCDEFG" and the terminal identification (eg mobile phone number) to the application as the authenticator again.

Step S37): the application program encrypts the plaintext with an encryption code according to the plaintext input by the account user again to obtain a review ciphertext code.

In this step, the application program uses the plaintext "ABCDEFG" and the encrypted password KEY1 to perform the second calculation according to the pre-agreed algorithm, and obtains the ciphertext code "1234567"

Step S38): The application program determines whether to trust the SMS verification code according to whether the original ciphertext code is consistent with the review ciphertext code.

In this step, the application program as the verifier invokes the terminal identity verification function, and the verification module judges whether the original ciphertext code is consistent with the review ciphertext code. The cipher text code verification is passed, that is to say, the account user is the real holder of the terminal, and the subsequent SMS verification code is accepted and trusted; if the original cipher text code is consistent with the review cipher text code, the subsequent SMS verification code is not trusted. . The verification result is returned to the application and determines the acceptance of the SMS verification code by the application level.

As an application program of the verifier, before accepting the account user's input of the SMS verification code transmitted through the 2G GSM network, the ciphertext code is verified through plaintext encryption twice. The holder of the terminal then performs the traditional SMS verification code verification.

The method for anti-monitoring of short messages, the system for anti-monitoring of short messages, the application program and the terminal information database provided by the present invention can effectively prevent the harm caused by the pseudo base station, and completely solve the problem that the existing mobile phone receives a large number of junk short messages or mobile phones after connecting to the pseudo base station. The transmission information of the fake base station is stolen by the fake base station, especially to solve the problem that the fake base station can currently monitor the short message and make the authentication invalid, which brings very serious problems, such as stealing the payment account information inside, which leads to the hidden danger of the user's fund security. problem, avoid the harm caused by the user connecting to the pseudo base station, and ensure the normal use and security of the user account.

It can be understood that the above embodiments are only exemplary embodiments adopted to illustrate the principle of the present invention, but the present invention is not limited thereto. For those skilled in the art, without departing from the spirit and essence of the present invention, various modifications and improvements can be made, and these modifications and improvements are also regarded as the protection scope of the present invention.

Claims (11)

1. A method for preventing short message monitoring is characterized in that an application program is installed on a mobile terminal, and before the application program receives a short message verification code, the method also comprises the steps of verifying an account user:

receiving plaintext input by the account user and related to the account user;

randomly generating an encryption code corresponding to the plaintext, and encrypting the plaintext by using the encryption code to obtain an original ciphertext code;

extracting a terminal identification of the mobile terminal receiving the short message verification code, and at least sending terminal information comprising the terminal identification, the encryption code and the original ciphertext code to a terminal information database;

receiving the same plaintext and the terminal identification input again by the account user;

inquiring the encryption code and the original ciphertext code which correspond to the terminal identifier and are closest to the current time from the terminal information database according to the terminal identifier input by the account user;

encrypting the plaintext by using the encryption code according to the plaintext input again by the account user to obtain a rechecked ciphertext code;

and judging whether to trust the short message verification code according to whether the original ciphertext code is consistent with the double-check ciphertext code.

2. The method for preventing short message monitoring according to claim 1, wherein the plaintext is inputted by the account user;

or the plaintext is randomly generated by the application program logged in by the account user according to a preset rule, and the plaintext is returned to the account user.

3. The method of claim 1, wherein the information sent to the terminal information database further includes a name, a version number, and information of a developer of the application program to be logged in.

4. The method for preventing interception of short messages according to any one of claims 1 to 3, wherein the plaintext is any one of random characters, account user identification numbers, account user names, and TOP10 contacts on which the account users have recently frequently made calls.

5. A method for preventing short message monitoring is characterized in that before an application program receives a short message verification code, the method also comprises the following steps of verifying an account user:

receiving and storing a terminal identifier, an encryption code and a ciphertext code;

according to the query request, returning the encryption code and the original ciphertext code which correspond to the terminal identifier and are closest to the current time to the application program;

the original ciphertext code is a code obtained by randomly generating an encryption code corresponding to a plaintext and encrypting the plaintext, wherein the plaintext is information which is input by an account user and is related to the account user;

the original ciphertext code is used for being compared with a rechecked ciphertext code obtained by the application program, so that the application program judges whether to trust the short message verification code according to whether the original ciphertext code is consistent with the rechecked ciphertext code, wherein the rechecked ciphertext code is a code word obtained by encrypting the plaintext input again by the account user by using the encryption code.

6. The method of claim 5, further comprising the steps of authenticating and registering the terminal in the terminal information database before the account user is verified, comprising:

the account user sends an operator customer service password of the terminal to a terminal information database in a mobile switching network mode, wherein the mobile switching network mode comprises sending a text short message, a voice short message or making a voice call;

the terminal information database identifies a terminal identifier corresponding to the terminal and extracts the operator customer service password;

the terminal information database inquires the operator customer service password corresponding to the terminal identification in a customer service system of an operator according to the terminal identification;

and judging whether the terminal is operated by a hacker or not according to the consistency of the customer service passwords of the operators.

7. The method of claim 6, wherein the step of determining whether the terminal is operated by a hacker according to whether the service passwords of the operators are consistent comprises:

if the operator customer service passwords are consistent, the service authentication and registration performed by the account user are considered;

and if the operator customer service passwords are consistent, the hacker pretends to be the service authentication and registration performed by the account user.

8. The method of claim 5, wherein the information sent to the terminal information database further includes a name, a version number, and information of a developer of the application program to be logged in.

9. The utility model provides an application program, its characterized in that, application program installs on mobile terminal, including being used for carrying out the verification module that verifies to account number user, the verification module includes interface module, encryption module, transmission module, recheck module and judgment module, wherein:

the interface module is used for receiving plaintext input by the account user and related to the account user; receiving the same plaintext and the terminal identification input again by the account user;

the encryption module is used for randomly generating an encryption code corresponding to the plaintext and encrypting the plaintext by using the encryption code to obtain an original ciphertext code;

the transmission module is used for extracting a terminal identifier of the mobile terminal for receiving the short message verification code and at least sending terminal information comprising the terminal identifier, the encryption code and the original ciphertext code to the terminal information database; the terminal information database is also used for inquiring the encryption code and the original ciphertext code which correspond to the terminal identifier and are closest to the current time according to the terminal identifier input by the account user;

the rechecking module is used for encrypting the plaintext by using the encryption code according to the plaintext input again by the account user to obtain a rechecked ciphertext code;

and the judging module is used for judging whether to trust the short message verification code according to whether the original ciphertext code is consistent with the rechecked ciphertext code.

10. A terminal information database is characterized by comprising a storage module and an inquiry module, wherein:

the storage module is used for receiving and storing the terminal identification, the encryption code and the ciphertext code;

the query module is used for returning the encryption code and the original ciphertext code which are corresponding to the terminal identifier and are closest to the current time to an application program according to a query request;

the original ciphertext code is a code obtained by randomly generating an encryption code corresponding to a plaintext and encrypting the plaintext, wherein the plaintext is information which is input by an account user and is related to the account user;

the original ciphertext code is used for being compared with a rechecked ciphertext code obtained by the application program, so that the application program judges whether to trust the short message verification code according to whether the original ciphertext code is consistent with the rechecked ciphertext code, wherein the rechecked ciphertext code is a code word obtained by encrypting the plaintext input again by the account user by using the encryption code.

11. A system for preventing short message interception, comprising the application program of claim 9 and the terminal information database of claim 10.

Images