CN101267456B - Method and system for preventing CP subscription simulation - Google Patents

Abstract

The invention relates to a method and a system for preventing CP from imitating ordering. The method includes: step 101, the user sends an order request to the WAP portal; step 102, the WAP portal marks the page element mark on its order prompt page, and sends the order prompt page containing the page element mark to the user; step 103, the user After confirmation, the mobile browser will splice header files in the confirmation order request according to the page element mark, which includes parameters identifying the user's order confirmation behavior; step 104, after the WAP portal receives the confirmation order request that includes the header file , verify the parameters in the header file that identify the user confirming the order behavior, make the order, and return an order success prompt. The invention ensures that the initiated ordering request is completely from the user terminal rather than from the script program of the terminal, eliminates the phenomenon that the fee is deducted without the user's knowledge, and protects the legitimate rights and interests of consumers.

Description

Method and system for preventing CP from simulated ordering

technical field

The invention relates to WAP ordering service, in particular to a method and system for preventing CP from simulating ordering. the

Background technique

The WAP (Wireless Application Protocol) platform includes modules such as a WAP portal and a billing gateway, and a database is set in the billing gateway. The order process of the existing WAP platform is as follows: WAP users click on the corresponding link request on the mobile phone, and arrive at the WAP platform through the WAP gateway. If there is no order, the billing page will pop up, allowing the user to order, and it can be used after ordering; if it is judged that the user has ordered, the user can be allowed to access. the

With the development of WAP services, more and more illegal access and ordering situations appear on the WAP platform, one of which is simulated ordering by content providers (CPs): by deploying illegal applications on user terminals, simulating users to place orders. the

In the prior art, access to illegal requests can be restricted by judging whether the source of the request is legitimate by means of a firewall or the like. This scheme can strengthen the security of access sources in some links of the network, but it cannot effectively control the malicious ordering simulated by CP. the

The patent application "Service Processing Method of WAP Gateway Server" (Application No. 200610161852.4) discloses a technical solution that can prevent illegal ordering. In this solution, the blacklist and whitelist of URL (Uniform Resource Locator) or IP are accessed through WAP browsing request. The purpose of preventing illegal ordering, but this scheme cannot be used to prevent the above-mentioned CP simulation ordering behavior. the

Contents of the invention

In order to solve the above-mentioned technical problems, the present invention provides a method and system for preventing CP from simulating ordering, the purpose of which is to prevent CP from simulating ordering. the

The present invention provides a method for preventing CP from simulating ordering, including:

Step 101, the user sends the order request to the WAP portal;

Step 102, the WAP portal marks the page element mark on its order prompt page, and sends the order prompt page containing the page element mark to the user;

Step 103, after the user confirms, the mobile browser will splice header files in the order confirmation request according to the page element mark, and the header file contains parameters identifying the user's order confirmation behavior;

Step 104: After receiving the order confirmation request including the header file, the WAP portal verifies the parameters in the header file that identify the user's order confirmation behavior, performs ordering, and returns an order success prompt. the

Further steps between step 103 and step 104 include: the user sends a confirmation subscription request to the WAP portal through the WAP gateway and the billing gateway. the

In step 104, the WAP portal returns an order success prompt to the user through the charging gateway and the WAP gateway. the

In step 102, the page element is marked as sendreferer="true" added after the page link where the user can order services

In step 104, the parameter identifying the user's order confirmation behavior is the service charge page link. the

The invention provides a system for preventing CP from simulating ordering, including a WAP gateway, a billing gateway, a WAP portal, a mobile phone, and a browser is installed on the mobile phone.

The WAP portal is also used to mark the page element mark on the order prompt page, and to verify whether the header file contains parameters identifying the user's order confirmation;

The browser is also used for splicing the header file in the order confirmation request according to the page element mark after the user confirms, and the header file contains parameters identifying the order confirmation behavior of the user. the

The page element is marked as sendreferer="true" added after the page link where the user can order services. the

The parameter identifying the user's order confirmation behavior is the service charge page link. the

The invention ensures that the initiated ordering request is completely from the user terminal rather than from the script program of the terminal, eliminates the phenomenon that the fee is deducted without the user's knowledge, and protects the legitimate rights and interests of consumers. the

Description of drawings

Fig. 1 is the detailed flowchart that prevents CP simulation from ordering provided by the present invention;

Fig. 2 is the overall flow chart that prevents CP simulation from ordering provided by the present invention;

Fig. 3 is a schematic structural diagram of a system for preventing CP simulation ordering provided by the present invention. the

Detailed ways

For CP simulated ordering, since the actual request is initiated from the mobile phone, it is difficult to distinguish it from the real user request. In the present invention, a specific page element mark (sendreferer) is marked on the page where the user confirms the order. When a normal user's mobile phone clicks on the page to initiate a confirmation, the mobile browser will splice a special Header in the request according to this mark, that is, the user confirmation mark, and pass it to the WAP portal. The script loaded on the mobile phone to simulate the user's request does not have the function of splicing the request Header, so the WAP portal can judge whether it is a request that the user really clicks according to this mark. the

Based on the above-mentioned reasons, the solution provided by the present invention to prevent CP simulation from ordering is: in the page link seen by the mobile browser, the WAP portal adds a sendreferer element, and when the user confirms ordering and clicks on this link, HTTP (hypertext Transfer Protocol) The header named Referer will be automatically spliced in the request packet, and the value is the URL of the service fee page address. This header is called the user confirmation mark. The WAP portal confirms that the user clicked from this page to initiate by verifying the header and the header value. Normal order request, if there is no such parameter in the user's request package, the WAP portal considers it to be an illegal order initiated by the script program simulating the user. When the WAP portal performs verification, if the verification is passed, a prompt of order success will be returned, and if the verification fails, a prompt of order failure will be returned. the

For example, in the order prompt page http://wap.uni-info.com.cn/home.aspx, there is a page url where users can order services: <go href="http://wap.uni-info.com. cn/test.aspx″>. In the present invention, a special mark will be added in the url: <go href="http://wap.uni-info.com.cn/test.aspx" sendreferer="true">, this is to click this link, the user clicks After confirmation, the browser splices a Header in the HTTP confirmation request packet, that is, Referer: http://wap.uni-info.com.cn/test.aspx. http://wap.uni-info.com.cn/test.aspx is the business tariff page. However, if the CP loads a malicious access script on the user's mobile phone, and the script initiates the request, the script does not have the function of splicing the Header, so the Header in a normal request cannot be generated. the

For example, a mobile phone user intends to subscribe to a music download service, and the music download service is divided into a monthly subscription service and a pay-per-view service. The user clicks the URL address of the music to download, and the WAP portal will return the order prompt page address (such as http://wap.uni-info.com.cn/home.aspx above) to the mobile phone user after receiving the request, and at the same time Also return the URL address of the service that the user can order (for example, the above go href= http://wap.uni-info.com.cn/test.aspx , the URL of the subscription service and the pay-per-view service that can be ordered are different) . In order to realize the purpose of the present invention, it is necessary to add sendreferer="true" in the back, so that the user can click when selecting. After the user clicks, the browser on the mobile phone splices a Header (such as the Referer above: http://wap.uni-info.com.cn/test.aspx). After the WAP portal receives the confirmation request from the user, it will verify the value of the Header, and after the verification is passed, it will return an order success prompt to the user.

A detailed description will be given below in conjunction with the accompanying drawings. the

The process of preventing CP from simulated ordering is shown in Figure 1, including:

Step 1, the user clicks on a service URL to initiate a request;

Step 2, after the WAP gateway obtains the request, it forwards the request to the billing gateway;

Step 3, the billing gateway BG judges whether the user has subscribed to this service, and finds that the user has not subscribed, and performs step 4, if the user has subscribed to the service, the user can directly use the service;

Step 4, the billing gateway initiates a jump, and turns the request to the order prompt page on the WAP portal;

Step 5, the WAP portal marks a specific page element mark on the order prompt page (i.e. sendreferer="true");

Step 6, the WAP portal returns to the order prompt page;

Step 7, the billing gateway returns to the order prompt page;

Step 8, the WAP gateway returns to the order prompt page;

Step 9, after the user sees the page, selects the product type he likes, clicks OK, and initiates a confirmation request to the WAP portal, and the mobile browser will splice a special Header (ie Referer) into the request according to the page element mark, as a user confirmation mark;

Step 10, after the WAP gateway obtains the request, it forwards the confirmation request containing the user confirmation mark to the billing gateway;

Step 11, the billing gateway sees the non-service URL of the confirmation request containing the user confirmation mark, and forwards it directly to the WAP portal;

Step 12, the WAP portal receives the order confirmation request, and verifies whether there is a user confirmation mark in the request header file, that is, verifies whether the Header exists, and whether its value is the address of the service fee page;

Step 13, the verification is passed, and the ordering logic is executed;

Step 14, the WAP portal returns to the order success prompt page;

Step 15, the billing gateway will return the order success prompt page;

Step 16, the WAP gateway will return the order success prompt page;

Step 17, the user sees the order success prompt, clicks to enter the service, and initiates a service URL request;

Step 18, after the WAP gateway obtains the request, it forwards the request to the billing gateway;

Step 19, the billing gateway judges whether the user has subscribed to this service, at this time the user has subscribed and the user can access;

Step 20, the billing gateway directly forwards to the service site;

Step 21, the business site returns a page response;

Step 22, the billing gateway returns the page response;

In step 23, the WAP gateway returns the page response. the

Fig. 2 is the overall flowchart provided by the present invention, including:

Step 201, after the billing gateway receives the order request from the user, it forwards the request to the order prompt page on the WAP portal;

Step 202, the WAP portal marks the page element mark on its order prompt page;

Step 203, the WAP portal sends the order prompt page containing the page element mark to the user;

Step 204, after the user confirms, the mobile browser will splice header files in the order confirmation request according to the page element mark, and the header file contains parameters identifying the user's order confirmation behavior;

Step 205: After receiving the order confirmation request, the WAP portal verifies the parameters identifying the order confirmation behavior of the user in the header file, performs the order, and returns an order success prompt. the

In order to realize the method that the present invention provides, the present invention provides the system that prevents CP simulation from ordering, as shown in Figure 3, comprises: WAP gateway 301, billing gateway 302, WAP portal 303, mobile phone 305, mobile phone 305 passes wireless communication network 304 Communicate with the above several modules. A browser is installed on the mobile phone 305; the WAP portal 303 is also used to mark the page element mark on the order prompt page, and to verify whether the header file contains parameters identifying the user's confirmation order behavior; the browser is also used for user confirmation. The header file is spliced in the order confirmation request according to the page element mark, and the header file contains parameters identifying the order confirmation behavior of the user. the

The page element is marked as sendreferer="true" added after the page link of the service that the user can order. the

The parameter identifying the user's order confirmation is the link to the business tariff page. the

Various modifications can be made to the above contents by those skilled in the art without departing from the spirit and scope of the present invention defined by the claims. Therefore, the scope of the present invention is not limited to the above description, but is determined by the scope of the claims. the

Claims (8)

1. prevent the method for content supplier's subscription simulation, it is characterized in that, comprising:

Step 101, the user is sent to the WAP (wireless application protocol) door with subscription request;

Step 102, the WAP (wireless application protocol) door is ordered mark page elements mark on prompting page at it, and the order prompting page that will comprise the page elements mark is sent to the user;

Step 103, after the user confirmed, mobile phone browser can be marked at according to page elements confirmed spelling joint file in the subscription request, comprises the parameter that identifying user is confirmed the order behavior in this header file;

After step 104, WAP (wireless application protocol) door are received the affirmation subscription request that comprises described header file, verify the parameter of identifying user affirmation order behavior in the described header file, order, and return order and successfully point out.

2. the method that prevents content supplier's subscription simulation as claimed in claim 1 is characterized in that, also comprises between step 103 and the step 104: the user will confirm that subscription request is sent to the WAP (wireless application protocol) door by Wireless Application Protocol Gateway and charging gateway.

3. the method that prevents content supplier's subscription simulation as claimed in claim 1 is characterized in that, in the step 104, the WAP (wireless application protocol) door returns order to the user and successfully points out by charging gateway, Wireless Application Protocol Gateway.

4. as claim 1, the 2 or 3 described methods that prevent content supplier's subscription simulation, it is characterized in that in the step 102, but page elements is labeled as the sendreferer=" true " that the page link of user's order business adds later.

5. the method that prevents content supplier's subscription simulation as claimed in claim 4 is characterized in that, in the step 104, identifying user confirms that the parameter of order behavior is the service tariff page link.

6. prevent the system of content supplier's subscription simulation, comprise Wireless Application Protocol Gateway, charging gateway, WAP (wireless application protocol) door, mobile phone, browser is installed on the mobile phone, it is characterized in that,

The WAP (wireless application protocol) door also be used for ordering mark page elements mark on the prompting page, and whether the checking header file comprises the parameter that identifying user is confirmed the order behavior;

Browser after also being used for the user and confirming, is marked at according to page elements and confirms spelling joint file in the subscription request, comprises the parameter that identifying user is confirmed the order behavior in this header file.

7. the system that prevents content supplier's subscription simulation as claimed in claim 6 is characterized in that, but described page elements is labeled as the sendreferer=" true " that the page link of user's order business adds later.

8. the system that prevents content supplier's subscription simulation as claimed in claim 7 is characterized in that, described identifying user confirms that the parameter of order behavior is the service tariff page link.

Images