CN114493565A

CN114493565A - Account association method and account association management system

Info

Publication number: CN114493565A
Application number: CN202011254802.7A
Authority: CN
Inventors: 蔡剑波; 洪涛; 盛近春; 沈小梅; 陈贤强; 袁道繁; 陈洪; 程赛; 肖雯; 梁滨; 史翔禄; 覃丹; 徐安淇; 曹文红; 杨慧; 蔡辉明; 刘派; 潘丽莹
Original assignee: Unionpay International Co ltd
Current assignee: Unionpay International Co ltd
Priority date: 2020-11-11
Filing date: 2020-11-11
Publication date: 2022-05-13

Abstract

The invention relates to an account association method, which comprises the steps of obtaining a first mark from a mark service provider based on receiving a first association request from a first application program, and returning the first mark to the first application program; instructing the first application program to push a first mark to the second application program; and obtaining a second token corresponding to the first token from the token service provider based on receiving a second association request from the second application and returning the second token to the second application. The method can effectively protect the user data, prevent transaction failure and improve the use experience of the user.

Description

Account association method and account association management system

Technical Field

The invention relates to the technical field of electronic payment, in particular to an account association method and a corresponding account association management system.

Background

With the popularization of electronic payment technology, various mobile application programs (APP) with payment functions are installed or registered on an intelligent terminal and then are related to operation of binding a bank card (bank account), so that convenient and fast mobile payment is realized conveniently. Binding a bank card requires a user to input key information of the bank card, such as a card number, a CVN2, a validity period, a name, a mobile phone number and the like, but information may be leaked or illegally acquired in the input process of the information, which introduces financial security risk. Meanwhile, many manual input operations are required for binding each time, and each application program needs to perform the binding operation separately, which is a burden for the user. Furthermore, the inability of the mobile application to obtain the status of the bank card in a timely manner may result in a transaction failure when the user is unaware that the bank card has expired or been frozen.

Disclosure of Invention

An aspect of the present invention is to provide an account association method, which can overcome the defects in the prior art at least in part.

To this end, the present invention discloses an account association method for associating a user's account with one or more payment applications, the method comprising obtaining a first token from a token service provider based on receiving a first association request from a first application, and returning the first token to the first application; the first association request comprises account information of a user, and the first application program and the payment application program are installed in an intelligent terminal held by the user; instructing the first application program to push a first mark to a second application program, wherein the second application program is one of the payment application programs; and obtaining a second token corresponding to the first token from the token service provider based on receiving a second association request from the second application and returning the second token to the second application.

Optionally, the method comprises obtaining a mapping between the first tag and the second tag from a tag service provider.

Optionally, the method includes obtaining a validity period for the first tag and/or the second tag from a tag service provider.

Optionally, the method includes deactivating the second indicia based on determining that the first indicia is deactivated.

Optionally, the method further comprises accepting a query of the first application, the query for determining at least one payment application that supports the account association operation.

Another aspect of the present invention is to provide an account association management system capable of facilitating a card binding operation of a user.

To this end, the invention discloses an account association management system configured to associate an account of a user with one or more payment applications, the system comprising a first association unit configured to obtain a first token from a token service provider based on receiving a first association request from a first application, and to return the first token to the first application, thereby instructing the first application to push the first token to a second application; the first association request comprises account information of a user, the first application program and the payment application program are installed in an intelligent terminal held by the user, and the second application program is one of the payment application programs; and a second associating unit configured to acquire a second tag corresponding to the first tag from the tag service provider based on receiving a second association request from the second application, and return the second tag to the second application.

Alternatively, the system is arranged at a party independent from the intelligent terminal and the label service provider respectively.

Optionally, the system comprises a tag management unit configured to perform at least one of: acquiring a mapping relation between a first label and a second label from a label service provider; recording the mapping relation between the first mark and the second mark; deactivating the second indicia based on determining that the first indicia is deactivated; the validity of the first indicia is checked based on determining that the second indicia is invalid.

Optionally, the system comprises an application querying unit configured to accept a query of the first application, querying at least one payment application for determining support for the account association operation.

The account association management system provided by the invention associates the account of the user with the payment application program through the marks corresponding to each other, thereby being beneficial to protecting user data and preventing transaction failure. In addition, the complicated information input process is also omitted through the information pushing process from the first application program to the second application program, and the use experience of a user is favorably improved.

Drawings

Fig. 1 is a flowchart illustrating an account association method according to an embodiment of the present invention.

FIG. 2 illustrates a coupling relationship diagram of an account association management system according to one embodiment.

Fig. 3 exemplarily shows a flow of the first application program acquiring the first mark.

Fig. 4 illustratively shows a flow of a first application initiating an account association operation.

Detailed Description

In the following description specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that embodiments of the invention may be practiced without these specific details. In the present invention, specific numerical references such as "first element", "second device", and the like may be made. However, specific numerical references should not be construed as necessarily subject to their literal order, but rather construed as "first element" as opposed to "second element".

The specific details set forth herein are merely exemplary and may be varied while remaining within the spirit and scope of the invention. The term "coupled" is defined to mean either directly connected to a component or indirectly connected to the component via another component. The abbreviated term "PAN" refers to the user's primary account number, typically a bank card number. The abbreviated term "TOKEN" is a payment TOKEN that is a substitute value for the primary account number. The abbreviated term "TSP" denotes a tag service provider, which is a subject that generates and maintains TOKEN, also manages TOKEN requesters, and provides the generated TOKEN to the requesters. The account manager APP denotes an APP installed in the mobile terminal, which the user can use to manage a personal bank account. The account management party APP Gateway represents a service end of the account management party APP, and provides a service request interface for the account management party APP to call. An issuing system of an institution refers to an information management system operated by an issuing (banking) institution, which is generally associated with a banking system.

Preferred embodiments of methods, systems and devices suitable for implementing the present invention are described below with reference to the accompanying drawings. Although embodiments are described with respect to a single combination of elements, it is to be understood that the invention includes all possible combinations of the disclosed elements. Thus, if one embodiment includes elements A, B and C, while a second embodiment includes elements B and D, the invention should also be considered to include A, B, C or the other remaining combinations of D, even if not explicitly disclosed.

According to an embodiment of the present invention, there is provided an account associating method, as shown in FIG. 1, including steps S10-S12-S14-S16-S18. The steps S10 and S18 are optional steps, and whether to execute the steps may be determined according to the application.

Step S10: and accepting the inquiry of the first application program installed on the intelligent terminal to the payment application program. The query is to determine one or more payment applications that support the account association operation such that the first application initiates the account association operation. Step S10 may be performed by the account association server, which is independent of the user side. The account association server can be independent of the bank end and the label service provider, and can also be arranged at the bank end or the label service provider. The following description will take the account-related server as an independent party (independent of the user side, the bank side, and the tag service provider) as an example. In this step, when the first application is in a running state, a query operation may be automatically initiated to determine which of a plurality of payment applications also installed on the smart terminal may support the account association operation. The first application may also initiate a query operation at the prompt of the account association server. The account association server may maintain a white list in which a list of payment applications that support the account association operation is recorded, which may be periodically updated. And after the query result is obtained, the first application program selects a second application program to be associated from the first application program. As an example, the first application may be a bank App (or cell phone bank), and the payment application may be a desired App for the user to make a payment, through which the user may make a mobile payment, including payment for goods, services, public transportation fees, utility fees, and the like.

In some embodiments of the present invention, step S10 is not performed, and the second application is selected directly in the first application for account association operations. The first application may itself maintain a white list of payment applications that support account association operations for the user to select from among the second applications to associate.

Step S12: a first tag is obtained from a tag service provider based on receiving a first association request from a first application and returned to the first application.

Specifically, the first application program initiates an account association operation through user authorization, and submits a first association request to an account association server. The first association request may include a valid account information of the user, such as PAN, CVN2 (bank card verification code), etc., and the identification code of the first application. After receiving the first association request, the account association server may perform security verification (e.g., short message verification) first, and then forward the valid account information to the tag service provider TSP. The tag service provider generates a first tag corresponding to the valid account information accordingly. By way of example, the first indicia may consist of 13-19 digits, the value of which is in accordance with the basic validation rules of the account, e.g. in accordance with the LUHN algorithm verification. Furthermore, the first token is assigned within a legal BIN, and the digits of the first token are not the same as, and do not conflict with, the digits of the PAN. By means of the first token, a user account can be uniquely determined. After receiving the first mark generated by the mark service provider, the account association server returns the first mark to the first application program on the intelligent terminal. In some embodiments, the returned content may be encapsulated in a return instruction packet, which may include the first tag and, in some cases, the applicable authentication code.

Step S14: the first application is instructed to push the first token to the second application.

In this step, the account association server instructs the first application to push the first token to the second application installed on the same intelligent terminal. As an example, the second application may be selected in a white list supporting account association operations obtained by the first application querying an account association server.

Since the first application has obtained the first token via step S12, the above indication transmitted from the account association server to the first application only needs to include one indication bit. Based on the indicator bit being "1", the first application pushes the first flag to the second application. Since the two applications are located in the same intelligent terminal, the pushing process is executed on the local side of the intelligent terminal. In some cases, before pushing, the first application program may also check whether the second application program supports the pushing operation, and if not, terminate the association operation.

Step S16: based on receiving a second association request from a second application, a second token corresponding to the first token is obtained from the token service provider and returned to the second application.

And after receiving the first mark pushed by the first application program, the second application program sends a second association request to the account association server, which indicates that the second application program allows subsequent account association operation. The second association request may include signed encrypted data, such as the first token received from the first application, and may also include an identification code of the second application. At step S16, the account association server requests a second token from the token service provider upon receiving the second association request. In response, the tag service provider may first check whether the first tag is in the validity period, and then generate a second tag based on the first tag, such that the generated second tag has a one-to-one correspondence with the first tag, and further, corresponds to the user account for the association operation. After receiving the second token from the token service provider, the account association server returns the second token to the second application. In this process, the account association server may record the mapping relationship between the first token and the second token, and check the validity period of both.

Step S18: the validity periods of the first tag and the second tag are obtained from the tag service provider.

As an optional step, step S18 may not be performed, or may be performed multiple times and periodically, so that the account association server checks the validity of the first token and the second token. After a certain mark is found to be invalid, the account association server can request the mark service provider to regenerate the corresponding first mark and the second mark, and the previous association relation is invalid, so that the payment transaction is prevented from failing.

In some embodiments, the account association server disables the second token when it is determined that the first token is disabled. When the second token is invalidated, the account association server checks the validity of the first token without directly invalidating it. In some embodiments, in the case that the first flag is valid and the second flag is invalid, the account association server may re-execute step S16, thereby resuming the account association operation.

In some embodiments of the present invention, some of the steps may be combined with each other, separated into multiple sub-steps, or performed in different orders, and some steps may be repeated multiple times without affecting the technical effect of the present invention. As an example, steps S12, S14 may be performed in combination, e.g. to return a return instruction packet (which includes the first token) from the account association server to the first application directly as an indication to the first application instructing it to push the first token to the second application. As another example, step S18 may be performed periodically so that the account association server learns the validity of the first token and the second token in time. When the first mark is invalid, the account association server can timely make the previous account association relation invalid, thereby avoiding transaction failure and simultaneously preventing the account information of the user from being stolen.

The account association method and various improved embodiments thereof can achieve the following technical effects:

1. the user only needs to finish one account association operation needing to input key information at the first application program end, and the subsequent account association operations of the second application programs can be finished by pushing information, so that a complicated information input process is omitted;

2. the first application program (bank App) can efficiently manage the account information of the cardholder, and the account information of the cardholder is not required to be acquired by various payment application programs randomly;

3. the account association operation and the information pushing process are all marked based on the TOKEN technology, all steps can be verified, and the safety degree is higher;

4. the bank card information (second mark) associated with the payment application program is a child TOKEN of the bank card information (first mark) associated with the first application program, the life cycle of the child TOKEN is limited by a parent TOKEN constraint, and when the bank card is expired or frozen, the account state of all the payment application programs associated with the bank card can be synchronously managed at one time.

According to some embodiments of the invention, there is provided a computer readable storage medium having stored thereon a collection of machine executable instructions which, when executed by a processor (including microprocessors, singlechips, chips, integrated circuits), will carry out the steps of the method of the above-described embodiments.

Another embodiment of the present invention provides an account association management system 21 configured to associate a user's account with one or more payment applications, as shown in fig. 2, the system comprising a first association unit 211, a second association unit 212, an optional token management unit 213 and an application querying unit 214. The units are coupled with each other by a uniform data interface. The account association management system 21 is independent of the tag service provider 10 and the smart terminal 30.

In particular, the first association unit 211 is configured to obtain the first token from the token service provider 10 based on receiving a first association request from the first application 301 of the smart terminal 30 and to return the first token to the first application, thereby instructing the first application 301 to push the first token to the second application 302 also installed in the smart terminal. The second associating unit 212 is configured to obtain a second tag corresponding to the first tag from the tag service provider 10 based on receiving a second association request from the second application 302 and return the second tag to the second application.

In the case of the intelligent terminal 30, various operations may be initiated or performed under the direction or prompt of the account association management system 21, but with user permission of the intelligent terminal (e.g., as prompted by a verification code or push message). In particular, the first association request comprises account information of the user, which is transmitted by the first application 301 to the first association unit 211. The first association unit 211 responds by transmitting a return packet to the first application 301 after acquiring the first tag. In response to the return bundle, the first application 301 pushes the first token to the second application 302. The second application 302 generates a corresponding second association request accordingly. After receiving the second association request, the second association unit 212 responds, obtains and returns the second token to the second application program 302, and the account association operation is finished this time. The first application 301 and the second application 302 are installed in the smart terminal 30 held by the user.

The first tag has a particular mapping with the second tag, which may depend on the generation method employed by the tag service provider 10 in generating the first tag and the second tag. In some embodiments, the second token may be a child of the first token, i.e., a parent-child mapping relationship exists between the two. The account association management system 21 may record the mapping relationship between the first token and the second token, and check the validity period of both. This mapping and validity period can be obtained or verified in near real-time with the tag service provider 10 to maintain the authenticity and timeliness of both tags. In some embodiments, upon determining that the first token is invalid, the account association management system 21 also invalidates the second token; and upon determining that the second flag is invalid, the account association management system 21 verifies to the flag service provider 10 whether the first flag is still in the validity period. The above management of the first and second markers may be performed by the optional marker management unit 213. The tag management unit 213 is coupled to both the first association unit 211 and the second association unit 212 and may be coupled to the tag service provider 10 via an input/output interface of the account association management system 21, as shown in fig. 2.

The account association management system 21 may also include an application querying unit 214 that accepts queries of the first application 301 to determine which payment applications support account association operations, which may be referred to as whitelists. According to the query result, the intelligent terminal 30 can confirm whether a member of the white list exists in the installed payment application program, and further can execute account association operation on the first application program 301 and the second application program 302 selected from the white list. By way of example, the first application is a bank App, and the second application is a non-bank-side App supporting mobile payment and code-scanning payment.

In some embodiments, the account association management system 21 further includes a prompting unit that actively issues a prompt to a plurality of smart terminals in communication connection with (or in proximity to) the smart terminals, prompting a bank App (if any) on each smart terminal to initiate an account association operation, which may be initiated by the bank App issuing a first association request to the account association management system 21.

In some embodiments of the invention, at least a portion of the above-described system may be implemented using a distributed set of computing devices connected by a communications network, or based on a "cloud". In such a system, a plurality of computing devices operate together to provide services by using their shared resources. For example, the first association unit and the second association unit may be deployed in pairs with a plurality of wireless communication base stations, serve nearby intelligent terminals, and provide real-time performance and convenience for account association operations.

A "cloud" based implementation may provide one or more advantages, including: openness, flexibility and extensibility, centrally manageable, reliable, scalable, optimized for computing resources, having the ability to aggregate and analyze information across multiple users, connecting across multiple geographic areas, and the ability to use multiple mobile or data network operators for network connectivity.

FIG. 3 illustrates an example flow of a first application program obtaining a first token. Through the process, the user can complete the card binding operation, and the bank card is bound with the account manager App through the account association management system. Firstly, a user inputs information of a bank card PAN, a CVN2 and the like to be bound into an account manager App (namely a first application program), the account manager App acquires a binding short message verification code from an account manager App Gateway (a server of the first application program), the App Gateway sends bank card information and a verification code acquisition request (a first association request) to an account association management system after verification, the application Gateway forwards the bank card information and the verification code acquisition request (the first association request) to an institution issuing system (an institution issuing the bank card) through the account association management system, and the institution issuing system returns a verification result and the verification code to the account association management system. And then, the account association management system sends a request to the tag service provider to request the tag service provider to generate a Token (first tag) according to the card number of the bank card, and after the Token generated by the TSP is obtained, the account association management system returns the Token and the short message verification code to the App Gateway for the storage and operation of the App of the account manager. And after the user inputs the verification code on the App of the account manager, the card binding operation is completed.

FIG. 4 illustrates an example flow of a first application initiating an account association operation. Specifically, a user firstly selects a bank card to be pushed by an account management side App, then inquires an account application side App (payment application program) list supporting card binding operation from an account association management system through an App Gateway, and according to the intersection of the list and the account application side App list installed on the intelligent terminal, the account management side App can designate one account application side App as a second application program. Subsequently, the account manager App may further check whether the account application App supports pushing, and then push the bank card information (including the first token) to the account application App. In response, the account application side App generates a card binding request (second association request), and accordingly, the account application side App gateway (server side of the second application program) submits signature encryption data to the account association management system, wherein the signature encryption data comprises bank card information pushed by the account management side App. In response, the account association management system may request the Token service provider to generate a child Token (second Token), and upon receiving the child Token, record the Token mapping relationship and return the child Token to the account applicator App. Therefore, the card binding operation of the account application side App can be completed.

Those of skill in the art would appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the aspects disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To demonstrate interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

The above description is directed to the preferred embodiment of the present invention only, and is not intended to limit the scope of the present invention. Various modifications may be made by those skilled in the art without departing from the spirit of the invention and the appended claims.

Claims

1. An account association method for associating a user's account with one or more payment applications, the method comprising:

a) acquiring a first label from a label service provider based on receiving a first association request from a first application program, and returning the first label to the first application program; the first association request comprises account information of a user, and the first application program and the payment application program are installed in an intelligent terminal held by the user;

b) instructing the first application program to push the first mark to a second application program, wherein the second application program is one of the payment application programs; and

c) and obtaining a second token corresponding to the first token from the token service provider based on receiving a second association request from the second application, and returning the second token to the second application.

2. The method of claim 1, further comprising:

obtaining a mapping relationship between the first tag and the second tag from the tag service provider.

3. The method of claim 1, further comprising:

obtaining a validity period of the first tag and/or the second tag from the tag service provider.

4. The method of claim 3, further comprising:

deactivating the second indicia based on determining that the first indicia is deactivated.

5. The method of claim 1, further comprising:

accepting a query of the first application, the query for determining at least one of the payment applications that supports account association operations.

6. A computer readable storage medium having stored thereon a collection of machine executable instructions which, when executed by a processor, implement the method of any one of claims 1-5.

7. An account association management system configured to associate a user's account with one or more payment applications, the system comprising:

a first association unit configured to obtain a first tag from a tag service provider based on receiving a first association request from a first application and return the first tag to the first application, thereby instructing the first application to push the first tag to a second application; the first association request comprises account information of a user, the first application program and the payment application program are installed in an intelligent terminal held by the user, and the second application program is one of the payment application programs; and

a second association unit configured to acquire a second tag corresponding to the first tag from the tag service provider based on receiving a second association request from the second application, and return the second tag to the second application.

8. The system of claim 7, wherein the system is disposed on a separate party from the smart terminal and the tag service provider.

9. The system of claim 7, further comprising a tag management unit configured to perform at least one of:

obtaining a mapping relationship between the first tag and the second tag from the tag service provider;

recording the mapping relation between the first mark and the second mark;

deactivating the second indicia based on determining that the first indicia is deactivated;

checking the validity of the first marker based on determining that the second marker is invalid.

10. The system of claim 7, further comprising an application querying element configured to:

11. The system of claim 7, further comprising a prompt unit configured to:

and prompting the first application program to initiate account association operation.

12. The system according to any of claims 7-11, characterized in that the first and/or the second system of correlation units are implemented based on a set of distributed computing devices, respectively.