WO2012031549A1

WO2012031549A1 - Method, apparatus, and system for security authentication in mobile payment

Info

Publication number: WO2012031549A1
Application number: PCT/CN2011/079374
Authority: WO
Inventors: 黄志辉
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2010-09-09
Filing date: 2011-09-06
Publication date: 2012-03-15
Also published as: CN102402746A; CN102402746B

Abstract

Provided are a method, an apparatus, and a system for security authentication in mobile payment, which relate to the field of communications. The method comprises: acquiring a payment account, a one-off payment password, and a mobile terminal number sent by a mobile terminal; judging whether the payment account and the mobile terminal number exist locally; if the payment account and the mobile terminal number exist locally, judging whether a one-off authentication password corresponding to the one-off payment password exists in a group of authentication passwords corresponding to the payment account; and if the one-off authentication password corresponding to the one-off payment password exists in the group of authentication passwords corresponding to the payment account, determining that the authentication of the one-off payment password is successful. The apparatus comprises a first acquiring module, a first judging module, a second judging module, and a payment module. The system comprises a mobile terminal, and a payment authentication server. The present invention improves the security of payment.

Description

Method, device and system for mobile payment security

The present invention relates to the field of communications technologies, and in particular, to a method, device and system for mobile payment security verification. Background technique

As mobile communications shift from voice services to digital services, various mobile value-added services are emerging, and mobile payment is one of them. The so-called mobile payment means that the two parties use the mobile terminal to make a payment by wireless means for a certain goods or business. The mobile terminal used for mobile payment can be a mobile phone, a PDA (Personal Digital Assistant), or the like.

At present, when paying through the mobile terminal, in order to ensure the security of the payment, the user inputs the payment password through the mobile terminal, and then the mobile terminal transmits the payment password to the operator server, and the operator server transmits the payment password to the payment verification server. After the payment verification server verifies the payment password, the payment is made.

However, in the process of implementing the present invention, the inventors have found that the prior art has at least the following problems:

The mobile terminal transmits the payment password to the operator server through the base station, and the carrier server transmits the payment password to the payment verification server, and the payment password may be captured by the illegal user, so that the illegal user can use the payment password to pass the payment verification server. The verification of the payment makes the existing payment method very unsafe. Summary of the invention

In order to enhance the security in the payment by the mobile terminal, the embodiment of the invention provides a method, device and system for the mobile payment security risk certificate. The technical solution is as follows: A method of mobile payment security 3 certification, comprising:

Obtaining a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal; determining whether the payment account and the mobile terminal number exist locally;

If the payment account and the mobile terminal number exist locally, determining whether a one-time verification password corresponding to the one-time payment password exists in a group of license passwords corresponding to the payment account;

If there is a one-time insurance password corresponding to the one-time payment password in a set of risk code corresponding to the payment account, it is determined that the one-time payment password insurance is successful.

Further, the method further includes: before acquiring the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal, the method further includes:

Obtaining the mobile payment verification information set by the user, and storing the mobile payment verification information locally, where the mobile payment insurance information includes: the mobile terminal number, a payment account corresponding to the mobile terminal number, And a set of verification passwords corresponding to the payment account.

Further, after the one-time payment password insurance is successful, the method further includes: setting a one-time verification password corresponding to the one-time payment password to be unavailable or the one-time verification password from the Deleted in a set of authentication passwords.

A device for mobile payment security insurance, comprising:

a first obtaining module, configured to acquire a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal;

a first determining module, configured to determine, after the first acquiring module acquires a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal, whether the payment account and the mobile terminal exist in the device Number

a second judging module, configured to: when the judgment result of the first judging module is that the payment account and the mobile terminal number are present in the device, determine whether a group of verification passwords corresponding to the payment account is There is a one-time verification password corresponding to the one-time payment password code;

a payment module, configured to: when the judgment result of the second judging module is that a one-time insurance password corresponding to the one-time payment password exists in a group of license passwords corresponding to the payment account, The one-time payment password insurance certificate is successful.

Further, the device further includes: a second obtaining module, configured to acquire, after the first acquiring module acquires the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal, the mobile payment verification information set by the user And storing the mobile payment verification information in the device, where the mobile payment insurance information comprises: the mobile terminal number, a payment account corresponding to the mobile terminal number, and the payment account A corresponding set of verification passwords.

Further, the device further includes: a setting module, configured to: after the payment module determines that the one-time payment password is successfully verified, set a one-time verification password corresponding to the one-time payment password to be unavailable Or deleting the one-time verification password from the set of verification passwords.

A system for mobile payment security verification, comprising: a mobile terminal and a payment verification server; the mobile terminal, configured to acquire a payment account input by a user, a one-time payment password, the payment account, a one-time payment password, and a mobile terminal The number is sent to the payment verification server; the payment verification server is configured to acquire a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal, and determine whether the payment account and the mobile terminal number exist locally; If the payment account and the mobile terminal number exist, it is determined whether a one-time insurance password corresponding to the one-time payment password exists in a group of insurance passwords corresponding to the payment account.

The payment verification server includes:

a first obtaining module, configured to acquire a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal; a first determining module, configured to determine, after the first acquiring module acquires a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal, whether the payment account and the Mobile terminal number;

a second judging module, configured to determine, when the judgment result of the first judging module is that the payment account and the mobile terminal number exist in the payment verification server, determine a group of insurance risks corresponding to the payment account Whether there is a one-time insurance password corresponding to the one-time payment password in the password;

Further, the payment verification server further includes: a second obtaining module, configured to acquire a mobile payment set by the user before the first obtaining module acquires the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal Verifying the information, and storing the mobile payment verification information in the payment verification server, where the mobile payment verification information includes: the mobile terminal number, a payment account corresponding to the mobile terminal number, and A set of risk code corresponding to the payment account.

Further, the payment verification server further includes: a setting module, configured to: after the payment module determines that the one-time payment password verification is successful, set a one-time verification password corresponding to the one-time payment password to Not available or remove the one-time verification password from the set of verification passwords.

The beneficial effects of the technical solutions provided by the embodiments of the present invention are:

By using a one-time payment password and a one-time verification password that can be used only once, the verification is performed, so that even if the one-time payment password is captured by the unlawful user during the payment process, the unlawful user can not use the one-time payment password to pay through the risk certificate. , increased security of payment. DRAWINGS

1 is a schematic flow chart of a method for mobile payment security verification according to Embodiment 1 of the present invention;

2 is a schematic flow chart of a method for mobile payment security verification according to Embodiment 2 of the present invention;

FIG. 3 is a schematic diagram showing the structure of a first mobile payment security verification apparatus according to Embodiment 3 of the present invention; FIG.

4 is a schematic diagram showing the structure of a second mobile payment security verification apparatus according to Embodiment 3 of the present invention;

FIG. 5 is a schematic structural diagram of a third apparatus for mobile payment security verification according to Embodiment 3 of the present invention; FIG.

6 is a schematic diagram showing the structure of a fourth mobile payment security verification apparatus according to Embodiment 3 of the present invention;

FIG. 7 is a schematic structural diagram of a system for mobile payment security verification according to Embodiment 4 of the present invention. detailed description

The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

Example 1

Referring to FIG. 1, an embodiment of the present invention provides a method for mobile payment security verification, including: Step 101: Acquire a payment account, a one-time payment password, and a mobile terminal number sent by a mobile terminal.

Step 102: Determine whether the payment account and the mobile terminal number exist locally.

Step 103: If the payment account and the mobile terminal number exist locally, determine whether there is a corresponding one of the set of verification passwords corresponding to the payment account corresponding to the one-time payment password. Verify the password once.

Step 104: If there is a one-time insurance password corresponding to the one-time payment password in the set of license password corresponding to the payment account, it is determined that the one-time payment password insurance is successful.

Further, before acquiring the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal, the method further includes:

Obtaining mobile payment verification information set by the user, and storing the mobile payment verification information locally, wherein the mobile payment insurance information comprises: the mobile terminal number, a payment account corresponding to the mobile terminal number, and the payment A set of risk code corresponding to the account.

Further, after determining that the one-time payment password insurance is successful, the method further includes: setting a one-time verification password corresponding to the one-time payment password to be unavailable or verifying the one-time verification password from the group Deleted in the password.

The mobile payment security verification method according to the embodiment of the present invention performs verification by using a one-time payment password and a one-time verification password that can be used only once, so that even if the one-time payment password is captured by the illegal user during the payment process, the illegal user It is also not possible to use the one-time payment password to pay through the risk certificate, which increases the security of the payment. And, the one-time payment password and the one-time payment can be realized by setting the one-time verification password corresponding to the one-time payment password to be unavailable or deleting the one-time verification password from the group of the license passwords. The license code can only be used once.

Example 2

Referring to FIG. 2, an embodiment of the present invention provides a method for mobile payment security verification, including: Step 201: A payment verification server obtains mobile payment verification information, and stores the mobile payment verification information in a payment verification server, where The mobile payment verification information includes: the mobile terminal number, a payment account corresponding to the mobile terminal number, and a set of verification passwords corresponding to the payment account. Wherein, one set of verification passwords includes at least two one-time verification passwords.

Wherein, the mobile terminal number is a number that can identify the mobile terminal, such as a mobile phone number of the mobile phone Code and so on. The payment account can be an account that can support mobile payment, such as a 4 credit card number, a credit card number, a Q currency account number, and a Fortune account. And the payment account corresponding to the mobile terminal number may be set one or more, and may be set according to the actual application status, which is not limited thereto. In addition, in the method described in the embodiment of the present invention, the verification password can be used only once, and thus can be referred to as a one-time verification password.

Specifically, when setting the mobile terminal number, the payment account corresponding to the mobile terminal number, and the set of verification passwords corresponding to the payment account, the user may directly set to the provider of the payment verification server, or may use a computer or the like. The provider of the remote connection payment verification server performs setting, which is not specifically limited. The set of verification passwords includes at least two one-time verification passwords. For example, the method for setting a group of verification passwords includes five one-time verification passwords: 0123, x456, abc, 3789, and 8888.

Specifically, when the payment verification server stores the mobile terminal number, the payment account corresponding to the mobile terminal number, and the set of verification passwords corresponding to the payment account, the payment verification server may be stored in the payment verification server in a list manner, or may be Other ways to store, the storage method is not specifically limited.

Step 202: When the user makes a payment through the mobile terminal, the mobile terminal requests the user to input the payment account and the one-time payment password.

Since the payment password can only be used once in the method of the embodiment of the present invention, it can be referred to as a one-time payment password.

Step 203: The mobile terminal acquires the payment account and the one-time payment password input by the user, and sends the payment account, the one-time payment password and the mobile terminal number to the payment verification server through the base station and the operator server.

Step 204: The payment verification server receives the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal, and determines whether the payment account and the mobile terminal number exist in the payment verification server. If yes, step 205 is performed; otherwise, End the current process. Step 205: The payment verification server determines whether there is a one-time insurance password corresponding to the one-time payment password input by the user this time in the group of verification passwords corresponding to the payment account, and if yes, step 206 is performed; otherwise, Go to step 207.

Step 206: The payment insurance certificate server determines that the one-time payment password insurance is successful, and sets the one-time verification password corresponding to the one-time payment password sent by the mobile terminal to be unavailable or from its corresponding group. The license is removed from the password and the current process ends.

After the payment verification server successfully verifies the one-time payment password, the payment account can be used for payment.

In addition, after the payment verification server successfully verifies the one-time payment password, the payment verification server may send a one-time payment password verification success message to the mobile terminal through the operator server and the base station, and notify the mobile terminal to successfully pay the password insurance certificate in one time.

By setting the one-time verification password entered by the user this time to be unavailable or deleting it from the set of verification passwords, the one-time payment password and the one-time verification password can be used only once, even in the payment process. The payment password is captured by the unlawful user, and the unlawful user cannot use the one-time payment password to pay, which increases the security of the payment.

And, it is not limited to the one-time payment password and the one-time verification password step 207: the payment verification server judges the movement by setting the one-time verification password input by the user this time to be unavailable or deleting it from the group of verification passwords. Whether the number of times the one-time payment password is input in the terminal exceeds a preset number of times. If it is exceeded, the current process is ended; otherwise, step 208 is performed.

The preset number of times may be 3 times, 5 times, etc., and may be flexibly set according to actual application conditions, which is not limited thereto.

Step 208: The payment verification server requests the mobile terminal to re-enter the one-time payment password. After receiving the request from the payment verification server, the mobile terminal requests the user to re-enter the one-time payment password, and then performs step 203. The mobile payment security verification method according to the embodiment of the present invention performs verification by using a one-time payment password and a one-time verification password that can be used only once, so that even if the one-time payment password is captured by the illegal user during the payment process, the illegal user It is also not possible to use the one-time payment password to pay through the risk certificate, which increases the security of the payment. And, the one-time payment password and the one-time payment can be realized by setting the one-time verification password corresponding to the one-time payment password to be unavailable or deleting the one-time verification password from the group of the license passwords. The license code can only be used once.

Example 3

Referring to FIG. 3, an embodiment of the present invention provides a device for mobile payment security verification, where the device includes:

The first obtaining module 301 is configured to obtain a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal.

The first determining module 302 is configured to determine, after the first obtaining module 301 obtains the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal, whether the payment account and the mobile terminal number are corresponding to the device. Payment account.

The second judging module 303 is configured to: when the judgment result of the first judging module 302 is that the payment account and the mobile terminal number are present in the device, determine whether there is a pair of license code passwords corresponding to the payment account The one-time payment password corresponds to the one-time verification password.

The payment module 304 is configured to determine, when the determination result of the second determining module 303 is that the one-time verification password corresponding to the one-time payment password exists in a group of verification passwords corresponding to the payment account, determining the one-time payment The password insurance certificate was successful.

Further, referring to FIG. 4, the apparatus further includes:

The second obtaining module 305 is configured to obtain the mobile payment verification information set by the user, and store the mobile payment verification information, before the first obtaining module 301 acquires the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal. In the device, wherein the mobile payment check The license information includes: the mobile terminal number, a payment account corresponding to the mobile terminal number, and a set of risk certificate passwords corresponding to the payment account.

Further, referring to FIG. 5 or FIG. 6, the device further includes:

The setting module 306 is configured to: after the payment module 304 determines that the one-time payment password is successfully verified, set the one-time verification password corresponding to the one-time payment password to be unavailable or the one-time verification password from the group Verify the password is removed.

The mobile payment security verification apparatus according to the embodiment of the present invention performs verification by using a one-time payment password and a one-time verification password that can be used only once, so that even if the one-time payment password is captured by the illegal user during the payment process, the illegal user It is also not possible to use the one-time payment password to pay through the risk certificate, which increases the security of the payment. And, the one-time payment password and the one-time payment can be realized by setting the one-time verification password corresponding to the one-time payment password to be unavailable or deleting the one-time verification password from the group of the license passwords. The license code can only be used once.

Example 4

Referring to FIG. 7, an embodiment of the present invention provides a system for mobile payment security verification, where the system includes: a mobile terminal 401 and a payment verification server 402.

The mobile terminal 401 is configured to obtain a payment account input by the user, a one-time payment password, and send the payment account, the one-time payment password, and the mobile terminal number to the payment verification server 402.

a payment verification server 402, configured to acquire a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal 401, and determine whether the payment account and the mobile terminal number exist locally; if the payment account and the mobile terminal exist locally The number determines whether a one-time verification password corresponding to the one-time payment password exists in a group of license passwords corresponding to the payment account.

The payment verification server 402 includes: a first obtaining module, configured to acquire a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal 401;

a first determining module, configured to determine, after the first obtaining module obtains the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal, whether the payment account and the mobile terminal number exist in the payment verification server 402;

a second judging module, configured to: when the judgment result of the first judging module is that the payment account and the mobile terminal number exist in the payment verification server 402, determine whether a set of verification passwords corresponding to the payment account exists a one-time verification password corresponding to the one-time payment password; a payment module, configured to: when the judgment result of the second judgment module is that the set of verification passwords corresponding to the payment account has a one-time corresponding to the one-time payment password When verifying the password, it is determined that the one-time payment password insurance is successful.

Further, the payment verification server 402 further includes:

a second obtaining module, configured to acquire mobile payment verification information set by the user, and store the mobile payment verification information in the payment verification server 402, before the first obtaining module acquires the one-time payment password and the mobile terminal number sent by the mobile terminal The mobile payment verification information includes: a mobile terminal number, a payment account corresponding to the mobile terminal number, and a set of risk certificate passwords corresponding to the payment account.

Further, the payment verification server 402 further includes:

a setting module, configured to: after the payment module determines that the one-time payment password is successfully verified, set a one-time verification password corresponding to the one-time payment password to be unavailable or the one-time verification password from the group of verification passwords Deleted.

The mobile payment security verification system according to the embodiment of the present invention performs verification by using a one-time payment password and a one-time verification password that can be used only once, so that even if the one-time payment password is captured by the illegal user during the payment process, the illegal user It is also not possible to use the one-time payment password to pay through the risk certificate, which increases the security of the payment. And, specifically, The one-time verification password corresponding to the one-time payment password is set to be unavailable or the one-time verification password is deleted from the set of risk passwords, and the one-time payment password and the one-time insurance password can be used only once. .

All or part of the technical solutions provided by the above embodiments may be implemented by software programming, and the software program is stored in a readable storage medium such as a hard disk, an optical disk or a floppy disk in a computer.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., which are within the spirit and scope of the present invention, should be included in the protection of the present invention. Within the scope.

Claims

Claim

A mobile payment security verification method, the method comprising: acquiring a payment account, a one-time payment password, and a mobile terminal number sent by a mobile terminal; determining whether the payment account and the mobile are locally present Terminal number

The method of claim 1, wherein the method further comprises: before acquiring the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal, the method further includes:

The method for verifying the security of the mobile payment according to claim 1 or 2, wherein after the determining that the one-time payment password insurance is successful, the method further includes:

A one-time verification password corresponding to the one-time payment password is set to be unavailable or the one-time verification password is deleted from the group of verification passwords.

A device for mobile payment security verification, the device comprising: a first obtaining module, configured to acquire a payment account, a one-time payment password and a mobile terminal number sent by the mobile terminal;

a first determining module, configured to determine, after the first acquiring module acquires a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal, whether the payment account and the mobile terminal exist in the device number; a second judging module, configured to: when the judgment result of the first judging module is that the payment account and the mobile terminal number are present in the device, determine whether a group of verification passwords corresponding to the payment account is There is a one-time verification password corresponding to the one-time payment password;

The device for secure verification of mobile payment according to claim 4, wherein the device further comprises:

a second acquiring module, configured to acquire mobile payment verification information set by the user, and the mobile payment verification information, before the first obtaining module acquires the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal Stored in the device, wherein the mobile payment insurance information comprises: the mobile terminal number, a payment account corresponding to the mobile terminal number, and a set of risk certificate passwords corresponding to the payment account.

The device of the mobile payment security verification according to claim 4 or 5, wherein the device further comprises:

a setting module, configured to: after the payment module determines that the one-time payment password verification is successful, set a one-time verification password corresponding to the one-time payment password to be unavailable or the one-time verification password from The set of verification passwords is deleted.

7. A system for mobile payment security verification, the system comprising: a mobile terminal and a payment verification server;

The mobile terminal is configured to acquire a payment account input by a user, a one-time payment password, and send the payment account, a one-time payment password, and a mobile terminal number to a payment verification server, where the payment verification server is configured to acquire the a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal, determining whether the payment account and the mobile terminal exist locally If the payment account and the mobile terminal number exist locally, it is determined whether a one-time insurance password corresponding to the one-time payment password exists in a group of license passwords corresponding to the payment account.

8. The mobile payment security verification system according to claim 7, wherein the payment verification server comprises:

a first determining module, configured to determine, after the first acquiring module acquires a payment account, a one-time payment password, and a mobile terminal number sent by the mobile terminal, whether the payment account and the Mobile terminal number;

The mobile payment security verification system according to claim 8, wherein the payment verification server further comprises:

a second acquiring module, configured to acquire mobile payment verification information set by the user, and the mobile payment verification information, before the first obtaining module acquires the payment account, the one-time payment password, and the mobile terminal number sent by the mobile terminal Stored in the payment verification server, wherein the mobile payment insurance information comprises: the mobile terminal number, a payment account corresponding to the mobile terminal number, and a set of insurance password corresponding to the payment account .

10. The system for mobile payment security verification according to claim 8 or 9, characterized in that The payment verification server further includes:

a setting module, configured to: after the payment module determines that the one-time payment password verification is successful, set a one-time verification password corresponding to the one-time payment password to be unavailable or the one-time insurance password Remove from the set of risk codes.