CN101140648A

CN101140648A - Method for bank bill online authorisation and off line trading

Info

Publication number: CN101140648A
Application number: CNA2007101512365A
Authority: CN
Inventors: 王忠杰
Original assignee: Individual
Current assignee: Individual
Priority date: 2007-09-10
Filing date: 2007-09-17
Publication date: 2008-03-12

Abstract

The invention discloses a bank note online authorization and off-line exchange method. Prior exchange, a payer can log in a WEB server in a paying bank, autonomously select exchange element information, and create a payment password and an authorization running number for the exchange; after storing the data, the payer fills the received payment password and authorization running number into a bank note before submitting to a payee; the payee inputs the authorization element information according to the paying bank's prompt; after completely through, the system will perform exchange legality audit; if the audit result is OK, both parties will perform capital account transfer or corresponding deposit adsorption process.

Description

The method of bank bill online authorisation and off line trading

Technical field

The present invention relates to the financial service field, relate in particular to a kind of method of bank bill online authorisation and off line trading.

Background technology

Web bank has brought facility to people, people are the free and allotted fund legally of bank on the net, this has not only made things convenient for the client, and subdued huge operation cost for financial company, be financial service development in future trend, but also there is a drawback in Web bank, during online transaction, the payer must clearly know trading object, specific product, many material elementses such as dealing money, can't finish on the net for the transaction that can't determine these factors, therefore, if Web bank and off-line transaction are organically combined, not only can make things convenient for the client, and can subdue huge operation cost for financial company equally.

Existing method, application number by my application is 200710143546.2 bank bill obstacle-free payment platform, its shortcoming is the private key that the payer must have oneself, be applicable to and surf the Net or the client of original meaning online not, therefore the structure at authorization data has certain requirement, must finish the Trading Authorization work on basis on the corresponding system that the payer dominates, and then could realize the accessible payment of bank money, its inapplicable client who does not have private key belongs to licensing mode under the line.

Summary of the invention

The objective of the invention is to solve the many drawbacks in the existing bank money transaction, with effectively simple, safe and reliable is the basis, lead the developing direction of bank money transaction, the method for the bank bill online authorisation and off line trading of a safety, efficient, convenient, quick, low expense is provided for financial company and both parties.

Above-mentioned purpose realizes by following technical scheme:

A kind of method of bank bill online authorisation and off line trading, its composition comprises authorizes on the line and off-line transaction two parts composition, it is characterized in that: authorizing on the line is to be carried out in the transaction disposal environment that the bank of deposit of institute provides by the payer, off-line transaction then is to be carried out in the transaction disposal environment that paying bank or third party provide by the payee, one transaction is divided into two relatively independent processes, and connect by the bill that carries believable effect, reach safe real-time payment purpose, its hardware is formed and is comprised:

One Trading Authorization terminal, the payer owns, be meant can with paying bank's equipment that accepting server carries out information interaction of concluding the business, main PC and the mobile phone that can surf the Net of finger, it links to each other with the transaction accepting server of paying bank by internet or wireless network;

Terminal is submitted in one transaction to, the payee all, be meant can with paying bank's equipment that accepting server or the third party service organization carry out information interaction of concluding the business, mainly PC, mobile phone or the landline telephone that can surf the Net of finger;

One transaction accepting server, paying bank owns, the mutual environment that is used to the payer Trading Authorization to be provided and to provide a transaction to accept for the payee, it is made up of one or more WEB server and voice server, submits to terminal to link to each other by internet, wireless network or public telephone network with Trading Authorization terminal and transaction;

One identity certificate server, paying bank owns, and is used to verify the legitimacy of receipts, payer's identity;

One data-storing server, paying bank all, be used to store conclude the business and carry out information-related data with payer's Trading Authorization and payee;

One calculation server, paying bank owns, and is used to generate, verifies and examines from receipts, payer import for information about;

One security protection system, the payer owns, and is used for the protection transaction and normally carries out and safety, and it is made up of equipment such as fire wall, routers;

Described all continuous by LAN (Local Area Network) or special line by all equipment of paying bank;

The method that realizes between each system is as follows:

Authorize on the line: the payer lands the WEB server by authorization terminal, after passing through the safety certification of authentication server, autonomous option dealing authorization message item on the Trading Authorization page of the unified standard that the WEB server provides, to trading range, feature is carried out autonomous Trading Authorization, form and authorize element information, carry out cryptographic calculation or signature by calculation server or third party to comprising described mandate element information, generate one group of payment cipher that is associated and authorize serial number, and will this time authorize relevant Transaction Information to be stored in the data-storing server with the payer, the online Trading Authorization terminal that passes to of information with clients such as described payment cipher and mandate serial number need is kept by payer's storage or record;

Off-line transaction: the payee submits to terminal to submit request to paying bank or third party service organization's initiation transaction by transaction, the relevant mandate element information item that is provided according to the transaction accepting server of paying bank, form prompting payee with interaction finishes input, after correct input such as the described information that requires the payee to import about mandate element information item and payment cipher etc. finishes, calculation server is according to the resulting trade identity audit of the mandate element information of transaction being carried out strictness from payee's transaction data request and payer, whether satisfy the condition of payer institute authority to pay fully with the Transaction Information of checking payee submission, by after, calculation server will send the corresponding service processing instruction according to payer's mandate, finish accordingly by the comprehensive business system of paying bank and to transfer accounts, circle such as deposits at operation, and related data in the renewal data-storing server, with the online transaction submission terminal that feeds back to of result, pass to the payee, and print or store corresponding bank and return document, closing the transaction.

This technical scheme has following beneficial effect:

1, convenience: the characteristics of maximum of the present invention are exactly simple to operate and convenient, and the convenience that it promptly has a Web bank has remedied the deficiency of Web bank again, for the client provides simple, convenient, quick, a safe trade mode.

2, low cost: the present invention does not invest the requirement of specialized equipment for the bank settlement people, the most simply as long as the payer has a computer, the payee has a phone can finish transaction safely, be suitable for extensive popularizing, this can save huge human cost and bill management cost for financial company, it will help financial company to realize no cash transaction all taken to carry out on the net and without any obstacle, comprise transacting targeted and the uncertain transaction of the amount of money, and this is the development in future direction.

3, security: owing to used safety technique such as digital authenticating, the client has safety guarantee to the mandate of transaction, also has non-repudiation, therefore, it can refuse the risk that all outside swindles, inner swindle and maloperation bring for financial company on bill business, solved the transaction risk problem of financial company.

In concrete enforcement of the present invention, can take following mode to improve service quality or system performance:

1,, when carrying out with paying bank's data interactive, payer and payee all should be subjected to data security protecting for guaranteeing the safety of Transaction Information.

2, in order to guarantee transaction security, suggestion is all finished by the third party links such as the generation of 16-20 position payment cipher and veritifications, and financial company can break away from responsibility better when dispute occurring like this.

Simultaneously, when using non-payer's key to generate payment cipher, selected information is except will using the selected mandate element information of payer, also to will this time authorize relevant with the payer, and can prove that the payer participates in this information of authorizing and includes in into, can comprise the biological information when landing, dynamic password, be used to verify undeniable direct informations of client such as note validating password that bill is true and false or the undeniable information of obtaining indirectly of payer or the data of approving its exclusive property with the payer, the IP that comprises the payer, MAC, direct information or indirect information such as network adapter address from hardware from hardware, guarantee that the payment cipher that is produced is the result that the payer authorizes, and has non-repudiation.

3, when whether the validation of payment password is correct, the payment cipher of payee's input is to check with the payment cipher of once preserving with storage mode, or check with the payment cipher that the information of importing according to the payee regenerates, still use and generate the corresponding PKI of payment cipher it is verified from there not being too many difference in essence, because data are to be stored in bank, as safe as a house, but more be in conformity with law and explain and be it to be verified easily with corresponding PKI, during checking, everyly import the corresponding information that the mandate element information of acquisition all will replace the payer once to import, so both can more safely confirm the legitimacy of concluding the business from the payee.

4, for guaranteeing transaction security, the payer should be provided with bill and access to your password, when authorizing, import numeral or bearer's ID (identity number) card No. of a 6-8 figure place by the payer, be that easy note plays safe effect again, need the bearer to provide during payment, to finish the correctness of correct verification payment cipher, lose also at bill like this and can not bring economic loss to enterprise, certainly, also can be with the note validating password as the accessing to your password of bill, but shortcoming is to be not easy to remember and take care of.

Simultaneously, if bank's validation of payment password is to take to regenerate or use public key verifications according to the information of payee's input, this bill accesses to your password so, information such as pay code, cheque number had better not authorize element information and store along with other, breaks away from responsibility to increase security and to help bank.

5, the payer takes the internet to log in the WEB server to the mode of Trading Authorization optimum exactly, feasible technically as for the mode of taking SMS or phone mandate, but operation and dirigibility are restricted, can't reflect the Autonomous Control of payer exactly to authorizing, when accepting the information that the payee imports also is like this, take the mode of editing short message to submit the relevant element information item and inadvisable of authorizing to, therefore, suggestion financial company greatly develops the Internet model mandate.

6, authorize serial number to manage for convenience and raise the efficiency and be provided with, it has irreplaceable effect, because each payer is inequality to Trading Authorization, the Trading Authorization that has may be very complicated and careful, authorize the serial number mandate key element that each is different to associate by one, promptly being convenient to management has also increased safety, and for long-term goal, suggestion authorizes serial number to work out according to following arrangement:

Country code (3)+bank's row number (5)+days (4)+flowing water serial number (5)+identifying code (3), totally 20.

When the payee imports the mandate serial number, for preventing malicious attack, accepting server should be imported number of times to the payee and be limited, and to watch out for the terminal that those attempt constantly to visit accepting server, if submit this transaction to, submit to each time and point out payee's input page identifying code by PC.

7, for guaranteeing transaction security, paying bank should notify the related personnel with SMS when the payer authorizes success, notify different clients according to the different mandate amount of money, authorizing the amount of money and client's phone number should be that the client is reserved in bank, to prevent when the inside crime takes place, in time notifying the relevant personnel.

8, paying bank also should require the client that the amount of money of online mandate is done a restriction, prevent that a huge sum of money is stolen, simultaneously, paying bank also should take time-delay to come into force to a huge sum of money mandate, be the client to a huge sum of money mandate after, should delay a bit of time could arm's length transaction.Paying bank should provide counterbalanced accounts for transaction, services such as deletion.

9, described circle is deposited the fund of temporarily freezing certain number in payer's account that is meant, to guarantee the safety of transaction, strengthen payee's confidence, the present invention does not advocate that direct circle is deposited in payer account, but circle can be existed fund unification in payer's account transfer in the holding account or specially in the family manager come, can save huge interest expense for paying bank every year like this.

Simultaneously, when the payer takes formerly to enclose when depositing, paying bank should be printed on the corresponding bill for the payer provides a sign that has security feature accordingly, to strengthen payee's confidence.

10, the various servers of paying bank of the present invention, in fact be exactly the existing bank system of web of paying bank, paying bank only needs on the net to do an empowerment management page in the banking system and can finish, described voice server also is the telephone bank system of each tame bank, increase a new function, on hardware,, can subdue the cost of enterprise without any special requirement.

11, the client during to the banker's buying rate bill, bank should be mapped the account of note number and enterprise, and be the note validating password that the client generates a correspondence at each bill preferably by bank, and with this incidence relation and data storage in the data-storing server, also can allow the client generate note validating password or status identifying code voluntarily, or on bill, write magnetic by paying bank, less radio-frequency etc., purpose is the legitimacy of verifying and examining bill self and user effectively, carry out Trading Authorization and payee the payer and conclude the business and be used for verifying the legitimacy of transaction when submitting to, increase transaction security with the dual channel road.

12, the audit of described trade identity is can be according to the design proposal of financial institution different and adjusted, can be embodied in first comparison, also can compare in real time, comparison formerly, be exactly when the payee does not also import about mandate element information item, the transaction accepting server is examined information such as the transaction count of this transaction, the zones of concluding the business in real time according to the information from the payee earlier, the then continuation that satisfies condition, otherwise remind the payee that transaction can't continue; Comparison in real time, exactly the information of payee's input is examined in real time, compare in real time with the information of payee's input and from the data in the storage server, but this real-time audit is higher to the performance requirement of system, the time of single transaction can prolong, and can be subjected to the loco when formerly comparing and collecting account deviation do not occur or needs comparison again in same zone.

13, payee of the present invention is only limited to the seller, and it also can be the teller of bank, and bank cashier also can assist to finish real-time deal between the both parties and need not bear any transaction risk.

Description of drawings

Fig. 1 is a business process map of the present invention;

Fig. 2 is a synoptic diagram of the present invention.

The specific embodiment of the present invention

Implementation column 1:

The payer logs on the WEB server of paying bank by PC with dynamic password and account password, authentication server is checked the account password that this dynamic password and client are reserved in bank, by after, allow the payer to enter the Trading Authorization administration page, present a standard and comprehensive authorization message item, comprise payer's number of the account (acquiescence), payer's title (acquiescence), and

Coin not, payment type, payee account payee's name note number note validating password Maximum Transaction Amount degree mandate valid period stateful transaction (be subdivided into: formerly circle deposit, in real time circle deposit, real-time deal, transaction count) the accessing to your password of transaction zone (being subdivided into :) bearer's ID (identity number) card No. passport number bill with city transaction, transaction inside the province, transaction, Foreign Transactions transprovincially;

The payer selects in these projects according to the actual needs of this transaction, bank also can newly establish project according to actual needs and select for the payer, then can not skip for the project that necessarily requires the payer to make a choice, the selected information in back that finishes promptly forms the mandate element information, send it in the calculation server by the WEB server, private key with paying bank carries out cryptographic calculation or signature to it, generate the payment cipher of a 16-20 position and authorize serial number, requirement according to the payer, as needs earmark formerly, then send circle and deposit instruction to comprehensive business system, calculate the service charge of maximum according to the zone that may conclude the business after, deposit out corresponding fund at payer's account centre circle, and will be stored in the data-storing server for information about, simultaneously with payment cipher, authorize serial number, note validating passwords etc. are online to pass to the payer, it is filled in or is printed on the bank money by the payer, gives the bearer and concludes the business.

Simultaneously, for the trouble of information such as the input payment cipher that reduces the payee and note validating sign indicating number, reduce the probability of makeing mistakes, make things convenient for and check behind the Banking Days and check, suggestion paying bank with payment cipher, authorize serial number, bill to access to your password etc. to pass to payer's information to form two-dimensional bar code, remind the payer to be printed on the corresponding bank money.

Implementation column 2:

After the payee receives bank money, can select landline telephone to conclude the business, put through the telephone bank system of paying bank earlier by landline telephone, as 95588, connect the back and select " ticket payment " option, system can point out the payee to input 6 telephone banks and land password, by after, system has promptly set up data association with the payee, obtained payee's number of the account, name in an account book, information such as transaction zone, then, system can point out 20 of inputs to authorize serial number, chance is arranged 3 times, by after, system finds relevant mandate element information according to this serial number in the data-storing server, need can pass to the payee by the data of payee's input and remind the payee to import successively, every has chance 3 times, after the whole inputs of payee finish, voice server is given calculation server with data transfer, the selected element information item of respectively authorizing when calculation server is authorized according to the payer, data with payee's input replace corresponding data, form one group of element information to be verified, with the PKI of paying bank itself and payment cipher are verified again, whether check both mate, if do not match, then data entry error or Trading Authorization do not match, the prompting payee confirms, if coupling, prove that then this transaction belongs to arm's length transaction, can proceed following security audit, whether the state of audit transaction count meets this transaction, be that the payer authorizes the mandate of can only single using not use for the second time, whether the dealing money of audit payee input is smaller or equal to the Maximum Transaction Amount degree that is allowed, whether the audit trade date is within the mandate valid period that the payer authorized, whether audit account payee region is consistent with the mandate element information, and whether audit account payee state can conclude the business.

After above-mentioned audit is all passed through, calculation server sends real-time circle to comprehensive business system and deposits instruction, transaction funds is transferred corresponding fund (the actual service charge of real trade volume+born by the payer with) in a holding account from payer's account, upgrade and the relevant information of storage in the data-storing server, treat electron image that the payee holds this bank money or bill to bank again from this holding account with the allocation of the funds in the account payee, simultaneously, notify the payee with the net result of transaction processing, print document, or will be from the income advice note of payment bank with in relevant bill sends to payee and the corresponding mailbox of payer, closing the transaction.

Implementation column 3:

After the payee receives bank money, can select to conclude the business by the internet, the payee is provided by PC by the bill business interface that is provided by the third party, at first import 20 and authorize serial number and page identifying code, system number determines paying bank according to the bank's row that contains in the serial number, and then will authorize serial number to pass to the WEB server of paying bank, this moment, the payee was the direct exchange message of WEB server with paying bank, rather than by described third party, the WEB server accesses relevant with this transaction in the data-storing server according to this mandate serial number, must be delivered on payee's the page by the mandate element information item of payee's input, the prompting payee imports item by item, correctly import All Activity information (the complete Transaction Information that comprises described payment cipher, be receiver information and payer information) afterwards, after carrying out safe handling to these data, client sends the WEB server to, pass to calculation server by it again, the selected element information item of respectively authorizing when calculation server is authorized according to the payer, data with payee's input replace corresponding data, form one group of element information to be verified, with the PKI of paying bank itself and payment cipher are verified again, whether check both mate, if do not match, then this transaction data input error or Trading Authorization do not match, the prompting payee confirms, if coupling, prove that then this transaction belongs to arm's length transaction, can proceed following security audit, whether the state of audit transaction count meets this transaction, be that the payer authorizes the mandate of can only single using not use for the second time, whether the dealing money of audit payee input is smaller or equal to the Maximum Transaction Amount degree that is allowed, whether the audit trade date is within the mandate valid period that the payer authorized, whether audit account payee region is consistent with the mandate element information, and whether relevant informations such as audit account payee are legal.

After above-mentioned audit is passed through, calculation server sends the Instant Transfer instruction to comprehensive business system, from payer's account with the transfer of funds to payee's account, upgrade and the relevant information of storage in the data-storing server, simultaneously, the net result of transaction processing is fed back to the payee, print income advice note and relevant bill, closing the transaction from paying bank.

At this moment, the Maximum Transaction Amount degree that the payer authorized deducts the real trade amount of money for the Maximum Transaction Amount degree that the payer authorizes, and the client still can hold this bill and carry out the transaction of remaining amount according to identical method, and a bill can use repeatedly.

Claims

1. the method for a bank bill online authorisation and off line trading, its composition comprises authorizes on the line and off-line transaction two parts composition, it is characterized in that: authorizing on the line is to be carried out in the transaction disposal environment that the bank of deposit of institute provides by the payer, off-line transaction then is to be carried out in the transaction disposal environment that paying bank or third party provide by the payee, one transaction is divided into two relatively independent processes, and connect by the bill that carries believable effect, reach safe real-time payment purpose, its hardware is formed and is comprised:

The method that realizes between each system is as follows:

2. the method for a kind of bank bill online authorisation and off line trading according to claim 1, it is characterized in that: when the payer carries out Trading Authorization at the transaction accepting server that lands paying bank and provide, at least taked a kind ofly can assert what the method for its identity was carried out, comprised biological information identification, smartcard identification, digital certificate identification, dynamic password identification, the identification of ekey digital certificate etc. with legal means.

3. the method for a kind of bank bill online authorisation and off line trading according to claim 1 is characterized in that: the mandate element information that the payer selects is free and variable;

When using bank money as fiduciary media, described mandate element information comprises payment number of the account, note number, Maximum Transaction Amount degree at least, authorizes valid period, stateful transaction, transaction zone, bill to access to your password;

Described mandate element information is in the checking of transaction time-division two parts, must import by the payee being included in payment number of the account, shroff account number, note number, bill holder ID (identity number) card No., passport number, bill among the described mandate element information many mandate element information items and the real trade amount of money, payment cipher such as access to your password, and authorize valid period, stateful transaction, transaction zone etc. to authorize element information Xiang Ze to obtain or obtain by gathering receiver information by the data-storing server by the transaction accepting server.

4. the method for a kind of bank bill online authorisation and off line trading according to claim 3 is characterized in that: the described mandate valid period be meant comprise from the payer authorize from or afterwards any one section continuous during;

Described stateful transaction is meant the selection of payer to transaction form, specifically comprise, formerly circle deposit, in real time circle deposit, Instant Transfer, four kinds of states of transaction count, wherein, described circle is formerly deposited and is meant that bank money does not enter before the transaction as yet, send circle by the payer to paying bank and deposit instruction, and enclosed and be saved as merit, take place to automatically terminate again that circle deposits in the certain hour no deal; Described real-time circle deposits and is meant that sending circle by the payee to paying bank in when transaction deposits instruction, need determine whether to enclose to be saved as merit; Can carry out Instant Transfer when described Instant Transfer is meant and receives bank money by the payee and handle, need whether not exist and the true and false of bill through bank's checking bill; Whether described transaction count is meant a bill or once authorizes and allow to reuse, only allow single to use, Successful Transaction once or is successfully enclosed the amount of money of depositing the back remainder and can not be reused, at once remove remaining circle and deposit the amount of money, allow reusable, the full amount that the total value of transaction or circle are saved as merit can not surpass the Maximum Transaction Amount degree that the payer authorized, selection repeated use state, unless paying bank can provide safe evidence for payment to the payee, otherwise, the payer should select Instant Transfer simultaneously, and the computing formula of the Maximum Transaction Amount degree that the payer authorizes is:

Maximum Transaction Amount degree=Maximum Transaction Amount degree-real trade volume or circle are deposited amount.

5. the method for a kind of bank bill online authorisation and off line trading according to claim 4 is characterized in that: when the payer selected that formerly circle is deposited, the amount of money of depositing that encloses was Maximum Transaction Amount degree and issuable maximum service charge sum in payer's account;

When the payer selected real-time circle to deposit, the amount of money of depositing that encloses was the real trade amount of money and actual service charge sum in payer's account.

6. according to the method for claim 1 or 3 described a kind of bank bill online authorisation and off line trading, it is characterized in that: described payment cipher is to comprising described mandate element information and carrying out cryptographic calculation or signature and the one group of 16-20 position payment cipher that produces with payer or paying bank or third-party key;

Described 16-20 position payment cipher has uniqueness, and this uniqueness is not the result who is caused by the uniqueness of described mandate element information passively.

7. the method for a kind of bank bill online authorisation and off line trading according to claim 1 is characterized in that: described mandate serial number comes from one group of 16-20 bit digital that the calculation server of paying bank generates automatically according to certain rules;

Described mandate serial number has uniqueness, is corresponding relation with this transaction related data;

Contain the self-check code that is not less than 2 figure places in the described mandate serial number, to prevent maintaining secrecy of input error and Transaction Information.

8. the method for a kind of bank bill online authorisation and off line trading according to claim 1, it is characterized in that: the payee at first submits to the transaction accepting server of the paying bank or the third party service organization and authorizes serial number start information interaction, whether the described mandate serial number of transaction accepting server checking payee submission earlier is correct, by after, in the data-storing server, access and be associated with this mandate serial number, must import the mandate element information item of acquisition by the payee, and submit to terminal to feed back to the payee by described transaction, the prompting payee imports item by item, after the relevant mandate element information item checking that comprises described payment cipher and passing through, the trade identity audit that can enter the backstage.

9. according to the method for claim 1 or 8 described a kind of bank bill online authorisation and off line trading, it is characterized in that: following audit is finished in described trade identity audit at least,

A) whether the state of audit transaction count meets this transaction, and promptly the payer authorizes the mandate of can only single using not use for the second time;

B) whether the dealing money of audit payee input is smaller or equal to the Maximum Transaction Amount degree that is allowed;

C) whether the audit trade date is within the mandate valid period that the payer authorized;

D) whether audit account payee region is consistent with the mandate element information;

10. the method for a kind of bank bill online authorisation and off line trading according to claim 1, it is characterized in that: described bank returns document and is meant that bank feeds back to receipts, payer's Transaction Success, printable or store electronic certificate, and be stamped the E-seal or the anti-fake mark of bank on the voucher.