CN117787985A

CN117787985A - Resource transfer method, device, system, computer equipment and storage medium

Info

Publication number: CN117787985A
Application number: CN202311435205.8A
Authority: CN
Inventors: 王文耀; 罗伟; 刘强; 徐玙萌
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2023-10-31
Filing date: 2023-10-31
Publication date: 2024-03-29

Abstract

The present application relates to a resource transfer method, apparatus, system, computer device, storage medium and computer program product, and relates to the field of computer technology, which may be used in the field of financial technology or other related fields. The method comprises the following steps: receiving a transfer authentication instruction sent by a resource receiving device; encrypting and transferring an authentication instruction to obtain a first encrypted message; sending the first encrypted message to a resource transfer server; the decryption resource transfer server obtains a transfer authentication result based on a second encrypted message returned by the first encrypted message; and sending the transfer authentication result to the resource receiving equipment, so that the resource receiving equipment executes a corresponding resource transfer flow based on the transfer authentication result. By adopting the method, the safety of resource transfer can be improved.

Description

Resource transfer method, device, system, computer equipment and storage medium

Technical Field

The present application relates to the field of computer technology, and in particular, to a resource transfer method, apparatus, system, computer device, storage medium, and computer program product.

Background

With the development of mobile phone technology, a mobile payment technology is generated, and mobile payment can simulate card swiping payment of a bank card on a POS machine.

Whether the physical bank card or the mobile terminal simulates the bank card, authentication or authentication of the bank card is completed by the POS machine. However, due to the performance of the POS machine, there is a high security risk for authentication or authorization of the bank card, which easily causes a payment security problem.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a resource transfer method, apparatus, computer device, computer-readable storage medium, and computer program product that can improve security.

In a first aspect, the present application provides a resource transfer method, where the method is applied to a resource transfer-out device, and includes:

receiving a transfer authentication instruction sent by a resource receiving device;

encrypting the transfer authentication instruction to obtain a first encrypted message;

the first encryption message is sent to a resource transfer server;

decrypting the second encrypted message returned by the resource transfer server based on the first encrypted message to obtain a transfer authentication result;

and sending the transfer authentication result to the resource receiving equipment, so that the resource receiving equipment executes a corresponding resource transfer flow based on the transfer authentication result.

In one embodiment, before the first encrypted message is sent to the resource transfer server, the method further includes:

Generating message digest information according to the first encrypted message;

the sending the first encrypted message to a resource transfer server includes:

and sending the message digest information and the first encrypted message to the resource transfer server together, so that the resource transfer server obtains the second encrypted message based on the first encrypted message under the condition that the data of the first encrypted message is complete according to the message digest information.

In one embodiment, before receiving the transfer authentication instruction sent by the resource receiving device, the method further includes:

receiving a resource transfer application list acquisition request sent by the resource receiving equipment;

according to the resource transfer application list acquisition request, the resource transfer application list corresponding to the resource transfer-out equipment is sent to the resource receiving equipment;

and according to the target application identifier returned by the resource transfer application list, sending corresponding application data to the resource receiving equipment, so that the resource receiving equipment determines the resource transfer flow and generates the transfer authentication instruction according to the application data.

collecting user authentication information of a user;

according to the pre-recorded target authentication information, carrying out identity authentication on the user authentication information;

the transfer authentication instruction sent by the receiving resource receiving equipment comprises the following steps:

and receiving a transfer authentication instruction sent by the resource receiving equipment under the condition that the identity authentication is passed.

In one embodiment, the encrypting the transfer authentication instruction to obtain a first encrypted message includes:

grouping the transfer authentication instructions to obtain a plurality of grouping messages;

each packet message is encrypted by adopting a preset secret key to obtain a plurality of packet encrypted messages;

and combining the plurality of packet encrypted messages to obtain a first encrypted message.

In a second aspect, the present application further provides a resource transfer method, where the method is applied to a resource transfer server, and includes:

receiving a first encrypted message sent by a resource transferring device; the first encryption message is obtained by encrypting a transfer authentication instruction sent by the resource receiving device by the resource transferring device;

Obtaining a second encrypted message based on the first encrypted message;

sending the second encrypted message to the resource transfer-out equipment; the resource transferring device is used for decrypting the second encrypted message to obtain a transfer authentication result, and sending the transfer authentication result to the resource receiving device, so that the resource receiving device executes a corresponding resource transfer flow based on the transfer authentication result.

In one embodiment, the obtaining, based on the first encrypted packet, a second encrypted packet includes:

decrypting the first encrypted message to obtain the transfer authentication instruction;

obtaining the transfer authentication result according to the transfer authentication instruction;

and encrypting the transfer authentication result to obtain the second encrypted message.

In a third aspect, the present application further provides a resource transfer device, where the device is applied to a resource transfer-out apparatus, and includes:

the authentication instruction receiving module is used for receiving a transfer authentication instruction sent by the resource receiving equipment;

the authentication instruction encryption module is used for encrypting the transfer authentication instruction to obtain a first encrypted message;

the encrypted message sending module is used for sending the first encrypted message to a resource transfer server;

The encrypted message decryption module is used for decrypting the second encrypted message returned by the resource transfer server based on the first encrypted message to obtain a transfer authentication result;

and the authentication result sending module is used for sending the transfer authentication result to the resource receiving equipment so that the resource receiving equipment executes a corresponding resource transfer flow based on the transfer authentication result.

In a fourth aspect, the present application further provides a resource transfer device, where the device is applied to a resource transfer server, and includes:

the first encrypted message receiving module is used for receiving a first encrypted message sent by the resource transferring equipment; the first encryption message is obtained by encrypting a transfer authentication instruction sent by the resource receiving device by the resource transferring device;

the second encrypted message acquisition module is used for acquiring a second encrypted message based on the first encrypted message;

the second encryption message sending module is used for sending the second encryption message to the resource transferring-out equipment; the resource transferring device is used for decrypting the second encrypted message to obtain a transfer authentication result, and sending the transfer authentication result to the resource receiving device, so that the resource receiving device executes a corresponding resource transfer flow based on the transfer authentication result.

In a fifth aspect, the present application further provides a resource transfer system, including: resource transfer-out equipment, resource receiving equipment and a resource transfer server;

the resource receiving device is used for sending a transfer authentication instruction to the resource transferring device;

the resource transferring device is used for encrypting the transfer authentication instruction to obtain a first encrypted message, and sending the first encrypted message to the resource transfer server;

the resource transfer server is used for obtaining a second encrypted message based on the first encrypted message and sending the second encrypted message to the resource transfer-out equipment;

the resource transferring device is further configured to decrypt the second encrypted message, obtain a transfer authentication result, and send the transfer authentication result to the resource receiving device;

the resource receiving device is further configured to execute a corresponding resource transfer procedure based on the transfer authentication result.

In a sixth aspect, the present application further provides a computer device comprising a memory and a processor, the memory storing a computer program, the processor implementing the following steps when executing the computer program:

the first encryption message is sent to a resource transfer server;

In a seventh aspect, the present application also provides a computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of:

the first encryption message is sent to a resource transfer server;

In an eighth aspect, the present application also provides a computer program product comprising a computer program which, when executed by a processor, performs the steps of:

the first encryption message is sent to a resource transfer server;

The resource transfer method, the device, the system, the computer equipment, the storage medium and the computer program product firstly receive the transfer authentication instruction sent by the resource receiving equipment, encrypt the transfer authentication instruction to obtain a first encrypted message, ensure the confidentiality of the transfer authentication instruction in the transmission process, and ensure that even if the transfer authentication instruction is intercepted, the encrypted data which is not decrypted is difficult to be maliciously acquired; then, the first encrypted message is sent to a resource transfer server, then the second encrypted message returned by the resource transfer server based on the first encrypted message is decrypted to obtain a transfer authentication result, and the resource transfer server completes the authentication operation of the transfer authentication instruction, so that safer measures can be adopted to ensure the credibility of the authentication; and finally, the transfer authentication result is sent to the resource receiving equipment, so that the resource receiving equipment executes a corresponding resource transfer flow based on the transfer authentication result, the resource receiving equipment is prevented from carrying out authentication or authentication operation, and the risk is reduced. In the method, the resource transfer equipment and the resource transfer server are adopted for interaction, instead of the resource receiving equipment and the resource transfer server, meanwhile, in the interaction process, the resource transfer equipment only executes information encryption, decryption and forwarding processing, authentication and other operations are completed by the resource transfer server, and therefore the security and the credibility of the authentication are guaranteed based on the stronger performance of the resource transfer server. In addition, the resource transfer-out equipment realizes simpler functions, the program deployment on the resource transfer-out equipment is simpler, and the universality of the resource transfer-out equipment is higher.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the related art, the drawings that are required to be used in the embodiments or the related technical descriptions will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and other drawings may be obtained according to the drawings without inventive effort for a person having ordinary skill in the art.

FIG. 1 is a diagram of an application environment for a resource transfer method in one embodiment;

FIG. 2 is a flow diagram of a method of resource transfer in one embodiment;

FIG. 3 is a flow chart of a method of transferring resources according to another embodiment;

FIG. 4 is a schematic diagram of components of a resource roll-out device in one embodiment;

FIG. 5 is a schematic diagram of communication between a resource transfer-out device and a resource transfer-out server in one embodiment;

FIG. 6 is a schematic diagram of payment communications between a resource receiving device and a bank payment network in one embodiment;

FIG. 7 is a flow chart of a method of transferring resources according to yet another embodiment;

FIG. 8 is a block diagram of a resource transfer device in one embodiment;

FIG. 9 is a block diagram of a resource transfer device in one embodiment;

FIG. 10 is an internal block diagram of a computer device in one embodiment;

FIG. 11 is an internal block diagram of a computer device in one embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the present application.

The resource transfer method provided by the embodiment of the application can be applied to an application environment shown in fig. 1. Wherein the resource transfer-out device 102 communicates with the resource receiving device 104 and the resource transfer-out server 106, respectively. The data storage system may resource transfer data that the server 106 needs to process. The data storage system may be integrated on the resource transfer server 106 or may be located on the cloud or other network server. The resource transferring-out device 102 receives a transfer authentication instruction sent by the resource receiving device 104; then, encrypting and transferring an authentication instruction to obtain a first encrypted message; then, the first encrypted message is sent to the resource transfer server 106; the resource transferring device 102 decrypts the second encrypted message returned by the resource transferring server 106 based on the first encrypted message to obtain a transferring authentication result; and sends the transfer authentication result to the resource receiving device 104, so that the resource receiving device 104 executes a corresponding resource transfer flow based on the transfer authentication result. The resource transferring device 102 may be, but not limited to, various smart phones and portable wearable devices, which may be smart watches, smart bracelets, etc. The resource receiving device 104 may be, but is not limited to, various POS devices, etc. The resource transfer server 106 may be implemented as a stand-alone server or as a cluster of servers.

In an exemplary embodiment, as shown in fig. 2, a resource transfer method is provided, which is described by taking the application of the method to the resource transfer-out device 102 in fig. 1 as an example, and includes the following steps:

step S201, a transfer authentication instruction sent by the resource receiving device is received.

The resource can be money in the financial field, the resource receiving equipment can be a POS machine and other collection equipment, and the transfer authentication instruction can be a payment authentication instruction.

For example, the resource transferring device and the resource receiving device may perform information interaction based on the near field communication technology, and when the resource transferring device approaches to the resource receiving device, the resource transferring device may receive a transfer authentication instruction sent by the resource receiving device in real time, so that the resource receiving device determines an identity corresponding to the resource transferring device.

Step S202, encrypting a transfer authentication instruction to obtain a first encrypted message.

Illustratively, after receiving the transfer authentication instruction, the resource transfer-out device encrypts the transfer authentication instruction, and encrypts the transfer authentication instruction with a proportional symmetric key to obtain a first encrypted message.

Step S203, the first encryption message is sent to a resource transfer server.

In the financial field, the resource transfer server may be a banking server.

The resource transfer-out device sends the first encrypted message to a bank server of an issuing bank corresponding to the resource transfer-out device through network communication.

Step S204, the decryption resource transfer server obtains a transfer authentication result based on the second encrypted message returned by the first encrypted message.

The resource transfer server receives the first encrypted message, decrypts the first encrypted message in a preset mode to obtain a transfer authentication instruction, and then performs authentication processing according to the transfer authentication instruction to obtain a transfer authentication result. And encrypting the transfer authentication result by adopting a preset encryption mode to obtain a second encrypted message, and returning the second encrypted message to the resource transfer-out equipment. After the resource transferring equipment receives the second message, the second encrypted message is decrypted by adopting a preset decryption mode, so that a transfer authentication result is obtained.

Step S205, the transfer authentication result is sent to the resource receiving device, so that the resource receiving device executes a corresponding resource transfer flow based on the transfer authentication result.

The resource transferring device returns the transfer authentication result to the resource receiving device through near field communication, so that the resource receiving device executes a corresponding resource transfer flow based on the transfer authentication result, the resource transferring device returns authentication failure information to the resource transferring device when authentication fails, and the resource transfer is completed when authentication is successful.

In the resource transfer method, firstly, a transfer authentication instruction sent by a resource receiving device is received, the transfer authentication instruction is encrypted to obtain a first encrypted message, confidentiality of the transfer authentication instruction in a transmission process is ensured, and encrypted data which is not decrypted is difficult to obtain maliciously even if the encrypted data is intercepted; then, the first encrypted message is sent to a resource transfer server, then the second encrypted message returned by the resource transfer server based on the first encrypted message is decrypted to obtain a transfer authentication result, and the resource transfer server completes the authentication operation of the transfer authentication instruction, so that safer measures can be adopted to ensure the credibility of the authentication; and finally, the transfer authentication result is sent to the resource receiving equipment, so that the resource receiving equipment executes a corresponding resource transfer flow based on the transfer authentication result, the resource receiving equipment is prevented from carrying out authentication or authentication operation, and the risk is reduced. In the method, the resource transfer equipment and the resource transfer server are adopted for interaction, instead of the resource receiving equipment and the resource transfer server, meanwhile, in the interaction process, the resource transfer equipment only executes information encryption, decryption and forwarding processing, authentication and other operations are completed by the resource transfer server, and therefore the security and the credibility of the authentication are guaranteed based on the stronger performance of the resource transfer server. In addition, the resource transfer-out equipment realizes simpler functions, the program deployment on the resource transfer-out equipment is simpler, and the universality of the resource transfer-out equipment is higher.

In an exemplary embodiment, before the step S203 of sending the first encrypted packet to the resource transfer server, the method further includes: and generating message digest information according to the first encrypted message.

Further, in an exemplary embodiment, the step S203 sends the first encrypted packet to the resource transfer server, and further includes: and sending the message digest information and the first encrypted message to a resource transfer server together, so that the resource transfer server obtains a second encrypted message based on the first encrypted message under the condition that the data of the first encrypted message is complete according to the message digest information.

The resource transfer-out device also needs to adopt a message digest algorithm to obtain the message digest information of the first encrypted message before sending the first encrypted message. And then when the first encrypted message is sent, the message digest information is also sent to the resource transfer server. When the resource transfer server receives the first encrypted message and the message digest information, firstly determining the data integrity of the first encrypted message based on the message digest information, and under the condition that the data of the first encrypted message is complete, the resource transfer server obtains the second encrypted message according to the first encrypted message.

The message digest algorithm may be a hash algorithm or SM3 algorithm.

The hash algorithm maps binary values of arbitrary length to shorter fixed length binary values, the latter being referred to as hash values. Hash values are a unique and extremely compact representation of a piece of data. If a piece of information is hashed and even only one letter of the information is changed, the resulting hash values will be different. It is computationally impossible to find two different pieces of information hashed to the same value, so the hash value of the data can verify the integrity of the data.

SM3 is a cryptographic hash function standard. In a commercial cryptosystem, SM3 is mainly used for digital signature and verification, message authentication code generation and verification, random number generation and the like, and the algorithm is disclosed. The safety and the efficiency are equivalent to those of SHA-256.

In this embodiment, by introducing the message digest information and transmitting it to the resource transfer server together with the encrypted message, the data integrity verification of the resource transfer method and the detection of possible tampering or data damage are enhanced. The method is beneficial to improving the safety and the credibility of the whole resource transfer process and preventing potential attacks and data destruction.

In an exemplary embodiment, before the step S201 receives the transfer authentication instruction sent by the resource receiving device, the method further includes: receiving a resource transfer application list acquisition request sent by a resource receiving device; according to the resource transfer application list acquisition request, the resource transfer application list corresponding to the resource transfer-out equipment is sent to the resource receiving equipment; and sending corresponding application data to the resource receiving equipment according to the target application identifier returned by the resource receiving based on the resource transfer application list, so that the resource receiving equipment determines a resource transfer flow and generates a transfer authentication instruction according to the application data.

In the financial field, the resource transferring device can be used for simulating a bank card to complete financial transactions, and the corresponding applications include a Unionpay application, a universal application, a VISA application and the like.

Illustratively, the resource receiving device also needs to send an acquisition request of the resource transfer application list to the resource transferring-out device before sending the transfer authentication instruction. Then, the resource transfer-out device transmits the pre-stored application resource list to the resource receiving device. The resource receiving device determines a currently required target application from the application list, and then sends the target application identifier to the resource transferring device. The resource transfer-out device sends corresponding application data to the resource receiving device based on the target application identifier, so that the resource receiving device can generate a corresponding transfer authentication instruction based on the application data, and determine a resource transfer flow to be executed subsequently.

In this embodiment, the resource transfer-out device may deploy a plurality of different financial applications, and may be suitable for resource transfer under a plurality of conditions, where the resource transfer-out device has good universality.

In an exemplary embodiment, before the step S201 receives the transfer authentication instruction sent by the resource receiving device, the method further includes: collecting user authentication information of a user; and carrying out identity authentication on the user authentication information according to the pre-recorded target authentication information.

Further, in an exemplary embodiment, the step S201 receives a transfer authentication instruction sent by the resource receiving device, and further includes: and receiving a transfer authentication instruction sent by the resource receiving equipment under the condition that the identity authentication is passed.

Illustratively, the resource roll-out device also requires user identity authentication before it is used. The resource transfer-out device collects user authentication information, such as fingerprint information, etc., of the currently held user. And then, inquiring the pre-recorded target authentication information, and determining whether the user authentication information is matched with the target authentication information so as to authenticate whether the current holding user is the corresponding authentication user when the resource transfer-out equipment issues. And under the condition that the identity authentication of the current holding user passes, the resource transfer-out equipment can receive a transfer authentication instruction sent by the resource receiving equipment.

In the embodiment, the security and the legality of the resource transfer method are enhanced by introducing the user identity authentication information acquisition and the identity authentication verification and receiving the transfer authentication instruction under the condition that the identity authentication passes. Only authenticated users can perform resource transfer operations, thereby avoiding unauthorized access and fraud. The method has important significance in scenes requiring high security, such as financial fields, and the like, and ensures the credibility of user identity and resource transfer.

In an exemplary embodiment, the step S202 encrypts the transfer authentication instruction to obtain a first encrypted packet, and further includes: grouping the transfer authentication instructions to obtain a plurality of grouping messages; each packet message is encrypted by adopting a preset secret key to obtain a plurality of packet encrypted messages; and combining the plurality of packet encrypted messages to obtain a first encrypted message.

For example, when encrypting the transfer authentication instruction, the resource transfer device may perform packet processing on the resource transfer instruction according to a preset packet length, and if the information length of the resource transfer instruction is not an integer multiple of the packet length, it is necessary to fill data after the resource transfer instruction, and then perform the packet. The resource transferring device encrypts a plurality of packet messages obtained by the packets by adopting a preset secret key to obtain a plurality of packet encrypted messages. And finally, integrating the plurality of packet encrypted messages by the resource transfer equipment, and sending the integrated packet encrypted messages to the resource transfer server as a first encrypted message.

In this embodiment, by encrypting and integrating the transfer authentication instruction according to the packet, higher data security and transmission efficiency are achieved. The fixed size of each packet can be ensured by the packet encryption so as to be more suitable for an encryption algorithm, thereby improving the security; while packet encryption can accommodate encryption processing of multiple information lengths.

In another exemplary embodiment, as shown in fig. 3, there is provided a resource transfer method including the steps of:

step S301, user authentication information of a user is collected, and identity authentication is performed on the user authentication information according to pre-recorded target authentication information.

Step S302, receiving a resource transfer application list acquisition request sent by a resource receiving device under the condition that identity authentication is passed.

Step S303, according to the resource transfer application list acquisition request, the resource transfer application list corresponding to the resource transfer-out device is sent to the resource receiving device.

Step S304, according to the target application identifier returned by the resource receiving based on the resource transfer application list, the corresponding application data is sent to the resource receiving equipment, so that the resource receiving equipment determines a resource transfer flow and generates a transfer authentication instruction according to the application data.

Step S305, a transfer authentication instruction sent by the resource receiving device is received.

Step S306, grouping the transfer authentication instruction to obtain a plurality of grouping messages, and encrypting each grouping message by adopting a preset secret key to obtain a plurality of grouping encrypted messages.

Step S307, combining the plurality of packet encrypted messages to obtain a first encrypted message, and generating message digest information according to the first encrypted message.

Step S308, the message digest information and the first encrypted message are sent to a resource transfer server together, so that the resource transfer server obtains a second encrypted message based on the first encrypted message under the condition that the data of the first encrypted message is complete according to the message digest information.

Step S309, the decryption resource transfer server obtains a transfer authentication result based on the second encrypted message returned by the first encrypted message.

Step S310, the transfer authentication result is sent to the resource receiving device, so that the resource receiving device executes a corresponding resource transfer flow based on the transfer authentication result.

The above method can be applied to a resource transferring device as shown in fig. 4, and the resource transferring device includes a main control chip 401, a display chip 402, a power control chip 403, a near field communication chip 404, a secure memory chip 405, a fingerprint identification module 406, and 4G and 5G communication modules 407. The 4G and 5G communication modules 407 have a function of connecting with a mobile base station, and provide a wireless communication function for equipment; the near field communication module 404 (including NFC communication unit and bluetooth communication unit) has a function of communicating with the resource receiving device; the power module 403 provides a power supply for the device; the secure memory chip 405 has a read-write function and stores information such as user information, a communication key, a certificate, and system time; the resource transferring device can load a mobile intelligent operating system, such as apple mobile phone operating system ios, android mobile phone operating system and the like. When the issuer of the resource transfer-out device issues the device to the user for the first time, the fingerprint of the user needs to be acquired through the fingerprint identification module 407, and the fingerprint is written into the secure memory chip 405 through the main control chip 401; meanwhile, the system working date is written into the secure memory chip 405 through the master control chip 401 by the near field communication mode through the near field communication chip 404, and the paid application information can be written in by the smart phone application after the initial release.

In one specific scenario, the communication between the resource transfer-out device and the resource transfer-out server (i.e., the bank) is shown in FIG. 5.

In a specific example, the merchant POS reads the payment application list of the resource transfer-out device through a near field communication protocol to determine a payment application, and executes a transaction flow: the merchant POS sends an APDU (Application protocol Data Unit ) instruction; the resource transferring device receives APDU-REQ (APDU request) sent by a merchant POS, controls the secure memory chip 405 to symmetrically encrypt the APDU-REQ according to a message data format agreed in advance to generate ciphertext, and generates message digest information; the resource transfer-out equipment controls the 4G and 5G communication modules 407 to send the message to the card issuing bank server; the card issuing bank server decrypts the message according to the preset symmetric key, generates an APDU-RES (corresponding to the APDU), symmetrically encrypts the responded message APDU-RES and sends the message APDU-RES to the resource transferring equipment; the resource transferring-out equipment decrypts the message and returns the decrypted content to the POS of the merchant through the near field communication module 404; the merchant POS judges whether to carry out the next payment transfer operation according to the APDU-RES.

In a specific scenario, the payment communication between a merchant POS (resource receiving device) and a bank payment network is shown in FIG. 6.

In a specific example, encryption of data employs a block cipher algorithm of 64 bits (8 bytes) or 128 bits (16 bytes) in packet length, but either an Electronic Codebook (ECB) mode or a Cipher Block Chaining (CBC) mode. The present example selects the ECB mode as the encryption/decryption mode.

The encryption key Ks is used for encrypting the message MSG with any length as follows:

filling and grouping: if the length of the message MSG is not an integer multiple of the packet length, 1 "80" is added to the right end of the MSG, and then the least "00" bytes are added to the right end, so that the length MSG of the result message: = (msg| "80" | "00" |.| 00"| is an integer multiple of the packet length; if the length of the message length MSG is an integer multiple of the packet length, no padding is performed on the data.

The encrypted data is first formatted into the following data blocks

The length of the plaintext data, excluding padding characters;

plaintext data;

pad characters (in the pad manner described above);

the MSG is then split into 8-byte or 16-byte X1, X2., xk.

Ciphertext encryption: the blocks X1, X2, xk are encrypted as Y1, Y2, yk of the packet length with the encryption key Ks in the ECB mode of the packet algorithm.

Thus when i=1, 2,..k, respectively:

Yi：＝ALG(Ks)[Xi]。

The decryption process is as follows:

ciphertext decryption:

when i=1, 2, K was calculated separately

Xi：＝ALG-1(Ks)[Yi]。

Algorithms that may be involved: the SM4 algorithm operates on 128-bit packets with a key length of 16 bytes. The DES algorithm is an algorithm performed in 64-bit units, and the key length is 8 bytes.

In this embodiment, the resource transferring device and the resource transferring server are adopted to interact, instead of the resource receiving device and the resource transferring server, and in the interaction process, the resource transferring device only performs information encryption, decryption and forwarding processing, and operations such as authentication and authentication are completed by the resource transferring server, so that the security and the credibility of the authentication are ensured based on the stronger performance of the resource transferring server. In addition, the resource transfer-out equipment realizes simpler functions, the program deployment on the resource transfer-out equipment is simpler, and the universality of the resource transfer-out equipment is higher. Meanwhile, the resource transfer-out equipment in the example is portable and safe, and the problem that mobile payment cannot be used due to the fact that two-dimension code transaction is not supported is solved to the greatest extent.

In yet another exemplary embodiment, as shown in fig. 7, a resource transfer method is provided, and the method is applied to the resource transfer server 106 in fig. 1, for illustration, and includes the following steps:

Step S701, receiving a first encrypted message sent by a resource transfer-out device.

The first encryption message is obtained by encrypting a transfer authentication instruction sent by the resource receiving device by the resource transferring device.

Step S702, obtaining a second encrypted message based on the first encrypted message.

Step S703, sending the second encrypted message to the resource transferring device.

The resource transferring device is used for decrypting the second encrypted message to obtain a transfer authentication result, and sending the transfer authentication result to the resource receiving device, so that the resource receiving device executes a corresponding resource transfer flow based on the transfer authentication result.

When the resource transfer server sends the second encrypted message, the information digest algorithm may also be used to determine second message digest information of the second encrypted message, and the second message digest information and the second encrypted message are returned to the resource transfer device together, so that the resource transfer device verifies the data integrity of the second encrypted message based on the second message digest information.

In this embodiment, the authentication operation of transferring the authentication instruction is completed by the resource transfer server, so that the authentication or authentication operation performed by the resource receiving device is avoided, safer measures can be taken to ensure the credibility of the authentication, and the risk is reduced. In the method, the resource transfer equipment and the resource transfer server are adopted for interaction, instead of the resource receiving equipment and the resource transfer server, meanwhile, in the interaction process, the resource transfer equipment only executes information encryption, decryption and forwarding processing, authentication and other operations are completed by the resource transfer server, and therefore the security and the credibility of the authentication are guaranteed based on the stronger performance of the resource transfer server. In addition, the resource transfer-out equipment realizes simpler functions, the program deployment on the resource transfer-out equipment is simpler, and the universality of the resource transfer-out equipment is higher.

In an exemplary embodiment, the step S702 obtains a second encrypted message based on the first encrypted message, and further includes: decrypting the first encrypted message to obtain a transfer authentication instruction; obtaining a transfer authentication result according to the transfer authentication instruction; and encrypting and transferring the authentication result to obtain a second encrypted message.

The resource transfer server obtains the transfer authentication instruction by decrypting the first encrypted message, inquires the pre-stored authentication information according to the transfer authentication instruction, determines the authority of the transfer authentication instruction, and further obtains a transfer authentication result. Then, the transfer authentication result can be subjected to packet encryption processing to obtain a plurality of second packet encrypted messages; and integrating the plurality of second packet encrypted messages into a second encrypted message.

In this embodiment, the authentication and authorization process of transferring the authentication instruction is performed by the resource transfer server, so as to ensure the validity of the resource transfer and improve the security of the resource transfer.

It should be understood that, although the steps in the flowcharts related to the embodiments described above are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.

Based on the same inventive concept, the embodiments of the present application also provide two resource transfer devices for implementing the above-mentioned resource transfer methods. The implementation of the solution provided by these two devices is similar to that described in the above method, so the specific limitations in one or more embodiments of the resource transfer device provided below may be referred to above as limitations of the resource transfer method, and will not be described here.

In one exemplary embodiment, as shown in fig. 8, there is provided a resource transferring apparatus, comprising: an authentication instruction accepting module 801, an authentication instruction encrypting module 802, an encrypted message transmitting module 803, an encrypted message decrypting module 804, and an authentication result transmitting module 805, wherein:

an authentication instruction accepting module 801, configured to receive a transfer authentication instruction sent by a resource receiving device;

an authentication instruction encryption module 802, configured to encrypt the transfer authentication instruction to obtain a first encrypted message;

a encrypted message sending module 803, configured to send a first encrypted message to a resource transfer server;

an encrypted message decryption module 804, configured to decrypt a second encrypted message returned by the resource transfer server based on the first encrypted message, to obtain a transfer authentication result;

And the authentication result sending module 805 is configured to send a transfer authentication result to the resource receiving device, so that the resource receiving device executes a corresponding resource transfer procedure based on the transfer authentication result.

In an exemplary embodiment, the resource transfer device further includes a message digest generation module, configured to generate message digest information according to the first encrypted message.

In an exemplary embodiment, the above-mentioned encrypted message sending module 803 is further configured to send the message digest information and the first encrypted message to the resource transfer server together, so that the resource transfer server obtains the second encrypted message based on the first encrypted message when determining that the data of the first encrypted message is complete according to the message digest information.

In an exemplary embodiment, the above-mentioned resource transfer device further includes an application data sending module, configured to receive a resource transfer application list acquisition request sent by the resource receiving device; according to the resource transfer application list acquisition request, the resource transfer application list corresponding to the resource transfer-out equipment is sent to the resource receiving equipment; and sending corresponding application data to the resource receiving equipment according to the target application identifier returned by the resource receiving based on the resource transfer application list, so that the resource receiving equipment determines a resource transfer flow and generates a transfer authentication instruction according to the application data.

In an exemplary embodiment, the resource transferring device further includes a user authentication module, configured to collect user authentication information of a user; and carrying out identity authentication on the user authentication information according to the pre-recorded target authentication information.

In an exemplary embodiment, the authentication instruction accepting module 801 is further configured to receive a transfer authentication instruction sent by the resource receiving device when the identity authentication passes.

In an exemplary embodiment, the authentication instruction encryption module 802 is configured to group the transfer authentication instruction to obtain a plurality of packet messages; each packet message is encrypted by adopting a preset secret key to obtain a plurality of packet encrypted messages; and combining the plurality of packet encrypted messages to obtain a first encrypted message.

In one exemplary embodiment, as shown in fig. 9, there is provided a resource transferring apparatus, including: a first encrypted message receiving module 901, a second encrypted message obtaining module 902, and a second encrypted message sending module 903, where:

the first encrypted message receiving module 901 is configured to receive a first encrypted message sent by the resource forwarding device; the first encryption message is obtained by encrypting a transfer authentication instruction sent by the resource receiving equipment by the resource transferring equipment;

A second encrypted message obtaining module 902, configured to obtain a second encrypted message based on the first encrypted message;

a second encrypted message sending module 903, configured to send a second encrypted message to the resource transferring device; the resource transferring device is used for decrypting the second encrypted message to obtain a transfer authentication result, and sending the transfer authentication result to the resource receiving device, so that the resource receiving device executes a corresponding resource transfer flow based on the transfer authentication result.

In an exemplary embodiment, the second encrypted message obtaining module 902 is further configured to decrypt the first encrypted message to obtain a transfer authentication instruction; obtaining a transfer authentication result according to the transfer authentication instruction; and encrypting and transferring the authentication result to obtain a second encrypted message.

The various modules in the resource transfer device described above may be implemented in whole or in part by software, hardware, and combinations thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.

In one exemplary embodiment, a resource transfer system is provided, referring to FIG. 1, the system comprising: a resource roll-out device 102, a resource receiving device 104, and a resource transfer server 106, wherein:

A resource receiving device 104 for transmitting a transfer authentication instruction to the resource transferring device 102;

the resource transferring device 102 is configured to encrypt the transfer authentication instruction, obtain a first encrypted packet, and send the first encrypted packet to the resource transfer server 106;

the resource transfer server 106 is configured to obtain a second encrypted message based on the first encrypted message, and send the second encrypted message to the resource transfer-out device 102;

the resource transferring device 102 is further configured to decrypt the second encrypted message, obtain a transfer authentication result, and send the transfer authentication result to the resource receiving device 104;

the resource receiving device 104 is further configured to execute a corresponding resource transfer procedure based on the transfer authentication result.

In this embodiment, the resource transferring device and the resource transferring server are adopted to interact, instead of the resource receiving device and the resource transferring server, and in the interaction process, the resource transferring device only performs information encryption, decryption and forwarding processing, and operations such as authentication and authentication are completed by the resource transferring server, so that the security and the credibility of the authentication are ensured based on the stronger performance of the resource transferring server. In addition, the resource transfer-out equipment realizes simpler functions, the program deployment on the resource transfer-out equipment is simpler, and the universality of the resource transfer-out equipment is higher. Meanwhile, the resource transfer-out equipment is portable and safe, and the problem that mobile payment cannot be used due to the fact that two-dimension code transaction is not supported is solved to the greatest extent.

In an exemplary embodiment, a computer device, which may be a terminal, is provided, and an internal structure thereof may be as shown in fig. 10. The computer device includes a processor, a memory, an input/output interface, a communication interface, a display unit, and an input means. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input/output interface. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input/output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless mode can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by a processor to implement a resource transfer method. The display unit of the computer device is used to form a visually perceptible picture, which may be a display screen. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, and can also be keys, a track ball, a touch pad or the like arranged on the shell of the computer equipment.

In one exemplary embodiment, a computer device is provided, which may be a server, and the internal structure thereof may be as shown in fig. 11. The computer device includes a processor, a memory, an Input/Output interface (I/O) and a communication interface. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface is connected to the system bus through the input/output interface. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device is used for storing data such as keys. The input/output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a resource transfer method.

It will be appreciated by those skilled in the art that the structures shown in fig. 10 and 11 are block diagrams of only some of the structures associated with the present application and are not intended to limit the computer device to which the present application may be applied, and that a particular computer device may include more or fewer components than shown, or may combine certain components, or have a different arrangement of components.

In an embodiment, there is also provided a computer device comprising a memory and a processor, the memory having stored therein a computer program, the processor implementing the steps of the method embodiments described above when the computer program is executed.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored which, when executed by a processor, carries out the steps of the method embodiments described above.

In an embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of the method embodiments described above.

It should be noted that, the user information (including, but not limited to, user equipment information, user personal information, etc.) and the data (including, but not limited to, data for analysis, stored data, presented data, etc.) referred to in the present application are information and data authorized by the user or sufficiently authorized by each party, and the collection, use, and processing of the related data are required to meet the related regulations.

Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in the various embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magnetic random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (Phase Change Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in the form of a variety of forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), and the like. The databases referred to in the various embodiments provided herein may include at least one of relational databases and non-relational databases. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processors referred to in the embodiments provided herein may be general purpose processors, central processing units, graphics processors, digital signal processors, programmable logic units, quantum computing-based data processing logic units, etc., without being limited thereto.

The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The above examples only represent a few embodiments of the present application, which are described in more detail and are not to be construed as limiting the scope of the present application. It should be noted that it would be apparent to those skilled in the art that various modifications and improvements could be made without departing from the spirit of the present application, which would be within the scope of the present application. Accordingly, the scope of protection of the present application shall be subject to the appended claims.

Claims

1. A method of resource transfer, for use with a resource transfer-out device, the method comprising:

the first encryption message is sent to a resource transfer server;

2. The method of claim 1, further comprising, prior to sending the first encrypted message to a resource transfer server:

generating message digest information according to the first encrypted message;

the sending the first encrypted message to a resource transfer server includes:

3. The method of claim 1, further comprising, prior to receiving the transfer authentication instruction sent by the resource receiving device:

4. The method of claim 1, further comprising, prior to receiving the transfer authentication instruction sent by the resource receiving device:

collecting user authentication information of a user;

5. The method of claim 1, wherein encrypting the transfer authentication instruction to obtain a first encrypted message comprises:

6. A method for transferring resources, applied to a resource transfer server, the method comprising:

obtaining a second encrypted message based on the first encrypted message;

7. The method of claim 6, wherein the obtaining a second encrypted message based on the first encrypted message comprises:

8. A resource transfer apparatus for use with a resource transfer-out device, the apparatus comprising:

9. A resource transfer apparatus for use with a resource transfer server, said apparatus comprising:

10. A resource transfer system, the system comprising: resource transfer-out equipment, resource receiving equipment and a resource transfer server;

11. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any of claims 1 to 7 when the computer program is executed.

12. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 7.

13. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 7.