CN1635506A

CN1635506A - Financial payment service system

Info

Publication number: CN1635506A
Application number: CN 200310117522
Authority: CN
Inventors: 张吉星; 周蔚林; 袁勇; 田明; 陈孜; 李自沐; 莫达雄; 杨军辉; 郭履宁; 杨芳波; 方涛; 李澄宇; 赵卓威; 邵静
Original assignee: GOLDEN CHINA TELECOM SERVICES CO Ltd
Current assignee: GOLDEN CHINA TELECOM SERVICES CO Ltd
Priority date: 2003-12-25
Filing date: 2003-12-25
Publication date: 2005-07-06

Abstract

This invention discloses a financial payment service system, which comprises the following: plug-in layer, application layer, communication gate, payment layer and safety service sub-system, wherein the plug-in layer provides multi-plug support to the user terminal; the application layer is connected to the plug-in layer through interface; the said communication net gate is separately connected to the application and payment layer through interface; the said payment layer is connected to the financial service system through interface; the said safety service system provides safety service to the user terminal, plug-in layer, application layer and payment layer to ensure the safety of the data.

Description

A kind of financial receipt and payment service system

Technical field

The invention belongs to Electronic Finance payment technology field, especially belong to a kind of financial receipt and payment service system of communication value-added service industry.

Background technology

Existing electronic payment mode, payment way, mobile (mobile phone) modes of payments (being mobile banking or Mobile banking) etc. are mostly based on single communication modes.As:

Logical mobile payment platforms of many silver and value-added service application systems: payment is provided, pays the fees, function such as inquiry.On this system mainly is positioned at and move inserts,, and must change card when using, be inconvenient to popularize only based on the application of this a kind of communication modes of SMS; Its disposal system is not a unified information exchange platform.

Alliance's card payment: the payment of online payment and SMS mainly is provided.Just adopt cell-phone number to do authentication, when paying, Internet or SMS deduct " amount of money " in the member card (" alliance's card ") that this system provides for the member, and really do not realize from bank card, detaining account, the amount of money in its alliance's card still needs by traditional approach it to be supplemented with money (buy service card, deduct etc.) from mobile phone charge.The disposal system of alliance's card payment is not a unified information exchange platform.

Some other electronic fare payment system exists access way single to above-mentioned similar substantially in the prior art, and its disposal system is not a unified information exchange platform, does not more comprise application on K-Java mobile phone, the PDA at programmable terminal.

Summary of the invention

The object of the present invention is to provide a kind of financial receipt and payment service system, have access way to solve in the prior art, method of service is single and awkward shortcoming.

Realize technical scheme of the present invention:

A kind of financial receipt and payment service system comprises: Access Layer, application layer, Communication Gateway, payment layer and security service subsystem;

Described Access Layer provides to insert to client terminal and supports, the access protocol of conversion client terminal and access data layout are given application layer with the data forwarding after the conversion, and the message that application layer is returned is sent to client terminal;

Described application layer is connected with described Access Layer by interface, and this application layer is finished application service or/and payment request information is sent to Communication Gateway according to inserting data, and with the application service result or/and payment result is returned described Access Layer;

Described Communication Gateway is connected with the payment layer by interface and application layer respectively, and this Communication Gateway is transmitted to the payment layer after handling payment request information, and will pay and return to application layer after layer message of returning is handled, and simultaneously the payment behavior is monitored;

Described payment layer is connected with financial services system by interface, the Payment Request form that this payment layer conversion Communication Gateway sends is also submitted to financial services system, by the financial services system processing of paying, and the payment result that financial services system returns sent to the payment layer;

Described security service subsystem provides security service to client terminal, Access Layer, application layer and payment layer, to guarantee the safety of transmission data.

According to said system:

Described Access Layer comprises a plurality of access module that plurality of access modes is provided to client terminal.

Described a plurality of access module comprises one or more in note access module, WAP access module, vedio on radio binary operation environment (BREW) access module, KJAVA access module, mobile POS access module, voice access module and the WEB access module.

Described a plurality of access module is connected with application layer by unified interface, and each access module will insert and send to application layer by this unified interface after data are converted to consolidation form, and is that corresponding form sends to client terminal with the information translation that application layer is returned.

Described application layer comprises:

First interface module is connected with Access Layer;

Second interface module is connected with Communication Gateway;

The solicited message processing module is connected with first interface module, is used to accept the request message of Access Layer and detect and the translation data packet format;

The return message processing module is connected with first interface module, is used to accept return message and translation data packet format, and sends to Access Layer by first interface module;

First sending module is connected with second interface module with the solicited message processing module respectively, and Payment Request and kernel service request that transmission solicited message processing module is sent send to Communication Gateway by second interface module;

First receiver module is connected with the return message processing module with second interface module respectively, and the return messages of the Communication Gateway that second interface is received send message processing module to;

Described application layer also comprises:

The 3rd interface module is connected with Third-Party Service;

Second sending module is connected with the 3rd interface module with the solicited message processing module, and third party's services request that transmission solicited message processing module is sent sends to corresponding Third-Party Service by the 3rd interface module;

Second receiver module is connected with the 3rd interface module with the return message processing module, and the return messages of the Third-Party Service that the 3rd interface module is accepted send the return message processing module to.

Described Communication Gateway comprises:

The 4th interface module is connected with application layer;

The 5th interface module is connected with the payment layer;

The request message processing module is connected with the 4th interface module, is used to accept the request message of application layer and detect and the translation data packet format;

The return messages processing module is connected with the 4th interface module, is used to accept return message and translation data packet format, and sends to application layer by the 4th interface module;

The 3rd sending module is connected with the request message processing module with the 5th interface module, and request message processing module processed request information is sent to the payment layer by the 5th interface module;

The 3rd receiver module is connected with the return messages processing module with the 5th interface module, and the payment layer message that the 5th interface module is accepted sends to the return messages processing module;

Log pattern, monitoring module, be connected with request message processing module, return messages processing module, the 3rd sending module and the 3rd receiver module by communication interface, monitoring module is monitored the processing of each module, and the log pattern record is to handling the log information of request message.

Described payment layer comprises:

Subscriber management server, managing user information also provides kernel service;

Swap server is connected by Interface and Communication gateway, subscriber management server and financial services system respectively, submits to financial services system after the Payment Request of Communication Gateway is handled, and core request is submitted to subscriber management server.

Described swap server comprises:

First communication interface module is connected with the payment layer;

Second communication interface module is connected with subscriber management server;

The 3rd communication interface module is connected with financial services system;

Outside packet parsing device is resolved the outside message that first communication interface module is accepted, and is converted to the core message of unified structure; The core packet parsing that service message resolver and Unionpay's packet parsing device are sent and be converted to outside message and send to the first incoming communication module simultaneously;

The service message resolver, the core message that outside packet parsing device is sent is converted to the client server message, and sends to subscriber management server by the second incoming communication module; The message that subscriber management server is sent is converted to the core message and sends to outside packet parsing device simultaneously;

Unionpay's packet parsing device, the core message that outside packet parsing device is sent is converted to Unionpay's message of the ISO8583 of Unionpay form, by the 3rd communication interface module Unionpay's message is sent to financial services system; The Unionpay's message that simultaneously financial services system is returned is converted to the core message and sends to outside packet parsing device;

Routing module control carries out route control to message forwarding;

The flowing water database writes down all Transaction Informations;

Overtime control module, the Payment Request message in the scanning flowing water database sends towards just concluding the business when the response message of finding Payment Request is overtime.

Described secure subsystem comprises certificate registration server, certificate issuance system server, certificate issuance system server and Key Management server.

The present invention has following beneficial effect:

1, made full use of advanced wireless communication technique (SMS, GPRS, CDMA), Internet technology, CTI technology and comprehensively inserted, really realized large-scale mobile e-business and multiple access is provided.

2, adopted security system based on PKI, both guaranteed that user terminal was to the transaction data safety between the platform, guaranteed the data security of plateform system internal transmission, preservation again, realized confidentiality, accuracy, legitimacy and the non-repudiation of transaction data on the whole, realized SECURITY PROBLEM OF ELECTRONIC COMMERCE on a large scale thereby fundamentally solved.

2, adopt hierarchical system decomposing scheme clearly, summed up and defined basic Trading Model, in system, used the security architecture of PKI and WPKI simultaneously, thereby native system can be satisfied at present and most of electronic commerce affair demand in the future;

3, the core of adopting message queue technology, message exchange and route technology to realize system makes system very compact, efficient, and is easy to expansion and upgrading.

4, provide the core system monitoring interface, made native system be highly susceptible to management.

5, adopted the periphery of distributed component object technology, Java technological development system to insert and used, provide favorable compatibility for adapting to the diversity that plurality of access modes produces.

6, the present invention such as can realize paying, pay the fees, inquire about, transfer accounts at function; Under various access waies such as note, GPRS, CDMA, Internet, voice call, total solution is arranged all; Terminal type relates to regular handset, GPRS mobile phone, CDMA mobile phone, K-Java mobile phone, the PDA that is with communication module, plain old telephone, WEB browser etc.; Different terminals had unified information exchange platform.

Description of drawings

Fig. 1 is a structured flowchart of the present invention;

Fig. 2 inserts synoptic diagram for note;

Fig. 3 is a WAP access infrastructure synoptic diagram;

Fig. 4 is a BREW access infrastructure synoptic diagram;

Fig. 5 is a KJAVA access infrastructure synoptic diagram;

Fig. 6 is mobile POS access infrastructure synoptic diagram;

Fig. 7 is a WEB access infrastructure synoptic diagram;

Fig. 8 is the voice gateways principle schematic;

Fig. 9 is the application layer structure block diagram;

Figure 10 is the Communication Gateway structural representation;

Figure 11 A is the graph of a relation of log pattern and each process in the Communication Gateway;

Figure 11 B is the graph of a relation of monitoring module and each process in the Communication Gateway;

Figure 12 is the structural representation of payment layer;

Figure 13 A is that gateway side inserts synoptic diagram;

Figure 13 B is for connecting the subscriber management server synoptic diagram;

Figure 13 C is that information transmits the route synoptic diagram;

Figure 14 is a CA layer structural representation;

Figure 15 is the PKI configuration diagram;

Figure 16 is application certificate background process process flow diagram.

Embodiment

Consult shown in Figure 1ly, financial receipt and payment service system comprises Access Layer, application layer, Communication Gateway, payment layer and security service subsystem.

Access Layer provides to insert to client terminal and supports, the access protocol of conversion client terminal and access data layout are given application layer with the data forwarding after the conversion; The message that the while Access Layer returns application layer sends to client terminal.

Application layer is connected with described Access Layer by interface, and this application layer is finished application service or/and payment request information is sent to Communication Gateway according to inserting data; Simultaneously with the application service result or/and payment result is returned Access Layer.

Communication Gateway is connected with the payment layer by interface and application layer respectively, and this Communication Gateway is transmitted to the payment layer after handling payment request information, and will pay and return to application layer after layer message of returning is handled, and the payment behavior is monitored done daily record simultaneously.

The payment layer is connected with financial services system by interface, the Payment Request form that this payment layer conversion Communication Gateway sends is also submitted to financial services system, by the financial services system processing of paying, and the payment result that financial services system returns sent to the payment layer.

The security service subsystem provides safety certificate and key to client terminal, Access Layer, application layer and payment layer, to guarantee the safety of transmission data.

Below in conjunction with accompanying drawing, above-mentioned each subsystem is elaborated.

One, Access Layer

Access Layer provides different visit channel supports.The user can pass through note, WAP browser, Kjava mobile phone, Brew mobile phone, Web browser, the application of voice call and mobile POS machine access services provider.Access Layer is finished the conversion between the different access protocols, and to HTTP, wap protocol is to the conversion of HTTP as SGIP, and according to configuration the data that insert is transferred in the application of appointment, according to the corresponding relation realization routing function of one-to-many.

Access Layer is supported following several accessing terminal and communication mode:

Mobile phone: short message mode, WAP, Kjava, Brew;

PC: internet;

Landline telephone: automatic speech and artificial speech (customer service, seat);

Mobile POS.

In Access Layer, the note access technology is followed the SGIP agreement and is linked to each other with cellular carrier, to non-cellular carrier (as virtual operator or SP), adopt self-defining agreement HPPX coupled, all note inserts all needs to realize and background application layer and the physical connection of paying layer via Short Message Service Gateway.

The voice access technology is followed NAP2000, and Huawei's queue machine and voice flow software switch and control thereof are realized the access of automatic speech, and can realize the technology of artificial speech commentaries on classics automatic speech.All voice insert all needs to realize and background application layer and the physics UNICOM that pays layer via voice gateways.

The internet access technology adopts general in the world internet security agreement SSL to place on Web server and issues key length by Verisign company is 128 certificate of service, and client's sensitive data transmits on the net with the ciphertext form.

Programmable terminal: to the Kjava mobile phone, the Brew mobile phone, this class programmable terminal of mobile POS and STK, with the client-side program of application program this Terminal Type that writes direct, send the request of connection with TCP/IP formula http protocol to the backstage application layer by client-side program, this UNICOM depends on the network of cellular carrier, and the data of Access Layer pass to the backstage with encrypted test mode through the network of operator after using the encrypted private key that is embedded in the terminal.

1, note (SMS) access module

Consult shown in Figure 2ly, short message is responsible for sending and is received to the note access module, the conversion short-message protocol, and distribute according to the content of short message head, the short message that receives is passed to application layer.The note access module is made up of protocol conversion layer, short messaging gateway, buffer data storehouse, short message distribution services and the interface that initiatively sends SMS message.Short messaging gateway adopts the SGIP agreement to send, receives short message, finishes the exchange of short messages with each Virtual network operator gateway.Protocol conversion layer is between money bag short messaging gateway and each the Virtual network operator gateway, is responsible for other short-message protocol is converted to the SGIP agreement.The buffer data storehouse be used to cushion the short message that receives and etc. short message to be sent, and deposit the short message that sends or received.The short message distribution services passes to short message application layer and gives short messaging gateway with the short message loopback that application layer services is returned according to the content of short message leader knowledge that receives.

The main treatment scheme that short message inserts is as follows:

(1) mobile phone sends services request short message (MO) to corresponding wireless carriers.

(2) short messaging gateway receives user's short message that the Virtual network operator short messaging gateway sends, and extracts the content of corresponding field and is put into send buffer.

(3) the short message distribution services reads user's short message from send buffer, and the leader of analysis user content of short message is known, and according to configuration information use http protocols such as content of short message, cell-phone number is sent to application layer.

(4) request submitted to of application layer process user and return result and give the short message distribution services.

(5) short message distribution services result that application layer is returned is put into short message and is sent buffer zone.

(6) if the short message of initiatively initiating by application layer by " interface initiatively sends SMS message " module the content of descending transmission is put into short message and sends buffer zone.

(7) short messaging gateway sends buffer zone from short message and reads the short message (MT) that will issue, and fills each territory of SGIP agreement according to configuration information, and submits this short message to.

(8) user mobile phone receives the result short message.

The short messaging gateway main functional modules comprises: primary module, short message receive module, short message sending module and configuration information module.

Primary module: be responsible for safeguarding other each module, for other each module pass-along message, coordinate the synchronous etc. of each module.

Configuration information module: be responsible for maintain configuration information, obtain the configuration information interface for other module provides.

Short message receives module: explain the SGIP protocol massages that gateway is received, extract contents such as content of short message, cell-phone number, and be put into send buffer.

Short message sending module: send buffer zone from short message and short message to be sent such as read, obtain configuration information, fill the SGIP protocol massages and also submit this message to from the configuration information module.

The short message distribution services mainly comprises primary module, data base access module, http protocol module, configuration information module etc.

Configuration information module: be responsible for maintain configuration information, comprise sub number of short message and the sign of various application services and the configuration of parameter.

Data base access module: be responsible for checking that short message receives buffer zone, reads content of short message and the message that application service is returned is write database.

Http protocol module: be responsible for converting content of short message to corresponding http protocol message, and set up with application service and to connect, to exchange messages etc.

2, home control network communication protocol (WAP) access module

WAP is the open global standards of carrying out communication between digital mobile phone, the Internet or other PDA (Personal Digital Assistant), computer utility, just as http protocol is a kind of standard, has stipulated WEB server and client browser alternant way, standard.

Wap protocol comprise following which floor:

Wireless?Application?Environment(WAE)

Wireless?Session?Layer(WSL)

Wireless?Transport?Layer?Security(WTLS)

Wireless?Transport?Layer(WTP)

Receipt and payment service system on the WAP is exactly to realize the main application of payment on WAP, comprises that purchase stored value card, profit news are paid the fees, business such as length and width are paid the fees, lottery ticket choosing and selling, postal remittance.Mainly contain:

Login system: at mobile phone input operator's phone number, and input operator's password, WAP does operator's checking, and directly to the checking of money packet system, after the success, the operator just can carry out other financial transaction.

User's configuration: the user can register as online by mobile phone, and the data of oneself is made amendment comprises basic document and login password.

Bank card configuration: the user can carry out random increase to the bank card of own binding, deletion, modification default configuration.

Query the balance: import bank card password on mobile phone, the holder just can find the remaining sum on the bank card.

Financial transaction: the holder can input the bank card business dealing password and carry out various business transactions.As: hand over cell-phone fee, buy digital card, postal remittance, lottery ticket choosing and selling.

Automatically just dashing: to the transaction that reasons such as or response message MAC verification failure overtime owing to transaction fail to finish, the WAP server will produce dashing of former transaction and just conclude the business, and send to main frame before the transaction down, up to dashing positive success.Inquiry into balance transaction nothing is just being dashed.

Use IIS or Apache can set up WAP site easily.As website Www.gwallet.com, can support WAP through after being provided with, the mobile phone of any support WAP can be browsed.No matter the GSM, the GPRS that move or the CDMA of UNICOM, the user can import network address by hand by " forwarding the website to " in the navigate through menus: Http:// www.Gwallet.com/eweb/wap/epay/wap.jsp, while Configuration Agent server, as be configured to: 193.95.167.178, port numbers is 9201.

Because mobile phone itself does not have encryption and decryption functions, there is not definition to call the interface of SIM card cryptographic calculation in the wap protocol yet.This makes WAP can't realize end to end communication safety.So in native system, take the mode of WMLScript, WTLS, three kinds of safety practice combinations of SSL.Utilize client WMLScipt program, can realize the encryption to user input data, encrypted secret key produces at random.WTLS can realize that mobile phone is to the transmission security between the WAP gateway.Safety between WAP gateway and the WAP site can realize by SSL.Owing to can obtain all transmission WAP pages really expressly at gateway, but WAP gateway is subjected to network operating company's strict control, so WAP gateway is quite safe.Also taking the measure of some securities simultaneously in addition, is that number of the account and bank cipher do not occur simultaneously as the binding bank card, only need input password during transaction; Use special purpose system, and do not use Bank Account Number password etc.

Consult shown in Figure 3ly, the WAP access module comprises WAP terminal and WAP gateway.The WAP terminal is supported the mobile phone of wap protocol.WAP gateway realizes by the protocol conversion of Intranet to Internet.Acceptance is from the request of clients/applications layer, according to the code of asking to become application layer/client to discern Context resolution.

The user passes to data on the WAP gateway by the post mode in the standard agreement http protocol by terminal, gateway is responsible for the data of request are analyzed, and data are assembled into the required form of application layer, the data that application layer is returned are separated simultaneously, return to the terminal user, finish request of data.

Because the encode Chinese characters for computer in enterprise network and WAP server is the acquiescence coding with GBK, and the encode Chinese characters for computer on cell phone apparatus is to use the Unicode coding, if without conversion, mess code appears in the time of just can receiving Chinese information showing, cause user's trouble in the use, therefore in WAP gateway, finish the conversion work of these two kinds of codings.

To unusual sensitive data (bank cipher as the user lands password etc.), gateway is to CA server application private key, private key and ciphertext passed to application layer together after adopting asymmetric encryption mode enciphered data, guarantees the security from the gateway to the application layer.

The procotol that the WAP access module is followed is a http protocol.The http protocol requests for data has two kinds of main modes: the one, and GET mode, the one, POST mode.Consider the disguise of data, only support the POST mode.

Application layer provides the Servlet2.3 that has expanded http protocol to be basic interface standard, and each application provides a Servlet interface at least.So Access Layer WAP with http protocol, adopts the POST mode to the application-level request service.URL address and port that the URL address of its request and port provide for application layer.

3, vedio on radio binary operation environment (Binary Runtime Environment for Wireless, BREW) access module

BREW carries out platform at the application program of the disclosed standard of wireless device exploitation.The Brew platform can be built in a series of hand-held device, from common widely used mobile phone to various senior multi-application wireless equipment.At present, the application of Brew technology on wireless device (comprising mobile phone, PDA etc.) mainly concentrates on mobile textcommunication (Email, instant messages transmit), information service (news, weather, movie and video programs are single etc.), customize services (personalized agency), positioning service (location navigation, seek friend), multimedia recreation (data stream video, internet audio) and plays aspects such as (off-line, online, three-dimensional motion, video, music).The Brew platform is a general application platform, and just as the Windows operating system on the PC, the Brew platform provides a unified interface and environment for writing and moving of application program on the wireless device.The Brew platform provides developing instrument for application developer; For equipment vendor provides a development platform; Also provide the program delivery system for Virtual network operator; And provide the program download service for the terminal user.

Consult shown in Figure 4ly, the BREW access way is after signing in to Internet by cdma network, will insert the server that data transmission is given Access Layer in the mode of http protocol POST.

The BREW gateway be one by internal network request internal application, and provide the program of access services to outer net.In the BREW gateway, because the encode Chinese characters for computer in enterprise network and WEB server is the acquiescence coding with GBK, and the encode Chinese characters for computer on the CDMA of BREW cell phone apparatus is to use the Unicode coding, if without conversion, just mess code occurs in the time of can receiving Chinese information showing, cause user's trouble in the use.Therefore, in the BREW gateway, finish the conversion work of these two kinds of codings.Through will directly being sent to application layer to obtain application service according to application layer/Access Layer unified interface standard behind the BREW gateway.

In BREW mobile phone application terminal, consider that security set up the safety certificate storage space, the user can ask safe authentication and payment function as required.

4, KJAVA access module

The KJAVA technology is the JAVA technology that is based upon on the J2ME standard that SUN company provides.Be a kind of embedded JAVA virtual machine, at present on the PDA equipment and have on the novel JAVA mobile phone of PDA function this embedded type virtual machine is installed.The KJAVA application bag that operates on the PDA mobile phone generally is to wrap through the JAR that breaks into after several heavy processing.These processing comprise work such as code compiling, compiling, debugging, check, configuration, compression packing.

The cell phone apparatus that support of the present invention has the KJAVA virtual machine obtains service by GPRS network or cdma network in the Internet mode.

The application that operates on PDA (the comprising mobile phone) equipment of supporting KJAVA is referred to as the KJAVA application.These are applied on the physical store is that some low capacities (generally are no more than 500k, because capacity is little, in KB, so be referred to as KJAVA, this also is the source of KJAVA title) JAVA bag, owing on the PDA equipment of support KJAVA the KJAVA virtual machine is installed, makes the PDA equipment of supporting KJAVA have the ability of loading, explanation, operation JAVA object code.

PDA user uses the menu mode that provides by KJAVA and selects to finish payment function.The KJAVA that the user also can delete unwanted the time on PDA equipment uses.

Consult shown in Figure 5ly, the KJAVA gateway among the figure directly can be realized with the WEB technology.The KJAVA gateway in fact be exactly one by internal network request internal application and the application program of access services is provided to outer net.

The KJAVA gateway need be handled the Chinese character code problem, because the Chinese character code in enterprise network and WEB server is the acquiescence coding with GBK, and the Chinese character code on mobile phone and PDA equipment is the UTF-8 coding, if without conversion, just can the mess code phenomenon occur when sending and receive parameter, the KJAVA gateway is finished the translation function of these two kinds of codings.Request on the PDA equipment of supporting KJAVA is picked application layer to obtain application service according to application layer/Access Layer unified interface standard straight behind the KJAVA gateway.

In the KJAVA access module, have independently Access Layer database, be used for writing down payment and dash the daily record data table that dashes correction data table and preservation day regular data of just concluding the business.

In the PDA application terminal of supporting KJAVA, because the safety certificate storage space has been set up in security, the user can ask safe authentication and payment function as required.

The PDA equipment of supporting KJAVA signs in on the Internet by the GPRS gateway after operation KJAVA uses, and inserts the KJAVA gateway in the WEB mode then, finishes the request of service and returns.

5, mobile POS access module

Mobile POS access module is to utilize the characteristics and the receipt and payment service system backstage of the wireless telecommunications of mobile POS to carry out wireless telecommunications, carries out various message exchanges, thus functions such as realization financial transaction.

Utilize mobile POS, the bank card that can use various Unionpay to support anywhere or anytime provides quick, reliable various services to the client.

Consult shown in Figure 6ly, the treatment scheme that POS inserts is as follows:

(1) transaction data is in mobile POS, by predefined protocol format packing.Its content comprises: transaction order, the unique sign of user number, user cipher, date, time, transaction card number, dealing money or the like.

(2) transaction data is sent to the application gateway of mobile POS access module by GPRS or cdma wireless network.

(3) application gateway is forwarded in the application layer application corresponding server according to the transaction data of accepting.

(4) application server is analyzed according to the transaction data that receives, checking treatment, and send backstage service wait result.

(5) after application server receives the result on backstage, directly send in the application gateway of POS access module.

(6) data message after application gateway will be handled is sent to the POS terminal by GPRS or cdma wireless network.

When using the POS terminal, need first login system to register i.e. input operator ID on POS, and input operator's password, POS does operator's checking, directly to system verification, finishes terminal and trade company's validation verification, produce terminal key and transaction lot number, following biography POS registers successfully.Register after the success, the operator just can carry out other financial transaction.

Utilize mobile POS terminal, the holder can import the inquiry that the bank card password for inquiry carries out the bank card remaining sum; Can input the bank card business dealing password and carry out various business transactions.

To the transaction that reasons such as or response message MAC verification failure overtime owing to transaction fail to finish, the POS terminal will produce dashing of former transaction and just conclude the business, and send to main frame before the transaction down, up to dashing positive success.Inquiry into balance transaction nothing is just being dashed.

6, Web access module

It is to utilize the characteristics of cable network and receipt and payment service system backstage to carry out communication that Web inserts, and carries out the exchange of various information, thereby reaches function such as financial transaction.Utilize the network advantages resource, can use any interchanger of binding whenever and wherever possible, to user's good service efficiently of providing convenience.

Web inserts needs Web terminal, router, fire wall, Web server, Web gateway, database and security mechanism cooperation to finish.

The Web terminal: common have common desktop PC to insert and portable PC access.

Router: playing routing function, is Web server and the outside unique interface that is connected.

Fire wall: be connected between router and the Web server, guarantee the security of total system, avoid being subjected to the attack of malice.

Web server: accept user's request, be and the pith of user interactions dialogue, webpage is resolved the code that client can be discerned according to request.Adopting general in the world internet security agreement SSL to place on Web server and issuing key length by Verisign company is 128 certificate of service, client's sensitive data, the ciphertext form transmits on the net, guarantees the security from the client terminal to the server.

In fact the Web gateway is exactly one provides the program of access services by internal network request internal application and to outer net, consults shown in Figure 7.The user passes to data on the web server by the post mode in the standard agreement http protocol by browser, gateway is responsible for the data of request are analyzed, and data are assembled into the required form of application layer, the data that application layer is returned are separated simultaneously, return to the terminal user, finish request of data.Because user terminal is windows system Chinese character mostly is the acquiescence coding with GBK, and application layer is to be operating system with linux, so there is Chinese character mess code problem.The web gateway converts the GBK formatted data of user request the ISO form of standard to, delivers to application layer, simultaneously application layer is sent here the ISO formatted data and is converted to the GBK formatted data and gives the terminal user.For unusual sensitive data (bank cipher as the user lands password etc.), gateway is to CA server application private key, private key and ciphertext passed to application layer together after adopting asymmetric encryption mode enciphered data, guarantees the security from the gateway to the application layer.

Web inserts database provides a unique serial number to distinguish communicating by letter each time of web gateway and application layer to the web gateway.

Structures such as Web terminal, router, fire wall, web server, web gateway, database, safety have been formed the whole of Web access technology.

The systemic-function that provides is provided WEB:

Login system: input operator's phone number on webpage, and input operator's password, Web are done operator's checking, and directly to system verification, after the success, the operator just can carry out other financial transaction.

User's configuration: the user can register by webpage, and the data of oneself is made amendment comprises basic document and login password.

Bank card configuration: the user can carry out random increase to the bank card of own binding, deletion, and the modification default configuration can be bound 9 bank cards at most.

Query the balance: import bank card password on webpage, the holder just can find the remaining sum on the binding bank card.

Financial transaction: the holder can input the bank card business dealing password and carry out various business transactions.As: hand over cell-phone fee, buy digital card, mobile phone is paid the fees, postal remittance, lottery ticket choosing and selling.

Automatically just dashing: to the transaction that reasons such as or response message MAC verification failure overtime owing to transaction fail to finish, Web server will produce dashing of former transaction and just conclude the business, and send to main frame before the transaction down, up to dashing positive success.Inquiry into balance transaction nothing is just being dashed.

7, voice access module

Consult shown in Figure 8ly, voice gateways have realized the exchanges data of voice platform system and application server.The NAP2000 voice platform is a software and hardware system ensemble.This system definition a kind of special use based on message and communications protocol between the node of UDP.The Communication ctrl control that the general NAP2000 of use is equipped with is realized communication interface.Application server then uses the http agreement to accept outside application request.In order to realize both exchanges data.Need set up a conversion layer in the centre.The program that realizes this conversion is voice gateways.

Because the continuous increase of using, agreement also can constantly expand and improve.For improving dirigibility, maintainability and the extensibility of gateway, to adapt to various demands of applications in the future.The message format of agreement can define fully.Program can be resolved these definition and be changed by definition is strict.A kind of message format is defined as an interface (interface), and interface is stored in the designated directory with document form.Because some data also need be passed through certain special conversion.Support to use transfer function in the definition.Interface definition is the definable test data also, is used for the side test separately of gateway.

Program adopts multithreading.Can handle the protocol conversion of a plurality of (looking machine performance and free memory size) different messages simultaneously.

Two, application layer

The application layer of receipt and payment service system realizes the business application logic of payment function.Each application has realized an independently items in commerce, and these items in commerce can be the stand-alone service projects that system self provides, as: digital card service item, service item etc. queries the balance; Also can be the comprehensive services with the third party service provider cooperation, as: postal remittance service item, the fast mobile phone paying service project of profit, Great Wall Broadband Network Service Company Limited expenses of surfing in Internet paying service project etc.

In application layer, all commerce is used and all is based upon on the core application, and this core application has realized the user's service and the payment services of receipt and payment service system core.

User service provides such as bank card configuration management (comprise the number of auditing, add number of the account, delete account number, change number of the account, function such as default account number is set), user management (comprise login, registration, cancellation, identification, searching user's information, modification user profile, inquiring user password, revise function such as user cipher).

Payment services provide such as querying the balance, pay, cancel, dashing and are just waiting financial service function.

Payment services and user's service have closely gets in touch.The user serves and has realized the binding of user's plurality of access modes (as mobile phone, phone, third party's service identifiers etc.) with bank card, and payment services are finished payment function according to the Financial Information (mainly being bank card account number information) that user's service provides.

Application layer mainly realizes the business logic of various application, comprises user's authentication.

Consult shown in Figure 9ly, application layer comprises following functional module:

First interface module is used to connect Access Layer;

Second interface module is used to connect Communication Gateway;

The solicited message processing module is connected with first interface module, is used to accept request message and the detection and the translation data packet format etc. of Access Layer;

First sending module is connected with second interface module with the solicited message processing module respectively, and Payment Request and user's services request that transmission solicited message processing module is sent send to Communication Gateway by second interface module;

The 3rd interface module is used to connect Third-Party Service;

As can be seen from Figure, whole service interface framework has three interfaces, below this is elaborated.

Second interface definition exchanges data standard of application layer and bottom user service, payment services, security service etc., this interface will be used to share and use by all, this is the kernel service interface of receipt and payment service system.

The 3rd interface (being third party's service layer/Applied layer interface) the then integrated application demand according to reality determines whether needs, needs request third party service if integrated application relates to, and then should formulate the 3rd interface, otherwise not need this interface.As: digital card service, postal remittance service etc. does not need this interface; Need third party's service layer/Applied layer interface and moisten fast paying service, Great Wall Broadband Network Service Company Limited paying service, first letter shopping service etc.

First interface (application layer/Access Layer interface) purpose is the service that standard and unified all system applies provide, and requires all Access Layers must follow this interface standard to ask service.Unified after the interface, application layer is no longer finished the complicated parameter processing relevant with access way and the processing of error message, these work will be finished by Access Layer, consider that different Access Layers are not quite similar from the parameter that client layer receives, and the information that returns to the user is also different, and it also is rational selection that the processing of parameter is placed on that different Access Layers finishes.By the interface alternation characteristic that the Access Layer decision provides to the external world, the service that the one side Access Layer can use application layer to provide flexibly on the other hand, has also been strengthened compatibility and the expandability of Access Layer to system upgrade.

Consider cross-platform characteristic, application layer is the core development technique with JAVA, is the core application database with ORACLE, under the running environment of supporting JAVA, sets up the application server that service is provided to different access waies.

Consider the compatibility and the extendibility of system, application layer provides a cover unified interface standard to Access Layer.According to this standard, each is independently used can both independently provide identical service to different access waies, and can be according to the difference of the different access way parameter recognition access waies of importing into.Use the transaction of tenaculum safety certificate, also support not transaction, two kinds of mode of doing business compatibility and co-existences with safety certificate.Because application layer provides unified service interface, it supports any new access way.Along with the expansion of business scope, application layer allows constantly to increase to use, and each application can independently provide service.Generally speaking, on new application and this both direction of access way, provide good extending space.

Because application layer operates under the WEB application service environment, the WEB server has very strong stability and adaptivity, so the stability of application layer and adaptivity have obtained guarantee.In addition, application layer password can not occur expressly, and all confidential information are only respectively accessing terminal and bottom service terminal is finished end-to-end encryption and decryption process, and the application layer in the centre all is transparent and mistake, and therefore, the security of application layer also is conclusive.

Each application all links with a unified interface and Access Layer.The means that Access Layer inserts can passing in time constantly add new access way, and all access waies are all passed through unified application interface with application and linked to each other.

Whole application are all passed through a Communication Gateway and are linked to each other with the payment layer, and any one is applied in when needing to pay and all links to each other with the payment layer with unified message format process Communication Gateway, gives Communication Gateway with Payment Request.

The mode of Communication Gateway employing process exchange is responsible for realizing the transmission of all Payment Request of application layer, uses the technology of Inter-Process Communication can guarantee to greatest extent that application layer and payment layer have excellent communication performance and bigger flow.

The service object of system mainly is the customer group that has mobile phone, and user mobile phone and user's bank card security is bundled on the system platform reliably, the user can be made things convenient for and relieved carries out various electronic transactions on this platform.The user can pass through mobile phone, can certainly pass through other network terminal, as landline telephone, the PC with function of surfing the Net, the POS machine with function of surfing the Net, PDA equipment etc., inserts the receipt and payment platform to obtain service.

All possible access way is numbered in consideration, so that management.Typical case's access way has following several:

Call voice (Telephone Voice) inserts: serve with acquisition by making call receipt and payment system automation services number and according to voice prompt operation.The terminal that inserts in this mode mainly is a landline telephone, also supports mobile phone speech to insert.This access way is numbered 0.

Short message (Short Message System) inserts: short message also is referred to as note, serves with acquisition to receipt and payment system note shortcode by sending short message by mobile phone.The terminal that inserts in this mode mainly is a mobile phone, and what walk is the SMS passage.This access way is numbered 1.

WEB browser: serve with acquisition by visit receipt and payment system websites such as browser commonly used such as IE, NETSCAPE, OPERA.The terminal that inserts in this mode mainly is the PC of online, has the PDA terminal of operating system etc.This access way is numbered 2.

More than three kinds of access waies are the three kinds of maximum modes that insert at present.

WAP (Wireless Application Protocol) browser: by the WAP browser access WAP application server of mobile phone or PDA terminal.This mode is similar to WEB browser mode.This access way is numbered 3.

Embedded JAVA application interface: mobile phone or PDA with embedded JAVA function pass through OTA downloaded receipt and payment system service client application, then by the service of client application visit receipt and payment system.This access way is numbered 4.

The Brew application interface: this access way is similar to the access of embedded JAVA application interface, is the kernel language difference, and what Brew used is C language kernel.This access way is numbered 5.

The Symbian application interface: this access way is numbered 6.

Mobile POS operation interface: this access way is numbered 7.

Consider to be used for internal trace and management, be in particular a kind of access way that back-stage management is set, the request of this access way allows to have the privilege service.This access way is numbered 9.

Also can support more access way according to demand.

The network data transportation protocol that application layer is followed is a http protocol.The http protocol requests for data has two kinds of main modes: the one, and GET mode, the one, POST mode.Consider the disguise and the security of data, this standard code application service end is only supported the POST mode, to the GET mode with denial of service.Because application layer is running environment with JAVA, application layer requires to provide the interface standard based on Servlet 2.3 standards of having expanded http protocol.Require each application at least that a Servlet interface is provided.

For each application, different Access Layers are URL address and the port that application layer provides service with the URL address and the port of http protocol request.For example: digital card is used, if application layer provides the request address of shape such as http://server:port/digitalcards, then no matter be SMS gateway or voice gateways or other access gateway, when setting up HTTP Socket connection, all with top Address requests digital card service.To an application, application layer provides unique request address, can guarantee like this to use for one not have two parts simultaneously in operation, thereby also solve because the data collision problem that the applied version problem is brought.

About the transmission problem of parameter, http protocol POST mode allows the organized formats of self-defining data parameter, and the organizational standard of for this reason formulating parameter is as follows:

All parameters all are named parameters, and separate with equal sign (=) between parameter name and the parameter value.

Must there be functional parameter Command parameter, Request From parameter and SSN parameter.These three parameters are respectively the function titles, accept mode (also being access way), handle serial number (being produced by incoming end).

Between the parameter with sterling symbol (﹠amp; ) separate, this separator can redefine according to demand, and this needs application service exploitation side and each the Access Layer side of exploitation consult to decide.In case determined separator, then each access side all must follow, and can not use special separator voluntarily.

Parameter name capital and small letter is irrelevant, the parameter sequence independence.These regulations help the expansion and the upgrading of interface.

This standard meets CGI (Common gateway interface) standard in fact.All parameters are made into packet with this set of specifications, and shape is as parameter1=value1﹠amp; Parameter2=value2﹠amp; ....Access Layer sends to application layer after data are made into packet by set of specifications, and application layer mask data bag is also finished return results after the application corresponding function according to parameter, and the data layout of return results also satisfies this standard.Application layer and Access Layer all need to finish the function that HTTP POST supplemental characteristic bag is unpacked.

Use is satisfied CGI specification data packet format and is compared with other form and mainly contain following advantage (being primarily aimed at traditional data message format and XML cannonical format):

Consider based on dirigibility that one, CGI standard and XML specification data bag are not stipulated the length of parameter value, the priority position of also not stipulating parameter, and the fixed-length data message format is to the parameter position, parameter length has all been done constraint.Require elongated or shorten in case find content of parameter, perhaps transposing appears in parameter in proper order, all can cause the change on interface both sides, and if data length must fill the data bit of deficiency when not enough.If without the fixed-length data message, and use elongated data message instead, so also must all will calculate length one time, and the parameter position can not be changed still to each territory in the message.Use CGI specification data bag not have such problem, use XML specification data bag also not have such problem.Based on dirigibility, should select CGI standard or XML standard.

Two, consider that based on compatibility and interface version the compatibility of data message form is the poorest, in case need to increase a parameter, when perhaps certain parameter no longer needed, whole message structure all needs to upgrade to be adjusted, and the corresponding interface both sides also all must be adjusted.There are not such problem in CGI and XML, and they all have the interface back compatible.Consider based on compatibility and interface version, also do not select the data message form.

Consider based on data bandwidth that three, the form of bandwidth-saving is the data message form, the form that consumes bandwidth most is the XML cannonical format, compromise be the CGI cannonical format.

Take all factors into consideration, using the CGI cannonical format is best choice.

This standard-required application layer is described with form at the call parameters and the return parameters of each function, and indicates length as much as possible, type, information such as specific (special) requirements, and the wrong code table of enclosing transceive data bag example and may returning.The application layer of receipt and payment service system realizes the business application logic of payment function.Each application has realized an independently items in commerce, and these items in commerce can be the stand-alone service projects that system self provides, as: digital card service item, service item etc. queries the balance; Also can be the comprehensive services with the third party service provider cooperation, as: postal remittance service item, the fast mobile phone paying service project of profit, Great Wall Broadband Network Service Company Limited expenses of surfing in Internet paying service project etc.

User service provides such as bank card configuration management (comprise the number of auditing, add number of the account, delete number of the account, change number of the account, function such as default number of the account is set), user management (comprise login, registration, cancellation, identification, searching user's information, modification user profile, inquiring user password, revise function such as user cipher).

Payment services and user's service have closely gets in touch.The user serves and has realized the binding of user's plurality of access modes (as mobile phone, phone, third party's service identifiers etc.) with bank card, and payment services are finished payment function according to the Financial Information (mainly being the bank card account) that user's service provides.

First interface module is used to connect Access Layer;

Second interface module is used to connect Communication Gateway;

The 3rd interface module is used to connect Third-Party Service;

The Symbian application interface: this access way is numbered 6.

Mobile POS operation interface: this access way is numbered 7.

Also can support more access way according to demand.

For each application, different Access Layers are URL address and the port that application layer provides service with the URL address and the port of http protocol request.For example: digital card is used, if application layer provides shape such as http: the request address of ∥ server:port/digitalcards, then no matter be SMS gateway or voice gateways or other access gateway, when setting up HTTP Socket connection, all with top Address requests digital card service.To an application, application layer provides unique request address, can guarantee like this to use for one not have two parts simultaneously in operation, thereby also solve because the data collision problem that the applied version problem is brought.

This standard-required application layer is described with form at the call parameters and the return parameters of each function, and indicates length as much as possible, type, information such as specific (special) requirements, and the wrong code table of enclosing transceive data bag example and may returning.

Three, Communication Gateway

Communication Gateway provides the pipeline of data communication between an application layer and the payment layer.The data that its verification Application layer of while is sent here are abandoned dirty data, guarantee to pay the safety of data and the integrality of layer, play the effect of a simple soft fire wall.Communication Gateway also provides log system and information monitoring system, can normally stable operation to guarantee whole Communication Gateway.

Consult shown in Figure 10ly, Communication Gateway comprises the 4th interface module, the 5th interface module, request message processing module, return messages processing module, the 3rd sending module, the 3rd receiver module, log pattern and monitoring module.Communication Gateway is set up a thread for each client-requested, and follows the tracks of the request service of this client, comprises the transmission solicited message, handles solicited message, accepts return message etc.

Communication Gateway is connected with application layer by the 4th interface module, is connected with the payment layer by the 5th interface module.

The request message processing module is connected with the 4th interface module, and its function is: accept request, unpack processing, check information detects information integrity, presses server message protocol form package information, message information is sent in the message queue by sending type of message, and carry out overtime control operation.

The return messages processing module is connected with the 4th interface module, and its function is: accept the service returned packet by accepting type of message from message queue, unpack by the server message format, by client message protocol package information, send information to client.When overtime, send out the time-out information message to client.

The 3rd sending module is connected with the request message processing module with the 5th interface module, accepts message information by sending type of message from message queue, and sends to the payment layer.

The 3rd receiver module is connected with the return messages processing module with the 5th interface module, accepts the returned packet information of payment layer, sends in the message queue by accepting type of message.

Log pattern and monitoring module, be connected with request message processing module, return messages processing module, the 3rd sending module and the 3rd receiver module by communication interface, monitoring module is monitored the service processes of each module, and log pattern then writes down the log information of each module.

The relation of log pattern and each process is shown in Figure 11 A; The relation of monitoring module and process is shown in Figure 11 B.

Four, payment layer

The payment layer is the core layer of receipt and payment service system, comprises subscriber management server and swap server.Subscriber management server leading subscriber database also provides kernel service.Swap server is connected by Interface and Communication gateway, subscriber management server and financial services system respectively, submits to financial services system after the Payment Request of Communication Gateway is handled, and core request is submitted to subscriber management server.

Each financial institution services system is connected, and adopts the ISO8583 agreement, and the Payment Request that the payment layer is submitted Communication Gateway is submitted to financial institution by the ISO8583 form after treatment.Subscriber management server is submitted in the kernel service request that Communication Gateway is submitted after treatment.

Swap server is the message Communication Gateway that connects application layer, subscriber management server and bank's gateway and other application interfaces.It is positioned at the lowermost layer of system logic layer.The routing forwarding of swap server and time-out check, handle and error tracking towards positive retransmission mechanism obtaining of guaranteeing that the message of turnover can be correct.

Consult shown in Figure 12ly, swap server comprises the first incoming communication module, the second incoming communication module, the 3rd incoming communication module, outside packet parsing device, service message resolver, Unionpay's packet parsing device, routing module control, overtime control module and flowing water database.

The first incoming communication module is connected with the payment layer; The second incoming communication module is connected with subscriber management server; The 3rd incoming communication module is connected with financial services system.

Outside packet parsing device is resolved the outside message that first communication interface module is accepted, and is converted to the core message of unified structure; The core packet parsing that service message resolver and Unionpay's packet parsing device are sent and be converted to outside message and send to the first incoming communication module simultaneously.

The service message resolver, the core message that outside packet parsing device is sent is converted to the client server message, and sends to subscriber management server by the second incoming communication module; The message that subscriber management server is sent is converted to the core message and sends to outside packet parsing device simultaneously.

Unionpay's packet parsing device, the core message that outside packet parsing device is sent is converted to Unionpay's message of the ISO8583 of Unionpay form, by the 3rd communication interface module Unionpay's message is sent to financial services system; The Unionpay's message that simultaneously financial services system is returned is converted to the core message and sends to outside packet parsing device.

Routing module control carries out route control to message forwarding.

Route refers to message that requesting party (CLIENT) is sent according to the information in the message, obtain the function of information such as address, the side of service, port, communication route by routing algorithm under the situation of the address of not knowing service side (SERVER), port.

Routing algorithm is:

(1) if the route of requesting party known service side then is failure to actuate, and jumps out;

(2), then, jump out according to the address of the corresponding service side of transaction classification inquiry if there is the information of transaction classification in requesting party's data;

(3) if there is the information of card account number in requesting party's the data, the address of this service side's (payment network selection) that selection should be selected according to the card type table is jumped out;

(4) return routing failure.

The Transaction Information that the flowing water data-base recording is all, the effect of its record have three:

(1) provides the desired data of overtime control module;

(2) produce the data of day accounting checking file as clearing;

(3) data that provide problem to recall;

The main information of flowing water data-base recording comprises: trade date, exchange hour, transaction title, transaction

Classification, dealing money, return code, completion status and Settlement Date.

Overtime control module is carried out overtime control to the response of Payment Request message.Payment Request message in the overtime control module timing scan flowing water database sends towards just concluding the business when the response message of finding Payment Request is overtime.

The intelligent access side, outside that connects of swap server, when the external interrupt connection, swap server can obtain joining the information of interrupting on the road and removing the communication handle immediately, and information is sent to monitoring client.

First, second and the 3rd incoming communication module are transmitting-receiving two-way dual-mode.Be that both sides respectively build the Server end.

Consult shown in Figure 13 A, for the access point of Communication Gateway side, the receiver module of the first incoming communication module receives outside transaction request message, and sending module sends the transaction response message.

Consult shown in Figure 13 B, for subscriber management server and financial services system side, the receiver module of the second and the 3rd incoming communication module generally receives outside transaction response message, and sending module sends the transaction request message.

Consult shown in Figure 13 C, for the route control that message is transmitted, each access point is assigned unique Number for access, and this numbering has also been specified the address sign of the interface routine of this access point simultaneously.When need mailing to another access point, the information of an access point only needs to fill in take over party's Number for access in the destination address mark territory of message.

In swap server, the transaction message of each access point has the uniquely identified serial number, and the record of being convenient to conclude the business and just dashing is the uniqueness that realizes serial number, and all transaction journals number all unify generation.The configurable flowing water table of each access point is used to put down in writing the All Activity information of this access point turnover, cancels transaction and can inquire about former Transaction Information for dashing just reaching.

Operation has monitor terminal in swap server, and each process can send the inner Debugging message that produces of process to monitor terminal by the information release process, and the information release process is a service routine that can connect a plurality of monitor terminals.Each process can send the message information of turnover by the information release process to monitor terminal.

Payment layer adopts a message exchange and a route technology, can insert how tame trade company simultaneously, run service provider, banking institution, forms a unified information exchange platform, system is very easily expanded and upgrades.

Five, security service subsystem

The security service subsystem is divided into CA layer (CA is the specialized agency of reliable distribution ﹠ management digital security certificate for CA-Certificate Authority, certification authority (CA)) and PKI (Public KeyInfrastructure is called for short PKI).PKI is that a kind of public key cryptography of utilizing of following standard provides the technology and the standard of a cover foundation for security platform for carrying out of ecommerce.The secure communication layer is carried out in the service that the user can utilize the PKI platform to provide.

The CA layer is responsible for signing and issuing digital certificate to each server and the user of payment services system.Digital certificate is a series of data of sign communication each side identity information in the network communication, and the form of digital certificate adopts X.509 international standard.

The digital certificate content comprises:

The version information of certificate;

The sequence number of certificate, each certificate all have a unique certificate serial number;

The employed signature algorithm of certificate;

Issuer's title of certificate, naming rule generally adopts X.400 form;

The term of validity of certificate, general certificate generally adopts the UTC time format now, and its timing range is 1950-2649;

The proprietary title of certificate, naming rule generally adopts X.400 form;

The proprietary public-key cryptography of certificate;

Certificate issue person is to the signature of certificate.

Digital certificate functionality:

Information is not stolen by other people except that transmit leg and take over party;

Information is not distorted in transmission course;

Transmit leg can be confirmed take over party's identity by digital certificate;

Transmit leg can not be denied for the information of oneself.

Consult shown in Figure 14ly, the CA layer comprises certificate registration server, certificate issuance server, certificate issuance server and Key Management server.

Certificate type comprises:

1, the end-to-end certificate of bank, be used to guarantee bank card password from or the transmission security of the swap server of other financial sensitive informations from Access Layer to the payment layer.The swap server end uses the certificate of band private key, is used for the private key deciphering; Access Layer or user side use not with the certificate of private key, are used for public key encryption.

2, Communications service certificate is used for protecting account No. that user terminal fills in communication process safety (particularly in wireless network in the transmission way).Server end uses the certificate of band private key, is used for the private key deciphering.Access Layer or user side use not with the certificate of private key, are used for public key encryption.

Grant a certificate on client server mainly is a safety of returning private key for user when protecting the user applies certificate.When user terminal (particularly mobile phone) application certificate, generate a symmetric key---private key protection key, and serve PKI with the user it is encrypted.With private key it is deciphered after client server is received, take out private key protection key plain.After the success of individual subscriber certificate request, adopt symmetric encipherment algorithm to encrypt private key for user with private key protection key, return to user terminal again.

3, application service certificate, be used for application layer and the non-finance of third party's network delivery but the high information of security requirement is arranged.Application server uses the certificate of band private key, is used for the private key deciphering.Access Layer or user side use not with the certificate of private key, are used for public key encryption.

4, personal terminal certificate, the sign personal identification that the user of system holds, and be used for the certificate of data encryption and digital signature purposes.

PKI is that a kind of public key cryptography of utilizing of following standard provides the technology and the standard of a cover foundation for security platform for carrying out of ecommerce.Secure communication is carried out in the service that the user can utilize the PKI platform to provide.Secure subsystem PKI layer is to use these technology to solve the realization of the information security of multiple communicating terminal.

Algorithm and technology that PKI uses:

The 3-DES cryptographic algorithm;

The SHA-1 hash algorithm;

1024bit RSA asymmetric encryption;

The x509 certificate format;

Ca authentication and key management technology.

The arrangement framework of PKI in whole payment services system as shown in figure 15.

According to the MIDP standard, have a MIDlet Suite in the routine package that the JAVA communicating terminal is downloaded each time (Package), when the operation of the program MIDlet in the bag, can visit an independently permanent memory headroom, but the program in the different bags can not be visited mutually but by RMS.Therefore, for the JAVA communicating terminal of supporting MIDP, the strategy that is defined as follows:

1, the user is before using the service of payment services system by the JAVA communicating terminal, earlier by OTA (abbreviation of English Over-The-Air, the meaning are " air download ") download user routine package.The function of this routine package comprises: user's registration, application certificate, configuration bank card, inquiry into balance, other finance self-help service, other user's service.This routine package need prestore Communications service certificate or pairing PKI, user's certificate of service or pairing PKI, bank's end certificate or pairing PKI.This routine package will be preserved user's the pairing private key of personal certificate after user registration success is also successfully applied for certificate.

2, the user can select download application corresponding package of service program (business) according to the needs of oneself, and according to the difference of class of business and the data security of communication is required different, server certificate has been installed in the application service that has, and what have does not then have.According to the service conditions of reality, can be in a routine package with a plurality of application combination.The routine package of this type need prestore: Communications service certificate or pairing PKI, application service certificate or pairing PKI (selecting for use), bank's end certificate or pairing PKI, user's the pairing private key of personal certificate.

Consult shown in Figure 16ly, in order to simplify user's operation, the application of user certificate is finished by the client server proxy user.Client server extracts user's information from database, form certificate request information, submits the certificate registration application to the registration door of CA system.After the intact application for registration of CA system handles, return to client server user's certificate and corresponding private key, client server returns to these information user's portable terminal again.

In the present invention, Access Layer, application layer, Communication Gateway, payment layer and security service subsystem can be realized by different physical entity (as server) respectively, also can be combined in a physical entity or a plurality of physical entity realizes, as, Communication Gateway and payment layer are arranged in the physical entity, and all the other are arranged in the different physical entities.

Claims

1, a kind of financial receipt and payment service system is characterized in that this system comprises: Access Layer, application layer, Communication Gateway, payment layer and security service subsystem;

2, the system as claimed in claim 1 is characterized in that, described Access Layer comprises a plurality of access module that plurality of access modes is provided to client terminal.

3, system as claimed in claim 2 is characterized in that, described a plurality of access module comprise the note access module, and this note access module is accepted the short message of client terminal, sends to application layer behind the conversion short-message protocol; And the information that application layer is returned sent to client terminal with short message way.

4, system as claimed in claim 2 is characterized in that, described a plurality of access module comprise the WAP access module, and this access module is accepted the request of client terminal and application layer, and request content is resolved to the code that application layer or client can be discerned.

5, system as claimed in claim 2 is characterized in that, described a plurality of access module comprise vedio on radio binary operation environment (BREW) access module, and this access module provides access services by internal network request internal application and to outer net.

6, system as claimed in claim 2 is characterized in that, described a plurality of access module comprise the KJAVA access module, and this access module provides access services by internal network request internal application and to outer net.

7, system as claimed in claim 2, it is characterized in that described a plurality of access module comprise mobile POS access module, this access module is accepted the data of mobile POS terminal, send to application layer after the processing, and send to mobile POS terminal after the data processing that application layer is returned.

8, system as claimed in claim 2 is characterized in that, described a plurality of access module comprise the voice access module, and this access module is that data offer application layer with the speech conversion of client terminal.

9, system as claimed in claim 2 is characterized in that, described a plurality of access module comprise the WEB access module, and this access module provides WEB access services by internal network request internal application and to outer net.

10, system as claimed in claim 2, it is characterized in that, described a plurality of access module is connected with application layer by unified interface, each access module will insert and send to application layer by this unified interface after data are converted to consolidation form, and be that corresponding form sends to client terminal with the information translation that application layer is returned.

11, the system as claimed in claim 1 is characterized in that, described application layer comprises:

First interface module is connected with Access Layer;

Second interface module is connected with Communication Gateway;

12, system as claimed in claim 11 is characterized in that, described application layer also comprises:

The 3rd interface module is connected with Third-Party Service;

13, the system as claimed in claim 1 is characterized in that, described Communication Gateway comprises:

The 4th interface module is connected with application layer;

The 5th interface module is connected with the payment layer;

14, the system as claimed in claim 1 is characterized in that, described payment layer comprises:

15, system as claimed in claim 14 is characterized in that, described swap server comprises:

First communication interface module is connected with the payment layer;

Routing module control carries out route control to message forwarding;

The flowing water database writes down all Transaction Informations;

16, the system as claimed in claim 1 is characterized in that, described secure subsystem comprises certificate registration server, certificate issuance system server, certificate issuance system server and Key Management server.