TWI678666B - Transaction verification method and system - Google Patents

Abstract

The invention relates to a transaction verification method, which includes: generating transaction information of a first transaction; using a digital voucher to submit a first request to a digital voucher applicant; submitting a second request to a digital voucher provider; and a digital voucher provider A digital certificate is used to query the first key, and the first key is used to disperse the identity information of the digital certificate user to obtain the second key, and the transaction information of the first transaction is encrypted based on the second key to form The first dynamic information is issued; and the digital voucher verifies the second dynamic information received by the digital voucher user in the second transaction to instruct the second transaction to proceed or terminate; wherein, the first The second dynamic information corresponds to the first dynamic information. It provides users with a very convenient electronic payment method while avoiding leakage of user information; it also performs dynamic information verification that is difficult to crack for each transaction.

Description

Transaction verification method and system

The present invention relates to the field of electronic payment technology, and more particularly, to a transaction verification method and system.

With the development of mobile Internet technology and Internet finance, electronic payment technology has shown a diversified development trend. Emerging payment methods such as Internet payment and mobile payment are rapidly spreading. At the same time, the security of this type of payment is being increasingly affected. More attention.

In the existing online payment scenario, the legitimacy of payment transactions mainly depends on card-related information provided by cardholders. Usually, when making the first payment, the cardholder submits complete bank card information for payment on a merchant website or digital wallet website, including name, card number, expiration date, CVN2 and other card surface information, and subsequent transactions need only be based on the registered The four-digit information behind the card can initiate a transaction. This fast payment depends on the card number information of the merchant system or digital wallet system. Although the cardholder experience is relatively good, the transaction security is not good. Specifically include: 1. The merchant system needs to store a large amount of card information, which may be attacked or leaked; 2. The transaction authorization is mainly based on the card static information, and there is a possibility of forgery of transactions.

An object of the present invention is to provide a transaction verification method, which can perform dynamic information verification that is difficult to crack for each transaction, so as to help strengthen the security of the transaction.

To achieve the above objective, the present invention provides a technical solution as follows:

A transaction verification method includes the following steps: a), the card user performs information interaction with the digital voucher user to generate transaction information of the first transaction; b) the digital voucher use submits a first request to the digital voucher applicant, The first request includes the first digital voucher and the transaction information of the first transaction; c) The digital voucher applicant identifies and verifies the identity information of the digital voucher user to submit a second request to the digital voucher provider. The second request includes at least The identity information of the digital certificate user; d) The digital certificate provider identifies and verifies the identity information of the digital certificate applicant, queries the first key based on the first digital certificate, and uses the first key to decentralize the use of the digital certificate. The party ’s identity information to obtain a second key, and the digital certificate provider encrypts the transaction information of the first transaction based on the second key to form the first dynamic information, and the digital certificate provider also passes the first dynamic information via the digital The voucher requester transmits to the digital voucher consumer; and e) the digital voucher provider responds to the received digital voucher consumer. The second dynamic information sent in the second transaction is verified to instruct the second transaction to continue or terminate based on the verification result; wherein the second dynamic information corresponds to the first dynamic information.

Step e) specifically includes: e1), the digital certificate user sends the second dynamic information, the first digital certificate, and the identity information of the digital certificate user And the transaction information of the second transaction is transmitted to the acquirer; e2), the transfer agency requests the digital certificate provider to verify the second dynamic information based on the request of the acquirer; and e3), the digital certificate provider verifies the second dynamic information And instruct the acquirer to continue the second transaction or reject the second transaction based on the verification result.

Preferably, the verification of the second dynamic information by the digital certificate provider specifically includes: indexing based on the first digital certificate forwarded by the transfer mechanism to obtain a corresponding first key; and using the first key to disperse the identity of the digital certificate user Information to obtain a second key; perform a message digest algorithm on the transaction information of the second transaction based on the second key to generate third dynamic information; and compare the third dynamic information with the second dynamic information to Generate verification results.

Preferably, the method further includes a registration phase and a digital voucher generation phase. The registration phase includes: r1), the digital voucher application submits business qualification information to the digital voucher provider; r2), the digital voucher provider reviews the business qualification information, and After the verification is passed, the digital credential applicant is assigned the unique digital credential applicant's identity information; r3), the digital credential provider uses the third key to disperse the digital credential applicant's identity information to obtain the fourth key; of which, The third key is held and managed by the digital certificate provider; the digital certificate generation phase includes the following steps: s1), the card user submits the first account information to the digital certificate user; s2), the digital certificate application direction digital certificate application Party submits the first application; wherein the first application includes the first account information; s3), the digital voucher applicant identifies and verifies the identity information of the digital voucher user, and submits the first voucher to the digital voucher provider. Two applications; of which, the second application request is generated based on the first application; s4), the digital voucher provider identifies and verifies the identity information of the digital voucher applicant, and generates a first digital voucher corresponding to the first account information, and The first digital voucher is returned to the digital voucher consumer via the digital voucher applicant.

Preferably, step s4) specifically includes: the digital voucher provider determines whether the digital voucher applicant has previously submitted a second application request corresponding to the first account information; if not, the digital voucher provider generates a second application request corresponding to the first account information The first digital certificate, and the fourth key is used to scatter the first digital certificate to obtain the first key; if so, the digital certificate provider queries the corresponding first digital certificate that has been generated; and the digital certificate provider uses the first digital The voucher is returned to the digital voucher consumer via the digital voucher applicant.

Preferably, the digital certificate provider is configured to maintain and / or store only one of the keys using a plurality of different keys.

The invention also discloses a transaction verification system, which includes: a digital voucher user, interacts with a card holder to generate transaction information of a first transaction, and submits a first request to the digital voucher applicant; wherein the first request includes The first digital voucher and the transaction information of the first transaction; the digital voucher applicant identifies and verifies the identity information of the digital voucher user to submit a second request to the digital voucher provider; wherein the second request includes at least the use of the digital voucher Party ’s identity information; and digital certificate provider, which identifies and verifies the identity information of the digital certificate applicant, queries the first key based on the first digital certificate, and uses the first key to disperse the identity of the digital certificate user Information to obtain a second key, and it is also based on the second The key encrypts the transaction information of the first transaction to form the first dynamic information, and transmits the first dynamic information to the digital certificate user via the digital certificate applicant; wherein the digital certificate provider is further configured to: 2. The second dynamic information sent by the digital certificate user in the second transaction is verified to instruct the second transaction to proceed or terminate based on the verification result; wherein the second dynamic information corresponds to the first dynamic information.

The transaction verification method and system provided by the embodiments of the present invention use digital vouchers to speed up the transaction process and provide users with a very convenient electronic payment method; merchants only use digital vouchers to implement transactions, avoiding leakage of user information; , And also perform dynamic information verification that is difficult to crack for each transaction, thereby further enhancing transaction security. In dynamic information verification, the method and system also use multiple different keys, and only maintain one of them, and the leakage or theft of any one of them does not affect the security of other keys.

S10, S12, S14, S16, S18‧‧‧ steps

201‧‧‧ Digital Voucher User

203‧‧‧ Digital Certificate Applicant

205‧‧‧ Digital Voucher Provider

212‧‧‧Acquirer

214‧‧‧Transfer agency

FIG. 1 is a schematic flowchart of a transaction verification method according to a first embodiment of the present invention.

FIG. 2 shows a module diagram of a transaction verification system provided by a second embodiment of the present invention.

As shown in FIG. 1, a first embodiment of the present invention provides a transaction verification method, which includes the following steps.

Step S10: The card user performs information interaction with the digital certificate user to generate transaction information of the first transaction.

As an example, a card user may enter information in a web page provided by a digital voucher user to initiate a first transaction. The first transaction may be the first transaction between the card user and the digital certificate user, or the N-th transaction (N> 1) between the card user and the digital certificate user.

Step S12: The digital certificate is used to submit a first request to the digital certificate applicant.

The first request includes the first digital certificate and the transaction information of the first transaction. The transaction information includes, for example, transaction time, transaction place, transaction amount, and identification information of the transaction parties.

Specifically, the first digital certificate can be obtained through an independent digital certificate generation process: first, the digital certificate user sends a request to the digital certificate applicant with the card user's account information, and then the digital certificate applies for the digital certificate The provider sends a request. After the digital voucher provider passes the verification, the digital voucher applicant issues the first digital voucher to the digital voucher user. The digital certificate user may hold the first digital certificate and passively update the first digital certificate when appropriate.

Step S14: The digital voucher application submits a second request to the digital voucher provider.

The second request may be generated based on the first request, and the second request includes at least the identity information of the digital certificate user. The second request also includes the transaction information of the first transaction and the first digital voucher.

Step S16: The digital certificate provider queries the first key based on the first digital certificate to obtain a second key, and encrypts the transaction information based on the second key to form the first dynamic information.

Specifically, the digital certificate provider first identifies and verifies the identity information of the digital certificate applicant, and queries the first key based on the first digital certificate, and then uses the first key to disperse the digital certificate user's identity information to obtain the first Then, the digital certificate provider encrypts the transaction information of the first transaction based on the second key to form the first dynamic information, and then transmits the first dynamic information to the digital certificate user through the digital certificate applicant.

The first key can be stored in the digital certificate provider, or it can be generated or updated by the digital certificate provider in other ways. The first digital voucher is generated by the digital voucher provider and issued to the digital voucher user via the digital voucher applicant.

The digital voucher provider uses an algorithm to make a one-to-one correspondence between the first key and the first digital voucher, so that the corresponding relationship can be used to query the first key based on the first digital voucher. In the following, an example of how this correspondence is formed will be described.

The digital certificate provider also uses the first key to disperse the identity information of the digital certificate user parsed from the second request, and then obtains the second key. Subsequently, the digital certificate provider encrypts the transaction information of the first transaction based on the second key, generates the first dynamic information and issues it.

It can be understood that the second key is different from the first key. second The key is generated on the fly and used once, and is discarded after use. The digital certificate provider does not keep it for backup. Even if the first key is leaked or stolen, the second key is not affected.

Step S18: The digital certificate provider verifies the second dynamic information, and instructs the second transaction to proceed or terminate based on the verification result.

Specifically, the digital voucher provider verifies the received second dynamic information sent by the digital voucher consumer in the second transaction to instruct the second transaction to proceed or terminate based on the verification result. The second dynamic information corresponds to the first dynamic information.

It should be noted that the second transaction is the next transaction performed after the first transaction. Understandably, in the second transaction, the transaction information of the second transaction no longer needs to flow through the digital voucher applicant. In other words, step S18 may cover: (1). The cardholder and the digital voucher user conduct a second information interaction to generate transaction information for the second transaction, and (2). The digital voucher user directly or The transaction information of the second transaction is sent to the digital certificate provider together with the second dynamic information through other intermediaries.

As described above, the digital certificate user has obtained the first dynamic information in the foregoing step S16, and the digital certificate user holds the first dynamic information. In the second transaction, the digital voucher user can directly send the first dynamic information as the second dynamic information, or the digital voucher user processes the first dynamic information and generates a second dynamic information corresponding to the one. Delivery. That is, the second dynamic information may be completely consistent with the first dynamic information, or correspond one-to-one.

After verifying the second dynamic information, the digital The voucher provider instructs the second transaction to proceed or terminate based on the verification result. In short, if the second dynamic information cannot correspond to the first dynamic information that was issued by the digital certificate provider to the same digital certificate user in the previous transaction and contains the encrypted first transaction transaction information, the second transaction will Rejected, which can effectively prevent counterfeit transactions.

As a further improvement of the above-mentioned first embodiment, step S18 may include the following series of sub-steps: 1). The digital certificate user uses the second dynamic information, the first digital certificate, the identity information of the digital certificate user, and the second transaction. The transaction information is transmitted to the acquirer; 2). The transfer agency requests the digital voucher provider to verify the second dynamic information based on the request of the acquirer; and 3). The digital voucher verifies the second dynamic information, and based on the verification result To instruct the acquirer to continue or reject the second transaction.

In this improved embodiment, in the second transaction, the digital voucher user does not directly communicate with the digital voucher provider, but implements data and / or information interaction through the acquirer and the transfer agency.

Preferably, the verification of the second dynamic information by the digital voucher provider may be specifically implemented as follows: I. Indexing based on the first digital voucher forwarded by the transfer agency to obtain the corresponding first key; II. Using the first key to Disperse the identity information of the user of the digital certificate to obtain the second key; III. Perform a Message-Digest Algorithm on the transaction information of the second transaction based on the second key to generate the third dynamic information; and The third dynamic information is compared with the second dynamic information to generate a verification result.

Among them, the third dynamic information is generated by the digital voucher provider in real time after calculation. The second dynamic information is uploaded by the digital voucher user for verification in the second transaction. As mentioned above, the second dynamic information May be completely consistent or one-to-one correspondence with the first dynamic information; if the third dynamic information is completely consistent with the second dynamic information or has another one-to-one correspondence relationship, the third dynamic information may be regarded as a kind of the first dynamic information Restore or reproduce the version, so as to reflect the correspondence between the second dynamic information and the first dynamic information again. In this case, the second transaction is permitted to proceed; otherwise, it will be terminated.

As a further optimization of the foregoing first embodiment, the transaction verification method further includes a registration phase and a digital credential generation phase. These two phases occur before the first transaction. As a preliminary phase, the digital voucher user, applicant, and provider mutually recognize each other. More importantly, the first digital voucher can correspond to the first account number of the card user. Information.

The registration phase includes: r1), the digital voucher application submits business qualification information to the digital voucher provider; r2), the digital voucher provider reviews the business qualification information, and assigns a unique digital voucher application to the digital voucher applicant after the approval is passed R3), the digital certificate provider uses the third key to disperse the digital certificate applicant's identity information to obtain the fourth key.

Among them, the third key is held and managed by the digital certificate provider, and the fourth key is used as an intermediate product for one-time use. The digital certificate provider does not keep a copy or back it up.

The digital certificate generation phase includes the following steps: s1), card holding The user submits the first account information to the digital voucher user; s2), the digital voucher uses the digital voucher to submit the first application; the first application includes the first account information; s3), the digital voucher applicant identifies and verifies The digital voucher user ’s identity information and submits a second application to the digital voucher provider; wherein the second application request is generated based on the first application; s4), the digital voucher provider identifies and verifies the digital voucher applicant ’s identity information, A first digital certificate corresponding to the first account information is generated, and the first digital certificate is returned to the digital certificate user via the digital certificate applicant.

Preferably, the above-mentioned step s4) specifically includes: the digital voucher provider judges whether the digital voucher applicant has previously submitted a second application request corresponding to the first account information; if not, the digital voucher provider generates a corresponding first account The first digital certificate of the information and use the fourth key to scatter the first digital certificate to obtain the first key; if so, the digital certificate provider queries the corresponding first digital certificate that has been generated; and the digital certificate provider will A digital voucher is returned to the digital voucher consumer via the digital voucher applicant.

The digital certificate provider uses the fourth key to disperse the first digital certificate to obtain the first key, which makes a one-to-one correspondence between the first key and the first digital certificate. Therefore, in the foregoing step S16, The digital certificate provider may query the first key based on the first digital certificate. However, this is only an example of forming the correspondence between the first key and the first digital certificate, and it is expected that other equivalent methods are also applicable.

The above-mentioned first embodiment and improved method utilize digital certificates To speed up the transaction process, you can use it any number of times after generating a number of vouchers. Users do not need to provide card information when conducting future transactions, thereby providing users with a very convenient electronic payment method. On the other hand, the merchant (that is, the user of the digital voucher) does not save the user's card information, and only uses the digital voucher to implement the transaction, thereby avoiding the possibility of the merchant leaking the user's information; in addition, the above embodiment also provides The transaction is verified with dynamic information that is difficult to crack, thereby further enhancing the security of the transaction.

It can be understood that according to the optimized implementation of the improved embodiment described above, the digital certificate provider can use multiple different keys, such as the first, second, third, and fourth keys, and only maintain the third key key. Specifically, the first key is stored in the digital certificate provider, but is generated or updated by the digital certificate provider, for example, the first key is updated every transaction or at regular intervals; the second and fourth are used as intermediates The product is generated on the fly, without copy or backup; the third key is held and maintained by the digital certificate provider, and the system administrator can replace the third key.

As shown in FIG. 2, a second embodiment of the present invention provides a transaction verification system, which includes a digital voucher user 201, a digital voucher applicant 203, and a digital voucher provider 205.

The digital certificate user 201 interacts with the card user to generate transaction information of the first transaction, and submits a first request to the digital certificate applicant 202; wherein the first request includes the first digital certificate and the transaction information of the first transaction .

The digital certificate applicant 202 identifies and verifies the identity information of the digital certificate user 201 to submit a second request to the digital certificate provider 203 The second request includes at least the identity information of the digital certificate user.

The digital certificate provider 203 identifies and verifies the identity information of the digital certificate applicant 202, and queries the first key based on the first digital certificate, and uses the first key to disperse the identity information of the digital certificate user 201 to obtain a second The key, and it also encrypts the transaction information of the first transaction based on the second key to form the first dynamic information, and transmits the first dynamic information to the digital certificate user 201 via the digital certificate applicant 202.

The digital voucher provider 203 is further configured to verify the received second dynamic information sent by the digital voucher consumer in the second transaction to instruct the second transaction to proceed or terminate based on the verification result.

The second transaction is the next transaction that occurs after the first transaction. The second dynamic information may be completely consistent with the first dynamic information, or there may be a one-to-one correspondence between the two. The verification of the second dynamic information may be performed in a manner detailed in the first embodiment.

As a further improvement, the system may optionally include an acquirer 212 and a transfer agency 214. In this case, the digital certificate user 201 is configured to: in the second transaction, the second dynamic information, the first digital certificate, The identity information of the user of the digital certificate and the transaction information of the second transaction are transmitted to the acquirer 212. The acquirer 212 is configured to initiate a verification request to the transfer agency 214 based on an instruction from the digital voucher user. The transfer mechanism 214 is configured to request the digital voucher provider 205 to verify the second dynamic information based on the verification request of the acquirer 212. And, the acquirer 212 is further configured to verify the second dynamic information based on the digital certificate provider 205 As a result, the second transaction is continued or rejected.

The above description is only directed to the preferred embodiments of the present invention, and is not intended to limit the protection scope of the present invention. Those skilled in the art can make various modified designs without departing from the idea of the present invention and the scope of accompanying patent applications.

Claims (10)

A transaction verification method includes the following steps: a), the card user performs information interaction with the digital voucher using component to generate transaction information of the first transaction; b), the digital voucher using component submits a first A request, the first request includes a first digital voucher and transaction information of the first transaction; c) the digital voucher application component identifies and verifies the identity information of the digital voucher use component to provide the digital voucher The component submits a second request, the second request includes at least the identity information of the digital voucher using the component, the transaction information of the first transaction, and the first digital voucher; d) the digital voucher provides a component identification and Verify the identity information of the digital certificate application component, and query a first key based on the first digital certificate, and use the first key to disperse the identity information of the digital certificate use component to obtain a second gold And the digital certificate providing component encrypts the transaction information of the first transaction based on the second key to form a first State information, the digital voucher providing component also transmits the first dynamic information to the digital voucher using component via the digital voucher application component; and e), the digital voucher providing component pair receives the The digital certificate is verified using the second dynamic information sent by the component in the second transaction to instruct the second transaction to continue or terminate based on the verification result; wherein the second dynamic information corresponds to the first dynamic information. The method according to claim 1, wherein the step e) specifically includes: e1), the digital voucher using component includes the second dynamic information, the first digital voucher, and the digital voucher using component. The identity information and the transaction information of the second transaction are transmitted to the acquirer; e2), the transfer agency requests the digital certificate providing component to verify the second dynamic information based on the request of the acquirer; and e3) 2. The digital voucher providing component verifies the second dynamic information, and instructs the acquirer to continue the second transaction or reject the second transaction based on the verification result. The method according to claim 2, wherein the verification of the second dynamic information by the digital voucher providing component specifically includes: indexing based on the first digital voucher forwarded by the transfer mechanism to obtain a corresponding one of the A first key; using the first key to disperse the identity information of the digital certificate using component to obtain the second key; and performing transaction information of the second transaction based on the second key A Message-Digest Algorithm to generate third dynamic information; and comparing the third dynamic information with the second dynamic information to generate the verification result. The method according to claim 1, further comprising a registration phase and a digital voucher generation phase, the registration phase includes: r1), the digital voucher application component submits business qualification information to the digital voucher providing component; r2) 2. The digital voucher providing component reviews the business qualification information, and assigns the unique identity information of the digital voucher applying component to the digital voucher applying component after the approval is passed; r3), the digital voucher providing component uses the first Three keys to disperse the identity information of the digital certificate application component to obtain a fourth key; wherein the third key is held and managed by the digital certificate providing component; the digital certificate generation phase includes the following steps : S1), the card user submits the first account information to the digital voucher using component; s2), the digital voucher using component submits a first application to the digital voucher application component; wherein the first application includes The first account information; s3), the digital certificate application component identifies and verifies the identity information of the digital certificate use component, and The digital voucher providing component submits a second application; wherein the second application request is generated based on the first application; s4), the digital voucher providing component identifies and verifies the identity information of the digital voucher applying component, And generating the first digital voucher corresponding to the first account information, and returning the first digital voucher to the digital voucher using component via the digital voucher application component. The method according to claim 4, wherein the step s4) specifically includes: the digital voucher providing component determines whether the digital voucher application component has previously submitted the second corresponding to the first account information An application request; if not, the digital voucher providing component generates the first digital voucher corresponding to the first account information, and uses the fourth key to scatter the first digital voucher to obtain the first A key; if so, the digital voucher providing component queries the corresponding first digital voucher that has been generated; and the digital voucher providing component returns the first digital voucher to the via the digital voucher application component Digital vouchers use widgets. The method of claim 5, wherein the digital credential providing component is configured to use a plurality of different keys while maintaining only one of the keys. The method according to claim 6, wherein the plurality of keys include at least the first key, the second key, the third key, and the fourth key, and one of the keys is the Third key. A transaction verification system includes: a digital voucher using component, which interacts with a card user to generate transaction information of a first transaction, and submits a first request to the digital voucher application component; wherein the first request includes a first digital The voucher and the transaction information of the first transaction; the digital voucher application component that identifies and verifies the identity information of the digital voucher using component to submit a second request to the digital voucher providing component; wherein the second request Including at least the identity information of the digital voucher using component, the transaction information of the first transaction, and the first digital voucher; and the digital voucher providing component that identifies and verifies the identity information of the digital voucher application component, Querying a first key based on the first digital certificate, and using the first key to disperse the identity information of the digital certificate using component to obtain a second key, and further based on the second digital certificate The key encrypts the transaction information of the first transaction to form first dynamic information, and passes the first dynamic information through the The digital voucher application component is transmitted to the digital voucher using component; wherein the digital voucher providing component is further configured to verify the second dynamic information received and sent by the digital voucher using component in a second transaction, The second transaction is instructed to continue or terminate based on the verification result; wherein the second dynamic information corresponds to the first dynamic information. The system according to claim 8, further comprising an acquirer and a transfer agency, wherein the digital voucher using component is configured to: in the second transaction, the second dynamic information, the The first digital voucher, the identity information of the digital voucher using component, and the transaction information of the second transaction are transmitted to the acquirer; the acquirer is configured to: based on the instruction of the digital voucher using the component, Initiating a verification request to the transfer agency; the transfer mechanism is configured to: based on the verification request of the acquirer, request the digital voucher providing component to verify the second dynamic information; and the acquirer further It is configured to continue the second transaction or reject the second transaction based on the verification result of the second dynamic information by the digital voucher providing component. The system according to claim 9, wherein the digital voucher providing component is configured to perform the following to verify the second dynamic information: index based on the first digital voucher provided by the switching mechanism to obtain a corresponding Using the first key; using the first key to disperse the identity information of the digital certificate using component to obtain the second key; and performing the message on the transaction information based on the second key A digest algorithm to generate third dynamic information; and comparing the third dynamic information with the second dynamic information to generate the verification result.