WO2012072022A1

WO2012072022A1 - Remote payment method

Info

Publication number: WO2012072022A1
Application number: PCT/CN2011/083122
Authority: WO
Inventors: 刘凤军; 李金良; 赵振祥; 肖波; 张春玲; 嵇文俊; 郝义泉; 王玉玺; 郭宇航
Original assignee: 中国银联股份有限公司
Priority date: 2010-11-30
Filing date: 2011-11-29
Publication date: 2012-06-07
Also published as: CN102480725A

Abstract

A remote payment method is provided. The method includes the following steps: A mobile terminal downloads at least one encrypted file, which is the encrypted file of ATM card track information and the encrypted first mobile phone number (A1) associated with the ATM card account; the encrypted file and information to be processed are sent to the mobile payment platform (A2); the mobile payment platform processes the information to be processed and returns transaction completion information (A3). The remote payment method can reduce the cost of users for opening and using the service, thereby being advantageous to the promotion and popularization of the remote payment, and the security of the remote payment is ensured at the same time.

Description

Remote payment method

Technical field

The present invention relates to the field of data processing, and more particularly to data processing methods in remote payment. Background technique

With the rapid development of China's economy, the business in the financial sector has also grown rapidly. While business transactions are frequent, there is a large amount of data that needs to be handled safely and quickly. Therefore, the use of mobile communication technology to process financial data, improve the efficiency of the financial system, and enhance security is urgently needed.

The mobile payment method can not only avoid the problem that the traditional cash settlement needs to carry a large amount of money at any time, but also does not need to preset the corresponding equipment like the sales terminal POS and the automatic rejection machine ATM, and does not need to be relatively large like online payment. And complex computer network equipment, in general mobile payment can bring considerable convenience.

However, the key and difficult point of implementing remote payment for financial cards through mobile phones is how to securely store and transmit sensitive information (including financial card account information and payment information) during the transaction authorization process. Chinese Patent Application Publication No. CN10109837A discloses a financial data processing method for storing sensitive information for payment (such as financial card track information, etc.) in a smart card that is relatively independent from the mobile terminal to implement storage of sensitive information. . This requires that the mobile phone must have a smart card interface, which is less adaptable, and increases the cost of the user to open and use the service, which limits the promotion and popularization of the mobile phone remote payment. Summary of the invention

The technical problem to be solved by the present invention is to provide a remote payment method, which can avoid the smart card interface, reduce the access cost of mobile payment, and maintain the gold in mobile payment. Integrate the security and efficiency of data processing; Expand the application of mobile payment data processing.

The invention provides a remote payment method, comprising:

Al. The mobile terminal downloads at least one encrypted file, where the encrypted file is a financial card track information associated with the financial card account and an encrypted file of the first mobile phone number;

A2, sending the encrypted file and the pending information to the mobile payment platform;

A3. The mobile payment platform processes the to-be-processed information and returns transaction completion information. Preferably, in the above method of the present invention, step A1 further comprises: the mobile terminal transmitting the remote payment activation request, the first mobile phone number and the financial card information to the mobile payment platform by the authorization device, wherein the financial card information comprises a financial card account And financial card payment password;

The mobile payment platform forwards the financial card information to the financial card authentication device; the financial card authentication device authenticates the financial card information and sends the authentication pass information and the financial card track information to the mobile payment platform;

The mobile payment platform establishes and stores a binding relationship between the financial card account number and the first mobile phone number, and generates an encrypted file of the financial card track information and the first mobile phone number;

The mobile payment platform transmits the encrypted file to the mobile terminal.

Preferably, in the above method of the present invention, the mobile payment platform transmits the encrypted file to the mobile terminal in the form of a link; the mobile terminal downloads and saves the encrypted file through the link.

Preferably, in the above method of the present invention, at least one symmetric key algorithm is employed to generate an encrypted file.

Preferably, in the above method of the present invention, step A2 further comprises:

Bl. The mobile terminal sends the encrypted file, the second mobile phone number and the order information to the mobile payment platform.

C1. The merchant system sends the order information to the mobile payment platform and the mobile terminal.

C2: After receiving the order information, the mobile terminal sends the encrypted file and the second mobile phone number to the mobile payment platform. Preferably, in the above method of the present invention, step B1 further includes: the mobile terminal accessing the merchant system and transmitting the shopping request to the merchant system;

The merchant system generates and sends the order information to the mobile terminal;

After receiving the order information, the mobile terminal sends the encrypted file, the second mobile number and the order information to the mobile payment platform.

Optionally, in the above method of the present invention, step C1 further comprises: the mobile terminal accessing the merchant system and transmitting the shopping request to the merchant system;

The merchant system generates and sends order information to the mobile terminal and mobile payment platform. Preferably, in the above method of the present invention, step A3 further comprises:

Dl, the mobile payment platform sends the order payment request information to the mobile terminal;

D2. The mobile terminal generates and sends an order payment determination information to the mobile payment platform; D3. The mobile payment platform sends the financial card track information and the order payment confirmation message to the transaction transfer platform;

D4. The transaction transfer platform transaction is processed successfully and the transaction completion information is returned.

Preferably, in the above method of the present invention, the step D1 further comprises: the mobile payment platform decrypting the encrypted file to obtain the first mobile phone number, comparing the first mobile phone number and the second mobile phone number;

If the two are inconsistent, the mobile payment platform sends a failure message to the mobile terminal; if the two are consistent, the mobile payment platform generates and sends an order payment request message to the mobile terminal according to the order information.

If the two are inconsistent, the mobile payment platform sends a failure message to the mobile terminal; if the two are consistent, the mobile payment platform obtains the order information from the merchant system; the mobile payment platform generates and sends the order payment request information to the mobile terminal according to the order information.

Preferably, in the above method of the present invention, the order branch is sent in the form of a page For payment information, the order payment request information includes an order information, a financial card account, an order payment password, and a password input box.

Preferably, in the above method of the present invention, the mobile terminal inputs the order payment password in the password input box to generate order payment confirmation information.

Preferably, in the above method of the present invention, the mobile payment platform transmits the order payment request information in the form of a URL link.

Preferably, in the above method of the present invention, step D4 further comprises: the transaction transfer platform returns transaction completion information to the mobile payment platform; and the mobile payment platform forwards the transaction completion information to the mobile terminal and the merchant system. Preferably, in the above method of the present invention, the mobile payment platform sends the financial card track information and the order payment confirmation message to the transaction transfer platform in the form of consumption text.

The technical effect of the present invention is that since the smart card is not required, the smart card interface is not required to be added to the mobile terminal, so that the cost of opening and using the service is reduced, which is beneficial to the promotion and popularization of the remote payment. At the same time, the security of remote payment is guaranteed. DRAWINGS

1 is a flow chart of steps of a remote payment method according to the present invention;

Figure 2 is a flow chart showing the schematic steps of step A1 in Figure 1;

Figure 3 is a schematic flow chart of the first embodiment of the step A2 of Figure 1; Figure 4 is a schematic flow chart of the second embodiment of the step A2 of Figure 1; Figure 5 is the step of Figure 1. Flow chart of the schematic steps of A3;

Figure 6 is a flow chart showing the schematic steps of the first embodiment of the step D1 of Figure 5; Figure 7 is a flow chart showing the schematic steps of the second embodiment of the step D1 of Figure 5. detailed description

The preferred embodiments of the present invention are described in detail with reference to the accompanying drawings

1 is a flow chart showing the steps of a remote payment method according to the present invention. As shown in Figure 1, The remote payment method of the present invention comprises the following steps:

A3. The mobile payment platform processes the to-be-processed information and returns transaction completion information. Figure 2 is a flow chart showing the schematic steps of step A1 in Figure 1. As shown in FIG. 2, step A1 in FIG. 1 further includes:

The mobile terminal sends the remote payment activation request, the first mobile phone number and the financial card information to the mobile payment platform through the authorization device, wherein the financial card information includes a financial card account and a financial card payment password;

The mobile payment platform forwards the financial card information to the financial card authentication device;

The financial card authentication device authenticates the financial card information and transmits the authentication pass information and the financial card track information to the mobile payment platform;

The authorized device may be, but not limited to, a customized POS, an online banking, a rejection, and a self-service device.

Preferably, the bound mobile phone number is sent to the user in the form of a link short message. The HTTPS link received by the user downloads the encrypted file with the bank card track information and the mobile phone number information (referred to as "encrypted file") to the mobile phone and saves it. When the mobile terminal is a PC,

Preferably, at least one symmetric key algorithm is employed to generate the encrypted file.

The encrypted key uses a symmetric key to ensure that the encrypted file cannot be created and the encrypted file cannot be decrypted without knowing the key. If an asymmetric key is used, the public key is made available to everyone, and will enable those who know the scheme to make cards and mobile numbers that are not bound. Since the mobile terminal does not need to encrypt and decrypt this file, it is possible to use 3DES or AES with higher encryption strength, or higher strength. In view of the fear that the files stored in the mobile phone or PC are lost or copied by the attacker in large quantities, the content in the encrypted file is obtained by extruding the method to create a fake card, and the key algorithm has a back door problem, Two or more symmetric key algorithms are implemented

Encryption of "track + mobile number". For example, you can use the AES algorithm selected by the US government to encrypt and then use the Chinese government.

The SMS4 algorithm selected in WAPI is encrypted. This way, even if you can crack one of them, or know a back door, you should not crack the two, or know the two back doors. For several years later, if the above symmetric key algorithm is found to be vulnerable, it can be adjusted and replaced in time. Tracking the new trends in cryptography, there should be a symmetric key algorithm that can be used to ensure that encryption is difficult to obtain.

The "track + phone number" in the encrypted file is not money in itself. There are many ways to obtain it, and the cost of obtaining the track and the mobile phone number by using computing technology is significantly higher than using other methods.

In view of the fear of key leakage, a method of implementing a key corresponding to a key for the encryption key can be stored in the background of the mobile payment system. The background needs to ensure that the keys are randomly generated, at least to ensure that they are not repeated within 10 billion. And for the chosen encryption algorithm is the key that meets the security requirements. If you use two symmetric encryption algorithms, each bank card uses two keys.

In addition, since the encrypted file can only be decrypted on the server side (ie, the mobile payment platform), the track information will not be leaked even if it is stolen. In step A1, the transaction URL message is sent to the mobile phone number solved from the encrypted file, and even if the encrypted file is forged, the payment URL message is not received.

3 is a schematic flow chart of the first embodiment of step A2 of FIG. 1, wherein step A2 may be performed by the mobile terminal to send the encrypted file, the second mobile number and the order information to the mobile payment platform.

As shown, the mobile terminal accesses the merchant system and sends a shopping request to the merchant system; the merchant system generates and sends the order information to the mobile terminal;

After receiving the order information, the mobile terminal sends the encrypted file, the second mobile phone number, and the subscription Single message to the mobile payment platform.

Figure 4 is a flow chart showing the schematic steps of the second embodiment of step A2 of Figure 1. In step A2, the order information can be sent by the merchant system to the mobile payment platform and the mobile terminal. After receiving the order information, the mobile terminal sends the encrypted file and the second mobile phone number to the mobile payment platform.

As shown in the figure, the mobile terminal accesses the merchant system and sends a shopping request to the merchant system; the merchant system generates and sends the order information to the mobile terminal and the mobile payment platform; after receiving the order information, the mobile terminal sends the encrypted file and the second mobile phone number to Mobile payment platform.

Preferably, the order may include a merchant number, a terminal number, and an order number.

Preferably, the mobile terminal is a mobile phone or a PC, or a digital device that can access the Internet. Figure 5 is a flow chart showing the schematic steps of step A3 in Figure 1. As shown, the steps

A3 further includes:

D2. The mobile terminal generates and sends an order payment determination information to the mobile payment platform;

D3. The mobile payment platform sends the financial card track information and the order payment confirmation message to the transaction transfer platform;

D4> The transaction transfer platform transaction is processed successfully and the transaction completion information is returned.

Figure 6 is a flow chart showing the schematic steps of the first embodiment of step D1 in Figure 5. As shown in the figure, step D1 further includes:

The mobile payment platform decrypts the encrypted file to obtain a first mobile phone number, and compares the first mobile phone number with the second mobile phone number;

If the two are inconsistent, the mobile payment platform sends the failure information to the mobile terminal; if the two are consistent, the mobile payment platform generates and sends the order payment request information to the mobile terminal according to the order information.

Figure 7 is a flow chart showing the schematic steps of the second embodiment of step D1 in Figure 5. As shown in the figure, step D1 further includes:

The mobile payment platform decrypts the encrypted file to obtain the first mobile phone number, and compares the first mobile phone number. Code and second mobile number;

Preferably, in the method of the present invention, the order payment information is transmitted in the form of a page, and the order payment request information includes an order information, a financial card account, a payment password, and a password input box.

Preferably, in the method of the present invention, the order payment confirmation information includes a merchant name, a merchant number, a card number, a product information, a payment amount, an order number, an order generation time, a dynamic password picture, and a password input box. The cardholder is clearly indicated, and after entering the password and submitting it, it is considered as an endorsement and confirmation of the transaction.

Preferably, in the method of the present invention, the mobile terminal inputs the order payment password in the password input box to generate order payment confirmation information.

Preferably, in the method of the present invention, the order payment request information is sent in the form of a URL link.

Preferably, in the method of the present invention, the transaction transfer platform returns transaction completion information to the mobile payment platform; the mobile payment platform forwards the transaction completion information to the mobile terminal and the merchant system.

Preferably, in the method of the present invention, the mobile payment platform sends the financial card track information and the order information to the transaction transfer platform in the form of a consumption message.

In step D2, the user confirms the order information and enters the order payment password to confirm the payment, and can discriminate whether the transaction is forged.

In addition, in the case where only the encrypted track and the mobile phone number file are obtained, the attacker cannot perform the attack because the encrypted file is ciphertext, and there is no plain text phone number and magnetic n. Under normal circumstances, the user's own mobile phone number will not be stored on his mobile phone, thus ensuring that the Trojan horse program cannot obtain the user's clear text mobile phone number. Once the user's encrypted file and the plain text of the mobile phone number are obtained, it is possible to falsify the purchase transaction and create a transaction initiated by the user. The illusion is that spam messages, users who know the transaction situation know that they are not trading, will not pay for the transaction; they may not pay for the transaction.

Assume that the encryption "track + mobile phone number" and the bank card password are all lost. In the case that the mobile phone is not lost, the spam message will be received at most, and the user can go to the card issuing bank to cancel the mobile payment service, or replace the 4 bank card, instead of Causing financial losses.

Encrypted files can be placed in the normal memory of the phone, using BASE64 encoding as a plain text file. It is specified by the user when it is used, and can be uploaded as a file. For phones that do not support mobile phone upload files, you can also copy the content into a text box for upward transfer.

The encrypted file can also be placed in the storage of the mobile phone certificate. A certificate file is issued by the CFCA, and the encrypted content is placed in the certificate extension field of the X509V3 in BASE64 format. This extended field can be defined as a string of approximately 350 bytes and has been contacted by a CFCA technician. For the specific length, please refer to the attached description of the encrypted content.

Each time a client certificate is uploaded on SSL/TLS at the time of the transaction, it is transferred to CUPMobile. In this way, the container of the certificate on the mobile phone can be utilized to realize the mapping and management of the corresponding bank card. And can guarantee the popularity of the CFCA server certificate to the client. At this time, the CFCA certificate issued by the mobile terminal is only used as evidence and carrier for binding bank card information, and is not used for user identity verification. At this point, the phone is required to support the client certificate.

This method can be preferred, and the first method is a user-selectable option for users whose mobile phones do not support client certificates. The two methods are equivalent in terms of security, and the use of certificates means that the user experience will be better.

In addition, there are many mobile phone brands at present, and the functions, operation speed, and memory capacity of the operating system and the browser of the mobile phone itself, which can display the size and color of the image, are greatly different, which is obviously different from the personal computer system, and can be produced on a large scale. The possibility of a Trojan is much lower than that of a personal computer. However, mobile phones that support Internet access can support SMS, and most of them can support standard transmission encryption (https), image display, and digital text input.

Other embodiments, combinations, and modifications of the invention will be apparent to those skilled in the < Therefore, when reading in conjunction with the above description and the drawings, The invention is only limited by the claims.

Claims

Claim

A remote payment method, comprising:

A3. The mobile payment platform processes the to-be-processed information and returns transaction completion information.

2. The remote payment method according to claim 1, wherein the step A1 further comprises:

The remote payment method according to claim 2, wherein the mobile payment platform transmits the encrypted file to the mobile terminal in a link form; the mobile terminal downloads and saves the encrypted file through the link.

4. The method of claim 2, wherein the encrypted file is generated using at least one symmetric key algorithm.

The remote payment method according to claim 1, wherein the step A2 further comprises:

6. The remote payment method according to claim 1, wherein step A2 is advanced. One step includes:

Cl, the merchant system sends the order information to the mobile payment platform and the mobile terminal;

C2: After receiving the order information, the mobile terminal sends the encrypted file and the second mobile phone number to the mobile payment platform.

The remote payment method according to claim 5, wherein the step B1 further comprises:

The mobile terminal accesses the merchant system and sends a shopping request to the merchant system;

The remote payment method according to claim 6, wherein the step C1 further comprises:

The merchant system generates and sends order information to the mobile terminal and mobile payment platform.

9. The remote payment method according to claim 1, wherein the step A3 further comprises:

The remote payment method according to claim 9, wherein the step D1 further comprises:

The remote payment method according to any one of claims 9-11, wherein the order payment information is sent in the form of a page, the order payment request information including order information, a financial card account, and an order payment. Password and password input boxes.

The remote payment method according to claim 12, wherein the mobile terminal inputs the order payment password in the password input box to generate order payment confirmation information.

The remote payment method according to claim 9, wherein the mobile payment platform transmits the order payment request information in the form of a URL link.

The remote payment method according to claim 9, wherein the step D4 further comprises:

The transaction transfer platform returns transaction completion information to the mobile payment platform;

The mobile payment platform forwards the transaction completion information to the mobile terminal and the merchant system.

The remote payment method according to claim 9, wherein the mobile payment platform transmits the financial card track information and the order payment confirmation message to the transaction transfer platform in the form of a consumption message.