WO2015154536A1

WO2015154536A1 - Payment method and system having multiple security composition mechanisms based on visible code

Info

Publication number: WO2015154536A1
Application number: PCT/CN2014/095525
Authority: WO
Inventors: 闻进
Original assignee: 闻进
Priority date: 2014-04-11
Filing date: 2014-12-30
Publication date: 2015-10-15
Also published as: CN103886449A

Abstract

The present invention relates to a payment method and system having multiple security combination mechanisms based on a visible code (such as a two-dimensional code, a bar code and a literal code or a mixed combination). The present invention is characterized in that on the basis of the existing transaction payment system (such as the Internet channel, a mobile intelligent client, an ATM, a POS, a counter, etc.), payment card information for authorization and authentication during transaction payment is generated by a cardholder in a self-service manner in a system of a card issuing bank/a card issuing mechanism, the payment card information comprising but not limited to the following contents: a payment card number, personalized welcomes, an acquiring bank identification code, a merchant name, a merchant number, a card acceptor terminal identification code, an actual expiry date, a single-use card/a repeated-use card, a service code/service constraint, a card verification number (CVN), a personal identification number, a dynamic verification code receiving number, the number of times of retyping allowed, a transaction currency code, a credit amount, cardholder identity authentication information (a cardholder identification number, fingerprint, digital certificate, seal impression and the like), etc.; and the payment card information is taken as a basis of multiple security composition authorization mechanisms, thereby realizing the method and system for applying the payment card number to the transaction payment in the manner of a visible code (such as a two-dimensional code, a bar code and a literal code or a mixed combination).

Description

Payment method and system based on visible code multiple security combination mechanism

Technical field

The invention relates to an enhancement based on an existing payment system (Internet channel, mobile intelligent client, ATM, POS, counter, etc.), based on visible codes (two-dimensional code, barcode and text code or mixed combination) Payment method and system for secure combination mechanism.

Background technique

Traditionally, due to the limitations of communication technology, the focus of secure payment is on the binding of software and hardware encryption and payment devices to payment certificates (magnetic cards, IC cards, sound waves, NFC, SIM cards, etc.) held by the payer. However, these payment vouchers ultimately need to be read by the payment terminal device to complete the payment process. In theory, there is inevitably the possibility of being read and copied, and the difference is only in the cost of reading the copy. At the same time, such payment vouchers (magnetic cards, IC cards, sound waves, NFC, SIM cards, etc.) relying on software and hardware encryption may not be too short in the effective period of use of such payment vouchers due to cost (production, distribution, replacement, etc.). The holding amount of each person's payment voucher cannot be very large, and the result is that the amount of funds involved in a single payment voucher account is large, and the amount of loss is large once the payment voucher is copied and stolen. At the same time, the design of the POS payment system is also based on the communication considerations. It adopts the mode of setting the conditions for one-time package uploading and seeking the authorization of the host. The payer cannot visually judge whether the payment terminal is legally authenticated before inputting the security information. Therefore, it is possible for the illegal payment terminal to copy and steal the payment information of the payer, and it is also impossible to use a high security mechanism such as a dynamic verification code.

Visible codes (two-dimensional codes, bar codes, and text codes or mixed combinations) are inexpensive and easy to distribute, providing a one-time or limited number of means of payment. However, the visible code, like other payment vouchers, cannot eliminate the readable copyability, and it is necessary to ensure the security of payment through multiple security combination mechanisms.

Summary of the invention

The object of the present invention is to solve the above problems, and to provide a payment method and system based on a multiple security combination mechanism of visible codes.

The technical solution of the present invention includes the following steps:

(1) The cardholder uses the self-service equipment such as online banking and mobile banking to generate the payment card information for the transaction in the issuing bank or the card issuing institution system. The payment card information includes but not limited to the following contents: payment card number, personality Welcome message, acquiring line identification code, merchant name, merchant number, card machine terminal identification code, actual validity period, single-time card/multi-digit card, service code/service constraint, card verification code (CVN), personal identification Code, dynamic verification code receiving number, number of allowed retransmissions, transaction currency code, amount of amount, cardholder identity authentication information (cardholder ID number, fingerprint, digital certificate, seal, etc.), etc., with the combination of the above information The authorization element of the payment card realizes multiple security combination mechanisms for payment of payment card transactions.

(a) The payment card number, the generated payment card number conforms to the relevant standard specifications, and has no explicit relationship with the main account, so as to prevent the thief from calculating the main account information by using the payment card number. The primary account card number is a special case of the payment card number.

(b) Personalized welcome language for identifying the legality of the payment terminal and preventing the phishing website and the illegal transaction terminal from stealing the cardholder account information.

(c) Zero or all combinations of the acquirer identification code, merchant name, merchant number, card machine terminal identification code, service code/service constraint, etc., used to limit the scope of the payment card, improve the payment security of the payment card, and avoid fishing. Website fraud.

(d) The actual validity period is subject to the validity period of the main account, and the time is accurate to the minute (YYMMDDhhmm), and the security of the payment card is improved by the short validity period.

(e) Card verification code (CVN), personal identification code (independent), dynamic verification code receiving number, cardholder identity authentication information, etc., zero or all combinations, to improve the security of payment, cardholder identity authentication information (holding The card holder ID number, fingerprint, digital certificate, seal, etc.) can be the primary account owner or other person authorized by the primary account (mainly used for company cards, official cards, etc.).

(f) the amount of the amount, the special lock amount (the amount of the payment card is locked from the main account for this payment card, not shared with other payment cards, the main account, until the payment card is invalidated or revoked); The amount of the payment card and other payment cards, The main account is shared, which improves the efficiency of capital utilization.

(2) The payment card information is stored in the authorization authentication system for the authorization authentication of the payment card transaction payment.

(3) The generated payment card number is sent and saved (copy, download, MMS, SMS, etc.) to the storage medium by visible code (two-dimensional code, barcode and text code or mixed combination) for transaction payment (payer) The device can be offline.)

(4) The offline use mode of the payer device (presenting the payment card number), on the one hand, reduces the roaming charges brought by the online use mode of the payer device, and on the other hand avoids the use of the payer device to use the payee transaction place. The security risks associated with the unknown security WIFI provided.

(5) The transaction payment terminal of the payee reads (acquires) the payment card number, and the online authorization authentication system completes the authorization process of payment with multiple security combination mechanisms.

(6) Because of the multiple security combination features of the payment card's reserved authorization authentication information, different requirements for convenience and security in different payment environments can be considered, for example:

(a) Small payment such as bus, subway, expressway toll, and recharge of call charges, convenience is a priority, through the receipt line identification code, merchant name, merchant number, and actual validity period (short validity period) in the payment card information The amount of the amount (small amount) is limited to limit the scope of use and available amount, avoid secondary verification (return to personalized greetings, etc.), and pay directly to meet the requirements of security and convenience.

(b) Ordinary consumption, by adding reserved personalized greetings, card verification code (CVN), personal identification code, dynamic verification code and other information verification to meet the security requirements.

(c) When transferring large transactions such as transfers and remittances, the requirements for high security are met by increasing the cardholder identity authentication information (cardholder ID number, fingerprint, U shield, seal, etc.).

(d) For the application of the official card, set the relevant reservation information, such as: the receipt line identification code, the merchant name, the merchant number, the actual validity period, the amount of the amount, the cardholder identity authentication information (cardholder ID card) Number), etc., to avoid one card (waste of resources) in the use of the current official card, public and private use (business card can also be used for public and private consumption), the collection of information on the use of official card is not concentrated, difficult to supervise and involve individuals in advance Privacy and other drawbacks, but the use of visible code payment card as a business card, special card dedicated (business card is only used for official expenses), strengthen the pre-existence (pre-approval budget before the public expenditure), in the event (public expenditures timely feedback to the account system, Because it is necessary to verify the identity information of the official card users, avoid being fraudulently used, and at the same time facilitate financial and timely separate statistics) supervision, fixed-point procurement, improve the utilization of funds, and simplify the centralized management of funds.

The technical solution of the present invention is established on the basis of an existing payment system (Internet channel, mobile intelligent terminal, ATM, POS, counter, etc.) that has obtained security authentication, and is strengthened by a multiple security combination mechanism, and the payment method thereof The system is easy to pass the safety certification of the relevant department/institution. The invention has the characteristics of unified authorization authentication methods of various transaction payment systems (Internet channels, mobile intelligent terminals, ATMs, POSs, counters, etc.), and effectively reduces operation and maintenance costs. And in the whole process, the third party (except the cardholder and the issuing bank/issuing institution) can only access and obtain the payment card information, only the payment card number, so as to protect the cardholder's account information security to the utmost extent.

DRAWINGS

Figure 1 is a simplified flow diagram of the present invention.

2 is a schematic diagram of a related field of payment card information of the present invention.

3 is a simplified flow diagram of an embodiment of the present invention in a POS application.

detailed description

The invention will now be further described with reference to the drawings and embodiments.

The cardholder uses the terminal account (200) device (online banking, mobile banking, mobile smart client, etc.) to log in to the issuing bank/issuing institution system (100) of the primary account, and self-generates payment card information for transaction payment ( Including but not limited to the following: payment card number, personalized welcome message, acquiring line identification code, merchant name, merchant number, card machine terminal identification code, actual validity period, single-time card/multi-digit card, service code/service Constraint, card verification code (CVN), personal identification code, dynamic verification code receiving number, number of allowed retransmissions, transaction currency code, amount of amount, cardholder identity authentication information (cardholder ID number, fingerprint, digital certificate, seal Etc) and will The payment card information is saved to the authorized authentication system for authorization processing when the transaction is paid. At the same time, the payment card number is sent and saved (copy, download, MMS, SMS, etc.) to the card holder's storage medium (200) by visible code (QR code, barcode and text code or mixed combination), for Transaction payment (offline mode of the payer device). The storage medium (200) may be a computer, a mobile phone, a mobile intelligent terminal, and a printable material, and may be stored in an encrypted manner, and then decrypted and converted into a visible code (a two-dimensional code, a bar code, a text code or a combination) when used, and enhanced. safety. The cardholder displays the storage medium (200) of the visible code (two-dimensional code, bar code, and text code or mixed combination) of the payment card number, which is presented to the transaction payment terminal (300), and is increased by the transaction payment terminal (300). The payment card can be displayed with a personalized welcome message, which is convenient for the cardholder to judge the legality of the transaction payment terminal (300) and improve the security payment level. The issuing process of the transaction payment authorization request submitted by the issuing bank/issuing institution authorization authentication system (100) to the transaction payment terminal (100) may be performed in two ways: (a) indirect mode, the transaction payment terminal (300) is connected to the online acquiring bank/ The acquiring institution (400) completes the legality identification of the transaction payment terminal (300), and then completes the transaction payment authorization authentication process between the acquiring bank/acquisition institution (400) and the issuing bank/issuing institution (100), and authorizes the authentication. The result is fed back to the transaction payment terminal (300). (b) In a direct manner, after the transaction payment terminal (300) completes the transaction payment terminal (300) legality identification by the online payment acquiring terminal (300), the transaction payment terminal (300) is initiated by the acquiring bank/acquisition institution (400). ) and a direct secure connection or session between the issuing bank/card issuer (100) to implement a direct transaction payment authorization process between the transaction payment terminal (300) and the issuer/issuer (100), and authorize the transaction payment The certification result is fed back to the acquirer/acquisition agency (400).

The simplified flow of the terminal processing operation of the transaction payment terminal (300) for the POS terminal is as follows.

The POS terminal operator operates as follows, step 301: prompt transaction function selection: the function key and the number key are simultaneously available.

Step 302: For the transaction that needs to verify the operator or administrator password, prompt for input and verify.

Step 303: According to the transaction requirement, prompt to read the card or input the card number: if the card is not read, press the designated function key to enter the manual input card number prompt.

Step 304: According to the transaction requirement, select prompt to input relevant data: including: transaction amount, pre-authorization amount, return amount, original authorization code, original POS serial number, original retrieval reference number, and the like.

Step 305: Judging: the traditional POS transaction processing flow? The traditional POS transaction processing process adopts a mode in which the condition is set to upload and upload the authorization for the host once, and the paying party cannot visually judge whether the payment terminal is legally authenticated before inputting the security information. This step is to be compatible with the existing POS transaction processing flow, and the present invention can enable the cardholder to authenticate the transaction payment terminal by adding a step of obtaining a feedback cardholder to reserve a personalized welcome message in the existing POS transaction processing flow. Legitimacy.

As determined in step 305: the traditional POS transaction processing flow? If yes, go to step 307.

Step 307: According to the transaction request, the cardholder is prompted to input a password: if the confirmation key is directly pressed, it is regarded as no password.

Step 311: Prompt processing: display processing and communication status, such as dialing, sending, receiving, automatic flushing, sending, and sending.

Step 312: Display the transaction result and print the purchase order according to the transaction and response code.

As determined in step 305: the traditional POS transaction processing flow? If the result is no, the process proceeds to step 306.

Step 306: Online, send a message, wait for a response message, and obtain cardholder reservation information (personalized welcome message) from the authorization system.

Step 308: Judging: Is the reservation information (personalized welcome message) and the cardholder reservation information consistent? This is a security enhancement measure for the existing POS transaction processing flow of the present invention.

If the result is determined in step 308: Is the reservation information (personalized welcome message) and the cardholder reservation information consistent? If the result is inconsistent, the process proceeds to step 309.

Step 309: Displaying the reservation information (personalized welcome message) and the cardholder reservation information are inconsistent, which may be an illegal authorization transaction terminal, and the cardholder terminates the candidate payment operation.

If the result is determined in step 308: Is the reservation information (personalized welcome message) and the cardholder reservation information consistent? If the result is consistent, then step 310 is entered.

Step 310: In accordance with the transaction reservation verification requirement, the cardholder is prompted to input relevant reserved security verification information: such as a password, a dynamic verification code, and an identity information.

Claims

A payment method and system for multiple security combination mechanisms based on visible codes, including:

(1) Cardholders self-generate and manage payment card information for transaction payment in the issuing bank/card issuer system through self-service devices such as online banking and mobile banking, and store them in the authorization authentication system for use as transaction payment authorization certification. The security basis for the license.

(2) The payment card number in the payment card information is sent and saved (copy, download, MMS, SMS, etc.) to the cardholder's storage medium by visible code (two-dimensional code, barcode and text code or mixed combination). As a voucher for transaction payments.

(3) After the transaction payment terminal reads the visible code certificate of the payment card presented by the cardholder, the online acquiring bank/acquisition institution system directly or indirectly issues the transaction payment authorization certificate to the issuing and issuing authority's authorization authentication system. Request and get feedback.

(4) After obtaining the transaction payment authorization request, the issuing authority/issuing authority authorization authentication system uses the reserved payment card information as a security basis, executes the corresponding transaction payment authorization procedure, and feeds back the authorization result to the transaction payment terminal.
The system according to claim 1, wherein the payment card information in the step (1) includes but not limited to the following: a payment card number, a personalized welcome message, an acquirer identification code, a merchant name, a merchant number, and a Card machine terminal identification code, actual validity period (accurate to minute), single-time card/multi-digit card, service code/service constraint, card verification code (CVN), personal identification code, dynamic verification code receiving number, allow for re-transmission The number of times, the transaction currency code, the amount of the amount, the cardholder identity authentication information (cardholder ID number, fingerprint, digital certificate, seal, etc.), etc., using the combination of the above information as the security element of the authorization authentication of the payment card, to realize the payment Multiple security combination mechanisms for card transaction payments.
The system according to claim 1, wherein the visible code (two-dimensional code, bar code, and text code or mixed combination) in the step (2) as a form of payment card number expression is characterized by low cost and convenient distribution, and at the same time The two-dimensional code and barcode have convenient reading characteristics, and the text code has the best compatibility adaptability, and is compatible with various transaction payment systems for transaction payment (offline mode of the payer device).
The system of claim 1 wherein the storage medium in step (2) is a computer, a cell phone, a mobile smart terminal, and a printable material (such as a card, check, money order, traveler's check, etc.).
The system according to claim 1, wherein in step (3), after the transaction payment terminal (Internet channel, mobile intelligent terminal, ATM, POS, counter, etc.) obtains the payment card number, the authorization authentication request is issued online, and is obtained and displayed. Feedback information, the information of the payment card information reserved by the cardholder in the feedback information: personalized greetings, so that the cardholder can authenticate the legality of the transaction payment terminal (Internet channel, mobile intelligent terminal, ATM, POS, counter, etc.).
The system of claim 1 wherein the third party (except for the account holder and the issuer/issuer) is not required to provide the payer's account information throughout the transaction payment session.
The processing method of the system according to claim 2, characterized in that: the payment card information content: the combination of the receipt line identification code, the merchant name, the merchant number, and the card acceptor terminal identification code, which constitutes a valid transaction object range, just like remittance In the transfer transaction, the account name and account number of the receiving party are clearly identified to avoid fraudulent transactions.
The processing method of the system according to claim 2, characterized in that: the payment card information content: the receipt line identification code, the merchant name, the merchant number, the single card/multiple card, the actual validity period (short validity period) and the amount of the amount The combination of (small amount) is convenient for small and fast payment such as public transportation and subway.
The processing method of the system according to claim 2, characterized in that: the payment card information content: a single-pass/multi-card, a card verification code (CVN), a personal identification code, and a dynamic verification code receiving number (acquiring dynamic verification) The combination of the code, the amount of the amount, the cardholder's identity authentication information (cardholder's ID number, fingerprint, digital certificate, seal, etc.) constitutes a valid and valid cardholder's secure transaction limit.
The processing method according to claim 3, wherein the payment card number represented in the form of a visible code (a two-dimensional code, a bar code, and a text code or a mixed combination) is encrypted and stored in the storage medium.