WO2016206385A1

WO2016206385A1 - Payment method, device and system, and computer storage medium

Info

Publication number: WO2016206385A1
Application number: PCT/CN2016/073748
Authority: WO
Inventors: 孙奥; 童龙仓; 陈天明
Original assignee: 深圳市中兴微电子技术有限公司
Priority date: 2015-06-25
Filing date: 2016-02-14
Publication date: 2016-12-29
Also published as: CN106296197A

Abstract

A payment method, device and system, and a computer storage medium. The method comprises: after transaction information sent by a payment server is received, comparing acquired biological characteristic information with pre-stored biological characteristic reference information (S210); when the acquired biological characteristic information is consistent with the biological characteristic reference information, signing a digital signature on payment information by means of a first private key associated with the biological characteristic reference information (S220); and sending, to the payment server, the payment information on which the digital signature is signed (S230).

Description

Method, device, system and computer storage medium for payment

Technical field

The present invention relates to information security technologies, and in particular, to a payment method, device, system, and computer storage medium.

Background technique

As a new and convenient payment method, QR code payment has been rapidly popularized by its fashionable and convenient user experience. However, since the QR code itself is easy to capture, easy to intercept and easy to spread, the terminal device for payment is running in the background. The virus program can obtain the two-dimensional code information through screen capture and other technical means, and send the payment request in advance, thereby causing losses to the customer and having a large security risk.

At present, in order to improve the security of the two-dimensional code payment, some biometric information-based confirmation means, such as fingerprints, are added to the two-dimensional code payment process. The specific process may include: first, the authentication server pre-stores the user's fingerprint template. a machine fingerprint of the identity scanning device, and a user QR code; then, the user mobile terminal initiates an authentication request to the authentication server; then, the identity scanning device scans the user fingerprint information to extract the fingerprint feature; and then, the identity scanning device scans The user's two-dimensional code extracts the machine fingerprint of the device; then, the user's two-dimensional code and fingerprint feature are encrypted and protected by the machine fingerprint of the device, and transmitted to the remote authentication server for authentication; finally, the authentication server decrypts with the pre-stored device machine fingerprint If the user authentication request is the same as the user's QR code and the fingerprint feature, the authentication succeeds. If the authentication is inconsistent, the authentication fails.

The above solution can ensure the uniqueness of the user's identity credentials, and can also meet the needs of the user without having to memorize the key. However, in the specific implementation process, the virus program in the user terminal can acquire the fingerprint feature when the user inputs the fingerprint, and generate the forged transaction information to be sent to the authentication server for authentication; further, the transmission process of the fingerprint feature on the network and Fingerprint feature directly Saving on the server side will lead to the leakage of fingerprint features. In addition, the fingerprint information of the user is irrevocable. It cannot be modified as if the password was changed. Once it is leaked, the user side fingerprint image can be reversed through the fingerprint information template. To make more serious losses, therefore, the above scheme still has a large security risk.

Summary of the invention

In order to solve the above technical problem, embodiments of the present invention are directed to providing a method, device, system, and computer storage medium for payment, avoiding leakage of biometric information, and improving security in a mobile payment process.

The technical solution of the present invention is implemented as follows:

In a first aspect, an embodiment of the present invention provides a payment terminal, where the payment terminal includes: an acquisition unit and a payment information processing unit connected through an encrypted channel, and a payment application processing unit and the payment information processing unit Connected terminal devices;

The terminal device is configured to receive transaction information sent by the payment server, where the transaction information includes user account information corresponding to the payment terminal and an amount to be paid;

The acquiring unit is configured to acquire biometric information, and transmit the biometric information to the payment information processing unit,

The payment information processing unit is configured to compare the biometric information with pre-stored biometric collation information; and

When the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information; and the signed payment information is transmitted to The terminal device; wherein the payment information is used to confirm payment of the transaction information;

The terminal device is further configured to send the signed payment information to the payment server; wherein the signed payment information is used by the payment server by using the biometric comparison information a public key for digital signature verification, and when the verification is successful The payment information transfers the amount to be paid in the user account corresponding to the payment terminal to the payment end.

In the above solution, the acquiring unit may be further configured to acquire biometric collation information; and transmit biometric collation information to the payment information processing unit;

The payment information processing unit is further configured to generate a key pair associated with the biometric collation information according to a preset key generation policy; and transmit the first public key in the key pair to the terminal device; The key pair includes a first public key and a first private key;

The terminal device is further configured to send the first public key in the key pair to the payment server; the first public key is used by the payment server to bind the first public key to the user account corresponding to the payment terminal.

In the above solution, the terminal device is further configured to send a temporary account request to the payment server; wherein the temporary account request is used by the payment server to generate a temporary account associated with the user account; Receiving a temporary account sent by the payment server, and generating a two-dimensional code associated with the temporary account; wherein the temporary account is used to have the same payment function as the user account within a preset validity period and is only used for a preset number of times of payment; the two-dimensional code is used to send a transaction request to the payment server after the cashier scans; the transaction request includes the temporary information obtained by the payment terminal by parsing the two-dimensional code Account number and amount to be paid.

In the above solution, when the temporary account is in the validity period, the user account information included in the transaction information is the temporary account;

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the payment server.

In the above solution, the first private key corresponding to the biometric collation information and the biometric collation information stored by the payment information processing unit cannot be acquired by the terminal device.

In a second aspect, an embodiment of the present invention provides a payment server, where the payment server includes: a sending unit, a receiving unit, a verifying unit, and a dialing unit;

The sending unit is configured to send a transaction message to the payment terminal, where the transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

The receiving unit is configured to receive, by the payment terminal, a payment message that is digitally signed by the first private key of the payment terminal; the payment message is used to confirm payment of the transaction information;

The verification unit is configured to verify the signed payment message by using the first public key of the payment terminal, and trigger the transfer unit after the verification succeeds;

The allocating unit is configured to allocate the to-be-paid amount in the user account corresponding to the payment terminal to the receiving end.

In the above solution, the receiving unit is further configured to receive the first public key sent by the payment terminal;

The payment server further includes a binding unit configured to bind the first public key to a user account corresponding to the payment terminal.

In the above solution, the receiving unit is further configured to receive a temporary account request sent by the payment terminal;

The payment server further includes a generating unit configured to generate a temporary account associated with the user account; wherein the temporary account is used to have the same payment function as the user account within a preset validity period and only used Payment for a preset number of times;

The sending unit is further configured to send the temporary account to the payment terminal, so that the payment terminal generates a two-dimensional code associated with the temporary account.

In the above solution, the receiving unit is further configured to receive a transaction request sent by the payment terminal after scanning the two-dimensional code; wherein the transaction request includes the payment end by parsing the second The temporary account number and the amount to be paid obtained by the dimension code.

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the generating unit.

In a third aspect, an embodiment of the present invention provides a method for payment, where the method is applied to a payment terminal, and the method includes:

After receiving the transaction information sent by the payment server, the acquired biometric information is compared with the pre-stored biometric comparison information; wherein the transaction information includes the user account information corresponding to the payment terminal and the amount to be paid ;

And when the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information; wherein the payment information is used for confirmation Paying for the transaction information;

Sending the signed payment information to the payment server; wherein the signed payment information is used by the payment server to perform digital signature verification by using a first public key associated with the biometric collation information, and When the verification is successful, the amount to be paid in the user account corresponding to the payment terminal is allocated to the payment end according to the payment information.

In the above solution, before the receiving the transaction information sent by the payment server, the method further includes:

Obtaining biometric control information;

Generating a key pair associated with the biometric collation information according to a preset key generation policy; the key pair includes a first public key and a first private key;

Sending the first public key in the key pair to the payment server; the first public key is used by the payment server to bind the first public key to a user account corresponding to the payment terminal.

In the above solution, when the payment terminal initiates the payment, the method further includes:

The payment terminal sends a temporary account request to the payment server; wherein the temporary An account request for the payment server to generate a temporary account associated with the user account;

Receiving, by the payment terminal, the temporary account number sent by the payment server, and generating a two-dimensional code associated with the temporary account; wherein the temporary account is used to have a user account with a preset validity period The same payment function and only for a preset number of payments; the two-dimensional code is used for sending a transaction request to the payment server after the payment end scan; the transaction request includes the payment end by parsing the second The temporary account number and the amount to be paid obtained by the dimension code.

In the above solution, the first private key corresponding to the biometric matching information and the biometric matching information stored by the payment terminal cannot be acquired.

In a fourth aspect, an embodiment of the present invention provides a method for payment, where the method is applied to a payment server, and the method includes:

The payment server sends a transaction message to the payment terminal; wherein the transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

The payment server receives a payment message sent by the payment terminal and digitally signed by the first private key of the payment terminal; the payment message is used to confirm payment of the transaction information;

The payment server verifies the signed payment message by using the first public key of the payment terminal;

When the verification is successful, the payment server transfers the to-be-paid amount in the user account corresponding to the payment terminal to the payment terminal.

In the above solution, before the payment server sends the transaction message to the payment terminal, the method further includes:

The payment server receives the first public key sent by the payment terminal; and binds the first public key to a user account corresponding to the payment terminal.

Receiving, by the payment server, a temporary account request sent by the payment terminal; and generating a temporary account associated with the user account, the temporary account being used to have the same payment as the user account within a preset validity period Function and only for a preset number of payments;

The payment server sends the temporary account to the payment terminal, so that the payment terminal generates a two-dimensional code associated with the temporary account.

In the above solution, after the payment server sends the temporary account to the payment terminal, and the payment server sends a transaction message to the payment terminal, the method further includes:

Receiving, by the payment server, a transaction request sent by the payment terminal after scanning the two-dimensional code; wherein the transaction request includes the temporary account obtained by the payment terminal by parsing the two-dimensional code And the amount to be paid.

In a fifth aspect, an embodiment of the present invention provides a payment system, where the system includes a payment terminal, a payment terminal, and a payment server;

The payment terminal is configured to: after receiving the transaction information sent by the payment server, compare the acquired biometric information with the pre-stored biometric collation information; the transaction information includes a user corresponding to the payment terminal Account information and amount to be paid; and,

And when the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information; wherein the payment information is used for confirmation Paying for the transaction information, and the payment is final The biometric control information stored in the end and the first private key corresponding to the biometric collation information cannot be acquired; and,

Sending the signed payment information to the payment server;

The payment server is configured to send a transaction message to the payment terminal, where the transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

Receiving, by the payment terminal, a payment message digitally signed by the first private key of the payment terminal; the payment message is used to confirm payment of the transaction information;

Verifying the signed payment message by the first public key of the payment terminal; and

When the verification is successful, the to-be-paid amount in the user account corresponding to the payment terminal is allocated to the collection terminal.

The embodiment of the invention provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to execute the payment method described above.

The embodiment of the invention provides a method, a device and a system for payment, which perform a verification process in a payment by using a key pair corresponding to the biometric information, thereby avoiding leakage of the biometric information of the user and avoiding the real account of the user. Leakage improves security in the mobile payment process.

DRAWINGS

FIG. 1 is a schematic structural diagram of a payment terminal according to an embodiment of the present invention;

2 is a schematic flowchart of a payment method applied to a payment terminal according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a biometric comparison information and a corresponding key pair generation process according to an embodiment of the present disclosure;

FIG. 4 is a schematic flowchart of generating a two-dimensional code associated with a temporary account corresponding to a user account according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of a payment server according to an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of another payment server according to an embodiment of the present disclosure;

FIG. 7 is a schematic flowchart of a payment method applied to a payment server according to an embodiment of the present disclosure;

FIG. 8 is a schematic flowchart diagram of a payment method according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings.

Embodiment 1

FIG. 1 shows a structure of a payment terminal 10 according to an embodiment of the present invention. The terminal 10 may include an obtaining unit 110 and a payment information processing unit 120 connected through an encrypted channel, and a payment application installed. a terminal device 130 connected to the payment information processing unit 120; the terminal device 130 can implement the function of the payment process according to the embodiment of the present invention according to the indication of the payment application;

The terminal device 130 is configured to receive transaction information sent by the payment server, where the transaction information includes user account information corresponding to the payment terminal and an amount to be paid;

The obtaining unit 110 is configured to acquire the biometric information and transmit the biometric information to the payment information processing unit 120. In the embodiment of the present invention, the biometric information is described by taking the fingerprint information as an example. A person skilled in the art can apply the technical solutions of the embodiments of the present invention to other biometric information, such as eye lines, voice prints, and the like. This embodiment of the present invention does not describe this;

The payment information processing unit 120 is configured to compare the biometric information with the pre-stored biometric collation information; and

When the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information; and the signed payment information is transmitted to The terminal device 130; wherein the payment information is used to confirm payment of the transaction information;

The terminal device 130 is further configured to send the signed payment information to the payment server, wherein the signed payment information is used by the payment server by using the first public key associated with the biometric collation information The digital signature verification is performed, and when the verification is successful, the amount to be paid in the user account corresponding to the payment terminal is allocated to the payment end according to the payment information.

It should be noted that the terminal device 130 described in this embodiment may be any terminal device having a payment application, such as a mobile phone, a tablet computer, or the like. The payment information processing unit 120 may be a device with hardware protection performance including a storage area and a processor, which may have the ability to store, calculate, and decrypt, and have the ability to securely store the stored data, so that Securely stored data can be exported and retrieved. The specific structure of the obtaining unit 110 may correspond to a processor, and the specific structure of the processor may be a Central Processing Unit (CPU), a Micro Controller Unit (MCU), and a Digital Signal Processor (DSP). Digital Signal Processing) or a collection of electronic components or electronic components having processing functions such as a programmable logic device (PLC). The obtaining unit 110 and the payment information processing unit 120 may be connected to the terminal device 130 through a peripheral interface such as a USB, or may be designed as a part of the terminal device 130 through a bus connection, which is not specifically described in this embodiment.

Exemplarily, the acquiring unit 110 may be further configured to acquire biometric collation information; and transmit the biometric collation information to the payment information processing unit 120;

The payment information processing unit 120 is further configured to generate a key pair associated with the biometric collation information according to a preset key generation policy; and transmit the first public key in the key pair to the terminal device 130; The key pair includes a first public key and a first private key;

The terminal device 130 is further configured to send the first public key in the key pair to the payment server; the first public key is used by the payment server to bind the first public key to the user account corresponding to the payment terminal.

Exemplarily, the terminal device 130 is further configured to send a temporary account request to the payment server; The temporary account request is used by the payment server to generate a temporary account associated with the user account; and, the temporary account sent by the payment server is received, and a two-dimensional code associated with the temporary account is generated; wherein the temporary account is used for the preset The validity period has the same payment function as the user account and is only used for the preset number of payments; the two-dimensional code is used for the payment terminal to scan and send a transaction request to the payment server; the transaction request includes the receipt The temporary account and the amount to be paid obtained by parsing the two-dimensional code by the payment end.

Further, when the temporary account is in the validity period, the user account information included in the transaction information is the temporary account;

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the payment server; understandably, the terminal device 130 can resend the temporary account to the payment server at this time. Request to obtain a temporary account regenerated by the payment server.

Illustratively, the first private key corresponding to the biometric collation information and the biometric collation information stored by the payment information processing unit 120 cannot be performed by the terminal device 130, because the payment information processing unit 120 has hardware protection performance. Obtain.

The embodiment provides a structure of the payment terminal 10, and performs a verification process in the payment by using a key pair corresponding to the biometric information, thereby avoiding leakage of biometric information of the user, and avoiding leakage of the real account of the user and improving The security in the mobile payment process.

Embodiment 2

The payment terminal according to the first embodiment, referring to FIG. 2, shows a flow of a payment method applied to the payment terminal according to the foregoing embodiment, which may include:

S210: After receiving the transaction information sent by the payment server, comparing the acquired biometric information with the pre-stored biometric comparison information;

The transaction information includes user account information corresponding to the payment terminal and an amount to be paid;

S220: When the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information;

Wherein the payment information is used to confirm payment of the transaction information;

S230: Send the signed payment information to the payment server;

The signed payment information is used by the payment server to perform digital signature verification by using a first public key associated with the biometric collation information, and corresponding to the payment terminal according to the payment information when the verification is successful. The amount to be paid in the user account is transferred to the receiving end.

It should be noted that the first private key corresponding to the biometric matching information and the biometric matching information stored by the payment terminal cannot be obtained by the terminal.

Illustratively, referring to FIG. 3, before receiving the transaction information sent by the payment server, the method further includes biometric comparison information and a corresponding key pair generation process:

S200: Obtain biometric comparison information;

S201: Generate a key pair associated with the biometric comparison information according to a preset key generation policy; the key pair includes a first public key and a first private key;

S202: Send the first public key in the key pair to the payment server, where the first public key is used by the payment server to bind the first public key to a user account corresponding to the payment terminal.

Illustratively, referring to FIG. 4, when the payment terminal initiates the payment, the method further includes a process of generating a two-dimensional code associated with the temporary account corresponding to the user account, specifically:

S203: The payment terminal sends a temporary account request to the payment server.

The temporary account request is used by the payment server to generate a temporary account associated with the user account;

S204: The payment terminal receives the temporary account sent by the payment server, and generates a temporary account. Associated two-dimensional code;

The temporary account is used to have the same payment function as the user account in the preset validity period and is used only for the preset number of times of payment; the two-dimensional code is used for the payment by the payment terminal to the payment. The server sends a transaction request; the transaction request includes the temporary account number and the to-be-paid amount obtained by the payment terminal by parsing the two-dimensional code.

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the payment server. It can be understood that the payment terminal can resend the temporary account request to the payment server. In order to obtain a temporary account regenerated by the payment server.

The embodiment provides a payment method applied to a payment terminal, and performs a verification process in the payment by using a key pair corresponding to the biometric information, thereby avoiding leakage of the biometric information of the user, and avoiding leakage of the real account of the user. , improve the security of the mobile payment process.

Embodiment 3

Based on the same technical concept of the foregoing embodiment, referring to FIG. 5, a structure of a payment server 50 according to an embodiment of the present invention is shown. The payment server 50 may include: a sending unit 510, a receiving unit 520, a verification unit 530, and a dialing unit 540; wherein

The sending unit 510 is configured to send a transaction message to the payment terminal, where the transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

The receiving unit 520 is configured to receive, by the payment terminal, a payment message that is digitally signed by the first private key of the payment terminal; the payment message is used to confirm payment of the transaction information;

The verification unit 530 is configured to verify the signed payment message by using the first public key of the payment terminal; and trigger the transfer unit 540 after the verification is successful;

The dialing unit 540 is configured to allocate the to-be-paid amount in the user account corresponding to the payment terminal to the payment end.

Exemplarily, the receiving unit 520 is further configured to receive the first public key sent by the payment terminal; referring to FIG. 6, the payment server 50 further includes a binding unit 550 configured to associate the first public key with the Bind the user account corresponding to the payment terminal.

Exemplarily, the receiving unit 520 is further configured to receive a temporary account request sent by the payment terminal;

Referring to FIG. 6, the payment server 50 further includes a generating unit 560 configured to generate a temporary account associated with the user account; wherein the temporary account is used to have the same payment function as the user account within a preset validity period and Only for a preset number of payments;

The sending unit 510 is further configured to send a temporary account to the payment terminal, so that the payment terminal generates a two-dimensional code associated with the temporary account.

Further, the receiving unit 520 is further configured to receive a transaction request sent by the payment terminal after scanning the two-dimensional code, where the transaction request includes the payment end acquiring by analyzing the two-dimensional code The temporary account number and the amount to be paid.

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the generating unit 560. It can be understood that the receiving unit 520 can accept the temporary resend by the payment terminal. The account request, thereby generating a temporary account that unit 560 can regenerate.

In a practical application, the specific structures of the sending unit 510, the receiving unit 520, the verifying unit 530, the dialing unit 540, the binding unit 550, and the generating unit 560 may all correspond to a processor. The specific structure of the processor may be a collection of electronic components or electronic components having processing functions such as a CPU, an MCU, a DSP, or a PLC. Wherein the processor includes executable code, The executable code is stored in a storage medium, and the processor may be connected to the storage medium through a communication interface such as a bus, and when the corresponding function of each module is executed, the storage medium is read and operated from the storage medium. Executable code. The portion of the storage medium used to store the executable code is preferably a non-transitory storage medium.

The foregoing sending unit 510, the receiving unit 520, the verifying unit 530, the dialing unit 540, the binding unit 550, and the generating unit 560 may be integrated corresponding to the same processor, or respectively corresponding to different processors; when the integration corresponds to the same processor The processor adopts a function corresponding to the connection sending unit 510, the receiving unit 520, the verification unit 530, the dialing unit 540, the binding unit 550, and the generating unit 560.

The embodiment provides a structure of the payment server 50, and performs a verification process in the payment by using a key pair corresponding to the biometric information, thereby avoiding the leakage of the biometric information of the user, and avoiding the leakage of the real account of the user. Security in the mobile payment process.

Embodiment 4

The payment server according to the third embodiment, referring to FIG. 7, shows a flow of a payment method applied to the payment server described in the foregoing embodiment, which may include:

S710: The payment server sends a transaction message to the payment terminal.

The transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

S720: The payment server receives the payment message that is sent by the payment terminal and is digitally signed by the first private key of the payment terminal.

Wherein the payment message is used to confirm payment of the transaction information;

S730: The payment server verifies the signed payment message by using the first public key of the payment terminal.

S740: When the verification is successful, the payment server will be in the user account corresponding to the payment terminal. The amount to be paid is allocated to the receiving end.

Exemplarily, before the payment server sends the transaction message to the payment terminal, the method may further include:

Illustratively, when the payment terminal initiates the payment, the method may further include:

Receiving, by the payment server, a temporary account request sent by the payment terminal; and generating a temporary account associated with the user account;

The payment server sends the temporary account to the payment terminal to cause the payment terminal to generate a two-dimensional code associated with the temporary account.

The temporary account is used to have the same payment function as the user account within a preset validity period and is used only for a preset number of payments.

It should be noted that, when the temporary account is in the validity period, the user account information included in the transaction information is the temporary account;

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the payment server. It can be understood that the payment server can accept the temporary account request resent by the payment terminal. , thereby paying the temporary account that the server can regenerate.

Further, after the payment server sends the temporary account to the payment terminal, and the payment server sends the transaction message to the payment terminal, the payment server may further include:

The embodiment provides a payment method applied to the payment server, and performs a verification process in the payment by using a key pair corresponding to the biometric information, thereby avoiding leakage of the biometric information of the user, and avoiding leakage of the real account of the user. Improve security in the mobile payment process.

Embodiment 5

Based on the same technical concept of the foregoing embodiment, referring to FIG. 8 , a detailed process of a payment method according to an embodiment of the present invention is shown. In the process, the biometric information is illustrated by using a fingerprint as an example. Can include:

S801: After the payment terminal authenticates, send a fingerprint binding request to the payment server.

S802: The payment server sends a fingerprint binding instruction to the payment terminal.

S803: The payment terminal acquires the comparison fingerprint, and generates a key pair associated with the comparison fingerprint according to the preset key generation policy.

The key pair includes a first public key and a first private key;

Specifically, the comparison fingerprint may be acquired by the acquiring unit in the payment terminal, and the key pair associated with the comparison fingerprint may be generated and stored by the payment information processing unit;

S804: The payment terminal sends the first public key in the key pair to the payment server.

S805: The payment server binds the first public key to a user account corresponding to the payment terminal.

It can be understood that S801 to S805 implement the acquisition of the collation fingerprint and the generation of the key pair corresponding to the fingerprint, so that the payment verification can be performed by verifying the key pair instead of verifying the fingerprint information in the subsequent payment verification process. Thereby, the risk of leakage of fingerprint information can be reduced.

When a payment transaction needs to be initiated, the process can continue to include:

S806: The payment terminal sends a temporary account request to the payment server.

S807: The payment server generates a temporary account associated with the user account;

It should be noted that the temporary account is consistent with the composition of the user account. Therefore, the temporary account can be used to have the same payment function as the user account within the preset validity period and only used for the preset number of payments; A temporary account is used to replace the payment function of the user account. Therefore, in the specific payment process, the payment terminal and the merchant receiving end cannot obtain the real user account. The number information ensures the security of the real user account, and since the temporary account is only used for the preset number of payments, the security of the funds in the user account can also be guaranteed.

S808: The payment server sends the temporary account to the payment terminal.

S809: The payment terminal generates a two-dimensional code associated with the temporary account.

S810: The payment end scans the two-dimensional code, and parses out the temporary account according to the two-dimensional code;

It can be understood that the payee end can be a merchant that conducts a transaction, and the two-dimensional code associated with the temporary account is scanned by the two-dimensional code scanner.

S811: The payment terminal encapsulates the parsed temporary account number and the to-be-paid amount into a transaction request and sends the transaction request to the payment server;

S812: The payment server sends the transaction information to the payment terminal according to the transaction request;

The transaction information includes user account information corresponding to the payment terminal and the amount to be paid;

It should be noted that, when the temporary account is within the validity period, the user account information included in the transaction information is the temporary account; and when the temporary account is not within the validity period, the user account information included in the transaction information is the payment. Temporary account regenerated by the server;

S813: The payment terminal acquires the fingerprint of the user, and compares the obtained fingerprint with the comparison fingerprint.

S814: when the obtained fingerprint is consistent with the comparison fingerprint, the payment terminal digitally signs the payment information by using the first private key associated with the comparison fingerprint;

It can be understood that the payment terminal can acquire the fingerprint of the user through the obtaining unit, and can perform fingerprint matching and digital signature on the payment information through the payment information processing unit.

S815: the payment terminal sends the signed payment information to the payment server;

S816: The payment server verifies the signed payment message by using the first public key of the payment terminal.

S817: When the verification is successful, the payment server will be in the user account corresponding to the payment terminal. The amount to be paid is allocated to the receiving end.

Understandably, after the funds transfer is completed, the payment server can notify the payment terminal and the payment terminal.

The embodiment provides a detailed process of the payment method, and performs a verification process in the payment by using a key pair corresponding to the biometric information, thereby avoiding the leakage of the biometric information of the user, and avoiding the leakage of the real account of the user. Security in the mobile payment process.

Embodiment 6

The foregoing embodiment describes the two important execution entities in the technical solutions of the embodiments of the present invention, namely, the structure of the payment terminal and the payment server. On the basis of this, the embodiment further provides a payment system, and the system can Including a payment terminal, a payment terminal, and a payment server;

The payment terminal is configured to: after receiving the transaction information sent by the payment server, compare the acquired biometric information with the pre-stored biometric comparison information; the transaction information includes the user account information corresponding to the payment terminal The amount paid; and,

And when the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information; wherein the payment information is used for confirmation Paying the transaction information, and the first private key corresponding to the biometric matching information and the biometric collation information stored by the payment terminal cannot be obtained by the terminal;

Sending the signed payment information to the payment server; wherein the signed payment information is used by the payment server to perform digital signature verification by using a first public key associated with the biometric collation information, and When the verification is successful, the amount to be paid in the user account corresponding to the payment terminal is allocated to the collection end according to the payment information;

a payment server, configured to send a transaction message to the payment terminal, where the transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

Receiving, after being digitally signed by the payment terminal, the first private key of the payment terminal Payment message; the payment message is used to confirm payment of the transaction information;

And verifying, by the first public key of the payment terminal, the signed payment message; when the verification is successful, transferring the to-be-paid amount in the user account corresponding to the payment terminal to the payment end.

It is to be understood that the payment terminal involved in the embodiment may be the payment terminal described in the foregoing embodiment; the payment server involved in this embodiment may be the payment server described in the foregoing embodiment.

The embodiment of the invention further describes a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used in the payment method described in the foregoing embodiments.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the computer is readable and stored The instructions in the reservoir produce an article of manufacture comprising an instruction device that implements the functions specified in one or more blocks of the flow or in a flow or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Industrial applicability

In the embodiment of the present invention, the verification process in the payment is performed by the key pair corresponding to the biometric information, the leakage of the biometric information of the user is avoided, the leakage of the real account of the user is avoided, and the security in the mobile payment process is improved. Sex.

Claims

A payment terminal, comprising: an acquisition unit and a payment information processing unit connected through an encrypted channel; and a terminal device installed with a payment application and connected to the payment information processing unit;

The terminal device is configured to receive transaction information sent by the payment server, where the transaction information includes user account information corresponding to the payment terminal and an amount to be paid;

The acquiring unit is configured to acquire biometric information, and transmit the biometric information to the payment information processing unit;

The payment information processing unit is configured to compare the biometric information with pre-stored biometric collation information; and

When the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information; and the signed payment information is transmitted to The terminal device; wherein the payment information is used to confirm payment of the transaction information;

The terminal device is further configured to send the signed payment information to the payment server; wherein the signed payment information is used by the payment server by using the biometric comparison information A public key performs digital signature verification, and when the verification is successful, the amount to be paid in the user account corresponding to the payment terminal is allocated to the payment end according to the payment information.
The payment terminal according to claim 1, wherein the obtaining unit is further configured to acquire biometric collation information; and transmit the biometric collation information to the payment information processing unit;

The payment information processing unit is further configured to generate a key pair associated with the biometric collation information according to a preset key generation policy; and transmit the first public key in the key pair to the terminal device; The key pair includes a first public key and a first private key;

The terminal device is further configured to send the first public key in the key pair to the payment server; the first public key is used by the payment server to bind the first public key to the user account corresponding to the payment terminal.
The payment terminal according to claim 1, wherein the terminal device is further configured to send a temporary account request to the payment server; wherein the temporary account request is used by the payment server to generate and associate with the user account a temporary account; and receiving a temporary account sent by the payment server, and generating a two-dimensional code associated with the temporary account; wherein the temporary account is used to have the same user account within a preset validity period Payment function and only for a preset number of payments; the two-dimensional code is used for sending a transaction request to the payment server after the payment end scan; the transaction request includes the payment end by parsing the two-dimensional The temporary account number and the amount to be paid obtained by the code.
The payment terminal according to claim 3, wherein when the temporary account is in the validity period, the user account information included in the transaction information is the temporary account;

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the payment server.
The payment terminal according to claim 1, wherein the first private key corresponding to the biometric collation information and the biometric collation information stored by the payment information processing unit cannot be acquired by the terminal device.
A payment server, wherein the payment server comprises: a sending unit, a receiving unit, a verifying unit, and a dialing unit; wherein

The sending unit is configured to send a transaction message to the payment terminal, where the transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

The receiving unit is configured to receive, by the payment terminal, a payment message that is digitally signed by the first private key of the payment terminal; the payment message is used to confirm payment of the transaction information;

The verification unit is configured to verify the signed payment message by using the first public key of the payment terminal, and trigger the transfer unit after the verification succeeds;

The allocating unit is configured to allocate the to-be-paid amount in the user account corresponding to the payment terminal to the receiving end.
The payment server according to claim 6, wherein the receiving unit is further configured to receive a first public key sent by the payment terminal;

The payment server further includes a binding unit configured to bind the first public key to a user account corresponding to the payment terminal.
The payment server according to claim 6, wherein the receiving unit is further configured to receive a temporary account request sent by the payment terminal;

The payment server further includes a generating unit configured to generate a temporary account associated with the user account; wherein the temporary account is used to have the same payment function as the user account within a preset validity period and only used Payment for a preset number of times;

The sending unit is further configured to send the temporary account to the payment terminal, so that the payment terminal generates a two-dimensional code associated with the temporary account.
The payment server according to claim 8, wherein the receiving unit is further configured to receive a transaction request sent by the payment terminal after scanning the two-dimensional code; wherein the transaction request includes the receipt The temporary account and the amount to be paid obtained by parsing the two-dimensional code by the payment end.
The payment server according to claim 8, wherein when the temporary account is within the validity period, the user account information included in the transaction information is the temporary account;

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the generating unit.
A method of payment, wherein the method is applied to a payment terminal, the method comprising:

After receiving the transaction information sent by the payment server, the acquired biometric information is compared with the pre-stored biometric comparison information; wherein the transaction information includes the user account information corresponding to the payment terminal and the amount to be paid ;

And when the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information; wherein the payment information is used for confirmation Paying for the transaction information;

Sending the signed payment information to the payment server; wherein the signed payment information is used by the payment server to perform digital signature verification by using a first public key associated with the biometric collation information, and When the verification is successful, the amount to be paid in the user account corresponding to the payment terminal is allocated to the payment end according to the payment information.
The method of claim 11, wherein the method further comprises: before the receiving the transaction information sent by the payment server, the method further comprising:

Obtaining biometric control information;

Generating a key pair associated with the biometric collation information according to a preset key generation policy; the key pair includes a first public key and a first private key;

Sending the first public key in the key pair to the payment server; the first public key is used by the payment server to bind the first public key to a user account corresponding to the payment terminal.
The method of claim 11, wherein when the payment terminal initiates payment, the method further comprises:

The payment terminal sends a temporary account request to the payment server; wherein the temporary account request is used by the payment server to generate a temporary account associated with the user account;

Receiving, by the payment terminal, the temporary account number sent by the payment server, and generating a two-dimensional code associated with the temporary account; wherein the temporary account is used to have a user account with a preset validity period The same payment function and only for a preset number of payments; the two-dimensional code is used for the payment terminal to send a transaction request to the payment server; the transaction request includes The payment end obtains the temporary account number and the amount to be paid by parsing the two-dimensional code.
The method according to claim 13, wherein when the temporary account is in the validity period, the user account information included in the transaction information is the temporary account;

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the payment server.
The method according to claim 11, wherein the biometric collation information stored by the payment terminal and the first private key corresponding to the biometric collation information cannot be acquired.
A method of payment, wherein the method is applied to a payment server, the method comprising:

The payment server sends a transaction message to the payment terminal; wherein the transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

The payment server receives a payment message sent by the payment terminal and digitally signed by the first private key of the payment terminal; the payment message is used to confirm payment of the transaction information;

The payment server verifies the signed payment message by using the first public key of the payment terminal;

When the verification is successful, the payment server transfers the to-be-paid amount in the user account corresponding to the payment terminal to the payment terminal.
The method of claim 16, wherein before the payment server sends the transaction message to the payment terminal, the method further comprises:

The payment server receives the first public key sent by the payment terminal; and binds the first public key to a user account corresponding to the payment terminal.
The method of claim 16, wherein when the payment terminal initiates a payment, the method further comprises:

Receiving, by the payment server, a temporary account request sent by the payment terminal; a temporary account associated with the user account, wherein the temporary account is used to have the same payment function as the user account within a preset validity period and is used only for a preset number of payments;

The payment server sends the temporary account to the payment terminal, so that the payment terminal generates a two-dimensional code associated with the temporary account.
The method according to claim 18, wherein after the payment server sends the temporary account to the payment terminal, and the payment server sends a transaction message to the payment terminal, the method further includes:

Receiving, by the payment server, a transaction request sent by the payment terminal after scanning the two-dimensional code; wherein the transaction request includes the temporary account obtained by the payment terminal by parsing the two-dimensional code And the amount to be paid.
The method according to claim 18, wherein when the temporary account is in the validity period, the user account information included in the transaction information is the temporary account;

When the temporary account is not in the validity period, the user account information included in the transaction information is a temporary account regenerated by the payment server.
A payment system, wherein the system includes a payment terminal, a payment terminal, and a payment server; wherein

The payment terminal is configured to: after receiving the transaction information sent by the payment server, compare the acquired biometric information with the pre-stored biometric collation information; the transaction information includes a user corresponding to the payment terminal Account information and amount to be paid; and,

And when the acquired biometric information is consistent with the biometric collation information, the payment information is digitally signed by the first private key associated with the biometric collation information; wherein the payment information is used for confirmation Paying for the transaction information, and the first private key corresponding to the biometric comparison information and the biometric collation information stored by the payment terminal cannot be acquired;

Sending the signed payment information to the payment server;

The payment server is configured to send a transaction message to the payment terminal, where the transaction message includes user account information corresponding to the payment terminal and an amount to be paid;

Receiving, by the payment terminal, a payment message digitally signed by the first private key of the payment terminal; the payment message is used to confirm payment of the transaction information;

Verifying the signed payment message by the first public key of the payment terminal; and

When the verification is successful, the to-be-paid amount in the user account corresponding to the payment terminal is allocated to the collection terminal.
A computer storage medium having stored therein computer executable instructions for performing the method of any one of claims 11 to 15, and/or for performing claim 16. The method of any one of 20.