WO2016206530A1 - 一种高级安全的移动支付方法、装置及系统 - Google Patents

一种高级安全的移动支付方法、装置及系统 Download PDF

Info

Publication number
WO2016206530A1
WO2016206530A1 PCT/CN2016/084890 CN2016084890W WO2016206530A1 WO 2016206530 A1 WO2016206530 A1 WO 2016206530A1 CN 2016084890 W CN2016084890 W CN 2016084890W WO 2016206530 A1 WO2016206530 A1 WO 2016206530A1
Authority
WO
WIPO (PCT)
Prior art keywords
payment
mobile terminal
request
data
authentication
Prior art date
Application number
PCT/CN2016/084890
Other languages
English (en)
French (fr)
Inventor
林志明
王俊杰
余勇
杨军
Original Assignee
深圳国微技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳国微技术有限公司 filed Critical 深圳国微技术有限公司
Publication of WO2016206530A1 publication Critical patent/WO2016206530A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/16—Payments settled via telecommunication systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]

Definitions

  • the invention belongs to the field of electronic payment, and in particular relates to an advanced and secure mobile payment method, device and system.
  • mobile POS Mobile Point of Mobile payment devices
  • mobile point-of-sale terminals have also been widely used, but in the process of payment, mobile payment devices are easy to intercept and copy the payment information such as passwords and transaction information, resulting in the user's funds being stolen. Therefore, the security of mobile payment devices is receiving more and more attention.
  • the prior art generally adopts a method of encrypting payment information in a payment device and then decrypting the mobile terminal to improve the security of the payment password and the transaction information.
  • all mobile terminals are required to use the same key.
  • the password of a mobile terminal is cracked, the password of the entire system will be cracked/copied, and the security is low.
  • the embodiment of the invention provides an advanced and secure mobile payment method, which aims to solve the problem that when the password of a mobile terminal is cracked, the password of the entire system will be all cracked/copied, and the security is low.
  • the embodiment of the present invention is implemented as an advanced secure mobile payment method, and the method includes the following steps: Receiving a payment request sent by the mobile terminal, where the payment request is generated by a payment device, the payment request carries sensitive data, and the payment device performs an encryption operation on the sensitive data; decrypting the encrypted sensitive data; The payment request interacts with the payment platform to complete the payment; wherein the payment request carries a payer account, a payment password, a payee account, and a consumption amount, and the sensitive data includes at least a payment password.
  • the embodiment of the present invention further provides another advanced secure mobile payment method, where the method includes the following steps: the mobile terminal sends a consumption request to the payment device, where the consumption request carries a payee account number and a consumption amount; the payment The device generates a payment request according to the consumption request, and sends the consumption request to the mobile terminal, where the payment request carries sensitive data, and the payment device performs an encryption operation on the sensitive data; The mobile terminal sends the payment request to a background server; the background server decrypts the encrypted sensitive data after receiving the payment request, and interacts with the payment background based on the payment request to complete the payment.
  • the payment request carries at least a payer account, a payment password, a payee account, and a consumption amount, and the sensitive data includes at least a payment password.
  • An embodiment of the present invention further provides an advanced and secure mobile payment device, where the device includes: a receiving unit, configured to receive a payment request sent by a mobile terminal, where the payment request is generated by a payment device, and the payment request carries sensitive data. And performing, by the payment device, the encryption operation on the sensitive data; the decryption unit is configured to decrypt the encrypted sensitive data; and the payment unit is configured to interact with the payment platform according to the payment request to complete the payment;
  • the payment request carries a payer account, a payment password, a payee account, and a spending amount, and the sensitive data includes at least a payment password.
  • An embodiment of the present invention further provides an advanced secure mobile payment system, where the system includes: a mobile terminal, configured to send a consumption request to a payment device, receive a payment request sent by the payment device, and send the payment request to a background a server, the consumer request carries a payee account number and a consumption amount; the payment device is configured to generate a payment request according to the consumption request, encrypt the sensitive data carried in the payment request, and send the payment request To the mobile terminal;
  • the background server is configured to decrypt the encrypted sensitive data after receiving the payment request, and interact with the payment background to complete the payment based on the payment request.
  • the payment request carries at least a payer account, a payment password, a payee account, and a consumption amount, and the sensitive data includes at least a payment password.
  • the payment device of the present invention encrypts the sensitive data by using the key, and then sends the payment request containing the sensitive data to the background server for decryption via the mobile terminal to complete the payment, so that the decryption is performed in the background server, and the key is uniformly managed by the background server.
  • the mobile terminal only forwards data, so different keys can be issued for different payment devices or each transaction, which improves the security of payment.
  • FIG. 1 is a structural diagram of a mobile payment system according to an embodiment of the present invention
  • FIG. 2 is a flowchart of an implementation of a mobile payment method according to an embodiment of the present invention
  • FIG. 3 is a flowchart of implementing a method for authenticating a payment device by a background server according to an embodiment of the present invention, and transmitting a first key for encrypting sensitive data to a payment device after successful authentication;
  • FIG. 4 is a flowchart of an implementation of a mobile payment method according to a second embodiment of the present invention.
  • FIG. 5 is a flowchart of implementing a method for authenticating a payment device by a background server according to a second embodiment of the present invention, and transmitting a first key for encrypting sensitive data to a payment device after successful authentication;
  • FIG. 6 is a structural diagram of a mobile payment system according to a third embodiment of the present invention.
  • FIG. 7 is a structural diagram of a background server provided by the fourth embodiment.
  • FIG. 8 is a structural diagram of an authentication unit according to a fourth embodiment of the present invention.
  • the payment device encrypts the sensitive data by using the key, and then sends the payment request containing the sensitive data to the background server for decryption via the mobile terminal to complete the payment, and the key is uniformly managed by the background server, and the mobile terminal only performs data. Forwarding, so different keys can be issued for different payment devices or each transaction, which improves the security of payment.
  • FIG. 1 is a structural diagram of a mobile payment system according to an embodiment of the present invention. For convenience of description, only parts related to the embodiment of the present invention are shown.
  • the mobile payment system includes a mobile terminal 11, a payment device 12, and a background server 13.
  • the mobile terminal 11 can be a mobile phone, a personal digital assistant (PDA), Mobile terminals such as digital cameras, laptops, and tablets.
  • PDA personal digital assistant
  • the payment device 12 may be a terminal device that can generate a payment request, such as a POS machine, a vending machine, or the like.
  • the backend server 13 may be a server of a third party payment platform, a payment service provider such as a bank.
  • the mobile terminal 11, and the background server 13 can communicate via the Internet, Communication links such as a local area network and a wide area network communicate, and the mobile terminal 11 and the payment device 12 communicate by means of near field communication, infrared or Bluetooth, audio interface, and the like.
  • the mobile terminal 11 when the user needs to perform consumption, the mobile terminal 11 initiates a consumption request to the payment device 12, and the payment device 12 generates a payment request after receiving the consumption request, and sends a payment request to the mobile terminal 11, the background server 13 The payment request forwarded by the mobile terminal 11 is obtained, and the payment is completed according to the payment request.
  • FIG. 2 is a flowchart of implementing an advanced secure mobile payment method according to an embodiment of the present invention. The method is applied to a background server, and the details are as follows:
  • step S201 a payment request sent by the mobile terminal is received.
  • the payment request is generated by the payment device according to the consumption request sent by the mobile terminal, and the payment request carries at least information such as the payer account, the payment password, the payee account, and the consumption amount, etc., in order to improve the security of the transaction, payment
  • the device encrypts sensitive information such as a payment password.
  • the background server obtains a payment request from the mobile terminal.
  • step S202 the encrypted sensitive data is decrypted.
  • the background server after receiving the payment request from the mobile terminal, the background server first decrypts the encrypted sensitive data in the payment request to obtain sensitive data such as a payment password.
  • step S203 an interaction with the payment platform is performed according to the payment request to complete the payment.
  • the background server sends the corresponding information to the payment platform according to the requirements of the payment platform such as the bank and the third-party platform, and completes the payment.
  • the interaction between the backend server and the payment platform can be as specified by any applicable conventional financial transaction standard and will not be described here.
  • the background server in order to improve the security of the payment, before the step S201, the background server further authenticates the payment device, and after the authentication succeeds, the first key for encrypting the sensitive data is sent to the payment device.
  • the background server transmits a payment success notification to the mobile terminal to notify the user that the payment is successful.
  • the payment device encrypts the sensitive data by using the key, and then sends the payment request containing the sensitive data to the background server for decryption via the mobile terminal to complete the payment, and the key is uniformly managed by the background server, and the mobile terminal only performs data. Forwarding, so different keys can be issued for different payment devices or each transaction, which avoids the need to use the same key when the mobile terminal performs encryption and decryption, resulting in the entire payment system being cracked after the mobile terminal key is compromised or Copying increases the security of payment.
  • FIG. 3 is a flowchart of implementing a method for authenticating a payment device by a background server according to an embodiment of the present invention, and transmitting a first key for encrypting sensitive data to a payment device after successful authentication, which is as follows:
  • step S301 the background server transmits random data to the payment device through the mobile terminal in response to the data acquisition request of the mobile terminal.
  • the background server sends a random number to the mobile terminal according to the data acquisition request of the mobile terminal, and after receiving the random number, the mobile terminal sends the random number to the payment device, and the payment device calculates the received random number.
  • the corresponding authentication data is obtained, and the authentication data is encrypted with a preset second key before the authentication data is sent.
  • the background server equips the payment device with an identity code that uniquely proves the identity information of the payment device, and presets a second key corresponding to the identity code at the payment device, and uses the authentication key before transmitting the authentication data.
  • the preset second key encrypts the authentication data and carries the identification code when returning the authentication data.
  • the payment device adopts 3DES (Triple Data Encryption) Algorithm, triple data encryption algorithm) Encryption method encrypts authentication data.
  • 3DES Triple Data Encryption Algorithm, triple data encryption algorithm
  • step S302 the encrypted authentication data transmitted by the mobile terminal is acquired.
  • the payment device sends the encrypted authentication data to the mobile terminal, and the background server obtains the encrypted authentication data from the mobile terminal.
  • step S303 the encrypted authentication data is decrypted, authentication data is obtained, and authentication is performed.
  • the server finds the corresponding key according to the identity identification code carried in the authentication data and decrypts the encrypted authentication data. After the authentication is passed, the authentication result is returned to the mobile terminal.
  • step S304 in response to the key acquisition request of the mobile terminal, the first key for encrypting the sensitive data is transmitted to the payment device by the mobile terminal.
  • the background server sends a first key for encrypting the sensitive data to the mobile terminal, and the first key is sent by the mobile terminal to the mobile terminal.
  • the payment device On the payment device.
  • the background server in order to prevent the first key from being stolen during transmission, encrypts the first key before issuing the first key.
  • the background server adopts 3DES (Triple The Data Encryption Algorithm (encryption method) encrypts the first key.
  • the background server sends a different key to the payment device through the mobile terminal after each authentication, and the payment device encrypts the authentication data by using the issued payment key, and the key issued by each authentication. Differently, it can prevent the payment device from being breached in advance and cause the information carried by the payment request to be leaked, thereby improving the security of the payment.
  • FIG. 4 is a flowchart showing an implementation of an advanced secure mobile payment method according to a second embodiment of the present invention, which is described in detail as follows:
  • step S401 the mobile terminal transmits a consumption request to the payment device.
  • the consumption request includes consumption information such as a payee account and a consumption amount.
  • a user may make a purchase on another terminal or the mobile terminal, and generate a merchandise order after the selected item is sent to the mobile terminal, and the mobile terminal sends a purchase request to the payment device according to the merchandise order.
  • the goods order includes the payee account and the amount of consumption.
  • the user can also directly send a purchase request to the payment device after inputting the payee account and the amount of consumption on the mobile terminal.
  • step S402 the payment device generates a payment request according to the consumption request, and transmits the payment request to the mobile terminal.
  • the payment device generates a payment request and sends a payment request to the mobile terminal after receiving the consumption request, wherein the payment request carries at least information such as a payer account, a payment password, a payee account, and a consumption amount,
  • the payment device encrypts sensitive information such as payment passwords.
  • the payment device is a mobile POS machine.
  • the mobile POS machine After receiving the consumption request, the mobile POS machine displays the consumption amount and reminds the user to perform a credit card and a payment operation such as a password on the payment device to obtain a payment party account.
  • the information such as the payment password is used, and when the payment operation is completed, the sensitive data such as the payment password is encrypted, and the payment request is transmitted to the mobile terminal.
  • step S403 the mobile terminal transmits a payment request to the background server.
  • step S404 the background server decrypts the encrypted sensitive data after receiving the payment request, and interacts with the payment background based on the payment request to complete the payment.
  • the background server after receiving the payment request from the mobile terminal, the background server first decrypts the encrypted sensitive data in the payment request to obtain sensitive data such as a payment password. After the decryption is completed, the background server sends the corresponding information to the payment platform according to the requirements of the payment platform such as the bank and the third-party platform, and completes the payment.
  • the interaction between the backend server and the payment platform can be as specified by any applicable conventional financial transaction standard, and will not be described here.
  • the background server authenticates the payment device, and if the authentication is passed, the mobile terminal sends the encrypted data for the sensitive data to the payment device. A key.
  • the background server in order to prevent the first key from being stolen during transmission, encrypts the first key before issuing the first key.
  • the background server adopts 3DES (Triple The Data Encryption Algorithm (encryption method) encrypts the first key.
  • the background server transmits a payment success notification to the mobile terminal to notify the user that the payment is successful.
  • the payment device encrypts the sensitive data by using the key, and then sends the payment request containing the sensitive data to the background server for decryption via the mobile terminal to complete the payment, and the key is uniformly managed by the background server, and the mobile terminal only performs data. Forwarding, so different keys can be issued for different payment devices or each transaction, which avoids the need to use the same key when the mobile terminal performs encryption and decryption, resulting in the entire payment system being cracked after the mobile terminal key is compromised or Copying increases the security of payment.
  • FIG. 5 is a flowchart of implementing a method for authenticating a payment device by a background server according to a second embodiment of the present invention, and transmitting a first key for encrypting sensitive data to the payment device after the authentication is successful, as follows:
  • step S501 the mobile terminal sends a data acquisition request to the background server, acquires random data, and transmits the random data to the payment device.
  • the mobile terminal sends a data acquisition request to the background server, and the background server sends a random number to the mobile terminal according to the data acquisition request of the mobile terminal, and the mobile terminal sends the random number to the payment device after receiving the random number.
  • step S502 the payment device calculates the random data to obtain the authentication data, and encrypts the authentication data with the preset key.
  • the payment device calculates the received random number to obtain the corresponding authentication data, and encrypts the authentication data with the preset second key before transmitting the authentication data.
  • the background server equips the payment device with an identity code that uniquely proves the identity information of the payment device, and presets a second key corresponding to the identity code at the payment device, and uses the authentication key before transmitting the authentication data.
  • the preset second key encrypts the authentication data and carries the identification code when returning the authentication data.
  • the payment device adopts 3DES (Triple Data Encryption) Algorithm, triple data encryption algorithm) Encryption method encrypts authentication data.
  • 3DES Triple Data Encryption Algorithm, triple data encryption algorithm
  • step S503 the background server acquires the encrypted authentication data through the mobile terminal, decrypts the encrypted authentication data, obtains the authentication data, and performs authentication.
  • the corresponding key is found according to the identity identification code carried in the authentication data, and the encrypted authentication data is decrypted, and the authentication data is authenticated. After the authentication is passed, the authentication result is returned to the mobile terminal.
  • step S504 the background server transmits a first key for encrypting the sensitive data to the payment device via the mobile terminal in response to the key acquisition request of the mobile terminal.
  • the background server sends a first key for encrypting the sensitive data to the mobile terminal, and the first key is sent by the mobile terminal to the mobile terminal.
  • the payment device On the payment device.
  • the background server sends a different key to the payment device through the mobile terminal after each authentication, and the payment device encrypts the authentication data by using the issued payment key, and the key issued by each authentication. Differently, it can prevent the payment device from being breached in advance and cause the information carried by the payment request to be leaked, thereby improving the security of the payment.
  • FIG. 6 is a structural diagram of an advanced secure mobile payment system according to a third embodiment of the present invention. For the convenience of description, only parts related to the embodiment of the present invention are shown.
  • the mobile secure payment system includes a mobile terminal 11, a payment device 12 connected to the mobile terminal, and a background server 13.
  • the mobile terminal 11 is configured to send a consumption request to the payment device, receive a payment request sent by the payment device, and send the payment request to the background server.
  • the purchase request carries the payee account number and the consumption amount.
  • the payment request is generated by the payment device according to the consumption request sent by the mobile terminal, and the payment request carries at least information such as the payer account, the payment password, the payee account, and the consumption amount.
  • the background server A payment request is obtained in the mobile terminal.
  • a user may make a purchase on another terminal or the mobile terminal, and generate a merchandise order after the selected item is sent to the mobile terminal, and the mobile terminal sends a purchase request to the payment device according to the merchandise order.
  • the goods order includes the payee account and the amount of consumption.
  • the user can also directly send a purchase request to the payment device after inputting the payee account and the amount of consumption on the mobile terminal.
  • the payment device 12 is configured to generate a payment request according to the consumption request sent by the mobile terminal, encrypt the sensitive data carried in the payment request, and send the payment request to the mobile terminal.
  • the payment device generates a payment request and sends the payment request to the mobile terminal after receiving the consumption request.
  • the payment request carries at least information such as a payer account, a payment password, a payee account, and a consumption amount.
  • the payment device encrypts sensitive information such as a payment password.
  • the payment device is a mobile POS machine.
  • the mobile POS machine After receiving the consumption request, the mobile POS machine displays the consumption amount and reminds the user to perform a payment operation such as swiping the payment device and inputting a payment password to obtain a payment party.
  • the background server 13 is configured to decrypt the encrypted sensitive data after receiving the payment request, and interact with the payment background based on the payment request to complete the payment.
  • FIG. 7 is a structural diagram of a background server according to a fourth embodiment of the present invention. For convenience of description, only parts related to the embodiment of the present invention are shown.
  • the background server includes a receiving unit 131, a decrypting unit 132, and a payment unit 133.
  • the receiving unit 131 is configured to receive a payment request sent by the mobile terminal.
  • the payment request is generated by the payment device according to the consumption request sent by the mobile terminal, and the payment request carries at least information such as the payer account, the payment password, the payee account, and the consumption amount, etc., in order to improve the security of the transaction, payment
  • the device encrypts sensitive information such as a payment password, and when the payment device transmits a payment request to the mobile terminal, the receiving unit 131 acquires a payment request from the mobile terminal.
  • the decryption unit 132 is configured to decrypt the encrypted sensitive data.
  • the decryption unit 131 after receiving the payment request from the mobile terminal, the decryption unit 131 first decrypts the encrypted sensitive data in the payment request to obtain sensitive data such as a payment password.
  • the payment unit 133 is configured to interact with the payment platform according to the payment request to complete the payment.
  • the payment unit 133 sends the corresponding information to the payment platform according to the requirements of the payment platform such as the bank and the third party platform, and completes the payment.
  • the interaction between the backend server and the payment platform can be as specified by any applicable conventional financial transaction standard and will not be described here.
  • the background server 13 further includes an authentication unit 134 for authenticating the payment device, and after the authentication succeeds, the first key for encrypting the sensitive data is sent to the payment device.
  • the background server 13 further includes a notification unit 135, configured to send a payment success notification to the mobile terminal after the payment is successful, to notify the user of the successful payment message.
  • the payment device encrypts the sensitive data by using the key, and then sends the payment request containing the sensitive data to the background server for decryption via the mobile terminal to complete the payment, and the key is uniformly managed by the background server, and the mobile terminal only performs data. Forwarding, so different keys can be issued for different payment devices or each transaction, which avoids the need to use the same key when encrypting and decrypting by the mobile terminal, so that the entire payment system is destroyed after a certain mobile terminal key is compromised. Cracking or copying improves the security of payment.
  • FIG. 8 is a structural diagram of an authentication unit according to a fourth embodiment of the present invention. For the convenience of description, only parts related to the embodiment of the present invention are shown.
  • the authentication unit includes a data sending module 1341, an authentication data receiving module 1342, and an authentication module 1343, a first key issuing module 1344.
  • the data sending module 1341 is configured to send random data to the payment device by using the mobile terminal in response to the data acquisition request of the mobile terminal.
  • the authentication unit 1341 sends a random number to the mobile terminal according to the data acquisition request of the mobile terminal, and after receiving the random number, the mobile terminal sends the random number to the payment device, and the payment device calculates the received random number to obtain a corresponding
  • the authentication data is encrypted with the preset second key before the authentication data is sent.
  • the background server equips the payment device with an identity code that uniquely proves the identity information of the payment device, and presets a second key corresponding to the identity code at the payment device, and uses the authentication key before transmitting the authentication data.
  • the preset second key encrypts the authentication data and carries the identification code when returning the authentication data.
  • the payment device adopts 3DES (Triple Data Encryption) Algorithm, triple data encryption algorithm) Encryption method encrypts authentication data.
  • 3DES Triple Data Encryption Algorithm, triple data encryption algorithm
  • the authentication data receiving module 1342 is configured to obtain encrypted authentication data sent by the mobile terminal.
  • the payment device transmits the encrypted authentication data to the mobile terminal, and the authentication data receiving module 1342 obtains the encrypted authentication data from the mobile terminal.
  • the authentication module 1343 is configured to decrypt the encrypted authentication data, obtain the authentication data, and perform authentication.
  • the authentication module 1343 finds a corresponding key according to the identity identification code carried in the authentication data and decrypts the encrypted authentication data. After the authentication is passed, the authentication result is returned to the mobile terminal.
  • the first key issuance module 1344 is configured to send, by the mobile terminal, a first key for encrypting the sensitive data to the payment device in response to the key acquisition request of the mobile terminal.
  • the secret first key issuing module 1344 sends a first key for encrypting the sensitive data to the mobile terminal, by the mobile terminal.
  • the first key is sent to the payment device.
  • the first key issuing module 1344 encrypts the first key before issuing the first key.
  • the first key sending module 1344 adopts 3DES (Triple)
  • the Data Encryption Algorithm encryption method
  • the background server sends a different key to the payment device through the mobile terminal after each authentication, and the payment device encrypts the authentication data by using the issued payment key, and the key issued by each authentication. Differently, it can prevent the payment device from being breached in advance and cause the information carried by the payment request to be leaked, thereby improving the security of the payment.

Abstract

一种高级安全的移动支付方法、装置及系统，适用于电子支付领域。所述方法包括：移动终端向支付设备发送消费请求(S401)；支付设备根据消费请求生成支付请求，并将支付请求发送到移动终端(S402)，支付请求携带有敏感数据，并且由支付设备对敏感数据进行了加密操作；移动终端将支付请求发送到后台服务器(S403)；后台服务器接收到支付请求后对加密的敏感数据进行解密，并基于支付请求与支付后台进行交互以完成支付(S404)。通过密钥对敏感数据进行加密后经由移动终端将包含敏感数据的支付请求发送到后台服务器进行解密以完成支付，密钥由后台服务器进行统一管理，移动终端只进行数据的转发，可以针对不同的支付设备或者每一次交易下发不同的密钥，提高了支付的安全性。

Description

一种高级安全的移动支付方法、装置及系统 技术领域
本发明属于电子支付领域，尤其涉及一种高级安全的移动支付方法、装置及系统。
 背景技术
随着科技的发展，移动POS机 (Mobile Point of sale，移动销售点终端)等移动支付设备也得到了广泛的应用，但移动支付设备在支付的过程中密码、交易信息等支付信息容易被截取，复制，导致用户的资金被盗刷。因此移动支付设备的安全性越来越受到重视。
现有技术通常采用在支付设备中对支付信息进行加密，再通过移动终端进行解密的方式提高支付密码、交易信息的安全性，但采用此种方式要求所有的移动终端都采用相同的密钥，当某一个移动终端的密码被破解时，整个系统的密码将全部被破解/复制，安全性较低。
 技术问题
本发明实施例提供一种高级安全的移动支付方法，旨在解决现有技术当某一个移动终端的密码被破解时，整个系统的密码将全部被破解/复制，安全性较低的问题。
 技术解决方案
本发明实施例是这样实现的，一种高级安全的移动支付方法，所述方法包括以下步骤： 接收移动终端发送的支付请求，所述支付请求由支付设备生成，所述支付请求携带有敏感数据，并且由所述支付设备对敏感数据进行了加密操作；对加密的敏感数据进行解密；根据所述支付请求与支付平台进行交互以完成支付；其中，所述支付请求中携带有支付方账户、支付密码、收款方账户以及消费金额，所述敏感数据至少包括支付密码。
本发明实施例还提供另一种高级安全的移动支付方法，所述方法包括以下步骤：移动终端向支付设备发送消费请求，所述消费请求中携带有收款方账号以及消费金额；所述支付设备根据所述消费请求生成支付请求，并将所述消费请求发送到移动终端，所述支付请求携带有敏感数据，并且由所述支付设备对敏感数据进行了加密操作； 所述移动终端将所述支付请求发送到后台服务器；所述后台服务器接收到所述支付请求后对加密的敏感数据进行解密，并基于所述支付请求与支付后台进行交互以完成支付。其中，所述支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额，所述敏感数据至少包括支付密码。
本发明实施例还提供一种高级安全的移动支付装置，所述装置包括：接收单元，用于接收移动终端发送的支付请求，所述支付请求由支付设备生成，所述支付请求携带有敏感数据，并且由所述支付设备对敏感数据进行了加密操作；解密单元，用于对加密的敏感数据进行解密；支付单元，用于根据所述支付请求与支付平台进行交互以完成支付；其中，所述支付请求携带有支付方账户、支付密码、收款方账户以及消费金额，所述敏感数据至少包括支付密码。
本发明实施例还提供一种高级安全的移动支付系统，所述系统包括：移动终端，用于向支付设备发送消费请求，接收所述支付设备发送的支付请求并将所述支付请求发送至后台服务器，所述消费请求中携带有收款方账号以及消费金额；支付设备，用于根据所述消费请求生成支付请求，对所述支付请求中携带的敏感数据进行加密并将所述支付请求发送至所述移动终端； 后台服务器，用于接收支付请求后对加密的敏感数据进行解密，并基于所述支付请求与支付后台进行交互以完成支付。其中，所述支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额，所述敏感数据至少包括支付密码。
 有益效果
本发明支付设备通过密钥对敏感数据进行加密后经由移动终端将包含敏感数据的支付请求发送到后台服务器进行解密以完成支付，这样，解密在后台服务器进行，密钥由后台服务器进行统一管理，移动终端只进行数据的转发，因此可以针对不同的支付设备或者每一次交易下发不同的密钥，提高了支付的安全性。
 附图说明
图1是本发明实施例提供的移动支付系统的架构图；
图2是本发明实施例提供的移动支付方法的实现流程图；
图3是本发明实施例提供的后台服务器对支付设备进行认证，认证成功后向支付设备下发用于对敏感数据加密的第一密钥的实现流程图；
图4是本发明本发明第二实施例提供的移动支付方法的实现流程图；
图5是本发明第二实施例提供的后台服务器对支付设备进行认证，认证成功后向支付设备下发用于对敏感数据加密的第一密钥的实现流程图；
图6是本发明第三实施例提供的移动支付系统的结构图；
图7是第四实施例提供的后台服务器的结构图；
图8示出了本发明第四实施例提供的认证单元的结构图。
 本发明的实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
本发明实施例支付设备通过密钥对敏感数据进行加密后经由移动终端将包含敏感数据的支付请求发送到后台服务器进行解密以完成支付，密钥由后台服务器进行统一管理，移动终端只进行数据的转发，因此可以针对不同的支付设备或者每一次交易下发不同的密钥，提高了支付的安全性。
图1示出了本发明实施例提供的移动支付系统的架构图，为了便于说明，仅示出了与本发明实施例相关的部分。
如图1所示，移动支付系统包括移动终端11、支付设备12和后台服务器13。
移动终端11可以是手机、个人数字助理（Personal Digital Assistant，PDA）、 数码相机、笔记本电脑、平板电脑等移动终端。
支付设备12可以是POS机、 自动售货机等可以生成支付请求的终端设备。
后台服务器13可以是第三方支付平台、银行等支付服务商的服务器。
作为本发明的一个实施例，移动终端11、和后台服务器13可以通过因特网、 局域网、广域网等通信链路进行通信，移动终端11与支付设备12通过近场通信、红外或者蓝牙、音频接口等方式进行通信。
在本发明实施例中，当用户需要进行消费时，移动终端11向支付设备12发起消费请求，支付设备12在接收到消费请求后生成支付请求，并发送支付请求到移动终端11，后台服务器13获取移动终端11转发的支付请求，根据支付请求完成支付。
图2示出了本发明实施例提供的高级安全的移动支付方法的实现流程图，该方法应用于后台服务器，详述如下：
在步骤S201中，接收移动终端发送的支付请求。
在本发明实施例中，支付请求由支付设备根据移动终端发送的消费请求生成，支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额等信息，为了提高交易的安全性，支付设备对支付密码等敏感信息进行加密，当支付设备将支付请求发送至移动终端时，后台服务器从移动终端中获取支付请求。
在步骤S202中，对加密的敏感数据进行解密。
在本发明实施例中，当接收到来自移动终端的支付请求后，后台服务器首先对支付请求中加密的敏感数据进行解密，得到支付密码等敏感数据。
在步骤S203中，根据支付请求与支付平台进行交互以完成支付。
在本发明实施例中，解密完成后后台服务器根据银行、第三方平台等支付平台的要求将相应的信息发送到支付平台，完成支付。后台服务器与支付平台之间的交互可以如任何适用的常规金融交易标准所规定的那样来进行，在此不再赘述。
作为本发明的一个实施例，为了提高支付的安全性，在步骤S201前，后台服务器还对支付设备进行认证，认证成功后向支付设备下发用于对敏感数据加密的第一密钥。
作为本发明的一个实施例，当支付完成后，后台服务器将支付成功通知发送到移动终端中，以通知用户支付成功的消息。
本发明实施例支付设备通过密钥对敏感数据进行加密后经由移动终端将包含敏感数据的支付请求发送到后台服务器进行解密以完成支付，密钥由后台服务器进行统一管理，移动终端只进行数据的转发，因此可以针对不同的支付设备或者每一次交易下发不同的密钥，避免了由移动终端进行加解密时需要使用相同的密钥，导致移动终端密钥被攻破后整个支付系统被破解或者复制，提高了支付的安全性。
图3示出了本发明实施例提供的后台服务器对支付设备进行认证，认证成功后向支付设备下发用于对敏感数据加密的第一密钥的实现流程图，详述如下：
在步骤S301中，后台服务器响应于移动终端的数据获取请求，通过移动终端向支付设备发送随机数据。
在本发明实施例中，后台服务器根据移动终端的数据获取请求向移动终端发送随机数，移动终端接收到该随机数后将随机数发送到支付设备中由支付设备对接收到的随机数进行计算得到相应的认证数据，并在发送认证数据前用预设的第二密钥对认证数据进行加密。
作为本发明的一个实施例，后台服务器为支付设备配备了唯一证明支付设备身份信息的身份识别码，并在支付设备预设了与身份识别码对应的第二密钥，在传输认证数据前利用预设的第二密钥对认证数据进行加密，并在返回认证数据时携带身份识别码。
作为本发明的一个实施例，支付设备采用3DES（Triple Data Encryption Algorithm，三重数据加密算法）加密方法对认证数据进行加密。
在步骤S302中，获取移动终端发送的加密的认证数据。
在本发明实施例中，支付设备将加密的认证数据发送到移动终端，后台服务器从移动终端获取加密的认证数据。
在步骤S303中，对加密的认证数据进行解密，得到认证数据并进行认证。
在本发明实施例中，服务器根据认证数据中携带的身份识别码找出对应的密钥并对加密的认证数据进行解密。当认证通过后，向移动终端返回认证结果。
在步骤S304中，响应于移动终端的密钥获取请求，通过移动终端向支付设备发送用于对敏感数据加密的第一密钥。
在本发明实施例中，当认证通过后，响应于移动终端的密钥获取请求，后台服务器向移动终端发送用于对敏感数据加密的第一密钥，由移动终端将第一密钥发送到支付设备上。
作为本发明的一个实施例，为了防止第一密钥的在传输过程中被窃取，后台服务器在下发第一密钥前对第一密钥进行加密。优选地，后台服务器采用3DES（Triple Data Encryption Algorithm，三重数据加密算法）加密方法对第一密钥进行加密。
本发明实施例中，后台服务器在每一次认证后都通过移动终端向支付设备发送不同的密钥，支付设备利用下发的支付密钥对认证数据进行加密，由于每一次认证下发的密钥不同，能够防止支付设备被提前攻破导致支付请求携带的信息外泄，提高了支付的安全性。
图4示出了本发明第二实施例提供的高级安全的移动支付方法的实现流程图，详述如下：
在步骤S401中，移动终端向支付设备发送消费请求。
在本发明实施例中，消费请求中包括收款方账户以及消费金额等消费信息。
作为本发明的一个实施例，用户可以在其他终端或该移动终端上进行购物，并且在选定商品后生成商品订单并发送到移动终端上，移动终端根据商品订单向支付设备发送消费请求。可以理解，商品订单中包括收款方账户以及消费金额。
作为本发明的另一个实施例，用户还可以直接在移动终端上输入收款方账户以及消费金额后直接向支付设备发送消费请求。
在步骤S402中，支付设备根据消费请求生成支付请求，并将支付请求发送到移动终端。
在本发明实施例中，支付设备在接收到消费请求后生成支付请求并将支付请求发送到移动终端，其中，支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额等信息，为了提高交易的安全性，支付设备对支付密码等敏感信息进行加密。
作为本发明的一个实施例，支付设备为移动pos机，当接收到消费请求后，移动pos机显示出消费金额并提醒用户在支付设备上进行刷卡以及输入密码等支付操作以获得支付方账号、支付密码等信息，当支付操作完成时，对支付密码等敏感数据进行加密，将支付请求发送至移动终端。
在步骤S403中，移动终端将支付请求发送到后台服务器。
在步骤S404中，后台服务器接收到支付请求后对加密的敏感数据进行解密，并基于支付请求与支付后台进行交互以完成支付。
在本发明实施例中，当接收到来自移动终端的支付请求后，后台服务器首先对支付请求中加密的敏感数据进行解密，得到支付密码等敏感数据。解密完成后后台服务器根据银行、第三方平台等支付平台的要求将相应的信息发送到支付平台，完成支付。后台服务器与支付平台之间的交互可以如任何适用的常规金融交易标准所规定的那样来进行，在此不再赘述
作为本发明的一个实施例，为了提高支付的安全性，在步骤S401前，后台服务器对还对支付设备进行认证，若认证通过则通过移动终端向支付设备下发用于对敏感数据加密的第一密钥。
作为本发明的一个实施例，为了防止第一密钥的在传输过程中被窃取，后台服务器在下发第一密钥前对第一密钥进行加密。优选地，后台服务器采用3DES（Triple Data Encryption Algorithm，三重数据加密算法）加密方法对第一密钥进行加密。
作为本发明的一个实施例，当支付完成后，后台服务器将支付成功通知发送到移动终端中，以通知用户支付成功的消息。
本发明实施例支付设备通过密钥对敏感数据进行加密后经由移动终端将包含敏感数据的支付请求发送到后台服务器进行解密以完成支付，密钥由后台服务器进行统一管理，移动终端只进行数据的转发，因此可以针对不同的支付设备或者每一次交易下发不同的密钥，避免了由移动终端进行加解密时需要使用相同的密钥，导致移动终端密钥被攻破后整个支付系统被破解或者复制，提高了支付的安全性。
图5示出了本发明第二实施例提供的后台服务器对支付设备进行认证，认证成功后向支付设备下发用于对敏感数据加密的第一密钥的实现流程图，详述如下：
在步骤S501中，移动终端向后台服务器发送数据获取请求，获取随机数据并将随机数据发送到支付设备。
在本发明实施例中，移动终端向后台服务器发送数据获取请求，后台服务器根据移动终端的数据获取请求向移动终端发送随机数，移动终端接收到该随机数后将该随机数发送到支付设备中。
在步骤S502中，支付设备对随机数据进行计算得到认证数据，并用预设的密钥对认证数据进行加密。
在本发明实施例中，支付设备对接收到的随机数进行计算得到相应的认证数据，并在发送认证数据前用预设的第二密钥对认证数据进行加密。
作为本发明的一个实施例，后台服务器为支付设备配备了唯一证明支付设备身份信息的身份识别码，并在支付设备预设了与身份识别码对应的第二密钥，在传输认证数据前利用预设的第二密钥对认证数据进行加密，并在返回认证数据时携带身份识别码。
作为本发明的一个实施例，支付设备采用3DES（Triple Data Encryption Algorithm，三重数据加密算法）加密方法对认证数据进行加密。
在步骤S503中，后台服务器通过移动终端获取加密的认证数据，对加密的认证数据进行解密，得到认证数据并进行认证。
在本发明实施例中，根据认证数据中携带的身份识别码找出对应的密钥并对加密的认证数据进行解密，并对认证数据进行认证，当认证通过后，向移动终端返回认证结果。
在步骤S504中，后台服务器响应于移动终端的密钥获取请求，通过移动终端向支付设备发送用于对敏感数据加密的第一密钥。
在本发明实施例中，当认证通过后，响应于移动终端的密钥获取请求，后台服务器向移动终端发送用于对敏感数据加密的第一密钥，由移动终端将第一密钥发送到支付设备上。
本发明实施例中，后台服务器在每一次认证后都通过移动终端向支付设备发送不同的密钥，支付设备利用下发的支付密钥对认证数据进行加密，由于每一次认证下发的密钥不同，能够防止支付设备被提前攻破导致支付请求携带的信息外泄，提高了支付的安全性。
本领域普通技术人员可以理解，实现上述实施例方法中的全部或者部分步骤是可以通过程序来指令相关的硬件来完成的，上述的程序可以存储于一计算机可读取存储介质中，上述的存储介质，如ROM/RAM、磁盘、光盘、闪盘等。
图6示出了本发明第三实施例提供的高级安全的移动支付系统的结构图，为了便于说明，仅示出了与本发明实施例相关的部分。
如图6所示，移动安全支付系统包括移动终端11、与移动终端连接的支付设备12以及后台服务器13。
移动终端11，用于向支付设备发送消费请求，接收支付设备发送的支付请求并将支付请求发送至后台服务器。
在本发明实施例中，消费请求中携带有收款方账号以及消费金额。支付请求由支付设备根据移动终端发送的消费请求生成，支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额等信息，当支付设备将支付请求发送至移动终端时，后台服务器从移动终端中获取支付请求。
作为本发明的一个实施例，用户可以在其他终端或该移动终端上进行购物，并且在选定商品后生成商品订单并发送到移动终端上，移动终端根据商品订单向支付设备发送消费请求。可以理解，商品订单中包括收款方账户以及消费金额。
作为本发明的另一个实施例，用户还可以直接在移动终端上输入收款方账户以及消费金额后直接向支付设备发送消费请求。
支付设备12，用于根据移动终端发送的消费请求生成支付请求，对支付请求中携带的敏感数据进行加密并将支付请求发送至移动终端。
在本发明实施例中，支付设备在接收到消费请求后生成支付请求并将支付请求发送到移动终端。其中，支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额等信息，为了提高交易的安全性，支付设备对支付密码等敏感信息进行加密。
作为本发明的一个实施例，支付设备为移动pos机，当接收到消费请求后，移动pos机显示出消费金额并提醒用户在支付设备上进行刷卡以及输入支付密码等支付操作以获得支付方的账号、支付密码等信息，当支付操作完成时，对支付密码等敏感数据进行加密，并将支付请求发送至移动终端。
后台服务器13，用于接到支付请求后对加密的敏感数据进行解密，并基于支付请求与支付后台进行交互以完成支付。
图7示出了本发明第四实施例提供的后台服务器的结构图，为了便于说明，仅示出了与本发明实施例相关的部分。
后台服务器包括接收单元131、解密单元132以及支付单元133。
接收单元131，用于接收移动终端发送的支付请求。
在本发明实施例中，支付请求由支付设备根据移动终端发送的消费请求生成，支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额等信息，为了提高交易的安全性，支付设备对支付密码等敏感信息进行加密，当支付设备将支付请求发送至移动终端时，接收单元131从移动终端中获取支付请求。
解密单元132，用于对加密的敏感数据进行解密。
在本发明实施例中，当接收到来自移动终端的支付请求后，解密单元131首先对支付请求中加密的敏感数据进行解密，得到支付密码等敏感数据。
支付单元133，用于根据支付请求与支付平台进行交互以完成支付。
在本发明实施例中，解密完成后支付单元133根据银行、第三方平台等支付平台的要求将相应的信息发送到支付平台，完成支付。后台服务器与支付平台之间的交互可以如任何适用的常规金融交易标准所规定的那样来进行，在此不再赘述。
作为本发明的一个实施例，后台服务器13还包括认证单元134，用于对支付设备进行认证，认证成功后向支付设备下发用于对敏感数据加密的第一密钥。
作为本发明的一个实施例，后台服务器13还包括通知单元135，用于在支付成功后将支付成功通知发送到移动终端中，以通知用户支付成功的消息。
本发明实施例支付设备通过密钥对敏感数据进行加密后经由移动终端将包含敏感数据的支付请求发送到后台服务器进行解密以完成支付，密钥由后台服务器进行统一管理，移动终端只进行数据的转发，因此可以针对不同的支付设备或者每一次交易下发不同的密钥，避免了由移动终端进行加解密时需要使用相同的密钥，导致某一个移动终端密钥被攻破后整个支付系统被破解或者复制，提高了支付的安全性。
图8示出了本发明第四实施例提供的认证单元的结构图，为了便于说明，仅示出了与本发明实施例相关的部分。
认证单元包括数据发送模块1341、认证数据接收模块1342、认证模块1343第一密钥下发模块1344。
数据发送模块1341，用于响应于移动终端的数据获取请求，通过移动终端向支付设备发送随机数据。
在本发明实施例中，认证单元1341根据移动终端的数据获取请求向移动终端发送随机数，移动终端接收到该随机数后发送到支付设备中由支付设备对接收到的随机数进行计算得到相应的认证数据，并在发送认证数据前用预设的第二密钥对认证数据进行加密。
作为本发明的一个实施例，后台服务器为支付设备配备了唯一证明支付设备身份信息的身份识别码，并在支付设备预设了与身份识别码对应的第二密钥，在传输认证数据前利用预设的第二密钥对认证数据进行加密，并在返回认证数据时携带身份识别码。
作为本发明的一个实施例，支付设备采用3DES（Triple Data Encryption Algorithm，三重数据加密算法）加密方法对认证数据进行加密。
认证数据接收模块1342，用于获取移动终端发送的加密的认证数据。
在本发明实施例中，支付设备将加密的认证数据发送到移动终端，认证数据接收模块1342从移动终端获取加密的认证数据。
认证模块1343，用于对加密的认证数据进行解密，得到认证数据并进行认证。
在本发明实施例中，认证模块1343根据认证数据中携带的身份识别码找出对应的密钥并对加密的认证数据进行解密。当认证通过后，向移动终端返回认证结果。
第一密钥下发模块1344，用于响应于移动终端的密钥获取请求，通过移动终端向支付设备发送用于对敏感数据加密的第一密钥。
在本发明实施例中，当认证通过后，响应于移动终端的密钥获取请求，密第一密钥下发模块1344向移动终端发送用于对敏感数据加密的第一密钥，由移动终端将第一密钥发送到支付设备上。
作为本发明的一个实施例，为了防止第一密钥的在传输过程中被窃取，第一密钥下发模块1344在下发第一密钥前对第一密钥进行加密。优选地，第一密钥下发模块1344采用3DES（Triple Data Encryption Algorithm，三重数据加密算法）加密方法对第一密钥进行加密。
本发明实施例中，后台服务器在每一次认证后都通过移动终端向支付设备发送不同的密钥，支付设备利用下发的支付密钥对认证数据进行加密，由于每一次认证下发的密钥不同，能够防止支付设备被提前攻破导致支付请求携带的信息外泄，提高了支付的安全性。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (17)

  1. 一种高级安全的移动支付方法，其特征在于，所述方法包括以下步骤：
    接收移动终端发送的支付请求，所述支付请求由支付设备生成，所述支付请求携带有敏感数据，并且由所述支付设备对敏感数据进行了加密操作；
    对加密的敏感数据进行解密；
    根据所述支付请求与支付平台进行交互以完成支付；
    其中，所述支付请求中携带有支付方账户、支付密码、收款方账户以及消费金额，所述敏感数据至少包括支付密码。
  2. 如权利要求1所述的移动支付方法，其特征在于，在所述接收来自移动终端发送的支付请求的步骤之前还包括：
    对所述支付设备进行认证，认证成功后向所述支付设备下发用于对所述敏感数据加密的第一密钥。
  3. 如权利要求2所述的移动支付方法，其特征在于，所述对支付设备进行认证，认证成功后向所述支付设备下发用于对所述敏感数据加密的第一密钥的步骤具体为：
    响应于所述移动终端的数据获取请求，通过所述移动终端向所述支付设备发送随机数据；
    获取所述移动终端发送的认证数据，所述认证数据由所述支付设备根据所述移动终端发送的随机数据进行计算得到，并用预设的第二密钥对所述认证数据进行加密；
    对所述加密的认证数据进行解密，得到所述认证数据并进行认证；
    响应于所述移动终端的密钥获取请求，通过所述移动终端向所述支付设备发送用于对敏感数据加密的第一密钥；
  4. 如权利要求1所述的移动支付方法，其特征在于，所述方法还包括：
    支付成功后将支付成功通知发送到移动终端。
  5. 一种高级安全的移动支付方法，其特征在于，所述方法包括以下步骤：
    移动终端向支付设备发送消费请求，所述消费请求中携带有收款方账号以及消费金额；
    所述支付设备根据所述消费请求生成支付请求，并将所述消费请求发送到移动终端，所述支付请求携带有敏感数据，并且由所述支付设备对敏感数据进行了加密操作；
    所述移动终端将所述支付请求发送到后台服务器；
    所述后台服务器接收到所述支付请求后对加密的敏感数据进行解密，并基于所述支付请求与支付后台进行交互以完成支付。
    其中，所述支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额，所述敏感数据至少包括支付密码。
  6. 如权利要求5所述的移动支付方法，其特征在于，所述方法还包括以下步骤：
    所述后台服务器对所述支付设备进行认证，若认证通过则通过所述移动终端向所述支付设备下发用于对所述敏感数据加密的第一密钥。
  7. 如权利要求6所述的移动支付方法，其特征在于，所述后台服务器对所述支付设备进行认证，若认证通过则通过所述移动终端向支付设备下发用于对敏感数据加密的第一密钥的步骤具体为：
    所述移动终端向所述后台服务器发送数据获取请求，获取随机数据并将所述随机数据发送到所述支付设备；
    所述支付设备对随机数据进行计算得到认证数据，并用预设的密钥对所述认证数据进行加密。
    后台服务器通过移动终端获取加密的认证数据，对所述加密的认证数据进行解密，得到认证数据并进行认证；
    后台服务器响应于移动终端的密钥获取请求，通过移动终端向支付设备发送用于对所述敏感数据加密的第一密钥。
  8. 如权利要求5所述的移动支付方法，其特征在于，所述方法还包括：
    所述后台服务器在支付成功后向所述移动终端发送支付成功通知。
  9. 一种高级安全的移动支付装置，其特征在于，所述装置包括：
    接收单元， 用于接收移动终端发送的支付请求，所述支付请求由支付设备生成，所述支付请求携带有敏感数据，并且由所述支付设备对敏感数据进行了加密操作；
    解密单元，用于对加密的敏感数据进行解密；
    支付单元，用于根据所述支付请求与支付平台进行交互以完成支付；
    其中，所述支付请求携带有支付方账户、支付密码、收款方账户以及消费金额，所述敏感数据至少包括支付密码。
  10. 如权利要求9所述的移动支付装置，其特征在于，所述装置还包括：
    认证单元，用于对支付设备进行认证，认证成功后向所述支付设备下发用于对所述敏感数据加密的第一密钥。
  11. 如权利要求10所述的移动支付装置，其特征在于，所述认证单元包括：
    数据发送模块，用于响应于所述移动终端的数据获取请求，通过所述移动终端向所述支付设备发送随机数据；
    认证数据接收模块，用于获取所述移动终端发送的认证数据，所述认证数据由所述支付设备根据所述移动终端发送的随机数据进行计算得到，并用预设的第二密钥对所述认证数据进行加密；
    认证模块，用于对所述加密的认证数据进行解密，得到所述认证数据并进行认证；
    第一密钥下发模块，用于响应于所述移动终端的密钥获取请求，通过所述移动终端向所述支付设备发送用于对敏感数据加密的第一密钥。
  12. 如权利要求9所述的移动支付装置，其特征在于，所述装置还包括：
    通知单元，用于支付成功后将支付成功通知发送到移动终端。
  13. 一种高级安全的移动支付系统，其特征在于，所述系统包括：
    移动终端，用于向支付设备发送消费请求，接收所述支付设备发送的支付请求并将所述支付请求发送至后台服务器，所述消费请求中携带有收款方账号以及消费金额；
    支付设备，用于根据所述消费请求生成支付请求，对所述支付请求中携带的敏感数据进行加密并将所述支付请求发送至所述移动终端；
    后台服务器，用于接收支付请求后对加密的敏感数据进行解密，并基于所述支付请求与支付后台进行交互以完成支付。
    其中，所述支付请求至少携带支付方账户、支付密码、收款方账户以及消费金额，所述敏感数据至少包括支付密码。
  14. 如权利要求13所述的移动支付系统，其特征在于，所述后台服务器包括：
    接收单元， 用于接收所述移动终端发送的支付请求；
    解密单元，用于对加密的敏感数据进行解密；
    支付单元，用于根据所述支付请求与支付平台进行交互以完成支付。
  15. 如权利要求14所述的移动支付系统，其特征在于，所述后台服务器还包括：
    认证单元，用于对所述支付设备进行认证，认证成功后向支付设备下发用于对敏感数据加密的第一密钥。
  16. 如权利要求15所述的移动支付系统，其特征在于，所述认证单元包括：
    数据发送模块，用于响应于所述移动终端的数据获取请求，通过所述移动终端向所述支付设备发送随机数据；
    认证数据接收模块，用于获取所述移动终端发送的认证数据，所述认证数据由所述支付设备根据所述移动终端发送的随机数据进行计算得到，并用预设的第二密钥对所述认证数据进行加密；
    认证模块，用于对所述加密的认证数据进行解密，得到所述认证数据并进行认证；
    第一密钥下发模块，用于响应于所述移动终端的密钥获取请求，通过所述移动终端向所述支付设备发送用于对敏感数据加密的第一密钥。
  17. 如权利要求14所述的移动支付系统，其特征在于，所述后台服务器还包括：
    通知单元，用于支付成功后将支付成功通知发送到所述移动终端。
PCT/CN2016/084890 2015-06-26 2016-06-06 一种高级安全的移动支付方法、装置及系统 WO2016206530A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510366135.4 2015-06-26
CN201510366135.4A CN105046489A (zh) 2015-06-26 2015-06-26 一种移动支付方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2016206530A1 true WO2016206530A1 (zh) 2016-12-29

Family

ID=54453014

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/084890 WO2016206530A1 (zh) 2015-06-26 2016-06-06 一种高级安全的移动支付方法、装置及系统

Country Status (2)

Country Link
CN (1) CN105046489A (zh)
WO (1) WO2016206530A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11645642B2 (en) * 2017-10-26 2023-05-09 Jack Shauh Mobile payment system and method using a mobile payment device without an installed application

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105046489A (zh) * 2015-06-26 2015-11-11 深圳国微技术有限公司 一种移动支付方法、装置及系统
CN106228356A (zh) * 2016-07-13 2016-12-14 广东商联支付网络技术有限公司 一种使用手环替代实体会员卡进行支付的方法及装置
CN106209386B (zh) * 2016-10-10 2019-09-27 中国银行股份有限公司 一种实现安全认证的方法、装置和系统
CN107085791A (zh) * 2017-04-19 2017-08-22 深圳市金立通信设备有限公司 一种电子支付方法及终端
CN107516196A (zh) * 2017-09-04 2017-12-26 杭州哲信信息技术有限公司 一种移动支付系统及其移动支付方法
CN108804942A (zh) * 2018-05-29 2018-11-13 广东通莞科技股份有限公司 一种移动支付中敏感数据识别系统
CN109493023B (zh) * 2018-10-17 2022-01-25 珠海横琴井通容智科技信息有限公司 基于防篡改加密算法的移动支付清结算方法
CN112036859B (zh) * 2020-08-31 2022-05-27 百富计算机技术（深圳）有限公司 安全支付方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060287965A1 (en) * 2005-06-15 2006-12-21 E.E. System Corporation Method and system for real time online debit transactions
CN102354418A (zh) * 2011-10-09 2012-02-15 钱袋网（北京）信息技术有限公司 交易信息处理系统及方法
CN103136668A (zh) * 2011-11-28 2013-06-05 中兴通讯股份有限公司 终端支付方法、终端和支付平台
CN104240073A (zh) * 2014-10-11 2014-12-24 上海众人科技有限公司 一种基于预付卡的脱机支付方法和系统
CN105046489A (zh) * 2015-06-26 2015-11-11 深圳国微技术有限公司 一种移动支付方法、装置及系统

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109508983A (zh) * 2012-01-05 2019-03-22 维萨国际服务协会 用转换进行数据保护

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060287965A1 (en) * 2005-06-15 2006-12-21 E.E. System Corporation Method and system for real time online debit transactions
CN102354418A (zh) * 2011-10-09 2012-02-15 钱袋网（北京）信息技术有限公司 交易信息处理系统及方法
CN103136668A (zh) * 2011-11-28 2013-06-05 中兴通讯股份有限公司 终端支付方法、终端和支付平台
CN104240073A (zh) * 2014-10-11 2014-12-24 上海众人科技有限公司 一种基于预付卡的脱机支付方法和系统
CN105046489A (zh) * 2015-06-26 2015-11-11 深圳国微技术有限公司 一种移动支付方法、装置及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11645642B2 (en) * 2017-10-26 2023-05-09 Jack Shauh Mobile payment system and method using a mobile payment device without an installed application

Also Published As

Publication number Publication date
CN105046489A (zh) 2015-11-11

Similar Documents

Publication Publication Date Title
WO2016206530A1 (zh) 一种高级安全的移动支付方法、装置及系统
WO2020062642A1 (zh) 基于区块链的电子合同签署方法、装置、设备及存储介质
WO2014175538A1 (ko) Puf 기반 하드웨어 otp 제공 장치 및 이를 이용한 2-factor 인증 방법
WO2014139343A1 (zh) 密钥下载方法、管理方法、下载管理方法及装置和系统
US5796840A (en) Apparatus and method for providing secured communications
WO2014139341A1 (zh) 密钥管理方法及系统
US7697691B2 (en) Method of delivering Direct Proof private keys to devices using an on-line service
US9800562B2 (en) Credential recovery
US6058478A (en) Apparatus and method for a vetted field upgrade
WO2015093734A1 (ko) 빠른 응답 코드를 이용한 인증 시스템 및 방법
US8386796B2 (en) Information processing apparatus and information management method
WO2014063455A1 (zh) 即时通信方法和系统
WO2018072261A1 (zh) 信息加密方法及装置、信息解密方法及装置及终端
WO2017133204A1 (zh) 银行卡密码保护方法及系统
WO2015037887A1 (ko) 스마트 칩 인증 서버 및 그 방법
WO2020186775A1 (zh) 业务数据提供方法、装置、设备及计算机可读存储介质
WO2019039865A1 (ko) 인증 단말, 인증 장치 및 이들을 이용한 인증 방법 및 시스템
CN112507296B (zh) 一种基于区块链的用户登录验证方法及系统
WO2020034527A1 (zh) 用户个人信息加密授权方法、装置、设备及可读存储介质
TW201223225A (en) Method for personal identity authentication utilizing a personal cryptographic device
WO2017016272A1 (zh) 一种虚拟资源数据的处理方法、装置及系统
CN112003697A (zh) 密码模块加解密方法、装置、电子设备及计算机存储介质
WO2019165571A1 (zh) 一种传输数据的方法及系统
WO2020032351A1 (ko) 익명 디지털 아이덴티티 수립 방법
WO2014071703A1 (zh) 通信信息传输方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16813646

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 28/05/2018)

122 Ep: pct application non-entry in european phase

Ref document number: 16813646

Country of ref document: EP

Kind code of ref document: A1