WO2017016037A1

WO2017016037A1 - Payment data safety verification method, third-party payment platform and commercial platform

Info

Publication number: WO2017016037A1
Application number: PCT/CN2015/088496
Authority: WO
Inventors: 陈历伟
Original assignee: 宇龙计算机通信科技(深圳)有限公司
Priority date: 2015-07-29
Filing date: 2015-08-30
Publication date: 2017-02-02
Also published as: CN105574726A

Abstract

Disclosed are a payment data safety verification method, a third-party payment platform and a commercial platform. The method discloses: a third-party payment platform receiving payment data sent by a first platform, wherein the first platform has a first domain name and a first IP address and the payment data contains information about a commercial platform generating the payment data and an order number; the third-party payment platform judging whether the first domain name and the first IP address are a recorded domain name and a recorded IP address, wherein the recorded domain name and the recorded IP address are pre-stored in the third-party payment platform; if the first domain name and the first IP address are the recorded domain name and the recorded IP address, normally completing payment according to the payment data; and if the first domain name and the first IP address are not the recorded domain name and the recorded IP address, sending the first domain name, the first IP address and the order number to the commercial platform for verification according to the information about the commercial platform. In the present application, the problem that a phishing platform cheats a "fish" to pay the bill for a phisher using payment data can be avoided.

Description

Payment data security verification method, third-party payment platform, and commercial platform

Technical field

The invention relates to the field of internet, in particular to a payment data security verification method, a third party payment platform and a commercial platform.

Background technique

In order to realize online shopping, the prior art provides a payment system. As shown in FIG. 1 , the payment system includes: a commercial platform 210, a fishing platform 220, and a third-party payment platform 230. The commercial platform 210 is connected to the third party payment platform 230. In order to be able to obtain payment data from the commercial platform 210 and send the payment data to the third-party payment platform 230, the phishing platform 220 connects the commercial platform 210 and the third-party payment platform 230, respectively.

Under normal conditions, commercial platforms 210, such as Taobao and Jingdong, etc., can display various commodities for selection. In the normal shopping, after the consumer selects the appropriate commodity on the commercial platform 210 and confirms the payment, the commercial platform 210 generates the payment data and the order record according to the consumer's shopping, wherein the payment platform records the commercial platform. The information and the order number, the information of the commercial platform is used to determine which commercial platform the platform that generates the payment data is, the order number is used to indicate the behavior of the consumer to purchase the goods, the order number and the shipping address are recorded in the order record, and the like. Then, the consumer then pays the payment to the third-party payment platform 230, such as a bank, by electronic transfer, to complete the payment of the order number. After receiving the payment, the third-party payment platform 230 obtains the corresponding commercial platform according to the order number, and sends a message to the commercial platform 210 that the consumer has completed the payment for the order number. After receiving the notification, the commercial platform 210 will find the corresponding shipping address according to the order number in the order record, thereby sending the goods to the corresponding shipping address.

However, referring to Figure 2, in an abnormal state, the angler is fishing,

Step 1: The angler will first select the target item on the commercial platform 210. After the phishers select the target merchandise on the commercial platform 210 and confirm the payment, the phishing platform 220 intercepts the payment data sent by the commercial platform 210 to the third-party payment platform 230.

Step 2: The angler sets and displays a number of commodities on the fishing platform 220, wherein the goods The price is set to be the same as the price of the target item purchased by the angler on the commercial platform 210, so the angler can bind the payment data to the corresponding item.

Step 3: The fisherman purchases goods on the fishing platform 220 and determines the payment.

Step 4: After the fisherman purchases the product on the fishing platform 220 and determines the payment, the fishing platform 220 sends the intercepted payment data to the third-party payment platform 230.

Step 5: The fisherman sends the payment to the third party payment platform 230 by electronic transfer.

Step 6: After receiving the payment, the third-party payment platform 230 obtains the corresponding commercial platform according to the order number, and sends a message to the commercial platform 210 that the consumer has completed the payment for the order number.

Step 7: After receiving the notification, the commercial platform 210 will find the corresponding shipping address according to the order number in the order record, thereby sending the goods to the corresponding shipping address.

Obviously, the shipping address here is the address of the angler, so the item will be sent to the angler. That is, the fisherman pays for the angler and causes economic loss to the fisherman.

Summary of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a payment data security verification method, a third-party payment platform, and a commercial platform, which can prevent the phishing platform from using the payment data to deceive the phishers to pay for the phishers.

A first aspect of the present invention provides a payment data security verification method, including: a third-party payment platform receives payment data sent by a first platform, where the first platform has a first domain name and a first IP address, The payment data includes information and an order number of the commercial platform that generates the payment data; and the third-party payment platform determines whether the first domain name and the first IP address are a record domain name and a record IP address, and the record domain name and The filing IP address is pre-stored in the third-party payment platform; if the first domain name and the first IP address are the filing domain name and the filing IP address, the payment is normally completed according to the payment data. If the first domain name and the first IP address are not the filing domain name and the filing IP address, then the first domain name, the first IP address, and the The order number is sent to the commercial platform for verification.

Optionally, the method further includes: if the commercial platform verifies that the first domain name and/or the first IP address is the modified domain name and IP address of the commercial platform, accepting the sending by the commercial platform Confirming the message and storing the first domain name and the first IP address locally as the filing domain name and the filing IP address of the commercial platform.

Optionally, the method further includes: accepting a negative message sent by the commercial platform if the commercial platform verifies that the first domain name and/or the first IP address is not a domain name and an IP address of the commercial platform And sending a prompt message to the paying party, the prompt message prompting that the first platform is an illegal platform.

A second aspect of the present invention provides a payment data security verification method, including: a commercial platform receiving order information sent by a payer, and generating payment data according to the order information, wherein the payment data includes a domain name of a commercial platform and The IP address, the payment data further includes an order number of the current payment; and the payment data is sent to the third-party payment platform for verification by the third-party payment platform.

Optionally, the method further includes: receiving a first domain name, a first IP address, and an order number sent by the third-party payment platform; determining whether the first domain name and the first IP address are domain names of the platform and The IP address; if yes, sending a determination message to the third-party payment platform, and if not, sending a negative message to the third-party payment platform, and stopping the processing flow of the order number.

A third aspect of the present invention provides a third-party payment platform, including: a receiving module, a determining module, and an executing module,

The receiving module is configured to receive payment data sent by the first platform, where the first platform has a first domain name and a first IP address, and the payment data includes information of a commercial platform that generates the payment data. And the order number;

The determining module is configured to obtain the first domain name and the first IP address of the first platform, and determine whether the first domain name and the first IP address are a record domain name and a record IP address. The record domain name and the filing IP address are pre-stored in the third-party payment platform;

The executing module is configured to normally complete payment according to the payment data when the first domain name and the first IP address are the filing domain name and the filing IP address, in the first domain name and the The first IP address is not the filing domain name and the filing IP address, and the first domain name, the first IP address, and the order number are sent to the commercial platform according to the information of the commercial platform. verification.

Optionally, the platform further includes a filing module, where the filing module is configured to: when the commercial platform verifies that the first domain name and/or the first IP address is a modified domain name and an IP address of the commercial platform, Accepting the confirmation message sent by the commercial platform, and storing the first domain name and the first IP address locally as the filing domain name and the filing IP address of the commercial platform.

Optionally, the platform further includes a prompting module, where the prompting module is configured to accept the first domain name and/or the first IP address is not the domain name and IP address of the commercial platform when the commercial platform is verified Determining a negative message sent by the commercial platform, and sending a prompt message to the paying party, the prompt message The first platform is shown as an illegal platform.

A fourth aspect of the present invention provides a commercial platform, where the platform includes a receiving module and a sending module, where the receiving module is configured to receive order information sent by a paying party, and generate payment data according to the order information, where The payment data includes a domain name and an IP address of the commercial platform, and the payment data further includes an order number of the current payment; the sending module is configured to send the payment data to the third-party payment platform for the third party The payment platform is verified.

Optionally, the platform further includes a determining module, where the receiving module is further configured to receive a first domain name, a first IP address, and an order number sent by the third-party payment platform, where the determining module is configured to determine the first Whether the domain name and the first IP address are the domain name and the IP address of the platform, and when the determination result is yes, sending a determination message to the third-party payment platform, and when the determination result is no, the The three-party payment platform sends a negative message and stops the processing flow of the order number.

Since the formal business platform pre-registers the domain name and IP address of the platform in the third-party payment platform before the operation, after receiving the payment data, the third-party payment platform will obtain the first domain name of the first platform that sends the payment data. And the first IP address, and determining whether the first domain name and the first IP address of the first platform that sends the payment data are the record domain name and the record IP address, and if so, the first platform is a formal commercial platform, and the third party payment platform The payment is completed normally. If not, the first platform is an illegal commercial platform. The third-party payment platform sends the first domain name, the first IP address, and the order number to the commercial platform that generates the payment data for verification. It can prevent the phishing platform from using the payment data to deceive the phishers to pay for the phishers.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a schematic structural diagram of an embodiment of a prior art payment system;

2 is a schematic diagram of a fisherman using a fishing platform to trick a fisherman into paying;

3 is a flow chart of an embodiment of a payment data security verification method according to the present invention;

4 is a flowchart of another embodiment of a payment data security verification method according to the present invention;

5 is a schematic structural diagram of an implementation manner of a third-party payment platform according to the present invention;

6 is a schematic structural diagram of another embodiment of a third-party payment platform according to the present invention;

7 is a schematic structural view of an embodiment of a commercial platform of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

It is to be understood that the terminology used in the embodiments of the present invention is for the purpose of describing the particular embodiments, and is not intended to limit the invention. The singular forms "a", "the" and "the" It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

Please refer to FIG. 3. FIG. 3 is a flowchart of an embodiment of a payment data security verification method according to the present invention. The present embodiment is described from the perspective of a third-party payment platform. The payment data security verification method of this embodiment includes:

S310: The third-party payment platform receives the payment data sent by the first platform.

The data generated by consumers or phishers when making a purchase on a commercial platform when paying for data. The payment data includes information and an order number of the commercial platform that generated the payment data. The first platform may be a commercial platform or a phishing platform. If it is a commercial platform, the business platform will send the payment data generated by the consumer's shopping to the third-party payment platform. If it is a fishing platform, the phishing platform will send the payment data previously intercepted from the commercial platform to the third-party payment. platform. Since each platform has its own domain name and IP address, the first platform has a first platform with a first domain name and a first IP address.

S320: The third-party payment platform obtains the first domain name and the first IP address of the first platform, and determines whether the first domain name and the first IP address are the record domain name and the record IP address, and the record domain name and the record IP address are pre-stored in the third party. In the payment platform.

Before the commercial platform is officially launched, the commercial platform will record its domain name and IP address on a third-party payment platform. Since the third-party payment platform is directly connected to the first platform, the third-party payment platform can acquire the first domain name and the first IP address of the first platform. The third-party payment platform obtains the first domain name and the first IP address of the first platform, and queries the local registered domain name and the filed IP address to determine whether the first domain name and the first IP address are the record domain name and the record IP address. . If the first domain name and the first IP address are the record domain name and the record IP address, proceed to step S330; if the first domain name and the first IP address are not the record domain name and the record IP address, proceed to step S340.

S330: The payment is normally completed according to the payment data.

If the first domain name and the first IP address are the filing domain name and the filing IP address, it can be known that the first platform is a commercial platform, and the payment is normally completed according to the payment data.

S340: Send the first domain name, the first IP address, and the order number to the commercial platform for verification according to the information of the commercial platform.

If the first domain name and the first IP address are not the record domain name and the record IP address, it is not determined that the first platform is a commercial platform, and the first domain name, the first IP address, and the order number are sent to the commercial platform according to the information of the commercial platform. verification.

In the above manner, if the platform that sends the payment data is not the filing platform, the payment cannot be completed, and the phishing platform can be prevented from using the payment data to deceive the hunter to pay for the phishers.

In another possible implementation manner, if the commercial platform performs verification according to the first domain name and the first IP address, and finds that the first domain name and the first IP address are the modified domain name and IP address of the platform, the third party is paid. The platform sends a confirmation message. After receiving the confirmation message sent by the commercial platform, the third-party payment platform stores the first domain name and the first IP address locally as the filing domain name and the filing IP address of the commercial platform. If the commercial platform verifies that the first domain name and/or the first IP address is not the domain name and IP address of the commercial platform, the commercial platform sends a negative message to the third party payment platform. After receiving the negative message sent by the commercial platform, the third-party payment platform sends a prompt message to the paying party, prompting the first platform that the payer to purchase is an illegal platform.

Referring to FIG. 4, FIG. 4 is a flowchart of another embodiment of the payment data security verification method of the present invention. The present embodiment is described from the perspective of a commercial platform. The payment data security verification method of this embodiment includes:

S410: The commercial platform receives the order information sent by the paying party, and generates the order information according to the order information. Payment data, wherein the payment data includes a domain name and an IP address of the commercial platform, and the payment data further includes an order number of the payment.

The commercial platform can be Taobao, Jingdong and other platforms. When the paying party makes a purchase on the commercial platform, the corresponding order information, such as the price of the purchased product, the number of pieces, and the like, is generated, and the commercial platform generates the payment data according to the order information after receiving the order information sent by the paying party. When producing payment data, the domain name of the commercial platform, the IP address, and the order number of this payment are encapsulated into the payment data.

S420: Send the payment data to the third-party payment platform for verification by the third-party payment platform.

The third party payment platform can be a bank or the like. The commercial platform sends the payment data including the domain name of the commercial platform, the IP address, and the order number of the payment to the third-party payment platform for payment.

In the above manner, the payment data can be sent to the third-party payment platform, so that the third-party payment platform verifies whether the platform that sends the payment data is the filing platform. If the platform that sends the payment data is not the filing platform, the payment cannot be completed, and the fishing platform can be avoided. Using payment data to trick the phisher into paying for the phishers.

Referring to FIG. 5, FIG. 5 is a schematic structural diagram of an implementation manner of a third-party payment platform according to the present invention. The third-party payment platform 500 of the present embodiment includes a receiving module 510, a determining module 520, and an executing module 530.

The receiving module 510 is configured to receive payment data sent by the first platform, where the first platform has a first domain name and a first IP address, where the payment data includes a commercial platform that generates the payment data. Information and order number;

The determining module 520 is configured to obtain the first domain name and the first IP address of the first platform, and determine whether the first domain name and the first IP address are a record domain name and a record IP address. The record domain name and the filing IP address are pre-stored in the third-party payment platform;

The executing module 530 is configured to normally complete payment according to the payment data when the first domain name and the first IP address are the filing domain name and the filing IP address, in the first domain name and the The first IP address is not the record domain name and the record IP address, and the first domain name, the first IP address, and the order number are sent to the commercial platform according to the information of the commercial platform. authenticating.

In the above manner, if the platform that sends the payment data is not the filing platform, the branch cannot be completed. Pay, can avoid the phishing platform using the payment data to deceive the phishers to pay for the phishers.

Referring to FIG. 6 , in another embodiment, the third-party payment platform 500 further includes a filing module 540 and a prompting module 550 .

The filing module 540 is configured to accept a confirmation message sent by the commercial platform when the commercial platform verifies that the first domain name and/or the first IP address is a modified domain name and an IP address of the commercial platform, And storing the first domain name and the first IP address locally as a filing domain name and a filing IP address of the commercial platform.

The prompting module 550 is configured to accept a negative message sent by the commercial platform when the commercial platform verifies that the first domain name and/or the first IP address is not a domain name and an IP address of the commercial platform, and The payer sends a prompt message, and the prompt message prompts that the first platform is an illegal platform.

Referring to FIG. 7, FIG. 7 is a schematic structural diagram of an embodiment of a commercial platform of the present invention. The commercial platform 700 of the present embodiment includes a receiving module 710, a sending module 720, and a determining module 730.

The receiving module 710 is configured to receive order information sent by the paying party, and generate payment data according to the order information, where the payment data includes a domain name and an IP address of the commercial platform, and the payment data further includes the current payment. Order number;

The sending module 720 is configured to send the payment data to the third-party payment platform for verification by the third-party payment platform.

The business platform 700 further includes a determining module 730, the receiving module 710 is further configured to receive a first domain name, a first IP address, and an order number sent by the third-party payment platform, where the determining module 730 is configured to determine the first Whether the domain name and the first IP address are the domain name and the IP address of the platform, and when the determination result is yes, sending a determination message to the third-party payment platform, and when the determination result is no, the The third party payment platform sends a negative message and stops the processing process of the order number.

One of ordinary skill in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a calculation. The machine can be read into a storage medium, and when executed, the program can include the flow of an embodiment of the methods as described above. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above disclosure is only a preferred embodiment of the present invention, and of course, the scope of the present invention is not limited thereto, and those skilled in the art can understand all or part of the process of implementing the above embodiments, and according to the present invention. The equivalent changes required are still within the scope of the invention.

Claims

A payment data security verification method, comprising:

The third-party payment platform receives the payment data sent by the first platform, where the first platform has a first domain name and a first IP address, and the payment data includes information and an order of the commercial platform that generates the payment data. number;

Obtaining, by the third-party payment platform, the first domain name and the first IP address of the first platform, and determining whether the first domain name and the first IP address are a record domain name and a record IP address, and the filing The domain name and the filing IP address are pre-stored in the third-party payment platform;

If the first domain name and the first IP address are the filing domain name and the filing IP address, the payment is normally completed according to the payment data, if the first domain name and the first IP address are not Describe the domain name and the filing IP address, and send the first domain name, the first IP address, and the order number to the commercial platform for verification according to the information of the commercial platform.
The method of claim 1 further comprising:

If the commercial platform verifies that the first domain name and/or the first IP address is the modified domain name and IP address of the commercial platform, accepting a confirmation message sent by the commercial platform, and the first domain name is And the first IP address is stored locally as a filing domain name and a filing IP address of the business platform.
The method of claim 1 further comprising:

If the commercial platform verifies that the first domain name and/or the first IP address is not the domain name and IP address of the commercial platform, accepting a negative message sent by the commercial platform, and sending a prompt message to the paying party, The prompt message prompts that the first platform is an illegal platform.
A payment data security verification method, comprising:

The business platform receives the order information sent by the paying party, and generates payment data according to the order information, wherein the payment data includes a domain name and an IP address of the commercial platform, and the payment data further includes an order number of the payment;

The payment data is sent to the third party payment platform for verification by the third party payment platform.
The method of claim 4, wherein the method further comprises:

Receiving a first domain name, a first IP address, and an order number sent by the third-party payment platform;

Determining whether the first domain name and the first IP address are domain names and IP addresses of the platform;

If yes, send a determination message to the third-party payment platform, and if not, to the third The party payment platform sends a negative message and stops the processing flow of the order number.
A third-party payment platform, comprising: a receiving module, a determining module, and an executing module,

The receiving module is configured to receive payment data sent by the first platform, where the first platform has a first domain name and a first IP address, and the payment data includes information of a commercial platform that generates the payment data. And the order number;

The determining module is configured to obtain the first domain name and the first IP address of the first platform, and determine whether the first domain name and the first IP address are a record domain name and a record IP address. The record domain name and the filing IP address are pre-stored in the third-party payment platform;

The executing module is configured to normally complete payment according to the payment data when the first domain name and the first IP address are the filing domain name and the filing IP address, in the first domain name and the The first IP address is not the filing domain name and the filing IP address, and the first domain name, the first IP address, and the order number are sent to the commercial platform according to the information of the commercial platform. verification.
The platform of claim 6 wherein said platform further comprises a filing module.

The filing module is configured to accept a confirmation message sent by the commercial platform when the commercial platform verifies that the first domain name and/or the first IP address is a modified domain name and an IP address of the commercial platform, and The first domain name and the first IP address are stored locally as a filing domain name and a filing IP address of the business platform.
The platform according to claim 6, wherein the platform further comprises a prompting module,

The prompting module is configured to accept a negative message sent by the commercial platform when the commercial platform verifies that the first domain name and/or the first IP address is not a domain name and an IP address of the commercial platform, and pays The party sends a prompt message, and the prompt message prompts that the first platform is an illegal platform.
A commercial platform, characterized in that the platform comprises a receiving module and a sending module,

The receiving module is configured to receive order information sent by the paying party, and generate payment data according to the order information, where the payment data includes a domain name and an IP address of the commercial platform, and the payment data further includes the current payment order number;

The sending module is configured to send the payment data to the third-party payment platform for verification by the third-party payment platform.
The platform according to claim 9, wherein the platform further comprises a judging module,

The receiving module is further configured to receive a first domain name and a first IP address sent by a third-party payment platform. And the order number;

The determining module is configured to determine whether the first domain name and the first IP address are domain names and IP addresses of the platform, and send a determination message to the third-party payment platform when the determination result is yes. When the determination result is negative, a negative message is sent to the third-party payment platform, and the processing flow of the order number is stopped.