WO2018153288A1

WO2018153288A1 - Numerical value transfer method, apparatus, device and storage medium

Info

Publication number: WO2018153288A1
Application number: PCT/CN2018/076072
Authority: WO
Inventors: 周菲
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2017-02-22
Filing date: 2018-02-09
Publication date: 2018-08-30
Also published as: CN108462580A; CN108462580B

Abstract

Disclosed are a numerical value transfer method, apparatus and device, and a storage medium, belonging to the field of information security. The method comprises: after receiving an order parameter and a signature of a first order sent by a web page, detecting whether the signature is correct according to the order parameter and the signature; when the signature is correct, detecting whether the order parameter contains a first pre-set field and the value of the first pre-set field is a pre-set numerical value; when the order parameter contains the first pre-set field and the value of the first pre-set field is the pre-set numerical value, sending a first error code to the web page, and prohibiting continued execution of the numerical value transfer operation corresponding to the first order. The present application can solve the problem, in an actual payment scenario, of an account and funds of a user not being secure when a proxy tool is used to skip over a part of a logic check procedure, and a payment CGI is continuously scheduled to complete payment, and has the effect that when a proxy tool is used in an actual payment scenario, the execution of a payment operation is prohibited, and the security of the account and funds of the user is protected.

Description

Numerical transfer method, device, device and storage medium

The present application claims priority to Chinese Patent Application No. 200910097347.6, the entire disclosure of which is incorporated herein by reference. .

Technical field

The embodiments of the present application relate to the field of information security, and in particular, to a method, device, device, and storage medium for transferring values.

Background technique

When performing a payment operation, usually before the payment is completed, the payment system needs to perform some logic verification on the payment operation, such as mobile phone number verification, verification code verification, and the like. The purpose of the logic check is to confirm whether the payment operation is the user's own operation.

When the payment system performs the payment process, it usually includes multiple interactions between the web page on the terminal and various CGI (Common Gateway Interface) on the server. For example, the CGI includes the identity verification CGI and the payment CGI. The webpage page sends the authentication-related parameters input by the user to the identity verification CGI, and the identity verification CGI verifies the parameters. After the verification succeeds, the identity verification CGI is performed. A confirmation message is returned to the webpage page, and then the webpage page sends the relevant parameters of the payment to the payment CGI, the payment CGI verifies the parameter, the payment operation is completed after the verification is successful, and the payment completed message is returned to the webpage page.

In the development or testing of payment scenarios, technicians often use proxy tools (such as Fiddler) in the terminal to test different payment scenarios by capturing and modifying the parameters of the web page or the parameters of each CGI. That is to say, the agent tool is usually used by technicians to pay for the development or testing of the scenario. However, in the actual payment scenario, if the malicious user uses the proxy tool, when the webpage page sends the identity verification related parameter to the identity verification CGI, the proxy tool can intercept the identity verification CGI request sent by the webpage page to the server, and then pretend to be The server returns a confirmation message to the web page. In this case, regardless of whether the parameters used for authentication are correct, the webpage page can receive the confirmation message, thereby bypassing the actual authentication process. When the webpage page sends the payment-related parameters to the payment CGI, the proxy tool can The parameters input to the payment CGI are modified so that the payment CGI considers that the previous authentication has been confirmed at the time of verification, so that the web page successfully calls the payment CGI to complete the payment.

Since the malicious user uses the proxy tool in the actual payment scenario, the payment system may skip some logic verification processes similar to the authentication, and continue to call the payment CGI to complete the payment, thereby causing the ordinary user's account and funds to be unsecured. .

Summary of the invention

The embodiment of the present application provides a method, a device, a device, and a storage medium for a numerical value transfer, which can solve the security problem caused by a malicious user using a proxy tool to skip the logic verification process and continue to call the payment CGI to complete the payment. The technical solution is as follows:

According to an aspect of the present application, a numerical transfer method is provided, which is applied to a server, the method comprising:

After receiving the order parameter and the signature of the first order sent by the webpage page in the terminal, detecting whether the signature is correct according to the order parameter and the signature, the order parameter includes a parameter value of each field before the signature, The signature is obtained by the order parameter according to a predetermined digital signature rule;

When the signature is correct, detecting whether the first predetermined field is included in the order parameter, and the value of the first predetermined field is a predetermined value, and the value of the first predetermined field is the predetermined value The terminal uses a proxy tool, which refers to a tool that proxyes the resources of the accessed server as a local resource;

When the first predetermined field is included in the order parameter and the value of the first predetermined field is the predetermined value, sending a first error code to the webpage page, and prohibiting execution of the first order correspondence The value transfer operation.

According to another aspect of the present application, a value transfer method is provided for use in a terminal, the method comprising:

When the web page is opened, detecting whether the terminal is running a proxy tool, and the proxy tool is a tool for proxying a resource of the accessed server as a local resource;

When the terminal is running the proxy tool, the value of the first predetermined field is set to a predetermined value, and the first predetermined field is used to indicate whether to use the proxy tool;

The order parameter of the first order is calculated according to a predetermined digital signature rule, and the order parameter includes the first predetermined field and other value transfer operation corresponding fields;

Sending the signature and the order parameter to the server, the signature and the order parameter are used to trigger the server to detect whether the signature is correct, and if the signature is correct, if the first predetermined field If the value is the predetermined value, returning the first error code, and prohibiting the execution of the value transfer operation;

Receiving the first error code sent by the server, where the first error code is used to prompt to prohibit execution of the value transfer operation.

According to another aspect of the present application, a numerical transfer apparatus is provided, the apparatus comprising:

a first detecting module, configured to: after receiving an order parameter and a signature of the first order sent by the webpage page in the terminal, detecting whether the signature is correct according to the order parameter and the signature, where the order parameter includes a signature a parameter value of each field, the signature being obtained by the order parameter according to a predetermined digital signature rule;

a second detecting module, configured to: when the first detecting module detects that the signature is correct, detecting whether the first predetermined field is included in the order parameter, and the value of the first predetermined field is a predetermined value, When the value of the first predetermined field is the predetermined value, the terminal uses the proxy tool, and the proxy tool refers to a tool that proxyes the resource of the accessed server as a local resource;

a first sending module, configured to send, to the webpage, when the second detecting module detects that the first predetermined field is included in the order parameter and the value of the first predetermined field is the predetermined value The first error code, and prohibiting the execution of the value transfer operation corresponding to the first order.

a third detecting module, configured to detect, when the webpage is opened, whether the device is running a proxy tool, where the proxy tool is a tool that proxyes resources of the accessed server as local resources;

An evaluation module, configured to: when the third detecting module detects that the device is running the proxy tool, set a value of a first predetermined field to a predetermined value, where the first predetermined field is used to indicate whether to use a proxy tool;

a calculation module, configured to calculate a signature of the order parameter of the first order according to a predetermined digital signature rule, where the order parameter includes the first predetermined field and other value transfer operation corresponding fields;

a third sending module, configured to send the signature obtained by the calculating module and the order parameter to a server, where the signature and the order parameter are used to trigger the server to detect whether the signature is correct, If the signature is correct, if the value of the first predetermined field is the predetermined value, returning the first error code, and prohibiting the execution of the value transfer operation;

And a first receiving module, configured to receive the first error code sent by the server, where the first error code is used to prompt to prohibit execution of the value transfer operation.

In accordance with another aspect of the present application, a server is provided, the server including a memory and a processor, the memory storing one or more instructions for executing the one or more instructions to implement the following steps :

According to another aspect of the present application, a terminal is provided, the terminal comprising: a memory and a processor, the memory storing one or more instructions, and the processor is configured to execute the one or more instructions as follows step:

Sending the signature and the order parameter to the server;

According to another aspect of the present application, a computer readable storage medium is provided, wherein one or more instructions are stored on the storage medium, and the one or more instructions are executed to implement a server as described above The side value transfer method, and/or the value transfer method on the terminal side as above.

The beneficial effects brought by the technical solutions provided by the embodiments of the present application include at least:

The webpage is used to detect whether the terminal uses the proxy tool, the first predetermined field is added to the order parameter sent to the server, and the signature generated by the order parameter is sent to the server, and the server verifies the signature according to the order parameter and the signature, due to the order. After the value of any field in the parameter changes, the generated signature will also change. By verifying the signature, the agent tool can effectively find the modification of the order parameter. In addition, when the server detects that the first predetermined field is included in the order parameter and the value of the first predetermined field is a predetermined value, that is, when the server detects that the terminal performs the numerical transfer operation corresponding to the first order, the terminal uses the proxy tool, and the server prohibits the continuation. The numerical transfer operation corresponding to the first order is executed, so that the numerical user transfer operation by the proxy tool is prohibited, and the effect of protecting the account and property security of the ordinary user is achieved.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present application. Other drawings may also be obtained from those of ordinary skill in the art in light of the inventive work.

1 is a schematic diagram of an implementation environment of a numerical transfer method according to an embodiment of the present application;

2 is a flow chart of a method for a numerical value transfer method provided in an embodiment of the present application;

3A is a flowchart of a method for a numerical value transfer method provided in another embodiment of the present application;

FIG. 3B is a flowchart of a method for transferring a value in a payment scenario provided in an embodiment of the present application; FIG.

4 is a block diagram showing the structure of a numerical value transfer apparatus provided in an embodiment of the present application;

Figure 5 is a block diagram showing the structure of a numerical value transfer apparatus provided in an embodiment of the present application;

Figure 6 is a block diagram showing the structure of a numerical value transfer device provided in another embodiment of the present application;

7 is a schematic structural diagram of a server provided in an embodiment of the present application;

FIG. 8 is a structural block diagram of a terminal provided in an embodiment of the present application.

detailed description

In order to make the objects, technical solutions and advantages of the present application more clear, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

FIG. 1 is a schematic diagram of an implementation environment of a numerical value transfer method according to an embodiment of the present application. As shown in FIG. 1 , the implementation environment includes: a terminal 110, a server 120, and a communication network 130.

The terminal 110 has the capability of web browsing. Optionally, the terminal 110 includes: a desktop computer, a laptop portable computer, a tablet computer, a smart phone, a Point ofsales (POS) terminal, and an MP3 (Moving Picture Experts Group Audio Layer III). ) Player, MP4 player, etc.

Server 120 is a platform that provides Internet network services. The server 120 has at least one of a value transfer, a data storage, and a logical check. The server 120 may be a server or a server cluster composed of a plurality of servers. All or part of data between the servers in the server cluster may be shared, and the server 120 may also be a cloud computing service center. The physical implementation manner of the server 120 is not limited in this embodiment of the present application.

The terminal 110 and the server 120 are connected by a communication network 130. Alternatively, communication network 130 can be a wired communication network or a wireless communication network.

A web page 111 is run on the browser or application of the terminal 110, and the web page 111 has the ability to provide a numerical transfer operation. The web page 111 can also be referred to as a web client. The numerical transfer refers to the transfer of the resource of the specified value between the first account A and the second account B, such as transferring from the first account A to the second account B. In practical applications, the value transfer includes at least one of payment, recharge, transfer, and repayment. Correspondingly, the webpage page 111 is implemented as at least one of a payment page, a recharge page, a transfer page, and a repayment page.

The server 120 runs a variety of CGIs (Common Gateway Interfaces). This embodiment uses the identity verification CGI 121 and the payment CGI 122 on the server 120 as an example. The CGI is physically a program running on the server 120. Depending on the functions implemented, the CGI can be specifically divided into different types of CGIs, such as the identity verification CGI 121 and the payment CGI 122 shown in FIG. The identity verification CGI 121 is a program on the server 120 for implementing the identity verification function, and the payment CGI 122 is a program on the server 120 for implementing the payment function.

When the web page 111 sends a CGI-specific call request to the server, the server 120 searches for the corresponding CGI according to the call request, and sends the call request to the found CGI for processing. After processing, the CGI sends the processing result to the server 120. The server 120 returns the processing result to the web page 111. For example, the terminal 110 is an example of a PC (Personal Computer). When the user performs a value transfer operation on the PC side, the value transfer operation involves the user's property security. Generally, before the server 120 completes the value transfer operation, the user also needs to send an identity verification request to the server 120 through the terminal 110 to ensure that the value transfer operation is performed by the person.

In the case of a normal payment, the user opens a webpage page 111 on the terminal 110. After the user fills in the authentication information, the webpage 111 generates an identity verification request according to the parameters in the filled identity verification information, and sends the identity verification request to the server. 120. After receiving the identity verification request, the server 120 sends an identity verification request to the identity verification CGI 121, and the identity verification CGI 121 verifies the parameters in the identity verification request. When passing the verification, the identity verification CGI 121 feeds back the verification success message to the server 120, and the server 120 returns the verification success message to the webpage page 111. After receiving the verification success message, the webpage page 111 is based on the value filled in by the user. The transfer related parameter generates a value transfer request, and the value transfer request is sent to the server 120. After receiving the value transfer request, the server 120 sends the value transfer request to the payment CGI 122, and the payment CGI 122 checks the value transfer parameter to ensure that the value is transferred. The authentication before the value transfer has passed, and the payment CGI 122 checks the handling fee, checks the payment authority, checks whether the payment is verified, etc. After the verification is completed, the value transfer operation is performed, and the value is transferred. After the operation is completed, the payment CGI 122 feeds back the value transfer success message to the server 120, and the server 120 returns a value transfer success message to the web page 111, and the web page 111 displays a notification of successful numerical transfer on the terminal 110.

In the case of abnormal payment (such as a malicious user), the proxy tool 112 is also run on the terminal 110. The agent tool 112 is a tool that proxyes the resources of the server 120 being accessed as a local resource. When the web page 111 requests the resource, the proxy tool 112 will call the local resource. The agent tool 112 is typically used by technicians in development or testing to simulate different scenarios and save development costs. The common proxy tool 112 has Fiddler, which has at least one of forwarding, proxy, host management, setting breakpoints, CGI scanning, modifying input parameters, modifying return parameters, and simulating network speed.

In the actual payment scenario, if the malicious user uses the proxy tool 112, the web page 111 sends an authentication request to the identity verification CGI 121. Since the proxy tool 112 can proxy the resource of the server 120 as a local resource, the authentication request is Instead of being sent to the identity verification CGI 121, the local resource is invoked and the proxy tool 112 pretends that the server 120 returns a verification success message to the web page 111. In this case, regardless of whether the authentication information entered in the web page 111 is correct, the web page 111 can receive the verification success message, thereby bypassing the actual authentication process. When the web page 111 sends a payment request to the payment CGI 122, since the proxy tool 112 can modify the input parameters, the proxy tool 112 can modify the parameters sent to the payment CGI 122 such that upon receipt of the payment request, the payment CGI 122 is The verification result of the parameter confirms that the verification logic (such as identity verification) before this step has been confirmed, so that other verification of the payment logic is continued, and the value transfer is completed.

Since the agent tool 112 is running under the actual payment scenario, it should be considered an abnormal payment. Accordingly, in various embodiments of the present application, a verification process for whether the terminal 110 is running the agent tool 112 is added to the web page 111 and the payment CGI 122.

2 is a flow chart of a method for a numerical value transfer method provided in an embodiment of the present application, which is illustrated by the application in the implementation environment shown in FIG. 1. As shown in FIG. 2, the numerical transfer method may include:

Step 201: When the terminal opens the webpage page, the webpage page detects whether the terminal is running the proxy tool.

The browser in the terminal (or the built-in browser of the application) runs a web page. This web page can also be referred to as a web client.

A proxy tool is a tool that proxies the resources of a server being accessed as a local resource.

A web page is a page that needs to detect whether or not to run a proxy tool. Optionally, the webpage page is used to provide a value transfer operation, and the webpage page includes at least one of a payment page, a top-up page, a transfer page, and a repayment page.

Step 202: When the terminal is running the proxy tool, the webpage page causes the value of the first predetermined field to be a predetermined value, and the first predetermined field is used to indicate whether to use the proxy tool.

A first predetermined field is added to the payment request sent by the web page to the payment CGI, and the first predetermined field is used to indicate whether to use the proxy tool. For example, the first predetermined field is agent_tool. If Fiddler is running in the terminal, the web page page causes agent_tool=1 to indicate that there is a proxy tool running.

Step 203: The webpage page calculates the signature of the order parameter of the first order according to a predetermined digital signature rule, and the order parameter includes a first predetermined field and other value transfer operation corresponding fields.

Optionally, the calculation signature is within a predetermined time period prior to the submission of the first order, typically a predetermined time period is shorter. For example, after the user fills in the number of value transfer corresponding to the first order and the information of the transfer account on the webpage page, when the confirmation control on the webpage page is triggered, the webpage page is based on each field corresponding to the information filled in by the user and the first The predetermined field is calculated according to a predetermined digital signature rule.

Alternatively, the predetermined digital signature rule may be an MD5 signature. When generating the signature, the MD5 signature selects some specific parameters from the user's order parameters according to a certain order and adds the key value that is not visible to the external user. The MD5 signature is irreversible, that is, the user cannot calculate the parameters before the signature inversely based on the MD5 signature. Before the web page generates the signature using the MD5 signature, the first predetermined field is added to the field of the calculated signature.

Optionally, the webpage may also be digitally signed using 3des. The difference between the 3des and the MD5 signature is that the encryption of the 3des is reversible, and the CGI can decrypt the digital signature by the key to obtain the parameters before the signature. For 3des, the web page is a first predetermined field added after the signature is generated and an MD5 signature generated according to the specified key.

Step 204: The webpage page sends the signature and the order parameter of the first order to the server.

Since the MD5 signature is irreversible, the order parameters before the signature are also sent to the server, and the payment CGI in the server verifies the signature correctly according to the order parameters and the signature.

In an actual application, the webpage generates a payment request according to the signature and the order parameter, and the webpage sends the payment request to the server. After receiving the payment request sent by the webpage, the server sends the payment request to the corresponding payment CGI for processing, and pays the CGI. After processing the payment request, the processing result is sent to the server, and the server sends the processing result to the webpage page.

For the specific implementation of the payment request sent by the CGI processing webpage, please refer to step 205 to step 207.

Step 205: After receiving the order parameter and signature of the first order sent by the webpage page, the payment CGI detects whether the signature is correct according to the order parameter and the signature.

Since the order parameters or signatures may be modified, the payment CGI needs to verify that the order parameters or signatures have been modified by verifying that the signatures are correct.

Step 206: When the signature is correct, the payment CGI detects whether the first predetermined field is included in the order parameter of the first order, and the value of the first predetermined field is a predetermined value.

The first predetermined field is used to indicate whether to use the proxy tool, and the value of the first predetermined field indicates that the proxy tool is used when the value is a predetermined value.

Corresponding to step 202, the payment CGI needs to detect whether the first predetermined field agent_tool is included in the order parameter, and whether the value of the first predetermined field is a predetermined value of 1.

Step 207: When the order parameter of the first order includes the first predetermined field and the value of the first predetermined field is a predetermined value, the payment CGI sends the first error code to the webpage page, and prohibits the execution of the value transfer corresponding to the first order. operating.

When the agent tool is running in the terminal, the webpage page causes agent_tool=1, and the order parameter included in the payment CGI includes agent_tool=1, the order parameter includes the first predetermined field agent_tool, and the value of the first predetermined field is a predetermined value. 1.

When the payment CGI detects the agent_tool=1, the first error code is sent to the webpage page, and the webpage page is prohibited from continuing to perform the numerical transfer operation corresponding to the first order. In the payment scenario, the first error code sent by the payment CGI may be: retcode=5100211, retmsg= prohibiting the user from continuing to pay.

Step 208: The webpage page receives a first error code sent by the server, where the first error code is used to prompt to prohibit the execution of the value transfer operation.

The web page obtains a message prohibiting the execution of the value transfer operation by parsing the first error code.

Optionally, the webpage pops up a prompt window according to the first error code, and the prompt window is used to prompt the user to prohibit the value transfer operation from continuing.

It should be noted that the interaction between the terminal and the server in this embodiment may be directly understood as the interaction between the web page and the payment CGI.

In summary, the value transfer method provided by the embodiment of the present application detects whether the terminal uses the proxy tool through the webpage page, adds a first predetermined field to the order parameter sent to the server, and sends the signature generated by the order parameter to the server. The server verifies the signature according to the order parameters and the signature. Since the value of any field in the order parameter changes, the generated signature also changes. By verifying the signature, the proxy tool can effectively find the order parameter. modify. In addition, when the server detects that the first predetermined field is included in the order parameter and the value of the first predetermined field is a predetermined value, that is, when the server detects that the terminal performs the numerical transfer operation corresponding to the first order, the terminal uses the proxy tool, and the server prohibits execution. The value transfer operation corresponding to the first order, so that the numerical user transfer operation by the proxy tool is prohibited, and the effect of protecting the account and property security of the ordinary user is achieved.

FIG. 3A is a flowchart of a method for a numerical value transfer method provided in another embodiment of the present application, which is exemplified in the implementation environment shown in FIG. 1. As shown in FIG. 3A, the numerical transfer method may include:

Step 301: When the terminal opens the webpage page, the webpage page detects whether the terminal is running the proxy tool.

Optionally, when the login page is opened on the terminal, the login page may also detect whether the terminal is running the proxy tool. That is, the web page may also include a login page.

Optionally, the web page detects whether the terminal is running the proxy tool, and can be implemented in the following manner:

S1. The web page detects whether the target agent tool is running in the resource manager of the terminal.

The target agent tool is at least one of a list of pre-configured agent tools. There may be a variety of agent tools. The web page pre-configures the names of a series of agent tools into a list of agent tools, and then queries the resource manager according to the list of agent tools to see if the target agent tool on the agent tool list is running.

S2. When the target agent tool is run in the resource manager of the terminal, the web page determines that the terminal is running the agent tool.

In practical applications, the terminal may run an agent tool or multiple agent tools at the same time. When the web page detects that any agent tool in the agent tool list is running, it can confirm that the terminal is running the agent tool.

S3. When no target agent tool is running in the resource manager of the terminal, the web page determines that the terminal does not run the agent tool.

In practical applications, it can be confirmed that the terminal is not running the agent tool only when the terminal does not run the agent tool in the list of agent tools.

Step 302: When the terminal is running the proxy tool, the webpage page causes the value of the first predetermined field to be a predetermined value, so that the value of the second predetermined field is the name of the proxy tool, and the first predetermined field is used to indicate whether to use the proxy tool, The second predetermined field is used to indicate the name of the agent tool used.

A first predetermined field and a second predetermined field are added to the payment request sent by the web page to the payment CGI, respectively, to indicate whether to use the proxy tool and the name of the proxy tool used. For example, the first predetermined field is agent_tool, and the second predetermined field is agent_name. If Fiddler is running in the terminal, the web page page causes agent_tool=1 to indicate that there is a proxy tool running, and agent_name=Fiddler is used to indicate that the name of the running proxy tool is Fiddler.

Optionally, only the first predetermined field is added in the payment request sent by the web page to the payment CGI, and the second predetermined field is an optional field.

Step 303: The webpage page calculates the signature of the order parameter of the first order according to a predetermined digital signature rule, where the order parameter includes a first predetermined field, a second predetermined field, and other value transfer operation corresponding fields.

Optionally, the calculation signature is within a predetermined time period prior to the submission of the first order, typically a predetermined time period is shorter. For example, after the user fills in the number of value transfer corresponding to the first order and the information of the transfer account on the webpage page, when the confirmation control on the webpage page is triggered, the webpage page is based on each field corresponding to the information filled in by the user and the first The predetermined field and the second predetermined field are calculated according to a predetermined digital signature rule.

Alternatively, the predetermined digital signature rule may be an MD5 signature. When generating the signature, the MD5 signature selects some specific parameters from the user's order parameters according to a certain order and adds the key value that is not visible to the external user. The MD5 signature is irreversible, that is, the user cannot calculate the parameters before the signature inversely based on the MD5 signature. Before the web page generates the signature using the MD5 signature, the first predetermined field and the second predetermined field are added to the field for calculating the signature (or only the first predetermined field is added).

Optionally, the webpage may also be digitally signed using 3des. The difference between the 3des and the MD5 signature is that the encryption of the 3des is reversible, and the CGI can decrypt the digital signature by the key to obtain the parameters before the signature. For 3des, the web page is to add the first predetermined field and the second predetermined field after generating the signature and the MD5 signature generated according to the specified key.

In step 304, the web page sends the signature and order parameters to the payment CGI.

The process of sending the signature and order parameters to the payment CGI on the web page is the process of calling the payment CGI.

Since the MD5 signature is irreversible, the order parameters before the signature are also sent to the payment CGI, and the payment CGI verifies that the signature is correct according to the order parameters and the signature.

Step 305: After receiving the order parameter and signature of the first order sent by the webpage page, the payment CGI detects whether the signature is correct according to the order parameter and the signature.

Alternatively, detecting the correctness of the signature can be achieved by:

S1, the payment CGI calculates the verification signature according to the predetermined digital signature rule according to the order parameter.

Since the MD5 signature is irreversible, the payment CGI needs to calculate the signature according to the order parameter according to the same predetermined digital signature rule as the webpage page. The signature is a verification signature, and the signature is determined by comparing the verification signature with the received signature. Whether the order parameters have been modified.

S2, whether the payment CGI detection signature is consistent with the verification signature.

S3, when the signature is consistent with the verification signature, the payment CGI determines that the signature is correct.

S4, when the signature is inconsistent with the verification signature, the payment CGI determines the signature error.

Step 306, when determining the signature error, the payment CGI sends a second error code to the webpage page, and prohibits the execution of the numerical transfer operation corresponding to the first order.

When the payment CGI determines the signature error, it indicates that the payment CGI does not pass the verification of the signature, so the payment CGI sends a second error code error to the webpage page.

In the actual payment scenario, the second error code may be: retcode=5100200, retmsg=signature error, prohibiting the user from continuing to pay.

Step 307: The webpage page receives a second error code sent by the server, and the second error code is used to prompt a signature error and prohibits the execution of the value transfer operation.

Optionally, the webpage pops up a prompt window according to the second error code, and the prompt window is used to prompt the user to prohibit the value transfer operation from continuing.

As another branch of step 305, if the signature is correct, the payment CGI needs to proceed to step 308.

Step 308: When the signature is correct, the payment CGI detects whether the first predetermined field is included in the order parameter, and the value of the first predetermined field is a predetermined value.

Corresponding to step 302, the payment CGI needs to detect whether the first predetermined field agent_tool is included in the order parameter, and whether the value of the first predetermined field is a predetermined value of 1.

Step 309, when the order parameter includes the first predetermined field and the value of the first predetermined field is a predetermined value, the payment CGI records the order number of the first order in the database of the server, and marks the first order corresponding to the order number as the target order. .

The order number is used to uniquely identify the first order, and the target order is a value transfer order using the agent tool.

Optionally, the payment CGI stores the order number and the tag in the database, and the tag may be agent_tool=1.

Step 310: The payment CGI sends the first error code to the webpage page, and prohibits the execution of the value transfer operation corresponding to the first order.

Step 311: The webpage page receives a first error code sent by the server, where the first error code is used to prompt to prohibit the execution of the value transfer operation.

In actual implementation, even after the webpage page receives the first error code, the malicious user may submit the same value transfer order again through the webpage page, and it is possible to re-modify the parameters through the proxy tool. In a possible case, when the web page pop-up prompt window prompts the user to prohibit the value transfer operation from being performed, the malicious user may directly close the prompt window, confirm that the control is triggered again, and the web page sends the value transfer order to the payment CGI again. . In another possible scenario, a malicious user replaces a terminal, reopens the web page, and resubmits the value transfer order that was previously submitted but not completed. In both cases, the order number of the resubmitted value transfer order does not change. For this type of order, the payment CGI is verified by the following steps.

Step 312: When submitting the second order, the webpage page sends the signature and order parameters of the second order to the payment CGI, and the order parameter of the second order further includes the order number of the second order.

The order number of the second order is used to uniquely identify the second order.

Alternatively, the second order is a value transfer order that has been submitted but not completed.

Step 313, when receiving the submit request of the second order, the payment CGI queries the database whether the second order belongs to the target order according to the order number of the second order.

After the second order is resubmitted, since the order number of the second order is the same as the order number when the previous order was submitted, the payment CGI checks whether the second order belongs to the marked target order according to the order number of the second order.

Step 314, when the second order belongs to the target order, the payment CGI sends the first error code to the webpage page.

Since the second order belongs to the target order, indicating that the second order is a value transfer order using the proxy tool, the payment CGI directly sends a first error code error to the webpage page.

Step 315, the webpage page receives the first error code sent by the payment CGI.

Optionally, the webpage page pops up the corresponding prompt window by parsing the first error code, and is used to prompt the user to prohibit the value transfer operation from continuing.

As another branch of step 308, the method further includes step 316.

Step 316, when the signature is correct and there is no first predetermined field in the order parameter, or when the signature is correct and the value of the first predetermined field is not a predetermined value, the other verification process of the normal value transfer is continued.

The other verification process includes at least one of verifying the commission, verifying whether the payment is successful, and verifying whether or not the payment authority is available.

For a terminal that does not have an agent tool installed, or an agent tool installed but does not open the agent tool during the entire process of performing a value transfer operation, the web page does not send the first predetermined field and the second predetermined field to the payment CGI, or the web page is sent. The first predetermined field and the second predetermined field, but the value of the first predetermined field is null or not a predetermined value, and the value of the second predetermined field is null.

Optionally, in actual implementation, the payment CGI supports a configuration switch. When the switch is turned on, the payment CGI needs to detect whether there is a first predetermined field in the order parameter indicating whether the terminal uses the proxy tool. Correspondingly, the webpage page on the terminal needs to detect whether the proxy tool is running in the terminal through the resource manager, and then add a first predetermined field in the order parameter, or add a first predetermined field and a second predetermined field. When the switch is turned off, the payment CGI does not detect the first predetermined field in the order parameter, and correspondingly, the web page does not detect whether the proxy tool is running in the terminal.

Optionally, the switch is in the CGI configuration file, and the technician must log in to the server to control the switch. Therefore, the switch is only controlled by a technician, and the ordinary user cannot control the switch. The technician turned off the switch during testing and development because of the need to use the agent tool. When the web page is normally available to the user, the switch is turned on to detect whether the terminal is running the proxy tool in the actual payment environment.

The numerical value transfer method provided in this embodiment can also be represented as a flowchart shown in FIG. 3B in the payment scenario. As shown in FIG. 3B, S301 is first executed to open a webpage page; then, S302 is executed, and the webpage page checks the resource manager process of the terminal; then, S303 is executed to determine whether the terminal uses the proxy tool; if the result of the determination in S303 is no, the webpage is executed. The page calculates a label according to the order parameter of the first order, the label may be a signature of the order parameter, and the payment CGI is invoked by using the label; then, executing S307, the payment CGI calculates and verifies whether the label is correct according to the order parameter of the first order; If the determination result of S303 is yes, then S305 is executed to make the first predetermined field agent_tool=1, the second predetermined field agent_name=***, and the webpage page is based on the order parameter of the first order (including the first predetermined field and the second predetermined field) Calculating a generated tag, which may be a signature of the order parameter; then executing S306, the web page uses the tag to call the payment CGI, and in the calling process, sends the agent_tool=1, agent_name=***, and the tag to the payment CGI; S307, the payment CGI calculates and according to the order parameter of the first order (including the first predetermined field and the second predetermined field) Verify the label; then execute S308 to pay the CGI verification label for correctness;

If the determination result of S308 is no, that is, the signature of the order parameter of the first order is incorrect, then S3089 is executed, and the payment CGI returns a second error code; then the webpage page executes S310, and the webpage page displays the first page popup window, the first page A page pop-up window can display prompt text: signature error, unable to continue to pay.

If the result of the determination in S308 is YES, then S311 is performed, and the payment CGI determines whether the first predetermined field agent_tool is equal to 1; if the determination result of S311 is YES, that is, the agent_tool is equal to 1, executing S312, the payment CGI returns the first error code, The first error code is used to indicate that the numerical value transfer operation is prohibited from being performed; then, in S313, the webpage page displays the second page popup window, and the second page popup window can display the prompt text: prohibiting payment, unable to continue to pay; if the judgment result of S311 If no, execute S314, that is, agent_tool is equal to 0, and pay the CGI to perform other verification of the payment logic.

In summary, the value transfer method provided by the embodiment of the present application detects whether the terminal uses the proxy tool through the webpage page, adds the first predetermined field and the second predetermined field to the order parameter sent to the server, and generates the order parameter. The signature is sent to the server, and the server verifies the signature according to the order parameter and the signature. Since the value of any field in the order parameter changes, the generated signature also changes, and the signature can be effectively verified by verifying the signature. The tool modifies the order parameters. In addition, when the server detects that the first predetermined field is included in the order parameter and the value of the first predetermined field is a predetermined value, that is, when the server detects that the terminal performs the numerical transfer operation corresponding to the first order, the terminal uses the proxy tool, and the server prohibits execution. The value transfer operation corresponding to the first order, so that the numerical user transfer operation by the proxy tool is prohibited, and the effect of protecting the account and property security of the ordinary user is achieved.

In addition, the numerical value transfer method provided in this embodiment further prohibits the execution of the value transfer operation by the payment CGI when the signature is incorrect, so that when the order parameter or the signature changes, the numerical transfer operation is prohibited, and the account and property security of the ordinary user are protected. .

In addition, the value transfer method provided by the embodiment further records the order number of the first order into the database by detecting the first order as the value of the agent tool when the payment CGI detects the order, and marks the first order as the target order. If a second order with the same order number is submitted, the payment CGI can query the database according to the order number and quickly determine that the second order is a value transfer order using the agent tool.

In addition, the numerical value transfer method provided by the embodiment further performs the execution when the signature verification is correct and the first predetermined field is not included in the order parameter or when the signature verification is correct and the first predetermined field in the order parameter is not a predetermined value. The other verification flow of the numerical transfer operation enables the numerical transfer order request of the terminal that does not use the proxy tool to be executed normally.

4 is a block diagram showing the structure of a numerical value transfer apparatus provided in an embodiment of the present application, which is exemplified in the server 120 shown in FIG. 1. As shown in FIG. 4, the value transfer device may include: a first detection module 410, a second detection module 420, and a first transmission module 430.

The first detecting module 410 is configured to: after receiving the order parameter and the signature of the first order sent by the webpage page in the terminal, detecting whether the signature is correct according to the order parameter and the signature, where the order parameter includes a signature a parameter value of each of the preceding fields, the signature being obtained by the order parameter according to a predetermined digital signature rule;

The second detecting module 420 is configured to detect, when the first detecting module detects that the signature is correct, whether the first predetermined field is included in the order parameter, and the value of the first predetermined field is a predetermined value. When the value of the first predetermined field is the predetermined value, the terminal uses the proxy tool, and the proxy tool refers to a tool that proxyes the resource of the accessed server as a local resource;

The first sending module 430 is configured to: when the second detecting module detects that the first predetermined field is included in the order parameter, and the value of the first predetermined field is the predetermined value, to the webpage page Sending the first error code and prohibiting the execution of the value transfer operation corresponding to the first order.

In an optional embodiment, the first detecting module 410 includes: a calculating unit, configured to calculate a verification signature according to the predetermined digital signature rule according to the order parameter; and a detecting unit, configured to detect the signature and Whether the verification signature obtained by the calculating unit is consistent; the first determining unit is configured to determine that the signature is correct when the detecting unit detects that the signature is consistent with the verification signature.

In an optional embodiment, as shown in FIG. 5, the apparatus further includes: a second determining unit 442, configured to determine, when the detecting unit detects that the signature is inconsistent with the verification signature, The second sending module 444 is configured to: when the second determining unit determines the signature error, send a second error code to the webpage page, and prohibit performing the numerical transfer corresponding to the first order operating.

In an optional embodiment, as shown in FIG. 5, the device further includes: a marking module 462, configured to record an order number of the first order in a database of the device, and mark the order number corresponding to The first order is a target order, the order number of the first order is used to uniquely identify the first order, the target order is a value transfer order using a proxy tool; and the query module 464 is configured to receive When the second order is submitted, the database is queried according to the order number of the second order whether the second order belongs to the target order marked by the marking module; the first sending module 430 further And when the query module queries that the second order belongs to the target order, sending the first error code to the webpage page.

In an optional embodiment, the apparatus further includes: a verification module 480, configured to: when the first detection module detects that the signature is correct and the second detection module detects that the order parameter is not When the first predetermined field is detected, or when the first detecting module detects that the signature is correct and the second detecting module detects that the value of the first predetermined field is not the predetermined value, continuing to perform normal The other verification process of the value transfer includes at least one of verifying the commission, verifying whether the payment is successful, and verifying whether the payment authority is available.

Figure 6 is a block diagram showing the structure of a numerical value transfer device provided in another embodiment of the present application, which is exemplified in the terminal 110 shown in Figure 1. As shown in FIG. 6, the value transfer device may include: a third detection module 618, an evaluation module 620, a calculation module 630, a third transmission module 640, and a first receiving module 650.

The third detecting module 618 is configured to detect, when the webpage is opened, whether the device is running a proxy tool, where the proxy tool is a tool that proxyes resources of the accessed server as local resources;

An evaluation module 620, configured to: when the third detecting module 610 detects that the device is running the proxy tool, set a value of the first predetermined field to a predetermined value, where the first predetermined field is used to indicate whether to use the proxy tool;

a calculation module 630, configured to calculate, by using a predetermined digital signature rule, an order parameter of the first order, where the order parameter includes the first predetermined field and another value transfer operation corresponding field;

a third sending module 640, configured to send the signature obtained by the calculating module and the order parameter to a server;

The first receiving module 650 is configured to receive the first error code sent by the server, where the first error code is used to prompt to prohibit execution of the value transfer operation.

In an optional embodiment, the evaluation module 620 is further configured to: when the device is running the proxy tool, set a value of the second predetermined field to a name of the proxy tool, the second predetermined The field is an order parameter in the first order.

In an optional embodiment, the apparatus further includes:

The second receiving module 660 is configured to receive a second error code sent by the server, where the second error code is used to prompt the signature error and prohibit to continue to perform the value transfer operation.

In an optional embodiment, the third sending module 640 is configured to send a signature of the second order and an order parameter to the server when the second order is submitted, the order of the second order The parameter further includes an order number of the second order, the order number of the second order is used to uniquely identify the second order, and the order number of the second order is used to trigger the server to query the database Whether the second order belongs to the target order, and the target order is a value transfer order using the agent tool;

The first receiving module 650 is further configured to receive the first error code sent by the server, where the first error code is sent by the server when querying that the second order belongs to the target order .

In an optional embodiment, the third detecting module 618 includes: a detecting unit, configured to detect whether a target agent tool is run in a resource manager of the device, where the target agent tool is a pre-configured agent At least one of the tool list; the third determining unit, configured to: when the detecting unit detects that the target agent tool is run in the resource manager of the device, determine that the device is running the agent tool; And a determining unit, configured to determine that the device does not run the proxy tool when the detecting unit detects that the target agent tool is not running in the resource manager of the device.

It should be noted that the numerical value transfer device provided in the above embodiment is only exemplified by the division of the above functional modules when transferring the numerical value. In actual applications, the above functional distribution can be completed by different functional modules as needed. The internal structure of the terminal or server is divided into different functional modules to complete all or part of the functions described above. In addition, the numerical value transfer device and the numerical value transfer method are provided in the same embodiment, and the specific implementation process is described in detail in the method embodiment, and details are not described herein again.

FIG. 7 is a schematic structural diagram of a server provided in an embodiment of the present application. The server can be the server 120 shown in FIG. Specifically, the server 600 includes a central processing unit (CPU) 601, a system memory 604 including a random access memory (RAM) 602 and a read only memory (ROM) 603, and a system bus that connects the system memory 604 and the central processing unit 601. 605. The server 600 also includes a basic input/output system (I/O system) 606 that facilitates transfer of information between various devices within the computer, and mass storage for storing the operating system 613, applications 614, and other program modules 615. Device 607.

The basic input/output system 606 includes a display 608 for displaying information and an input device 609 such as a mouse or keyboard for user input of information. The display 608 and input device 609 are both connected to the central processing unit 601 by an input/output controller 610 that is coupled to the system bus 605. The basic input/output system 606 can also include an input output controller 610 for receiving and processing input from a plurality of other devices, such as a keyboard, mouse, or electronic stylus. Similarly, input/output controller 610 also provides output to a display screen, printer, or other type of output device.

The mass storage device 607 is connected to the central processing unit 601 by a mass storage controller (not shown) connected to the system bus 605. The mass storage device 607 and its associated computer readable medium provide non-volatile storage for the server 600. That is, the mass storage device 607 can include a computer readable medium (not shown) such as a hard disk or a CD-ROM drive.

Without loss of generality, the computer readable medium can include computer storage media and communication media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, EPROM, EEPROM, flash memory or other solid state storage technologies, CD-ROM, DVD or other optical storage, tape cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices. Of course, those skilled in the art will appreciate that the computer storage medium is not limited to the above. The system memory 604 and mass storage device 607 described above may be collectively referred to as a memory.

According to various embodiments of the present application, the server 600 may also be operated by a remote computer connected to the network through a network such as the Internet. That is, the server 600 can be connected to the network 612 through a network interface unit 611 connected to the system bus 605, or can also be connected to other types of networks or remote computer systems (not shown) using the network interface unit 611. .

The system memory 604 also includes one or more programs, the one or more programs being stored in the system memory 604, and the central processing unit 601 implementing the server in the method embodiment by executing the one or more programs. Side value transfer method. Exemplary:

The central processing unit 601 is configured to execute the one or more instructions to implement the following steps:

In an optional embodiment, the central processing unit 601 is further configured to execute the one or more instructions to implement the following steps:

Calculating a verification signature according to the predetermined digital signature rule according to the order parameter;

Detecting whether the signature is consistent with the verification signature;

When the signature is consistent with the verification signature, it is determined that the signature is correct.

Determining the signature error when the signature is inconsistent with the verification signature;

When the signature error is determined, the second error code is sent to the web page, and the numerical transfer operation corresponding to the first order is prohibited from continuing.

Recording an order number of the first order in a database of the server, marking the first order corresponding to the order number as a target order, and the order number of the first order is used to uniquely identify the first order The target order is a value transfer order using a proxy tool;

After the sending the first error code to the webpage page, the method further includes:

When receiving the submit request of the second order, querying, in the database, whether the second order belongs to the target order according to the order number of the second order;

When the second order belongs to the target order, the first error code is sent to the webpage page.

When the signature is correct and the first predetermined field is absent from the order parameter, or when the signature is correct and the value of the first predetermined field is not the predetermined value, the normal value transfer is continued. The other verification process includes at least one of verifying the commission, verifying whether the payment is successful, and verifying whether the payment authority is available.

Referring to FIG. 8, there is shown a block diagram showing the structure of a terminal provided in some embodiments of the present application. The terminal 700 is configured to implement the numerical value transfer method provided by the foregoing embodiment. The terminal 700 in this application may include one or more of the following components: a processor for executing computer program instructions to perform various processes and methods for information and storage of program instructions, random access memory (RAM), and read-only Memory (ROM), memory for storing data and information, I/O devices, interfaces, antennas, etc. Specifically:

The terminal 700 may include an RF (Radio Frequency) circuit 710, a memory 720, an input unit 730, a display unit 740, a sensor 750, an audio circuit 760, a WiFi (Wireless Fidelity) module 770, a processor 780, and a power supply 782. , camera 790 and other components. It will be understood by those skilled in the art that the terminal structure shown in FIG. 8 does not constitute a limitation to the terminal, and may include more or less components than those illustrated, or a combination of certain components, or different component arrangements.

The components of the terminal 700 will be specifically described below with reference to FIG. 8:

The RF circuit 710 can be used for transmitting and receiving information or during a call, and receiving and transmitting the signal. Specifically, after receiving the downlink information of the base station, the processor 780 processes the data. In addition, the uplink data is designed to be sent to the base station. Generally, RF circuits include, but are not limited to, an antenna, at least one amplifier, a transceiver, a coupler, an LNA (Low Noise Amplifier), a duplexer, and the like. In addition, RF circuitry 710 can also communicate with the network and other devices via wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access). , Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), e-mail, SMS (Short Messaging Service), and the like.

The memory 720 can be used to store software programs and modules, and the processor 780 executes various functional applications and data processing of the terminal 700 by running software programs and modules stored in the memory 720. The memory 720 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored according to The data created by the use of the terminal 700 (such as audio data, phone book, etc.) and the like. Moreover, memory 720 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.

The input unit 730 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function control of the terminal 700. Specifically, the input unit 730 may include a touch panel 731 and other input devices 732. The touch panel 731, also referred to as a touch screen, can collect touch operations on or near the user (such as the user using a finger, a stylus, or the like on the touch panel 731 or near the touch panel 731. Operation), and drive the corresponding connecting device according to a preset program. Optionally, the touch panel 731 can include two parts: a touch detection device and a touch controller. Wherein, the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information. The processor 780 is provided and can receive commands from the processor 780 and execute them. In addition, the touch panel 731 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch panel 731, the input unit 730 may also include other input devices 732. In particular, other input devices 732 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.

The display unit 740 can be used to display information input by the user or information provided to the user and various menus of the terminal 700. The display unit 740 can include a display panel 741. Alternatively, the display panel 741 can be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like. Further, the touch panel 731 can cover the display panel 741. When the touch panel 731 detects a touch operation on or near the touch panel 731, it transmits to the processor 780 to determine the type of the touch event, and then the processor 780 according to the touch event. The type provides a corresponding visual output on display panel 741. Although the touch panel 731 and the display panel 741 are used as two independent components to implement the input and input functions of the terminal 700 in FIG. 7, in some embodiments, the touch panel 731 can be integrated with the display panel 741. The input and output functions of the terminal 700 are implemented.

Terminal 700 can also include at least one type of sensor 750, such as a gyro sensor, a magnetic induction sensor, a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 741 according to the brightness of the ambient light, and the proximity sensor may close the display panel 741 when the terminal 700 moves to the ear. / or backlight. As a kind of motion sensor, the acceleration sensor can detect the magnitude of acceleration in each direction (usually three axes). When it is stationary, it can detect the magnitude and direction of gravity. It can be used to identify the attitude of the terminal (such as horizontal and vertical screen switching, related games). , magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping), etc.; other sensors such as barometers, hygrometers, thermometers, infrared sensors, etc., which can also be configured in the terminal 700, are not described here.

An audio circuit 760, a speaker 761, and a microphone 762 can provide an audio interface between the user and the terminal 700. The audio circuit 760 can transmit the converted electrical data of the received audio data to the speaker 761 for conversion to the sound signal output by the speaker 761; on the other hand, the microphone 762 converts the collected sound signal into an electrical signal by the audio circuit 760. After receiving, it is converted into audio data, and then processed by the audio data output processor 780, transmitted to the terminal, for example, via the RF circuit 710, or the audio data is output to the memory 720 for further processing.

WiFi is a short-range wireless transmission technology, and the terminal 700 can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 770, which provides wireless broadband Internet access for users. Although FIG. 8 shows the WiFi module 770, it can be understood that it does not belong to the essential configuration of the terminal 700, and may be omitted as needed within the scope of not changing the essence of the disclosure.

Processor 780 is the control center of terminal 700, which connects various portions of the entire terminal using various interfaces and lines, by running or executing software programs and/or modules stored in memory 720, and recalling data stored in memory 720, The various functions and processing data of the terminal 700 are performed to perform overall monitoring of the terminal. Optionally, the processor 780 may include one or more processing units; preferably, the processor 780 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like. The modem processor primarily handles wireless communications. It will be appreciated that the above described modem processor may also not be integrated into the processor 780.

The terminal 700 also includes a power source 782 (such as a battery) for powering various components. Preferably, the power source can be logically coupled to the processor 780 through a power management system to manage functions such as charging, discharging, and power management through the power management system.

The camera 790 is generally composed of a lens, an image sensor, an interface, a digital signal processor, a CPU, a display screen, and the like. The lens is fixed above the image sensor, and the focus can be changed by manually adjusting the lens; the image sensor is equivalent to the "film" of the conventional camera, and is the heart of the image captured by the camera; the interface is used to connect the camera with the cable and the board to the board. And the spring-type connection mode is connected to the terminal board, and the collected image is sent to the memory 720; the digital signal processor processes the acquired image through a mathematical operation, converts the collected analog image into a digital image, and sends the image to the interface Memory 720.

Although not shown, the terminal 700 may further include a Bluetooth module or the like, and details are not described herein again. The memory 720 further includes one or more programs, the one or more programs are stored in a memory, and the processor 780 implements the value transfer method on the terminal side in the foregoing method embodiment by executing the one or more programs. Schematic:

The processor 780 is configured to execute the one or more instructions to implement the following steps:

When the webpage page is opened, detecting whether the terminal is running an agent tool, the proxy tool is a tool for proxying resources of the accessed server as a local resource; when the terminal is running the proxy tool, making the first The predetermined field value is a predetermined value, the first predetermined field is used to indicate whether to use the proxy tool; the order parameter of the first order is calculated according to a predetermined digital signature rule, and the order parameter includes the first predetermined field and The other value transfer operation corresponding field; sending the signature and the order parameter to the server; receiving the first error code sent by the server, the first error code being used to prompt to prohibit execution of the Numerical transfer operation.

In an optional embodiment, the processor 780 is further configured to execute the one or more instructions to implement the following steps:

When the terminal is running the agent tool, the value of the second predetermined field is the name of the agent tool, and the second predetermined field is an order parameter in the first order.

Receiving a second error code sent by the server, the second error code is used to prompt the signature error and prohibit to continue performing the value transfer operation.

When submitting the second order, sending the signature and order parameters of the second order to the server, the order parameter of the second order further includes an order number of the second order, and an order of the second order The number is used to uniquely identify the second order, and the order number of the second order is used to trigger the server to query in the database whether the second order belongs to a target order, and the target order is a value transfer using a proxy tool. And receiving the first error code sent by the server, where the first error code is sent by the server when querying that the second order belongs to the target order.

Detecting whether a target agent tool is run in a resource manager of the terminal, the target agent tool is at least one of a pre-configured list of agent tools; when the target agent tool is run in a resource manager of the terminal Determining that the terminal is running the proxy tool; when any of the target proxy tools are not running in the resource manager of the terminal, determining that the terminal is not running the proxy tool.

The embodiment of the present application further provides a computer readable storage medium, which may be a computer readable storage medium included in the memory in the foregoing embodiment, or may exist separately, not assembled into a terminal or A computer readable storage medium in a server. The computer readable storage medium stores one or more programs that are used by one or more processors to perform the terminal side and/or server side numerical transfer methods described above.

The serial numbers of the embodiments of the present application are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

A person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium. The storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

The above is only the preferred embodiment of the present application, and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application are included in the protection of the present application. Within the scope.

Claims

A numerical value transfer method is applied to a server, the method comprising:

After receiving the order parameter and the signature of the first order sent by the webpage page in the terminal, detecting whether the signature is correct according to the order parameter and the signature, the order parameter includes a parameter value of each field before the signature, The signature is obtained by the order parameter according to a predetermined digital signature rule;

When the signature is correct, detecting whether the first predetermined field is included in the order parameter, and the value of the first predetermined field is a predetermined value, and the value of the first predetermined field is the predetermined value The terminal uses a proxy tool, which refers to a tool that proxyes the resources of the accessed server as a local resource;

When the first predetermined field is included in the order parameter and the value of the first predetermined field is the predetermined value, sending a first error code to the webpage page, and prohibiting execution of the first order correspondence The value transfer operation.
The method according to claim 1, wherein the detecting whether the signature is correct according to the order parameter and the signature comprises:

Calculating a verification signature according to the predetermined digital signature rule according to the order parameter;

Detecting whether the signature is consistent with the verification signature;

When the signature is consistent with the verification signature, it is determined that the signature is correct.
The method according to claim 2, further comprising: after detecting whether the signature is correct according to the order parameter and the signature, further comprising:

Determining the signature error when the signature is inconsistent with the verification signature;

When the signature error is determined, the second error code is sent to the web page, and the numerical transfer operation corresponding to the first order is prohibited from continuing.
The method according to claim 1, wherein before the sending the first error code to the webpage page, the method further comprises:

Recording an order number of the first order in a database of the server, marking the first order corresponding to the order number as a target order, and the order number of the first order is used to uniquely identify the first order The target order is a value transfer order using a proxy tool;

After the sending the first error code to the webpage page, the method further includes:

When receiving the submit request of the second order, querying, in the database, whether the second order belongs to the target order according to the order number of the second order;

When the second order belongs to the target order, the first error code is sent to the webpage page.
The method according to any one of claims 1 to 4, wherein the method further comprises:

When the signature is correct and the first predetermined field is absent from the order parameter, or when the signature is correct and the value of the first predetermined field is not the predetermined value, the normal value transfer is continued. The other verification process includes at least one of verifying the commission, verifying whether the payment is successful, and verifying whether the payment authority is available.
A numerical value transfer method is applied to a terminal, the method comprising:

When the web page is opened, detecting whether the terminal is running a proxy tool, and the proxy tool is a tool for proxying a resource of the accessed server as a local resource;

When the terminal is running the proxy tool, the value of the first predetermined field is set to a predetermined value, and the first predetermined field is used to indicate whether to use the proxy tool;

The order parameter of the first order is calculated according to a predetermined digital signature rule, and the order parameter includes the first predetermined field and other value transfer operation corresponding fields;

Sending the signature and the order parameter to the server;

Receiving the first error code sent by the server, where the first error code is used to prompt to prohibit execution of the value transfer operation.
The method of claim 6 wherein the method further comprises:

When the terminal is running the agent tool, the value of the second predetermined field is the name of the agent tool, and the second predetermined field is an order parameter in the first order.
The method according to claim 6, wherein after the sending the signature and the order parameter to the server, the method further comprises:

Receiving a second error code sent by the server, the second error code is used to prompt the signature error and prohibit to continue performing the value transfer operation.
The method according to claim 6, wherein after receiving the second error code sent by the server, the method further comprises:

When submitting the second order, sending the signature and order parameters of the second order to the server, the order parameter of the second order further includes an order number of the second order, and an order of the second order The number is used to uniquely identify the second order, and the order number of the second order is used to trigger the server to query in the database whether the second order belongs to a target order, and the target order is a value transfer using a proxy tool. Order

Receiving the first error code sent by the server, where the first error code is sent by the server when querying that the second order belongs to the target order.
The method according to any one of claims 6 to 9, wherein the detecting whether the terminal is running the agent tool comprises:

Detecting whether a target agent tool is running in the resource manager of the terminal, where the target agent tool is at least one of a pre-configured list of agent tools;

Determining that the terminal is running the proxy tool when the target agent tool is run in a resource manager of the terminal;

When the target agent tool is not running in the resource manager of the terminal, it is determined that the terminal does not run the agent tool.
A numerical transfer device, characterized in that the device comprises:

a first detecting module, configured to: after receiving an order parameter and a signature of the first order sent by the webpage page in the terminal, detecting whether the signature is correct according to the order parameter and the signature, where the order parameter includes a signature a parameter value of each field, the signature being obtained by the order parameter according to a predetermined digital signature rule;

a second detecting module, configured to: when the first detecting module detects that the signature is correct, detecting whether the first predetermined field is included in the order parameter, and the value of the first predetermined field is a predetermined value, When the value of the first predetermined field is the predetermined value, the terminal uses the proxy tool, and the proxy tool refers to a tool that proxyes the resource of the accessed server as a local resource;

a first sending module, configured to send, to the webpage, when the second detecting module detects that the first predetermined field is included in the order parameter and the value of the first predetermined field is the predetermined value The first error code, and prohibiting the execution of the value transfer operation corresponding to the first order.
The device according to claim 11, wherein the first detecting module comprises:

a calculating unit, configured to calculate a verification signature according to the predetermined digital signature rule according to the order parameter;

a detecting unit, configured to detect whether the signature is consistent with the verification signature obtained by the computing unit;

The first determining unit is configured to determine that the signature is correct when the detecting unit detects that the signature is consistent with the verification signature.
The device according to claim 11, wherein the device further comprises:

a second determining unit, configured to determine the signature error when the detecting unit detects that the signature is inconsistent with the verification signature;

And a second sending module, configured to: when the second determining unit determines the signature error, send a second error code to the webpage page, and prohibit performing the numerical transfer operation corresponding to the first order.
The device according to claim 10, wherein the device further comprises:

a marking module, configured to record an order number of the first order in a database of the device, mark that the first order corresponding to the order number is a target order, and an order number of the first order is used for unique identification The first order, the target order is a value transfer order using a proxy tool;

a query module, configured to query, in the database, whether the second order belongs to the target order marked by the marking module according to the order number of the second order when receiving the submit request of the second order;

The first sending module is further configured to: when the query module queries that the second order belongs to the target order, send the first error code to the webpage page.
The device according to any one of claims 10 to 14, wherein the device further comprises:

a verification module, configured to: when the first detection module detects that the signature is correct, and the second detection module detects that the first predetermined field is not included in the order parameter, or in the first detection module And detecting that the signature is correct and the second detecting module detects that the value of the first predetermined field is not the predetermined value, and continues to perform another verification process of a normal value transfer, where the other verification process includes Verify the commission, verify whether the payment is successful, and verify that at least one of the payment rights is available.
A numerical transfer device, characterized in that the device comprises:

a third detecting module, configured to detect, when the webpage is opened, whether the device is running a proxy tool, where the proxy tool is a tool that proxyes resources of the accessed server as local resources;

An evaluation module, configured to: when the third detecting module detects that the device is running the proxy tool, set a value of a first predetermined field to a predetermined value, where the first predetermined field is used to indicate whether to use a proxy tool;

a calculation module, configured to calculate a signature of the order parameter of the first order according to a predetermined digital signature rule, where the order parameter includes the first predetermined field and other value transfer operation corresponding fields;

a third sending module, configured to send the signature obtained by the calculating module and the order parameter to a server;

And a first receiving module, configured to receive the first error code sent by the server, where the first error code is used to prompt to prohibit execution of the value transfer operation.
The device according to claim 16, wherein the evaluation module is further configured to: when the device is running the proxy tool, cause a value of the second predetermined field to be a name of the proxy tool, The second predetermined field is an order parameter in the first order.
The device according to claim 16, wherein the device further comprises:

And a second receiving module, configured to receive a second error code sent by the server, where the second error code is used to prompt the signature error and prohibit to continue to perform the value transfer operation.
The device of claim 16 wherein:

The third sending module is configured to send a signature of the second order and an order parameter to the server when submitting the second order, where the order parameter of the second order further includes an order of the second order No. The order number of the second order is used to uniquely identify the second order, and the order number of the second order is used to trigger the server to query in the database whether the second order belongs to a target order, The target order is a value transfer order using the agent tool;

The first receiving module is further configured to receive the first error code sent by the server, where the first error code is sent by the server when querying that the second order belongs to the target order.
The device according to any one of claims 16 to 19, wherein the third detecting module comprises:

a detecting unit, configured to detect whether a target agent tool is run in a resource manager of the device, where the target agent tool is at least one of a pre-configured list of agent tools;

a third determining unit, configured to: when the detecting unit detects that the target agent tool is run in a resource manager of the device, determine that the device is running the agent tool;

And a fourth determining unit, configured to: when the detecting unit detects that the target agent tool is not running in the resource manager of the device, determine that the device does not run the agent tool.
A server, characterized in that the server comprises a system memory and a central processing unit, the system memory storing one or more instructions, and the central processing unit for executing the one or more instructions implements the following steps:

After receiving the order parameter and the signature of the first order sent by the webpage page in the terminal, detecting whether the signature is correct according to the order parameter and the signature, the order parameter includes a parameter value of each field before the signature, The signature is obtained by the order parameter according to a predetermined digital signature rule;

When the signature is correct, detecting whether the first predetermined field is included in the order parameter, and the value of the first predetermined field is a predetermined value, and the value of the first predetermined field is the predetermined value The terminal uses a proxy tool, which refers to a tool that proxyes the resources of the accessed server as a local resource;

When the first predetermined field is included in the order parameter and the value of the first predetermined field is the predetermined value, sending a first error code to the webpage page, and prohibiting execution of the first order correspondence The value transfer operation.
The server according to claim 21, wherein the central processing unit is further configured to execute the one or more instructions to implement the following steps:

Calculating a verification signature according to the predetermined digital signature rule according to the order parameter;

Detecting whether the signature is consistent with the verification signature;

When the signature is consistent with the verification signature, it is determined that the signature is correct.
The server according to claim 22, wherein the central processing unit is further configured to execute the one or more instructions to implement the following steps:

Determining the signature error when the signature is inconsistent with the verification signature;

When the signature error is determined, the second error code is sent to the web page, and the numerical transfer operation corresponding to the first order is prohibited from continuing.
The server according to claim 21, wherein the central processing unit is further configured to execute the one or more instructions to implement the following steps:

Recording an order number of the first order in a database of the server, marking the first order corresponding to the order number as a target order, and the order number of the first order is used to uniquely identify the first order The target order is a value transfer order using a proxy tool;

After the sending the first error code to the webpage page, the method further includes:

When receiving the submit request of the second order, querying, in the database, whether the second order belongs to the target order according to the order number of the second order;

When the second order belongs to the target order, the first error code is sent to the webpage page.
The server according to any one of claims 21 to 24, wherein the central processing unit is further configured to execute the one or more instructions to implement the following steps:

When the signature is correct and the first predetermined field is absent from the order parameter, or when the signature is correct and the value of the first predetermined field is not the predetermined value, the normal value transfer is continued. The other verification process includes at least one of verifying the commission, verifying whether the payment is successful, and verifying whether the payment authority is available.
A terminal, comprising: a memory and a processor, the memory storing one or more instructions, and the processor is configured to execute the one or more instructions to implement the following steps:

When the web page is opened, detecting whether the terminal is running a proxy tool, and the proxy tool is a tool for proxying a resource of the accessed server as a local resource;

When the terminal is running the proxy tool, the value of the first predetermined field is set to a predetermined value, and the first predetermined field is used to indicate whether to use the proxy tool;

The order parameter of the first order is calculated according to a predetermined digital signature rule, and the order parameter includes the first predetermined field and other value transfer operation corresponding fields;

Sending the signature and the order parameter to the server;

Receiving the first error code sent by the server, where the first error code is used to prompt to prohibit execution of the value transfer operation.
The terminal according to claim 26, wherein the processor is further configured to execute the one or more instructions to implement the following steps:

When the terminal is running the agent tool, the value of the second predetermined field is the name of the agent tool, and the second predetermined field is an order parameter in the first order.
The terminal according to claim 26, wherein said processor is further configured to execute said one or more instructions to implement the following steps:

Receiving a second error code sent by the server, the second error code is used to prompt the signature error and prohibit to continue performing the value transfer operation.
The terminal according to claim 26, wherein the processor is further configured to execute the one or more instructions to implement the following steps:

When submitting the second order, sending the signature and order parameters of the second order to the server, the order parameter of the second order further includes an order number of the second order, and an order of the second order The number is used to uniquely identify the second order, and the order number of the second order is used to trigger the server to query in the database whether the second order belongs to a target order, and the target order is a value transfer using a proxy tool. Order

Receiving the first error code sent by the server, where the first error code is sent by the server when querying that the second order belongs to the target order.
The terminal according to any one of claims 26 to 29, wherein the processor is further configured to execute the one or more instructions to implement the following steps:

Detecting whether a target agent tool is running in the resource manager of the terminal, where the target agent tool is at least one of a pre-configured list of agent tools;

Determining that the terminal is running the proxy tool when the target agent tool is run in a resource manager of the terminal;

When the target agent tool is not running in the resource manager of the terminal, it is determined that the terminal does not run the agent tool.
A computer readable storage medium, wherein the storage medium stores one or more instructions, and the one or more instructions are used to implement the method of any one of claims 1 to 5 And/or the method of any of claims 6 to 10.