WO2018166359A1

WO2018166359A1 - Mobile payment sublicensing method and payment system implemented by using same

Info

Publication number: WO2018166359A1
Application number: PCT/CN2018/077845
Authority: WO
Inventors: 孙权
Original assignee: 中国银联股份有限公司
Priority date: 2017-03-17
Filing date: 2018-03-02
Publication date: 2018-09-20
Also published as: TW201835824A; CN107256484B; CN107256484A; TWI775820B

Abstract

The present invention relates to a mobile payment licensing method and a system thereof. The method comprises the following steps: a main user terminal is bound with a payment account; the main user terminal and a slave user terminal respectively log into a server, and the main user terminal sends a sublicensing request to the server; the server verifies the sublicensing request and issues a Token and a transaction secret key to the slave user terminal after the sublicensing request passes the verification; and the slave user terminal carries out payment according to the Token and the transaction secret key. According to the present invention, mobile payment sublicensing between family members and friends may be achieved on the basis of trust, and using the Token and the transaction secret key may ensure security of the transaction. Additionally, when a user is paying, the user does not need to input a password, thus making payment quick and convenient and providing a good user experience. Furthermore, a user end mobile phone may achieve the payment transaction without needing to connect to the Internet.

Description

Mobile payment transfer authorization method and payment system realized by the same

Technical field

The present invention relates to computer communication technologies, and in particular, to a mobile payment transfer authorization method based on a payment token (Token), a payment system implemented by the mobile payment transfer authorization method, a mobile terminal, and a server.

Background technique

Existing mainstream payment methods require a password to verify the identity of the user to achieve payment. This has the following disadvantages,

First, the user needs to input a password to pay, the payment process is troublesome, and the user experience is poor.

Second, mobile payment needs to be bound to its own bank card, and it is impossible to realize shared bank card payment between family or friends.

Third, the user account password may be stolen, posing a security risk.

Summary of the invention

In view of the above problems, an object of the present invention is to provide a trust-based mobile payment transfer authorization method between family members or friends and a mobile payment transfer authorization system realized by the method under the premise of ensuring payment security. .

The mobile payment authorization method of the present invention is implemented by a primary user terminal, a user terminal, a server, and a merchant terminal, and the method includes the following steps:

Binding step, the primary user terminal is bound to the payment account;

The authorization request requesting step, the main user terminal and the user terminal respectively log in to the server, and the main user terminal sends a transfer authorization request to the server;

Transfer the authorization request verification step, the server verifies the transfer authorization request, and after verification, issues a token to the slave user terminal;

In the transfer authorization process, payment is implemented from the user terminal based on the Token and the transaction key.

Preferably, in the transfer authorization request, the primary user terminal presets one or more of an authorization limited amount, an authorization limited time, an authorized limited place, an authorized limited merchant, and whether a transaction confirmation is required.

Preferably, the transfer authorization request verification step comprises the following sub-steps:

The server checks the transfer authorization request;

After passing the verification, the token and the transaction key are issued to the slave user terminal at one time;

The Token and transaction keys are saved from the user terminal in a secure element or saved in the cloud.

Preferably, the transfer authorization payment step comprises the following sub-steps:

When a payment transaction is made from a user terminal, a Token is generated in the cloud or a local security element instead of a PAN. With the Token, a transaction key is used for each transaction, and the transaction elements (including Token, transaction amount, merchant number, terminal number, etc.) are used. Information) is encrypted to form a transaction ciphertext, and a consumer transaction is performed at the transaction terminal;

The merchant terminal sends the transaction information including the current consumption location, the merchant number, the transaction amount, and the transaction token and the transaction ciphertext to the server;

The server verifies the transaction token, decrypts the transaction ciphertext information, and verifies the validity of the transaction identity; in the case of successful verification, the server returns the verification success to the merchant terminal and completes the payment.

Preferably, in a sub-step of the server verifying the transaction token, the server verifies the transaction token and determines, according to the need, whether one or more of the transaction amount, the transaction time, the transaction location, and the transaction merchant are pre-set in the transfer authorization request. set.

Preferably, in the sub-step of the server verifying the transaction token, the method further comprises: the server sending the transaction information to the main user terminal for confirming the transaction, and in the case that the main user terminal confirms that the transaction is executable, the server returns the verification success to the merchant terminal.

The mobile payment transfer authorization system of the present invention is characterized by comprising:

a primary user terminal for binding with a payment account and for submitting a delegation authorization request to a server described below;

From the user terminal, for accepting the Token and transaction key sent by the following server, storing it in the security unit or storing it in the cloud, and using the Token to combine the transaction key for transaction;

a server, configured to check the transfer authorization request from the primary user terminal and generate a Token and a transaction key in the case of verification and deliver the token and the transaction key to the slave user terminal, and use it to verify the transaction when performing transaction payment Describe the transaction token and transaction ciphertext sent from the user terminal and complete the transaction if the verification passes;

The merchant terminal is configured to submit transaction information from the user terminal including the transaction token, the merchant number, the transaction amount, and the transaction ciphertext to the server when the slave user terminal consumes at the merchant terminal.

Preferably, the primary user terminal sets one or more of an authorized limited amount, an authorized limited time, an authorized limited place, an authorized limited merchant, and the like in the transfer authorization request.

Preferably, the merchant terminal has:

LBS module for obtaining the trading location where the transaction is generated;

a communication module, configured to upload a transaction place and transaction information generated by the transaction to the server.

Preferably, the server is provided with: a Token authorization module, configured to generate a Token and a transaction key, and send the Token and the transaction key to the slave user terminal; and a location calculation module, configured to calculate a transaction location and an authorization limit The distance between the locations, whether the comparison meets the conditions for the authorized location defined in the transfer authorization request.

Preferably, the Token authorization module is further configured to set a certain life cycle for the Token.

Preferably, the primary user terminal sets whether a transaction confirmation is required in the transfer authorization request, and if the transaction confirmation is required, the server forwards the information about the transaction to the primary user terminal and confirms by the primary user terminal. The transaction is allowed only after confirmation by the primary user terminal.

The mobile terminal of the present invention is characterized in that

The mobile terminal is configured to accept the Token and the transaction key sent by the server, store the Token and the transaction key in the security unit or store in the cloud, and use the Token to combine the transaction key for the transaction.

The server of the present invention is used to implement the transfer authorization of the primary user terminal to the user terminal, wherein

Used to check the transfer authorization request from the primary user terminal and generate it by checking

The Token and the transaction key are sent to the slave user terminal for verifying the transaction token and the transaction ciphertext sent from the slave user terminal when the transaction payment is made and completing the transaction payment if the verification is passed.

Preferably, the server of the present invention is provided with:

a Token authorization module, configured to generate a Token and a transaction key, and send the Token and the transaction key to the slave user terminal;

And a location calculation module, configured to calculate a distance between the transaction location and the authorized restriction location, and whether the comparison meets the condition for the authorized authorized location set in the transfer authorization request.

According to the present invention, it is possible to perform mobile payment transfer authorization from the primary user terminal to the secondary user terminal, thereby enabling trust-based mobile payment transfer authorization between family members and friends. Among them, the Token and the transaction key can be used to implement the transaction, thereby ensuring the security of the transaction. Moreover, the user does not need to input a password when paying, which is quick and convenient, and the user experience is good. On the other hand, since a plurality of Tokens and a plurality of transaction keys can be received and stored in advance from the user terminal, the payment transaction can be performed from the user terminal without networking.

DRAWINGS

1 is a flow chart showing a mobile payment transfer authorization method of the present invention.

2 is a flow chart showing an embodiment of a mobile payment transfer authorization method of the present invention.

Fig. 3 is a block diagram showing the construction of an embodiment of the mobile payment transfer authorization system of the present invention.

detailed description

The following are some of the various embodiments of the invention, which are intended to provide a basic understanding of the invention. It is not intended to identify key or critical elements of the invention or the scope of the invention.

First, some terms that will appear in the present invention will be described.

Card emulation technology is a technology that simulates an NFC terminal as a card as a whole and is accessed by a card reader.

Token technology means that the Token SP generates a Token according to the PAN (primary account) provided by the Token Requestor, and then transfers the Token as a substitute value of the PAN to each part of the payment, so that in the payment process, the unique PAN is only in the Token SP, and the transfer is performed. The transfer between the party and the card issuer, because the three private lines are connected and mutual trust, and when the Token is detected to be risky or expires, a new Token replacement will be generated again, thereby greatly reducing the possibility of PAN leakage during the payment process, greatly improving The security of the PAN.

The LBS location service is also called a Location Based Service (LBS), which acquires location information (latitude and longitude coordinates) of a mobile terminal user through a telecommunication mobile operator's network (eg, GSM network, CDMA network).

PAN refers to the bank card master account issued by the bank, which is generally composed of the card issuer identity, personal account identifier and check digit.

HCE (host-based card emulation) refers to host-based card emulation, which implements card emulation on a mobile terminal equipped with an NFC function.

First, the mobile payment transfer authorization method of the present invention will be described.

As shown in FIG. 1, the mobile payment authorization method of the present invention is implemented by a primary user terminal, a secondary user terminal, a server, and a merchant terminal, and the method includes the following steps:

Binding step S100: the primary user terminal is bound to the payment account;

The transfer authorization request is submitted to step S200: the primary user terminal and the secondary user terminal respectively log in to the server, and the primary user terminal sends a transfer authorization request to the server, wherein in the transfer authorization request, the primary user terminal can set the authorized limit amount and the authorization limit according to the need. Time, authorized limited location, authorized qualified merchants, etc., can also set whether to require transaction confirmation according to needs;

Transfer authorization request verification step S300: the server verifies the transfer authorization request, and after verification, issues the token and the transaction key to the slave user terminal at one time;

Transfer Authorization Payment Step S400: Implementing payment from the user terminal using the Token and the transaction key, wherein the Token and the transaction key are saved from the user terminal in their secure element (SE) or saved in the cloud, and the payment is made from the user terminal During the transaction, the cloud or local security element (SE) generates a Token, which uses the Token to support the cloud flash payment transaction terminal on the merchant side for the consumer transaction. The merchant terminal will include the current consumption location, the merchant number, the transaction amount, and the transaction token, transaction. The relevant consumer information, such as ciphertext, is transmitted to the server, and the server verifies the transaction token and the transaction ciphertext, and completes the payment if the verification is successful.

Next, an embodiment of a specific application of the mobile payment transfer authorization method of the present invention will be described.

The mobile payment transfer authorization method of this embodiment is implemented by the primary user terminal 100, the user terminal 200, the server 300, and the merchant terminal 400.

As shown in FIG. 2, the mobile payment transfer authorization method according to an embodiment of the present invention includes the following specific steps:

1 The main user terminal 100 binds a payment account (for example, a bank card, a payment card, a consumer card, etc.) by, for example, a mobile payment application.

2 The main user terminal 100 and the user terminal 200 respectively log in to the server 300.

3 The main user terminal 100 issues a transfer authorization request to the server 300 to allow the payment function from the user terminal 200 to be able to use the main user terminal 100, wherein in the transfer authorization request, the main user terminal 100 can set the authorization limit amount as needed. Authorized time limit, authorized limited location, authorized limited merchants, etc., or you can set whether you need transaction confirmation as needed.

4 The server 300 checks the related information of the transfer authorization request, and after the verification, the Token and the transaction key are issued to the slave user terminal 200 (the temporary Token corresponds to the payment account bound to the main user terminal 100). The user terminal 200 saves the Token and the transaction key in its secure element (SE) or in the cloud, at which time the user terminal 200 has a payment function. According to the setting of the main user terminal 100, the payment transaction from the user terminal 100 having the Token has various restrictions ranging from the authorized limited amount, the authorized limited time, the authorized limited place, the authorized limited merchant, etc., if the limit is exceeded, the user terminal 200 The payment function will be lost.

5 When the payment transaction is performed from the user terminal 200, the cloud or the local security element (SE) generates a Token, and the transaction terminal 400 supporting the cloud flash payment on the merchant side is consumed by the HCE (host-based cardemulation) or SE (Secure Element). transaction. In addition, usually the cloud will generate more than one Token in advance so that users can still use HCE payment when the device is not connected to the Internet.

The merchant terminal 400 transmits the relevant consumption information including the current consumption location, the merchant number, the transaction amount, and the transaction token, the transaction ciphertext, and the like to the server 300.

7 The server 300 verifies the transaction token and the transaction ciphertext, and judges the transaction amount, the transaction time, the transaction location, the transaction merchant's compliance with the authorized limit amount, the authorization limited time, the authorized limited location, the authorized limited merchant, and the like according to the need.

8 Optionally, the transaction confirmation is performed as needed, and the server 300 transmits the transaction information to the primary user terminal 100 for transaction confirmation.

9 In the case where the verification is successful (optionally including the case where the transaction confirmation is successful), the server 300 returns the verification success to the merchant terminal 400 and completes the payment.

In the present invention, Token solves the problem of card number information leakage, and replaces the card number with a virtual digit string of 13 to 19 bits. The server 300 issues a Token and a transaction key to the slave user terminal 200, and through the transaction key, calculates a transaction ciphertext for each transaction of the card transaction for the validity verification of the transaction identity. Transaction security is achieved through the combination of Token and transaction keys.

As shown in FIG. 3, the mobile payment transfer authorization system of the present invention includes a primary user terminal 100, a secondary user terminal 200, a server 300, and a merchant terminal 400.

The primary user terminal 100 refers to a mobile payment device of the primary user, and may be, for example, a smart phone, a tablet computer, or a wearable device, etc., and may include a payment APP, a binding payment account (eg, a bank card, a payment card, etc.), which may be utilized. The payment APP implements user login and subsequent payment-to-authorization. The primary user terminal 100 is configured to bind a payment account for submitting a transfer authorization request to the server 300. The primary user terminal 100 may set one or more of the authorized limited amount, the authorized limited time, the authorized limited location, the authorized limited merchant, and the like in the transfer authorization request, and may also set whether the transaction confirmation is required according to the need.

The slave user terminal 200 refers to a mobile device of the user, which is installed with a payment APP, such as a smartphone, a tablet or a wearable device, and the like, accepts a Token certificate transmitted from the server 300 (or is stored in the cloud), and completes the payment. The Token and the transaction key transmitted from the server 300 are accepted from the user terminal 200, the Token and the transaction key are stored in the security unit or stored in the cloud, and the transaction is performed using the Token and the transaction key.

The server 300 is configured to check the transfer authorization request from the primary user terminal 100 and generate a Token and transaction key in the case of verification and deliver it to the secondary user terminal 200, and to verify the secondary user terminal when performing transaction payment. 200 sent transaction tokens and transaction ciphertexts and complete transaction payment with verification pass.

The server 300 is provided with a Token authorization module 310 and a location calculation module 320, wherein the location calculation module 320 is an optional module.

The Token authorization module 310 is configured to generate a Token and a transaction key, and bind the Token to the card number corresponding to the main transaction terminal, and authorize the Token to the secondary user terminal 200. Further, the Token authorization module 310 can also set a certain life cycle for the Token.

The location calculation module 320 is configured to calculate a distance between the transaction location and the authorized restriction location, and whether the comparison meets the conditions of the authorization-defined location set in the transfer authorization request.

The merchant terminal 400 may be, for example, a terminal device of a merchant's POS machine or the like, and the merchant terminal 400 includes a communication module 410 and an LBS function module 420, wherein the LBS function module 420 is an optional module. The communication module 410 is configured to upload the transaction location (optional) and transaction information generated by the transaction to the server 300. The LBS module 420 is used to detect where the transaction occurred.

According to the present invention, it is possible to perform mobile payment transfer authorization from the primary user terminal to the secondary user terminal, thereby enabling trust-based mobile payment transfer authorization between family members and friends. Among them, the transaction can be realized by using the token and the transaction key, thereby ensuring the security of the transaction. Moreover, the user does not need to input a password when paying, which is quick and convenient, and the user experience is good. On the other hand, since a plurality of Tokens and transaction keys can be received and stored in advance from the user terminal, the payment transaction can be performed from the user terminal without networking.

The above examples mainly illustrate the mobile payment transfer authorization method of the present invention, the payment system implemented by the mobile payment transfer authorization method, the mobile terminal, and the server. Although only a few of the specific embodiments of the present invention have been described, it is understood that the invention may be embodied in many other forms without departing from the spirit and scope of the invention. Accordingly, the present invention is to be construed as illustrative and not restrictive, and the invention may cover various modifications without departing from the spirit and scope of the invention as defined by the appended claims With replacement.

Claims

A mobile payment authorization method is implemented by a primary user terminal, a user terminal, a server, and a merchant terminal, and the method includes the following steps:

Binding step, the primary user terminal is bound to the payment account;

The authorization request requesting step, the main user terminal and the user terminal respectively log in to the server, and the main user terminal sends a transfer authorization request to the server;

Transmitting the authorization request verification step, the server verifies the transfer authorization request, and after verification, issues a token and a transaction key to the slave user terminal;

The transfer authorization step is implemented by the user terminal using the Token and the transaction key.
A mobile payment authorization method according to claim 1, wherein

In the transfer authorization request, the primary user terminal presets one or more of an authorization limited amount, an authorization limited time, an authorized limited place, an authorized limited merchant, and whether a transaction confirmation is required.
A mobile payment authorization method according to claim 2, wherein

The sub-authorization request verification step includes the following sub-steps:

The server checks the transfer authorization request;

After passing the verification, the token and the plurality of transaction keys are issued to the slave user terminal at one time;

The Token and transaction keys are saved from the user terminal in a secure element or saved in the cloud.
A mobile payment authorization method according to claim 3, wherein

The transfer authorization payment step includes the following sub-steps:

When the user terminal performs a payment transaction at the transaction terminal, the Token in the cloud or the local security element is used instead of the PAN, and each transaction uses a transaction key to encrypt the Token, transaction amount, merchant number, and terminal number as transaction elements. Transaction ciphertext, sending merchant terminal to conduct consumer transactions;

The merchant terminal sends the transaction information including the current consumption location, the merchant number, the transaction amount, and the transaction token and the transaction ciphertext to the server;

The server verifies the transaction token, decrypts the transaction ciphertext information, and verifies the validity of the transaction identity; in the case of successful verification, the server returns the verification success to the merchant terminal and completes the payment.
A mobile payment authorization method according to claim 4, wherein

In a sub-step of the server verifying the transaction token, the server verifies the transaction token and determines whether one or more of the transaction amount, transaction time, transaction location, and transaction merchant are pre-set in the transfer authorization request as needed.
A mobile payment authorization method according to claim 5, wherein

In the sub-step of the server verifying the transaction token, the method further includes: the server sends the transaction information to the main user terminal for transaction confirmation, and the server returns the verification success to the merchant terminal if the main user terminal confirms that the transaction is executable.
A mobile payment transfer authorization system, characterized in that:

a primary user terminal for binding with a payment account and for submitting a delegation authorization request to a server described below;

From the user terminal, the Token and the transaction key for receiving the following server are stored in the security unit or stored in the cloud, and the transaction is performed by using the Token and the transaction key;

a server, configured to check the transfer authorization request from the primary user terminal and generate a Token and a transaction key in the case of verification and deliver the token and the transaction key to the slave user terminal, and use it to verify the transaction when performing transaction payment Describe the transaction token and transaction ciphertext sent from the user terminal and complete the transaction if the verification passes;

The merchant terminal is configured to submit transaction information from the user terminal including the transaction token, the merchant number, the transaction amount, and the transaction ciphertext to the server when the slave user terminal consumes at the merchant terminal.
The mobile payment transfer authorization system of claim 7 wherein:

The primary user terminal sets one or more of an authorized limited amount, an authorized limited time, an authorized limited location, an authorized limited merchant, and the like in the transfer authorization request.
A mobile payment transfer authorization system according to claim 8 wherein:

The merchant terminal has:

LBS module for obtaining the trading location where the transaction is generated;

a communication module, configured to upload a transaction place and transaction information generated by the transaction to the server.
The mobile payment transfer authorization system of claim 9 wherein:

The server has:

a Token authorization module, configured to generate a Token and a transaction key, and deliver the Token and the transaction key to the slave user terminal;

And a location calculation module, configured to calculate a distance between the transaction location and the authorized restriction location, and whether the comparison meets the condition for the authorized authorized location set in the transfer authorization request.
The mobile payment transfer authorization system of claim 9 wherein:

The Token authorization module is further configured to set a certain life cycle for the Token.
The mobile payment transfer authorization system of claim 9 wherein:

The primary user terminal sets whether a transaction confirmation is required in the transfer authorization request, and in the case that the transaction confirmation is required, the server forwards the information about the transaction to the primary user terminal and confirms by the primary user terminal, only in the The transaction is allowed only after confirmation by the main user terminal.
A mobile terminal, characterized in that

The mobile terminal is configured to accept that the Token and the transaction key sent by the server are stored in the security unit or stored in the cloud, and use the Token and the transaction key to perform the transaction.
A server, configured to implement a transfer authorization for a primary user terminal to a user terminal, configured to check a transfer authorization request from a primary user terminal and generate a token and a transaction key by collation The slave user terminal is used to verify the transaction token and the transaction ciphertext sent from the slave user terminal when the transaction payment is made and complete the transaction payment if the verification is passed.
The server according to claim 14, comprising:

a Token authorization module, configured to generate a Token and a transaction key, and send the Token and the transaction key to the slave user terminal;

And a location calculation module, configured to calculate a distance between the transaction location and the authorized restriction location, and whether the comparison meets the condition for the authorized authorized location set in the transfer authorization request.