WO2022073336A1 - 安全支付方法、装置、电子设备及存储介质 - Google Patents

安全支付方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2022073336A1
WO2022073336A1 PCT/CN2021/090308 CN2021090308W WO2022073336A1 WO 2022073336 A1 WO2022073336 A1 WO 2022073336A1 CN 2021090308 W CN2021090308 W CN 2021090308W WO 2022073336 A1 WO2022073336 A1 WO 2022073336A1
Authority
WO
WIPO (PCT)
Prior art keywords
payment
server
user
identifier
code
Prior art date
Application number
PCT/CN2021/090308
Other languages
English (en)
French (fr)
Inventor
陈优优
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2022073336A1 publication Critical patent/WO2022073336A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions

Definitions

  • the present application relates to the technical field of financial technology, and in particular, to a secure payment method, device, electronic device, and computer-readable storage medium.
  • Mobile payment is a new type of payment method in the Internet era. It is centered on mobile terminals and conducts transaction settlement and payment through the network. Payment authentication by users through mobile payment apps installed on mobile phones and other clients has become one of the main payment methods for people's transactions.
  • network security problems such as Wi-Fi links anywhere, illegal App Trojan viruses, and robbing of red envelopes and QR codes make it possible for users' payment information to be illegally obtained and tampered with, resulting in economic losses for users.
  • the payment keyboard may also be called a soft keyboard, which is a fixed keyboard or a random keyboard customized on the client interface.
  • the payment keyboard is awakened to input the transaction password.
  • this kind of payment keyboard is implemented by the mobile payment app itself, and it is easy to tamper with the program code of the keyboard by means such as decompiling the code, so that the user's payment information can still be stolen.
  • a secure payment method provided by this application is applied to the server, including:
  • the server encryption is performed on the user payment identification, a server payment identification is generated, and the server payment identification and the randomly generated random keyboard code are returned to the client;
  • Receive the payment code transmitted by the client obtain the payment information of the user according to the payment code and the random keyboard code, and perform payment authentication on the payment information.
  • This application also provides a secure payment method, the method is applied to the client, including:
  • a payment keyboard is generated according to the random keyboard code
  • a payment code is generated according to the payment information input by the user through the payment keyboard, and the payment code is transmitted to the server for payment authentication.
  • the application also provides a secure payment device, the device is installed on the server, including:
  • an identity authentication module configured to receive the user payment identifier transmitted by the client, and authenticate the user payment identifier
  • the server-side encryption module is used to perform server-side encryption on the user-side payment identifier when the authentication of the user-side payment identifier is successful, generate a server-side payment identifier, and return the server-side payment identifier and the randomly generated random keyboard code to the the client;
  • the payment authentication module is configured to receive the payment code transmitted by the client, obtain the payment information of the user according to the payment code and the random keyboard code, and perform payment authentication on the payment information.
  • the application also provides a secure payment device, the device is installed on the client, including:
  • a client-side encryption module configured to obtain a payment identifier based on the payment request, perform client-side encryption on the payment identifier, generate a user payment identifier, and transmit the user payment identifier to the server;
  • a service authentication module configured to receive the server payment identifier and the random keyboard code returned by the server, and authenticate the server payment identifier
  • the generating module is used to generate a payment keyboard according to the random keyboard code when the payment authentication of the server is passed, generate a payment code according to the payment information input by the user through the payment keyboard, and transmit the payment code to the server for processing. Payment authentication.
  • the present application also provides an electronic device, the electronic device comprising:
  • the processor executes the computer program stored in the memory to realize the following steps:
  • the server encryption is performed on the user payment identification, a server payment identification is generated, and the server payment identification and the randomly generated random keyboard code are returned to the client;
  • Receive the payment code transmitted by the client obtain the payment information of the user according to the payment code and the random keyboard code, and perform payment authentication on the payment information.
  • the present application also provides an electronic device, the electronic device comprising:
  • the processor executes the computer program stored in the memory to realize the following steps:
  • a payment keyboard is generated according to the random keyboard code
  • a payment code is generated according to the payment information input by the user through the payment keyboard, and the payment code is transmitted to the server for payment authentication.
  • the present application also provides a computer-readable storage medium, where the computer-readable storage medium stores at least one instruction, and the at least one instruction is executed by a processor in an electronic device to implement the following steps:
  • the server encryption is performed on the user payment identification, a server payment identification is generated, and the server payment identification and the randomly generated random keyboard code are returned to the client;
  • Receive the payment code transmitted by the client obtain the payment information of the user according to the payment code and the random keyboard code, and perform payment authentication on the payment information.
  • the present application also provides a computer-readable storage medium, where the computer-readable storage medium stores at least one instruction, and the at least one instruction is executed by a processor in an electronic device to implement the following steps:
  • a payment keyboard is generated according to the random keyboard code
  • a payment code is generated according to the payment information input by the user through the payment keyboard, and the payment code is transmitted to the server for payment authentication.
  • FIG. 1 is a schematic flowchart of a secure payment method applied to a server provided by the first embodiment of the present application
  • FIG. 2 is a schematic flowchart of a secure payment method applied to a client according to a second embodiment of the present application
  • FIG. 3 is a schematic block diagram of a secure payment device applied to a server according to a third embodiment of the present application.
  • FIG. 4 is a schematic block diagram of a payment device applied to client-side secure payment provided by the fourth embodiment of the present application;
  • FIG. 5 is a schematic diagram of the internal structure of an electronic device for implementing a secure payment method provided by the fifth embodiment of the present application.
  • the embodiments of the present application provide a secure payment method, and the execution subject of the secure payment method includes, but is not limited to, at least one of electronic devices that can be configured to execute the method provided by the embodiments of the present application, such as a server and a client.
  • the secure payment method can be executed by software or hardware installed on the client or server, and the software can be a blockchain platform.
  • the server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like.
  • the secure payment method is implemented through the interaction of the client or the server.
  • the core is: when the client makes a transaction payment, it first sends the user payment identifier including the encrypted user unique identifier to the server for authentication; after the server has passed the authentication of the user payment identifier, it will send the user payment to the server.
  • the identifier is encrypted again on the server side to generate a server-side payment identifier, and a random keyboard code is generated, and the server-side payment identifier and the random keyboard code are transmitted to the client; the client has passed the authentication of the server-side payment identifier Afterwards, a payment keyboard is generated according to the random keyboard code for the user to input payment information.
  • the application implements dual authentication on the server and the client, and the payment keyboard is not implemented by the mobile payment App itself but is generated according to the arrangement of the server, thus further ensuring the security of the user's payment information.
  • the secure payment method provided by the first embodiment of the present application is described with reference to the flowchart shown in FIG. 1 .
  • the method described in Figure 1 is applied to the server, including:
  • S10 Receive the user payment identifier transmitted by the client, and authenticate the user payment identifier.
  • the client terminal may also be referred to as a mobile payment terminal, which is used to perform payment transactions, including but not limited to: mobile phones, tablets, PCs, and the like.
  • the user payment identifier refers to a unique user identifier encrypted based on the client, and the unique user identifier includes, but is not limited to, the user's gesture, fingerprint, password, password, and the like.
  • the embodiment of the present application uses a pre-built security credential to authenticate the user payment identifier.
  • the pre-built security credential refers to a data credential for data communication between the client and the server.
  • the security credentials include: digital signature, valid time, domain name, and the like.
  • the security credential is constructed through a Secure Sockets Layer (SSL).
  • the embodiment of the present application identifies the encrypted plaintext of the client payment identifier based on the security credential, decrypts the encrypted plaintext in the client payment identifier through a preset decryption algorithm, obtains the unique user identifier, and obtains the user unique identifier.
  • the user unique identifier is authenticated using pre-stored identity authentication information.
  • the preset decryption algorithm corresponds to the encryption algorithm of the encrypted plaintext.
  • the identity authentication information may be stored in a blockchain.
  • the authenticity of the user payment identifier in the client can be identified.
  • the following method is used to perform server-side encryption on the user payment identifier:
  • E(M) represents the server payment identifier
  • m represents the mth plaintext in the user payment identifier
  • t represents the number of plaintexts in the user payment identifier
  • e represents the wireless non-circular decimal
  • mod represents the plaintext encryption function
  • N represents the encryption frequency
  • the random keyboard code can be understood as a sequence of character codes whose order is randomly scrambled.
  • the random keyboard code is used to generate a virtual payment keyboard when the client performs transaction payment, that is, the arrangement of characters in the payment keyboard is arranged according to the random keyboard code.
  • the random keyboard code may be set with a security time limit.
  • a virtual payment keyboard when the client successfully verifies the payment identifier of the server, a virtual payment keyboard will be generated according to the random keyboard code, and the user can input the input through the virtual payment keyboard. Payment information, generate a payment code, and transmit the payment code to the server. In other embodiments of the present application, when the client fails to authenticate the payment identifier of the server, a virtual payment keyboard will not be generated on the client, so the payment code cannot be generated.
  • the performing payment authentication on the payment information includes: identifying whether the payment information in the payment code is consistent with the payment authentication information stored in the server in advance by the user, and if they are consistent, the authentication result is: If the authentication is successful, if they are inconsistent, the authentication result is authentication failure. Further, in the embodiment of the present application, the payment result is identified according to the authentication result, that is, the authentication result is authentication success, then the payment result is payment success, and the authentication result is authentication failure, then the payment result is payment failure.
  • the payment authentication information may also be stored in a blockchain node.
  • the payment code is discarded to further ensure the security of payment.
  • the payment request refers to an interaction between the user and the system payment platform.
  • the mobile terminal of user A will issue a payment request for payment, and the payment behavior is the payment request.
  • the obtaining the payment identifier based on the payment request includes:
  • the payment environment is identified; the user credential input by the user in the payment environment is received, and the payment identifier is obtained.
  • the payment environment refers to the transaction environment when the user makes payment.
  • the payment environment is identified by a preset Linux statement in this application, wherein the preset Linux statement may be an OpenSSL statement .
  • the user credential refers to the user's unique identifier, for example, the user's unique identifier may be: the user's gesture, fingerprint, password, password, and the like.
  • the client-side encryption method has the same principle as the above-mentioned server-side encryption method, and will not be further described here.
  • the server payment identifier and the random keyboard code refer to the authentication result generated by the server encrypting the user payment identifier that has been authenticated successfully by the server.
  • the authentication of the server-side payment identifier is to decrypt the server-side payment identifier. using the corresponding decryption algorithm to decrypt the encrypted plaintext in the payment identifier of the server.
  • the authenticity of the corresponding server of the client can be identified by decrypting the service payment identifier, so that the reliability of the corresponding server can be judged to enhance the reliability of the payment environment.
  • another embodiment of the present application further includes: when the authentication of the server fails, generating an error status code to prompt the user with error information.
  • a payment keyboard is generated according to the random keyboard code
  • a payment code is generated according to the payment information input by the user through the payment keyboard
  • the payment code is It is transmitted to the server for payment authentication.
  • the generating a payment keyboard according to the random keyboard code includes: acquiring an arrangement order of characters in the random keyboard code; Configure the interface and get the payment keyboard.
  • the virtual keyboard is compiled by a preset script language, and is used to support the user to input the payment code.
  • the payment keyboard is generated based on the random keyboard code, which can ensure that the payment code input by the user has With certain timeliness, disorder and security, it can ensure that even if the user's payment information is illegally obtained or the payment program code is tampered with, the payment operation cannot be performed, thus greatly improving the user's payment security.
  • the embodiment of the present application utilizes the server to authenticate the user payment identifier sent by the client, and utilizes the client to authenticate the server payment identifier sent by the server, thereby realizing dual authentication between the client and the server, and further.
  • the client generates the payment keyboard according to the random keyboard code generated by the server, instead of the mobile payment App installed on the client generating the payment keyboard, which further ensures the security of the user's payment information.
  • FIG. 3 is a schematic block diagram of a secure payment device applied to a server provided by the third implementation of the present application.
  • the secure payment device 100 applied to the server described in this application can be installed in an electronic device.
  • the secure payment device applied to the server may include an identity authentication module 101 , a server encryption module 102 and a payment authentication module 103 .
  • the modules described in the present invention can also be called units, which refer to a series of computer program segments that can be executed by the electronic device processor and can perform fixed functions, and are stored in the memory of the electronic device.
  • each module/unit is as follows:
  • the identity authentication module 101 is configured to receive the user payment identifier transmitted by the client, and authenticate the user payment identifier.
  • the client terminal may also be referred to as a mobile payment terminal, which is used to perform payment transactions, including but not limited to: mobile phones, tablets, PCs, and the like.
  • the user payment identifier refers to a unique user identifier encrypted based on the client, and the unique user identifier includes, but is not limited to, the user's gesture, fingerprint, password, password, and the like.
  • the identity authentication module 101 uses a pre-built security credential to authenticate the user payment identifier.
  • the pre-built security credential refers to a data credential for data communication between the client and the server.
  • the security credentials include: digital signature, valid time, domain name, and the like.
  • the security credential is constructed through a Secure Sockets Layer (SSL).
  • the identity authentication module 101 performs user payment authentication in the following manner: based on the security credential, identifying the encrypted plaintext of the client payment identifier, and using a preset decryption algorithm to authenticate the client
  • the encrypted plaintext in the payment identifier is decrypted to obtain the user unique identifier, and the user unique identifier is authenticated using pre-stored identity authentication information.
  • the preset decryption algorithm corresponds to the encryption algorithm of the encrypted plaintext.
  • the identity authentication information may be stored in a blockchain.
  • the authenticity of the user payment identifier in the client can be identified.
  • the server-side encryption module 102 is configured to perform server-side encryption on the user payment identifier when the authentication of the user payment identifier is successful, generate a server-side payment identifier, and encrypt the server-side payment identifier and the randomly generated random identifier.
  • the keyboard code is returned to the client.
  • the server encryption module 102 uses the following method to perform server encryption on the user payment identifier:
  • E(M) represents the server payment identifier
  • m represents the mth plaintext in the user payment identifier
  • t represents the number of plaintexts in the user payment identifier
  • e represents the wireless non-circular decimal
  • mod represents the plaintext encryption function
  • N represents the encryption frequency
  • the random keyboard code can be understood as a sequence of character codes whose order is randomly scrambled.
  • the random keyboard code is used to generate a virtual payment keyboard when the client performs transaction payment, that is, the arrangement of characters in the payment keyboard is arranged according to the random keyboard code.
  • the random keyboard code may be set with a security time limit.
  • the payment authentication module 103 is configured to receive the payment code transmitted by the client, obtain the user's payment information according to the payment code and the random keyboard code, perform payment authentication on the payment information, and obtain a payment result.
  • the payment authentication module 103 will generate a virtual payment keyboard according to the random keyboard code in response to the successful verification of the server payment identification, and the user can use the virtual payment keyboard.
  • the payment keyboard inputs payment information, generates a payment code, and transmits the payment code to the server.
  • a virtual payment keyboard will not be generated on the client, so the payment code cannot be generated.
  • the payment authentication module 103 when performing payment authentication on the payment information, adopts the following method: identifying whether the payment information in the payment code and the payment authentication information stored in advance by the user on the server are not If they are consistent, the authentication result is authentication success; if they are inconsistent, the authentication result is authentication failure. Further, in the embodiment of the present application, the payment result is identified according to the authentication result, that is, the authentication result is authentication success, then the payment result is payment success, and the authentication result is authentication failure, then the payment result is payment failure.
  • the payment authentication information may also be stored in a blockchain node.
  • the payment authentication module 103 further includes:
  • the payment code is discarded to further ensure the security of payment.
  • FIG. 4 it is a schematic block diagram of a secure payment device applied to a client provided by a fourth implementation of the present application.
  • the secure payment apparatus 200 applied to the client described in this application can be installed in an electronic device.
  • the secure payment device applied to the client may include a client encryption module 201 , a service authentication module 202 and a generation module 203 .
  • the modules described in the present invention can also be called units, which refer to a series of computer program segments that can be executed by the electronic device processor and can perform fixed functions, and are stored in the memory of the electronic device.
  • each module/unit is as follows:
  • the client-side encryption module 201 is configured to obtain a payment identifier based on a payment request, perform client-side encryption on the payment identifier, generate a user payment identifier, and transmit the user payment identifier to the server.
  • the payment request refers to an interaction between the user and the system payment platform.
  • the mobile terminal of user A will issue a payment request for payment, and the payment behavior is the payment request.
  • the client encryption module 201 executes the following method for obtaining the payment identifier based on the payment request:
  • the payment environment is identified; the user credential input by the user in the payment environment is received, and the payment identifier is obtained.
  • the payment environment refers to the transaction environment when the user makes payment.
  • the payment environment is identified by a preset Linux statement in this application, wherein the preset Linux statement may be an OpenSSL statement .
  • the user credential refers to the user's unique identifier, for example, the user's unique identifier may be: the user's gesture, fingerprint, password, password, and the like.
  • the client-side encryption method has the same principle as the above-mentioned server-side encryption method, and will not be further described here.
  • the service authentication module 202 is configured to receive the server payment identifier and the random keyboard code returned by the server, and authenticate the server payment identifier.
  • the server payment identifier and the random keyboard code refer to the authentication result generated by the server encrypting the user payment identifier that has been authenticated successfully by the server.
  • the service authentication module 202 authenticates the server payment identification, that is, decrypts the server payment identification.
  • the service authentication module 202 in the embodiment of the application The encryption algorithm used when the user payment identifier is encrypted on the server side, and the encrypted plaintext in the server payment identifier is decrypted by using the corresponding decryption algorithm.
  • the service authentication module 202 can identify the authenticity of the client corresponding to the server by decrypting the service payment identifier, so as to determine the reliability of the corresponding server to enhance the reliability of the payment environment sex.
  • the service authentication module 202 further includes: when the server authentication fails, generating an error status code to prompt the user with error information.
  • the generating module 203 is used to generate a payment keyboard according to the random keyboard code when the server payment authentication is passed, generate a payment code according to the payment information input by the user through the payment keyboard, and transmit the payment code to the service terminal for payment authentication.
  • the generating module 203 when the server-side payment authentication is passed, the generating module 203 generates a payment keyboard according to the random keyboard code, and generates a payment code according to the payment information input by the user through the payment keyboard, The payment code is transmitted to the server for payment authentication.
  • the server payment identifier that fails the authentication an error code will be popped up in the client to prompt the user with error information.
  • the generating module 203 executes the generation of the payment keyboard according to the random keyboard code in the following manner: obtaining the arrangement sequence of the characters in the random keyboard code; constructing a virtual keyboard, according to the characters The interface configuration is performed on the virtual keyboard in the order of arrangement, and a payment keyboard is obtained.
  • the virtual keyboard is compiled by a preset script language, and is used to support the user to input the payment code.
  • the payment keyboard is generated based on the random keyboard code, which can ensure that the payment code input by the user has With certain timeliness, disorder and security, it can ensure that even if the user's payment information is illegally obtained or the payment program code is tampered with, the payment operation cannot be performed, thus greatly improving the user's payment security.
  • the embodiment of the present application utilizes the server to authenticate the user payment identifier sent by the client, and utilizes the client to authenticate the server payment identifier sent by the server, thereby realizing dual authentication between the client and the server, and further.
  • the client generates the payment keyboard according to the random keyboard code generated by the server, instead of the mobile payment App installed on the client generating the payment keyboard, which further ensures the security of the user's payment information.
  • the secure payment method can also be applied to a secure payment system, and the secure payment system includes: a client and a server.
  • the client performs the method steps described in FIG. 1 above
  • the server performs the method steps described in FIG. 3 above.
  • FIG. 5 it is a schematic structural diagram of an electronic device of the secure payment method provided by the fifth embodiment of the present application.
  • the electronic device 1 may be a client or a server. Further, the electronic device 1 may include a processor 10, a memory 11 and a bus, and may also include a computer program stored in the memory 11 and run on the processor 10, such as a secure payment program 12.
  • the storage 11 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type storage (for example: SD or DX storage, etc.), magnetic storage, magnetic disk, CD etc.
  • the memory 11 may be an internal storage unit of the electronic device 1 in some embodiments, such as a mobile hard disk of the electronic device 1 .
  • the memory 11 may also be an external storage device of the electronic device 1, such as a pluggable mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital) equipped on the electronic device 1. , SD) card, flash memory card (Flash Card), etc.
  • the memory 11 may also include both an internal storage unit of the electronic device 1 and an external storage device.
  • the memory 11 can not only be used to store application software installed in the electronic device 1 and various types of data, such as codes for secure payment, etc., but also can be used to temporarily store data that has been output or will be output.
  • the processor 10 may be composed of integrated circuits, for example, may be composed of a single packaged integrated circuit, or may be composed of multiple integrated circuits packaged with the same function or different functions, including one or more integrated circuits.
  • Central Processing Unit CPU
  • microprocessor digital processing chip
  • graphics processor and combination of various control chips, etc.
  • the processor 10 is the control core (Control Unit) of the electronic device, and uses various interfaces and lines to connect the various components of the entire electronic device, by running or executing the program or module (for example, executing the program) stored in the memory 11. secure payment, etc.), and call data stored in the memory 11 to perform various functions of the electronic device 1 and process data.
  • the bus may be a peripheral component interconnect (PCI for short) bus or an extended industry standard architecture (Extended industry standard architecture, EISA for short) bus or the like.
  • PCI peripheral component interconnect
  • EISA Extended industry standard architecture
  • the bus can be divided into address bus, data bus, control bus and so on.
  • the bus is configured to implement connection communication between the memory 11 and at least one processor 10 and the like.
  • FIG. 5 only shows an electronic device with components. Those skilled in the art can understand that the structure shown in FIG. 5 does not constitute a limitation on the electronic device 1, and may include fewer or more components than those shown in the drawings. components, or a combination of certain components, or a different arrangement of components.
  • the electronic device 1 may also include a power supply (such as a battery) for powering the various components, preferably, the power supply may be logically connected to the at least one processor 10 through a power management device, so that the power management
  • the device implements functions such as charge management, discharge management, and power consumption management.
  • the power source may also include one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, and any other components.
  • the electronic device 1 may further include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.
  • the electronic device 1 may also include a network interface, optionally, the network interface may include a wired interface and/or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used in the electronic device 1 Establish a communication connection with other electronic devices.
  • a network interface optionally, the network interface may include a wired interface and/or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used in the electronic device 1 Establish a communication connection with other electronic devices.
  • the electronic device 1 may further include a user interface, and the user interface may be a display (Display), an input unit (eg, a keyboard (Keyboard)), optionally, the user interface may also be a standard wired interface or a wireless interface.
  • the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, and the like.
  • the display may also be appropriately called a display screen or a display unit, which is used for displaying data processed in the electronic device 1 and for displaying a visualized user interface.
  • the secure payment 12 stored in the memory 11 in the electronic device 1 is a combination of multiple instructions, and when running in the processor 10, a secure payment method can be implemented.
  • the secure payment method includes:
  • the server encryption is performed on the user payment identification, a server payment identification is generated, and the server payment identification and the randomly generated random keyboard code are returned to the client;
  • Receive the payment code transmitted by the client obtain the payment information of the user according to the payment code and the random keyboard code, and perform payment authentication on the payment information.
  • the secure payment method includes:
  • a payment keyboard is generated according to the random keyboard code
  • a payment code is generated according to the payment information input by the user through the payment keyboard, and the payment code is transmitted to the server for payment authentication.
  • the modules/units integrated by the electronic device 1 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium, and the computer-readable storage medium Can be non-volatile or volatile.
  • the computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, removable hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory) .
  • modules described as separate components may or may not be physically separated, and components shown as modules may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional module in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware, or can be implemented in the form of hardware plus software function modules.
  • the blockchain referred to in this application is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • Blockchain is essentially a decentralized database, which is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction data, which is used to authenticate its Data validity (anti-counterfeiting) and generation of the next block.
  • the blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

一种安全支付方法，包括：客户端在进行交易支付时，首先将包括加密后的用户唯一标识的用户支付标识发送给服务端进行认证；服务端根据预先存储的身份认证信息对所述用户支付标识进行认证并通过之后，将所述用户支付标识在服务端再次进行加密生成服务端支付标识，并生成随机键盘码，将所述服务端支付标识以及成随机键盘码传输给客户端；所述客户端通过了所述服务端支付标识的认证之后，根据所述随机键盘码生成支付键盘，供用户输入支付信息。还提出一种安全支付装置（100、200）、电子设备（1）以及存储介质。此外，还涉及区块链技术，所述身份认证信息可存储于区块链中。可以提高支付的安全性。

Description

安全支付方法、装置、电子设备及存储介质
本申请要求于2020年10月9日提交中国专利局、申请号为CN202011073558.4、名称为“安全支付方法、装置、电子设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及金融科技技术领域，尤其涉及一种安全支付方法、装置、电子设备及计算机可读存储介质。
背景技术
移动支付是互联网时代一种新型的支付方式，其以移动终端为中心，通过网络进行交易结算支付。用户通过在手机等客户端安装的移动支付App进行支付认证已经成为目前人们交易的主要支付方式之一。但是随地的WiFi链接，非法的App木马病毒，抢红包二维码等网络安全问题的出现，使得用户的支付信息有可能被非法获取并进行篡改，导致用户经济上损失。
为解决上述网络安全问题，发明人意识到，传统方式是通过提供虚拟的支付键盘供用户输入支付信息。所述支付键盘也可称为软键盘，是客户端界面自定义的一个固定的键盘或者是随机的键盘，用户支付的时候唤醒支付键盘进行交易密码的输入。目前，这种支付键盘是移动支付App自身实现的，通过反编译代码等手段很容易篡改键盘的程序代码，从而还是能够窃取到用户的支付信息。
发明内容
本申请提供的一种安全支付方法，所述方法应用于服务端，包括：
接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证。
本申请还提供的一种安全支付方法，所述方法应用于客户端，包括：
基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端；
接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
本申请还提供一种安全支付装置，所述装置安装于服务端，包括：
身份认证模块，用于接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
服务端加密模块，用于在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
支付认证模块，用于接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证。
本申请还提供一种安全支付装置，所述装置安装于客户端，包括：
客户端加密模块，用于基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端；
服务认证模块，用于接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
生成模块，用于在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
本申请还提供一种电子设备，所述电子设备包括：
存储器，存储至少一个计算机程序；及
处理器，执行所述存储器中存储的计算机程序以实现如下步骤：
接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证。
本申请还提供一种电子设备，所述电子设备包括：
存储器，存储至少一个计算机程序；及
处理器，执行所述存储器中存储的计算机程序以实现如下步骤：
基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端；
接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有至少一个指令，所述至少一个指令被电子设备中的处理器执行以实现如下步骤：
接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证。
本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有至少一个指令，所述至少一个指令被电子设备中的处理器执行以实现如下步骤：
基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端；
接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
附图说明
图1为本申请第一实施例提供的应用于服务端的安全支付方法的流程示意图；
图2为本申请第二实施例提供的应用于客户端的安全支付方法的流程示意图；
图3为本申请第三实施例提供的应用于服务端的安全支付装置的模块示意图；
图4为本申请第四实施例提供的应用于客户端的安全支付的支付装置的模块示意图；
图5为本申请第五实施例提供的实现安全支付方法的电子设备的内部结构示意图；
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请实施例提供一种安全支付方法，所述安全支付方法的执行主体包括但不限于服务端、客户端等能够被配置为执行本申请实施例提供的该方法的电子设备中的至少一种。换言之，所述安全支付方法可以由安装在客户端或服务端的软件或硬件来执行，所述软件可以是区块链平台。所述服务端包括但不限于：单台服务器、服务器集群、云端服务器或云端服务器集群等。
本申请实施例中，所述安全支付方法通过客户端或服务端的交互实现，其中客户端可以用用户的笔记本电脑、台式机、智能手机等便携式电子设备及智能穿戴式等，本申请实施例的核心在于：客户端在进行交易支付时，首先将包括加密后的用户唯一标识的用户支付标识发送给服务端进行认证；服务端通过了所述用户支付标识的认证之后，会将所述用户支付标识在服务端再次进行加密生成服务端支付标识，并生成随机键盘码，将所述服务端支付标识以及成随机键盘码传输给客户端；所述客户端通过了所述服务端支付标识的认证之后，根据所述随机键盘码生成支付键盘，供用户输入支付信息。本申请实施对服务端及客户端进行了双重认证，且所述支付键盘非移动支付App自身实现而是根据服务端的排配生成，因此进一步保证了用户的支付信息的安全性。
以下结合图1及图3对本申请的实现原理做进一步说明。
参照图1所示的流程图描述了本申请第一实施例提供的安全支付方法。其中，图1中描述的方法应用于服务端，包括：
S10、接收客户端传输的用户支付标识，对所述用户支付标识进行认证。
本申请较佳实例中，所述客户端也可以称为移动支付端，用于进行支付交易，包括、但不限于：手机、平板以及PC机等等。所述用户支付标识指的是一种基于客户端加密后的用户唯一标识，所述用户唯一标识包括，但不限于，用户的手势、指纹、密码、口令等。
进一步地，本申请实施例利用预先构建的安全凭证对所述用户支付标识进行认证。
其中，所述预先构建的安全凭证指的是客户端与服务端之间进行数据通信的一个数据凭证。优选地，在本申请中，所述安全凭证包括：数字签名、有效时间以及域名等。本申请一个可选实施例中，所述安全凭证通过安全套接字协议(Secure Sockets Layer，SSL)构建。
本申请实施例基于所述安全凭证，识别出所述客户端支付标识的加密明文，通过预设的解密算法对所述客户端支付标识中的加密明文进行解密，得到所述用户唯一标识，并利用预先存储的身份认证信息对所述用户唯一标识进行认证。其中，所述预设的解密算法与所述加密明文的加密算法相对应。
进一步地，为了保证所述身份认证信息的安全性，本申请实施例中，所述身份认证信息可以存储于区块链中。
基于所述用户支付标识的认证，可以识别出客户端中用户支付标识的真伪。
S11、在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端。
本申请实施例中，在所述用户支付认证成功时，利用下述方法对所述用户支付标识进行服务端加密：
Figure PCTCN2021090308-appb-000001
其中，E(M)表示服务端支付标识，m表示用户支付标识中的第m个明文，t表示用户支付标识中明文的数量，e表示无线不循环小数，mod表示明文加密函数，N表示加密次数。
所述随机键盘码可以理解为一个顺序被随机打乱排配的字符码序列。本申请实施例中， 所述随机键盘码用于在客户端进行交易支付时，产生虚拟的支付键盘，即所述支付键盘中的字符排配根据所述随机键盘码进行排配设置。本申请实施例中，为了进一步保证安全性，所述随机键盘码可以设置有安全时效。
S12、接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证，得到支付结果。
在本申请的至少一个实施例中，在所述客户端对所述服务端支付标识验证成功时，会根据所述随机键盘码生成一个虚拟的支付键盘，用户可以通过所述虚拟的支付键盘输入支付信息，产生支付码，并将所述支付码传输给服务端。本申请其他实施例中，当所述客户端对所述服务端支付标识认证失败时，在所述客户端不会生成虚拟的支付键盘，因而不能产生所述支付码。
本申请实施例中，所述对所述支付信息进行支付认证，包括：识别出所述支付码中的支付信息与用户预先在服务端保存的支付认证信息是否一致，若一致，则认证结果为认证成功，若不一致，则认证结果为认证失败。进一步地，本申请实施例中，根据所述认证结果识别出支付结果，即所述认证结果为认证成功，则支付结果为支付成功，所述认证结果为认证失败，则支付结果为支付失败。
优选地，为了保证所述支付认证信息的安全性，所述支付认证信息也可以存储于区块链节点中。
本申请一优选实施例中，还包括：
设置所述随机键盘码的安全时效；
当所述支付码的接收时间不在所述安全时效之内时，将所述支付码丢弃，以进一步保证支付的安全性。
参照图2所示的流程图描述了本申请第二实施例提供的安全支付方法。其中，图2中描述的方法应用于客户端，包括：
S20、基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付传输至服务端。
本申请较佳实施例中，所述支付请求指的是用户与系统支付平台产生的一个交互行为，例如，用户A通过手机端在手表商城平台中看中了一款手表，再进行付款之前，在用户A的手机端会发出一个请求支付的支付行为，该支付行为即为所述支付请求。
进一步地，本申请较佳实施中，所述基于支付请求，获取支付标识包括：
根据所述支付请求，识别出支付环境；接收用户在所述支付环境中输入的用户凭证，得到所述支付标识。
其中，所述支付环境指的是用户在进行支付时的交易环境，优选地，本申请中通过预设的Linux语句识别出所述支付环境，其中，所述预设的Linux语句可以为OpenSSL语句。所述用户凭证指的是用户唯一标识，例如，所述用户唯一标识可以为：用户的手势、指纹、密码、口令等。
进一步地，本申请较佳实施例中，所述客户端加密的方法与上述服务端加密方法原理相同，在此不做进一步地赘述。
S21、接收所述服务端返回的服务端支付标识以及随机键盘码，解密所述服务端支付标识，根据所述用户支付标识对所述服务端支付标识进行认证。
本申请较佳实施中，所述服务端支付标识以及随机键盘码指的是服务端对认证成功的所述用户支付标识进行服务端加密生成的认证结果。
进一步地，本申请较佳实施中所述对所述服务端支付标识进行认证，即解密所述服务端支付标识，优选地，本申请实施例根据在所述用户支付标识进行服务端加密时采用的加密算法，利用对应的解密算法对所述服务端支付标识中的加密明文进行解密。
本申请较佳实施中，通过解密所述服务支付标识可以识别出所述客户端对应服务端的 真伪性，从而可以判断出对应服务端的可靠程度，以增强支付环境的可靠性。
进一步地，本申请另一实施例还包括：在所述服务端认证失败时，产生错误状态码，以提示用户错误信息。
S22、在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
在本申请的至少一个实施例中，在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
本申请实施例中，所述根据所述随机键盘码生成支付键盘，包括：获取所述随机键盘码中字符的排配顺序；构建虚拟键盘，根据所述字符的排配顺序对所述虚拟键盘进行界面配置，得到支付键盘。
本申请实施例中，所述虚拟键盘通过预设的脚本语言编译，用于支持用户进行支付码的输入，同时，基于所述所述随机键盘码生成支付键盘，可以保障用户输入的支付码具有一定的时效性、乱序性以及安全性，从而可以保证即便是非法获取到用户支付信息或者篡改支付程序代码也无法进行支付操作，从而大大提高了用户的支付安全。
综上所述，本申请实施例利用服务端对客户端发送的用户支付标识进行认证，以及利用客户端对服务端发送的服务端支付标识进行认证，实现了客户端与服务器的双重认证，进一步地，本申请中客户端根据服务端产生随机键盘码生成支付键盘，而非安装在客户端的移动支付App自身产生支付键盘，进一步保证了用户的支付信息的安全性。
参与图3所示是本申请第三实施提供的应用于服务端的安全支付装置的模块示意图。
本申请所述应用于服务端的安全支付装置100可以安装于电子设备中。根据实现的功能，所述应用于服务端的安全支付装置可以包括身份认证模块101、服务端加密模块102以及支付认证模块103。本发所述模块也可以称之为单元，是指一种能够被电子设备处理器所执行，并且能够完成固定功能的一系列计算机程序段，其存储在电子设备的存储器中。
在本实施例中，关于各模块/单元的功能如下：
所述身份认证模块101，用于接收客户端传输的用户支付标识，对所述用户支付标识进行认证。
本申请较佳实例中，所述客户端也可以称为移动支付端，用于进行支付交易，包括、但不限于：手机、平板以及PC机等等。所述用户支付标识指的是一种基于客户端加密后的用户唯一标识，所述用户唯一标识包括，但不限于，用户的手势、指纹、密码、口令等。
进一步地，本申请实施例，所述身份认证模块101利用预先构建的安全凭证对所述用户支付标识进行认证。
其中，所述预先构建的安全凭证指的是客户端与服务端之间进行数据通信的一个数据凭证。优选地，在本申请中，所述安全凭证包括：数字签名、有效时间以及域名等。本申请一个可选实施例中，所述安全凭证通过安全套接字协议(Secure Sockets Layer，SSL)构建。
本申请实施例中，所述身份认证模块101采用下述方式执行用户支付认证：基于所述安全凭证，识别出所述客户端支付标识的加密明文，通过预设的解密算法对所述客户端支付标识中的加密明文进行解密，得到所述用户唯一标识，并利用预先存储的身份认证信息对所述用户唯一标识进行认证。其中，所述预设的解密算法与所述加密明文的加密算法相对应。
进一步地，为了保证所述身份认证信息的安全性，本申请实施例中，所述身份认证信息可以存储于区块链中。
基于所述用户支付标识的认证，可以识别出客户端中用户支付标识的真伪。
所述服务端加密模块102，用于对在所述用户支付标识认证成功时，对所述用户支付 标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端。
本申请实施例中，在所述用户支付认证成功时，所述服务端加密模块102利用下述方法对所述用户支付标识进行服务端加密：
Figure PCTCN2021090308-appb-000002
其中，E(M)表示服务端支付标识，m表示用户支付标识中的第m个明文，t表示用户支付标识中明文的数量，e表示无线不循环小数，mod表示明文加密函数，N表示加密次数。
所述随机键盘码可以理解为一个顺序被随机打乱排配的字符码序列。本申请实施例中，所述随机键盘码用于在客户端进行交易支付时，产生虚拟的支付键盘，即所述支付键盘中的字符排配根据所述随机键盘码进行排配设置。本申请实施例中，为了进一步保证安全性，所述随机键盘码可以设置有安全时效。
所述支付认证模块103，用于接收客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证，得到支付结果。
在本申请的至少一个实施例中，所述支付认证模块103响应于对所述服务端支付标识验证成功时，会根据所述随机键盘码生成一个虚拟的支付键盘，用户可以通过所述虚拟的支付键盘输入支付信息，产生支付码，并将所述支付码传输给服务端。本申请其他实施例中，当所述客户端对所述服务端支付标识认证失败时，在所述客户端不会生成虚拟的支付键盘，因而不能产生所述支付码。
本申请实施例中，所述对所述支付信息进行支付认证，所述支付认证模块103采用下述方式：识别出所述支付码中的支付信息与用户预先在服务端保存的支付认证信息是否一致，若一致，则认证结果为认证成功，若不一致，则认证结果为认证失败。进一步地，本申请实施例中，根据所述认证结果识别出支付结果，即所述认证结果为认证成功，则支付结果为支付成功，所述认证结果为认证失败，则支付结果为支付失败。
优选地，为了保证所述支付认证信息的安全性，所述支付认证信息也可以存储于区块链节点中。
本申请一优选实施例中，所述支付认证模块103还包括：
设置所述随机键盘码的安全时效；
当所述支付码的接收时间不在所述安全时效之内时，将所述支付码丢弃，以进一步保证支付的安全性。
参阅图4所示是本申请第四实施提供的应用于客户端的安全支付装置的模块示意图。
本申请所述应用于客户端的安全支付装置200可以安装于电子设备中。根据实现的功能，所述应用于客户端的安全支付装置可以包括客户端加密模块201、服务认证模块202以及生成模块203。本发所述模块也可以称之为单元，是指一种能够被电子设备处理器所执行，并且能够完成固定功能的一系列计算机程序段，其存储在电子设备的存储器中。
在本实施例中，关于各模块/单元的功能如下：
所述客户端加密模块201，用于基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端。
本申请较佳实施例中，所述支付请求指的是用户与系统支付平台产生的一个交互行为，例如，用户A通过手机端在手表商城平台中看中了一款手表，再进行付款之前，在用户A的手机端会发出一个请求支付的支付行为，该支付行为即为所述支付请求。
进一步地，本申请较佳实施中，所述基于支付请求，获取支付标识，所述客户端加密模块201采用下述方式执行：
根据所述支付请求，识别出支付环境；接收用户在所述支付环境中输入的用户凭证， 得到所述支付标识。
其中，所述支付环境指的是用户在进行支付时的交易环境，优选地，本申请中通过预设的Linux语句识别出所述支付环境，其中，所述预设的Linux语句可以为OpenSSL语句。所述用户凭证指的是用户唯一标识，例如，所述用户唯一标识可以为：用户的手势、指纹、密码、口令等。
进一步地，本申请较佳实施例中，所述客户端加密的方法与上述服务端加密方法原理相同，在此不做进一步地赘述。
所述服务认证模块202，用于接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证。本申请较佳实施中，所述服务端支付标识以及随机键盘码指的是服务端对认证成功的所述用户支付标识进行服务端加密生成的认证结果。
进一步地，本申请较佳实施中所述服务认证模块202对所述服务端支付标识进行认证，即解密所述服务端支付标识，优选地，本申请实施例所述服务认证模块202根据在所述用户支付标识进行服务端加密时采用的加密算法，利用对应的解密算法对所述服务端支付标识中的加密明文进行解密。
本申请较佳实施中，所述服务认证模块202通过解密所述服务支付标识可以识别出所述客户端对应服务端的真伪性，从而可以判断出对应服务端的可靠程度，以增强支付环境的可靠性。
进一步地，本申请另一实施例，所述服务认证模块202还包括：在所述服务端认证失败时，产生错误状态码，以提示用户错误信息。
所述生成模块203，用于所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
在本申请的至少一个实施例中，在所述服务端支付认证通过时，所述生成模块203根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。其中，需要声明的是，对于认证失败的服务端支付标识，则在所述客户端中弹出错误码，以提示用户错误信息。
本申请实施例中，所述根据所述随机键盘码生成支付键盘，所述生成模块203采用下述方式执行：获取所述随机键盘码中字符的排配顺序；构建虚拟键盘，根据所述字符的排配顺序对所述虚拟键盘进行界面配置，得到支付键盘。
本申请实施例中，所述虚拟键盘通过预设的脚本语言编译，用于支持用户进行支付码的输入，同时，基于所述所述随机键盘码生成支付键盘，可以保障用户输入的支付码具有一定的时效性、乱序性以及安全性，从而可以保证即便是非法获取到用户支付信息或者篡改支付程序代码也无法进行支付操作，从而大大提高了用户的支付安全。
综上所述，本申请实施例利用服务端对客户端发送的用户支付标识进行认证，以及利用客户端对服务端发送的服务端支付标识进行认证，实现了客户端与服务器的双重认证，进一步地，本申请中客户端根据服务端产生随机键盘码生成支付键盘，而非安装在客户端的移动支付App自身产生支付键盘，进一步保证了用户的支付信息的安全性。
本申请实施例中，所述安全支付方法还可以应用于一个安全支付系统中，所述安全支付系统包括：客户端和服务端。其中，所述客户端执行上述图1中描述的方法步骤，所述服务端执行上述图3中描述的方法步骤。
参阅图5所示，是本申请第五实施例提供的安全支付方法的电子设备的结构示意图。
本申请实施例中，所述电子设备1可以是客户端或者服务端。进一步地，所述电子设备1可以包括处理器10、存储器11和总线，还可以包括存储在所述存储器11中并可在所述处理器10上运行的计算机程序，如安全支付程序12。
其中，所述存储器11至少包括一种类型的可读存储介质，所述可读存储介质包括闪存、 移动硬盘、多媒体卡、卡型存储器(例如：SD或DX存储器等)、磁性存储器、磁盘、光盘等。所述存储器11在一些实施例中可以是电子设备1的内部存储单元，例如该电子设备1的移动硬盘。所述存储器11在另一些实施例中也可以是电子设备1的外部存储设备，例如电子设备1上配备的插接式移动硬盘、智能存储卡(Smart Media Card，SMC)、安全数字(Secure Digital，SD)卡、闪存卡(Flash Card)等。进一步地，所述存储器11还可以既包括电子设备1的内部存储单元也包括外部存储设备。所述存储器11不仅可以用于存储安装于电子设备1的应用软件及各类数据，例如安全支付的代码等，还可以用于暂时地存储已经输出或者将要输出的数据。
所述处理器10在一些实施例中可以由集成电路组成，例如可以由单个封装的集成电路所组成，也可以是由多个相同功能或不同功能封装的集成电路所组成，包括一个或者多个中央处理器(Central Processing unit，CPU)、微处理器、数字处理芯片、图形处理器及各种控制芯片的组合等。所述处理器10是所述电子设备的控制核心(Control Unit)，利用各种接口和线路连接整个电子设备的各个部件，通过运行或执行存储在所述存储器11内的程序或者模块(例如执行安全支付等)，以及调用存储在所述存储器11内的数据，以执行电子设备1的各种功能和处理数据。
所述总线可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。该总线可以分为地址总线、数据总线、控制总线等。所述总线被设置为实现所述存储器11以及至少一个处理器10等之间的连接通信。
图5仅示出了具有部件的电子设备，本领域技术人员可以理解的是，图5示出的结构并不构成对所述电子设备1的限定，可以包括比图示更少或者更多的部件，或者组合某些部件，或者不同的部件布置。
例如，尽管未示出，所述电子设备1还可以包括给各个部件供电的电源(比如电池)，优选地，电源可以通过电源管理装置与所述至少一个处理器10逻辑相连，从而通过电源管理装置实现充电管理、放电管理、以及功耗管理等功能。电源还可以包括一个或一个以上的直流或交流电源、再充电装置、电源故障检测电路、电源转换器或者逆变器、电源状态指示器等任意组件。所述电子设备1还可以包括多种传感器、蓝牙模块、Wi-Fi模块等，在此不再赘述。
进一步地，所述电子设备1还可以包括网络接口，可选地，所述网络接口可以包括有线接口和/或无线接口(如WI-FI接口、蓝牙接口等)，通常用于在该电子设备1与其他电子设备之间建立通信连接。
可选地，该电子设备1还可以包括用户接口，用户接口可以是显示器(Display)、输入单元(比如键盘(Keyboard))，可选地，用户接口还可以是标准的有线接口、无线接口。可选地，在一些实施例中，显示器可以是LED显示器、液晶显示器、触控式液晶显示器以及OLED(Organic Light-Emitting Diode，有机发光二极管)触摸器等。其中，显示器也可以适当的称为显示屏或显示单元，用于显示在电子设备1中处理的数据以及用于显示可视化的用户界面。
应该了解，所述实施例仅为说明之用，在专利申请范围上并不受此结构的限制。
所述电子设备1中的所述存储器11存储的安全支付12是多个指令的组合，在所述处理器10中运行时，可以实现一种安全支付方法。
优选地，当所述电子设备1为服务端时，所述安全支付方法包括：
接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付 信息，对所述支付信息进行支付认证。
进一步地，当所述电子设备1为客户端时，所述安全支付方法包括：
基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端；
接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
具体地，所述处理器10对上述指令的具体实现方法可参考图1及图2对应实施例中相关步骤的描述，在此不赘述。
进一步地，所述电子设备1集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中，所述计算机可读存储介质可以是非易失性的，也可以是易失性的。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM，Read-Only Memory)。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能模块的形式实现。
对于本领域技术人员而言，显然本申请不限于上述示范性实施例的细节，而且在不背离本申请的精神或基本特征的情况下，能够以其他的具体形式实现本申请。
因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附关联图标记视为限制所涉及的权利要求。
本申请所指区块链是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式。区块链(Blockchain)，本质上是一个去中心化的数据库，是一串使用密码学方法相关联产生的数据块，每一个数据块中包含了一批次网络交易的数据，用于认证其数据的有效性(防伪)和生成下一个区块。区块链可以包括区块链底层平台、平台产品服务层以及应用服务层等。
此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。系统权利要求中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第二等词语用来表示名称，而并不表示任何特定的顺序。
最后应说明的是，以上实施例仅用以说明本申请的技术方案而非限制，尽管参照较佳实施例对本申请进行了详细说明，本领域的普通技术人员应当理解，可以对本申请的技术方案进行修改或等同替换，而不脱离本申请技术方案的精神和范围。

Claims (20)

  1. 一种安全支付方法，其中，所述方法应用于服务端，包括：
    接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
    在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
    接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证。
  2. 如权利要求1所述的安全支付方法，其中，所述接收客户端传输的用户支付标识，对所述用户支付标识进行认证，包括：
    识别出所述用户支付标识的加密明文，对所述用户支付标识中的加密明文进行解密，根据预先存储的安全凭证对解密成功的所述用户支付标识进行认证。
  3. 如权利要求2所述的安全支付方法，其中，所述对所述用户支付标识进行服务端加密，生成服务端支付标识，包括：
    利用下述方法对所述用户支付标识进行服务端加密：
    Figure PCTCN2021090308-appb-100001
    其中，E(M)表示服务端支付标识，m表示用户支付标识中的第m个明文，t表示用户支付标识中明文的数量，e表示无线不循环小数，mod表示明文加密函数，N表示加密次数。
  4. 如权利要求1所述的安全支付方法，其中，还包括：
    设置所述随机键盘码的安全时效；
    当所述支付码的接收时间不在所述安全时效之内时，将所述支付码丢弃。
  5. 一种安全支付方法，其中，所述方法应用于客户端，包括：
    基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端；
    接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
    在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
  6. 如权利要求5所述的安全支付方法，其中，所述根据所述随机键盘码生成支付键盘，包括：
    获取所述随机键盘码中字符的排配顺序；
    构建虚拟键盘，根据所述字符的排配顺序对所述虚拟键盘进行界面配置，得到支付键盘。
  7. 一种安全支付装置，其中，所述装置安装于服务端，包括：
    身份认证模块，用于接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
    服务端加密模块，用于在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
    支付认证模块，用于接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证。
  8. 一种安全支付装置，其中，所述装置安装于客户端，包括：
    客户端加密模块，用于基于支付请求，获取支付标识，对所述支付标识进行客户端加 密，生成用户支付标识，将所述用户支付标识传输至服务端；
    服务认证模块，用于接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
    生成模块，用于在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
  9. 一种电子设备，其中，所述电子设备包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如下步骤：
    接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
    在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
    接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证。
  10. 如权利要求9所述的电子设备，其中，所述接收客户端传输的用户支付标识，对所述用户支付标识进行认证，包括：
    识别出所述用户支付标识的加密明文，对所述用户支付标识中的加密明文进行解密，根据预先存储的安全凭证对解密成功的所述用户支付标识进行认证。
  11. 如权利要求10所述的电子设备，其中，所述对所述用户支付标识进行服务端加密，生成服务端支付标识，包括：
    利用下述方法对所述用户支付标识进行服务端加密：
    Figure PCTCN2021090308-appb-100002
    其中，E(M)表示服务端支付标识，m表示用户支付标识中的第m个明文，t表示用户支付标识中明文的数量，e表示无线不循环小数，mod表示明文加密函数，N表示加密次数。
  12. 如权利要求9所述的电子设备，其中，还包括：
    设置所述随机键盘码的安全时效；
    当所述支付码的接收时间不在所述安全时效之内时，将所述支付码丢弃。
  13. 一种电子设备，其中，所述电子设备包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如下步骤：
    基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端；
    接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
    在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
  14. 如权利要求13所述的电子设备，其中，所述根据所述随机键盘码生成支付键盘，包括：
    获取所述随机键盘码中字符的排配顺序；
    构建虚拟键盘，根据所述字符的排配顺序对所述虚拟键盘进行界面配置，得到支付键盘。
  15. 一种计算机可读存储介质，存储有计算机程序，其中，所述计算机程序被处理器执行时实现如下步骤：
    接收客户端传输的用户支付标识，对所述用户支付标识进行认证；
    在所述用户支付标识认证成功时，对所述用户支付标识进行服务端加密，生成服务端支付标识，将所述服务端支付标识以及随机生成的随机键盘码返回至所述客户端；
    接收所述客户端传输的支付码，根据所述支付码及所述随机键盘码，获取用户的支付信息，对所述支付信息进行支付认证。
  16. 如权利要求15所述的计算机可读存储介质，其中，所述接收客户端传输的用户支付标识，对所述用户支付标识进行认证，包括：
    识别出所述用户支付标识的加密明文，对所述用户支付标识中的加密明文进行解密，根据预先存储的安全凭证对解密成功的所述用户支付标识进行认证。
  17. 如权利要求16所述的计算机可读存储介质，其中，所述对所述用户支付标识进行服务端加密，生成服务端支付标识，包括：
    利用下述方法对所述用户支付标识进行服务端加密：
    Figure PCTCN2021090308-appb-100003
    其中，E(M)表示服务端支付标识，m表示用户支付标识中的第m个明文，t表示用户支付标识中明文的数量，e表示无线不循环小数，mod表示明文加密函数，N表示加密次数。
  18. 如权利要求15所述的计算机可读存储介质，其中，还包括：
    设置所述随机键盘码的安全时效；
    当所述支付码的接收时间不在所述安全时效之内时，将所述支付码丢弃。
  19. 一种计算机可读存储介质，存储有计算机程序，其中，所述计算机程序被处理器执行时实现如下步骤：
    基于支付请求，获取支付标识，对所述支付标识进行客户端加密，生成用户支付标识，将所述用户支付标识传输至服务端；
    接收所述服务端返回的服务端支付标识以及随机键盘码，对所述服务端支付标识进行认证；
    在所述服务端支付认证通过时，根据所述随机键盘码生成支付键盘，根据用户通过所述支付键盘输入的支付信息生成支付码，将所述支付码传输至服务端进行支付认证。
  20. 如权利要求19所述的计算机可读存储介质，其中，所述根据所述随机键盘码生成支付键盘，包括：
    获取所述随机键盘码中字符的排配顺序；
    构建虚拟键盘，根据所述字符的排配顺序对所述虚拟键盘进行界面配置，得到支付键盘。
PCT/CN2021/090308 2020-10-09 2021-04-27 安全支付方法、装置、电子设备及存储介质 WO2022073336A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011073558.4 2020-10-09
CN202011073558.4A CN112150151B (zh) 2020-10-09 2020-10-09 安全支付方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2022073336A1 true WO2022073336A1 (zh) 2022-04-14

Family

ID=73952694

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/090308 WO2022073336A1 (zh) 2020-10-09 2021-04-27 安全支付方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN112150151B (zh)
WO (1) WO2022073336A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112150151B (zh) * 2020-10-09 2023-07-14 平安科技（深圳）有限公司 安全支付方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103020825A (zh) * 2012-12-05 2013-04-03 福建省派活园科技信息有限公司 一种基于软体客户端的安全支付认证方法
US20130254116A1 (en) * 2012-03-23 2013-09-26 The Toronto Dominion Bank System and method for authenticating a payment terminal
CN106920091A (zh) * 2015-12-25 2017-07-04 北京数码视讯科技股份有限公司 一种支付方法及安全操作系统
CN107465701A (zh) * 2017-10-04 2017-12-12 刘兴丹 一种动态位置密码输入界面的方法、装置
CN112150151A (zh) * 2020-10-09 2020-12-29 平安科技（深圳）有限公司 安全支付方法、装置、电子设备及存储介质

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN201207190Y (zh) * 2008-05-22 2009-03-11 北京飞天诚信科技有限公司 一种自动输入密码的装置
CN111611976A (zh) * 2020-06-04 2020-09-01 支付宝(杭州)信息技术有限公司 一种基于人脸识别的支付方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130254116A1 (en) * 2012-03-23 2013-09-26 The Toronto Dominion Bank System and method for authenticating a payment terminal
CN103020825A (zh) * 2012-12-05 2013-04-03 福建省派活园科技信息有限公司 一种基于软体客户端的安全支付认证方法
CN106920091A (zh) * 2015-12-25 2017-07-04 北京数码视讯科技股份有限公司 一种支付方法及安全操作系统
CN107465701A (zh) * 2017-10-04 2017-12-12 刘兴丹 一种动态位置密码输入界面的方法、装置
CN112150151A (zh) * 2020-10-09 2020-12-29 平安科技（深圳）有限公司 安全支付方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN112150151B (zh) 2023-07-14
CN112150151A (zh) 2020-12-29

Similar Documents

Publication Publication Date Title
US11665006B2 (en) User authentication with self-signed certificate and identity verification
CN109075976B (zh) 取决于密钥认证的证书发布
CN108900464B (zh) 电子装置、基于区块链的数据处理方法和计算机存储介质
US9075980B2 (en) Integrity protected smart card transaction
US9148415B2 (en) Method and system for accessing e-book data
WO2021219086A1 (zh) 基于区块链的数据传输方法和系统
WO2015188424A1 (zh) 一种密钥存储设备及其使用方法
JPWO2019239591A1 (ja) 認証システム、認証方法、アプリケーション提供装置、認証装置、及び認証用プログラム
US9065806B2 (en) Internet based security information interaction apparatus and method
US20140172741A1 (en) Method and system for security information interaction based on internet
WO2021114614A1 (zh) 应用程序安全启动方法、装置、计算机设备和存储介质
CN114760070A (zh) 数字证书颁发方法、数字证书颁发中心和可读存储介质
CN111241492A (zh) 一种产品多租户安全授信方法、系统及电子设备
CN114499859A (zh) 密码验证方法、装置、设备及存储介质
CN112862484A (zh) 一种基于多端交互的安全支付方法及装置
WO2022073336A1 (zh) 安全支付方法、装置、电子设备及存储介质
CN116188009A (zh) 一种国密软加密模式秘钥获取方法、系统、终端和可读存储介质
CN116226932A (zh) 业务数据校验方法、装置、计算机介质及电子设备
JP2015220526A (ja) 情報処理システム、情報処理方法、及びプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21876859

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21876859

Country of ref document: EP

Kind code of ref document: A1