WO2023142441A1

WO2023142441A1 - Tag-based money receiving qr code payment method and payment device

Info

Publication number: WO2023142441A1
Application number: PCT/CN2022/112826
Authority: WO
Inventors: 徐智劼; 杨阳; 秦杰
Original assignee: 中国银联股份有限公司
Priority date: 2022-01-29
Filing date: 2022-08-16
Publication date: 2023-08-03
Also published as: CN114493581A

Abstract

The present invention relates to a tag-based money receiving QR code payment method executed in a payment device. The method comprises: scanning a money receiving QR code, so as to obtain a link; interacting with a tag apparatus on the basis of a short-distance communication mode so as to obtain security verification information; and sending a payment request to a payment background on the basis of the security verification information. The present invention also relates to a payment device, a passive tag, a payment background, a computer storage medium, and a computer program product.

Description

Tag-based collection code payment method and payment device

technical field

This application claims the priority of the Chinese patent application (Application No.: 202210111031.9), and this application relates to the field of collection code payment, and more specifically, relates to a tag-based collection code payment method executed in a payment device, and a payment device , passive tags, payment background, computer storage media and computer program products.

Background technique

In recent years, personal payment barcodes have been widely used, effectively meeting the individualized and diversified payment needs of the public, and improving the efficiency of fund collection and payment for small and micro economies and street stall economies. But at the same time, personal payment barcodes also have some hidden risks. Some institutions use the personal collection barcode transfer business to handle a large number of production, operation and daily consumption transactions, which not only confuses the nature of the transaction, leads to distortion of transaction information, affects the effect of risk monitoring, but also does not facilitate the use of payment services to empower and add value to business activities.

In order to make better use of the inclusiveness and convenience of payment collection barcodes under the premise of preventing risks, the People's Bank of China issued the "Notice of the People's Bank of China on Strengthening the Management of Payment Acceptance Terminals and Related Businesses" and put forward targeted requirements: First, the Personal collection barcode users with obvious operating characteristics are managed with reference to special merchants, and it is required to provide such individual users with merchant collection barcodes to improve the quality of acquiring services for individual operators; the second is to prohibit the use of personal static collection barcodes in principle The third is to refer to the relevant requirements of the personal static collection barcode for personal dynamic collection barcodes saved by screenshots, downloads, etc., so as to prevent lawbreakers from using personal dynamic collection barcodes to evade policy requirements; the fourth is to require Prudently determine the entry conditions and scale of the personal static collection barcode whitelist, the validity period, number of uses and transaction limits of the personal static collection barcode, and prevent the risk of whitelist abuse.

However, in the prior art, there is no effective solution to prevent the abuse/remote use of offline static QR codes.

Contents of the invention

According to one aspect of the present invention, there is provided a tag-based collection code payment method executed in a payment device, the method comprising: scanning the collection code to obtain a link; communicating with the collection code based on a short-distance communication Interact with the tag device corresponding to the code to obtain security verification information; and send a payment request to the payment background based on the security verification information.

As a supplement or an alternative to the above solution, in the above method, the payment collection code is a static payment collection two-dimensional code, and the payment device acquires a URL link by scanning the static payment collection two-dimensional code.

As a supplement or alternative to the above solution, in the above method, the tag device is a passive tag.

As a supplement or alternative to the above solution, in the above method, interacting with the tag device corresponding to the payment code based on the short-distance communication method to obtain security verification information includes: code ID to apply for the security check information from the label device; and receive the security check information including signature data and label certificate from the label device.

As a supplement or an alternative to the above solution, in the above method, when the signature data is successfully verified by the label device on the payment two-dimensional code, the two-dimensional code for payment and the two-dimensional code for payment are verified by the label certificate. Signed with a timestamp.

As a supplement or alternative to the above solution, in the above method, based on the security verification information, sending the payment request to the payment background includes: the payment device uses the signature data and the label certificate to access the URL link ; after the payment background successfully verifies the signature data and the tag certificate, receiving a payment page from the payment background; and sending a payment request on the payment page.

As a supplement or alternative to the above solution, the above method may further include: after scanning the payment code and before interacting with the tag device to obtain security verification information, the payment device links to the payment background through the URL Applying for a payment page; and receiving the payment page from the payment background, wherein the payment page carries an access token corresponding to the static QR code for payment.

As a supplement or alternative to the above solution, in the above method, the access token includes a background random number in plain text and an access password in cipher text.

As a supplement or alternative to the above solution, in the above method, the access password is obtained by encrypting the tag device ID, the first time stamp, the payment order number and the payment device ID with the first key, wherein the first key The key is formed by dispersing the master key corresponding to the tag device through the background random number.

As a supplement or alternative to the above solution, in the above method, interacting with the tag device corresponding to the payment code based on short-distance communication to obtain security verification information includes: the payment device broadcasting the access token; and After the tag device passes the verification of the access token, a payment credential is received from the tag device.

As a supplement or an alternative to the above solution, in the above method, the payment credential is paired with the tag device ID, payment two-dimensional code ID, geographical location information, payment ID, the access token, and the second key through the second key. The time stamp is encrypted, and the second key is formed by dispersing the tag random number generated by the tag device and the background random number with a master key corresponding to the tag device.

As a supplement or alternative to the above solution, in the above method, based on the security verification information, sending a payment request to the payment background includes: after receiving the payment certificate, sending a payment request to the payment background, wherein , the payment request includes the payment credential.

As a supplement or alternative to the above solution, the above method may further include: receiving a payment result from the payment background.

As a supplement or alternative to the above solution, the above method may further include: after scanning the collection code, receiving a payment page and tag-related information from the payment background, where the tag-related information includes a tag device MAC and a tag device ID.

As a supplement or alternative to the above solution, in the above method, interacting with the tag device corresponding to the payment code based on the short-distance communication method to obtain security verification information includes: receiving a broadcast message from the tag device; The tag device MAC and the tag device ID in the broadcast message; after the verification is successful, send a request for payment voucher to the tag device; and receive the payment voucher from the tag device.

As a supplement or alternative to the above solution, in the above method, the payment credential request includes a tag device ID, a random number contained in the broadcast message, a payment device ID, and a payment account ID.

According to another aspect of the present invention, a payment device is provided, and the payment device includes: a scanning device for scanning a collection code to obtain a link; an interaction device for communicating with the payment collection code based on a short-distance communication method The tag device corresponding to the code interacts to obtain security verification information; and the payment request sending device is used to send a payment request to the payment background based on the security verification information.

As a supplement or an alternative to the above solution, in the above payment device, the payment collection code is a static payment collection two-dimensional code, and the scanning device acquires a URL link by scanning the static payment collection two-dimensional code.

As a supplement or alternative to the above solution, in the above payment device, the tag device is a passive tag.

As a supplement or an alternative to the above solution, in the above payment device, the interaction device is configured to: apply for the security check information from the label device through the two-dimensional code ID attached to the URL link; The tag device receives the security verification information including signature data and tag certificate.

As a supplement or alternative to the above solution, in the above payment device, when the signature data is successfully verified by the label device on the two-dimensional code for payment, the two-dimensional code for payment is verified through the label certificate signed with a timestamp.

As a supplement or alternative to the above solution, in the above payment device, the payment request sending device is configured to: use the signature data and the label certificate to access the URL link; After the signature data and the tag certificate are successfully received, the payment page is received from the payment background; and a payment request is sent on the payment page.

As a supplement or alternative to the above solution, the above payment device may further include: payment page application means, used to pass the URL linking to the payment background to apply for a payment page, and first receiving means for receiving the payment page from the payment background, wherein the payment page carries an access token corresponding to the static collection QR code .

As a supplement or alternative to the above solution, in the above payment device, the access token includes a background random number in plain text and an access password in cipher text.

As a supplement or alternative to the above solution, in the above payment device, the access password is obtained by encrypting the tag device ID, the first time stamp, the payment order number and the payment device ID with the first key, wherein the first The key is formed by dispersing the master key corresponding to the tag device through the background random number.

As a supplement or alternative to the above solution, in the above payment device, the interaction device is configured to: broadcast the access token; and after the tag device passes the verification of the access token, from the tag device Receive proof of payment.

As a supplement or alternative to the above solution, in the above payment device, the payment credential is paired with the tag device ID, payment two-dimensional code ID, geographical location information, payment ID, the access token, and the second key through the second key. Two timestamps are encrypted, wherein the second key is formed by dispersing the tag random number generated by the tag device and the background random number with a master key corresponding to the tag device.

As a supplement or alternative to the above solution, in the above payment device, the payment request sending means is configured to: after receiving the payment voucher, send a payment request to the payment background, wherein the payment request includes the payment voucher.

As a supplement or alternative to the above solution, the above payment device may further include: a second receiving device, configured to receive a payment result from the payment background.

As a supplement or alternative to the above solution, the above payment device may further include: a third receiving device, configured to receive the payment page and tag-related information from the payment background after scanning the payment collection code, the tag-related information includes Tag device MAC and tag device ID.

As a supplement or alternative to the above solution, in the above payment device, the interaction means is configured to: receive a broadcast message from the tag device; verify the tag device MAC and tag device ID in the broadcast message; Thereafter, sending a payment voucher request to the tag device; and receiving a payment voucher from the tag device.

As a supplement or alternative to the above solution, in the above payment device, the payment credential request includes a tag device ID, a random number contained in the broadcast message, a payment device ID, and a payment account ID.

According to still another aspect of the present invention, a passive tag is provided, and the passive tag includes: a communication module, used to interact with the aforementioned payment device based on a short-distance communication method; a control module, used to generate security verification information; and an environmental energy conversion module, configured to obtain the energy required by the passive tag through an environmental energy source.

As a supplement or replacement for the above solution, in the above passive tag, the control module is configured to: verify the payment receiving QR code ID provided by the payment device; and generate the security verification after the verification is successful information, wherein the security verification information includes signature data and label certificates.

As a supplement or an alternative to the above solution, in the above passive tag, the signature data is obtained by the control module signing the payment two-dimensional code and the time stamp through the tag certificate.

As a supplement or alternative to the above solution, in the above passive tag, the control module is configured to: verify the access token provided by the payment device; and generate the security verification information after the verification is successful, wherein The security verification information is a payment certificate.

As a supplement or alternative to the above scheme, in the above passive tag, the payment credential passes the key to the tag device ID, the payment two-dimensional code ID, geographic location information, payment ID, the access token, and a time stamp Encrypted, wherein the key is formed by dispersing the master key corresponding to the passive tag through tag random numbers and background random numbers.

As a supplement or alternative to the above solution, in the above passive tag, the control module is configured to: verify the tag ID and random number provided by the payment device; The device ID and payment account ID are hashed to generate payment credentials.

According to yet another aspect of the present invention, a payment background is provided, and the payment background includes: a payment device interaction module, used to interact with the aforementioned payment device; and a verification module, used to verify the The security verification information provided by the payment device.

As a supplement or an alternative to the above solution, in the above payment background, the verification module is configured to verify the label certificate and signature data provided by the payment device.

As a supplement or an alternative to the above solution, in the above payment background, the payment device interaction module is configured to: return a payment page to the payment device after the verification module succeeds in verification.

As a supplement or alternative to the above solution, in the above payment background, the payment interaction module is configured to: receive an application for a payment page from the payment device; The access token corresponding to the QR code.

As a supplement or an alternative to the above solution, in the above payment background, the access token includes a background random number in plain text and an access password in cipher text.

As a supplement or alternative to the above solution, in the above payment background, the access password is obtained by encrypting the tag device ID, the first time stamp, the payment order number and the payment device ID with the first key, wherein the first The key is formed by dispersing the master key corresponding to the tag device through the background random number.

As a supplement or an alternative to the above solution, in the above payment background, the verification module is configured to verify the payment certificate included in the payment request sent by the payment device.

As a supplement or an alternative to the above solution, in the above payment background, the payment credential is paired with the tag device ID, payment two-dimensional code ID, geographic location information, payment ID, the access token, and the second key through the second key. Two timestamps are encrypted, wherein the second key is formed by dispersing the tag random number and the background random number with the master key corresponding to the tag device.

According to yet another aspect of the present invention, a computer storage medium is provided, the medium includes instructions, and the instructions execute the method as described above when executed.

According to still another aspect of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the aforementioned method is implemented.

The tag-based collection code payment scheme of the embodiment of the present invention proposes that after the payment device scans the collection code (such as a static collection QR code), it interacts with the tag device corresponding to the collection code based on a short-distance communication method so that Obtain security verification information. Subsequently, the subsequent payment process is performed based on the security verification information. In this way, by binding the tag device (such as a passive tag) with the collection code (such as a static collection code), it is ensured that the collection code can only be used nearby, and the problem of personal collection code being abused is solved. Regulations of the People's Bank of China. In addition, the above payment scheme can be consistent with the existing code scanning payment experience, and will not have a negative impact on user experience.

In addition, the passive tag provided by one or more embodiments of the present invention can collect radio waves transmitted from the network side, capture and collect energy, and complete corresponding calculation and transmission tasks without requiring additional batteries or external power supplies.

Description of drawings

The above and other objects and advantages of the present invention will become more complete and clear from the following detailed description in conjunction with the accompanying drawings, wherein the same or similar elements are denoted by the same reference numerals.

Fig. 1 shows a schematic flow diagram of a tag-based collection code payment method executed in a payment device according to an embodiment of the present invention;

Fig. 2 shows a schematic structural diagram of a payment device according to an embodiment of the present invention;

Fig. 3 shows a schematic structural diagram of a passive tag according to an embodiment of the present invention;

Fig. 4 shows a schematic structural diagram of a payment background according to an embodiment of the present invention;

Fig. 5 shows the architecture diagram of the static collection code security payment system based on passive tags according to an embodiment of the present invention;

Fig. 6 shows a schematic diagram of a passive tag-based static payment code security payment method according to an embodiment of the present invention;

Figure 7 shows a schematic diagram of a passive tag-based static payment code security payment method according to another embodiment of the present invention; and

Fig. 8 shows a schematic diagram of a passive tag-based static payment code secure payment method according to yet another embodiment of the present invention.

Detailed ways

Embodiments of the present invention will be further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but should not be used to limit the scope of the present invention.

In the description of this specification, descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific examples", or "some examples" mean that specific features described in connection with the embodiment or example , structure, material or feature is included in at least one embodiment or example of the embodiments of the present invention. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the described specific features, structures, materials or characteristics may be combined in any suitable manner in any one or more embodiments or examples. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and should not be construed as indicating or implying relative importance. In addition, those skilled in the art can combine and combine different embodiments or examples and features of different embodiments or examples described in this specification without conflicting with each other.

Fig. 1 shows a schematic flow chart of a tag-based collection code payment method 1000 executed in a payment device according to an embodiment of the present invention. As shown in Figure 1, the method 1000 includes the following steps:

In step S110, scan the payment code to obtain the link;

In step S120, interacting with the tag device corresponding to the payment code based on the short-distance communication method to obtain security verification information; and

In step S130, based on the security verification information, a payment request is sent to the payment background.

In the context of the present invention, "payment device" refers to a device with a payment function, which can scan a collection code (such as a static collection QR code) to perform a subsequent payment process. In one or more embodiments, the payment device may be a smart phone, smart watch, IPAD, etc.

In step S110, the payment collection code may be a static payment collection two-dimensional code, and the payment device acquires a URL link by scanning the static payment collection two-dimensional code. URL is the abbreviation of uniform resource locator, which means Uniform Resource Locator System, which is a representation method for specifying the location of information on the Internet's World Wide Web service program. Using URL links can describe various information resources in a unified format, including files, server addresses and directories, etc. The format of the URL can be composed of the following three parts: the first part is the protocol (or service method); the second part is the host IP address (sometimes including the port number) where the resource is stored; the third part is the specific address of the host resource , such as directory and file names, etc. The first part and the second part are separated by a "://" symbol, and the second part and the third part are separated by a "/" symbol. The first and second parts are indispensable, and the third part can sometimes be omitted.

In one or more embodiments, the tag device is a passive tag. Here, a passive tag can also be referred to as a passive IoT tag, which does not have a built-in battery. The so-called "passive Internet of Things" is essentially passive terminal nodes. They do not have power lines and built-in batteries, but obtain energy from the environment. For example, the Internet of Things based on wireless electromagnetic energy capture technology, the passive Internet of Things The terminal captures and collects energy by collecting radio waves emitted from the network side, so as to complete data collection, transmission and distributed computing.

In the context of the present invention, a tag device corresponds to a payment device. In one embodiment, when the payment device is outside a certain range, the tag device is in a passive state, and when it is within a certain range of the payment device, the tag device sends radio frequency energy from the payment device (for example, transmitted from the network side) The power it needs to work is extracted from radio waves).

In step S120, interact with the tag device corresponding to the payment code based on the short-distance communication method. Here, the "short-range communication method" may include, but not limited to, low-power short-range communication methods such as bluetooth and wifi.

In the context of the present invention, the tag device can verify the information provided by the payment device (or payment terminal) (such as the payment QR code ID, access token, etc.) to provide the payment device with "security verification information" , used to ensure that the payment code is used on-site and not used remotely after being photographed, improving payment security.

In one embodiment, step S120 includes: applying for the security verification information from the tag device through the payment collection QR code ID attached to the URL link; and receiving the signature data and tag certificate from the tag device The security verification information of .

In one embodiment, the signature data is obtained by the label device signing the payment two-dimensional code and time stamp through the label certificate when the verification of the payment two-dimensional code is successful.

In this embodiment, step S130 includes: the payment device uses the signature data and the label certificate to access the URL link; after the payment background verifies the signature data and the label certificate successfully, Receive a payment page (such as an H5 page) from the payment background; and send a payment request on the payment page.

In one or more embodiments, although not shown in FIG. 1 , the above method 1000 may further include between step S110 and step S120: the payment device applies for a payment page to the payment background through the URL link; And receiving the payment page from the payment background, wherein the payment page carries an access token corresponding to the static payment collection QR code.

In one embodiment, the access token includes a background random number in plain text and an access password in cipher text. In one embodiment, the access password is obtained by encrypting the tag device ID, the first time stamp, the payment order number, and the payment device ID with a first key, wherein the first key is encrypted with the background random number It is formed by dispersing the master key corresponding to the tag device. Here, the key distribution algorithm can be used for the distribution operation of the master key. The so-called key distribution algorithm means that a double-length (one length key is 8 bytes) master key (MK) is used to disperse the data, and a double-length DES encryption key (DK) is derived. This algorithm is widely used in current financial IC cards and other industries with high security requirements. The DK derivation process is as follows: First, the left half of the DK is derived. The specific method is: 1. Use the rightmost 8 bytes of the scattered data as input data; 2. Use MK as the encryption key; 3. Use MK to input data Perform 3DES operation to get the left half of DK. Next, deduce the right half of DK, the specific method is as follows: 1. Invert the rightmost 8 bytes of the scattered data as the input data; 2. Use MK as the encryption key; 3. Use MK to perform 3DES operation on the input data , get the right half of DK. Finally, the 8 bytes of the left and right parts of the DK are combined into a double-length DK key, which is the 3DES key to be used obtained by dispersion.

In the above embodiment, step S120 includes: the payment device broadcasting the access token; and receiving a payment certificate from the tag device after the tag device passes the verification of the access token. In one embodiment, the payment credential is formed by encrypting the tag device ID, payment two-dimensional code ID, geographic location information, payment ID, the access token, and a second time stamp with a second key, The second key is formed by dispersing the tag random number generated by the tag device and the background random number into a master key corresponding to the tag device. Here, the key distribution algorithm as mentioned above can be used for the distribution operation of the master key.

In one embodiment, step S130 includes: after receiving the payment voucher, sending a payment request to the payment background, wherein the payment request includes the payment voucher.

Although not shown in FIG. 1 , in one or more embodiments, the above method 1000 may further include: receiving a payment result from the payment background.

In one or more embodiments, the above method 1000 may further include: after scanning the collection code, receiving the payment page and label-related information from the payment background, the label-related information includes label device MAC and label device ID and other information.

In this embodiment, step S120 includes: receiving a broadcast message (for example, including a tag ID and a random number, etc.) from the tag device; verifying the tag device MAC and tag device ID in the broadcast message; Afterwards, sending a payment voucher request (for example, including information such as tag ID, random number, payment device ID, payment account ID, etc.) to the tag device; and receiving a payment voucher from the tag device.

Through the above descriptions of various implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general-purpose hardware platform, and of course can also be implemented by hardware. Based on this understanding, the above-mentioned technical solution essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the computer-readable record A medium includes any mechanism for storing or transmitting information in a form readable by a computer (eg, a computer). A machine-readable medium includes, for example, read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash storage media, electronic, optical, acoustic, or other forms of propagated signals (e.g., carrier waves). , infrared signal, digital signal, etc.), the computer software product includes several instructions to make a computer device (which can be a personal computer, server, or network device, etc.) execute various embodiments or some parts of the embodiments Methods.

Fig. 2 shows a schematic structural diagram of a payment device 2000 according to an embodiment of the present invention. As shown in FIG. 2 , the payment device 2000 includes a scanning device 210 , an interaction device 220 and a payment request sending device 230 . Among them, the scanning device 210 is used to scan the payment code to obtain the link; the interaction device 220 is used to interact with the label device corresponding to the payment code based on the short-distance communication method to obtain security verification information; and the payment request is sent to The device 230 is configured to send a payment request to the payment background based on the security verification information.

In one or more embodiments, the scanning device 210 is used to scan the payment code to obtain a link, wherein the payment code may be a static payment two-dimensional code, and the payment device scans the static payment two-dimensional code to Get the URL link. URL is the abbreviation of uniform resource locator, which means Uniform Resource Locator System, which is a representation method for specifying the location of information on the Internet's World Wide Web service program. The use of URL links can describe various information resources in a unified format, including files, addresses and directories of servers, and so on. The format of the URL can be composed of the following three parts: the first part is the protocol (or service method); the second part is the host IP address (sometimes including the port number) where the resource is stored; the third part is the specific address of the host resource , such as directory and file names, etc. The first part and the second part are separated by a "://" symbol, and the second part and the third part are separated by a "/" symbol. The first and second parts are indispensable, and the third part can sometimes be omitted.

In one or more embodiments, the tag device is a passive tag. Here, a passive tag can also be referred to as a passive IoT tag, which does not have a built-in battery. The so-called "passive Internet of Things" is essentially passive terminal nodes. They do not have power lines and built-in batteries, but obtain energy from the environment. For example, the Internet of Things based on wireless electromagnetic energy capture technology, Passive Internet of Things The terminal captures and collects energy by collecting radio waves emitted from the network side, so as to complete data collection, transmission and distributed computing.

The interaction device 220 is configured to interact with the label device corresponding to the payment code based on the short-distance communication method to obtain security verification information. Here, the "short-range communication method" may include, but not limited to, low-power short-range communication methods such as bluetooth and wifi.

In one embodiment, the interaction device 220 is configured to: apply for the security verification information from the label device through the payment two-dimensional code ID attached to the URL link; and receive a signature from the label device. The security verification information of data and tag certificates.

For example, the signature data may be obtained by the label device signing the payment two-dimensional code and the time stamp through the label certificate when the verification of the payment two-dimensional code is successful.

In the above embodiment, the payment request sending device 230 is configured to: use the signature data and the label certificate to access the URL link; verify the signature data and the label certificate in the payment background After success, receive a payment page from the payment background; and send a payment request on the payment page.

In one embodiment, the above-mentioned payment device 2000 may further include: payment page application means 240, configured to pass the URL link to apply for a payment page from the payment background, and the first receiving means 250 is configured to receive the payment page from the payment background, wherein the payment page carries an access token corresponding to the static payment two-dimensional code Card.

In one embodiment, the access token includes a background random number in plain text and an access password in cipher text. For example, the access password is formed by encrypting information such as the tag device ID, the first time stamp, the payment order number, and the payment device ID with a first key, wherein the first key is distributed with the background random number. The master key corresponding to the tag device is formed. Here, the key distribution algorithm can be used for the distribution operation of the master key. The so-called key distribution algorithm means that a double-length (one length key is 8 bytes) master key (MK) is used to disperse the data, and a double-length DES encryption key (DK) is derived. This algorithm is widely used in current financial IC cards and other industries with high security requirements. The DK derivation process is as follows: First, the left half of the DK is derived. The specific method is: 1. Use the rightmost 8 bytes of the scattered data as input data; 2. Use MK as the encryption key; 3. Use MK to input data Perform 3DES operation to get the left half of DK. Next, deduce the right half of DK, the specific method is as follows: 1. Invert the rightmost 8 bytes of the scattered data as the input data; 2. Use MK as the encryption key; 3. Use MK to perform 3DES operation on the input data , get the right half of DK. Finally, the 8 bytes of the left and right parts of the DK are combined into a double-length DK key, which is the 3DES key to be used obtained by dispersion.

In the above embodiment, the interaction device 220 is configured to: broadcast the access token; and receive a payment credential from the tag device after the tag device passes the verification of the access token. For example, the payment credential can be formed by encrypting information such as the tag device ID, the payment two-dimensional code ID, the geographic location information, the payment ID, the access token, and the second time stamp through the second key, wherein The second key is formed by dispersing the tag random number generated by the tag device and the background random number into a master key corresponding to the tag device. Here, the above-mentioned key distribution algorithm may be used for the distribution operation of the master key, so details will not be repeated here.

In the above embodiment, the payment request sending means 230 may be configured to: after receiving the payment credential, send a payment request to the payment background, wherein the payment request includes the payment credential.

In addition, in one or more embodiments, the above-mentioned payment device 2000 may further include: a second receiving means 260, configured to receive a payment result from the payment background.

In one or more embodiments, the above-mentioned payment device 2000 may further include: a third receiving means 270, configured to receive the payment page and label-related information from the payment background after scanning the collection code, the label The relevant information includes tag device MAC and tag device ID and other information.

In this embodiment, the interaction device 220 may be configured to: receive a broadcast message (for example, including a tag ID and a random number, etc.) from the tag device; check the tag device MAC and the tag device ID in the broadcast message; After the verification is successful, send a payment credential request (for example, including tag device ID, random number, payment device ID, payment account ID, etc.) to the tag device; and receive a payment credential from the tag device.

Fig. 3 shows a schematic structural diagram of a passive tag 3000 according to an embodiment of the present invention. As shown in FIG. 3 , the passive tag 3000 includes: a communication module 310 , a control module 320 and an environmental energy conversion module 330 . Among them, the communication module 310 is used to interact with the payment device based on short-distance communication; the control module 320 is used to generate security verification information; energy.

For example, the passive tag 3000 provides security verification services for payment devices when scanning offline static QR codes for payment. The communication module 310 is responsible for communication with payment devices, including but not limited to low-power short-distance communication methods such as bluetooth and wifi. The control module 320 is responsible for access token verification, payment credential generation and storage calculation of payment-related keys. The environmental energy conversion module 330 obtains the required power through a variety of environmental energy sources (micro-light energy, temperature gradient, radio frequency, vibration, etc.), and the micro-energy management chip optimizes and stores the collected energy to solve the self-power supply problem of the device.

In one embodiment, the control module 320 is configured to: verify the payment collection QR code ID provided by the payment device; and generate the security verification information after the verification is successful, wherein the security verification Information includes signed data as well as tag certificates. For example, the signature data is obtained by the control module 320 signing the payment two-dimensional code and the time stamp through the label certificate.

In one embodiment, the control module 320 is configured to: verify the access token provided by the payment device; and generate the security verification information after the verification is successful, wherein the security verification information is a payment certificate. For example, the payment credential is formed by encrypting the tag device ID, payment two-dimensional code ID, geographic location information, payment ID, the access token, and time stamp with a key, wherein the key is randomly generated by the tag. number and the background random number are formed by dispersing the master key corresponding to the passive tag.

Fig. 4 shows a schematic structural diagram of a payment background 4000 according to an embodiment of the present invention. As shown in FIG. 4 , the payment background 4000 includes: a payment device interaction module 410 and a verification module 420 . Wherein, the payment device interaction module 410 is used to interact with the payment device; and the verification module 420 is used to verify the security verification information provided by the payment device.

In one embodiment, the verification module 420 is configured to verify the tag certificate and signature data provided by the payment device. In this embodiment, the payment device interaction module 410 is configured to: return a payment page to the payment device after the verification module succeeds in verification.

In one embodiment, the payment interaction module 410 is configured to: receive an application for a payment page from the payment device; and return to the payment page, wherein the payment page carries an access code corresponding to the static payment QR code token. For example, the access token includes a background random number in plain text and an access password in cipher text. The access password can be formed, for example, by encrypting information such as the tag device ID, the first time stamp, the payment order number, and the payment device ID with a first key, wherein the first key is distributed with the background random number. The master key corresponding to the tag device is formed.

In this embodiment, the verification module 420 is configured to verify the payment credential included in the payment request sent by the payment device. For example, the payment credential is formed by encrypting information such as the tag device ID, the payment two-dimensional code ID, the geographic location information, the payment ID, the access token, and the second time stamp with the second key, wherein the The second key is formed by dispersing the tag random number and the background random number with the master key corresponding to the tag device.

The device embodiments described above are only illustrative, and the modules described as separate components may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network modules. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative effort.

Fig. 5 shows a structure diagram of a passive tag-based static payment code security payment system according to an embodiment of the present invention. As shown in Figure 5, the static payment code security payment system based on passive tags can be composed of four parts: passive micro tags, payment QR codes, payment equipment and payment background. Among them, the passive micro-tag can include, for example, a communication module, an MCU module (control module) and a radio wave energy conversion module, and the payment device provides security verification services when scanning offline static QR codes for payment. The communication module is responsible for communication with payment devices, including but not limited to low-power short-distance communication methods such as Bluetooth and wifi; the MCU module is responsible for access token verification, payment voucher generation, and storage and calculation of payment-related keys; environmental energy conversion The module obtains the required power through a variety of environmental energy sources (micro-light energy, temperature gradient, radio frequency, vibration, etc.), and the micro-energy management chip optimizes and stores the collected energy to solve the self-power supply problem of the device. The payment QR code is an offline static QR code, which is responsible for providing the payment URL link; the payment device, such as a mobile phone, provides payment services for users; the payment background is responsible for verifying the payment certificate and completing the transaction.

Fig. 6 shows a schematic diagram of a passive tag-based static payment code secure payment method according to an embodiment of the present invention.

Here, the static payment code security payment method based on passive tags refers to the introduction of passive IoT tags on the basis of the original offline static QR code collection scheme, and the interaction between passive IoT tags and payment devices to ensure The on-site static QR code is used on-site and used remotely without being photographed, which improves payment security, ensures the authenticity of transaction information, improves the effect of risk monitoring, and then empowers and adds value to business activities through payment services.

Continuing to refer to Figure 6, the passive tag-based static payment code security payment method may include the following steps:

First, the payment device scans the payment QR code to obtain the URL link;

Secondly, the payment device applies for a tag certificate to the passive tag through broadcasting through the payment receiving QR code ID attached to the URL;

Next, the tag verifies whether the payment QR code ID is correct, and if the verification is successful, it signs the receipt (QR code ID+time stamp) on the tag certificate, and returns the signature data and the tag certificate;

Then, the payment device carries the signature data + label certificate to access the corresponding URL link;

Finally, after the verification certificate is successfully verified in the payment background, it returns to the payment collection H5 page, and guides the user to complete the subsequent payment steps.

Fig. 7 shows a schematic diagram of a passive tag-based static payment code secure payment method according to another embodiment of the present invention. This embodiment can deal with scenarios with higher security.

Continuing to refer to Figure 7, the passive tag-based static collection code security payment method may include the following steps:

First, the payment device scans the payment QR code to obtain the URL link;

Secondly, the payment device applies for the H5 payment interface to the payment background through the URL;

Then, the payment background returns to the H5 interface, and carries the passive tag access token corresponding to the payment QR code: background random number (plain text)+access password ((passive tag ID+time stamp 1+payment order number+payment device ID), the ciphertext is formed by encrypting the key 1 formed by the master key corresponding to the label through the background random number dispersion master key);

Then, the payment device broadcasts the passive tag access token. After the passive micro tag receives the access token, it generates the key 1 through the background random number in the plain text, and after decrypting the cipher text, it checks whether the passive tag ID is consistent with itself. , Whether the timestamp 1 is within the valid time (refer to setting within 5S of the current time);

Then, after the verification is passed, a tag random number is generated and a payment credential key is generated (formed by tag random number + background random number disperse master key), encrypted by key 2 (passive tag ID, payment QR code ID , geographic location information, payment device ID, current access token, time stamp 2 and other information) return to the payment device;

Then, the user enters the payment amount on the payment device, and submits the payment order with the payment amount, merchant number, payment order and other information;

Finally, the payment background checks whether the payment certificate is valid, and completes the payment deduction.

Fig. 8 shows a schematic diagram of a passive tag-based static payment code secure payment method according to yet another embodiment of the present invention. The static payment code security payment method based on passive tags may include the following steps:

First, the user scans the payment QR code on the payment device (such as a payment APP) to obtain the URL, and applies for information such as the payment interface, tag ID, and tag MAC;

Secondly, the payment device or APP calls the Bluetooth of the mobile phone to enter the monitoring mode;

Then, the Internet of Things tag bound to the collection terminal broadcasts tag information (including tag ID and random number, etc.) at regular intervals;

Then, the payment device receives the tag broadcast information, verifies the tag MAC and tag ID, and sends the tag device ID, random number, payment device ID, payment account ID and other information to the IoT tag after the verification is successful, and applies for a payment certificate.

Then, the Internet of Things tag device verifies the tag device ID and random number, and if the verification is successful, it performs a hash operation on the tag device ID, payment device ID, payment account ID and other information to obtain a face-to-face payment certificate and returns it to the payment device;

Then, the user enters the payment amount, and the payment device sends the payment bill and payment voucher to the payment background;

Subsequently, the payment service platform verifies the face-to-face payment voucher and completes the payment;

Finally, the payment service platform returns the payment result to the payment APP.

To sum up, the label-based collection code payment scheme of the embodiment of the present invention proposes that after the payment device scans the collection code (such as a static collection QR code), the label device corresponding to the collection code based on the short-distance communication method Interact to obtain security verification information. Subsequently, the subsequent payment process is performed based on the security verification information. In this way, by binding the tag device (such as a passive tag) with the collection code (such as a static collection code), it is ensured that the collection code can only be used nearby, and the problem of personal collection code being abused is solved. Regulations of the People's Bank of China. In addition, the above payment scheme can be consistent with the existing code scanning payment experience, and will not have a negative impact on user experience.

In addition, the passive tags provided by one or more embodiments of the present invention can collect radio waves transmitted from the network side, capture and collect energy, and complete corresponding calculation and transmission tasks without requiring additional batteries or external power supplies.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatuses (devices) and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the present application have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, the appended claims are intended to be construed to cover the preferred embodiment and all changes and modifications which fall within the scope of the application. Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

A tag-based collection code payment method executed in a payment device, the method comprising:

Scan the payment code to get the link;

Interacting with the label device corresponding to the payment code based on a short-distance communication method to obtain security verification information; and

Based on the security verification information, a payment request is sent to the payment background.
The method according to claim 1, wherein the payment collection code is a static payment collection two-dimensional code, and the payment device obtains a URL link by scanning the static payment collection two-dimensional code.
The method of claim 1, wherein the tag device is a passive tag.
The method according to claim 2, wherein interacting with the label device corresponding to the collection code based on the short-distance communication method so as to obtain the security verification information includes:

Applying for the safety verification information to the tag device through the payment receiving QR code ID attached to the URL link; and

The security check information including signature data and a tag certificate is received from the tag device.
The method according to claim 4, wherein, when the signature data is successfully verified by the label device on the two-dimensional code for payment, the two-dimensional code for payment and the time stamp are verified by the label certificate Obtained by signing.
The method according to claim 5, wherein, based on the security verification information, sending the payment request to the payment background includes:

The payment device utilizes the signature data and the tag certificate to access the URL link;

After the payment background successfully verifies the signature data and the tag certificate, receiving a payment page from the payment background; and

Send a payment request on the payment page.
The method of claim 2, further comprising:

After scanning the collection code and before interacting with the tag device to obtain security verification information, the payment device applies for a payment page to the payment background through the URL link; and

The payment page is received from the payment background, wherein the payment page carries an access token corresponding to the static payment collection QR code.
The method of claim 7, wherein the access token comprises a background random number in clear text and an access password in cipher text.
The method according to claim 8, wherein the access password is formed by encrypting the tag device ID, the first time stamp, the payment order number and the payment device ID with a first key, wherein the first key is encrypted with The background random number is formed by dispersing the master key corresponding to the tag device.
The method according to any one of claims 7 to 9, wherein interacting with the tag device corresponding to the collection code based on a short-distance communication method to obtain security verification information includes:

the payment device broadcasts the access token; and

After the tag device passes the verification of the access token, a payment credential is received from the tag device.
The method of claim 10, wherein the payment credential passes a second key pair tag device ID, payment QR code ID, geographic location information, payment ID, the access token, and a second time stamp Encrypted, wherein the second key is formed by dispersing the tag random number generated by the tag device and the background random number with the master key corresponding to the tag device.
The method according to claim 11, wherein, based on the security verification information, sending the payment request to the payment background includes:

After receiving the payment credential, a payment request is sent to the payment background, wherein the payment request includes the payment credential.
The method of claim 1, further comprising:

Receive a payment result from the payment background.
The method of claim 1, further comprising:

After scanning the collection code, receive the payment page and tag-related information from the payment background, the tag-related information includes tag device MAC and tag device ID.
The method according to claim 14, wherein interacting with the label device corresponding to the collection code based on the short-distance communication method so as to obtain the security verification information includes:

receiving a broadcast message from the tag device;

Verifying the tag device MAC and the tag device ID in the broadcast message;

After the verification is successful, sending a payment credential request to the tag device; and

Payment credentials are received from the tag device.
The method of claim 15, wherein the payment credential request includes a tag device ID, a random number contained in the broadcast message, a payment device ID, and a payment account ID.
A payment device, the payment device comprising:

Scanning device, used to scan the payment code, so as to obtain the link;

The interaction device is used to interact with the label device corresponding to the payment code based on the short-distance communication method to obtain security verification information; and

The payment request sending device is configured to send the payment request to the payment background based on the security verification information.
The payment device according to claim 17, wherein the payment collection code is a static payment collection two-dimensional code, and the scanning device acquires a URL link by scanning the static payment collection two-dimensional code.
The payment device of claim 17, wherein said tag means is a passive tag.
The payment device of claim 18, wherein the interaction means is configured to:

Applying for the safety verification information to the tag device through the payment receiving QR code ID attached to the URL link; and

The security check information including signature data and a tag certificate is received from the tag device.
The payment device according to claim 20, wherein, when the signature data is successfully verified by the label device on the two-dimensional code for payment, the two-dimensional code for payment and time are verified by the label certificate stamped for signature.
The payment device according to claim 21, wherein the payment request sending means is configured to:

using the signature data and the tag certificate to access the URL link;

After the payment background successfully verifies the signature data and the tag certificate, receiving a payment page from the payment background; and

Send a payment request on the payment page.
The payment device of claim 18, further comprising:

A payment page application device, configured to apply for a payment page to the payment background through the URL link after the scanning device scans the collection code and before the interaction device interacts with the label device, and

The first receiving means is configured to receive the payment page from the payment background, wherein the payment page carries an access token corresponding to the static payment collection QR code.
The payment device according to claim 23, wherein the access token comprises a background random number in plain text and an access password in cipher text.
The payment device according to claim 24, wherein the access password is formed by encrypting the tag device ID, the first time stamp, the payment order number and the payment device ID with a first key, wherein the first key It is formed by dispersing the master key corresponding to the tag device through the background random number.
A payment device as claimed in any one of claims 23 to 25, wherein the interaction means is configured to:

broadcast said access token; and

After the tag device passes the verification of the access token, a payment credential is received from the tag device.
The payment device according to claim 26, wherein the payment credential passes the second key to the tag device ID, the payment two-dimensional code ID, the geographic location information, the payment ID, the access token, and the second time stamp, wherein the second key is formed by dispersing the tag random number generated by the tag device and the background random number with the master key corresponding to the tag device.
The payment device according to claim 27, wherein the payment request sending means is configured to:

After receiving the payment credential, a payment request is sent to the payment background, wherein the payment request includes the payment credential.
The payment device of claim 17, further comprising:

The second receiving means is used for receiving the payment result from the payment background.
The payment device of claim 17, further comprising:

The third receiving means is configured to receive the payment page and tag-related information from the payment background after scanning the payment collection code, the tag-related information including tag device MAC and tag device ID.
The payment device of claim 30, wherein the interaction means is configured to:

receiving a broadcast message from the tag device;

Verifying the tag device MAC and the tag device ID in the broadcast message;

After the verification is successful, sending a payment credential request to the tag device; and

Payment credentials are received from the tag device.
The payment device according to claim 31, wherein the payment credential request includes a tag device ID, a random number contained in the broadcast message, a payment device ID, and a payment account ID.
A passive tag, the passive tag includes:

A communication module, configured to interact with the payment device according to any one of claims 17 to 32 based on a short-distance communication method;

a control module, configured to generate security verification information; and

The environmental energy conversion module is used to obtain energy required by the passive tag through an environmental energy source.
The passive tag of claim 33, wherein the control module is configured to:

verifying the payment receiving QR code ID provided by the payment device; and

After the verification is successful, the safety verification information is generated, wherein the safety verification information includes signature data and a label certificate.
The passive tag according to claim 34, wherein the signature data is obtained by the control module signing the payment two-dimensional code and the time stamp through the tag certificate.
The passive tag of claim 33, wherein the control module is configured to:

verifying the access token provided by said payment device; and

After the verification is successful, the safety verification information is generated, wherein the safety verification information is a payment credential.
The passive tag of claim 36, wherein the payment credentials are encrypted with a key to the tag device ID, payment QR code ID, geographic location information, payment ID, the access token, and a time stamp wherein the key is formed by dispersing the master key corresponding to the passive tag through tag random numbers and background random numbers.
The passive tag of claim 33, wherein the control module is configured to:

Verify the tag ID and random number provided by the payment device; and

After the verification is successful, a payment voucher is generated by hashing the tag device ID, payment device ID, and payment account ID.
A payment background, the payment background includes:

A payment device interaction module, configured to interact with the payment device according to any one of claims 17 to 32; and

A verification module, configured to verify the security verification information provided by the payment device.
The payment background according to claim 39, wherein the verification module is configured to verify the tag certificate and signature data provided by the payment device.
The payment background according to claim 40, wherein the payment device interaction module is configured to: return a payment page to the payment device after the verification by the verification module is successful.
The payment background according to claim 39, wherein the payment interaction module is configured to:

receiving an application for a payment page from the payment device; and

Return to the payment page, where the payment page carries an access token corresponding to the static QR code for payment.
The payment background according to claim 42, wherein the access token includes a background random number in plain text and an access password in cipher text.
The payment background according to claim 43, wherein the access password is obtained by encrypting the tag device ID, the first time stamp, the payment order number and the payment device ID with a first key, wherein the first key It is formed by dispersing the master key corresponding to the tag device through the background random number.
The payment background according to claim 44, wherein the verification module is configured to verify the payment certificate included in the payment request sent by the payment device.
The payment background as claimed in claim 45, wherein said payment credential passes through a second key pair tag device ID, payment two-dimensional code ID, geographic location information, payment ID, said access token, and a second time stamp, wherein the second key is formed by dispersing the master key corresponding to the tag device through the tag random number and the background random number.
A computer storage medium comprising instructions which, when executed, perform the method of any one of claims 1 to 16.
A computer program product comprising a computer program, which implements the method according to any one of claims 1 to 16 when executed by a processor.