CN103186857A - Bank card payment method and system - Google Patents

Abstract

The application provides a bank card payment method, including a security control receiving bank card information, cardholder identity information and SMS verification code; the security control sends a payment request message to the security control pre-system, and the payment request message includes a bank card information, cardholder identity information, and SMS verification code; the security control front-end system extracts the SMS verification code from the payment request message, and verifies it; after the SMS verification code is verified, the security control front-end system The above bank card information and cardholder information are forwarded to the bank transaction system; the bank transaction system performs identity authentication based on the bank card information and cardholder information forwarded from the security control front-end system; and when the identity authentication is passed, the bank transaction The system authorizes the transaction. The application also provides a bank card payment system.

Description

Bank card payment method and system

technical field

This application relates to the field of financial data processing, in particular to a bank card payment method and system.

Background technique

With the rapid development of the Internet and e-commerce industry, it has become a hot spot in the industry to provide people with all-round services such as clothing, food, housing, transportation, travel, shopping, and entertainment around the Internet. Driven by the advancement of mobile communication technology, mobile e-commerce, which perfectly combines the Internet, mobile communication technology, short-distance communication technology and other information processing technologies, has developed rapidly. Mobile e-commerce refers to B2B, B2C or C2C e-commerce conducted by wireless terminals such as mobile phones, PDAs and handheld computers. It enables people to carry out various business activities at any time and any place, realize online and offline shopping and transactions, online electronic payment and various transaction activities, commercial activities, financial activities and related comprehensive service activities anytime, anywhere.

However, in today's increasingly serious network security threats, the security of the payment link, one of the most important links in mobile e-commerce, is often criticized by people. For example, up to now, the security control used to ensure the security of the payment link cannot be embedded in the WAP browser of the mobile phone. Therefore, when using mobile devices such as mobile phones for shopping, it is difficult to guarantee the same security as online shopping. In addition, before using mobile phones to make payments, mobile banking must be activated or certain hardware media, such as SD cards, must be installed in mobile phones, which limit the development of mobile Internet payment.

In the patent document whose publication number is CN101098371, a financial data processing method is disclosed, which includes the following steps: setting a smart card in a mobile terminal device, the smart card is stored with at least one financial card magnetic track information; the mobile terminal device sends the financial card The magnetic track information and data to be processed are sent to the server; the server forwards the financial card magnetic track information and data to be processed to the corresponding data processing terminal; the data processing terminal completes the processing of relevant data and returns the processing result information. Although this patent application improves the efficiency of financial data processing in mobile payment, its method requires the smart card storing financial card magnetic track information to be set on the mobile terminal device, which reduces the adaptation rate of mobile phones and is not conducive to large-scale promotion and use.

Contents of the invention

One of the purposes of the present application is to provide an improved bank card payment method and system.

According to one aspect of the present application, a bank card payment method is provided, including: the security control receives bank card information, cardholder identity information and SMS verification code; the security control sends a payment request message to the security control front-end system, the The payment request message includes bank card information, cardholder identity information and SMS verification code; the security control front-end system extracts the SMS verification code from the payment request message and verifies it; after the SMS verification code is verified, the security The control front-end system forwards the bank card information and cardholder information to the bank transaction system; the bank transaction system performs identity authentication according to the bank card information and cardholder information forwarded from the security control front-end system; and when the identity After the authentication is passed, the bank transaction system authorizes the transaction.

In the above bank card payment method, the security control is set in the smart mobile terminal.

In the above bank card payment method, the bank card information includes one or more of bank card number, validity period, CVN2 and password.

In the above bank card payment method, the cardholder identity information includes an ID number and/or a mobile phone number.

In the above bank card payment method, it also includes: after the transaction is authorized, the bank transaction system returns the transaction result to the security control front-end system. Afterwards, the security control front-end system returns the transaction result to the security control. Finally, the security control presents the transaction result to the cardholder.

In the above bank card payment method, the SMS verification code is provided to the cardholder by the security control front-end system.

In the above bank card payment method, the security control and the security control front-end system use PKI digital envelope encryption for direct communication.

In the above bank card payment method, the security control front-end system and the bank transaction system are connected by a dedicated line.

According to another aspect of the present application, a bank card payment system is also provided, including: a security control in a mobile smart terminal, a security control front-end system and a bank transaction system, the security control and the security control front-end system Use PKI digital envelope encryption for direct communication and the security control front-end system is connected with the bank transaction system using a dedicated line, wherein: the security control is used to receive bank card information, cardholder identity information and SMS verification code, and send a payment request message to the security control front-end system, the payment request message includes bank card information, cardholder identity information and SMS verification code; the security control front-end system extracts the short message from the payment request message verification code, and verify it; after the SMS verification code is verified, the security control front-end system forwards the bank card information and cardholder information to the bank transaction system; the bank transaction system according to the The bank card information and cardholder information forwarded by the security control front-end system are used for identity authentication; and when the identity authentication is passed, the bank transaction system authorizes the transaction.

Compared with the prior art, the application can effectively solve the payment bottleneck of the mobile Internet, and realize a safe, convenient, unopened and easy-to-promote payment method.

Description of drawings

Fig. 1 is a schematic diagram of a bank card payment system according to an embodiment of the present application;

Fig. 2 is a schematic diagram of a bank card payment method according to an embodiment of the present application.

Detailed ways

The following introduces some of the possible embodiments of the present invention, which are intended to provide a basic understanding of the present invention, but are not intended to identify key or decisive elements of the present invention or limit the scope of protection. It is easy to understand that, according to the technical solution of the present invention, those skilled in the art may propose other alternative implementation manners without changing the essence and spirit of the present invention. Therefore, the following specific embodiments and drawings are only exemplary descriptions of the technical solution of the present invention, and should not be regarded as the entirety of the present invention or as a limitation or restriction on the technical solution of the present invention.

This application proposes a verification element information based on bank card number, mobile phone number, SMS verification code, validity period, CVN (Card Verification Number, card confirmation code/security code), password, etc., to achieve security, low threshold, high efficiency, and no need to Open and easy-to-promote payment mode, and fully support mobile payment, IVR (Interactive Voice Response, Interactive Voice Response) voice payment, TV payment and other all-round and integrated mobile Internet payments.

Fig. 1 is a schematic diagram of a bank card payment system according to an embodiment of the present application. As shown in FIG. 1 , the bank card payment system includes a security control 120 in a smart mobile terminal 110 , a security control front-end system 130 and a bank transaction system 140 . Moreover, it can also be seen from FIG. 1 that the security control front-end system 130 and the bank transaction system 140 move outside the smart terminal 110 . The security control 120 communicates directly with the security control front-end system 130 without going through any third-party system.

In a specific implementation, the security control 120 is installed in the smart mobile terminal 110 . After the user selects an item to be purchased in a merchant (such as JD.com), the security control 120 in the mobile smart terminal 110 is activated. The security control 120 may be activated by a merchant program, the user itself, or the like. The PKI (Public Key Infrastructure, public key infrastructure) digital envelope encryption technology is used between the security control 120 and the security control front-end system 130 to realize the secure transmission of payment information, thereby effectively preventing transaction risks such as interception, tampering, repudiation, and phishing. The digital envelope is an application of PKI in practice, which uses encryption technology to ensure that only specified recipients can read the content of the communication. In the digital envelope, the information sender uses a symmetric key to encrypt the content of the information, and then encrypts the symmetric key with the receiver's public key (this part is called a digital envelope), and sends it together with the encrypted information to the recipient. The recipient first uses the corresponding private key to open the digital envelope to obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted information. In this way, the authenticity and integrity of data transmission are guaranteed. Similarly, in order to ensure the security of information transmission, a dedicated line connection can be used between the security control front-end system 130 and the bank transaction system 140 .

In this application, the security control 120 is responsible for collecting and encrypting cardholder identity information and payment information. The security control front-end system 130 is responsible for transaction transfer, security control management, merchant management and system security control, and verifies the validity of the mobile phone number by verifying the SMS verification code. The bank transaction system 140 is responsible for cardholder identity authentication and transaction authorization. Specifically, the security control 120 is used to receive bank card information, cardholder identity information and SMS verification code, and send a payment request message to the security control front-end system 130, and the payment request message includes bank card information, cardholder Identity information and SMS verification code. The security control front-end system 130 extracts the SMS verification code from the payment request message, and verifies it. After the SMS verification code is verified, the security control front-end system 130 forwards the bank card information and cardholder information to the bank transaction system 140 . The bank transaction system 140 performs identity authentication according to the bank card information and cardholder information forwarded from the security control front-end system 130; and when the identity authentication is passed, the bank transaction system 140 performs transaction authorization.

In a specific implementation, the security control front-end system 130 implements the above-mentioned "security control management" through the following steps:

1. Before the security control 120 sends a payment request message to the security control front-end system 130, the security control 120 first sends identification information including its merchant ID, security control version number, and developer ID to the security control front-end system 130;

2. The security control front-end system 130 verifies the identification information;

3. If the verification is passed, allow the security control 120 to send the payment request message; otherwise, deny the security control 120 to send the payment request message.

In a specific implementation, the security control front-end system 130 implements the above-mentioned "merchant management" through the following steps:

1. In the list of merchants stored in the security control front-end system, a certain merchant is listed as unwelcome;

2. Determine the security controls associated with the merchant;

3. The security control front-end system shields all transactions with the security control.

Fig. 2 is a schematic diagram of a bank card payment method according to an embodiment of the present application.

In step S210 , the cardholder 210 inputs bank card information and cardholder identity information to the security control 220 . It can be understood that the bank card information may include one or more of bank card number, expiration date, CVN2 and password, and the cardholder's identity information may include ID card number and/or mobile phone number.

Next, in step S220 , the cardholder 210 obtains the SMS verification code from the security control front-end system 230 . Those skilled in the art can understand that the short message verification code can take various forms, such as numbers, letters, text, voice, etc. or a combination thereof. In addition, there can be multiple ways to trigger the security control front-end system 230 to provide the SMS verification code to the cardholder 210. For example, the cardholder 210 directly sends a short message to the security control front-end system 230 to request a SMS verification code, or The security control 220 forwards the cardholder information to the security control front-end system 230 , thereby triggering the security control front-end system 230 to provide the cardholder 210 with an SMS verification code.

In step 230 , the cardholder 210 enters the SMS verification code into the security control 220 . Moreover, in step 240 , the security control 220 submits a payment request to the security control front-end system 230 . The payment request message includes bank card information, cardholder identity information and SMS verification code provided by the cardholder 210 to the security control 220 . In a preferred implementation manner, the security control 220 uses the PKI digital envelope encryption technology to submit the payment request to the security control front-end system 230 . Before the security control 220 sends a payment request to the security control front-end system 230, it uses a symmetric key to encrypt bank card information, cardholder identity information, and SMS verification codes. Next, it encrypts this symmetric key with the public key of the security control front-end system 230 . Subsequently, the encrypted symmetric key and the encrypted information are sent to the security control front-end system 230 together. The security control front-end system 230 uses the private key to decrypt to obtain a symmetric key, and then uses the symmetric key to decrypt to obtain bank card information, cardholder identity information, and SMS verification codes. In this way, this method can effectively prevent transaction risks such as information interception, tampering, repudiation, and phishing.

In step S250, the security control front-end system 230 verifies the SMS verification code. After the verification is passed, in step S260, the security control front-end system 230 forwards the transaction information (including bank card information, cardholder identity information, etc.) to the bank transaction system 240 . As shown in step S270, the bank transaction system 240 performs verification, and authorizes the transaction after the verification is passed. Finally, in steps S280 , S290 and S300 , the transaction result is returned to the security control front-end system 230 , the security control 220 and the cardholder 210 in sequence.

So far, the introduction of the bank card payment method according to an embodiment of the present application is completed. This payment method can realize a safe, low-threshold, high-efficiency, non-opening, and easy-to-promote payment mode, and can be used for all-round and integrated mobile Internet payments such as mobile phone payment, IVR voice payment, and TV payment.

In order to make the content contained in this application clearer, the following takes the UnionPay mobile online payment product as an example to give the process of realizing secure payment on smart phones:

1. The cardholder enters the bank card number, validity period (credit card), CVN2 (credit card), password (debit card) and mobile phone number on the UnionPay mobile online payment plug-in;

2. The cardholder obtains the SMS verification code from the front-end system, and enters the SMS verification code on the UnionPay mobile online payment plug-in;

3. The cardholder submits a payment request on the UnionPay mobile online payment plug-in;

4. The UnionPay mobile online payment front-end system verifies the validity of the mobile phone number by verifying the SMS verification code;

5. The UnionPay mobile online payment front-end system forwards the transaction to the UnionPay card-free payment channel, and the card-free payment channel forwards the transaction information to the issuing bank;

6. The issuing bank verifies whether there is a binding relationship between the bank card number and the mobile phone number, and then verifies whether the validity period, CVN2, and password are correct after the verification is passed, and accepts the transaction after all verifications are passed;

7. The card issuing bank returns the transaction result to the UnionPay mobile online payment front-end system;

8. The UnionPay mobile online payment front-end system returns the transaction result to the UnionPay mobile online payment plug-in;

9. The UnionPay mobile online payment plug-in displays the payment result.

In the above implementation, the UnionPay mobile online payment product uses the UnionPay card-free channel, combines payment verification elements and UnionPay security certification, and is embedded in the merchant's client product in the form of a security plug-in, providing users with a mobile phone that does not need to open, use Bank cards are the means of completing secure payments.

The above examples mainly illustrate the implementation of the bank card payment method and system of the present application. Although only some specific embodiments have been described, those skilled in the art should understand that the present invention can be implemented in many other forms without departing from the spirit and scope thereof. For example, the method of the present application can be implemented in various ways—hardware, software, or a combination of software and hardware.

To sum up, this application proposes a method for processing financial data, including: the security control receives bank card information, cardholder identity information, and SMS verification code to wait for data information to be processed; the security control sends a request message to the security control front-end system , the request message includes bank card information, cardholder identity information and SMS verification code waiting to process data information; the safety control front-end system extracts the SMS verification code from the request message, and verifies it; After the code verification is passed, the security control front-end system forwards the bank card information and cardholder information to the bank transaction system; the bank transaction system proceeds according to the bank card information and cardholder information forwarded from the security control front-end system data processing.

In the above financial data processing method, the security control is set in the smart mobile terminal.

In the above financial data processing method, the bank card information includes one or more of bank card number, validity period, CVN2 and password.

In the above financial data processing method, the cardholder identity information includes an ID card number and/or a mobile phone number.

In the above financial data processing method, after the data processing, the bank transaction system returns the processing result to the security control front-end system.

In the above financial data processing method, after the bank transaction system returns the processing result to the security control front-end system, the security control front-end system returns the processing result to the security control.

In the above financial data processing method, after the security control front-end system returns the processing result to the security control, the security control displays the processing result to the cardholder.

In the above financial data processing method, the SMS verification code is provided to the cardholder by the security control front-end system.

In the above financial data processing method, the security control and the security control front-end system adopt PKI digital envelope encryption for direct communication.

In the above financial data processing method, the security control front-end system and the bank transaction system are connected by a dedicated line.

The examples and implementations shown above are regarded as illustrative rather than restrictive, and the present application may cover various modifications and substitutions without departing from the spirit and scope defined in the claims.

Claims (19)

1. a bank card method of payment is characterized in that, comprising:

Safe control receives bank card information, holder's identity information and short-message verification sign indicating number;

Safe control sends payment request message to safe control front-end system, and described payment request message contains bank's card information, holder's identity information and short-message verification sign indicating number;

Safe control front-end system extracts the short-message verification sign indicating number from described payment request message, and it is verified;

After the checking of short-message verification sign indicating number was passed through, safe control front-end system was transmitted to bank transaction system with described bank card information and cardholder information;

Bank transaction system carries out authentication according to bank card information and the cardholder information transmitted from safe control front-end system; And

After authentication was passed through, bank transaction system carried out Trading Authorization.

2. bank card method of payment as claimed in claim 1, wherein, described safe control is arranged in the mobile intelligent terminal.

3. bank card method of payment as claimed in claim 1, wherein, described bank card information comprises one or more in bank card number, the term of validity, CVN2 and the password.

4. bank card method of payment as claimed in claim 1, wherein, described holder's identity information comprises identification card number and/or cell-phone number.

5. bank card method of payment as claimed in claim 1 wherein, also comprises:

After carrying out Trading Authorization, bank transaction system returns to safe control front-end system with transaction results.

6. bank card method of payment as claimed in claim 5 wherein, also comprises:

After bank transaction system returned to transaction results safe control front-end system, safe control front-end system returned to safe control with transaction results.

7. bank card method of payment as claimed in claim 6 wherein, also comprises:

After safe control front-end system returned to safe control with transaction results, safe control was showed transaction results to the holder.

8. bank card method of payment as claimed in claim 1, wherein, described short-message verification sign indicating number offers the holder by safe control front-end system.

9. bank card method of payment as claimed in claim 1, wherein, safe control and safe control front-end system adopt the PKI digital envelope to encrypt to carry out direct communication, and safe control front-end system manages safe control.

10. bank card method of payment as claimed in claim 1, wherein, safe control front-end system adopts special line to be connected with bank transaction system.

11. bank card paying system, it is characterized in that, comprise: the safe control in the mobile intelligent terminal, safe control front-end system and bank transaction system, described safe control adopts the PKI digital envelope to encrypt to carry out direct communication with described safe control front-end system and described safe control front-end system adopts special line to be connected with described bank transaction system, wherein:

Described safe control is used for receiving bank card information, holder's identity information and short-message verification sign indicating number, and to safe control front-end system transmission payment request message, described payment request message contains bank's card information, holder's identity information and short-message verification sign indicating number;

Described safe control front-end system extracts the short-message verification sign indicating number from described payment request message, and it is verified; After the checking of short-message verification sign indicating number was passed through, described safe control front-end system was transmitted to described bank transaction system with described bank card information and cardholder information;

Described bank transaction system carries out authentication according to bank card information and the cardholder information transmitted from safe control front-end system; And after authentication was passed through, described bank transaction system carried out Trading Authorization.

12. bank card paying system as claimed in claim 11, wherein, described bank card information comprises one or more in bank card number, the term of validity, CVN2 and the password.

13. bank card paying system as claimed in claim 11, wherein, described holder's identity information comprises identification card number and/or cell-phone number.

14. bank card paying system as claimed in claim 11, wherein, after carrying out Trading Authorization, described bank transaction system returns to described safe control front-end system with transaction results.

15. bank card paying system as claimed in claim 14, wherein, after described bank transaction system returned to transaction results described safe control front-end system, described safe control front-end system returned to described safe control with transaction results.

16. bank card paying system as claimed in claim 15, wherein, after described safe control front-end system returned to transaction results described safe control, described safe control was showed transaction results to the holder.

17. bank card paying system as claimed in claim 11, wherein, described short-message verification sign indicating number offers the holder by described safe control front-end system.

18. safe control front-end system carries out the method that trade company manages in the bank card paying system, comprising:

In trade company's tabulation of storing in safe control front-end system, a certain trade company is listed in and is out of favour;

Determine the safe control related with this trade company;

All transaction of safe control front-end system shielding and this safe control.

19. safe control front-end system carries out the method for trade company's management in the bank card paying system as claimed in claim 18, also comprises: after mask steps, safe control front-end system upgrades its trade company's tabulation.

Images