CN115994760A - Method and device for realizing third-party payment service - Google Patents

Abstract

The embodiment of this specification provides a method and device for implementing a third-party payment service. The method implemented in the merchant server includes: receiving the order request sent by the merchant client; obtaining the currently available challenge question; determining the response content corresponding to the currently available challenge question; wherein, the challenge question and its corresponding The content of the response is shared by the third-party payment server and the merchant server; a payment request carrying the content of the response is generated; the private key of the merchant is used to sign the payment request carrying the content of the response, and then the signed payment request is sent to To the third party payment server. The embodiment of this specification can improve the security of the third-party payment service.

Description

Method and device for realizing third-party payment service

technical field

One or more embodiments of this specification relate to network information technology, and in particular to methods and devices for implementing third-party payment services.

Background technique

Third-party payment refers to a network payment mode in which a third-party payment server with certain strength and reputation guarantee acts as a third party other than the two parties to the transaction, and facilitates the transaction between the two parties through docking with UnionPay or NetsUnion.

In the third-party payment business, in order to improve security, the mutual trust mechanism between the third-party payment server and the merchant relies on an asymmetric encryption algorithm. Specifically, the data sender of the two, such as the merchant, needs to use its own private key to sign the service request For example, the merchant needs to use its own private key to sign the payment request, and the receiver, such as the payment service provider platform, should use the other party's public key to verify the signature to authenticate the identities of both parties. However, at present, the private key is often leaked, which greatly reduces the security of the third-party payment service. For example, the attacker steals the private key of the merchant and pretends to be a legitimate merchant server to send forged business information to the third-party payment server. Requests (such as transfers, refunds, downloading bills, etc.), and ultimately cause financial losses and privacy leaks for merchants and their end users.

Contents of the invention

One or more embodiments of this specification describe a method and device for implementing a third-party payment service, which can improve the security of the third-party payment service.

According to the first aspect, a method for implementing a third-party payment service is provided, wherein the method is applied to a merchant server, including: receiving an order request from a merchant client;

Get currently available challenge questions;

Determining the response content corresponding to the currently available challenge question; wherein, the challenge question and its corresponding response content are shared by the third-party payment server and the merchant server;

Generate a payment request carrying the content of the response;

Use the private key of the merchant to sign the payment request carrying the response content, and then send the signed payment request to the third-party payment server.

Among them, the currently available challenge questions include:

The challenge question carried in the information sent last time by the third-party payment server to the merchant server is determined as the currently available challenge question.

Wherein, after sending the signed payment request to the third-party payment server, further include:

Receive the back-end payment notification carrying the challenge question sent by the third-party payment server; obtain the next available challenge question from the back-end payment notification;

Determine the response to the challenge question that should be available next;

Generate a service information request carrying the content of the response;

Use the private key of the merchant to sign the service information request carrying the response content, and then send the signed service information request to the third-party payment server.

Wherein, the order request is an order request in the N+1th transaction corresponding to the merchant server processed by the third-party payment server; wherein, N is a positive integer;

The challenge question and its corresponding response content include: information in the first N transactions processed by the third-party payment server and corresponding to the merchant server.

Wherein, the challenge question includes: the external order number of the first transaction; wherein, the first transaction is one of the first N transactions processed by the third-party payment server and corresponding to the merchant server; the external order number is an order number generated by the third-party payment server for the first transaction;

Correspondingly, the response content corresponding to the challenge question includes: an internal order number of the first transaction; wherein, the internal order number is an order number generated by the merchant server for the first transaction.

Wherein, in each transaction processed by the third-party payment server and corresponding to the merchant server, the IP address used by the merchant server is a dynamic IP address;

The challenge question includes: a question about the IP address used by the merchant server in the second transaction; wherein, the second transaction is one of the first N transactions processed by the third-party payment server and corresponding to the merchant server transaction;

Correspondingly, the response content corresponding to the challenge question includes: the IP address used by the merchant server in the second transaction.

According to the second aspect, a method for implementing a third-party payment service is provided, wherein the method is applied to a third-party payment server, including:

Receive the payment request from the merchant server;

Use the merchant's public key to verify the signature of the payment request;

After the signature verification is successful, get the response content from the payment request;

Determine the currently available challenge question corresponding to the answer content; wherein, the challenge question and its corresponding answer content are only shared by the third-party payment server and the merchant server;

Validate the content of the response using the identified challenge questions;

If the verification of the response content is successful, payment processing is performed.

Wherein, the determination of currently available challenge questions corresponding to the answer content includes:

The challenge question carried in the last information sent by the third-party payment server to the merchant server is determined as the currently available challenge question corresponding to the response content.

Wherein, the performing payment processing includes: the third-party payment server sends a back-end payment notification carrying a challenge question to the merchant server;

After said payment processing, further include:

Receive business information requests from merchant servers;

Use the merchant's public key to verify the signature of the business information request;

After the signature verification is successful, get the response content from the business information request;

Verify the response content obtained from the business information request by using the challenge question carried in the back-end payment notification, and provide the business service requested by the business information request to the merchant server after the verification of the response content is successful.

Wherein, the payment request is a payment request in the N+1th transaction corresponding to the merchant server processed by the third-party payment server; where N is a positive integer;

The challenge question and its corresponding response content include: information in the first N transactions processed by the third-party payment server and corresponding to the merchant server.

Wherein, the challenge question includes: the external order number of the first transaction; wherein, the first transaction is one of the first N transactions processed by the third-party payment server and corresponding to the merchant server; the external order number is an order number generated by the third-party payment server for the first transaction;

Correspondingly, the response content corresponding to the challenge question includes: an internal order number of the first transaction; wherein, the internal order number is an order number generated by the merchant server for the first transaction.

Wherein, in each transaction processed by the third-party payment server and corresponding to the merchant server, the IP address used by the merchant server is a dynamic IP address;

The challenge question includes: a question about the IP address used by the merchant server in the second transaction; wherein, the second transaction is one of the first N transactions processed by the third-party payment server and corresponding to the merchant server transaction;

Correspondingly, the response content corresponding to the challenge question includes: the IP address used by the merchant server in the second transaction.

According to a third aspect, there is provided a device for implementing a third-party payment service, wherein the device is applied to a merchant server, and includes: an order request receiving module configured to receive an order request sent by a merchant client;

a challenge question determination module configured to obtain currently available challenge questions;

The response content determination module is configured to determine the response content corresponding to the currently available challenge question; wherein, the challenge question and its corresponding response content are shared by the third-party payment server and the merchant server;

The payment request processing module is configured to generate a payment request carrying the response content; use the merchant's private key to sign the payment request carrying the response content, and then send the signed payment request to a third-party payment server.

According to the fourth aspect, there is provided a device for implementing a third-party payment service, wherein the device is applied to a third-party payment server, including:

The payment request receiving module is configured to receive the payment request sent by the merchant server;

The signature verification module is configured to use the merchant's public key to perform signature verification on the payment request;

The response content acquisition module is configured to obtain the response content from the payment request after the signature verification is successful;

The challenge question obtaining module is configured to determine the currently available challenge question corresponding to the answer content; wherein, the challenge question and its corresponding answer content are only shared by the third-party payment server and the merchant server;

The challenge and response verification module is configured to use the determined challenge question to verify the content of the response;

The payment processing module is configured to perform payment processing if the challenge and response verification module successfully verifies the response content.

According to a fifth aspect, there is provided a computing device, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method described in any embodiment of this specification is implemented. method.

The methods and devices for implementing third-party payment services provided by the various embodiments of this specification, individually or in combination, at least have the following beneficial effects:

1. In the embodiment of this specification, the challenge question and its corresponding response content are shared between the merchant server and the third-party payment server, that is to say, the attacker cannot obtain the challenge question and/or the corresponding answer to the challenge question. content of the response. Therefore, the embodiment of this specification utilizes the information difference between the attacker and the normal merchant to enhance the security of the third-party payment server for the authentication service of the merchant. The third-party payment service greatly improves the security of the third-party payment service.

2. In the embodiment of this specification, the third-party payment service is authenticated from two different dimensions. One dimension is the signature verification based on the public and private keys, and the other dimension is the verification based on the challenge/response mechanism. Therefore, greatly The security of the third-party payment service is improved.

3. In the embodiment of this specification, the information in the historical transactions of the merchant server processed by the third-party payment server can be used to generate challenge questions and response content. On the one hand, it can ensure that the third-party payment server and the merchant server can share the challenge questions and answer content, on the other hand, it can ensure that it is difficult or even impossible for the attacker to obtain the challenge question and answer content.

4. In the embodiment of this specification, use the mapping relationship between the external order number and the internal order number in a transaction to generate a pair of challenge questions and answer content, or use the dynamic IP address used by the merchant server in a transaction Address to generate a pair of challenge questions and answer content, which is more in line with the characteristics of the tripartite payment agreement itself, and is easy to implement.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are For some embodiments of this specification, those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic diagram of a system architecture applied by an embodiment of the present specification.

Fig. 2 is a flowchart of a method for implementing a third-party payment service applied to a merchant server in an embodiment of this specification.

Fig. 3 is a flow chart of a method for implementing a third-party payment service applied to a third-party payment server in an embodiment of this specification.

Fig. 4 is a flow chart of a method for implementing a third-party payment service in an embodiment of this specification.

Fig. 5 is a schematic structural diagram of a device for realizing a third-party payment service applied to a merchant server in an embodiment of this specification.

Fig. 6 is a schematic structural diagram of a device for implementing a third-party payment service applied to a third-party payment server in an embodiment of this specification.

Detailed ways

The solutions provided in this specification will be described below in conjunction with the accompanying drawings.

First of all, it should be noted that the terminology used in the embodiments of the present invention is only for the purpose of describing specific embodiments, rather than limiting the present invention. As used in the embodiments of the present invention and the appended claims, the singular forms "a", "said" and "the" are also intended to include the plural forms unless the context clearly indicates otherwise.

It should be understood that the term "and/or" used herein is only an association relationship describing associated objects, which means that there may be three relationships, for example, A and/or B, which may mean that A exists alone, and A and B exist simultaneously. B, there are three situations of B alone. In addition, the character "/" in this article generally indicates that the contextual objects are an "or" relationship.

Depending on the context, the word "if" as used herein may be interpreted as "at" or "when" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrases "if determined" or "if detected (the stated condition or event)" could be interpreted as "when determined" or "in response to the determination" or "when detected (the stated condition or event) )" or "in response to detection of (stated condition or event)".

In order to facilitate the understanding of the methods provided in this specification, the system architecture involved and applicable in this specification is described first. As shown in Figure 1, the system architecture mainly includes four network nodes: merchant client (corresponding to the merchant App in Figure 1), merchant server, and third-party payment platform application (corresponding to the platform App in Figure 1) , Third-party payment server.

The method, device and system for realizing the third-party payment service proposed in the embodiments of this specification can be applied to various transaction scenarios using the third-party payment protocol. For example, business scenario 1: the merchant is a supermarket, and users need to use "Alipay" to pay when shopping in the supermarket. Therefore, see Figure 1, the merchant App can be the supermarket's app installed on the sales terminal (ie POS machine). The sales application program and the merchant server can be the server of the supermarket, the platform app can be the "Alipay" application program, and the third-party payment server can be the "Alipay" server. For another example, business scenario 2: The merchant is a merchant registered on an online shopping website. Users need to use "Alipay" to pay for the merchant's products on the shopping website. Therefore, as shown in Figure 1, the merchant App can be the The vending application program and merchant server of the online shopping website can be the server of the online shopping website, the platform App can be the application program of "Alipay", and the third-party payment server can be the server of "Alipay".

It should be understood that the numbers of merchant Apps, merchant servers, platform Apps and third-party payment servers in FIG. 1 are only illustrative. Any number can be selected and arranged according to implementation requirements.

In the embodiment of this specification, the processing methods in the merchant server and the third-party payment server are mainly modified, so different embodiments are described below.

Fig. 2 is a flowchart of a method for implementing a third-party payment service applied to a merchant server in an embodiment of this specification. It can be understood that the method can also be executed by any device, device, platform, or device cluster that has computing and processing capabilities. Referring to Figure 2, the method includes:

Step 201: The merchant server receives an order request from the merchant client.

Step 203: The merchant server obtains currently available challenge questions.

Step 205: The merchant server determines the response content corresponding to the currently available challenge question; wherein, the challenge question and its corresponding response content are only shared by the third-party payment server and the merchant server.

Step 207: The merchant server generates a payment request carrying the response content.

Step 209: The merchant server uses the merchant's private key to sign the payment request carrying the response content, and then sends the signed payment request to the third-party payment server.

Fig. 3 is a flow chart of a method for implementing a third-party payment service applied to a third-party payment server in an embodiment of this specification. It can be understood that the method can also be executed by any device, device, platform, or device cluster that has computing and processing capabilities. Referring to Figure 3, the method includes:

Step 301: The third-party payment server receives the payment request from the merchant server.

Step 303: The third-party payment server uses the merchant's public key to verify the signature of the payment request.

Step 305: After the signature verification of the third-party payment server is successful, the response content is obtained from the payment request.

Step 307: The third-party payment server determines currently available challenge questions corresponding to the answer content; wherein, the challenge questions and corresponding answer content are only shared by the third-party payment server and the merchant server.

Step 309: The third-party payment server uses the determined challenge question to verify the content of the response.

Step 311: If the third-party payment server successfully verifies the response content, it will perform payment processing.

According to the method of the embodiment of this specification shown in Fig. 2 and Fig. 3 above, it can be obtained that in the realization of the third-party payment service, the current third-party payment agreement process is transformed through the challenge/response mode, and the merchant server sends the third-party When the third-party payment server sends a request, it will carry the response content corresponding to the challenge question sent by the third-party payment server in the request, and the challenge question and its corresponding response content are only shared between the merchant server and the third-party payment server. In other words, the attacker cannot obtain the challenge question and/or the answer content corresponding to the challenge question. Therefore, the embodiment of this specification utilizes the information difference between the attacker and the normal merchant to enhance the security of the third-party payment server for the authentication service of the merchant. The third-party payment service greatly improves the security of the third-party payment service.

The methods shown in FIG. 2 and FIG. 3 will be described in detail below in conjunction with specific embodiments.

First, step 201 is executed: the merchant server receives an order request from the merchant client.

Here, if a purchase instruction for a product is input on the merchant client, the merchant server will receive an order request from the merchant client.

Next, step 203 is executed: the merchant server obtains currently available challenge questions.

In an embodiment of this specification, each time the third-party payment server sends a message to the merchant server, it will carry a challenge question; every time the merchant server sends a message to the third-party payment server, it will carry a response content. In this way, in a round of interaction from the third-party payment server to the merchant server and then from the merchant server to the third-party payment server, the interaction of a pair of challenge questions and answer content can be completed, so that verification based on the challenge/response mechanism can be realized.

A challenge question corresponds to an answer content. In each round of interaction between the third-party payment server and the merchant server, preferably, the challenge question used in one round of interaction and its corresponding answer content are the same as the challenge question used in other rounds of interaction and its corresponding answer content Are not the same. Of course, even if the challenge questions used in each round and the corresponding answer content are the same, the method in the embodiment of this specification can also be implemented.

Therefore, in this step 203, the merchant server may determine the challenge question carried in the last information sent by the third-party payment server to the merchant server as the currently available challenge question, which is denoted as challenge question 1 for ease of description. Wherein, the information may be a message or data or the like.

Next, step 205 is executed: the merchant server determines the answer content 1 corresponding to the currently available challenge question 1; wherein, the challenge question 1 and the corresponding answer content 1 are only shared by the third-party payment server and the merchant server.

The specific content of the challenge questions and the specific content of the responses is an important factor of security. In the embodiment of this specification, the content of each challenge question can be specified by the third-party payment server, which has a certain degree of unpredictability. Usually, although the attacker can steal the merchant's private key, they cannot break through the merchant's server, that is to say, the attacker cannot obtain the merchant's context in the three-party payment agreement, such as historical transaction information. Therefore, in one embodiment of this specification, the third-party payment server can trust the previous M transactions of the merchant server, and in the first M transactions, the third-party payment server and the merchant server do not need to perform verification based on the challenge question and the response content. , there may be no challenge/response requirement in the corresponding request and response; however, the response sent by the third-party payment server to the merchant server in the Mth transaction will contain a challenge question, which needs to be carried in the next request sent by the merchant server Responses to the challenge questions. In each transaction starting from the M+1th transaction, the third-party payment server can use the relevant information in the previous historical transactions of the merchant server as a challenge question, and correspondingly, the content of the answer to the challenge question is also a historical transaction related information in . M is a positive integer, and the value of M can be set according to the needs of the business, such as the security level. The higher the security level, the smaller the value of M.

Assume that the order request in step 201 above is the order request in the N+1th transaction of the corresponding merchant server processed by the third-party payment server; then the challenge question 1 in step 203 and the response content 1 in step 205 can be Including: information in the first N transactions processed by the third-party payment server and corresponding to the merchant server, such as information in the first transaction and so on. Wherein, N is a positive integer.

As mentioned above, the specific content of each pair of challenge questions and the specific content of the response can be the information in the historical transactions of the merchant server processed by the third-party payment server, and the specific implementation can include the following two methods:

Method 1. Use the external order number and internal order number in a previous transaction as the challenge question and the corresponding answer content respectively.

In the first method, the challenge question includes: the external order number of the first transaction; wherein, the first transaction is one of the first N transactions processed by the third-party payment server and corresponding to the merchant server; The order number is an order number generated by the third-party payment server for the first transaction;

Correspondingly, the response content corresponding to the challenge question includes: an internal order number of the first transaction; wherein, the internal order number is an order number generated by the merchant server for the first transaction.

In the three-party payment protocol, for each transaction, the merchant server will generate an internal order number, and the third-party payment server will generate an external order number. The two order numbers point to the same transaction and have a mapping relationship. The attacker cannot obtain the two order numbers, but the merchant server and the third-party payment server can share the two order numbers, and the two order numbers can be used as a hidden knowledge shared by the third-party payment server and the merchant server. Therefore, based on this characteristic, in the first method, the mapping relationship existing in such historical transactions is used to obtain the challenge question and the answer content.

Method 2: Use the dynamic IP address used by the merchant's server to obtain the challenge question and the corresponding response content.

In the second method, considering that the merchant's server is usually deployed in the cloud, the IP address used by the merchant's server is a dynamic value, so it can be used as a hidden knowledge shared by the third-party payment server and the merchant's server, that is, using this dynamic IP to get the challenge Questions and answers.

Specifically, in the second method, in each transaction processed by the third-party payment server and corresponding to the merchant server, the IP address used by the merchant server is a dynamic IP address;

The challenge question includes: a question about the IP address used by the merchant server in the second transaction; wherein, the second transaction is one of the first N transactions processed by the third-party payment server and corresponding to the merchant server transaction;

Correspondingly, the response content corresponding to the challenge question includes: the IP address used by the merchant server in the second transaction.

Next, for steps 207 to 209: the merchant server generates a payment request carrying the response content 1, signs the payment request carrying the response content 1 with the merchant’s private key, and then sends the signed payment request to the first Three-party payment server.

Next, the above steps 301 to 311 are executed. Referring to the above description of steps 201 to 209, correspondingly, in steps 301 to 311, the challenge question is challenge question 1, the answer content is answer content 1, and the specific implementation process of step 307 includes: the third party The challenge question 1 carried in the last message sent by the payment server to the merchant server is determined to be the currently available challenge question corresponding to the response content.

In step 311, the payment processing performed by the third-party payment server includes: the third-party payment server sends a back-end payment notification carrying a challenge question to the merchant server.

Next, the merchant server receives the back-end payment notification carrying the challenge question sent by the third-party payment server; the next available challenge question is obtained from the back-end payment notification, and the merchant server can determine the next available challenge question. The answer to the question. For example, the next available challenge question (referred to as challenge question 2 for ease of description) can be the external order number in the second transaction generated by the third-party payment server, corresponding to the answer content of the next available challenge question ( For the convenience of description, it is called the response content 2) It can be the internal order number in the second transaction generated by the merchant server.

Next, if the merchant server needs to obtain corresponding business services from the third-party payment server, such as business services such as transfer, refund, and bill download, the merchant server performs the following steps: the merchant server generates a business information request with response content 2; The merchant server uses the merchant's private key to sign the service information request carrying the response content, and then sends the signed service information request to the third-party payment server.

Correspondingly, if the third-party payment server receives the business information request, then the third-party payment server performs the following steps: the third-party payment server uses the merchant's public key to perform signature verification on the business information request; Get the response content 2 in the request; use the challenge question 2 carried in the back-end payment notification to verify the response content 2 obtained from the business information request, that is, verify whether the two are in the same transaction with a mapping relationship After the verification is successful, provide the business service requested by the business information request to the merchant server, such as realizing the transfer to the merchant server, refund, downloading bills and other services.

In the embodiment of this specification, the interaction process and challenge/response processing operations are added to the three-party payment protocol, which can be realized through the back-end SDK (: Software Development Kit) of the third-party payment server , so the cost of access transformation for merchants is relatively low.

In the following, the flow chart of the method for implementing the third-party payment service in an embodiment of this specification will be described through the cooperation of all parties in the system for implementing the third-party payment service shown in FIG. 1 . Referring to Fig. 1, Fig. 4, this method comprises:

Step 401: The merchant App sends an order request for a transaction to the merchant server. For example, the order request is an order request for the 100th transaction of the merchant server.

Step 403: For the challenge question 1 carried in the last response message sent by the third-party payment server, the merchant server obtains the response content 1 corresponding to the challenge question 1.

For example, the content of challenge question 1 carried in the response message sent last time is: the external order number in the second transaction in history. Then, in step 403, the response content 1 obtained by the merchant server is: the internal order number in the second transaction in history.

Step 405: The merchant's server generates the internal order number of this transaction and saves it, and carries the obtained response content 1 in the payment request, and uses the merchant's private key to sign the payment request.

Step 407: The merchant server sends the signed payment request to the merchant App.

Step 409: The merchant App sends the received payment request to the platform App.

Step 411: The platform App sends the received payment request to the third-party payment server.

Step 413: The third-party payment server uses the merchant's public key to verify the signature of the payment request. If the signature verification is successful, it uses the last challenge question 1 sent to the merchant server to verify the response content 1 in the payment request.

Step 415: After the verification of response content 1 is successful, the third-party payment server sends a front-end payment notification to the platform App.

Step 417: The third-party payment server carries the next challenge question 2 and the external order number corresponding to this transaction in the back-end payment notification, and signs the back-end payment notification with the private key of the third-party payment server sent to the merchant server.

Step 419: The merchant server uses the public key of the third-party payment server to verify the signature of the back-end payment notification. After the verification is successful, change the status of the order, store the external order number and save the challenge question 2.

Step 421: The platform App returns the front-end payment notification to the merchant App.

Step 423: The merchant App sends a request for querying order status to the merchant server.

Step 425: The merchant server returns the status information of the order to the merchant App.

Step 427: When the merchant server needs a business service, the merchant server generates a business information request requesting the service, carries the response content 2 corresponding to the challenge question 2 sent by the third-party payment server last time in the business information request, and Use the merchant's private key to request a signature for the business information.

Step 429: The merchant server sends the signed service information request to the third-party payment server.

Step 431: The third-party payment server uses the public key corresponding to the merchant to verify the signature of the received business information request. After the verification is successful, it uses the challenge question 2 sent last time to verify the response content 2 carried in the business information request.

Step 433: After the verification of the response content 2 is successful, the third-party payment server sends a business response to the merchant server, provides the requested business service to the merchant server through the business response, and carries the next challenge question 3 in the business response.

In one embodiment of this specification, a device for implementing a third-party payment service is provided, wherein the device is applied to a merchant server, see Figure 5, the device includes:

The order request receiving module 501 is configured to receive the order request sent by the merchant client;

A challenge question determination module 502 configured to obtain currently available challenge questions;

The answer content determination module 503 is configured to determine the answer content corresponding to the currently available challenge question; wherein, the challenge question and its corresponding answer content are shared by the third-party payment server and the merchant server;

The payment request processing module 504 is configured to generate a payment request carrying the response content; use the private key of the merchant to sign the payment request carrying the response content, and then send the signed payment request to a third-party payment server.

In an embodiment of the device of this specification shown in FIG. 5 , the challenge question determination module 502 is configured to determine the challenge question carried in the information sent by the third-party payment server to the merchant server last time as the current Available challenge questions.

In an embodiment of the device of this specification shown in FIG. 5 , it may further include: a business service request module (not shown in FIG. 5 );

A business service request module, configured to execute:

receiving the back-end payment notification carrying the next challenge question sent by the third-party payment server; obtaining the next available challenge question from the back-end payment notification;

Determine the response to the challenge question that should be available next;

Generate a service information request carrying the content of the response;

Use the private key of the merchant to sign the service information request carrying the response content, and then send the signed service information request to the third-party payment server.

An embodiment of this specification proposes a device for realizing a third-party payment service, wherein the device is applied to a third-party payment server, see Figure 6, the device includes:

The payment request receiving module 601 is configured to receive the payment request sent by the merchant server;

The signature verification module 602 is configured to use the merchant's public key to perform signature verification on the payment request;

The response content acquisition module 603 is configured to obtain the response content from the payment request after the signature verification is successful;

The challenge question obtaining module 604 is configured to determine the currently available challenge question corresponding to the answer content; wherein, the challenge question and its corresponding answer content are only shared by the third-party payment server and the merchant server;

The challenge and response verification module 605 is configured to use the determined challenge question to verify the content of the response;

The payment processing module 606 is configured to perform payment processing if the challenge and response verification module 605 succeeds in verifying the content of the response.

In the embodiment of the device of this specification shown in FIG. 6 , the challenge question acquisition module 604 is configured to determine the challenge question carried in the information sent by the third-party payment server to the merchant server last time as the content of the answer. Corresponds to currently available challenge questions.

In the embodiment of the device of this specification shown in FIG. 6, it further includes: a service providing module (not shown in FIG. 6);

The payment processing module 606 is configured to send a back-end payment notification carrying the next challenge question to the merchant server;

The service provider module is configured to execute:

Receive business information requests from merchant servers;

Use the merchant's public key to verify the signature of the business information request;

After the signature verification is successful, get the response content from the business information request;

Verify the response content obtained from the business information request by using the challenge question carried in the back-end payment notification, and provide the business service requested by the business information request to the merchant server after the verification is successful.

In one embodiment of the device of this specification shown in Fig. 5 and Fig. 6, the order request is the order request in the N+1th transaction corresponding to the merchant server processed by the third-party payment server; wherein , N is a positive integer;

The challenge question and its corresponding response content include: information in the first N transactions processed by the third-party payment server and corresponding to the merchant server.

In one embodiment of the device of this specification shown in Fig. 5 and Fig. 6, the challenge question includes: the external order number of the first transaction; wherein, the first transaction is processed by the third-party payment server and corresponds to the A transaction in the first N transactions of the merchant server; the external order number is the order number generated by the third-party payment server for the first transaction;

Correspondingly, the response content corresponding to the challenge question includes: an internal order number of the first transaction; wherein, the internal order number is an order number generated by the merchant server for the first transaction.

In one embodiment of the device of this specification shown in Fig. 5 and Fig. 6, in each transaction processed by the third-party payment server and corresponding to the merchant server, the IP address used by the merchant server is dynamic IP address;

The challenge question includes: a question about the IP address used by the merchant server in the second transaction; wherein, the second transaction is one of the first N transactions processed by the third-party payment server and corresponding to the merchant server transaction;

Correspondingly, the response content corresponding to the challenge question includes: the IP address used by the merchant server in the second transaction.

An embodiment of the present specification provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, the computer is instructed to execute the method in any one of the embodiments in the specification.

An embodiment of this specification provides a computing device, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the implementation of any one of the embodiments in the specification is implemented. method.

It can be understood that, the structure shown in the embodiment of the present specification does not constitute a specific limitation on the device of the embodiment of the present specification. In other embodiments of the specification, the above-mentioned apparatus may include more or less components than those shown in the illustrations, or combine certain components, or separate certain components, or arrange different components. The illustrated components may be realized in hardware, software, or a combination of software and hardware.

Each embodiment in this specification is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for relevant parts, please refer to part of the description of the method embodiment.

Those skilled in the art should be aware that, in the above one or more examples, the functions described in the present invention may be implemented by hardware, software, pendants or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of the present invention shall be included in the protection scope of the present invention.

Claims (15)

1. The method for realizing the third party payment service is applied to a merchant server and comprises the following steps: receiving a ordering request sent by a merchant client;

obtaining currently available challenge questions;

determining answer content corresponding to the currently available challenge questions; the challenge questions and the corresponding response contents are shared by the third party payment server and the merchant server;

Generating a payment request carrying the response content;

and signing the payment request carrying the response content by using the private key of the merchant, and then sending the signed payment request to a third-party payment server.

2. The method of claim 1, wherein the obtaining the currently available challenge questions comprises:

and determining the challenge question carried in the information which is last sent to the merchant server by the third party payment server as the currently available challenge question.

3. The method of claim 1, wherein after the sending the signed payment request to a third party payment server, further comprising:

receiving a back-end payment notification carrying a challenge question sent by the third party payment server; obtaining the next available challenge question from the backend payment notification;

determining answer content corresponding to the next available challenge questions;

generating a service information request carrying the response content;

and signing the business information request carrying the response content by using the private key of the merchant, and then sending the signed business information request to a third-party payment server.

4. A method according to any one of claims 1 to 3, wherein the order request is an order request in an n+1th transaction corresponding to the merchant server, processed by the third party payment server; wherein N is a positive integer;

The challenge questions and their corresponding response content include: and the third party payment server processes information in the first N transactions corresponding to the merchant server.

5. The method of claim 4, wherein the challenge question comprises: an external order number for the first transaction; wherein the first transaction is one of the first N transactions processed by the third party payment server and corresponding to the merchant server; the external order number is an order number generated by the third party payment server for the first transaction;

correspondingly, the response content corresponding to the challenge question comprises: an internal order number for the first transaction; wherein the internal order number is an order number generated by the merchant server for the first transaction.

6. The method of claim 4, wherein the IP address used by the merchant server is a dynamic IP address in each transaction processed by the third party payment server corresponding to the merchant server;

the challenge problems include: a question of an IP address used by the merchant server in a second transaction; wherein the second transaction is one of the first N transactions processed by the third party payment server and corresponding to the merchant server;

Correspondingly, the response content corresponding to the challenge question comprises: an IP address used by the merchant server in the second transaction.

7. The method for realizing the third party payment service is applied to a third party payment server and comprises the following steps:

receiving a payment request sent by a merchant server;

signature verification is carried out on the payment request by utilizing the public key of the merchant;

after the signature verification is successful, obtaining response content from the payment request;

determining currently available challenge questions corresponding to the answer content; the challenge question and the response content corresponding to the challenge question are only shared by the third party payment server and the merchant server;

verifying the response content using the determined challenge questions;

if the answer content verification is successful, the payment process is performed.

8. The method of claim 7, wherein the determining currently available challenge questions corresponding to the answer content comprises:

and determining the challenge question carried in the information which is last sent to the merchant server by the third party payment server as the currently available challenge question corresponding to the response content.

9. The method of claim 7, wherein the conducting payment processing comprises: the third party payment server sends a back-end payment notification carrying a challenge question to the merchant server;

After the payment processing, further comprising:

receiving a business information request sent by a merchant server;

signature verification is carried out on the business information request by utilizing the public key of the merchant;

after the signature verification is successful, obtaining response content from the service information request;

and verifying the response content obtained from the service information request by using the challenge question carried in the back-end payment notice, and providing the service requested by the service information request for the merchant server after the response content is verified successfully.

10. The method of any of claims 7 to 9, wherein the payment request is a payment request processed by the third party payment server in an n+1th transaction corresponding to the merchant server; wherein N is a positive integer;

the challenge questions and the corresponding response contents thereof comprise: and the third party payment server processes information in the first N transactions corresponding to the merchant server.

11. The method of claim 10, wherein the challenge question comprises: an external order number for the first transaction; wherein the first transaction is one of the first N transactions processed by the third party payment server and corresponding to the merchant server; the external order number is an order number generated by the third party payment server for the first transaction;

Correspondingly, the response content corresponding to the challenge question comprises: an internal order number for the first transaction; wherein the internal order number is an order number generated by the merchant server for the first transaction.

12. The method of claim 10, wherein in each transaction processed by the third party payment server corresponding to the merchant server, the IP address used by the merchant server is a dynamic IP address;

the challenge problems include: a question of an IP address used by the merchant server in a second transaction; wherein the second transaction is one of the first N transactions processed by the third party payment server and corresponding to the merchant server;

correspondingly, the response content corresponding to the challenge question comprises: and the IP address used by the merchant server in the second transaction.

13. The device for realizing the third party payment service is applied to a merchant server and comprises the following components: the ordering request receiving module is configured to receive an ordering request sent by a merchant client;

a challenge question determination module configured to obtain a currently available challenge question;

a response content determination module configured to determine response content corresponding to the currently available challenge question; the challenge questions and the corresponding response contents are shared by the third party payment server and the merchant server;

A payment request processing module configured to generate a payment request carrying the answer content; and signing the payment request carrying the response content by using the private key of the merchant, and then sending the signed payment request to a third-party payment server.

14. The device for realizing the third party payment service is applied to a third party payment server and comprises the following components:

the payment request receiving module is configured to receive a payment request sent by a merchant server;

the signature verification module is configured to verify the signature of the payment request by using the public key of the merchant;

the response content acquisition module is configured to acquire response content from the payment request after the signature verification is successful;

a challenge question acquisition module configured to determine a currently available challenge question corresponding to the answer content; the challenge question and the response content corresponding to the challenge question are only shared by the third party payment server and the merchant server;

a challenge and response verification module configured to verify the response content using the determined challenge questions;

and the payment processing module is configured to perform payment processing if the challenge and response verification module is successful in verifying the response content.

15. A computing device comprising a memory having executable code stored therein and a processor, which when executing the executable code, implements the method of any of claims 1-12.

Images