CN104240074A - Prepaid card online payment system based on identity authentication and payment method of prepaid card online payment system - Google Patents

Abstract

The invention relates to the field of payment of intelligent terminals, particularly relates to a system for implementing virtualized payment of a physical card by using a client side and a management service platform which work cooperatively, and provides a prepaid card online payment system based on identity authentication. The prepaid card online payment system based on identity authentication specifically comprises a client side, payment management equipment and a management and service platform, wherein a first identity authentication module and a first NFC (near field communication) module are arranged in the client side; the token information is acquired through the first identity authentication module; payment information and the token information are transmitted to the payment management equipment through the first NFC module; a second NFC module is arranged in the payment management equipment; information transmitted from the client side is received through the second NFC module; the payment information and the token information are transmitted to the management and service platform so as to respond to the payment information; a second identity authentication module is arranged in the management and service platform; the management and service platform is used for generating and authenticating the token information; user information and prepaid card information are managed and authenticated through the second identity authentication module; identity authentication in a payment process is realized; the safety performance of the prepaid card online payment system is improved; and applications are extended.

Description

Prepaid Card Online Payment System and Payment Method Based on Identity Authentication

technical field

The present invention relates to the payment field of intelligent terminals, in particular to a system and a payment method for a client and a management service platform to cooperate to realize physical card virtualization payment.

Background technique

Prepaid cards are also called stored-value cards, consumer cards, gift cards, smart cards, point cards, etc., which refer to the prepaid value of goods or services that can be purchased outside the card issuer and issued by the card issuer in a specific carrier and form. A card that pays first and spends later. According to whether the identity information of the cardholder is recorded or not, it is divided into registered prepaid cards and bearer prepaid cards, among which registered prepaid cards include shopping cards issued by supermarkets, etc., and bearer prepaid cards include SIM cards in mobile phones, etc.; classified according to different information carriers For magnetic stripe card, chip (IC) card.

Prepaid card shopping is a form of transaction that appeared after credit cards, and it is most commonly used in Japan at present. The process of using a prepaid card is: consumers prepay a limited amount of cash in a store within a certain system and get this card. In these stores, they can directly make one or more direct purchases within the prepaid amount without cash in these stores. .

Using this method has many benefits for both merchants and consumers. For merchants, after using the prepaid card, the merchant does not handle cash, which greatly reduces the flow of cash, which can not only avoid the loss of counterfeit banknotes, but also reduce dangers such as robbery; at the same time, the use of prepaid cards can collect cash and account receipts and expenditures. Reduction can not only improve efficiency, but also reduce labor and equipment costs, etc.; for consumers, they only need to bring a thin prepaid card, which can reduce the risk of theft and robbery without or with a lot of cash , It is also very convenient to carry.

Contents of the invention

At present, there are already many platforms that use prepaid cards for payment, such as the "virtual prepaid card" platform of Yinshang Information. In the platform, merchants can use their own software and third-party platforms, such as WeChat, Alipay wallet, etc. to realize the payment of existing physical cards. Virtualization, and also can issue pure virtual cards on this platform. In the process of using a third-party platform for payment, the cardholder first uses a mobile phone to generate a barcode online, and the cashier scans the barcode with a barcode scanner for payment. However, there are still many problems in the payment process of this payment system, such as: currently the barcode only supports red light scanning but not laser scanning; Three-party platforms, such as the WeChat platform, users can also directly use a computer browser to enter a URL (Uniform Resource Locator: Uniform Resource Locator) to generate a barcode for payment; and during the entire transaction process, data and passwords are transmitted in plain text, which is easy to be Listen and be intercepted. In view of the above problems, the present invention provides a prepaid card online payment system based on identity authentication, which sets identity authentication modules respectively between the client and the management server platform to realize identity authentication in the payment process; The NFC modules are respectively set in the device to realize the information interaction between the client and the payment management device, thereby improving the security performance of the present invention and expanding the application at the same time.

A prepaid card online payment system based on identity authentication, including:

Client, payment management equipment, and management service platform;

The client has a built-in first identity authentication module and a first NFC (Near Field Communication, near field communication) module, and obtains token information through the identity authentication module, and simultaneously passes payment information and the token information through the NFC The module sends to the payment management device;

The payment management device has a built-in second NFC module, receives the information sent by the client through the second NFC module, and sends the payment information and the token information to the management service platform at the same time, so as to realize the Response to the above payment information;

The management service platform has a built-in second identity authentication module, which is used to generate and authenticate the token information, and manage and authenticate user information and prepaid card information through the second identity authentication module.

Near Field Communication (NFC) technology is evolved from non-contact radio frequency identification (Radio Frequency Identification, RFID), jointly developed by Philips Semiconductors (now NXP Semiconductors), Nokia and Sony, based on RFID and interconnection technology , which is a short-range high-frequency radio technology that operates at a frequency of 13.56MHz within a distance of 20cm; the transmission speed is divided into three types: 106kbit/s, 212kbit/s or 424kbit/s. At present, near field communication has passed the ISO/IEC IS18092 international standard, ECMA-340 standard and ETSI TS 102 190 standard. NFC adopts two reading modes, active and passive. NFC near-field communication technology combines inductive card readers, inductive cards and point-to-point functions on a single chip to achieve identification and data exchange with compatible devices within a short distance.

Authentication is the process of confirming a user's identity in a computer network. Identity authentication can be divided into the authentication between the user and the client and the authentication between the client and the client. The authentication between the user and the client can be based on one or more of the following factors: such as passwords, passwords, etc., which uniquely identify the user Information, such as credit cards, etc.; biological characteristics of users: such as fingerprints, voice, retina, signature, etc.

Preferably, the management service platform includes: a management server, an authentication server, and a prepaid card management device;

The management server has a built-in second identity authentication module, receives user information and prepaid card information sent by the client, and sends them to the authentication server and the prepaid card management device respectively;

The authentication server generates session secret key and token information before the system makes payment; during the payment process, it is used to authenticate the user information and the token information;

The prepaid card management device is used to manage and authenticate the prepaid card information.

Preferably, the user information includes identification information for uniquely identifying the user.

Preferably, the payment management device includes a POS machine, and the POS machine includes an NFC reader.

The present invention also provides a prepaid card online payment method based on identity authentication, which is applied to the above-mentioned identity authentication-based prepaid card online payment system, specifically including:

S1 implement mutual authentication between the client and the authentication server based on the user information acquired by the client;

S2 The authentication server implements the legality authentication of the prepaid card information, and the prepaid card management device implements the correctness authentication of the prepaid card information;

S3, the authentication server generates corresponding token information in response to the client request;

S4, the payment management device sends the payment request to the client;

S5, the client sends the payment information and the token information to the authentication server via the payment management device and the prepaid card management device;

The authentication server of S6 realizes the authentication of the token information, and simultaneously sends the authentication result and the payment request to the prepaid card management device;

S7 The prepaid card management device completes the payment operation, and at the same time sends a payment response to the payment management device.

Preferably, in step S1, based on the user information obtained by the client, mutual authentication between the client and the authentication server is realized: the client and the authentication server are respectively based on the user information The same session key is formed to realize information interaction between the client and the management service platform.

The formation of the session key mentioned here is mainly for the user to realize the communication between the client and the management service platform to ensure the security performance of the transaction information. It is a kind of OTP (One-time Password, one-time dynamic password) A new type of encryption system SOTP (StrongOne-time Password, enhanced one-time dynamic password) developed on the basis of the SOTP algorithm. Denial.

The following is a detailed introduction to the SOTP encryption system. The whole process is mainly divided into three stages for implementation: registration stage, authentication stage, and session stage.

1. Registration stage

Before using SOTP, the user first registers with the server in a safe environment to complete user initialization.

In the registration stage, the client first uses the first algorithm H to encrypt the identification information uid that uniquely identifies the user and the user password information pw, such as the SHA1 algorithm to generate the first information; at the same time, the server generates the first key k and the second key Two keys k', and send the first key k and the second key k' to the client, and combine the first key k with the encryption algorithm E to generate an encryption function related to the first key k E _k , combining the second key k' with the decryption algorithm D to generate a decryption function D _k associated with the second key k'.

In this stage, the server stores the encryption algorithm, decryption algorithm, first key, second key, identification information and first information; the client stores the encryption algorithm and decryption algorithm sent by the server.

2. Authentication stage

In the process of identity authentication, firstly, the user inputs the identification information uid and user password information pw in the client, and at the same time combines the current time T _ui and user password information pw, encrypts with the encryption function E _k and the first algorithm H, and generates the second an encrypted message Then the client sends the identification information uid and the first encrypted information sent to the server.

The server receives the identification information uid and the first encrypted information Afterwards, firstly, it is judged whether the identification information uid is a legal user, that is, registered in the server, that is, whether the identification user information uid is pre-stored in the list of user identification information in the server.

If after verification, the user is a legitimate user, then complete the preliminary authentication in the server; if the user is found to be an illegal user after the preliminary authentication, immediately terminate the session with the client.

Next, the server selects the current time T _si , and at the same time encrypts the current time T _si with the encryption algorithm E and the second key k' to E _k '(T _si ); then uses the decryption algorithm D and the first key k' k pair received Decrypt to get Then put the result (Exclusive OR operation) to obtain E _k (T _ui ), and finally use the decryption algorithm D and the first key k to decrypt E _k (T _ui ) to obtain T _ui .

After getting T _ui , calculate the time difference between T _si and T _ui , if the time difference is within the preset time, such as within 10 minutes, the server authenticates the client successfully, otherwise the server disconnects the session with the client.

After completing the identity authentication of the client, the server immediately inverts E _k (T _ui ) (bit order and bit polarity) to obtain E' _k (T _ui ), and then uses the encryption algorithm E and the first key k to pair E _k (T _ui ) and E' _k (T _ui ) are encrypted to obtain the session key K _i =E _k (E _k (T _ui ))+E _k (E' _k (T _ui )), which realizes the original The 64bit extension is 128bit, which greatly strengthens the security of information.

After the server obtains the session key, it immediately sends E _k '(T _si ) to the client.

After the client receives E _k '(T _si ), use the decryption algorithm D and the second key k' to decrypt it to obtain the time T _si ; then calculate the time difference between T _si and T _ui , if Within the set time difference, such as within 10 minutes, the client authenticates the server successfully, otherwise the client disconnects the session with the server.

After the identity authentication of the server is completed, E _k (T _ui ) is reversed to obtain E' _k (T _ui ), and then the encryption algorithm E and the first key k are used to pair E _k (T _ui ) and E' _k ( T _ui ) is encrypted to obtain the session key K _i =E _k (E _k (T _ui ))+E _k (E' _k (T _ui )).

3. Session stage

After the session key is generated in the client and the server respectively, the session relationship between the client and the server is established, and then the data packets in each session between the server and the client are encrypted using the session key K _i protection, and use the first algorithm H to check the integrity check.

In addition, during the session, the sender and receiver of the data packet respectively include a public transaction data encryption algorithm e and a corresponding decryption algorithm d, including AES-128.

If the content of the conversation between the sender and the receiver is M, the format of the data packet sent by the sender is: e _Ki (M)+H(M); after receiving the data packet, the receiver sends the information to the corresponding In the server, after receiving the other party’s session data packet, the server first uses the decryption algorithm d to decrypt the information e _Ki (M) to obtain M, and then calculates and obtains H(M) through the first algorithm H through the obtained M, and finally obtains Compared with the received H(M), if they are the same, it means that the data packet is legal, otherwise, the session is terminated, and the authentication process of the entire SOTP algorithm is completed so far.

Preferably, in step S2, the authentication server implements the legality authentication of the prepaid card information, and the prepaid card management device implements the correctness authentication of the prepaid card information, which specifically includes:

The client encrypts the prepaid card information and the session key into first encrypted information, and simultaneously extracts first summary information in the prepaid card information, and then encrypts the first encrypted information and the second A summary information is sent together to the management server;

The management server sends the received first encrypted information and first summary information to the authentication server;

The authentication server uses the generated session key to decrypt the first encrypted information to obtain prepaid card information, and then obtains second summary information of the prepaid card information, and then combines the second summary information with the received Compare the first summary information of the prepaid card information to realize the authentication of the legality of the prepaid card information; finally, send the received prepaid card information and user information to the prepaid card management device;

The prepaid card management device obtains the matching user preset in the device according to the received user information, and then compares the received prepaid card information with the prepaid card information included in the user, Realize the verification of the correctness of the prepaid card information.

Preferably, in step S3, the authentication server generates corresponding token information in response to the client request, specifically including:

The client encrypts the token request information and the session key into second encrypted information, and simultaneously extracts third summary information in the token request information, and then converts the second encrypted information and the first The three summary information are sent to the management server together;

The management server sends the received second encrypted information and third summary information to the authentication server;

The authentication server uses the generated session key to decrypt the second encrypted information to obtain token request information, and then obtains fourth summary information of the token request information, and then combines the third summary information with The received fourth summary information is compared to realize the authentication of the legitimacy of the token request information; finally, corresponding token information is generated according to the token request of the client.

Preferably, in step S6, the authentication server implements the authentication of token information, and at the same time sends the authentication result and the payment request to the prepaid card management device, specifically including:

The payment management device sends a payment request to the client;

The client encrypts the token information, the payment information, and the session key into third encrypted information, and simultaneously extracts the fifth summary information in the token information and the payment information, and then converts the sending the third encrypted information and the fifth summary information to the payment management device;

The payment management device sends the third encrypted information and the fifth summary information to the prepaid card management device;

The prepaid card management device sends the received third encrypted information and the fifth summary information to the authentication server;

The session key generated by the authentication server decrypts the third encrypted information to obtain token information and payment information, and then obtains sixth summary information, and then performs a combination of the sixth summary information and the received fifth summary information Compare to realize the authentication of the legitimacy of the token request information; finally compare the received token information with the token information generated by itself to complete the comparison of the token information.

Preferably, in step S7, the prepaid card management device completes the payment operation, and at the same time sends a payment response to the payment management device, specifically including:

After the token information is authenticated successfully, the authentication result and payment information are sent to the prepaid card management device;

After the prepaid card management device receives the authentication result and the payment information, it responds to the payment according to the received payment information, and at the same time sends the payment response to the payment management device, completing the prepaid card online payment system. payment operation.

The present invention provides a prepaid card online payment system based on identity authentication, which has the beneficial effects of:

1. In the present invention, the identity authentication module is set respectively in the client and the management service platform, and the conversation between the client and the management service platform is realized; the security performance of the conversation information in the conversation process is greatly improved simultaneously;

2. use SOTP technology to encrypt session information in the session process of client and management service platform among the present invention:

In this process, each client includes an independent application or plug-in to integrate the built-in algorithm and key, that is, the client only stores the encryption function and decryption function generated by the encryption and decryption algorithm combined with the random key, It effectively solves the security problem of session key storage during the session; and the randomly generated key in each client is different, so the algorithm included in each client is different, even if the security plug-in in the client is leaked accidentally Will affect the overall security of the system;

The two-way authentication method is adopted between the client and the management service platform to authenticate the client and the management service platform respectively, and this authentication method effectively prevents counterfeiting attacks from the outside.

After two-way authentication between the client and the management service platform, the same session key is generated respectively, and the entire session process of the client and the server platform is encrypted with the session key to protect the integrity of the session information, preventing the disclosure of transaction content, Tampering, repudiation, and man-in-the-middle attacks.

3. The present invention sets NFC modules in the client and the payment management device respectively. During the entire payment process, the client and the payment management device communicate through the NFC module, which is convenient and quick, and effectively solves the problem that the payment management device cannot be timely The payment information in the client terminal is effectively obtained, and the application occasions of the system of the present invention are expanded.

Description of drawings

Below in conjunction with accompanying drawing and specific embodiment the present invention is described in further detail:

Fig. 1 is the structural representation of the prepaid card online payment system based on identity authentication among the present invention;

Fig. 2 is a schematic flowchart of the online payment method for prepaid cards based on identity authentication in the present invention.

Detailed ways

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the present invention will be specifically described below in conjunction with the accompanying drawings and embodiments. The drawings in the following description are only some embodiments of the invention. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

As shown in Fig. 1, the present invention provides an identity authentication-based prepaid card online payment system, which specifically includes: a client, a payment management device, and a management service platform.

Specifically, the first identity authentication module and the first NFC module are respectively built in the client; wherein, the first identity authentication module is used to realize the identity authentication in the data communication process between the client and the management service platform, so as to ensure the communication data security performance; the first NFC module is used to send the payment information and token information in the client to the payment management device equipped with the second NFC module.

Further, the client includes an intelligent terminal with a built-in NFC module, such as a mobile phone. Particularly, in order to realize the purpose of the present invention, in the intelligent terminal, used HCE (Host Card Mode, host card mode) technology in the mobile phone as sure that the information that the client receives from the outside is directly sent to the corresponding application program in the client host , instead of sending to the client, such as the security module (SE) in the mobile phone. However, HCE technology only implements the data sent from the external NFC module to the HCE service in the client or returns the reply data to the external NFC module, but there is no specific implementation of data processing and sensitive information storage. Therefore, in the present invention, the security module is simulated in the client by using the SOTP algorithm to ensure the security performance of the NFC service. According to the above description, it can be known that the specific form of the client based on the NFC module and HCE technology includes not only the mobile phone, but also other smart devices equipped with the NFC module and using the HCE technology, as long as there is data communication between the client and the management service platform In the process of using the SOTP algorithm in the present invention, the security performance in the data communication process can be guaranteed.

The payment management device has a built-in second NFC module, which receives the information sent by the client through the second NFC module, and at the same time sends the payment information and token information to the management service platform to realize the response of the payment information.

Further, the payment management device includes a POS machine, and the POS machine includes an NFC reader. During the payment process, the POS machine sends a payment request to the HCE service of the client through its built-in NFC reader, and at the same time receives the information sent by the client through the NFC reader. In particular, the present invention does not limit the specific form of the payment management device, as long as it can achieve the purpose of the present invention, it is included in the content of the present invention.

The management service platform has a built-in second identity authentication module, which is used to generate and authenticate token information, and manage and authenticate user information and prepaid card information through the second identity authentication module.

Further, the management service platform specifically includes: a management server, an authentication server, and a prepaid card management device.

Specifically, the management server has a built-in second identity authentication module, which receives user information and prepaid card information sent by the client, and sends them to the authentication server and the prepaid card management device respectively. In particular, in the present invention, the management server is mainly used for unified management of prepaid card information, including: the registration operation performed on the management service platform before the user with the prepaid card performs the payment operation, and the user's logout operation; The binding operation of the physical card or the user recharges the prepaid card; the user purchases the prepaid card online; and the user performs operations such as querying the balance and points of the prepaid card. In addition, the management server simultaneously provides access to the authentication server and the prepaid card device (realized through the built-in identity authentication module), and then forwards the received information to the authentication server and the prepaid card device respectively.

The authentication server generates session secret key and token information before the system makes payment; it is used to authenticate user information and token information during the payment process. Specifically, when a user holding a prepaid card registers in the management service platform through the client, the management server will send the information to the authentication server for storage after receiving the user information, so as to verify the identity of the user before making payment. Further, the user information includes identification information capable of identifying the user, such as a user name, and also includes the user's login password. In addition, the authentication server also includes an algorithm that can realize SOTP, including: generation of SOTP algorithm library, download of SOTP algorithm library to realize session key generation; at the same time, based on user information and time information according to the client's request Generate corresponding token information. In particular, the first identity authentication module in the client and the second identity authentication module in the management server include SOTP algorithm ports, which are used to realize the transmission of data encrypted using the SOTP algorithm.

The prepaid card management device is used for managing and authenticating prepaid card information. Specifically, in the system, each user can include multiple prepaid cards, and the user only needs to store the information of the prepaid card in the management server and the prepaid card management device during the registration process. , it is only necessary to select the prepaid card. After the prepaid card management device receives the user information and the prepaid card information, it first finds the user through the user information, and then confirms whether the prepaid card selected by the user is reasonable.

As shown in Figure 2, the present invention also provides a prepaid card online payment method based on identity authentication, which specifically includes:

S1 implements mutual authentication between the client and the authentication server based on the user information obtained by the client;

The S2 authentication server realizes the legality authentication of the prepaid card information, and the prepaid card management device realizes the correctness authentication of the prepaid card information;

The S3 authentication server generates corresponding token information in response to the client request;

The S4 payment management device sends a payment request to the client;

The S5 client sends the payment information and token information to the authentication server via the payment management device and the prepaid card management device;

The S6 authentication server realizes the authentication of the token information, and simultaneously sends the authentication result and the payment request to the prepaid card management device;

S7 The prepaid card management device completes the payment operation, and at the same time sends the payment response to the payment management device.

Specifically, in step S1, that is, before the prepaid card online payment system performs the payment operation, the client and the management service platform respectively form the same session key according to user information to realize mutual authentication between the client and the management service platform. Because the present invention uses the SOTP algorithm, based on our introduction to the SOTP algorithm, in the process of using the algorithm, the whole process is mainly divided into three stages: registration stage, authentication stage, and session stage. Specifically, the session phase mentioned here is the process of information interaction between the client and the management service platform; before the information interaction, the authentication server in the management service platform and the client will register based on user information according to the SOTP algorithm. stage and authentication stage, realize the authentication of the client to the authentication server and the authentication of the authentication server to the client, and generate the same session key at the same time, at the same time, the user successfully logs in to the management service platform; in the subsequent payment process, the client and Each conversation in the management service platform is encrypted with a session key to ensure the security of the exchanged information.

After the session key is generated, data verification can be performed between the client and the management service platform. In particular, in the present invention, the client and the authentication server also include an encryption algorithm and a decryption algorithm for the user to encrypt and decrypt the interaction information, such as AES-128; and an H algorithm for extracting summary information, such as SHA1, in particular, the present invention does not limit the encryption and decryption algorithm and the H algorithm, as long as they can achieve the purpose of the present invention, they are all included in the content of the present invention.

After the client successfully logs in to the management service platform through the above steps, it starts to select the prepaid card associated with the user, that is, in step S2, it specifically includes: the client encrypts the prepaid card information and session key through an encryption algorithm into the first One encrypted information, using the H algorithm to extract the first abstract information in the prepaid card information, and then send the first encrypted information and the first abstract information to the management server; the management server will receive the first encrypted information and the first abstract The information is sent to the authentication server; the authentication server uses the session key generated by itself and the decryption algorithm to decrypt the first encrypted information to obtain the prepaid card information, and then obtains the second summary information of the prepaid card information through the H algorithm, and then converts the second summary information Compare with the received second summary information to realize the authentication of the legitimacy of the prepaid card information, if the authentication is verified, then send the received prepaid card information and user information to the prepaid card management device; the prepaid card management device After obtaining the matching user information preset in the device, the received prepaid card information is compared with the prepaid card information included in the user to realize the verification of the correctness of the prepaid card information. If there is an error in the prepaid card information verification process, the session process with the client will be stopped immediately, and the user will be reminded at the same time; if an error occurs in the correctness verification process, the session process will also be stopped immediately, and the user will be prompted to choose a prepaid card error. Furthermore, the process of sending the authentication result back to the client through the management server will also go through the above-mentioned process, that is, first encrypt the session key and encryption algorithm in the authentication server, extract the summary information in the authentication result, and send it to the client together. After the client receives it, it uses the decryption algorithm to decrypt the encrypted information, obtains the summary information of the decrypted information, and finally compares the two summary information to verify the rationality and integrity of the obtained information.

In this step, the prepaid card management device records the prepaid card that the user needs to use in the payment process, so as to realize the subsequent payment process.

After the prepaid card is selected correctly, in order to further ensure the security performance in the payment process, the client also needs to request the management service platform to download the corresponding token information, that is, in step S3, it specifically includes: the client sends the token request information and session The key is encrypted into the second encrypted information using an encryption algorithm, and at the same time, the H algorithm is used to extract the third summary information in the token request information, and then the second encrypted information and the third summary information are sent to the management server; the management server will receive The received second encrypted information and third summary information are sent to the authentication server; the authentication server uses the session key and decryption function generated by itself to decrypt the second encrypted information to obtain the token request information, and then obtain the token request information through the H algorithm The fourth summary information, and then compare the third summary information with the received fourth summary information, if the authentication is successful, then realize the authentication of the legitimacy of the token request information; finally, according to the client’s token request, generate a token based on user information , time information and key seed information (the key seed is stored in the authentication server during the user registration process) to generate token information. If the authentication of the token request information fails, the session with the client will be stopped immediately. Furthermore, when the generated token information is sent back to the client by the management server, it will also go through the above-mentioned encryption and decryption process, that is, the authentication server first uses the session key and encryption algorithm to encrypt, and extracts the abstract of the token information information, and then send the encrypted information and summary information to the client together. After the client receives it, it uses the decryption algorithm to decrypt the encrypted information, then obtains the summary information of the decrypted information through the H algorithm, and finally compares the two summary information. The rationality and completeness of the obtained information are verified separately.

After the above preparations before payment are completed, the payment can be started. The specific payment process includes:

First, in step S4, the payment management device sends a payment request to the client. In particular, the payment management device here includes a POS machine, and the POS machine includes an NFC reader. That is, the NFC reader in the POS machine sends a payment request to the client, and the client also receives the payment request through the built-in NFC module.

Subsequently, as in step S6, the client encrypts the token information, payment information, and session key into the third encrypted information, and simultaneously extracts the fifth summary information in the token information and payment information, and then converts the third encrypted information and the 5. The summary information is sent to the payment management device; the payment information here specifically includes the payment amount and so on.

The payment management device sends the third encrypted information and the fifth summary information to the prepaid card management device;

Immediately afterwards, the prepaid card management device sends the received third encrypted information and fifth summary information to the authentication server;

Finally, the session key generated by the authentication server decrypts the third encrypted information to obtain token information and payment information, and then obtains the sixth summary information, and then compares the sixth summary information with the received fifth summary information to realize Authentication of the legitimacy of the token request information; finally, compare the received token information with the token information generated by itself to complete the token information comparison.

In the authentication server, as in step s7, if the authentication of the token information is successful, the authentication information will be sent back to the prepaid card management device; after the prepaid card management device receives the message that the token information authentication is successful, the payment will be made according to the received payment information operation, and at the same time send the payment response to the payment management device to complete the entire payment operation. In particular, after the authentication of the token information in the authentication server is successful, the token information will be canceled and wait for the next token information request to generate new token information.

To sum up, the present invention provides a prepaid card online payment system and method based on identity authentication, which sets an identity authentication module between the client and the management server platform to realize identity authentication in the payment process; The NFc modules are respectively set in the management device to realize the information interaction between the client and the payment management device, thereby improving the security performance of the present invention and expanding the application at the same time.

The specific embodiments of the invention have been described in detail above, but the present invention is not limited to the specific embodiments described above, which are only examples. For those skilled in the art, any equivalent modifications and substitutions to the system are also within the scope of the present invention. Therefore, equivalent changes and modifications made without departing from the spirit and scope of the invention shall fall within the scope of the present invention.

Claims (10)

1. the online payment system of the prepaid card of identity-based certification, is characterized in that, comprising:

Client, payment management equipment, and management service platform;

Built-in first authentication module of described client and the first NFC module, and obtain token information by described authentication module, payment information and described token information are sent to described payment management equipment by described NFC module simultaneously;

Built-in second NFC module of described payment management equipment, is received the information of described client transmission, described payment information and described token information is sent to described management service platform, to realize the response of described payment information simultaneously by described second NFC module;

Built-in second authentication module of described management service platform, for generating and token information described in certification, is managed and authenticated information and prepaid card information by described second authentication module simultaneously.

2. the online payment system of the prepaid card of identity-based certification as claimed in claim 1, it is characterized in that, described management service platform comprises: management server, certificate server, and prepaid card management equipment;

Built-in described second authentication module of described management server, receives user profile and the prepaid card information of the transmission of described client, is sent to described certificate server and described prepaid card management equipment respectively;

Described certificate server, before system pays, generates described token information; In payment process, for user profile described in certification and described token information;

Described prepaid card management equipment, for managing and prepaid card information described in certification.

3. the online payment system of the prepaid card of identity-based certification as claimed in claim 1 or 2, is characterized in that: described user profile comprises the identification information for unique identification user.

4. the online payment system of the prepaid card of identity-based certification as claimed in claim 2, is characterized in that: described payment management equipment comprises POS, and described POS comprises NFC reader.

5. a prepaid card online payment method for identity-based certification, be applied to as arbitrary in claim 1-4 as described in the online payment system of prepaid card of identity-based certification, it is characterized in that, specifically comprise:

The described user profile that S1 obtains based on described client, realizes the mutual certification of described client and described certificate server;

Certificate server described in S2 realizes the legitimacy certification of described prepaid card information, and described prepaid card management equipment realizes the correctness certification of described prepaid card information;

Described in S3, client-requested described in authentication server response generates corresponding token information;

Payment management equipment described in S4 sends described payment request to described client;

Described payment information and described token information are sent to described certificate server via described payment management equipment and described prepaid card management equipment by client described in S5;

Certificate server described in S6 realizes the certification of token information, described authentication result and described payment request is sent to prepaid card management equipment simultaneously;

Described in S7, prepaid card management equipment completes delivery operation, payment response is sent to payment management equipment simultaneously.

6. the prepaid card online payment method of identity-based certification as claimed in claim 5, it is characterized in that, in step S1, based on the described user profile that described client obtains, realize in the mutual certification of described client and described certificate server: in described client and described certificate server, form identical session key according to described user profile respectively, to realize the information interaction between described client and described management service platform.

7. the prepaid card online payment method of identity-based certification as claimed in claim 5, it is characterized in that, in step S2, described certificate server realizes the legitimacy certification of described prepaid card information, described prepaid card management equipment realizes, in the correctness certification of described prepaid card information, specifically comprising:

It is the first enciphered message that described prepaid card information and described session key are encrypted by described client, extract the first summary info in described prepaid card information simultaneously, subsequently described first enciphered message is sent to described management server together with described first summary info;

Described firstth enciphered message received and the first summary info are sent to described certificate server by described management server;

Described certificate server uses the described session key generated to be decrypted described first enciphered message and obtains prepaid card information, and then obtain the second summary info of described prepaid card information, subsequently described second summary info and the first summary info received are compared, realize the certification of described prepaid card information legitimacy; Finally the prepaid card information received is sent to described prepaid card management equipment together with user profile;

Described prepaid card management equipment according to described in receive user profile and obtain the user be preset in equipment matched, subsequently the prepaid card information that the described prepaid card information received and described user comprise is compared, realize the certification of described prepaid card information correctness.

8. the prepaid card online payment method of identity-based certification as claimed in claim 5, is characterized in that, in step S3, described in described authentication server response, client-requested generates in corresponding token information, specifically comprises:

It is the second enciphered message that described client token solicited message and described session key are encrypted, extract the 3rd summary info in described token request information simultaneously, subsequently described second enciphered message is sent to described management server together with described 3rd summary info;

Described second enciphered message received and the 3rd summary info are sent to described certificate server by described management server;

Described certificate server uses the described session key generated to be decrypted described second enciphered message and obtains token request information, and then obtain the 4th summary info of described token request information, subsequently described 3rd summary info and the 4th summary info received are compared, realize the certification of described token request information legitimacy; Finally generate corresponding token information according to the token request of described client.

9. the prepaid card online payment method of identity-based certification as claimed in claim 5, it is characterized in that, in step s 6, described certificate server realizes the certification of token information, described authentication result and described payment request are sent to prepaid card management equipment simultaneously, specifically comprise:

Described payment management equipment sends the request of payment to described client;

It is the 3rd enciphered message that described token information, payment information and described session key are encrypted by described client, extract the 5th summary info in described token information and described payment information simultaneously, subsequently described 3rd enciphered message and described 5th summary info are sent to described payment management equipment;

Described 3rd enciphered message and described 5th summary info are sent to described prepaid card management equipment by described payment management equipment;

Described 3rd enciphered message received and described 5th summary info are sent to described certificate server by described prepaid card management equipment;

The described session key that described certificate server generates is decrypted the 3rd enciphered message and obtains token information and payment information, and then obtain the 6th summary info, subsequently described 6th summary info and the 5th summary info received are compared, realize the certification of described token request information legitimacy; Finally the described token information received and the token information self generated are compared, complete the comparison of described token information.

10. the prepaid card online payment method of identity-based certification as claimed in claim 5, is characterized in that, in step S7, described prepaid card management equipment completes delivery operation, payment response is sent to payment management equipment, in specifically comprising simultaneously:

After described token information authentication success, be sent to described prepaid card management equipment by described authentication result and payment information;

After described prepaid card management equipment receives authentication result and described payment information, payment response is carried out according to the payment information received, described payment response is sent to described payment management equipment simultaneously, completes the delivery operation of the online payment system of described prepaid card.