[go: up one dir, main page]

WO2017162164A1 - Procédé de transaction par dispositif de création de signature électronique - Google Patents

Procédé de transaction par dispositif de création de signature électronique Download PDF

Info

Publication number
WO2017162164A1
WO2017162164A1 PCT/CN2017/077652 CN2017077652W WO2017162164A1 WO 2017162164 A1 WO2017162164 A1 WO 2017162164A1 CN 2017077652 W CN2017077652 W CN 2017077652W WO 2017162164 A1 WO2017162164 A1 WO 2017162164A1
Authority
WO
WIPO (PCT)
Prior art keywords
electronic signature
data packet
unit data
signature device
transaction
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/077652
Other languages
English (en)
Chinese (zh)
Inventor
李东声
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tendyron Corp
Original Assignee
Tendyron Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tendyron Corp filed Critical Tendyron Corp
Publication of WO2017162164A1 publication Critical patent/WO2017162164A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists

Definitions

  • the invention relates to the field of electronic technology, and in particular to a method for trading an electronic signature device.
  • the user's funds are stored in the account in the form of numbers.
  • the user holds 100 yuan of funds, and the funds are stored in the user account of the bank server in the form of numbers.
  • the bank server needs to rewrite the funds 100 in the user account to 90 to complete the account clearing.
  • the rewritten fund value 90 is signed. Because the value of the amount in the account changes every time the user makes a transaction, the bank server will process the value after each change. That is to say, the existing electronic transactions must rely on the bank server, and the electronic transactions performed by the users need to be synchronized with the bank server in real time, and it is impossible to independently complete multiple offline transactions without being connected to the Internet.
  • the present invention aims to solve at least one of the above problems.
  • the main object of the present invention is to provide a method of trading an electronic signature device.
  • Another object of the present invention is to provide a method of trading another electronic device.
  • a transaction method of an electronic signature device comprising: an electronic signature device transmitting a transaction request to a server, wherein the transaction request includes at least: a transaction amount; the server receives the transaction request, and deducts the transaction amount from the bank account of the electronic signature device, Obtaining at least one first unit data packet, and transmitting at least one first unit data packet to the electronic signature device; wherein each first unit data packet represents one of a plurality of currency denominations, each first unit The data packet includes at least: the first unit data, the first signature data obtained by the server signing the first unit data, the sum of the currency denominations represented by the at least one first unit data packet is equal to the transaction amount; and the electronic signature device receives the at least one first And a unit data packet, where the first signature data in the at least one first unit data packet is verified, and after the verification is passed, the at least one first unit data packet is stored in the security chip.
  • the transaction request further includes: a device identifier of the electronic signature device; each first unit data packet further includes: a server obtained by signing the first unit data and the device identifier of the electronic signature device Two signature data; at least one first unit data packet is stored in the electronic signature device Before the security chip, the method further comprises: the electronic signature device verifying the second signature data, and performing the step of storing the at least one first unit data packet in the security chip after the verification is passed.
  • the method of claim 1 or 2 after the electronic signature device stores the at least one first unit data packet in the security chip, the method further comprises: the electronic signature device according to the received at least one first unit data packet The number and the currency denomination represented by each first unit data packet calculate whether the sum of the currency face values represented by the received first unit data packet is consistent with the transaction amount in the transaction request, and if not, send a retransmission to the server. Request; the server receives a resend request.
  • the method further includes: the server sending the retransmission information to the electronic signature device according to the retransmission request, wherein the retransmission information includes at least one first unit data packet;
  • the electronic signature device receives the retransmission information, deletes at least one first unit data packet previously stored in the security chip, and re-stores at least one first unit data packet retransmitted by the server.
  • the method further includes: the server sending the retransmission information to the electronic signature device according to the retransmission request, where the retransmission information includes the first unreceived by the electronic signature device One unit data packet; the electronic signature device stores the unreceived first unit data packet in the security chip.
  • Item 6 The transaction method of any one of clauses 1 to 5, before the electronic signature device stores the at least one first unit data packet in the security chip, the method further comprising: the electronic signature device utilizing its security chip allocation for storing at least a storage space of the first unit data packet; the electronic signature device stores the at least one first unit data packet in the security chip, including: the electronic signature device stores the at least one first unit data packet in the corresponding storage space, and The status word of the corresponding storage space is set to be occupied.
  • the method further comprises: the electronic signature device using the counter value of the counter to obtain the currently stored The total number of first unit packets.
  • Item 8 The transaction method according to any one of claims 1 to 7, after the electronic signature device stores the at least one first unit data packet in the security chip, the method further comprises: the electronic signature device counting the transaction amount into the current account balance, Display the transaction amount and/or current account balance to the holding user.
  • the first unit data includes at least: currency denomination data, or currency serial number and currency denomination data; the first unit data packet further includes at least one of the following: issuing bank identifier And the bank certificate serial number.
  • the transaction method of the electronic signature device described above can store the user's funds in the form of a data packet in the electronic signature device of the user, and the number of the data packets is one or more.
  • the electronic signature device does not need to change the stored value by networking with the server, and only needs one or more firsts that meet the consumption amount.
  • the unit data packet can be sent to the payee. Therefore, the electronic signature device does not need to rely on the server for online payment when performing electronic transactions with other electronic signature devices, and the server no longer needs to supervise the electronic signature device, thereby truly Implement offline electronic trading.
  • the transaction method of the electronic signature device includes: the second electronic signature device sends the transaction request to the first electronic signature device, wherein the transaction request includes at least: a transaction amount; and the first electronic signature device receives the transaction request And obtaining at least one second unit data packet from its security chip, and transmitting at least one second unit data packet to the second electronic signature device, wherein each second unit data packet represents one of a plurality of currency denominations Currency denomination, each The second unit data packet includes at least: the second unit data, the third signature data obtained by the server signing the second unit data, the sum of the currency denominations represented by the at least one second unit data packet is equal to the transaction amount; and the second electronic signature device Receiving at least one second unit data packet, verifying the third signature data in the at least one second unit data packet, and storing the at least one second unit data packet in the security chip after the verification is passed.
  • the method further includes: deleting, by the first electronic signature device, the acquired at least one second unit data pack.
  • the first electronic signature device sends the at least one second unit data packet to the second electronic signature device, the first electronic signature device encrypting the at least one second unit data packet to obtain At least one third unit data packet, and transmitting the at least one third unit data packet to the second electronic signature device; the second electronic signature device receiving the at least one second unit data packet, including: the second electronic signature device receiving the at least one The three-unit data packet decrypts at least one third unit data packet to obtain at least one second unit data packet.
  • the first electronic signature device encrypts the at least one second unit data packet, the first electronic signature device using the public key of the second electronic signature device for at least each second unit data
  • the second unit data in the packet is encrypted to obtain the data ciphertext
  • the second electronic signature device decrypts the at least one third unit data packet, including: the second electronic signature device uses the private key of the second electronic signature device to at least The data ciphertext in the third unit data packet is decrypted.
  • the method further comprises: the first electronic signature device overwriting the security chip with each third unit data packet. Each second unit packet.
  • the first electronic signature device encrypts the at least one second unit data packet, including: the first electronic signature device utilizes a symmetric key associated with the second electronic signature device, at least for each The second unit data in the two unit data packet is encrypted to obtain the data ciphertext; the second electronic signature device decrypts the at least one third unit data packet, including: the second electronic signature device uses the first electronic signature device The symmetric key decrypts at least the data ciphertext in each third unit data packet.
  • the method further includes: the first electronic signature device overwriting the security chip with each third unit data packet. Each second unit of data packets and delete the symmetric key.
  • the symmetric key is an exclusive OR factor
  • the first electronic signature device utilizes a symmetric key associated with the second electronic signature device for at least a second of each second unit data packet
  • the unit data is encrypted to obtain the data ciphertext, including: the first electronic signature device uses an exclusive OR factor to perform an exclusive OR operation on at least the second unit data in each second unit data packet to obtain a data ciphertext; the second electronic signature
  • the device decrypts the data ciphertext in each third unit data packet by using a symmetric key associated with the first electronic signature device, including: the second electronic signature device uses an exclusive OR factor for each third unit data packet
  • the data ciphertext in the XOR is XORed.
  • the transaction method according to any one of the items 10 to 17, after the second electronic signature device stores the at least one second unit data packet in the security chip, the method further comprises: the second electronic signature device utilizing the counter value of the counter The total number of second unit packets to the current storage.
  • the transaction method according to any one of the items 10 to 18, wherein the transaction request comprises at least: a device identifier of the second electronic signature device.
  • the transaction method of claim 19 before the first electronic signature device acquires at least one second unit data packet from its security chip, the transaction method The method further includes: the first electronic signature device prompting the holding user with the transaction amount and the device identifier of the second electronic signature device, and receiving the confirmation information of the holding user.
  • the second unit data packet further includes: fourth signature data obtained by the first electronic signature device for the second unit data and the device identifier of the second electronic signature, and the second electronic data according to the transaction method of the party 19; Before the signing device stores the at least one second unit data packet in the security chip, the method further includes: the second electronic signature device verifies the fourth signature data, and after the verification is passed, executing the second electronic signature device to the at least one second unit The step of storing the data packet in the security chip.
  • each third unit data packet further comprises: a device identifier of the second electronic signature device.
  • the transaction request further comprises: a data packet identifier; the second electronic signature device stores the at least one second unit data packet in the security chip, and the second electronic signature device determines the received Whether the data packet identifier in the two-unit data packet is the same as the data packet identifier in the sent transaction request. If not, the second unit data packet with different data packet identifiers is discarded. If they are the same, the data packet identifier is the same. The second unit data packet is stored in the security chip.
  • the transaction request further includes: a data packet identification start value; the second electronic signature device storing the at least one second unit data packet in the security chip, comprising: the second electronic signature device determining each Whether the data packet identifier included in the second unit data packet satisfies the preset range determined according to the start value of the data packet identifier, and if not, the second unit data packet whose data packet identifier does not satisfy the preset range is discarded, if If satisfied, the second unit data packet whose data packet identifier meets the preset range is stored in the security chip.
  • the method before the second electronic signature device sends the transaction request to the first electronic signature device, the method further includes: the second electronic signature device obtaining the data packet identification start value by using the counter value of the counter; After the second electronic signature device stores the at least one second unit data packet in the security chip, the method further includes: the counter of the second electronic signature device adds the data packet identifier start value to the received second unit data packet. The total number of calculations yields a new packet identification start value.
  • the transaction method according to any one of the items 23 to 26, after the second electronic signature device stores the at least one second unit data packet in the security chip, the method further comprises: the second electronic signature device according to the received The number of two unit data packets and the currency denomination value represented by each second unit data packet calculate whether the sum of the currency face values represented by the received second unit data packet is consistent with the transaction amount in the transaction request, and if they are inconsistent, Sending a retransmission request to the first electronic signature device; the first electronic signature device receives the retransmission request, and sends the retransmission information to the second electronic signature device according to the retransmission request, wherein the retransmission request includes at least the second electronic signature The device identifier of the device and/or the packet identifier corresponding to each second unit data packet.
  • the method further includes: the second electronic signature device receiving the retransmission information, wherein The sending information includes at least one second unit data packet, and the at least one second unit data packet previously stored in the security chip is deleted, and the at least one second unit data packet retransmitted by the first electronic signature device is re-stored.
  • the method further includes: the second electronic signature device receiving the retransmission information, wherein The sending information includes a second unit data packet that is not received by the second electronic signature device, and stores the unreceived second unit data packet in its security chip.
  • the transaction method according to any one of the items 10 to 29, wherein the second unit data includes at least: currency denomination data, or currency serial number and currency denomination data; and the second unit data packet includes at least one of the following: issuing bank identification and Bank certificate serial number.
  • the method further comprises: the first electronic signature device to have its account The amount is subtracted from the transaction amount to obtain the current account balance, and the transaction amount and/or the current account balance are displayed to the holding user; after the second electronic signature device stores the at least one second unit data packet in the security chip, the method further includes: The second electronic signature device adds the current account amount to the transaction amount to obtain the current account balance, and displays the transaction amount and/or the current account balance to the holding user.
  • the method further comprises: distributing the security chip of the second electronic signature device And storing the storage space of the at least one second unit data packet; the second electronic signature device storing the at least one second unit data packet in the security chip, the second electronic signature device storing the at least one second unit data packet in the corresponding In the storage space, and set the status word of the corresponding storage space to be occupied.
  • the method further comprises: a security chip of the first electronic signature device Allocating a storage space for storing at least one third unit data packet, and storing at least one third unit data packet in the corresponding storage space; and transmitting, by the first electronic signature device, the retransmission information to the second according to the retransmission request
  • the method further includes: the first electronic signature device receiving the confirmation message of the success of the reception returned by the second electronic signature device, and modifying the status word of the storage space of the at least one third unit data packet to be completed. Or empty the storage space.
  • the user's funds are stored in the first electronic signature device or the second electronic signature device in the form of at least one second unit data packet.
  • the payee user the second electronic signature device side
  • the second electronic signature device since the funds are no longer stored in the second electronic signature device in the form of numerical values, the second electronic signature device does not need to be changed by the server.
  • the second electronic signature device of the payee user only needs to receive a certain number of second unit data packets from the first electronic signature device of the payer user, whereby the electronic signature device is signed with other electronic
  • the device conducts electronic transactions, it no longer needs to rely on the server for online payment, and the server does not need to supervise the electronic signature device of the payee user or the payer user, thereby realizing offline electronic transactions.
  • FIG. 1 is a flowchart of a method for processing an electronic signature device according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of another method for processing an electronic signature device according to Embodiment 2 of the present invention.
  • connection In the description of the present invention, it should be noted that the terms “installation”, “connected”, and “connected” are to be understood broadly, and may be fixed or detachable, for example, unless otherwise explicitly defined and defined. Connected, or integrally connected; can be mechanical or electrical; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of the two components.
  • Connected, or integrally connected can be mechanical or electrical; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of the two components.
  • the specific meaning of the above terms in the present invention can be understood in a specific case by those skilled in the art.
  • FIG. 1 is a flowchart of a method for processing an electronic signature device according to an embodiment of the present invention.
  • the method embodiment shown in FIG. 1 includes the following steps S11 to S13:
  • Step S11 The electronic signature device sends a transaction request to the server, wherein the transaction request includes at least: a transaction amount.
  • the electronic signature device may be an electronic device with a signature function, for example, a smart card with a signature function (a bus card, a bank card, a shopping card, etc.), a U shield of the ICBC, and the like.
  • the electronic signature device sends a transaction request to the server.
  • the electronic signature device may establish a connection with an external device (such as a PC or a mobile terminal, etc.), and the transaction is performed by the external device. The request is sent to the server.
  • the electronic signature device has a wired interface or a wireless interface, establishes a wired connection or a wireless connection with the server, and directly sends the transaction request to the server.
  • the wireless connection method may include Bluetooth, NFC approach communication, and WIFI.
  • the electronic signature device in this embodiment can send a transaction request to the server in a variety of ways.
  • the server includes a bank server or a third-party server.
  • the third-party server may be a shopping card stored value server of a certain mall.
  • the electronic signature device needs to perform a recharge operation, and sends a transaction request for refilling to the server (the bank server or the shopping card stored value server of the shopping mall), and the transaction amount carried in the transaction request is the electronic signature device requesting the server.
  • the value of the recharge amount so that the server returns the first unit data packet corresponding to the transaction amount to the electronic signature device (ie, the sum of the currency denominations of the first unit data packet returned by the server is equal to the transaction amount).
  • Step S12 the server receives the transaction request, deducts the transaction amount from the bank account of the electronic signature device, acquires at least one first unit data packet, and transmits the at least one first unit data packet to the electronic signature device;
  • Each of the first unit data packets represents one of a plurality of currency denominations, and each of the first unit data packets includes at least: the first unit data, and the first signature obtained by the server to sign the first unit data. Data, the sum of the currency denominations represented by the at least one first unit data packet is equal to the transaction amount.
  • each first unit data packet represents one currency face value of the plurality of currency denominations, that is, the currency face value has a plurality of types, when the electronic signature is set
  • the first unit data packet represents only one of the currency denominations.
  • the plurality of first unit data packets may represent a plurality of different currency denominations, for example, the number of the first unit data packets is three, each of the first One unit data packet represents currency face value of 1 yuan, 2 yuan and 5 yuan respectively; or, multiple first unit data packets can represent the same currency face value, for example, the number of first unit data packets is 3, each A unit data packet represents a currency denomination of 1 yuan; or, a plurality of first unit data packets represent a currency denomination that includes both the same and different currency denominations, for example, the number of first unit data packets is 3, each first unit data packet represents currency face value of 1 yuan, 1 yuan and 2 yuan.
  • the currency denomination represented by the at least one first unit data packet received by the electronic signature device from the server has a flexible combination.
  • the first unit data packet includes at least first unit data
  • the first unit data includes at least: currency denomination data, or currency serial number and currency denomination data.
  • the currency denomination data is the currency denomination represented by the first unit data packet, thereby identifying the currency denomination represented by the first unit data packet
  • the currency serial number is the unique serial number of each first unit data packet, that is, different numbers The currency numbers in a unit of data packets are different. Thereby, the uniqueness of each first unit data packet can be guaranteed to facilitate identification of the authenticity of the first unit data packet.
  • the first unit data packet further includes at least one of the following: an issuing bank identifier and a bank certificate serial number.
  • the issuing bank identifier is the identification information of the bank that issued the first unit data packet, so that the related information of the corresponding issuing bank can be queried according to the identifier, and the electronic signature device can obtain the identifier according to the issuing bank identifier and the bank certificate serial number.
  • the bank certificate contains the public key of the issuing bank, so that the electronic signature device can verify the signature of the first unit data by using the public key of the issuing bank in the subsequent operation.
  • the first unit data packet further includes: first unit data and first signature data obtained by the server to sign the first unit data.
  • the server separately signatures the first unit data in each first unit data packet by using its own private key, to obtain first signature data corresponding to each first unit data packet.
  • the server sends at least one first unit data packet carrying the first signature data to the electronic signature device, so that the electronic signature device uses the public key of the server to verify the authenticity of the first unit data packet in subsequent operations.
  • the transaction request sent by the electronic signature device to the server further includes: a device identifier of the electronic signature device; each first unit data packet further includes: the server to the first unit data And the second signature data obtained by the device identification signature of the electronic signature device.
  • the server uses the private key of the server to sign the first unit data and the device identifier of the electronic signature device to obtain second signature data corresponding to each first unit data packet.
  • the server sends at least one first unit data packet carrying the second signature data to the electronic signature device, so that the electronic signature device uses the public key of the server to verify the correctness of the first unit data packet in subsequent operations.
  • the server deducts the transaction amount requested by the electronic signature device from the account corresponding to the electronic signature device, and the sum of the currency denominations issued by the electronic signature device is equal to At least one first unit data packet of the transaction amount, after the electronic signature device receives the first unit data packet, that is, after the recharging is successful, the offline transaction can be completed with other electronic signature devices, that is, the network connection with the server is not needed. Transfer money to other electronic signature devices (ie, forward the first unit data packet to other electronic signature devices).
  • the currency face value represented by each first unit data packet may be the same or different, and the number of first unit data packets sent to the electronic signature device and the currency face value represented by each first unit data packet may be determined by the server according to the transaction amount. It is determined that the electronic signature device can also notify the server after determining the transaction amount.
  • the transaction request sent by the electronic signature device may further carry the type of the first unit data packet and Number.
  • the former server can flexibly implement the delivery of the first unit data packet, and the latter can The user's demand for the number of first unit data packets and the face value is satisfied.
  • each first unit data packet represents one of a plurality of currency denominations.
  • the currency denomination represented by the first unit data packet includes: 1 yuan, 2 Yuan, 5 yuan, 10 yuan, 20 yuan, 50 yuan and 100 yuan.
  • the currency face value of the country is also within the scope of protection of the present invention. In this embodiment, only the RMB denomination is used for illustration.
  • the electronic signature device sends a transaction request to the server, wherein the transaction request includes a transaction amount of 10 yuan, and the electronic signature device receives 5 first unit data packets from the server, and the currency face value represented by the 5 first unit data packets
  • the sum of the currency denominations represented by the five first unit data packets is 1 yuan, 1 yuan, 1 yuan, 2 yuan, and 5 yuan, respectively, which is equal to the transaction amount.
  • the electronic signature device may also receive 10 first unit data packets representing the face value of the 1 dollar currency from the server, or 2 first unit data representing the face value of the 5 dollar currency.
  • a first unit packet representing the face value of a 10-yuan currency a first unit packet representing the face value of a 10-yuan currency. That is to say, the currency denomination and the number represented by the first electronic unit currency data packet can be flexibly combined, and only the sum of the currency denominations represented by the received at least one first unit data packet is equal to the transaction amount.
  • the transaction amount is only 10 yuan as an example.
  • the numerical principle is the same, and is not illustrated here. Therefore, in the case that the server determines the number of the first unit data packets according to the transaction amount and the face value represented by each of the first unit data packets, the server can flexibly implement the delivery of the first unit data packet, and various types of data packets can be implemented.
  • the electronic signature device determines the number of the first unit data packets according to the transaction amount, and the face value represented by each first unit data packet
  • the number of requests and the corresponding first unit data packet may be represented.
  • the currency face value is sent to the server, thereby satisfying the user's demand for the number of first unit data packets and the face value.
  • the electronic signature device may further receive at least one ciphertext of the first unit data packet from the server, in order to further improve the security of the data transmission in the process of delivering the first unit data packet by the server.
  • Data wherein the ciphertext data is obtained by the server encrypting at least one first unit data packet, and the electronic signature device may decrypt the ciphertext data to obtain the first unit data packet original text, and the server and the electronic signature device may pass the symmetric key Secure encryption of data is achieved by means of key encryption or decryption or asymmetric key encryption and decryption.
  • the server encrypts the at least one first unit data packet by using: the server encrypts the at least one first unit data packet by using the public key of the electronic signature device (this is an asymmetric key encryption). Alternatively, the server encrypts the at least one first unit data packet using a symmetric key negotiated with the electronic signature device.
  • the electronic signature device After receiving the ciphertext data, the electronic signature device decrypts the ciphertext data by using a decryption method corresponding to the encryption mode of the server, to obtain at least one first unit data packet plaintext, that is, using the private key of the electronic signature device to the secret
  • the text data is decrypted to obtain the first unit data packet plaintext (this is the way of asymmetric key decryption), or the electronic signature device decrypts the ciphertext data by using the symmetric key negotiated with the server to obtain the first unit data packet plaintext.
  • the first unit data packet can be prevented from being copied or falsified during the transmission process, thereby improving the security of data transmission.
  • Step S13 The electronic signature device receives the at least one first unit data packet, and verifies the first signature data in the at least one first unit data packet, and after the verification is passed, stores the at least one first unit data packet in the security. In the chip.
  • the electronic signature device is provided with a security chip
  • the security chip has an independent processor and a storage unit, and can store the PKI digital certificate and the key, and other characteristic data.
  • the data is subjected to encryption and decryption operations to provide data encryption and identity security authentication services for the user.
  • the first unit data packet stored in the security chip of the electronic signature device cannot be illegally read, and the stored data security can be ensured.
  • the transaction method further includes: the electronic signature device uses its security chip allocation for storing the at least one first unit.
  • the storage space of the packet stores the at least one first unit data packet in the security chip, and specifically includes: the electronic signature device stores the at least one first unit data packet in a corresponding storage space, and stores the corresponding storage.
  • the status word for the space is set to Occupied.
  • the security chip allocates one storage space for each first unit data packet, and one storage space can only store one first unit data packet, and the transaction record of the electronic signature device also records the transaction received from the server in a transaction. The location of the storage space stored by each first unit packet.
  • the status word of the storage space is used to identify whether the storage space has been occupied. If it is already occupied, the electronic signature device cannot store the first unit data packet in the occupied storage space. When all the storage space allocated by the security chip is occupied, the electronic signature device needs to perform an operation of requesting the server to update the data packet or apply for a new storage space, wherein, as an optional implementation manner, the electronic signature device can apply for a new one. Storage space to store the newly received first unit packet. As another optional implementation manner, the electronic signature device may further request the server to update the locally stored first unit data packet.
  • the electronic signature device may request the server to store N locally (N is a positive integer greater than 1
  • N is a positive integer greater than 1
  • the first unit data packet representing the small face value is replaced by 1 or M (M ⁇ N)
  • the first unit data packet representing the face value of the large currency is stored, as long as the stored currency amount is unchanged, thereby releasing Multiple storage spaces, thereby saving storage space to store the newly received first unit data packet.
  • the electronic signature device may further encrypt each first unit data packet to obtain ciphertext data of each first unit data packet, and each confidentiality The text data is stored in the corresponding storage space. Thereby, it can be ensured that the first unit data packet stored in the storage space of the security chip cannot be maliciously copied or changed, thereby ensuring the security of storing the first unit data packet.
  • each first unit data packet includes at least: the first unit data and the server pair.
  • the first unit data is signed by the first unit data, thereby enabling the electronic signature device to verify the authenticity of the first unit data packet.
  • the first signature data is signature data obtained by the server by using the private key of the server to sign the first unit data.
  • the verifying the first signature data by the electronic signature device comprises: the electronic signature device performing the verification of the first signature data by using the public key of the server.
  • the bank server performs HASH operation on the first unit data to obtain the digest message A1 of the first unit data, and uses the private key of the bank server to sign the digest message A1 to obtain the first signature.
  • the data is carried in the first unit data packet and sent to the electronic signature device.
  • the electronic signature device can perform the verification of the first signature data by using the public key of the bank server. Specifically, the electronic signature device uses the public key of the bank server to calculate the first electronic signature data to obtain the operation result A2, and obtains the operation result A2.
  • the first unit data in the first unit data packet is subjected to HASH operation to obtain the digest message A3 of the first unit data, and the operation result A2 is compared with the digest message A3. If the comparison result is consistent, the electronic signature device pairs An electronic signature data check was passed.
  • the electronic signature device may obtain the public key of the bank according to the bank certificate serial number and/or the issuing bank identifier in the first unit data packet. For example, the electronic signature device may wait and receive according to the issuing bank identifier in the first unit data packet.
  • the issuing bank server corresponding to the verified first signature data obtains the bank certificate of the bank, and obtains the bank's public key from the bank certificate; for example, the electronic signature device can pre-store the bank certificate of each bank according to the first unit data packet.
  • the bank certificate serial number in the bank certificate is obtained from the pre-stored bank certificate, and the bank certificate corresponding to the first signature data to be verified is obtained, and the bank public key is obtained from the corresponding bank certificate. Therefore, the electronic signature device uses the public key of the bank to perform verification on the first signature data carried in the first unit data packet, and can verify the authenticity of the first unit data packet.
  • the above description is only taking the server as a bank server as an example, but the embodiment is not limited to the bank server, and the specific implementation manners of other third-party servers, such as a supermarket shopping card stored value server, etc. belong to the protection scope of the present invention. Within the fence.
  • the electronic signature device further confirms whether the object sent by the server is indeed the electronic signature device, so as to ensure that the data packet sent by the storage server is incorrect, in the step of ensuring that the received first unit data packet is authentic.
  • the transaction method further includes: the electronic signature device verifying the second signature data, and executing the storing the at least one first unit data packet after the verification is passed Operation in the security chip.
  • the second signature data is obtained by the server for the first unit data and the device identifier of the electronic signature device.
  • the transaction request sent by the electronic signature device to the server further includes: The device identifier of the electronic signature device; each first unit data packet includes at least: first unit data, second signature data obtained by the server for the first unit data and the device identifier of the electronic signature device, thereby enabling the electronic signature device to Verify the authenticity and correctness of the first unit packet.
  • the second signature data is signature data obtained by the server by using the private key of the server to sign the device identifier of the first unit data and the electronic signature device, that is, each second signature data.
  • the signature object is a combination of each of the first unit data and the device identification of the electronic signature device.
  • the verifying the second signature data by the electronic signature device comprises: the electronic signature device separately checking each second signature data by using a public key of the server.
  • the bank server uses the private key of the server to sign the first unit data and the device identifier of the electronic signature device to obtain the second signature data, which is carried in the first unit data packet and sent to the electronic signature device.
  • the electronic signature device can authenticate the second signature data by using the public key of the bank server.
  • the electronic signature device may obtain the bank certificate of the bank according to the bank certificate serial number and/or the issuing bank identifier in the first unit data packet, and obtain the public key of the bank from the bank certificate.
  • the electronic signature device may be configured according to the The issuing bank identifier in one unit data packet acquires the public key of the bank from the issuing bank server corresponding to the second signature data to be verified; for example, the electronic signature device may pre-store the bank certificate of each bank according to the first unit data
  • the bank certificate serial number in the package obtains the bank certificate corresponding to the second signature data to be verified from the pre-stored bank certificates, and obtains the bank public key from the corresponding bank certificate.
  • the electronic signature device uses the public key of the bank to perform verification on the second signature data carried in the first unit data packet, which can not only verify the authenticity of the first unit data packet, but also prove that the first unit data packet is indeed
  • the bank server sends the electronic signature device to the electronic signature device to verify the correctness of the first unit data packet.
  • the server is a bank server, but the embodiment is not limited to the bank server, and the specific implementation manners of other third-party servers, such as a supermarket shopping card stored value server, are within the protection scope of the present invention.
  • the transaction The method further includes: calculating, by the electronic signature device, the currency face value represented by the received first unit data packet according to the received number of the at least one first unit data packet and the currency face value represented by each first unit data packet The sum is consistent with the transaction amount in the transaction request, and if not, the retransmission request is sent to the server; the server receives the retransmission request.
  • the electronic signature device receives 5 first unit data packets from the server, and calculates whether the sum of the currency face values represented by the 5 first unit data packets is equal to 10 yuan, and if less than 10 yuan, the server Send a resend request.
  • the electronic signature device can solve the problem of insufficient currency face value represented by the received first unit data packet by transmitting a retransmission request to the server.
  • the electronic signature device After the electronic signature device sends a resend request to the server, the electronic signature device receives the retransmission information returned by the server.
  • the retransmission information returned by the server may be different.
  • the retransmission request may be The device identification and transaction record of the electronic signature device (such as the number of each transaction, account information, time stamp, transaction amount, and the number of received first unit data packets and the currency face value represented, etc.) Will also correspond to the record),
  • the retransmission request may also carry the received first unit.
  • the packet identifier of the data packet (which can uniquely identify the identifier of a first unit data packet, such as the unique identifier configured by the server for each first unit data packet, or the currency serial number).
  • the server can query Which first unit data packets are lost during the missed transmission or transmission, and the first unit data packets that are lost or lost during transmission are sent to the electronic signature device.
  • the following is an exemplary illustration of the server resending the first unit of electronic data packets:
  • the transaction method further includes: the server transmitting the retransmission information to the electronic signature device according to the retransmission request, wherein the retransmission information includes at least one first unit data packet; and the electronic signature device receives the retransmission And deleting at least one first unit data packet previously stored in the security chip, and re-storing at least one first unit data packet retransmitted by the server.
  • the electronic signature device after sending the resend request to the server, receives the retransmission information sent by the server according to the retransmission request, where the retransmission request includes at least: the device identifier of the electronic signature device and The transaction record, the retransmission information includes at least one first unit data packet, that is, in the optional implementation, the server resends all the first unit data packets corresponding to a transaction to the electronic signature device, in this embodiment.
  • the server deals with the unit electronic signature tool, it also stores the transaction records corresponding to each transaction (such as the number of each transaction, account information, time stamp, transaction amount, and the number of first unit packets sent).
  • the server will query The first unit data packet of the transaction that the electronic signature device requests to resend is resent to the electronic signature set. To ensure that the electronic signature device receives the correct transaction complete first unit of data packets, the server and the electronic signature device (such as a top-correct).
  • the transaction method further includes: the electronic signature device storing the at least one first stored in the security chip.
  • Unit data packet deletion ie, in this alternative embodiment, since the server will resend the first unit data packet of the transaction to the electronic signature device, the electronic signature device must all the previously received transactions.
  • a unit data packet that is, at least one first unit data packet corresponding to the transaction previously stored in the security chip is deleted, and re-storing at least one first unit data packet retransmitted by the server, wherein the electronic signature device is executing
  • the status word of the occupied storage space is set to be unoccupied, and the electronic signature device can store the re-received first unit data packet into the storage space allocated by the previous security chip.
  • set the status word of the occupied storage space to be occupied, thereby ensuring the electronic signature Preparation will not repeat unit storing a first data packet, and to ensure that the same storage unit can only store a first packet.
  • the transaction amount in the transaction request of the electronic signature device is 10 yuan
  • the electronic signature device receives 5 values representing the face value of the 2 yuan currency respectively sent by the server.
  • the first unit data packet but due to data loss during transmission, the electronic signature device only receives four first unit data packets respectively representing the denomination of the 2-yuan currency, and the sum of the currency denominations is 8 yuan, which is not equal to the transaction amount of 10 yuan.
  • the electronic signature device sends a retransmission request to the server, and receives retransmission information sent by the server according to the retransmission request, where the retransmission request includes: a device identifier of the electronic signature device and a transaction record, and the server receives the After the request is resent, the transaction corresponding to the electronic signature device may be queried according to the device identifier and the transaction record, and the server resends the first unit data packet of the transaction that the queried electronic signature device requests to resend to the transaction.
  • the electronic signature device that is, the retransmission information sent by the server to the electronic signature device, includes five first unit data packets respectively representing the denomination of the 2-yuan currency.
  • the electronic signature device stores the four previously stored in the security chip for the two-yuan currency.
  • the first unit packet of the denomination is deleted, and the first unit packet representing the denomination of the 2-yuan currency, respectively, is re-stored by the server.
  • the server can resend all of the first unit data packets required for the transaction to the electronic signature device, thereby enabling the transaction to enable the transaction. Done successfully.
  • the transaction method further includes: the server sending the retransmission information to the electronic signature device according to the retransmission request, wherein the retransmission information includes the first unit data packet that is not received by the electronic signature device.
  • the electronic signature device stores the unreceived first unit data packet in the security chip.
  • the electronic signature device after sending the resend request to the server, receives the retransmission information sent by the server according to the retransmission request, where the retransmission request includes at least: the device identifier of the electronic signature device, a transaction record and a received packet identifier of each first unit data packet, the retransmission information including a first unit data packet not received by the electronic signature device, that is, in the optional embodiment, the server is heavy to the electronic signature device A first unit data packet missed or lost during transmission is sent, and a corresponding transaction corresponding to the electronic signature device can be queried according to the device identification and the transaction record, and the server will query the electronic signature.
  • the first unit data packet corresponding to the unidentified data packet identifier of the transaction requesting retransmission of the device is resent to the electronic signature device to ensure that the electronic signature device receives the complete first unit data packet, the server and the electronic signature.
  • the transaction of the equipment is correct (such as recharge).
  • the optional implementation manner can reduce the data transmission volume of the server, greatly reduce the workload of the server, and improve the working efficiency of server retransmission.
  • the electronic signature device after the electronic signature device receives the first unit data packet resent by the server, the electronic signature device stores the first unit data packet that has not been received before in the security chip, that is, the electronic signature device The re-received first unit data packet is stored in the storage space allocated before the security chip, and the status word of the occupied storage space is set to be occupied, thereby ensuring that only one first unit data packet can be stored in the same storage space.
  • the transaction amount in the transaction request of the electronic signature device is 5 yuan
  • the electronic signature device receives two of the two face currency values respectively sent by the server.
  • the first unit data packet (referred to as a 2-yuan data packet), and a first unit data packet (referred to as a 1-yuan data packet) representing a denomination of a 1-yuan currency, but the electronic signature device only receives 2 due to data loss during transmission.
  • a 2-yuan data packet, the sum of currency face values is 4 yuan, which is not equal to the transaction amount of 5 yuan.
  • the electronic signature device sends a retransmission request to the server, and receives the retransmission information sent by the server according to the retransmission request, and the retransmission request further carries the data packet identifier of two 2-yuan data packets, and the server receives the packet identifier.
  • the transaction for the electronic signature device can query all the corresponding first unit data packets, and then the packet identifier of the unrequested data packet in the retransmission request can be found, and the server can The metadata packet is retransmitted to the electronic signature device, that is, the retransmission information sent by the server to the electronic signature device includes one 1-yuan data packet.
  • the electronic signature device stores one 1-byte data packet retransmitted by the server in the security chip.
  • the retransmission request sent by the electronic signature device to the server may include the data packet identifier of the part of the first unit data packet that has been received, and the server may determine the retransmission information according to the data packet identifier in the retransmission request.
  • the amount of transmission also ensures that the transaction can be completed smoothly.
  • each transaction in a plurality of transactions can be implemented in the above manner.
  • the storage space of the electronic signature device is limited after all. Therefore, the remaining space of the electronic signature device needs to be monitored at any time, so as to release the storage space in an instant, and avoid the problem that the transaction fails if there is no extra space in the transaction process.
  • the electronic signature device is further configured.
  • a counter is provided through which the remaining storage space of the electronic signature device can be monitored in real time. Specifically, after the step S13, the transaction method further includes: the electronic signature device uses the count value of the counter to obtain the total number of the first unit data packets currently stored.
  • each transaction the counter adds the number of the first unit data packet received by the transaction, and after multiple transactions, the counter value of the counter is accumulated to a value when the value reaches a preset value.
  • the storage space of the electronic signature device has been allocated, there is no redundant storage space.
  • the electronic signature device needs to perform an operation of requesting the server to update the data packet or apply for a new storage space (as described above).
  • each storage space has the same size
  • each first unit data packet has the same size and matches the size of the storage space, for example, the storage space allocated by the electronic signature device to a first unit data packet.
  • the size is 2M
  • the 2M storage space can store a first unit data packet
  • a security chip reserves the space for storing the first unit data packet as 1G
  • the electronic signature device can store up to 512 first unit data.
  • the package, the preset value can be set to 512.
  • the remaining space of the electronic signature device can be monitored in real time, and the redundant storage space is released in time, so as to avoid the problem that the transaction fails if there is no extra space in the transaction process.
  • the electronic signature device can also use the count value of the counter to obtain the total number of first unit data packets of each currency denomination stored in the security chip.
  • the electronic signature device can obtain the total amount of money of the currently stored first unit data packet according to the currency face value and the number of the money represented by each stored first unit data packet.
  • the transaction method further includes: the electronic signature device includes the transaction amount into the current account balance, and displays the transaction amount and/or the current account balance to the holding user.
  • the user holding the electronic signature device can query the transaction amount and the current account balance on his own device.
  • the user's funds can be stored in the user's electronic signature device in the form of data packets, and the number of data packets is one or more.
  • the electronic signature device does not need to change the stored value by networking with the server, and only needs one or more firsts that meet the consumption amount.
  • the unit data packet can be sent to the payee. Therefore, the electronic signature device does not need to rely on the server for online payment when performing electronic transactions with other electronic signature devices, and the server no longer needs to supervise the electronic signature device, thereby truly Implement offline electronic trading.
  • FIG. 2 is a flowchart of another method for processing an electronic signature device according to an embodiment of the present invention. As shown in FIG. 2, the transaction method includes the following steps S21 to S23:
  • Step S21 The second electronic signature device sends a transaction request to the first electronic signature device, where the transaction request includes at least: a transaction amount;
  • the first electronic signature device and the second electronic signature device can perform offline transactions (ie, no need to complete the transaction with the server), and both can be electronic devices with a signature function, for example, having a signature function. Smart cards (bus cards, bank cards, shopping cards, etc.), U-Shields from ICBC, etc.
  • the first electronic signature device and the second electronic signature device may each be provided with a wired interface or a wireless interface, and the second electronic signature device may be connected to the first electronic device by using a wired or wireless connection.
  • the signing device establishes a communication connection, wherein the wireless connection manner includes but is not limited to: Bluetooth, NFC near field communication or WIFI.
  • the second electronic signature device can also establish a connection with the external device through a wired or wireless connection, and send a transaction request to the first electronic signature device through the external device, and the first electronic signature device can also connect to the external device through a wired or wireless connection.
  • an electronic device capable of communicating such as a mobile phone, a PC, or a tablet computer.
  • the second electronic signature device of the cashier at the mall sends a transaction request carrying the transaction amount to the first electronic signature device of the user, and the transaction amount is the amount that the user needs to pay for the purchase.
  • the first electronic signature device sends the second unit data packet corresponding to the transaction amount to the second electronic signature device (ie, the sum of the currency denominations of the second unit data packet sent by the first electronic signature device is equal to the transaction amount)
  • two The electronic signature devices can be completely independent and do not need to be connected to the network.
  • the above transactions can be realized between two cards, and offline transactions can be realized, and the transaction is simple and quick.
  • the second electronic signature device may establish a secure channel with the first electronic signature device. And use the secure channel for data transmission. Thereby, the security of data transmission between the second electronic signature device and the first electronic signature device can be improved.
  • Step S22 The first electronic signature device receives the transaction request, and acquires at least one second unit data packet from the security chip, and sends the at least one second unit data packet to the second electronic signature device.
  • each second unit data packet represents one currency face value of the plurality of currency denominations
  • each second unit data packet includes at least: the second unit data, and the third signature data obtained by the server for signing the second unit data, The sum of the currency denominations represented by the at least one second unit data packet is equal to the transaction amount;
  • each second unit data packet represents one currency denomination of the plurality of currency denominations, and the sum of the currency denominations represented by the at least one second unit data packet is equal to the transaction amount.
  • each second unit data packet represents one of a plurality of currency denominations, that is, a plurality of currency denominations are used, and when the first electronic signature device transmits only one second unit data packet to In the case of the second electronic signature device, the second unit data packet represents only one of the currency denominations.
  • the second unit data packet in this embodiment has the same features as the first unit data packet provided in Embodiment 1. For a detailed description of the second unit data packet, refer to the first unit data packet in Embodiment 1. Description, no longer repeat here.
  • the second unit data packet includes at least second unit data
  • the second unit data includes at least: currency denomination data, or currency serial number and currency denomination data.
  • the currency denomination data is the currency denomination represented by the second unit data packet, thereby identifying the currency denomination represented by the second unit data packet
  • the currency serial number is the unique serial number of each second unit data packet, that is, different numbers The currency numbers in the two-unit data package are different. Thereby, the uniqueness of each second unit data packet can be guaranteed to facilitate identification of the authenticity of the second unit data packet.
  • the second unit data packet further includes at least one of the following: an issuing bank identifier and a bank certificate serial number.
  • the issuing bank identifier is the identification information of the bank that issues the second unit data packet
  • the second electronic signature device can query the related information of the corresponding issuing bank according to the identifier
  • the second electronic signature device can
  • the issuing bank identifier and the bank certificate serial number are used to obtain the corresponding bank certificate of the issuing bank, and the bank certificate includes the issuing bank's public key, so that the subsequent second electronic signature device can verify the signature of the second unit data by using the issuing bank's public key.
  • each second unit data packet includes at least: second unit data, and third signature data obtained by the server to sign the second unit data.
  • the server separately signs the second unit data in each second unit data packet by using its own private key, to obtain third signature data corresponding to each second unit data packet.
  • the server uses its own private key to sign The name refers to the bank server obtaining the corresponding private key according to the issuing bank identifier and the bank certificate serial number, and signing with the private key.
  • the server sends the at least one second unit data packet carrying the third signature data to the first electronic signature device.
  • the device Receiving, by the second electronic signature device, the at least one second unit data packet carrying the third signature data from the first electronic signature device, when the second electronic signature device performs the collection operation from the first electronic signature device, so as to facilitate the second electronic signature in the subsequent step.
  • the device can use the server's public key to verify the authenticity of the second unit packet.
  • the transaction request sent by the second electronic signature device to the first electronic signature device further includes: a device identifier of the second electronic signature device; each second unit data packet is further The method includes: the fourth signature data obtained by the first electronic signature device by using the second unit data and the device identifier of the second electronic signature device.
  • the first electronic signature device uses the private key of the first electronic signature to sign the second unit data and the device identifier of the second electronic signature device to obtain a fourth signature corresponding to each second unit data packet. data.
  • the correctness of the second unit data packet is verified using the public key of the first electronic signature device.
  • the first electronic signature device deducts the transaction amount requested by the second electronic signature device from the account balance of the second electronic signature device, and is the second electronic signature device.
  • the sum of the issued currency face values is equal to at least one second unit data packet of the transaction amount, and after the second electronic signature device receives the second unit data packets, if the transfer is successful, the offline transaction is completed, and the second electronic signature device is completed.
  • the first electronic signature device transfer (ie, receiving at least one second unit data packet sent by the first electronic signature device) may be received without networking with the server.
  • the currency denomination value represented by each second unit data packet may be the same or different, and the number of the second unit data packet sent by the first electronic signature device to the second electronic signature device and the currency represented by each second unit data packet
  • the face value may be determined by the first electronic signature device according to the transaction amount, or may be notified by the second electronic signature device according to the transaction amount, and then notified to the first electronic signature device, for example, as an optional implementation manner in this embodiment, the second
  • the transaction request sent by the electronic signature device may also carry the type and number of the required second unit data packets.
  • the first electronic signature device of the former can flexibly implement the delivery of the second unit data packet, and the latter can satisfy the requirement of the number of the second unit data packet and the face value of the user of the second electronic signature device.
  • the second electronic signature device determines the number of the second unit data packets according to the transaction amount and the currency denomination value represented by each second unit data packet
  • the security chip of the first electronic signature device does not store the second
  • the second unit data packet corresponding to the currency denomination requested by the electronic signature device or the number of stored data is insufficient.
  • the first electronic signature device may be used to the second electronic signature device.
  • the prompt information may include: information that the second unit data packet of the corresponding currency denomination does not exist or the number of the data is insufficient, and the second electronic signature device may replace the currency denomination represented by the second electronic unit currency data packet according to the transaction amount.
  • a combination strategy with the number, or a combination strategy of the currency denomination and the number represented by the second electronic unit currency data packet by the first electronic signature device according to the transaction amount.
  • the first electronic signature device receives the transaction request of the second electronic signature device to transfer 10 yuan, and requests to send 5 second unit data packets representing 2 yuan (hereinafter referred to as 2 yuan data packets), but the first electronic signature device If there are only 4 binary data packets, the message is sent to the second electronic signature device with only 4 binary data packets and the number of 2 metadata packets is insufficient.
  • the second electronic signature device can replace the combination policy, for example, Returning, to the first electronic signature device, a response requesting to send 4 2-yuan data packets and 2 1--value data packets, or the first electronic signature device receiving the second electronic signature after transmitting the prompt information to the second electronic signature device
  • the acknowledgment response of the device the first electronic signature device may randomly determine a combination policy, for example, sending four 2-yuan data packets and two 1-yuan data packets to the second electronic signature device, thereby solving the first electronic One of the second unit data packets stored in the security chip of the signing device A problem with insufficient or non-existent.
  • the embodiment provides The method further includes: the first electronic signature device sends the information to be changed, and the second electronic signature device receives the information to be changed, wherein the information to be changed is determined by the first electronic signature device according to the transaction amount and the number stored in the security chip.
  • the currency denomination represented by the two-unit data packet determines, for example, the information to be changed may include a currency denomination that requires the second electronic signature device to return the change. If the second electronic signature device stores a second unit data packet representing the face value of the change coin currency, or the sum of the currency face values stored is equal to the second unit data packet for retrieving the change, the second electronic signature device may The first electronic signature device returns an acknowledgment response, that is, the first electronic signature device is notified that the second unit data packet for the change is stored, and the first electronic signature device receives the change information sent by the second electronic signature device (ie, returns a confirmation Correspondingly, the first electronic signature device acquires at least one second unit data packet from the security chip, wherein the sum of the currency denominations represented by the at least one second unit data packet is equal to the transaction amount plus the currency for retrieving the change face value.
  • the first electronic signature device cannot use the second unit data packet (hereinafter referred to as a 2-yuan data packet) respectively representing the denomination of the 2-yuan currency in the security chip of the first electronic signature device.
  • the five 2-yuan data packages piece together the 7-yuan currency denomination, and the first electronic signature device can only use the five 2-yuan data packets stored in the security chip to piece together the currency face value that is closest to the transaction amount of 7 yuan and larger than the transaction amount.
  • the first electronic signature device can use the four 2-yuan data packets to piece together the 8-yuan currency denomination, and the second electronic signature device needs to retrieve 1 dollar change, that is, the first electronic signature device sends 4 2-yuan data packets to the first electronic signature device.
  • the second electronic signature device needs to return a 1-yuan data packet (a second unit data packet representing a 1-yuan currency denomination) to the first electronic signature device.
  • the first electronic signature device sends, to the second electronic signature device, the information to be changed that carries the change of change of 1 yuan, wherein the information to be changed is used to ask whether the second electronic signature device can retrieve the sum of the currency values represented by the second electronic signature device.
  • the second unit packet is 1 yuan. If the security chip of the second electronic signature device stores the second unit data packet whose representative currency denomination sum is 1 yuan, sending the change information to the first electronic signature device, that is, agreeing to return the representative to the first electronic signature device The second unit data packet of 1 yuan or the sum of currency face values is 1 yuan. After receiving the change information, the first electronic signature device acquires four 2-yuan data packets from the security chip and sends them to the second electronic signature device, and the second electronic signature device returns to the first electronic signature device for 1 yuan. A packet (a second unit packet representing the face value of a currency). Therefore, when it is impossible to piece together the second unit data packet whose sum of the face value of the money represented is equal to the transaction amount, the electronic transaction can be completed through the zero change mechanism, making the electronic transaction more convenient.
  • the second unit data packet is confusing, and the uniqueness of the same second unit data packet in the payment process is ensured.
  • the manner in which the first electronic signature device sends the at least one second unit data packet to the second electronic signature device includes at least one of the following two types:
  • step S22 after the first electronic signature device transmits the at least one second unit data packet to the second electronic signature device, the first electronic signature device deletes the acquired at least one second unit data packet, because the first electronic signature
  • the device obtains the at least one second unit data packet according to the transaction amount and sends the data to the second electronic signature device the local device data packet that has been sent remains in the local device, and the deletion action is not automatically performed.
  • the transmitted Two unit data packets, and the status word of the corresponding storage space is set to be unoccupied.
  • the first electronic signature device can delete the saved second unit data packet stored by the first electronic signature device after the second unit data packet is saved, thereby ensuring that the first electronic signature device cannot be reused and cannot be restored.
  • the second unit data packet guarantees the uniqueness of the same second unit data packet in the payment process;
  • the second electronic signature device After receiving the at least one second unit data packet sent by the first electronic signature device, the second electronic signature device directly stores, because the first electronic signature device has deleted the at least one second unit data packet, The second unit data packet received by the second electronic signature device is unique, and duplicate data packets do not appear.
  • the at least one second unit data packet sent by the first electronic signature device to the second electronic signature device is in a cipher text form, that is, the first electronic signature device sends the at least one second unit data packet to the second electronic signature.
  • the device includes: the first electronic signature device encrypts the at least one second unit data, obtains at least one third unit data packet, and sends the at least one third unit data packet to the second electronic signature device; Receiving, by the signature device, the at least one second unit data packet sent by the first electronic signature device, the second electronic signature device receiving the at least one third unit data packet, and decrypting the at least one third unit data packet to obtain at least A second unit packet.
  • the second electronic signature device receives five third unit data packets representing two yuan from the first electronic signature device, and decrypts each third unit data packet representing two yuan to obtain five second units representing two yuan. data pack.
  • the at least one third unit data packet received by the second electronic signature device includes a data ciphertext, wherein the data ciphertext is encrypted by the first electronic signature device for some or all of the data in each second unit data packet. of.
  • the second unit data packet may include: second unit data, third signature data, fourth signature data, a data packet identifier, and a device identifier of the second electronic signature device, where the first electronic signature device Encrypting part of the data in the two unit data packet means that the first electronic signature device encrypts at least the second unit data in the second unit data packet, for example, the first electronic signature device may be in the second unit data packet.
  • the second unit data and the packet identifier are encrypted.
  • the encryption operation performed by the first electronic signature device on some or all of the data in each second unit data packet is an irreversible operation, that is, the first electronic signature device can encrypt the third unit data packet, but cannot Decrypting the third unit data packet from the third unit data packet, so that when the obtained at least one third unit data packet covers the corresponding at least one second unit data packet, only the encrypted content is stored in the first electronic signature device
  • the third unit data packet cannot recover the second unit data packet because it cannot decrypt the third unit data packet, and the second unit data packet cannot be reused.
  • the first electronic signature device encrypts the at least one second unit data, including: the first electronic signature device uses the public key of the second electronic signature device for at least each second unit Encrypting the second unit data in the data packet to obtain the data ciphertext; the second electronic signature device decrypting the at least one third unit data packet, including: the second electronic signature device using the private key of the second electronic signature device, at least for each The data ciphertext in the third unit data packet is decrypted.
  • the first electronic signature device encrypts the at least one second unit data packet, including: the first electronic signature device utilizes a symmetric key associated with the second electronic signature device, at least for each The second unit data in the two unit data packet is encrypted to obtain the data ciphertext; the second electronic signature device decrypts the at least one third unit data packet, including: the second electronic signature device uses the first electronic signature device The symmetric key decrypts at least the data ciphertext in each third unit data packet.
  • the second electronic signature device may further include a public key of the second electronic signature device in the transaction request sent to the first electronic signature device, or the first electronic signature device may authenticate the platform to the third party.
  • the first electronic signature device can acquire the public key of the second electronic signature device.
  • the method provided by the embodiment further includes: the first electronic signature device overwrites each second stored in the security chip with each third unit data packet.
  • Unit data packet covering each second unit data packet stored in the security chip with each third unit data packet means that the first electronic signature device writes each generated third unit data packet into a corresponding original
  • the storage space of the two-unit data packet replaces the original second unit data packet.
  • the second unit data packet with the data packet identified as 1*** is encrypted to generate a third unit data packet, and is written into the storage space corresponding to the 1***.
  • the security chip of the first electronic signature device stores only the second electronic signature device for the second unit data packet that has been sent to the second electronic signature device.
  • the third unit data packet obtained by the public key is encrypted, and the first electronic signature device cannot have the private key of the second electronic signature device, so the first electronic signature device cannot decrypt the third unit data packet.
  • the second unit data packet cannot be recovered, and the second unit data packet cannot be reused, the uniqueness of the same second unit data packet is guaranteed, and the third unit data packet is utilized by the second electronic signature device.
  • the public key is encrypted, so the third unit data packet can only be decrypted by the second electronic signature device (only the second electronic signature device stores its own private key), so that only the payee (ie, the second electronic signature device) Can have and can use the unencrypted second unit data packet, even if other electronic signature devices illegally obtain the third unit data packet, because there is no
  • the private key of the second electronic signature device cannot be decrypted and the acquired second unit data packet cannot be used, thereby ensuring the security of the second unit data packet circulation.
  • the symmetric key is negotiated by the first electronic signature device and the second electronic signature device, that is, the symmetric key used by the first electronic signature device in performing the encryption operation and the second The symmetric key used by the electronic signature device to perform the decryption operation is the same.
  • the method provided by the embodiment further includes: the first electronic signature device overwrites each second stored in the security chip with each third unit data packet. Unit the packet and delete the symmetric key.
  • covering each second unit data packet stored in the security chip with each third unit data packet means that the first electronic signature device writes each generated third unit data packet into a corresponding original The storage space of the two-unit data packet replaces the original second unit data packet.
  • the second unit data packet with the data packet identified as 1*** is encrypted to generate a third unit data packet, and is written into the storage space corresponding to the 1***.
  • the third unit data packet can be decrypted and restored to the second unit data packet.
  • the symmetric key must be forcibly deleted, whereby the first electronic signature device sends the second unit data packet after the second unit data packet payment Giving a second unit data packet of the second electronic signature device, the security chip of the first electronic signature device storing only the corresponding third unit data packet obtained by the second electronic signature device using the symmetric key encryption, and The signature device has deleted the symmetric key used for encryption. Therefore, the first electronic signature device can no longer decrypt the third unit data packet, and cannot recover the second unit data packet, and the second unit cannot be reused.
  • the unit data packet guarantees the uniqueness of the same second unit data packet, and the symmetric key has only the first electronic signature And the second electronic signature device knows that, therefore, the third unit data packet can only be decrypted by the second electronic signature device, so that only the payee (ie, the second electronic signature device) can own and can use the unencrypted second Unit data packet, even if the other electronic signature device illegally acquires the third unit data packet, the second unit data packet cannot be obtained by decryption without the symmetric key, thereby ensuring the security of the second unit data packet circulation. Sex.
  • the symmetric key may be an exclusive OR factor
  • the exclusive OR factor may be a set of characters or numbers negotiated by the second electronic signature device and the first electronic signature device.
  • a sequence for performing an exclusive OR operation specifically, the first electronic signature device encrypts at least the second unit data in each second unit data packet by using a symmetric key associated with the second electronic signature device to obtain data
  • the ciphertext includes: the first electronic signature device uses an exclusive OR factor to perform an exclusive OR operation on the second unit data in each second unit data packet to obtain a data ciphertext; and the second electronic signature device utilizes the first electronic signature
  • the symmetric key associated with the device decrypts at least the data ciphertext in each second unit data packet, including: the second electronic signature device uses the XOR factor to perform at least the data ciphertext in each third unit data packet.
  • the XOR operation also belongs to a symmetric decryption operation mode, but the XOR operation is faster than other symmetric decryption operations. Therefore, the second electronic signature device can be modified to decrypt the third unit data packet. The efficiency of two unit packets.
  • step S22 at least the above manners can be prevented to prevent the electronic signature device from illegally reusing the same second unit data packet, thereby causing confusion in the circulation of the second unit data packet, and ensuring the same second unit data packet.
  • Uniqueness in the payment process is not exclude other embodiments as long as the same technical effects can be achieved.
  • the third unit data packet is ciphertext, which ensures the security of the transmitted data, and even if intercepted by other devices, it is difficult to crack, further improving the security of the second unit data packet circulation.
  • the confirmation of the holding user of the first electronic signature device is also required to perform the subsequent transaction operation, which is optional in this embodiment.
  • the transaction request sent by the second electronic signature device includes at least: a device identifier of the second electronic signature device.
  • the first electronic signature device prompts the holding user for the transaction amount and the device identifier of the second electronic signature device, and receives the Hold the user's confirmation message.
  • the device identifier of the second electronic signature device may be a factory serial number of the second electronic signature device, or may be a device name of the second electronic signature device, or may be a second
  • the electronic signature device holds the name of the user.
  • the holding user of the first electronic signature device can confirm whether the second electronic signature device is a transaction object agreed by the user, and the user selects to confirm the transaction only after the user approves the transaction amount and the transaction object.
  • the security of the transaction is guaranteed by the user's confirmation of the transaction.
  • the first electronic signature device is provided with a display screen or a speaker, and displays the transaction amount and the device identifier of the second electronic signature device through the display screen set by itself or through the speaker voice set by itself; or The first electronic signature device establishes a connection with the external device, and prompts the holding user with the transaction amount and the device identifier of the second electronic signature device through the display screen or the speaker of the external device. This makes it easy for the user to confirm the payment amount and whether the payee is correct.
  • the first electronic signature device may be provided with a confirmation button, and the user confirms by using the confirmation button.
  • the confirmation information input component may be further disposed on the first electronic signature device, and the confirmation information input component may specifically include: a PIN code input keyboard or a fingerprint input component. Therefore, the user can input the confirmation information by inputting the PIN code or the fingerprint, and while confirming the related information of the electronic transaction, the first electronic signature device can also verify the identity of the holding user, thereby further improving the electronic transaction. safety.
  • Step S23 The second electronic signature device receives the at least one second unit data packet, and verifies the third signature data in the at least one second unit data packet, and after the verification is passed, the at least one second unit data packet is Stored in a security chip.
  • the second electronic signature device is provided with a security chip, and the security chip has an independent processor and a storage list therein.
  • the device can store the PKI digital certificate and the key, and other feature data, and perform encryption and decryption operations on the data to provide the user with data encryption and identity security authentication services.
  • the second electronic signature device can be used from the first electronic device.
  • the second unit data packet received by the signature device or from another back-end server (such as a third-party server such as a bank server or a shopping mall recharge server) is stored in the security chip, because the data in the storage unit of the security chip cannot be illegally read. This ensures the security of the data stored in the storage unit.
  • the method provided in this embodiment further includes: the security chip allocation of the second electronic signature device is used to store the at least one The storage space of the second unit packet.
  • storing the at least one second unit data packet in the security chip in step S23 specifically: storing the at least one second unit data packet in a corresponding storage space, and corresponding storage space The status word is set to be occupied.
  • the security chip allocates one storage space for each second unit data packet, one storage space can only store one second unit data packet, and the transaction record of the second electronic signature device also records a transaction from other electronic The location of the storage space stored by each of the second unit data packets received by the signature device.
  • the status word of the storage space is used to identify whether the storage space is already occupied, and if it is already occupied, the second electronic signature device cannot store the second unit data packet in the occupied storage space.
  • the second electronic signature device needs to perform an operation of requesting the background server to update the data packet or apply for a new storage space, wherein, as an optional implementation, the second electronic The signing device can request a new storage space to store the newly received second unit data packet.
  • the second electronic signature device may further request to update the locally stored second unit data packet to the background server.
  • the second electronic signature device may request the background server to store the locally stored N (N).
  • the second unit data packet representing the facet value is replaced by one or M (M ⁇ N) second unit data packets representing the face value of the large currency, as long as the stored currency amount is unchanged.
  • M (M ⁇ N) second unit data packets representing the face value of the large currency
  • the second electronic signature device may further encrypt each second unit data packet to obtain ciphertext data of each second unit data packet, and each will be The ciphertext data is stored in the corresponding storage space.
  • the second electronic signature device verifies the third signature data, and after the verification is passed, the at least one second The unit data packet is stored in the security chip.
  • the third signature data is obtained by the server signing the second unit data, and each second unit data packet includes at least: the second unit data and the third signature data obtained by the server for signing the second unit data, thereby The second electronic signature device can verify the authenticity of the second unit data packet.
  • the third signature data is signature data obtained by the server by using the private key of the server to sign the second unit data.
  • the verifying the third signature data by the second electronic signature device comprises: the second electronic signature device performing the verification of the third signature data by using the public key of the server. Therefore, the second electronic signature device uses the public key of the bank to perform the verification of the third signature data carried in the second unit data packet, so that the authenticity of the second unit data packet can be verified.
  • the second electronic signature device further confirms whether the received second unit data packet is sent by the first first electronic signature device and is first, on the premise of ensuring that the received second unit data packet is authentic. Whether the object sent by the electronic signature device is indeed the second electronic signature device itself to avoid storing the data packet that is sent by the first electronic signature device, and the second electronic signature device in step S23 performs the at least one second unit data packet.
  • the transaction method further includes: the second electronic signature device verifies the fourth signature data, and after performing the verification, executing the step of storing the at least one second unit data packet The steps stored in the security chip.
  • the fourth signature data is obtained by the first electronic signature device signing the second unit data and the device identifier of the second electronic signature device.
  • the second electronic signature device The transaction request sent to the first electronic signature device further includes: a device identifier of the second electronic signature device; each second unit data packet sent by the first electronic signature device to the second electronic signature device includes: at least: second unit data And obtaining, by the first electronic signature device, the fourth signature data obtained by signing the second unit data and the device identifier of the second electronic signature device, thereby enabling the second electronic signature device to verify the authenticity and correctness of the second unit data packet.
  • the fourth signature data is signature data obtained by the first electronic signature device by using the private key of the first electronic unit to sign the device identifier of the second unit data and the second electronic signature device, that is, each The signature object of the fourth signature data is a combination of each of the second unit data and the device identifier of the second electronic signature device.
  • the verifying, by the second electronic signature device, the fourth signature data comprises: performing, by the second electronic signature device, each fourth signature data by using a public key of the first electronic signature device.
  • the second electronic signature device may acquire the digital certificate of the first electronic signature device from the first electronic signature device, and obtain the public key of the first electronic signature device from the digital certificate.
  • the second electronic signature device may also pre-store the digital certificate of the first electronic signature device and the other electronic signature device, and obtain the device identifier of the first electronic signature device from the first electronic signature device, and obtain the first pre-stored according to the device identifier.
  • the second unit data packet further includes: a data packet identifier.
  • the transaction request sent by the second electronic signature device to the first electronic signature device further includes: a data packet identifier.
  • the first electronic signature device may add the data packet identifier in the transaction request to one of the first Two unit data packets or one third unit data packet and sent to the second electronic signature device; the first electronic signature device sends at least one second unit data packet or the third unit data packet together to the second electronic signature
  • the first electronic signature device may add the data packet identifier in the transaction request to all the second unit data packets or the third unit data packet corresponding to the transaction amount and send it to the second electronic signature device, specifically The first electronic signature device adds the corresponding data packet identifier to the second unit data packet, and then sends the second unit data packet or the third unit data packet generated by the second unit data packet to the second
  • the second electronic signature device storing the at least one second unit data packet in the security chip in the step S23 includes: the second electronic signature device Determining whether the data packet identifier in the received second unit data packet is the same as the data packet identifier in the sent transaction request, and if not, the second electronic signature device discards the second unit data packet with different data packet identifiers If they are the same, the second electronic signature device stores the second unit data packet with the same data packet identifier in the security chip.
  • the second electronic signature device can check whether the received second unit data packet (ie, the second unit data packet obtained after decrypting the third unit data packet) is the playback data, and because the data packet The identifier is allocated by the second electronic signature device, so the second electronic signature device can determine whether the second unit data packet corresponding to the entire data packet identifier has been received, which is convenient for determining whether to initiate the retransmission request in the subsequent step.
  • the first electronic signature device obtains the data packet identifier from the second electronic signature device before transmitting the second unit data packet.
  • the second electronic signature device may check whether the received data packet identifier carried in the second unit data packet is a random number R1, and if yes, consider that the received second unit data packet is legal; otherwise, the received If the two-unit data packet is for playback data, the data is discarded. Thereby, it is possible to prevent the second electronic signature device from being attacked by the playback.
  • the transaction request sent by the second electronic signature device to the first electronic signature device further includes: a data packet identifier start value.
  • the second electronic signature device is provided with a counter.
  • the method provided by the embodiment further includes: the second electronic signature device uses the counter value of the counter to obtain The data packet identifier start value, that is, the value of the counter is the packet identifier start value, and the data packet identifier start value is obtained according to the number of data packets received by the second electronic signature device each time;
  • the method provided by the embodiment further includes: the counter of the second electronic signature device calculates the data packet identifier start value plus the total number of the received second unit data packet to obtain a new data packet identifier.
  • the second electronic signature device can calculate and update the packet identification start value.
  • the first electronic signature device may identify the data packet identifier corresponding to each second unit data packet according to the data packet identifier starting value and according to the total number of second unit data packets to be sent to the second electronic signature device.
  • the second electronic signature device in step S23 stores the at least one second unit data packet in the security chip, including: the second electronic signature.
  • the device determines whether the data packet identifier included in each second unit data packet satisfies a preset range determined according to the start value of the data packet identifier, and if not, the second electronic signature device determines that the data packet identifier does not satisfy the preset range.
  • the second unit data packet is discarded. If yes, the second electronic signature device stores the second unit data packet whose data packet identifier meets the preset range in the security chip.
  • the identifier of the data packet included in each second unit data packet should be not less than the start value of the data packet identifier, otherwise
  • the incremental counter means that each time a second unit data packet is received by the second electronic signature device, the counter value of the counter is incremented by one.
  • the first electronic signature device needs to send three second unit data packets to the second electronic signature device, and the three second unit data packets respectively represent the currency face value of 1 yuan, 2 yuan, and 5 yuan.
  • the data packet identification starting value obtained by the first electronic signature device from the second electronic signature device is 30, and the data packet identification start value may be the number of current data packets obtained by the counter counting of the second electronic signature device plus one.
  • the second electronic signature device stores a total of 29 second unit data packets, and the packet identification of the 29 second unit data packets can be from 1 to 29, then, the received A data packet can be identified from 30, and the first electronic signature device calculates based on the packet identifier start value 30: the data packet identifier corresponding to the second unit data packet representing the 1-yuan currency denomination is 30, representing 2 The data packet identifier corresponding to the second unit data packet of the face value of the currency currency is 31, and the data packet identifier corresponding to the second unit data packet representing the face value of the three currency currency is 32.
  • the second electronic signature device is receiving After the three second unit data packets are stored, the associated data is stored according to the corresponding data packet identifier, and the original data packet identifier starting value 30 plus 3 is calculated to obtain a new data packet identifier start. 33. Therefore, the first electronic signature device only needs to acquire a data packet identifier starting value from the second electronic signature device, and can flexibly calculate each according to the number of second unit data packets to be sent to the second electronic signature device. The packet identifier corresponding to the second unit data packet. The second electronic signature device determines that the received data identifier of the three second unit data packets is not less than the data packet identifier start value 30, and stores the received three second unit data packets in the security chip.
  • the second electronic signature device can determine, according to the data packet identifier, whether the received second unit data packet is playback data, thereby preventing the second electronic signature device from being Replay attack.
  • the method provided in this embodiment further includes: The second electronic signature device calculates the sum of the currency face values represented by the received second unit data packet and the transaction request according to the received number of the second unit data packets and the currency face value represented by each second unit data packet.
  • the first electronic signature device receives the retransmission request, and sends the retransmission information to the second electronic signature device according to the retransmission request, wherein And the retransmission request includes at least a device identifier of the second electronic signature device and/or a data packet identifier corresponding to each second unit data packet, so that the first electronic signature device can determine retransmission information according to the retransmission request,
  • the sending information is selected by the first electronic signature device from a third unit data packet corresponding to a transaction of the second electronic signature device. All or part of the data packet to ensure that the second electronic signature device gets all the second unit data packets of a transaction.
  • the second electronic signature device receives the retransmission information sent by the first electronic signature device according to the retransmission request, where the retransmission information includes at least one second unit data packet.
  • the second electronic signature device deletes at least one second unit data packet previously stored in the security chip, and re-stores at least one second unit data packet retransmitted by the first electronic signature device.
  • the second electronic signature device receives the retransmission information sent by the first electronic signature device according to the retransmission request, where the retransmission information includes the second unit data that is not received by the second electronic signature device. package.
  • the second electronic signature device stores the unreceived second unit data packet in the security chip.
  • the second unit data packet in the retransmission information can be understood as a cipher text form, that is, the third unit data packet obtained by the first electronic signature device for encrypting the second unit data packet, and therefore, in an optional manner
  • the third unit data packet is actually included in the retransmission information, and the second electronic signature device receives the retransmission information (the third unit data packet) sent by the first electronic signature device, and then the third unit data.
  • the packet decryption gets the second unit packet re-storage.
  • the resend request of the second electronic signature device includes at least the device identifier of the second electronic signature device
  • the retransmission information of the first electronic signature device includes at least one second unit data packet, that is, a transaction that resends a transaction. All the second unit data packets corresponding to the amount, as an optional manner, the first electronic signature device may send the at least one second unit data packet to the second electronic signature device in cipher text, that is, at least one third The unit data packet is sent to the second electronic signature device.
  • the retransmission information herein includes at least one third unit data packet, and the second electronic signature device deletes at least one second unit data packet previously stored in the security chip.
  • the method includes: a packet identifier of the second unit data packet that is not received, and may further include: a device identifier of the second electronic signature device
  • the retransmission information of the first electronic signature device includes a second unit data packet that is not received by the second electronic signature device, that is, a second unit data packet indicated by the data packet identifier in the retransmission request, as an optional manner,
  • An electronic signature device may send the second unit data packet indicated by the data packet identifier to the second electronic signature device in a cipher text format, that is, the third unit data packet indicated by the data packet identifier is sent to the second electronic signature device, where It is understood that the retransmission information herein includes a third unit data packet indicated by the data packet identifier, and the second electronic signature device stores the second unit data packet obtained
  • the transaction amount in the transaction request of the second electronic signature device is 10 yuan
  • the first electronic signature device is to the second electronic signature device.
  • the second electronic signature device sends a retransmission request to the first electronic signature device, where the retransmission request carries at least the device identifier of the second electronic signature device, and the first electronic signature device receives the second electronic signature device.
  • the transaction for the second electronic signature device may query all corresponding third unit data packets, and carry the 5 third unit data packets in the retransmission information and send to the second electronic signature device. That is, the second unit data packet respectively representing the denomination of the 2-yuan currency is carried in the form of ciphertext and the retransmission information is transmitted to the second electronic signature device.
  • the second electronic signature device decrypts the five third unit data packets carried in the retransmission information to obtain five corresponding second unit data packets, and stores the four previously stored in the security chip.
  • the second unit data packet representing the denomination of the 2-yuan currency is deleted, and the 5 second unit data packets obtained by the decryption are re-stored.
  • the second electronic signature device has the function of transmitting a retransmission request to the first electronic signature device when all second unit data packets required for the electronic transaction are not received, the first electronic signature device having the response second electronic signature device The function of resending, thereby ensuring that the second electronic signature device can receive all the second unit data packets required for the electronic transaction, and ensure that the transaction can be successfully completed.
  • the transaction amount in the transaction request of the second electronic signature device is 5 yuan
  • the second electronic signature device receives the first electronic signature
  • the second unit data packet (referred to as a 2-ary data packet) representing the denomination of the 2-yuan currency
  • the second unit data packet (referred to as the 1-ary data packet) representing the denomination of the 1-yuan currency, respectively, but transmitted by the device In the process, the data is lost.
  • the second electronic signature device only receives two 2-yuan data packets, and the sum of the currency face values is 4 yuan, which is not equal to the transaction amount of 5 yuan.
  • the second electronic signature device sends a retransmission request to the first electronic signature device, where the retransmission request carries at least the device identifier of the second electronic signature device and the data packet identifier of the unreceived data packet (ie, a data packet identifier of the 1st data packet or a data packet identifier of the received 2 metadata packet, after the first electronic signature device receives the retransmission request sent by the second electronic signature device, the second electronic signature device
  • the pen transaction may query the corresponding third unit data packet according to the data packet identifier of the 1 yuan data packet, or determine the corresponding data packet identifier of the untransferred 1 metadata packet according to the data packet identifier of the 4 binary data packets.
  • the third unit data packet carries the third unit data packet corresponding to the one-dimensional data packet identifier, and the retransmission information is sent to the second electronic signature device, that is, the second unit data packet corresponding to the data packet identifier is carried in the form of ciphertext.
  • the sending information is sent to the second electronic signature device.
  • the second electronic signature device decrypts the third unit data packet corresponding to the one-dimensional data packet identifier carried in the retransmission information, and obtains a second unit data packet corresponding to the one-dimensional data packet identifier, and the The second unit data packet corresponding to the one-dimensional data packet identifier is stored in the security chip.
  • the second electronic signature device has a function of transmitting a retransmission request to the first electronic signature device when all second unit data packets required for the electronic transaction are not received, and receiving a second retransmission by the first electronic signature device
  • the second unit data packet not received by the electronic signature device reduces the transmission amount of the retransmitted data, and ensures that the second electronic signature device can receive all the second unit data packets required for the electronic transaction.
  • the security chip of the first electronic signature device allocates a storage space for storing at least one third unit data packet (or a second unit data packet), and at least one third unit The data packet is stored in the corresponding storage space.
  • the storage space of the security chip may store at least one second unit data packet, so that the first electronic signature device obtains the second unit data packet required for the transaction amount from the security chip after receiving the transaction request of the second electronic signature device.
  • the at least one third unit data packet is stored in the corresponding In the storage space.
  • the first electronic signature device After the first electronic signature device sends the retransmission information to the second electronic signature device according to the retransmission request, the first electronic signature device receives the confirmation information that the second electronic signature device returns the success of the reception, and the first electronic signature device will The status word storing the storage space of the at least one third unit data packet is modified to complete the transaction, or the storage space is cleared, and the status word of the corresponding storage space is modified to be unoccupied. Among them, the status word is the storage space where the transaction is completed, and can be overwritten by new data. Thereby, the first electronic signature device confirms the second electronic signature After receiving all the second unit data packets required for the electronic transaction, the name device can clear the storage space of the security chip, so as to release more storage space and ensure the subsequent transactions proceed smoothly.
  • each transaction in a plurality of transactions can be implemented in the above manner.
  • the storage space of the second electronic signature device is limited, and therefore, the remaining space of the second electronic signature device needs to be monitored at any time, so as to release the storage space in an instant, and avoid unnecessary transactions in the transaction process.
  • the remaining storage space of the second electronic signature device may also be monitored in real time by using a counter in the second electronic signature device. Specifically, after each transaction ends, that is, after step S23, the second electronic signature device uses the count value of the counter to obtain the total number of currently stored second unit data packets. Specifically, in each transaction, the counter adds the number of second unit data packets received by the transaction.
  • each storage space has the same size
  • each second unit data packet has the same size and matches the size of the storage space, for example, the second electronic signature device allocates storage for a second unit data packet.
  • the size of the space is 2M
  • the 2M storage space can store a second unit data packet
  • the space reserved by a security chip for storing the second unit data packet is 1G
  • the second electronic signature device can store up to 512
  • the two-unit data packet that is, the preset value can be set to 512.
  • the second electronic signature device can also use the count value of the counter to obtain the total number of second unit data packets of each currency denomination stored in the security chip.
  • the second electronic signature device can obtain the total amount of money of the currently stored second unit data packet according to the currency face value and the number of the money represented by each stored second unit data packet.
  • the first electronic signature device after transmitting the at least one second unit data packet to the second electronic signature device, the first electronic signature device subtracts the transaction amount from the account amount to obtain the current account balance, and Displaying the transaction amount and/or the current account balance to the holding user; after storing the at least one second unit data packet in the security chip, the second electronic signature device adds the current account amount to the transaction amount to obtain the current account balance, Display the transaction amount and/or current account balance to the holding user.
  • the user holding the electronic signature device can query the transaction amount and the current account balance on his own device.
  • the user's funds are stored in the first electronic signature device or the second electronic signature device in the form of at least one second unit data packet.
  • the payee user the second electronic signature device side
  • the second electronic signature device since the funds are no longer stored in the second electronic signature device in the form of numerical values, the second electronic signature device does not need to be changed by the server.
  • the second electronic signature device of the payee user only needs to receive a certain number of second unit data packets from the first electronic signature device of the payer user, whereby the electronic signature device is signed with other electronic
  • the device conducts electronic transactions, it no longer needs to rely on the server for online payment, and the server does not need to supervise the electronic signature device of the payee user or the payer user, thereby realizing offline electronic transactions.
  • the second electronic signature device may receive the third unit data packet in the cipher text form from the first electronic signature device, further improving the security of the electronic transaction; further, adding the data packet identifier and the second in the second unit data packet
  • the device identifier of the electronic signature device can effectively prevent the second electronic signature device from being attacked by the playback, and can facilitate the first electronic signature device to determine the retransmission information.
  • portions of the invention may be implemented in hardware, software, firmware or a combination thereof.
  • multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system.
  • a suitable instruction execution system For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.
  • each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules.
  • the integrated modules, if implemented in the form of software functional modules and sold or used as stand-alone products, may also be stored in a computer readable storage medium.
  • the above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

La présente invention concerne un procédé de transaction par dispositif de création de signature électronique, comprenant les étapes suivantes: un dispositif de création de signature électronique transmet une requête de transaction à un serveur, la requête de transaction comprenant au moins un montant de transaction (S11); le serveur reçoit la requête de transaction, déduit le montant de transaction d'un compte bancaire du dispositif de création de signature électronique, acquiert au moins un premier paquet de données unitaires, et transmet ledit au moins un paquet de données unitaires au dispositif de création de signature électronique (S12), chaque premier paquet de données unitaires représentant une devise parmi une pluralité de devises, et la somme des devises représentée par ledit au moins un premier paquet de données unitaires étant égale au montant de transaction; et le dispositif de création de signature électronique reçoit ledit au moins un premier paquet de données unitaires, et stocke ledit au moins un premier paquet de données unitaires dans une puce sécurisée (S13). Grâce à la solution selon la présente invention, une transaction électronique hors ligne peut être réalisée.
PCT/CN2017/077652 2016-01-22 2017-03-22 Procédé de transaction par dispositif de création de signature électronique Ceased WO2017162164A1 (fr)

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
CN201610045339 2016-01-22
CN201610178325.8A CN105913256A (zh) 2016-01-22 2016-03-25 一种电子签名设备的交易方法和交易系统
CN201610178067.3A CN105956855B (zh) 2016-01-22 2016-03-25 一种电子签名设备的交易方法和交易系统
CN201610178325.8 2016-03-25
CN201610178067.3 2016-03-25

Publications (1)

Publication Number Publication Date
WO2017162164A1 true WO2017162164A1 (fr) 2017-09-28

Family

ID=56744518

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/077652 Ceased WO2017162164A1 (fr) 2016-01-22 2017-03-22 Procédé de transaction par dispositif de création de signature électronique

Country Status (2)

Country Link
CN (6) CN113159763A (fr)
WO (1) WO2017162164A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114612269A (zh) * 2022-05-11 2022-06-10 山东国盾网信息科技有限公司 基于电子签名技术的电子劳动合同平台

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113159763A (zh) * 2016-01-22 2021-07-23 天地融科技股份有限公司 一种电子签名设备的交易方法、交易系统和电子签名设备
CN106228349B (zh) * 2016-07-22 2021-01-15 天地融科技股份有限公司 一种电子签名设备的交易方法和电子签名设备
CN107067241A (zh) * 2017-02-06 2017-08-18 吕文华 一种二元体系数字币的运行系统
US11157900B2 (en) * 2017-03-24 2021-10-26 Mastercard International Incorporated Method and system for offline data transfer via machine-readable code
CN107665427A (zh) 2017-08-22 2018-02-06 阿里巴巴集团控股有限公司 一种离线支付、业务处理、支付处理的方法及装置
CN111915431B (zh) * 2019-05-09 2025-01-07 天地融科技股份有限公司 一种脱机电子货币交易方法及系统
CN112184450B (zh) * 2020-10-13 2023-06-20 中国联合网络通信集团有限公司 基于区块链的交易结算方法、交易节点、设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020128983A1 (en) * 2000-11-10 2002-09-12 Konrad Wrona Method and device for returning of change in an electronic payment system
CN101593338A (zh) * 2009-07-13 2009-12-02 招商银行股份有限公司 一种处理电子交易请求的方法和系统
US8285991B2 (en) * 2000-10-25 2012-10-09 Tecsec Inc. Electronically signing a document
CN105956855A (zh) * 2016-01-22 2016-09-21 天地融科技股份有限公司 一种电子签名设备的交易方法和交易系统

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IL120585A0 (en) * 1997-04-01 1997-08-14 Teicher Mordechai Countable electronic monetary system and method
US7506812B2 (en) * 2004-09-07 2009-03-24 Semtek Innovative Solutions Corporation Transparently securing data for transmission on financial networks
JP4391375B2 (ja) * 2004-09-30 2009-12-24 フェリカネットワークス株式会社 情報管理装置および方法、並びにプログラム
CN101051907B (zh) * 2007-05-14 2012-08-22 北京握奇数据系统有限公司 面向签名数据的安全认证方法及其系统
CN106355496A (zh) * 2008-11-21 2017-01-25 天地融科技股份有限公司 实现批量电子交易的方法、系统和装置以及电子签名工具
CN101719251A (zh) * 2010-01-15 2010-06-02 陈发勇 互联网电子货币系统
CN102468960A (zh) * 2010-11-16 2012-05-23 卓望数码技术（深圳）有限公司 一种离线模式身份与交易认证方法及终端
CN102694795B (zh) * 2012-05-06 2018-02-27 北京深思数盾科技股份有限公司 一种在离线情况下使用应用服务的方法
CN102999570B (zh) * 2012-11-09 2016-06-08 北京深思数盾科技股份有限公司 移动设备中应用程序关键数据的离线控制方法和系统
CN103413159B (zh) * 2013-08-15 2016-09-21 成都市易恒信科技有限公司 一种基于cpk的rfid电子凭证离线鉴真防伪实现方法及系统
CN103560886B (zh) * 2013-11-04 2016-08-17 北京旋极信息技术股份有限公司 电子签名设备认证方法
EP2924637A1 (fr) * 2014-03-24 2015-09-30 The Roberto Giori Company Ltd. Système et procédé de transfert d'argent électronique de quantités fractionnaires

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8285991B2 (en) * 2000-10-25 2012-10-09 Tecsec Inc. Electronically signing a document
US20020128983A1 (en) * 2000-11-10 2002-09-12 Konrad Wrona Method and device for returning of change in an electronic payment system
CN101593338A (zh) * 2009-07-13 2009-12-02 招商银行股份有限公司 一种处理电子交易请求的方法和系统
CN105956855A (zh) * 2016-01-22 2016-09-21 天地融科技股份有限公司 一种电子签名设备的交易方法和交易系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114612269A (zh) * 2022-05-11 2022-06-10 山东国盾网信息科技有限公司 基于电子签名技术的电子劳动合同平台

Also Published As

Publication number Publication date
CN105931048A (zh) 2016-09-07
CN105956855A (zh) 2016-09-21
CN105956855B (zh) 2022-02-22
CN113159763A (zh) 2021-07-23
CN105931049A (zh) 2016-09-07
CN105913255A (zh) 2016-08-31
CN105913256A (zh) 2016-08-31

Similar Documents

Publication Publication Date Title
US20250053637A1 (en) Proof of affinity to a secure event for frictionless credential management
US11687920B2 (en) Facilitating a fund transfer between user accounts
AU2021203184B2 (en) Transaction messaging
WO2017162164A1 (fr) Procédé de transaction par dispositif de création de signature électronique
CN101098225B (zh) 安全数据传输方法及支付方法、支付终端和支付服务器
KR101976027B1 (ko) 암호 화폐의 전자 지갑 생성 및 백업 방법 및 이를 이용한 단말 장치와 서버
US20160028548A1 (en) Key downloading method, management method, downloading management method, device and system
EP3422275A1 (fr) Procédé de paiement électronique et dispositif électronique utilisant une cryptographie à clé publique basée sur l'identité
CN102819893B (zh) 一种空中圈存方法
CN102609841A (zh) 一种基于数字证书的远程移动支付系统及支付方法
CN102239714B (zh) 基于应用层的移动金融业务的安全通信方法及其装置
CN110851870A (zh) 基于可信执行环境的区块链隐私保护方法、系统及介质
EP1142194A1 (fr) Procede et systeme de mise en oeuvre d'une signature numerique
CN106027457B (zh) 一种身份证信息传输方法和系统
CN106033571A (zh) 一种电子签名设备的交易方法、电子签名设备和交易系统
CN106228349B (zh) 一种电子签名设备的交易方法和电子签名设备
Kisore et al. A secure SMS protocol for implementing digital cash system
CN109816525A (zh) 一种数据处理方法及其装置、介质、终端
CN112041897B (zh) 一种控制方法、售票规则服务器、检票规则服务器及装置
JP2015146187A (ja) セキュアでない公衆通信基盤を介して金融トランザクションを行う方法及びそのための装置
CN101097646A (zh) 一种公钥更新方法和基于该方法的银行卡终端
WO2014187363A1 (fr) Procédé et système de verrouillage de réseau de terminaux sans fil
CN120263433A (zh) 基于区块链的资源处理方法、装置、设备和介质
CN117787985A (zh) 资源转移方法、装置、系统、计算机设备和存储介质
CN105938597A (zh) 一种电子签名设备的交易方法、交易系统和电子签名设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17769441

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17769441

Country of ref document: EP

Kind code of ref document: A1