A kind of electricity charge on-line payment system based on USBKEY
Technical field
The present invention relates to a kind of electricity charge on-line payment system based on USBKEY, belong to compunication applied technical field.
Background technology
In order to ensure the fund security of big customer's Online Payment, guarantee that demand charge fund arrives account in real time, in the urgent need to carry out new type of safe guard technology research and product development to support big customer's Online Payment needs; Big customer's power consumption is large, and its electricity consumption electricity charge are main sources (accounting about 3/4ths) of State Grid Corporation of China's power selling income.The promptness of big customer's payment and enthusiasm, reduce tariff recovery risk to State Grid Corporation of China most important.Current big customer's pay charge way is main mainly with withholding with bank transfer, pays the fees safely but exists in dirigibility and electricity charge fund to account real-time and limit to.
Summary of the invention
Goal of the invention: for problems of the prior art with not enough, for expanding electric power payment channel, the invention provides a kind of electricity charge on-line payment system based on USBKEY.The present invention, based on internet, expands big customer's Online Payment channel, improves the convenience of big customer's payment.Based on integrated paying platform and the integrated basis of Unionpay's certification channel available data, the big customer's electricity charge method of payment being carrier with U shield is proposed, realize electricity consumption numbering and the electricity charge disbursement account of physical bindings client, guarantee big customer's Online Payment safety such as 95598 websites, mobile phone.By the application integration with Unionpay's certification channel, enterprise's Net silver, the integration paying platform docking of quick Zhi Fuyu company are realized fund and arrive account in real time, reduces the electricity charge time in transit, reduce company's electricity charge arrears risk.
Technical scheme: a kind of electricity charge on-line payment system based on USBKEY, comprising:
The digital certificate usbkey that Utilities Electric Co. issues to user: for the authentication of user, issue digital certificate usbkey to user in, by user's ID authentication information write certificate wherein, user is when using desktop to pay application software, first digital certificate usbkey is inserted computer by USB interface, and input PIN code by digital certificate usbkey, log in successfully after correct.
Usbkey has storage space, personal information and the power information of digital certificate and user can be stored, the service of offline search can be provided, user connect not use after usbkey client software can check on usbkey yet the last time is stored in information on usbkey.
Usbkey, with display screen and button, is used for showing personal information, power information, input pin code, the information etc. of browsing of user, pays application software carry out information interaction with desktop.
The desktop be arranged on user computer pays application software: the interface being man-machine interaction, and user pays application software inquiry maintenance personal information, electricity charge information, payment information by desktop and carries out payment operation etc.Communication, encryption etc. are transparent to user.Start and use the prerequisite of this software to be the usbkey that user has that has the certificate that Utilities Electric Co. issues, and knowing its PIN code; The function that desktop payment application software completes has the communication of security server end, comprise the ID authentication request of usbkey, the inquiry request of personal information power information and payment request, in user side display userspersonal information, power information, the Unionpay of payment is provided to link to user, send arrearage payment prompting message etc. in advance to user, also carry out information transmission to usbkey simultaneously, upgrade the payment information of usbkey storage inside.
The detailed process wherein communicated and encrypt is: first desktop payment application software and security server all have the digital certificate proving oneself identity, desktop pays the public key information that application software end knows security server, security server end has the public key information of application software end, this information and electricity consumption numbering coupling, when first time connects and namely verifies both sides' identity and consulting session key, desktop pays application software user side and sends the message crossed by security server public key encryption to security server, security server is only had to use the private key of oneself correctly could decipher acquisition information, the content of information comprises two random numbers, one is used for identifying the real-time that session is guaranteed in this session, another is the communication session keys that desktop pays the generation of application software client, after security server end obtains message, security server end pays application software client by sending back to desktop after the public key encryption of the session key client of the random number and oneself generation that receive mark session, desktop pays application software client and compares with after the private key deciphering of oneself real-time that the random number identifying session just can verify session, also the exchange of session key is completed, the communication key of both sides is exactly a bit manipulation of the session key that both sides produce.Such authentication just completes with communicating of session key agreement, the cryptographic algorithm that both sides use in this process is MS2 algorithm, information communication is afterwards exactly carry out encryption and decryption with the session key produced according to the method for symmetrical encryption and decryption, all ciphering process algorithms are all completed by the encrypted card being arranged on usbkey inside, and usbkey internal cryptographic card supports that multiple cipher mode comprises symmetric encipherment algorithm SM1, SM4,3DES, AES hash algorithm SM3, SHA and asymmetric arithmetic SM2, RSA etc.
Security server: be responsible for paying application software with desktop and carry out information communication.Because communication has related to the sensitive informations such as userspersonal information, so the personal information of user and power information are encrypted by this process need, the encrypted card installed on the server is adopted to carry out hardware encipher, the encrypted card functional similarity of this encrypted card and usbkey inside, all be to provide cryptographic algorithm, after communication encryption, be sent to desktop payment software.Communication encryption process is at by the agency of above.Security server receives desktop and pays application software CIPHERING REQUEST URL, here request URL has two types, a kind of is the data inquiry request paying application software, comprise requesting query power information, payment information, another kind pays application software payment request, security server just decrypts request field after receiving the enciphered message paying application software transmission, if inquiry request, so information encryption is just sent back to payment application software by security server after querying the databases, if payment request, payment request the inside comprises electricity consumption numbering and the payment number of user, request field is just sent to paying platform by security server, again the result returned first is comprised the information of payment order, payment software is sent to after encryption, payment software again sends payment and completes information to security server after completing payment, security server again communicates with paying platform and informs that payment completes, sending the information of paying the fees and whether completing after paying platform inquiry account and writing bayonet socket makes to security server, information is sent to payment software by security server again, payment request process completes.
Paying platform: be responsible for intranet and extranet mutual; Paying platform is the Intranet system of Utilities Electric Co., and in order to externally provide service support, Utilities Electric Co. provides a web services for extranet access.We do firewall protection to it, only allow and secure server communication, ensure its safety.The information interaction of paying platform and security server has: server end sends the payment request of user to paying platform, paying platform obtains numbering and the payment number of user, generate an electricity bill, again the information of bill is sent to security server, when completing information Deng security server transmission payment, paying platform will be checked account to Unionpay by electricity consumption numbering, just returns success and writes bayonet socket and make to security server, otherwise return failure if paid the fees.
Writer, integrated with digital certificate usbkey, the back side of usbkey is just to provide the writer of electric card slot, the write operation to electricity card after responsible payment completes, and that writes electric calorie requirement grid company writes bayonet socket order, after having paid the fees, application software will obtain and write bayonet socket order, just can carry out writing operation, concrete writing operation is completed by hardware, only after writing card, the whole payment work of user side just completes, just can normal electricity consumption.
The workflow of present system is: Utilities Electric Co. issues the digital certificate usbkey being equipped with and can proving user identity to user, in use, digital certificate usbkey is inserted computer by user, first namely the authentication carrying out hardware inputs PIN code, pays application software client-side program by starting desktop afterwards.After startup, program can at backstage connection server, carry out authentication and communication key negotiation, in order to ensure the real-time communicated, communication key follows one-time pad principle, a new session key is all consulted in each connection, namely after application software or security server normally exit or disconnect, again connect the negotiation by re-starting authentication and session key, process is told about above, whole communication afterwards is all transmitted by after secret key encryption, user pays application software by desktop can safeguard personal information, inquiry power information, payment, check historical bills, and arrearage early warning information, usbkey is with display screen, the data query of user can be shown above.Actual for different local electrically charge, writer is equipped with for needing the user carrying out writing card after payment, by writer and usbkey integrated, the interface that just can call writer after completing the logging in of usbkey carries out writing operation, user is after completing the payment electricity charge, use writer just can complete and write card work, recover electricity consumption.
Beneficial effect: compared with prior art, a kind of electricity charge safety on line payment system based on USBKEY provided by the invention, utilize SM2 algorithm, the technology such as certificate are as the protection of identity and communication security, expand the channel of electric power payment, enhance the security that user uses, can online query power information and payment, simultaneously also can intelligent alarm, prompting subscriber arrearage, be conducive to Utilities Electric Co. and reclaim electricity charge reduction company electricity charge arrears risk in time, the writer be equipped with on this basis can make user really accomplish Online Payment after can directly have access to electricity, Zai Qu Utilities Electric Co. is not needed to carry out writing card, facilitate the life of the masses, also mitigate the working pressure of business hall simultaneously.
Accompanying drawing explanation
Fig. 1 is data interaction figure of the present invention;
Fig. 2 is system architecture diagram of the present invention;
Fig. 3 is PIN code of the present invention checking process flow diagram;
Fig. 4 is secure communication process flow diagram of the present invention;
Fig. 5 is security negotiation procedure chart of the present invention;
Fig. 6 is electricity charge querying flow figure of the present invention;
Fig. 7 is payment process flow diagram of the present invention.
Embodiment
Below in conjunction with specific embodiment, illustrate the present invention further, these embodiments should be understood only be not used in for illustration of the present invention and limit the scope of the invention, after having read the present invention, the amendment of those skilled in the art to the various equivalent form of value of the present invention has all fallen within the application's claims limited range.
Based on the electricity charge on-line payment system of USBKEY, provide inquiry power information, the functions such as payment, two generation ukey are utilized to have the feature of display screen and button, information is shown and button confirmation when paying the fees, increase security, add extendable functions-writer simultaneously, allow and make the user of electricity consumption card directly can write card after having paid the fees online.
It is data interaction schematic diagram of the present invention shown in Fig. 1.Detailed process is as follows:
1. usbkey sends a message to the precious application program of payment (desktop payment application software), and message comprises the user profile and acknowledge message of binding in usbkey;
2. usbkey receives the precious application messages of payment, data is shown in usbkey display screen, comprises arrearage information, electricity consumption situation etc.;
3. precious application program of paying the fees send information to security server, and message content comprises Query Information, payment information, transaction reconciliation information; In addition, Unionpay's certification channel also can with secure server communication, realize the direct information reconciliation that the electricity charge are paid;
4. security server response message is to the precious application program of payment, and message content comprises Query Information, payment information, transaction reconciliation information etc.;
5. precious application program of paying the fees and Unionpay's certification channel carry out integrated, ask payment interface;
6. the payment information of the precious application program of Unionpay's certification channel response payment;
7. with enterprise Net silver/fast pay and carry out the mutual of funds transaction information after Unionpay's certification channel receives the information of payment precious application requests payment;
8. enterprise's Net silver/quick Zhi Fuyu Unionpay certification channel carries out the mutual of funds transaction information;
9. enterprise's Net silver forwards fund to quick payment;
10. enterprise's Net silver/fast pay the allocation of the funds to electric power fund account.
Fig. 2 is system architecture diagram of the present invention.Plug USBKEY time large power customer uses intelligence payment precious, and precious application program of paying the fees will by the machine-processed security that ensure communication process of secure accessing platform with the communication of integrated paying platform.The rear of secure accessing platform is service server, its groundwork is login authentication, and carries out supplementing to some fields of client's request and perfect etc., such as, add timestamp, according to the field that the precious application program of payment is sent, splice new url request of access.Meanwhile, this server is also as the deployment server of management platform.Client jumps to after Unionpay pays dues, and Unionpay can notify that unified platform writes off, and client just completes and pays dues.
Fig. 3 is PIN code of the present invention checking process flow diagram.User is after insertion USBKey, USBKey brings into operation, first the interface command of oneself inside is called, there is the interface of input PIN code, user completes the authentication of client-side after correct input PIN code, now client-side program (desktop payment application software) brings into operation, if USBKEY locks by PIN code authentication failed after certain number of times.
Fig. 4 is secure communication process flow diagram of the present invention.
Application program, after being connected with security server end, needs two-way authentication before data interaction.Only have by authentication, just can carry out follow-up data letter.Application program, when carrying out normal data communication with security server end, needs to carry out encryption and decryption operation to the data of communication.
Secure communication detailed process is as follows:
1. the intelligence precious application software of payment and server connect.
2. the intelligence precious application software of payment and server carry out key agreement.And judge that key agreement is success or failure, if success, authentication success just can be encrypted communication, if failure just quits a program.
3. can judge in the process of coded communication whether each communication makes mistakes, and makes a mistake, and quits a program.Otherwise continue communication.Until a side stops communication.
Fig. 5 is security negotiation procedure chart of the present invention.
Being summarized as follows of negotiations process:
Note: device 1 refers to usbkey; Device 2 refers to the server of main website end (security server) authentication.SN is arranged at random by consulting initiator, and the introducing of SN is in order to preventing playback attack, add at every turn one can prevent same request by again send to server.
1. device 1 produces random number r1, does:
A=ECert2 (r1) ‖ ESkey1 (H (r1)), is sent to device 2 by A and SN; Wherein ECert2 (r1) refers to use the certificate of usbkey to be encrypted to random number r1, the basis that ESkey1 (H (r1)) refers to use SM3 algorithm random number r1 to be carried out to hash computing re-uses the private key signature of usbkey.
2. device 2 couples of A decipher and the signature of demo plant 1, produce random number r2, do:
B=ECert1 (r2) ‖ ESkey2 (H (r2)), is sent to device 1 by B and SN+1; Wherein ECert1 (r2) refers to use the certificate of server to be encrypted to random number r2, the basis that ESkey2 (H (r2)) refers to use SM3 algorithm random number r2 to be carried out to hash computing re-uses the private key signature of server.
Synthesis session key: DK=r1^r2;
3. device 1 couple of B deciphers and the signature of demo plant 2, does:
Synthesis session key: DK=r1^r2,
C=H (r1^r2), is sent to device 2 by C;
Device 2 is D=H (r1^r2), and whether compare C and D identical.Wherein H (r1^r2) represents r1's and r2 or carries out hash computing (using SM3 algorithm).
If identical, then the other side's identity of now both sides' empirical tests, and hold session key: DK=r1^r2; If different, then device 2 provides and consults failed warning information, notifying device 1, is again initiated to consult by device 1.
Fig. 6 is electricity charge querying flow figure of the present invention.
This module is used for the current power consumption of inquiring user.First, client needs to log in the precious system of payment.Afterwards, customer selecting " checks electricity charge information ".After both sides' security negotiation is passed through, the precious system constructing security request URL that pays the fees is to security server, and this request can be sent to unified platform by security server.Electricity charge data are returned security server by unified platform, and then electricity charge information returns by security server, are presented at electricity charge display page.
Fig. 7 is payment process flow diagram of the present invention.
This module is used for client's electricity payment, provides multiple Unionpay pay charge way.First, client needs to log in the precious system of payment.Afterwards, customer selecting " payment ".To pay the fees precious system jump page, make the customer selecting modes of payments, then according to the mode of customer selecting, payment information is sent to Third-party payment platform, carries out the payment of the electricity charge.If pay successfully, then jump to payment success page, prompting user pays successfully; If pay unsuccessfully, then prompting pays unsuccessfully and returns the modes of payments and selects the page, makes client again can carry out electricity charge payment.