WO2017206833A1 - 支付方法、支付设备和支付服务器 - Google Patents

支付方法、支付设备和支付服务器 Download PDF

Info

Publication number
WO2017206833A1
WO2017206833A1 PCT/CN2017/086317 CN2017086317W WO2017206833A1 WO 2017206833 A1 WO2017206833 A1 WO 2017206833A1 CN 2017086317 W CN2017086317 W CN 2017086317W WO 2017206833 A1 WO2017206833 A1 WO 2017206833A1
Authority
WO
WIPO (PCT)
Prior art keywords
payment
authorization code
code
secure
information
Prior art date
Application number
PCT/CN2017/086317
Other languages
English (en)
French (fr)
Inventor
黄洁静
王梓
彭峰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2017206833A1 publication Critical patent/WO2017206833A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G06Q20/3274—Short range or proximity payments by means of M-devices using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3227—Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction

Definitions

  • the present invention relates to the field of information technology, and in particular, to a payment method, a payment device, and a payment server.
  • the payment is realized by scanning the barcode or scanning the two-dimensional code.
  • the user mainly provides the payment authorization code including the user account information and the like by the payment device (such as a mobile phone) in the form of a barcode or a two-dimensional code, and the merchant scans through the mobile phone or the dedicated scanning device.
  • the payment authorization code displayed on the payment device of the user is then sent to the payment system server, and the payment system server performs a subsequent payment operation according to the payment authorization code.
  • a user using a payment device to obtain a payment authorization code can be implemented in two ways, one is an offline mode, and the other is an online mode. If the user obtains the payment authorization code by using the payment device offline, the payment method may be referred to as offline payment; if the user uses the payment device to obtain the payment authorization code through online, the payment method may be referred to as online payment.
  • both the payment system server and the user's payment device need to have an authorization code calculator, and the payment system server and the authorization code calculator on the user's payment device are synchronized, that is, The payment system calculator on the payment system server and the user's payment device generates payment information based on the user's payment authorization code, such as account information, time, time stamp, random number generator, and the like.
  • the user interface running in the Rich Execution Environment (REE) of the payment device receives the payment request input by the user (eg, the user clicks on the "payment" in the user interface.
  • run the authorization code calculator in the REE run the authorization code calculator in the REE, generate a payment authorization code, and present it under the REE in the form of a barcode or a QR code on the display device of the payment device.
  • REE Rich Execution Environment
  • the user's payment device must be connected to the network.
  • the user inputs a payment request through a user interface running in the REE of the payment device (such as clicking the "payment" option on the user interface), and the payment device receives the payment request from the user, and then pays the payment.
  • the system server issues a request, and then the payment system server generates a user's payment authorization code and sends it to the user's payment device over the network.
  • the payment device of the user receives the payment authorization code and presents it from the display device of the payment device via a user interface running under the REE.
  • the payment system server Because, whether it is an offline payment method or an online payment method, after receiving the payment authorization code, the payment system server only judges the validity of the payment authorization code, that is, only verifies whether the payment authorization code is correct, and whether it is generated or sent with the payment system server side.
  • the payment authorization code is the same, and it is not determined whether the source of the payment authorization code is legal.
  • the subsequent payment process is executed, which may cause the payment system server to determine that the payment authorization code is valid when any of the following payment authorization codes are obtained, and then perform subsequent payment operations, thereby reducing the payment.
  • the malicious application After the malicious application obtains the payment information of the payment authorization code generated by the authorization code calculator, the payment authorization code generated by the authorization code calculator is generated according to the payment information; the malicious application arbitrarily simulates the payment behavior of the user, and touches The payment authorization code generated by the authorization code calculator; after the user triggers the generation or reception of the payment authorization code, the malicious authorization application steals the payment authorization code, such as a screen capture to obtain the payment authorization code displayed in the form of a two-dimensional code.
  • the payment method, payment device and payment server provided by the invention can improve the security of payment.
  • the present invention provides a payment method, including: receiving an instruction to request payment; acquiring a payment security code in a Trusted Execution Environment (TEE); and generating security according to the payment security code in the TEE And an payment authorization code, where the payment security code is used by the payment server to verify the validity of the secure payment authorization code; the TUI of the TEE displays the secure payment authorization code, so that the payment server obtains the secure payment Authorization code and payment according to the secure payment authorization code.
  • TEE Trusted Execution Environment
  • the secure payment authorization code since the secure payment authorization code includes the payment security code in the TEE, it can be indicated that the secure payment authorization code is generated in the TEE, that is, the secure payment authorization code is legal.
  • the payment server may determine the payment security code in the secure payment authorization code to determine that the secure payment authorization code is from a secure environment, is trusted, and then performs payment, thereby avoiding malicious The software counterfeits the payment authorization code generated by the legal software to pay, and finally provides the security of the payment.
  • the secure payment authorization code is presented in the TEE of the payment device, and the payment device under the TEE has an anti-screening function, it is possible to prevent the malware from stealing the security generated in the TEE of the payment device by means of screen capture or the like. Paying the authorization code can also prevent the malware from triggering the payment device to generate and steal the secure payment authorization code, and ultimately improve the security of the payment.
  • the method further includes: acquiring payment information, where the payment information includes at least one of identifier information of a payment account, a payment type, a payment method, a payment time, a time stamp, and a random number generator.
  • the payment security code is generated based on the device number of the payment device or the identification information; the generating a secure payment authorization code according to the payment security code in the TEE, including: according to the payment in the TEE The security code and the payment information of the payment account generate the secure payment authorization code.
  • the payment information generating the secure payment authorization code may include a variety of information, so that the payment server can flexibly perform the payment according to requirements.
  • the payment security code generated based on the device number of the payment device or the identification information of the payment account can more reliably verify the security legality of the secure payment authorization code.
  • the acquiring the payment information includes: sending a request message of the payment information to a payment server; receiving a response message sent by the payment server, where the response message includes the payment information.
  • the payment information is obtained from the payment server immediately when the security payment authorization code needs to be generated, so that the payment method can be implemented in an online manner.
  • the acquiring the payment information includes: sending a request message of a payment authorization code to a payment server; receiving a response message sent by the payment server, where the response message includes a payment authorization code, and the payment authorization
  • the code carries the payment information
  • the generating the secure payment authorization code according to the payment security code and the payment information in the TEE includes: generating, according to the payment security code and the payment authorization code, in the TEE The secure payment authorization code.
  • the payment authorization code is generated according to the payment information, and the secure payment authorization code is generated.
  • the method for generating the payment authorization code in the prior art can be used to improve the generation of the payment authorization code in the prior art.
  • the utilization of the method can reduce the complexity of generating a secure payment authorization code based on the payment security code.
  • the payment information is already stored in the payment device prior to receiving the instruction.
  • the secure payment authorization code can be generated without acquiring the payment information from the payment server when generating the secure payment authorization code, so that offline payment can be realized.
  • the generating the secure payment authorization code according to the payment security code and the payment information in the TEE comprising: generating a payment authorization code according to the payment information; The payment security code and the payment authorization code generate the secure payment authorization code.
  • the payment authorization code is generated according to the payment information, and the secure payment authorization code is generated.
  • the method for generating the payment authorization code in the prior art can be used to improve the generation of the payment authorization in the prior art.
  • the utilization of the method of the code can reduce the complexity of generating a secure payment authorization code based on the payment security code.
  • the generating, in the TEE, the secure payment authorization code according to the payment security code and the payment authorization code comprising: calculating the payment security code in the TEE and the A hash value of the payment authorization code, the hash value being the secure payment authorization code.
  • the malware since the secure payment authorization code represented by the hash value is irreversible, the malware can be prevented from intercepting the secure payment authorization code, and the payment security code is obtained therefrom, thereby improving the security of the payment.
  • the displaying the secure payment authorization code in the TEE comprises: displaying the secure payment authorization code in the TEE by using a two-dimensional code or a barcode.
  • displaying the secure payment authorization code by means of a two-dimensional code or a barcode may improve the convenience of other devices to obtain a secure payment authorization code.
  • the present invention provides a payment method, including: receiving a secure payment authorization code, the secure payment authorization code including a payment security code; and verifying validity of the secure payment authorization code according to the payment security code; The secure payment authorization code is paid.
  • the payment server after receiving the secure payment authorization code, the payment server needs to determine whether the secure payment authorization code is derived from the TEE, that is, whether it is safe or legal, and then performs payment, thereby increasing the payment. Security.
  • the secure payment authorization code further includes payment information, where the payment information includes identifier information of a payment account, a payment type, a payment method, a payment time, a time stamp, and at least a random number generator.
  • the payment security code is generated based on the device number of the payment device or the identification information; the payment method further includes: acquiring the payment information in the secure payment authorization code; The payment of the secure payment authorization code includes: performing payment according to the payment information.
  • the payment information in the secure payment authorization code may include a variety of information, so that the payment server can flexibly perform payment according to requirements.
  • the payment security code generated based on the device number of the payment device or the identification information of the payment account can more reliably verify the security legality of the payment authorization code.
  • the obtaining the payment information in the secure payment authorization code includes: acquiring a first payment authorization code in the secure payment authorization code; and obtaining from the first payment authorization code The payment information.
  • the payment authorization code is first obtained from the secure payment authorization code, and the payment information is obtained from the payment authorization code, and the method for obtaining payment information according to the payment authorization code in the prior art can be used to improve the payment in the prior art.
  • the utilization of the method of information can reduce the complexity of obtaining a payment security code according to the secure payment authorization code.
  • the payment method further includes: receiving a payment authorization code request message, The payment authorization code request message is sent after the payment device receives the payment request instruction; and sends a response message to the payment device, where the response message carries the first payment authorization code; wherein the secure payment authorization code is The payment device is generated in the TEE according to the first payment authorization code and the payment security code in the TEE.
  • the payment authorization code carrying the payment information is sent to the payment device, so that the payment device can directly generate the secure payment authorization code according to the payment authorization code and the payment security code.
  • the payment device can directly generate the secure payment authorization code according to the payment authorization code and the payment security code.
  • the payment method further includes: receiving a payment information request message, where the payment information request message is sent after the payment device receives the payment request instruction; and sending a response message to the payment device, where The response message carries the payment information; wherein the secure payment authorization code is generated by the payment device in the TEE according to the payment information and a payment security code in the TEE.
  • the payment information is directly sent to the payment device, so that the payment device directly generates a secure payment authorization code according to the payment information and the payment security code, thereby realizing online payment.
  • the security payment authorization code can be generated flexibly according to the payment information.
  • the secure payment authorization code is generated by the payment device in the TEE according to the payment information pre-stored in the payment device and the secure payment code in the TEE.
  • the secure payment authorization code is generated by the payment device according to the locally pre-stored payment information and the payment security code, and the secure payment authorization code is flexibly generated according to the payment information, thereby implementing offline payment.
  • the secure payment authorization code is generated by the payment device according to the second payment authorization code according to the payment information pre-stored in the payment device, and according to the second payment authorization in the TEE. Generated by the code and the secure payment code in the TEE.
  • the secure payment authorization code is generated by the payment device according to the locally pre-stored payment information, and then generated according to the payment authorization code and the payment security code, so that the payment device can generate the payment authorization code in the prior art.
  • the method improves the utilization rate of the method for generating the payment authorization code in the prior art, and at the same time, realizes offline payment.
  • the verifying the security payment authorization code according to the payment security code includes: generating a third payment authorization code according to the payment information stored locally by the payment server; and calculating the third payment authorization And a hash value of the payment security code stored locally by the payment server; determining that the secure payment authorization code matches the hash value to verify the validity of the secure payment authorization code.
  • the present invention provides a payment device comprising means for performing the payment method of the first aspect.
  • the present invention provides a payment server for executing a module of the payment method of the second aspect.
  • the present invention provides a payment device comprising a memory, a processor and a transceiver.
  • the memory is for storing a program
  • the processor is for executing a program
  • the transceiver is for communicating with a payment server.
  • the processor performs the method of the first aspect when the program is executed.
  • the present invention provides a payment server including a memory, a processor, and a transceiver, the memory for storing a program, the processor for executing a program, and the transceiver for use with a payment device Communicate.
  • the processor performs the method of the second aspect when the program is executed.
  • the present invention provides a payment system comprising the payment device of the third aspect, and the payment server of the fourth aspect.
  • the present invention provides a system chip, including an input interface, an output interface, at least one processor, and a memory, where the input interface, the output interface, the processor, and the memory are connected by a system bus.
  • the processor is operative to execute code in the memory, the processor implementing the method of the first aspect when the code is executed.
  • the present invention provides a system chip, including an input interface, an output interface, at least one processor, and a memory, where the input interface, the output interface, the processor, and the memory are connected by a system bus.
  • the processor is operative to execute code in the memory.
  • the processor implements the method of the second aspect when the code is executed.
  • the present invention provides a computer readable medium storing program code for execution by a payment device, the program code comprising instructions for performing aspects of the first aspect.
  • the present invention provides a computer readable medium storing program code for execution by a payment server, the program code comprising instructions for performing the method of the second aspect.
  • the present invention provides a payment method, including: receiving an instruction for requesting payment; acquiring payment information for generating a payment authorization code in the TEE; and generating a payment authorization code according to the payment information in the TEE Displaying the payment authorization code in the TEE, so that the payment server obtains the payment authorization code and performs payment according to the payment authorization code.
  • the malware can be prevented from stealing the payment information, and the malware mimics the payment application to generate the payment authorization code.
  • the TEE Displaying the payment authorization code can ultimately improve the security of the payment.
  • a payment device comprising respective modules for performing the payment method of the twelfth aspect.
  • FIG. 1 is a schematic flowchart of a payment method according to an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a payment method according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a payment device according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a payment device according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a payment server according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a payment device according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a payment server according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a system chip according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a system chip according to an embodiment of the present invention.
  • FIG. 1 is a schematic flowchart of a payment method according to an embodiment of the present invention. It should be understood that FIG. 1 illustrates steps or operations of the payment method, but these steps or operations are merely examples, and embodiments of the present invention may perform other operations or variations of the various operations in FIG. 1. Moreover, the various steps in FIG. 1 may be performed in a different order than that presented in FIG. 1, and it is possible that not all of the operations in FIG. 1 are to be performed.
  • the user can input an instruction to the payment device through a unit or module having an input function of the payment device, between the payment device and the payment server, and between the cash register device and the payment server via the mobile network or the fixed network. Communication.
  • the payment device is used by the user who needs to make the payment, and the scanning device and the cash register device are used by the payee.
  • the cash register device may also be separately deployed into multiple physical devices according to functions, and the scanning device and the cash register device may also be deployed on the same physical device, such as a mobile phone.
  • TEE Transaction devices should be able to run in TEE and Rich Execution Environment (REE), REE such as Android (Android) environment.
  • REE Rich Execution Environment
  • TEE is an operating environment that coexists with REE on payment devices.
  • the TEE corresponds to a Trusted Operating System (Trusted Operating System) on the payment device;
  • the REE corresponds to a Rich Operating System (Rich OS) on the payment device, such as an Android system.
  • the payment device can also run only the TEE environment and its corresponding Trusted OS.
  • TEE The software and hardware resources that TEE can access are separate from the hardware and software resources that Rich OS can access. It can be said that TEE has its own running space. TEE has a higher security level than Rich OS. TEE provides a Trusted Application (TA), such as a secure execution environment for authorized security software, while also protecting the confidentiality, integrity, and access rights of TA resources and data. In order to ensure the credibility of the TEE itself, the TEE is verified and isolated from the Rich OS during the secure boot process. In TEE, each TA is independent of each other and cannot be accessed from each other without authorization.
  • TA Trusted Application
  • TEE internally contains a Trusted User Interface (TUI).
  • TUI refers to the hardware resources such as screen display and keyboard are completely controlled and accessed by TEE when the display of key information and the input of user key data (such as password) are entered, and the software in Rich OS cannot be accessed.
  • TEE can provide protection for user authentication, transaction confirmation and transaction processing.
  • TEE can communicate with REE through a standard interface that allows client applications (CAs) running in Rich OS to access TA services and data. And this standard interface has a strong key and cryptographic algorithm to ensure the security of communication between TEE and TEE.
  • CAs client applications
  • the payment device sends a registration request to the payment server to initiate a registration process.
  • the user can input various parameters such as the registered payment account, the user name corresponding to the payment account, the authentication information, the authentication password, and the like to the payment device, and then the payment device sends the parameters to the payment server.
  • the payment server can assign a unique user identifier to the user according to these parameters, such as Open Identity (OpenID). If the payment device sends the device number to the payment server, the payment server may also assign a unique user identifier to the user according to the device number, such as encrypting all or part of the device number, thereby obtaining the user identifier of the user.
  • Open Identity Open Identity
  • the payment server may further allocate a payment security code to the user, and the payment security code may be generated according to the device number of the payment device or the user identifier of the user (such as OpenID), such as directly using the device number as Pay the security code, or intercept part of the device number as the payment security code, or encrypt all or part of the device number, or intercept part of the user identification (such as OpenID) as the payment authorization code, or the user identification (All or part of the information, such as OpenID, is encrypted to obtain a payment security code.
  • the payment security code may be generated according to the device number of the payment device or the user identifier of the user (such as OpenID), such as directly using the device number as Pay the security code, or intercept part of the device number as the payment security code, or encrypt all or part of the device number, or intercept part of the user identification (such as OpenID) as the payment authorization code, or the user identification ( All or part of the information, such as OpenID, is encrypted to obtain a payment security code.
  • other information may be
  • the payment server may send the related information of the user's payment account to the payment device, and may also send the payment security code generated by the payment device to the payment device.
  • the payment server also records the payment security code and records the correspondence between the payment security code and the payment account.
  • the payment device should receive the payment security code sent by the payment server in the TEE and store it in the TEE to prevent malicious stealing and use, thereby improving the security of the payment security code.
  • the generation of the payment security code can also be done by the payment device.
  • the payment device may generate a payment security code by itself during the registration process or after the registration is completed, and report the payment security code to the payment server, so that the payment server knows that the user's payment account corresponds to the payment security code.
  • the payment device may generate the payment security code by using the method for generating the payment security code by the foregoing payment server, or generate the payment security code by using other methods.
  • the payment security code may also be generated by other means or other devices, and the payment device obtains the information and sends it to the payment server, or the payment server obtains the information and sends it to the payment device.
  • the payment server may regenerate the payment security code periodically or according to other requirements, and send the payment security code to the payment device to update the payment security code stored on the payment device.
  • the payment device may regenerate the payment security code periodically or according to other requirements, and send the payment security code to the payment server to update the payment security code stored on the payment server.
  • the payment information or payment security code of the user's payment account can be updated as needed.
  • the payment device obtains the payment information of the user's payment account and the payment security code, the payment device is ready for the user to make a payment.
  • the payment device receives a payment request input by the user.
  • the user can enter a request into the payment device in a variety of ways, such as by voice or by clicking a button on the input module of the payment device.
  • the present invention does not limit the manner in which a user inputs a request.
  • the payment device may receive the request instruction in the TEE (ie, the user enters the request on the TUI in the TEE) or may receive the request instruction in the REE (ie, the user enters the request on the user interface in the REE).
  • the payment device may send a request message for the payment authorization code to the payment server.
  • the request message may carry information such as a user identifier (such as OpenID) of the user, so that the payment server generates a payment authorization code for the user.
  • the payment server may generate a payment authorization code according to multiple payment information such as a user identifier of the user, a payment method of the user, a payment time, a timestamp, and a random number generator.
  • the payment authorization code may carry payment information such as a user identifier, a payment method, and a payment time.
  • the information used to generate the payment authorization code and the information carried by the payment authorization code may be referred to as payment information, and the payment information may include a user identifier of the user, a payment method of the user, a payment time, a time stamp, and the like.
  • the payment information may also include other information that may be related to the payment, and the embodiment of the present invention is not limited thereto.
  • the method by which the payment server generates the payment authorization code can refer to the method in the prior art.
  • the payment server sends a payment authorization code generated by the payment server to the payment device.
  • the payment device may be stored in the TEE or may be stored in the REE.
  • the payment device After receiving the payment authorization code sent by the payment server, the payment device can obtain the payment security in the TEE. The full code is then generated in the TEE based on the payment security code and the payment authorization code, and the secure payment authorization code is displayed in the TEE.
  • embodiments of the present invention do not limit the order in which the payment device acquires the payment security code and obtains the payment authorization code from the payment server.
  • the payment security code may be obtained by the payment device from the payment server or other device before, or may be generated by the payment device itself.
  • the reason why the payment device according to the payment security code and the payment authorization code generated from the payment server is called a secure payment authorization code is because the secure payment authorization code includes the payment security code as compared with the payment authorization code generated by the payment server.
  • the payment security code is stored in the TEE, so that the security payment authorization code can be verified from the TEE according to the payment security code, that is, the security payment authorization code is safe and reliable, and is legal.
  • the payment security code Since the function of the payment security code is to verify whether the payment authorization code is derived from the TEE, the payment security code is not limited to the foregoing generation manner, as long as the information is obtained from the TEE of the payment device, and the information and the user are reported to the payment server.
  • the corresponding relationship of the payment account which may be referred to as a payment security code, may generate a secure payment authorization code based on the information.
  • an implementation manner may be: calculating a hash value of the payment authorization code and the payment security code, and using the hash value as the security payment authorization code.
  • the secure payment authorization code can also be generated by other means, such as directly using the encryption algorithm to encrypt the payment authorization code and the payment security code, for example, the hash value of the payment information and the payment security code can be directly calculated, and the hash value is used. As a secure payment authorization code.
  • the payment device can display the secure payment authorization code in various ways, such as by one-dimensional code, two-dimensional code, barcode, number, and the like.
  • the payee or the cashier can scan the secure payment authorization code displayed in the TEE of the user's payment device through the scanning device.
  • the scanning device may be a dedicated scanning device, such as an infrared scanning device, or a scanning device integrated on other devices such as a mobile phone.
  • the scanning device may send the information to the cash register device. It should be noted that the scanning device and the payment device may be the same device. In this case, the device can directly obtain the secure payment authorization code after scanning the secure payment authorization code.
  • the cash register device may send a cashier request message to the payment server according to the secure payment authorization code, where the cash payment request message carries a secure payment authorization code.
  • the cash register request message may also carry other information, such as the account information of the payee, etc., which is not limited by the present invention.
  • the payment server After receiving the cash register request message sent by the cash register device, the payment server obtains the secure payment authorization code from the request message, and then can verify the legality of the secure payment authorization code and perform payment in multiple manners.
  • the legality of the secure payment authorization code refers to whether the source of the secure payment authorization code is legal.
  • the security code is used to ensure that the source of the security authorization code is legal, that is, it is derived from the legal TEE environment, not the malicious application forgery, non-screen capture, etc. A payment security code obtained illegally.
  • the payment server verifies the legality of the security payment authorization code by: generating the payment device
  • the secure payment authorization code is matched with the hash value of the payment authorization code and the payment security code calculated locally by the payment server to determine whether the secure payment authorization code generated by the payment device is legal. If the hash value calculated by the payment server matches the hash value calculated by the payment device, it indicates that the secure payment authorization code obtained by the payment server from the cash register device is legal.
  • the payment security code on which the payment server calculates the hash value may be pre-stored in the payment server.
  • the payment authorization code by which the payment server calculates the hash value may be generated by the payment server according to the locally stored payment information for generating the payment authorization code.
  • the payment server can also directly calculate the hash value of the above payment information and payment security code for comparison with the hash value generated by the payment device.
  • the payment security code and the payment information of the user may also be obtained from the secure payment authorization code, and the payment information may include one or more kinds of information such as the user identifier of the user, the payment method of the user, the payment time, and the time stamp.
  • the payment information may also include other information that may be related to the payment, and the embodiment of the present invention is not limited thereto.
  • the payment authorization code carrying the payment information may be obtained from the secure payment authorization code, and the payment information of the user is obtained from the payment authorization code.
  • the payment server can also obtain the user's payment information directly from the secure payment authorization code.
  • the payment server After obtaining the payment security code, the payment server verifies the security reliability of the secure payment authorization code according to the payment security code.
  • the payment server After obtaining the payment security code, the payment server verifies the security reliability of the secure payment authorization code according to the payment security code.
  • the payment server may determine whether the correspondence between the payment security code and the user's payment account is stored locally to determine the security and reliability of the secure payment authorization code. If the correspondence between the payment security code and the user's payment account is recorded on the payment server, the secure payment authorization code is safe and reliable, otherwise it is not secure.
  • the corresponding relationship between the payment security code and the payment account may be represented by the correspondence between the payment security code and the user identifier of the user, the payment device of the user, or other information, which is not limited by the present invention.
  • the payment server After the payment server obtains the payment information of the user, the validity of the payment information is verified. For example, when the payment information includes the payment time, it can be verified whether the time when the payment server receives the secure payment authorization code has exceeded the effective time of the secure payment authorization code.
  • An exemplary operation of the payment may be to deduct the payment amount from the payment account based on the identification information of the payment account.
  • the payment server may send a notification message to any one or all of the payment device and the cash register device to notify the payment device or the cash register device that the payment is successful.
  • the payment server may simultaneously send a notification message to the payment device and the cash register device, or may separately send a notification message to the payment device and the cash register device.
  • the notification message of the verification failure may also be sent to the payment device or the cash register device; when the payment server verifies that the payment message carried by the payment server is illegal, the payment may also be made to the payment.
  • the device and the cash register device send a notification message to facilitate subsequent operations of the payment device and the cash register device, such as the payment device regenerating the secure payment authorization code, and the cash register device abandoning the cash register.
  • the payment device may send a request message for generating payment information of the user's payment authorization code to the payment server.
  • the payment server determines payment information for generating a payment authorization code of the user.
  • the payment server directly sends the payment information to the payment device, and the payment device may store the received payment information in the TEE or may be stored in the REE.
  • the payment device may directly generate a secure payment authorization code according to the payment information and the payment security code, so as to improve the efficiency of generating the secure payment authorization code, and may also follow the payment information according to the prior art method.
  • a payment authorization code is first generated, and then a secure payment authorization code is generated according to the payment authorization code and the payment security code to reduce the complexity of generating a secure payment authorization code.
  • a hash value of the payment authorization code and the payment security code is calculated, and the hash value is used as a secure payment authorization code.
  • the payment server compares the secure payment authorization code with the hash value calculated locally by the payment server. If the secure payment authorization code matches the hash value calculated by the payment server, the secure payment authorization code is legal.
  • the payment authorization code on which the payment server locally calculates the hash value may be generated by the payment server according to the locally stored payment information; the payment security code on which the payment server locally calculates the hash value may be pre-stored in the payment server. .
  • the payment method of the payment device in the online mode is described in conjunction with FIG. 1 .
  • the payment method for payment by the offline mode according to the embodiment of the present invention is described below with reference to FIG. 2 .
  • the same reference numerals in FIG. 2 as those in FIG. 1 denote the same or similar meanings, and are not described herein again for the sake of brevity.
  • the payment server may send the payment information for the payment device to generate the payment authorization code to the payment device during the registration process initiated by the user to the payment server by the payment device or after the registration is completed, and the payment device may Store these payment information in TEE or REE.
  • the payment device receives the payment request instruction, and generates, according to the payment information (such as the user identifier of the user, the payment method of the user, the payment time, the timestamp, the random number generator, etc.) that has been stored on the payment device for generating the payment authorization code. And paying the authorization code; then generating a secure payment authorization code in the TEE according to the payment authorization code and the payment security code already stored in the TEE of the payment device; finally displaying the secure payment authorization code in the TEE.
  • the payment information such as the user identifier of the user, the payment method of the user, the payment time, the timestamp, the random number generator, etc.
  • the foregoing information used by the payment device to generate the payment authorization code that is stored before the user receives the request instruction of the user may be obtained from the payment server in the process of the user registering with the payment server by using the payment device, or may be after the registration is completed. Obtained from the payment server or obtained from other devices.
  • the payment authorization code when the payment device generates the secure payment authorization code according to the information used to generate the payment authorization code and the payment security code, the payment authorization code may be generated according to the information used to generate the payment authorization code.
  • other methods may also be used, and then a secure payment authorization code is generated according to the payment authorization code and the payment security code. In this way, the method of generating a payment authorization code in the prior art can be used to improve the efficiency of generating a secure payment authorization code, and the complexity of generating a secure payment authorization code has been reduced.
  • the secure payment authorization code may be directly generated according to the payment information and the payment security code used to generate the payment authorization code on the payment device, or may be a certain payment authorization code according to part of the information used to generate the payment authorization code. And generating a secure payment authorization code according to the payment authorization code and the payment security code.
  • an implementation manner may be: calculating a hash value of the payment authorization code and the payment security code, and using the hash value as the security payment authorization code.
  • the secure payment authorization code can also be generated by other means, such as directly using the encryption algorithm to encrypt the payment authorization code and the payment security code.
  • the subsequent payment process is the same as or similar to the related steps in the payment method in FIG. 1 and will not be further described herein for brevity.
  • the secure payment authorization code generated by the payment device may be generated by the payment device in the TEE according to the payment authorization code and the pre-stored payment security code, and may be stored in the TEE according to the payment information and pre-stored in the TEE.
  • the local payment security code is generated.
  • the payment authorization code may be obtained by the payment device from the payment server after receiving the instruction requested by the user, or may be a payment.
  • the device is generated locally based on the user's payment information.
  • the payment device locally generates the payment authorization code according to the payment information, and then generates a secure payment authorization code according to the payment security code, or the payment device directly generates a secure payment authorization code according to the payment information and the payment security code, and the payment information may be a payment device. Obtained and stored from the payment server before receiving the user's payment request, So the payment device gets from the payment server after receiving the user's payment request.
  • the payment information can be stored in the TEE of the payment device or in the REE of the payment device, but the payment security code needs to be stored in the TEE.
  • Another payment method for improving payment security in the embodiment of the present invention is: the payment device receives an instruction to request payment; acquires payment information in the TEE for generating a payment authorization code; and according to the payment in the TEE The information generates a payment authorization code; the payment authorization code is displayed in the TEE.
  • the payment device generates a payment authorization code according to the payment information in the TEE, and the payment process after the payment server obtains the payment authorization code is the same as or similar to the prior art, and details are not described herein again.
  • FIG. 3 is a schematic structural diagram of a payment device 300 according to an embodiment of the present invention.
  • the payment device 300 shown in FIG. 3 can implement the steps performed by the payment device in FIG. 1 and FIG. 2, and is not described herein again to avoid repetition.
  • the input module 310 is configured to receive an instruction for requesting payment.
  • the obtaining module 320 is configured to obtain a payment security code in the TEE.
  • the generating module 330 is configured to generate, in the TEE, a secure payment authorization code according to the payment security code, where the payment security code is used by the payment server to verify the validity of the secure payment authorization code.
  • the output module 340 is configured to display the secure payment authorization code in the TUI of the TEE, so that the payment server obtains the secure payment authorization code, and performs payment according to the secure payment authorization code.
  • the payment device of the present invention since the generated payment authorization code includes the security code in the TEE, can indicate that the payment authorization code is generated in the TEE, that is, the payment authorization code is legal, and after the payment server obtains the payment authorization code,
  • the payment authorization code may be determined to be from the security environment by determining that the security authorization code is included in the payment authorization code, and is trusted, and then the payment is performed, thereby avoiding payment according to the payment authorization code generated by the malware counterfeit legal software. Finally, the security of the payment is provided.
  • the malware can be prevented from stealing the payment authorization generated in the TEE of the payment device by means of screen capture or the like.
  • the code can also prevent the malware from triggering the payment device to generate and steal the payment authorization code, and ultimately improve the security of the payment.
  • the acquiring module is further configured to acquire payment information, where the payment information includes identifier information of a payment account, a payment type, a payment method, a payment time, a time stamp, and at least one of a random number generator.
  • the payment security code is generated based on the device number of the payment device or the identifier information; the generating module 330 is specifically configured to: generate the secure payment authorization according to the payment security code and the payment information in the TEE code.
  • the obtaining module 320 is specifically configured to: send a request message of the payment information to a payment server; receive a response message sent by the payment server, where the response message includes the payment information.
  • the acquiring module is specifically configured to: send a request message for sending a payment authorization code to the payment server; receive a response message sent by the payment server, where the response message includes a payment authorization code, and the payment authorization code Carrying the payment information.
  • the generating module 330 is specifically configured to generate the secure payment authorization code according to the payment security code and the payment authorization code in the TEE.
  • the payment information is pre-stored in the TEE before receiving the instruction.
  • the generating module is specifically configured to: generate a payment authorization code according to the payment information; generate the secure payment authorization according to the payment security code and the payment authorization code in the TEE code.
  • the generating module is specifically configured to: calculate the payment security code and the branch A hash value of the authorization code, the hash value being the secure payment authorization code.
  • the output module is specifically configured to display the secure payment authorization code in the TEE by using a two-dimensional code or a barcode.
  • FIG. 4 is a schematic structural diagram of a payment device 400 according to an embodiment of the present invention.
  • the payment device 400 includes components such as a processing unit 410, an input unit 420, an output unit 430, a storage unit 440, a communication unit 450, and a power source 460, which communicate via one or more buses.
  • the structure of the payment device shown in FIG. 4 does not constitute a limitation of the present invention, and it may be a bus-shaped structure or a star-shaped structure, and may further include more than that shown in FIG. Or fewer parts, or combine some parts, or different parts.
  • the payment device 400 may be any mobile or portable payment device, including but not limited to a mobile phone, a mobile computer, a tablet, a personal digital assistant (PDA), a media player, a smart TV, And a combination of two or more of the above.
  • PDA personal digital assistant
  • the processing unit 410 is a control center of the payment device that connects various parts of the entire payment device using various interfaces and lines, by running or executing software programs and/or modules stored in the storage unit, and calling data stored in the storage unit. To perform various functions of the payment device and/or process data.
  • the processing unit 410 may be composed of an integrated circuit (IC), for example, may be composed of a single packaged IC, or may be composed of a plurality of packaged ICs that have the same function or different functions.
  • the processing unit 410 may include only a central processing unit (CPU), or may be a GPU, a digital signal processor (DSP), and a control chip in the communication unit 450 (for example, A combination of baseband chips).
  • the CPU may be a single operation core, and may also include multiple operation cores.
  • the input unit 420 is configured to implement user interaction with the payment device and/or information input into the payment device.
  • the input unit 420 can receive numeric or character information input by the user to generate a signal input related to user settings or function control.
  • the input unit 420 may be a touch panel, or may be other human-computer interaction interfaces, such as physical input keys, microphones, etc., and may also be other external information capture devices, such as cameras.
  • a touch panel also known as a touch screen or touch screen, collects operational actions that the user touches or approaches on.
  • the user uses an action of any suitable object or accessory such as a finger or a stylus on or near the touch panel, and drives the corresponding connecting device according to a preset program.
  • the touch panel may include two parts: a touch detection device and a touch controller.
  • the touch detection device detects a touch operation of the user, converts the detected touch operation into an electrical signal, and transmits the electrical signal to the touch controller;
  • the touch controller receives the electrical signal from the touch detection device, and It is converted into contact coordinates and sent to the processing unit 410.
  • the touch controller can also receive commands from the processing unit 410 and execute them.
  • touch panels can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the physical input keys used by the input unit may include, but are not limited to, a physical keyboard, function keys (such as a volume control button, a switch button, etc.), a trackball, a mouse, a joystick, and the like. Or a variety.
  • An input unit in the form of a microphone can collect the voice input by the user or the environment and convert it into a command executable by the processing unit in the form of an electrical signal.
  • the input unit 420 can also be various types of sensor components, such as Hall devices, for detecting physical quantities of the payment device, such as force, moment, pressure, stress, position, displacement, velocity, acceleration, angle, angular velocity, number of revolutions, and rotational speed. And when the working state changes, etc., it is converted into electricity for detection and control.
  • sensor components may also include gravity sensors, three-axis accelerometers, gyroscopes, and the like.
  • the output unit 430 includes, but is not limited to, an image output unit and a sound output unit.
  • Image output unit for output Text, images, and/or videos.
  • the image output unit may include a display panel, such as a liquid crystal display (LCD), an organic light-emitting diode (OLED), a field emission display (FED), or the like. Display panel.
  • the image output unit may comprise a reflective display, such as an electrophoretic display, or a display utilizing an Interferometric Modulation of Light.
  • the image output unit may comprise a single display or multiple displays of different sizes.
  • the touch panel used by the input unit 420 can also serve as the display panel of the output unit 430 at the same time.
  • the touch panel detects a touch or proximity gesture operation thereon, it is transmitted to the processing unit 410 to determine the type of the touch event, and then the processing unit 410 provides a corresponding visual output on the display panel according to the type of the touch event.
  • the input unit 420 and the output unit 430 are two independent components to implement the input and output functions of the payment device, in some embodiments, the touch panel and the display panel may be integrated into one.
  • the image output unit can display various graphical user interfaces (GUIs) as virtual control components, including but not limited to windows, scroll axes, icons, and scrapbooks, for the user to touch. Take action.
  • GUIs graphical user interfaces
  • the image output unit may include a filter and an amplifier for filtering and amplifying the video output by the processing unit 410.
  • the audio output unit includes a digital to analog converter for converting the audio signal output by the processing unit 410 from a digital format to an analog format.
  • the storage unit 440 can be used to store software programs and modules, and the processing unit 410 executes various functional applications of the payment device 400 and implements data processing by running software programs and modules stored in the storage unit 440.
  • the storage unit 440 mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, such as a sound playing program, an image playing program, and the like; and the data storage area can be stored according to the payment. Data created by the use of the device (such as audio data, phone book, etc.).
  • the application includes any application installed on the payment device, including but not limited to browsers, email, instant messaging services, word processing, keyboard virtualization, widgets, encryption, digital rights management, voice recognition, Voice copying, positioning (such as those provided by GPS), music playback, and more.
  • the storage unit 440 may include a volatile memory, such as a non-volatile volatile random access memory (NVRAM), a phase change random access memory (PRAM), and a magnetoresistive random memory.
  • NVRAM non-volatile volatile random access memory
  • PRAM phase change random access memory
  • MRAM phase change random access memory
  • MRAM magnetoresistive random memory
  • MRAM may also include a non-volatile memory, such as at least one disk storage device, an electrically erasable programmable read-only memory (EEPROM), a flash memory device, For example, NOR flash memory or NAND flash memory.
  • EEPROM electrically erasable programmable read-only memory
  • flash memory device For example, NOR flash memory or NAND flash memory.
  • the non-volatile memory stores operating systems and applications executed by the processing unit.
  • Processing unit 410 loads the running program and data from the non-volatile memory into memory and stores the digital content in a plurality of storage devices.
  • the operating system includes various components and/or drivers for controlling and managing conventional system tasks such as memory management, storage device control, power management, and the like, as well as facilitating communication between various hardware and software.
  • the operating system may be an Android system of Google Inc., an iOS system developed by Apple Corporation, a Windows operating system developed by Microsoft Corporation, or an embedded operating system such as Vxworks.
  • the communication unit 150 is configured to establish a communication channel through which the payment device connects to the remote server and media data from the remote server.
  • the communication unit 150 may include a wireless local area network (Wireless LAN) module, a Bluetooth module, a baseband module, and the like, and a radio frequency (RF) circuit corresponding to the communication module.
  • WLAN Letter Bluetooth communication, infrared communication and/or cellular communication system communication, such as Wideband Code Division Multiple Access (W-CDMA) and/or High Speed Downlink Packet Access (HSDPA) ).
  • W-CDMA Wideband Code Division Multiple Access
  • HSDPA High Speed Downlink Packet Access
  • the communication module is used to control communication of components in the payment device, and can support Direct Memory Access.
  • the various communication modules in the communication unit 450 generally appear in the form of an integrated circuit chip and can be selectively combined without necessarily including all communication modules and corresponding antenna groups.
  • communication unit 450 may include only baseband chips, radio frequency chips, and corresponding antennas to provide communication functionality in a cellular communication system.
  • the wireless communication connection established via communication unit 450 such as wireless local area network access or WCDMA access, may be connected to a cellular network (Cellular Network) or the Internet (Internet).
  • a communication module, such as a baseband module, in the communication unit may be integrated into the processor unit, typically an APQ+MDM series platform such as that provided by Qualcomm.
  • the radio frequency circuit is used for receiving and transmitting signals during information transmission and reception or during a call. For example, after the downlink information of the base station is received, it is processed by the processing unit 410; in addition, the data designed for the uplink is transmitted to the base station.
  • the radio frequency circuit includes well-known circuits for performing these functions, including but not limited to an antenna system, a radio frequency transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a codec. (Codec) chipset, Subscriber Identity Module (SIM) card, memory, etc.
  • the RF circuit can communicate with the network and other devices through wireless communication.
  • the wireless communication may use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (Code). Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), High Speed Uplink Packet Access (HSUPA), Long Term Evolution (LTE) , email, Short Messaging Service (SMS), etc.
  • GSM Global System of Mobile communication
  • GPRS General Packet Radio Service
  • Code Division Multiple Access CDMA
  • WCDMA Wideband Code Division Multiple Access
  • HSUPA High Speed Uplink Packet Access
  • LTE Long Term Evolution
  • email Short Messaging Service
  • Power source 460 is used to power different components of the payment device to maintain its operation.
  • the power source 460 can be a built-in battery, such as a conventional lithium ion battery, a nickel metal hydride battery, etc., and can also include an external power source that directly supplies power to the payment device 400, such as an AC adapter.
  • the power supply 460 can also be more widely defined, for example, can also include a power management system, a charging system, a power failure detection circuit, a power converter or an inverter, and a power status indicator (eg, Light-emitting diodes), as well as any other components associated with the generation, management, and distribution of power for the payment device.
  • the payment device 400 of FIG. 4 is capable of performing the various steps of the payment method of FIG. 1 or FIG. 2, and corresponds to the payment device 300 of FIG. 3, as the input unit 420 can implement the same function as the input module 310, and the processing unit 410 can The function of the acquisition module 320 is the same as that of the generation module 330.
  • the output unit 430 can implement the same functions as the output module 340. For brevity, no further details are provided herein.
  • FIG. 5 is a schematic structural diagram of a payment server 500 according to an embodiment of the present invention.
  • the payment server of FIG. 5 can implement the steps performed by the payment server in FIGS. 1 and 2, and will not be described herein for brevity.
  • the receiving module 510 is configured to receive a secure payment authorization code, where the secure payment authorization code includes a payment security code.
  • the verification module 520 is configured to verify validity of the secure payment authorization code according to the payment security code.
  • the payment module 530 is configured to perform payment according to the secure payment authorization code.
  • the payment server of the present invention After receiving the secure payment authorization code, the payment server of the present invention needs to verify whether the payment authorization code is derived from the TEE by verifying the payment security code, that is, whether it is safe or legal, and then performing payment, thereby improving payment security. .
  • the secure payment authorization code further includes payment information, where the payment information includes identifier information of a payment account, a payment type, a payment method, a payment time, a time stamp, and at least one of a random number generator.
  • the payment security code is generated based on the device number of the payment device or the identification information;
  • the payment server further includes an obtaining module, configured to acquire the payment information in the secure payment authorization code;
  • the payment module is specifically configured to perform payment according to the payment information.
  • the acquiring module is specifically configured to: acquire a first payment authorization code in the secure payment authorization code; and obtain the payment information from the payment authorization code.
  • the receiving module 510 is further configured to receive a payment authorization code request message sent by the payment device.
  • the payment server further includes a sending module, configured to send a response message to the payment device, where the response message carries the first payment authorization code.
  • the secure payment authorization code is generated by the payment device according to the first payment authorization code and a secure payment code in the TEE.
  • the receiving module 510 is further configured to receive a payment information request message sent by the payment device.
  • the payment server further includes a sending module, configured to send a response message to the payment device, where the response message carries the payment information.
  • the secure payment authorization code is generated by the payment device in the TEE according to the payment information and a secure payment code in the TEE.
  • the secure payment authorization code is generated by the payment device in the TEE according to the payment information pre-stored in the payment device and a secure payment code in the TEE.
  • the secure payment authorization code is generated by the payment device according to the second payment authorization code according to the payment information pre-stored in the payment device, and according to the second payment authorization in the TEE. Generated by the code and the secure payment code in the TEE.
  • the verifying the validity of the secure payment authorization code according to the payment security code includes: generating a third payment authorization code according to the payment information stored locally by the payment server; and calculating the third And a hash value of the payment authorization code and the payment security code stored locally by the payment server; determining that the secure payment authorization code matches the hash value to verify the validity of the secure payment authorization code.
  • FIG. 6 is a schematic structural diagram of a payment device 600 according to an embodiment of the present invention. It should be understood that the payment device 600 of FIG. 6 is capable of performing the various steps performed by the payment device of FIGS. 1 and 2, and to avoid repetition, will not be described in detail herein.
  • Payment device 600 includes a memory 610, a processor 620, and a transceiver 630.
  • the memory 610 is configured to store a program.
  • the transceiver 630 is configured to receive an instruction to generate a payment authorization code.
  • the processor 620 is configured to execute a program in the memory 610, when the program is executed, the processor 620 is configured to: acquire a payment security code in the TEE, where the payment security code is used by the payment server to verify the payment. The legality of the authorization code; a secure payment authorization code is generated in the TEE according to the payment security code.
  • the transceiver 630 is further configured to display the secure payment authorization code in the TUI of the TEE, so that the payment server obtains the secure payment authorization code, and performs payment according to the secure payment authorization code.
  • the payment device of the present invention since the generated payment authorization code includes the security code in the TEE, can indicate that the payment authorization code is generated in the TEE, that is, the payment authorization code is legal, and after the payment server obtains the payment authorization code,
  • the payment authorization code may be determined to be from the security environment by determining that the security authorization code is included in the payment authorization code, and is trusted, and then the payment is performed according to the payment information, thereby avoiding the payment authorization code generated according to the malware counterfeit legal software. Make a payment and ultimately provide the security of the payment.
  • the payment authorization code is presented in the TEE of the payment device, and the payment device under the TEE has an anti-screening function, it can avoid evil.
  • the software can steal the payment authorization code generated in the TEE of the payment device by means of screen capture, etc., and can also prevent the malware from triggering the payment device to generate and steal the payment authorization code, and finally improve the security of the payment.
  • the processor 620 is specifically configured to: obtain payment information, generate the secure payment authorization code according to the payment security code and the payment information, where the payment information includes identifier information of a payment account, At least one of a payment type, a payment method, a payment time, a time stamp, and a random number generator, the payment security code being generated based on a device number of the payment device or the identification information.
  • the processor 620 is specifically configured to: send a request message for the payment information to a payment server; receive a response message sent by the payment server, where the response message includes the payment information.
  • the processor 620 is specifically configured to: send a request message for a payment authorization code to a payment server; receive a response message sent by the payment server, where the response message includes a payment authorization code, and the payment authorization The code carries the payment information; the secure payment authorization code is generated according to the payment security code and the payment authorization code in the TEE.
  • the memory 610 is specifically configured to pre-store payment information in the TEE before receiving the instruction.
  • the processor 620 is specifically configured to: generate a payment authorization code according to the payment information; generate the secure payment according to the payment security code and the payment authorization code in the TEE Authorization code.
  • the processor 620 is specifically configured to: calculate a hash value of the payment security code and the payment authorization code, where the hash value is the secure payment authorization code.
  • the transceiver is specifically configured to display the secure payment authorization code in the TEE by using a two-dimensional code or a barcode.
  • FIG. 7 is a schematic structural diagram of a payment server according to an embodiment of the present invention.
  • the payment server 700 of FIG. 7 can implement the various steps performed by the payment server in FIGS. 1 and 2, and will not be described herein for brevity.
  • the memory 710 is used to store programs.
  • the transceiver 730 is configured to receive a secure payment authorization code.
  • the processor 720 is configured to verify the validity of the secure payment authorization code according to the payment security code.
  • the processor 720 is further configured to perform payment according to the secure payment authorization code.
  • the payment server of the present invention After receiving the secure payment authorization code, the payment server of the present invention needs to verify whether the payment authorization code is derived from the TEE by verifying the payment security code, that is, whether it is safe or legal, and then performing payment, thereby improving payment security. .
  • the secure payment authorization code further includes payment information, where the payment information includes identifier information of a payment account, a payment type, a payment method, a payment time, a time stamp, and at least one of a random number generator.
  • the payment security code is generated based on the device number of the payment device or the identification information; the processor 720 is further configured to acquire the payment information in the secure payment authorization code, according to the payment information. Make a payment.
  • the processor 720 is specifically configured to: acquire a first payment authorization code in the secure payment authorization code; and obtain the payment information from the first payment authorization code.
  • the transceiver 730 is further configured to receive a payment authorization code request message sent by the payment device, and send a response message to the payment device, where the response message carries the payment authorization code.
  • the secure payment authorization code is generated by the payment device in the TEE according to the payment authorization code and the secure payment code in the TEE.
  • the transceiver 730 is further configured to receive payment information sent by the payment device. And requesting a message, sending a response message to the payment device, where the response message carries the payment information.
  • the secure payment authorization code is generated by the payment device in the TEE according to the payment information and a secure payment code in the TEE.
  • the secure payment authorization code is generated by the payment device in the TEE according to the payment information pre-stored in the payment device and a secure payment code in the TEE.
  • the secure payment authorization code is generated by the payment device according to the payment information pre-stored in the payment device, according to the second payment authorization code and TEE. Generated in the secure payment code.
  • the processor 720 is specifically configured to generate a third payment authorization code according to the payment information stored locally by the payment server, and calculate the third payment authorization code and the payment security locally stored by the payment server. a hash value of the code; determining that the secure payment authorization code matches the hash value to verify the validity of the secure payment authorization code.
  • FIG. 8 is a schematic structural diagram of a system chip according to an embodiment of the present invention.
  • the system chip 800 of FIG. 8 includes an input interface 810, an output interface 820, at least one processor 830, and a memory 840.
  • the input interface 810, the output interface 820, the processor 830, and the memory 840 are connected by a bus.
  • the processor 830 is configured to execute code in the memory 840 that, when executed, implements the method performed by the payment device of FIGS. 1 and 2.
  • FIG. 9 is a schematic structural diagram of a system chip according to an embodiment of the present invention.
  • the system chip 900 of FIG. 9 includes an input interface 910, an output interface 920, at least one processor 930, and a memory 940.
  • the input interface 910, the output interface 920, the processor 930, and the memory 940 are connected by a bus.
  • the processor 930 is configured to execute code in the memory 940 that, when executed, implements the method performed by the payment server of FIGS. 1 and 2.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or may be Each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本发明的技术方案提供了一种支付方法、支付设备和支付服务器。该支付方法包括：支付设备接收请求支付指令，获取TEE中的支付安全码，根据支付安全码生成安全支付授权码，在TEE的TUI显示安全支付授权码；支付服务器获取安全支付授权码，根据支付安全码验证安全支付授权码的合法性，根据安全支付授权码进行支付。本发明的技术方案可以提高支付的安全性。

Description

支付方法、支付设备和支付服务器 技术领域
本发明涉及信息技术领域，尤其涉及一种支付方法、支付设备和支付服务器。
背景技术
通过扫描条形码或扫描二维码完成支付的现象，在日常生活中(如便利店、商铺、餐厅等消费场所)已经越来越普遍。
通过扫描条形码或扫描二维码实现支付主要是用户通过支付设备(如手机)以条形码或二维码形式向商户提供包含用户账户信息等支付信息的支付授权码，商户通过手机或专用扫描设备扫描用户的支付设备上显示的支付授权码，然后将该支付授权码发送给支付***服务器，由支付***服务器根据该支付授权码执行后续支付操作。
用户使用支付设备向商户提供支付授权码之前，需要获取该支付授权码。目前，用户使用支付设备获取支付授权码可以通过两种方式实现，一种是离线方式，一种是在线方式。若用户使用支付设备通过离线方式获取支付授权码，则该支付方式可称为离线支付；若用户使用支付设备通过在线方式获取支付授权码，则该支付方式可称为在线支付。
若支付设备需要通过离线方式获取支付授权码，则支付***服务器和用户的支付设备上均需要有授权码计算器，且支付***服务器和用户的支付设备上的授权码计算器是同步的，即支付***服务器和用户的支付设备上的授权码计算器生成该用户的支付授权码所依据的支付信息，如账号信息、时间、时间戳、随机数产生器等是一致的。当支付设备需要离线方式获取支付授权码时，运行于支付设备的富执行环境(Rich Execution Environment，REE)中的用户界面接收到用户输入的付款请求(如用户点击用户界面上中的“付款”选项)时，运行REE中的授权码计算器，生成支付授权码，并在支付设备的显示装置上以条形码或二维码等形式在REE下呈现。
若支付设备需要通过在线方式获取支付授权码，则用户的支付设备必须与网络连接。这样，当用户需要获取支付授权码时，用户通过运行在支付设备的REE中的用户界面输入付款请求(如点击用户界面上的“付款”选项)，支付设备接收用户的付款请求后，向支付***服务器发出请求，然后支付***服务器生成用户的支付授权码并通过网络发送给用户的支付设备。用户的支付设备接收该支付授权码，并通过运行在REE下的用户界面从支付设备的显示装置上呈现。
上述支付方式虽然通过扫描以条形码或二维码形式呈现的支付授权码的方式简化了原本交易过程中输入账号等繁琐的过程，提高了用户的使用感受和体验，但是不论是离线支付方式还是在线支付方式，均存在巨大的安全隐患。
因为，不论是离线支付方式还是在线支付方式，支付***服务器接收到支付授权码后，只会判断支付授权码的有效性，即只验证支付授权码是否正确，是否与支付***服务器侧生成或发送的支付授权码一致，而不会去判断该支付授权码的来源是否合法。当确定该支付授权码有效时就执行后续支付流程，会导致支付***服务器在获取到以下任意一种支付授权码时，也会判断该支付授权码有效，然后进行后续支付操作，从而降低支付的安全性：恶意应用获取到授权码计算器生成支付授权码的支付信息后，根据这些支付信息仿冒授权码计算器生成的支付授权码；恶意应用擅自模拟用户的支付行为，触 发授权码计算器生成的支付授权码；用户触发生成或接收支付授权码后，恶意应用窃取的支付授权码，如截屏获取以二维码形式显示的支付授权码
发明内容
本发明提供的支付方法、支付设备和支付服务器，能够提高支付的安全性。
第一方面，本发明提供了一种支付方法，包括：接收请求支付的指令；获取可信执行环境(Trusted Execution Environment，TEE)中的支付安全码；在TEE中根据所述支付安全码生成安全支付授权码，所述支付安全码用于支付统服务器验证所述安全支付授权码的合法性；在所述TEE的TUI显示所述安全支付授权码，以便于所述支付服务器获取所述安全支付授权码，并根据所述安全支付授权码进行支付。
本发明的支付方法中，由于安全支付授权码包含了TEE中的支付安全码，因此可以表明安全支付授权码是在TEE中生成的，即表明安全支付授权码合法。支付服务器获取到该安全支付授权码后，可以判断该安全支付授权码中的支付安全码来确定该安全支付授权码来源于安全环境，是可信的，然后再进行支付，从而可以避免根据恶意软件仿冒合法软件生成的支付授权码进行支付，最终提供支付的安全性。另一方面，由于安全支付授权码是在支付设备的TEE中呈现的，而TEE下的支付设备具有防截屏功能，因此，可以避免恶意软件通过截屏等方式盗取支付设备的TEE中生成的安全支付授权码，也可以避免恶意软件触发支付设备生成和盗取安全支付授权码，最终也提高支付的安全性。
在一种可能的实现方式中，所述方法还包括，获取支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种；其中，所述支付安全码是基于支付设备的设备号或所述标识信息生成的；所述在TEE中根据所述支付安全码生成安全支付授权码，包括：在TEE中根据所述支付安全码和支付账号的支付信息生成所述安全支付授权码。
该实现方式中，生成安全支付授权码的支付信息可以包括多种信息，以便于支付服务器可以根据需求灵活进行支付。另一方面，基于支付设备的设备号或支付账号的标识信息生成的支付安全码可以更可靠地验证安全支付授权码的安全合法性。
在一种可能的实现方式中，所述获取所述支付信息包括：向支付服务器发送所述支付信息的请求消息；接收支付服务器发送的响应消息，所述响应消息包括所述支付信息。
该实现方式中，支付信息是在需要生成安全支付授权码时从支付服务器处即时获取的，使得该支付方式可以通过在线方式的实现。
在一种可能的实现方式中，所述获取所述支付信息包括：向支付服务器发送支付授权码的请求消息；接收支付服务器发送的响应消息，所述响应消息包括支付授权码，所述支付授权码携带所述支付信息；其中，所述在TEE中根据所述支付安全码与所述支付信息生成所述安全支付授权码包括：在TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
该实现方式中，在在线方式下，先根据支付信息生成支付授权码，再生成安全支付授权码，一方面能够沿用现有技术中生成支付授权码的方法，提高现有技术中生成支付授权码的方法的利用率，另一方面，可以降低根据支付安全码生成安全支付授权码的复杂度。
在一种可能的实现方式中，所述支付信息在接收所述指令之前已存储在支付设备中。
该实现方式中，由于支付信息预先存储在支付设备中，因此在生成安全支付授权码时不需要从支付服务器获取支付信息即可生成安全支付授权码，从而可以实现离线支付。
在一种可能的实现方式中，所述在TEE中根据所述支付安全码和支付信息生成所述安全支付授权码，包括：根据所述支付信息生成支付授权码；在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
该实现方式中，在离线支付方式下，先根据支付信息生成支付授权码，再生成安全支付授权码，一方面能够沿用现有技术中生成支付授权码的方法，提高现有技术中生成支付授权码的方法的利用率，另一方面，可以降低根据支付安全码生成安全支付授权码的复杂度。
在一种可能的实现方式中，所述在TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码，包括：在所述TEE中计算所述支付安全码和所述支付授权码的哈希值，所述哈希值为所述安全支付授权码。
该实现方式中，由于通过哈希值表示的安全支付授权码是不可逆的，能够避免恶意软件截取安全支付授权码后从中获取支付安全码，从而提高支付的安全性。
在一种可能的实现方式中，所述显示所述安全支付授权码于所述TEE中，包括：通过二维码或条形码的方式显示所述安全支付授权码于所述TEE中。
该实现方式中，通过二维码或条形码等方式显示安全支付授权码，可以提高其他设备获取安全支付授权码的便捷性。
第二方面，本发明提供了一种支付方法，包括：接收安全支付授权码，所述安全支付授权码包括支付安全码；根据所述支付安全码验证所述安全支付授权码的合法性；根据所述安全支付授权码进行支付。
本发明的支付方法中，支付服务器接收到安全支付授权码后，需要通过其中的支付安全码来确定该安全支付授权码是否来源于TEE，即是否安全或合法，然后再进行支付，从而提高支付的安全性。
在一种可能的实现方式中，所述安全支付授权码还包括支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种，所述支付安全码是基于支付设备的设备号或所述标识信息生成的；所述支付方法还包括：获取所述安全支付授权码中的所述支付信息；其中，所述根据所述安全支付授权码进行支付，包括：根据所述支付信息进行支付。
该实现方式中，安全支付授权码中的支付信息可以包括多种信息，以便于支付服务器可以根据需求灵活进行支付。另一方面，基于支付设备的设备号或支付账号的标识信息生成的支付安全码可以更可靠地验证支付授权码的安全合法性。
在一种可能的实现方式中，所述获取所述安全支付授权码中的支付信息，包括：获取所述安全支付授权码中的第一支付授权码；从所述第一支付授权码中获取所述支付信息。
该实现方式中，从安全支付授权码中先获取支付授权码，再从支付授权码中获取支付信息，可以沿用现有技术中根据支付授权码获取支付信息的方法，提高现有技术中获取支付信息的方法的利用率，另一方面，可以降低根据安全支付授权码获取支付安全码的复杂度。
在一种可能的实现方式中，所述支付方法还包括：接收支付授权码请求消息，所述 支付授权码请求消息是支付设备接收到支付请求指令后发送的；向所述支付设备发送响应消息，所述响应消息携带所述第一支付授权码；其中，所述安全支付授权码为所述支付设备在TEE中根据所述第一支付授权码和所述TEE中的支付安全码生成的。
该实现方式中，接收到支付设备发送的支付授权码请求消息后，向支付设备发送携带支付信息的支付授权码，以便于支付设备可以直接根据该支付授权码和支付安全码生成安全支付授权码，实现在线支付的同时，降低支付设备生成安全支付授权码的复杂性。
在一种可能的实现方式中，所述支付方法还包括：接收支付信息请求消息，所述支付信息请求消息是支付设备接收到支付请求指令后发送的；向所述支付设备发送响应消息，所述响应消息携带所述支付信息；其中，所述安全支付授权码为所述支付设备在TEE中根据所述支付信息和所述TEE中的支付安全码生成的。
该实现方式中，接收到支付设备发送的支付信息请求消息后，向支付设备直接发送支付信息，以便于支付设备直接根据该支付信息和支付安全码生成安全支付授权码，实现在线支付的同时，可以灵活根据支付信息生成安全支付授权码。
在一种可能的实现方式中，所述安全支付授权码为支付设备在TEE中根据预先存储在所述支付设备中的所述支付信息和TEE中的安全支付码生成的。
该实现方式中，安全支付授权码是支付设备根据本地预先存储的支付信息和支付安全码生成的，根据支付信息灵活生成安全支付授权码的同时，实现离线支付。
在一种可能的实现方式中，所述安全支付授权码为支付设备根据预先存储在所述支付设备中的所述支付信息生成第二支付授权码后，在TEE中根据所述第二支付授权码和TEE中的安全支付码生成的。
该实现方式中，安全支付授权码是支付设备根据本地预先存储的支付信息生成支付授权码后，再根据支付授权码和支付安全码生成的，使得支付设备可以沿用现有技术中生成支付授权码的方法，提高现有技术中生成支付授权码的方法的利用率，同时，可以实现离线支付。
在一种可能的实现方式中，所述根据所述支付安全码验证所述安全支付授权码合法，包括：根据支付服务器本地存储的支付信息生成第三支付授权码；计算所述第三支付授权码和所述支付服务器本地存储的支付安全码的哈希值；确定所述安全支付授权码与所述哈希值匹配，以验证所述安全支付授权码的合法性。
第三方面，本发明提供了一种支付设备，所述支付设备包括用于执行第一方面的支付方法的模块。
第四方面，本发明提供了一种支付服务器，所述支付服务器用于执行第二方面的支付方法的模块。
第五方面，本发明提供了一种支付设备，所述支付设备包括存储器、处理器和收发器。所述存储器用于存储程序，所述处理器用于执行程序，所述收发器用于与支付服务器通信。当所述程序被执行时，所述处理器执行第一方面的方法。
第六方面，本发明提供了一种支付服务器，所述支付服务器包括存储器、处理器和收发器，所述存储器用于存储程序，所述处理器用于执行程序，所述收发器用于与支付设备进行通信。当所述程序被执行时，所述处理器执行第二方面的方法。
第七方面，本发明提供了一种支付***，包括如第三方面所述的支付设备，以及如第四方面所述的支付服务器。
第八方面，本发明提供了一种***芯片，包括输入接口、输出接口、至少一个处理器、存储器，所述输入接口、输出接口、所述处理器以及所述存储器之间通过***总线相连，所述处理器用于执行所述存储器中的代码，当所述代码被执行时，所述处理器实现第一方面中的方法。
第九方面，本发明提供了一种***芯片，包括输入接口、输出接口、至少一个处理器、存储器，所述输入接口、输出接口、所述处理器以及所述存储器之间通过***总线相连，所述处理器用于执行所述存储器中的代码。当所述代码被执行时，所述处理器实现第二方面的方法。
第十方面，本发明提供一种计算机可读介质，所述计算机可读介质存储用于支付设备执行的程序代码，所述程序代码包括用于执行第一方面中的方面的指令。
第十一方面，本发明提供一种计算机可读介质，所述计算机可读介质存储用于支付服务器执行的程序代码，所述程序代码包括用于执行第二方面中的方法的指令。
第十二方面，本发明提供了一种支付方法，包括：接收请求支付的指令；获取所述TEE中的用于生成支付授权码的支付信息；在TEE中根据所述支付信息生成支付授权码；显示所述支付授权码于所述TEE中，以便于所述支付服务器获取所述支付授权码，并根据所述支付授权码进行支付。
本发明实施例的技术方案，由于用于生成支付授权码的各种支付信息在TEE中，所以可以防止恶意软件窃取这些支付信息，避免恶意软件模仿支付应用生成支付授权码，另外，在TEE中显示支付授权码，最终均可以提高支付的安全性。
第十三方面，提供了一种支付设备，所述支付设备包括用于执行第十二方面中的支付方法的各个模块。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例中所需要使用的附图作简单地介绍，显而易见地，下面所描述的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例的支付方法的示意性流程图。
图2是本发明实施例的支付方法的示意性流程图。
图3是本发明实施例的支付设备的示意性结构图。
图4是本发明实施例的支付设备的示意性结构图。
图5是本发明实施例的支付服务器的示意性结构图。
图6是本发明实施例的支付设备的示意性结构图。
图7是本发明实施例的支付服务器的示意性结构图。
图8是本发明实施例的***芯片的示意性结构图。
图9是本发明实施例的***芯片的示意性结构图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例 是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1是本发明实施例的支付方法的示意性流程图。应理解，图1示出了支付方法的步骤或操作，但这些步骤或操作仅是示例，本发明实施例还可以执行其他操作或者图1中的各个操作的变形。此外，图1中的各个步骤可以按照与图1呈现的不同的顺序来执行，并且有可能并非要执行图1中的全部操作。
图1的支付方法中，用户可以通过支付设备的具有输入功能的单元或模块向支付设备输入指令等，支付设备与支付服务器之间，以及收银设备与支付服务器之间可以通过移动网络或者固网通信。支付设备由需要进行支付的用户使用，扫描设备和收银设备由收款方使用。应理解，收银设备根据功能也可以分成多个实体装置分别部署，扫描设备和收银设备也可以部署在同一个实体装置上，如移动电话。
支付设备应可以在TEE和富执行环境(Rich Execution Environment，REE)中运行，REE如安卓(Android)环境。TEE基于可信区域(TrustZone)技术，是与支付设备上的REE并存的运行环境。TEE对应于支付设备上的可信操作***(Trusted Operating System，Trusted OS)；REE对应于支付设备上的富操作***(Rich Operating System，Rich OS)，如Android***。当然，支付设备也可以只运行TEE环境及其对应的Trusted OS。
TEE所能访问的软硬件资源与Rich OS能够访问的软硬件资源是分离的，可以说TEE具有其自身的运行空间。TEE比Rich OS的安全级别更高。TEE提供了可信应用(Trusted Application，TA)，如授权安全软件的安全执行环境，同时也保护TA的资源和数据的保密性、完整性和访问权限。为了保证TEE本身的可信性，TEE在安全启动过程中是要通过验证并且与Rich OS隔离的。在TEE中，每个TA是相互独立的，而且在未授权的情况下不能互相访问。
TEE内部包含可信用户界面(Trusted User Interface，TUI)。TUI是指在关键信息的显示和用户关键数据(如口令)的输入时，屏幕显示和键盘等硬件资源完全由TEE控制和访问，而Rich OS中的软件不能访问。借助于TUI的特性，TEE可以提供用户认证、交易确认和交易处理等方面的保护。
TEE可以通过标准接口与REE通信，这个标准接口可以让运行在Rich OS中的客户端应用(Client Application，CA)访问TA服务和数据。且这个标准接口有强大的密钥和密码算法，可以保证TEE与TEE之间通信的安全性。
S102，支付设备向支付服务器发送注册请求，发起注册过程。
在注册过程中，用户可以向支付设备输入注册的支付账号、支付账号对应的用户名、鉴权信息、鉴权密码等各种参数，然后支付设备将这些参数发送给支付服务器。支付服务器接收到这些参数后，可以根据这些参数为用户分配唯一的用户标识，如开放标识(Open Identity，OpenID)。若支付设备向支付服务器发送了设备号，支付服务器也可以根据该设备号为用户分配唯一的用户标识，如对设备号的全部或部分信息进行加密处理，从而得到用户的用户标识。
在注册过程中，支付服务器还可以为该用户分配支付安全码，该支付安全码可以是根据支付设备的设备号或用户的用户标识(如OpenID)生成，如直接使用设备号作为 支付安全码，或截取设备号的部分信息作为支付安全码，或对设备号的全部或部分信息进行加密处理，或截取用户标识(如OpenID)的部分信息作为支付授权码，或对用户标识(如OpenID)的全部或部分信息进行加密处理以得到支付安全码。当然，可以使用其他信息来作为支付安全码，本发明对此并不限定。
注册完成后，支付服务器可以向支付设备发送用户的支付账号的相关信息，还可以向支付设备发送为支付设备生成的支付安全码。当然支付服务器也会记录该支付安全码，并记录该支付安全码与支付账号之间的对应关系。
支付设备应该在TEE中接收支付服务器发送的支付安全码，并存储于TEE中，以防被恶意盗取及使用，从而提高支付安全码的安全性。
支付安全码的生成也可以由支付设备来完成。如支付设备可以在注册过程中或注册完成后，自己生成支付安全码，并向支付服务器上报该支付安全码，以便于支付服务器知道用户的支付账号与该支付安全码对应。
支付设备可以采用上述支付服务器生成支付安全码的方法来生成支付安全码，或采用其他方式生成支付安全码，为了简洁，此处不再赘述。当然，也可以通过其他方式或其他设备生成支付安全码，支付设备获取后发送给支付服务器，或支付服务器获取后发送给支付设备。
若由支付服务器生成支付安全码时，支付服务器可以定期或根据其他需求重新生成支付安全码，并向支付设备发送该支付安全码，以更新支付设备上存储的支付安全码。
若由支付设备生成支付安全码时，支付设备可以定期或根据其他需求重新生成支付安全码，并向支付服务器发送该支付安全码，以更新支付服务器上存储的支付安全码。
在注册完成后，可以根据需要更新用户的支付账号的支付信息或支付安全码。支付设备获取到用户的支付账号的支付信息及支付安全码后，即为用户进行支付作好了准备。
S104，支付设备接收用户输入的支付请求。
用户可以通过多种方式向支付设备输入请求，如通过语音方式或通过点击支付设备的输入模块上的按钮等方式。本发明对用户输入请求的方式不作限定。支付设备可以在TEE中接收请求指令(即用户在TEE中的TUI上输入请求)，也可以在REE中接收请求指令(即用户在REE中的用户界面上输入请求)。
S106，支付设备接收支付请求后，可以向支付服务器发送支付授权码的请求消息。该请求消息中可以携带用户的用户标识(如OpenID)等信息，以便于支付服务器为该用户生成支付授权码。
S108，支付服务器接收到支付设备发送的支付授权码请求消息后，可以根据如用户的用户标识、用户的支付方式、支付时间、时间戳、随机数产生器等多种支付信息生成支付授权码，该支付授权码可以携带用户标识、支付方式，支付时间等支付信息。本发明实施例中，可以将用于生成支付授权码的信息和支付授权码携带的信息称为支付信息，该支付信息可以包括用户的用户标识、用户的支付方式、支付时间、时间戳等一种或多种信息。当然，支付信息也可以包括其他可以与支付相关的信息，本发明实施例不限于此。支付服务器生成支付授权码的方法可以参照现有技术中的方法。
S110，支付服务器向支付设备发送支付服务器生成的支付授权码。支付设备接收到该支付授权码后，可以存储在TEE中，也可以存储在REE中。
S112，支付设备接收到支付服务器发送的支付授权码后，可以获取TEE中的支付安 全码，然后在TEE中根据该支付安全码和支付授权码生成安全支付授权码，并在TEE中显示该安全支付授权码。
应注意，本发明实施例不限定支付设备获取支付安全码与从支付服务器获取支付授权码的顺序。该支付安全码可以是支付设备在此之前从支付服务器或其他设备获取的，也可是支付设备自己生成的。
之所以将支付设备根据支付安全码和从支付服务器接收的支付授权码生成码称为安全支付授权码，是因为，该安全支付授权码与支付服务器生成支付授权码相比，还包括支付安全码，该支付安全码存储于TEE中，因此可以根据该支付安全码来验证安全支付授权码来源于TEE，即该安全支付授权码是安全可靠的，是合法的。
由于支付安全码的作用是验证支付授权码是否来源于TEE，因此支付安全码并不限于前述的生成方式，只要是从支付设备的TEE中获取的信息，并向支付服务器上报过该信息与用户的支付账号的对应关系，即可以称为支付安全码，并可以根据该信息生成安全支付授权码。
支付设备根据支付授权码和支付安全码生成安全支付授权码时，一种实现方式可以是，计算支付授权码和支付安全码的哈希值，将该哈希值作为安全支付授权码。当然也可以通过其他方式来生成安全支付授权码，如直接使用加密算法对支付授权码和支付安全码进行加密处理，如可以直接计算支付信息和支付安全码的哈希值，将该哈希值作为安全支付授权码。
支付设备可以通过多种方式显示安全支付授权码，如通过一维码、二维码、条形码、数字等方式显示。
S114，收款方或收银方可以通过扫描设备扫描用户的支付设备的TEE中显示的安全支付授权码。该扫描设备可以是专用的扫描设备，如红外线扫描设备等，也可以是集成部署在其他设备(如移动电话)上的扫描设备。
S116，扫描设备获取到支付设备上的安全支付授权码后，可以发送给收银设备。应注意，扫描设备和收款设备可以是同一个设备，此时，该设备在扫描安全支付授权码后即可以直接获取到该安全支付授权码。
S118，收银设备获取到安全支付授权码后，可以根据该安全支付授权码向支付服务器发送收银请求消息，该收银请求消息中携带安全支付授权码。当然，该收银请求消息还可以携带其他信息，如收款方的账户信息等，本发明对此不作限定。
S120，支付服务器接收到收银设备发送的收银请求消息后，从该请求消息中获取安全支付授权码，然后可以通过多种方式验证该安全支付授权码的合法性及进行支付。
安全支付授权码的合法性是指安全支付授权码的来源是否合法，通过支付安全码来保证安全授权码来源合法，即来源于合法的TEE环境，而非恶意应用伪造的，非截屏获取等以非法途径获取的支付安全码。
当支付服务器从收银设备获取到的安全支付授权码是支付设备计算的支付授权码和支付安全码的哈希值时，支付服务器验证安全支付授权码的合法性的方法为：将支付设备生成的安全支付授权码，与支付服务器本地计算的支付授权码和支付安全码的哈希值匹配，以判断支付设备生成的安全支付授权码是否合法。若支付服务器计算所得的哈希值与支付设备计算所得的哈希值能够匹配，则表明支付服务器从收银设备获取到的安全支付授权码是合法的。支付服务器计算哈希值所依据的支付安全码可以预先存储在支付 服务器。支付服务器计算哈希值所依据的支付授权码可以是支付服务器根据本地存储的用于生成支付授权码的支付信息生成的。当然，支付服务器也可以直接计算上述支付信息和支付安全码的哈希值，以用于与支付设备生成的哈希值作对比。
当然，也可以从安全支付授权码中获取支付安全码和用户的支付信息，该支付信息可以包括用户的用户标识、用户的支付方式、支付时间、时间戳等一种或多种信息。当然，支付信息也可以包括其他可以与支付相关的信息，本发明实施例不限于此。
支付服务器从安全支付收钱码中获取用户的支付信息时，可以先从安全支付授权码中获取携带支付信息的支付授权码，再从支付授权码中获取用户的支付信息。当然，支付服务器也可以直接从安全支付授权码中获取用户的支付信息。
支付服务器获取到支付安全码后，根据该支付安全码验证安全支付授权码的安全可靠性。支付服务器根据支付安全码验证安全支付授权码的安全可靠性的实现方式有多种，为了简洁，下面以其中一种方式作为示例性说明。
如，支付服务器可以判断本地是否存储有该支付安全码与用户的支付账号的对应关系来确定安全支付授权码的安全可靠性。若支付服务器上记录有支付安全码与用户的支付账号的对应关系，则说明该安全支付授权码安全可靠，否则不安全。其中，支付安全码与支付账号的对应关系可以通过支付安全码与用户的用户标识、用户的支付设备或其他信息的对应关系来体现，本发明对此不作限定。
支付服务器获取到用户的支付信息后，验证该支付信息的合法性。如当支付信息包括支付时间时，可以验证支付服务器收到安全支付授权码的时间是否已超过安全支付授权码的有效时间。
当支付***验证该安全支付授权码合法后，即可以根据其他支付信息进行支付，以提高支付的安全性。支付的一种示例性操作可以是根据支付账号的标识信息从该支付账号上扣除支付金额。
S122，支付服务器根据安全支付授权码完成支付后，可以向支付设备和收银设备中的任意一个或全部发送通知消息，以通知支付设备或收银设备支付成功。此时，支付服务器可以同时向支付设备和收银设备发送通知消息，也可以分别向支付设备和收银设备发送通知消息。
当然，当支付服务器根据支付安全码验证安全支付授权码不合法时，也可以向支付设备或收银设备发送验证失败的通知消息；当支付服务器验证其携带的支付消息不合法时，也可以向支付设备和收银设备发送通知消息，以便于支付设备和收银设备作后续操作，如支付设备重新生成安全支付授权码、收银设备放弃收银等。
在本发明实例中，可选地，S106中，支付设备接收支付授权码的请求指令后，可以向支付服务器发送用于生成用户的支付授权码的支付信息的请求消息。相应地，S108中，支付服务器接收到该请求消息后，确定用于生成该用户的支付授权码的支付信息。S110中，支付服务器直接向支付设备发送该支付信息，支付设备可以将接收到的支付信息存放在TEE中，也可以存放在REE中。S112中，支付设备接收到该支付信息后，可以直接根据该支付信息和支付安全码生成安全支付授权码，以提高生成安全支付授权码的效率；也可以沿用现有技术的方法根据该支付信息先生成支付授权码，然后根据该支付授权码和支付安全码生成安全支付授权码，以降低生成安全支付授权码的复杂性。
如，计算该支付授权码和支付安全码的哈希值，并将该哈希值作为安全支付授权码。 相应地，支付服务器获取到该安全支付授权码后，将该安全支付授权码与支付服务器本地计算的哈希值进性对比。若该安全支付授权码与支付服务器计算的哈希值匹配，则说明该安全支付授权码合法。支付服务器本地计算哈希值时所依据的支付授权码可以是支付服务器根据本地存储的支付信息生成的；支付服务器本地计算哈希值时所依据的支付安全码可以是预先存储在支付服务器中的。
上述结合图1介绍了本发明实施例的支付设备通过在线方式进行支付的支付方法，下面结合图2介绍本发明实施例的通过离线方式进行支付的支付方法。图2中与图1中相同的标记表示相同或相似的含义，为了简洁，此处不再赘述。
图2所示的支付方法中，用户通过支付设备向支付服务器发起的注册过程中或在注册完成后，支付服务器可以将用于支付设备生成支付授权码的支付信息发送给支付设备，支付设备可以将这些支付信息存储在TEE或REE中。
S105，支付设备接收支付请求指令，根据支付设备上已经存储的用于生成支付授权码的支付信息(如用户的用户标识、用户的支付方式、支付时间、时间戳、随机数产生器等)生成支付授权码；然后在TEE中根据该支付授权码和支付设备的TEE中已经存储的支付安全码生成安全支付授权码；最后在TEE中显示安全支付授权码。
支付设备在接收到用户的请求指令之前已经存储的用于生成支付授权码的上述信息可以是用户使用该支付设备向支付服务器进行注册的过程中从支付服务器处获取的，也可以是注册完成后从支付服务器处获取的，或者从其他设备上获取的。
在本发明实施例中，支付设备根据用于生成支付授权码的信息和支付安全码生成安全支付授权码时，可以先根据用于生成支付授权码的信息生成支付授权码(具体生成方式可以参考现有技术，也可以使用其他方式)，然后再根据该支付授权码和支付安全码生成安全支付授权码。这种方式，可以沿用现有技术中生成支付授权码的方法，提高生成安全支付授权码的效率，而且而已降低生成安全支付授权码的复杂度。
当然，也可根据支付设备上的用于生成支付授权码的支付信息和支付安全码直接生成安全支付授权码，或者根据用于生成支付授权码的信息中的部分信息先生成某一个支付授权码，再根据该支付授权码和支付安全码生成安全支付授权码。
支付设备根据支付授权码和支付安全码生成安全支付授权码时，一种实现方式可以是，计算支付授权码和支付安全码的哈希值，将该哈希值作为安全支付授权码。当然也可以通过其他方式来生成安全支付授权码，如直接使用加密算法对支付授权码和支付安全码进行加密处理。
支付设备生成安全支付授权码后，后续的支付过程与图1中的支付方法中的相关步骤相同或相似，为了简洁此处不再赘述。
综上所述，支付设备生成的安全支付授权码可以是支付设备在TEE中根据支付授权码和预先存储在本地的支付安全码生成的，可以是支付设备在TEE中根据支付信息和预先存储在本地的支付安全码生成的。当支付设备根据支付授权码和预先存储在本地的支付安全码生成安全支付授权码时，该支付授权码可以是支付设备在接收到用户请求支付的指令后从支付服务器获取的，也可以是支付设备根据用户的支付信息本地生成的。
无论是支付设备根据支付信息本地生成支付授权码后，再根据支付安全码生成安全支付授权码，还是支付设备直接根据支付信息和支付安全码生成安全支付授权码，该支付信息即可以是支付设备在接收到用户的支付请求前从支付服务器获取并存储的，也可 以是支付设备在接收到用户的支付请求后从支付服务器获取的。该支付信息即可存储在支付设备的TEE中，也可以存储在支付设备的REE中，但支付安全码需要存储在TEE中。
本发明实施例中另外一种提高支付安全性的支付方法为：支付设备接收请求支付的指令；获取所述TEE中的用于生成支付授权码的支付信息；在所述TEE中根据所述支付信息生成支付授权码；显示所述支付授权码于所述TEE中。
本发明实施例中，支付设备根据TEE中的支付信息生成支付授权码的实现方法，以及支付服务器获取到该支付授权码后的支付流程与现有技术相同或相似，此处不再赘述。
上面结合图1和图2介绍了本发明的支付方法，下面结合图3至图8介绍实现本发明的支付方法的支付设备和支付服务器。
图3为本发明一个实施例的支付设备300的示意性结构图。图3所示的支付设备300能够实现图1和图2中由支付设备执行的各个步骤，为避免重复，此处不再赘述。
输入模块310，用于接收请求支付的指令。
获取模块320，用于获取TEE中的支付安全码。
生成模块330，用于在TEE中根据所述支付安全码生成安全支付授权码，所述支付安全码用于支付服务器验证所述安全支付授权码的合法性。
输出模块340，用于在所述TEE的TUI显示所述安全支付授权码，以便于所述支付服务器获取所述安全支付授权码，并根据所述安全支付授权码进行支付。
本发明的支付设备，由于生成的支付授权码包含了TEE中的安全码，因此可以表明支付授权码是在TEE中生成的，即表明支付授权码合法，支付服务器获取到该支付授权码后，可以根据通过判断该支付授权码中包含了安全码确定该支付授权码来源于安全环境，是可信的，然后再进行支付，从而可以避免根据恶意软件仿冒合法软件生成的支付授权码进行支付，最终提供支付的安全性。另一方面，由于支付授权码是在支付设备的TEE中呈现的，而TEE下的支付设备具有防截屏功能，因此，可以避免恶意软件通过截屏等方式盗取支付设备的TEE中生成的支付授权码，也可以避免恶意软件触发支付设备生成和盗取支付授权码，最终也提高支付的安全性。
可选地，作为一个实施例，所述获取模块还用于获取支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种，所述支付安全码是基于支付设备的设备号或所述标识信息生成的；所述生成模块330具体用于：在TEE中根据所述支付安全码和支付信息生成所述安全支付授权码。
可选地，作为一个实施例，所述获取模块320具体用于：向支付服务器发送所述支付信息的请求消息；接收支付服务器发送的响应消息，所述响应消息包括所述支付信息。
可选地，作为一个实施例，所述获取模块具体用于：向支付服务器发送支付授权码的请求消息；接收支付服务器发送的响应消息，所述响应消息包括支付授权码，所述支付授权码携带所述支付信息。其中，所述生成模块330具体用于在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
可选地，作为一个实施例，所述支付信息在接收所述指令之前已预先存储在所述TEE中。
可选地，作为一个实施例，所述生成模块具体用于：根据所述支付信息生成支付授权码；在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
可选地，作为一个实施例，所述生成模块具体用于：计算所述支付安全码和所述支 付授权码的哈希值，所述哈希值为所述安全支付授权码。
可选地，作为一个实施例，所述输出模块具体用于：通过二维码或条形码的方式显示所述安全支付授权码于所述TEE中。
图4是本发明一个实施例的支付设备400的示意性结构图。支付设备400包括处理单元410、输入单元420、输出单元430、存储单元440、通信单元450和电源460等组件，这些组件通过一条或多条总线进行通信。
本领域技术人员可以理解，图4中示出的支付设备的结构并不构成对本发明的限定，它既可以是总线形结构，也可以是星型结构，还可以包括比图4所示更多或更少的部件，或者组合某些部件，或者不同的部件布置。在本发明实施方式中，支付设备400可以是任何移动或便携式支付设备，包括但不限于移动电话、移动电脑、平板电脑、个人数字助理(Personal Digital Assistant,PDA)、媒体播放器、智能电视，以及上述两项或两项以上的组合等。
处理单元410为支付设备的控制中心，利用各种接口和线路连接整个支付设备的各个部分，通过运行或执行存储在存储单元内的软件程序和/或模块，以及调用存储在存储单元内的数据，以执行支付设备的各种功能和/或处理数据。所述处理单元410可以由集成电路(Integrated Circuit，简称IC)组成，例如可以由单颗封装的IC所组成，也可以由连接多颗相同功能或不同功能的封装IC而组成。举例来说，处理单元410可以仅包括中央处理器(Central Processing Unit，简称CPU)，也可以是GPU、数字信号处理器(Digital Signal Processor，简称DSP)、及通信单元450中的控制芯片(例如基带芯片)的组合。在本发明实施方式中，CPU可以是单运算核心，也可以包括多运算核心。
输入单元420用于实现用户与支付设备的交互和/或信息输入到支付设备中。例如，输入单元420可以接收用户输入的数字或字符信息，以产生与用户设置或功能控制有关的信号输入。在本发明具体实施方式中，输入单元420可以是触控面板，也可以是其他人机交互界面，例如实体输入键、麦克风等，还可是其他外部信息撷取装置，例如摄像头等。触控面板，也称为触摸屏或触控屏，可收集用户在其上触摸或接近的操作动作。比如用户使用手指、触笔等任何适合的物体或附件在触控面板上或接近触控面板的位置的操作动作，并根据预先设定的程式驱动相应的连接装置。可选的，触控面板可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸操作，并将检测到的触摸操作转换为电信号，以及将所述电信号传送给触摸控制器；触摸控制器从触摸检测装置上接收所述电信号，并将它转换成触点坐标，再送给处理单元410。所述触摸控制器还可以接收处理单元410发来的命令并执行。此外，可以采用电阻式、电容式、红外线(Infrared)以及表面声波等多种类型实现触控面板。在本发明的其他实施方式中，输入单元所采用的实体输入键可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。麦克风形式的输入单元可以收集用户或环境输入的语音并将其转换成电信号形式的、处理单元可执行的命令。
输入单元420还可以是各类传感器件，例如霍尔器件，用于侦测支付设备的物理量，例如力、力矩、压力、应力、位置、位移、速度、加速度、角度、角速度、转数、转速以及工作状态发生变化的时间等，转变成电量来进行检测和控制。其他的一些传感器件还可以包括重力感应计、三轴加速计、陀螺仪等。
输出单元430包括但不限于影像输出单元和声音输出单元。影像输出单元用于输出 文字、图片和/或视频。所述影像输出单元可包括显示面板，例如采用液晶显示器(Liquid Crystal Display，LCD)、有机发光二极管(Organic Light-Emitting Diode，OLED)、场发射显示器(Field Emission Display，FED)等形式来配置的显示面板。或者所述影像输出单元可以包括反射式显示器，例如电泳式(electrophoretic)显示器，或利用光干涉调变技术(Interferometric Modulation of Light)的显示器。所述影像输出单元可以包括单个显示器或不同尺寸的多个显示器。输入单元420所采用的触控面板亦可同时作为输出单元430的显示面板。例如，当触控面板检测到在其上的触摸或接近的手势操作后，传送给处理单元410以确定触摸事件的类型，随后处理单元410根据触摸事件的类型在显示面板上提供相应的视觉输出。虽然在图1中，输入单元420与输出单元430是作为两个独立的部件来实现支付设备的输入和输出功能，但是在某些实施例中，可以将触控面板与显示面板集成一体而实现支付设备的输入和输出功能。例如，所述影像输出单元可以显示各种图形化用户接口(Graphical User Interface，GUI)以作为虚拟控制组件，包括但不限于窗口、卷动轴、图标及剪贴簿，以供用户通过触控方式进行操作。
影像输出单元可以包括滤波器及放大器，用来将处理单元410所输出的视频滤波及放大。音频输出单元包括数字模拟转换器，用来将处理单元410所输出的音频信号从数字格式转换为模拟格式。
存储单元440可用于存储软件程序以及模块，处理单元410通过运行存储在存储单元440的软件程序以及模块，从而执行支付设备400的各种功能应用以及实现数据处理。存储单元440主要包括程序存储区和数据存储区，其中，程序存储区可存储操作***、至少一个功能所需的应用程序，比如声音播放程序、图像播放程序等等；数据存储区可存储根据支付设备的使用所创建的数据(比如音频数据、电话本等)等。
所述应用程序包括安装在支付设备上的任何应用，包括但不限于浏览器、电子邮件、即时消息服务、文字处理、键盘虚拟、窗口小部件(Widget)、加密、数字版权管理、语音识别、语音复制、定位(例如由全球定位***提供的功能)、音乐播放等等。
具体地，存储单元440可以包括易失性存储器，例如非挥发性动态随机存取内存(Nonvolatile Random Access Memory，NVRAM)、相变化随机存取内存(Phase Change RAM，PRAM)、磁阻式随机存取内存(Magetoresistive RAM，MRAM)等，还可以包括非易失性存储器，例如至少一个磁盘存储器件、电子可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、闪存器件，例如反或闪存(NOR flash memory)或是反及闪存(NAND flash memory)。非易失存储器储存处理单元所执行的操作***及应用程序。处理单元410从所述非易失存储器加载运行程序与数据到内存并将数字内容储存于大量储存装置中。所述操作***包括用于控制和管理常规***任务，例如内存管理、存储设备控制、电源管理等，以及有助于各种软硬件之间通信的各种组件和/或驱动器。具体而言，所述操作***可以是Google公司的Android***、Apple公司开发的iOS***或Microsoft公司开发的Windows操作***等，或者是Vxworks这类的嵌入式操作***。
通信单元150用于建立通信信道，使支付设备通过所述通信信道以连接至远程服务器，并从所述远程服务器下媒体数据。通信单元150可以包括无线局域网(Wireless Local Area Network，Wireless LAN)模块、蓝牙模块、基带(Base Band)模块等通信模块，以及所述通信模块对应的射频(Radio Frequency，RF)电路，用于进行无线局域网络通 信、蓝牙通信、红外线通信及/或蜂窝式通信***通信，例如宽带码分多重接入(Wideband Code Division Multiple Access，W-CDMA)及/或高速下行封包存取(High Speed Downlink Packet Access，HSDPA)。所述通信模块用于控制支付设备中的各组件的通信，并且可以支持直接内存存取(Direct Memory Access)。
通信单元450中的各种通信模块一般以集成电路芯片(Integrated Circuit Chip)的形式出现，并可进行选择性组合，而不必包括所有通信模块及对应的天线组。例如，通信单元450可以仅包括基带芯片、射频芯片以及相应的天线以在一个蜂窝通信***中提供通信功能。经由通信单元450建立的无线通信连接，例如无线局域网接入或WCDMA接入，所述支付设备可以连接至蜂窝网(Cellular Network)或因特网(Internet)。在本发明的一些可选实施方式中，所述通信单元中的通信模块，例如基带模块可以集成到处理器单元中，典型的如高通(Qualcomm)公司提供的APQ+MDM系列平台。
射频电路用于信息收发或通话过程中接收和发送信号。例如，将基站的下行信息接收后，给处理单元410处理；另外，将设计上行的数据发送给基站。通常，所述射频电路包括用于执行这些功能的公知电路，包括但不限于天线***、射频收发机、一个或多个放大器、调谐器、一个或多个振荡器、数字信号处理器、编解码(Codec)芯片组、用户身份模块(SIM)卡、存储器等等。此外，射频电路还可以通过无线通信与网络和其他设备通信。所述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯***(Global System of Mobile communication，GSM)、通用分组无线服务(General Packet Radio Service，GPRS)、码分多址(Code Division Multiple Access，CDMA)、宽带码分多址(Wideband Code Division Multiple Access,WCDMA)、高速上行行链路分组接入技术(High Speed Uplink Packet Access，HSUPA)、长期演进(Long Term Evolution,LTE)、电子邮件、短消息服务(Short Messaging Service，SMS)等。
电源460用于给支付设备的不同部件进行供电以维持其运行。作为一般性理解，电源460可以是内置的电池，例如常见的锂离子电池、镍氢电池等，也可包括直接向支付设备400供电的外接电源，例如AC适配器等。在本发明的一些实施方式中，电源460还可以作更为广泛的定义，例如还可以包括电源管理***、充电***、电源故障检测电路、电源转换器或逆变器、电源状态指示器(如发光二极管)，以及与支付设备的电能生成、管理及分布相关联的其他任何组件。
图4的支付设备400能够执行图1或图2中的支付方法的各个步骤，且与图3的支付设备300相对应，如输入单元420能够实现与输入模块310相同的功能，处理单元410能够实现获取模块320与生成模块330相同的功能，输出单元430能够实现与输出模块340相同的功能，为了简洁，此处不再赘述。
图5为本发明实施例的支付服务器500的示意性结构图。图5的支付服务器能够实现图1和图2中由支付服务器执行的步骤，为了简洁，此处不再赘述。
接收模块510，用于接收安全支付授权码，所述安全支付授权码包括支付安全码。
验证模块520，用于根据所述支付安全码验证所述安全支付授权码的合法性。
支付模块530，用于根据所述安全支付授权码进行支付。
本发明的支付服务器，接收到安全支付授权码后，需要通过验证其中的支付安全码来确定该支付授权码是否来源于TEE，即是否安全或合法，然后再进行支付，从而提高支付的安全性。
可选地，作为一个实施例，所述安全支付授权码还包括支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种，所述支付安全码是基于支付设备的设备号或所述标识信息生成的；所述支付服务器还包括获取模块，用于获取所述安全支付授权码中的所述支付信息；其中，所述支付模块具体用于根据所述支付信息进行支付。
可选地，作为一个实施例，所述获取模块具体用于：获取所述安全支付授权码中的第一支付授权码；从所述支付授权码中获取所述支付信息。
可选地，作为一个实施例，所述接收模块510还用于接收支付设备发送的支付授权码请求消息。所述支付服务器还包括发送模块，用于向所述支付设备发送响应消息，所述响应消息携带所述第一支付授权码。其中，所述安全支付授权码为所述支付设备根据所述第一支付授权码和所述TEE中的安全支付码生成的。
可选地，作为一个实施例，所述接收模块510还用于接收支付设备发送的支付信息请求消息。所述支付服务器还包括发送模块，用于向所述支付设备发送响应消息，所述响应消息携带所述支付信息。其中，所述安全支付授权码为所述支付设备在TEE中根据所述支付信息和所述TEE中的安全支付码生成的。
可选地，作为一个实施例，所述安全支付授权码为支付设备在TEE中根据预先存储在所述支付设备中的所述支付信息和TEE中的安全支付码生成的。
可选地，作为一个实施例，所述安全支付授权码为支付设备根据预先存储在所述支付设备中的所述支付信息生成第二支付授权码后，在TEE中根据所述第二支付授权码和TEE中的安全支付码生成的。
可选地，作为一个实施例，所述根据所述支付安全码验证所述安全支付授权码的合法性，包括：根据支付服务器本地存储的支付信息生成第三支付授权码；计算所述第三支付授权码和所述支付服务器本地存储的支付安全码的哈希值；确定所述安全支付授权码与所述哈希值匹配，以验证所述安全支付授权码的合法性。
图6是本发明实施例的支付设备600的示意性结构图。应理解，图6的支付设备600能够执行图1和图2中由支付设备执行的各个步骤，为避免重复，此处不再详述。支付设备600包括存储器610、处理器620和收发器630。
存储器610，用于存储程序。
收发器630，用于接收请求生成支付授权码的指令。
处理器620，用于执行所述存储器610中的程序，当所述程序被执行时，所述处理器620用于：获取TEE中的支付安全码，所述支付安全码用于支付服务器验证支付授权码的合法性；在TEE中根据所述支付安全码生成安全支付授权码。
所述收发器630还用于在所述TEE的TUI显示所述安全支付授权码，以便于支付服务器获取所述安全支付授权码，并根据所述安全支付授权码进行支付。
本发明的支付设备，由于生成的支付授权码包含了TEE中的安全码，因此可以表明支付授权码是在TEE中生成的，即表明支付授权码合法，支付服务器获取到该支付授权码后，可以根据通过判断该支付授权码中包含了安全码确定该支付授权码来源于安全环境，是可信的，然后再根据支付信息进行支付，从而可以避免根据恶意软件仿冒合法软件生成的支付授权码进行支付，最终提供支付的安全性。另一方面，由于支付授权码是在支付设备的TEE中呈现的，而TEE下的支付设备具有防截屏功能，因此，可以避免恶 意软件通过截屏等方式盗取支付设备的TEE中生成的支付授权码，也可以避免恶意软件触发支付设备生成和盗取支付授权码，最终也提高支付的安全性。
可选地，作为一个实施例，所述处理器620具体用于：获取支付信息，根据所述支付安全码和支付信息生成所述安全支付授权码，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种，所述支付安全码是基于支付设备的设备号或所述标识信息生成的。
可选地，作为一个实施例，所述处理器620具体用于：向支付服务器发送所述支付信息的请求消息；接收支付服务器发送的响应消息，所述响应消息包括所述支付信息。
可选地，作为一个实施例，所述处理器620具体用于：向支付服务器发送支付授权码的请求消息；接收支付服务器发送的响应消息，所述响应消息包括支付授权码，所述支付授权码携带所述支付信息；在所述TEE中根据所述支付安全码与支付授权码生成所述安全支付授权码。
可选地，作为一个实施例，所述存储器610具体用于在接收所述指令之前已预先存储支付信息于所述TEE中。
可选地，作为一个实施例，所述处理器620具体用于：根据所述支付信息生成支付授权码；在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
可选地，作为一个实施例，所述处理器620具体用于：计算所述支付安全码和所述支付授权码的哈希值，所述哈希值为所述安全支付授权码。
可选地，作为一个实施例，所述收发器具体用于：通过二维码或条形码的方式显示所述安全支付授权码于所述TEE中。
图7是本发明实施例的支付服务器的示意性结构图。图7的支付服务器700能够实现图1和图2中由支付服务器执行的各个步骤，为了简洁，此处不再赘述。
存储器710用于存储程序。
收发器730用于接收安全支付授权码。
处理器720用于根据所述支付安全码验证所述安全支付授权码的合法性。
处理器720还用于根据所述安全支付授权码进行支付。
本发明的支付服务器，接收到安全支付授权码后，需要通过验证其中的支付安全码来确定该支付授权码是否来源于TEE，即是否安全或合法，然后再进行支付，从而提高支付的安全性。
可选地，作为一个实施例，所述安全支付授权码还包括支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种，所述支付安全码是基于支付设备的设备号或所述标识信息生成的；所述处理器720还用于获取所述安全支付授权码中的所述支付信息，根据所述支付信息进行支付。
可选地，作为一个实施例，所述处理器720具体用于：获取所述安全支付授权码中的第一支付授权码；从所述第一支付授权码中获取所述支付信息。
可选地，作为一个实施例，所述收发器730还用于接收支付设备发送的支付授权码请求消息，向所述支付设备发送响应消息，所述响应消息携带所述支付授权码。其中，所述安全支付授权码为所述支付设备在TEE中根据所述支付授权码和所述TEE中的安全支付码生成的。
可选地，作为一个实施例，所述收发器730还用于接收支付设备发送的支付信息请 求消息，向所述支付设备发送响应消息，所述响应消息携带所述支付信息。其中，所述安全支付授权码为所述支付设备在TEE中根据所述支付信息和所述TEE中的安全支付码生成的。
可选地，作为一个实施例，所述安全支付授权码为支付设备在TEE中根据预先存储在所述支付设备中的所述支付信息和TEE中的安全支付码生成的。
可选地，作为一个实施例，所述安全支付授权码为支付设备根据预先存储在所述支付设备中的所述支付信息生成第二支付授权码后，根据所述第二支付授权码和TEE中的安全支付码生成的。
可选地，作为一个实施例，所述处理器720具体用于根据支付服务器本地存储的支付信息生成第三支付授权码；计算所述第三支付授权码和所述支付服务器本地存储的支付安全码的哈希值；确定所述安全支付授权码与所述哈希值匹配，以验证所述安全支付授权码的合法性。
图8是本发明实施例的***芯片的示意性结构图。图8的***芯片800包括输入接口810、输出接口820、至少一个处理器830、存储器840，所述输入接口810、输出接口820、所述处理器830以及存储器840之间通过总线相连，所述处理器830用于执行所述存储器840中的代码，当所述代码被执行时，所述处理器830实现图1和图2中由支付设备执行的方法。
图9是本发明实施例的***芯片的示意性结构图。图9的***芯片900包括输入接口910、输出接口920、至少一个处理器930、存储器940，所述输入接口910、输出接口920、所述处理器930以及存储器940之间通过总线相连，所述处理器930用于执行所述存储器940中的代码，当所述代码被执行时，所述处理器930实现图1和图2中由支付服务器执行的方法。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的***、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是 各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求的保护范围为准。

Claims (32)

  1. 一种支付方法，其特征在于，包括：
    接收请求支付的指令；
    获取可信执行环境TEE中的支付安全码；
    在所述TEE中根据所述支付安全码生成安全支付授权码，所述支付安全码用于支付***服务器验证所述安全支付授权码的合法性；
    在所述TEE的可信用户界面TUI显示所述安全支付授权码，以便于所述支付服务器获取所述安全支付授权码，并根据所述安全支付授权码进行支付。
  2. 根据权利要求1所述的支付方法，其特征在于，所述方法还包括，获取支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种；
    其中，所述支付安全码是基于支付设备的设备号或所述标识信息生成的；
    所述在TEE中根据所述支付安全码生成安全支付授权码，包括：
    在所述TEE中根据所述支付安全码和支付信息生成所述安全支付授权码。
  3. 根据权利要求2所述的支付方法，其特征在于，所述获取所述支付信息，包括：
    向支付服务器发送所述支付信息的请求消息；
    接收支付服务器发送的响应消息，所述响应消息包括所述支付信息。
  4. 根据权利要求2所述的支付方法，其特征在于，所述获取所述支付信息，包括：
    向支付服务器发送支付授权码的请求消息；
    接收支付服务器发送的响应消息，所述响应消息包括支付授权码，所述支付授权码携带所述支付信息；
    其中，所述在所述TEE中根据所述支付安全码与支付信息生成安全支付授权码，包括：
    在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
  5. 根据权利要求2所述的支付方法，其特征在于，所述支付信息在接收所述指令之前已存储在支付设备中。
  6. 根据权利要求5所述的支付方法，其特征在于，所述在所述TEE中根据所述支付安全码和支付信息生成所述安全支付授权码，包括：
    根据所述支付信息生成支付授权码；
    在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
  7. 根据权利要求4或6所述的支付方法，其特征在于，所述在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码，包括：
    在所述TEE中计算所述支付授权码和所述支付安全码的哈希值，所述哈希值为所述安全支付授权码。
  8. 根据权利要求1至7中任一项所述的支付方法，其特征在于，所述显示所述安全支付授权码于所述TEE中，包括：
    通过二维码或条形码的方式显示所述安全支付授权码于所述TEE中。
  9. 一种支付方法，其特征在于，包括：
    接收安全支付授权码，所述安全支付授权码包括支付安全码；
    根据所述支付安全码验证所述安全支付授权码的合法性；
    根据所述安全支付授权码进行支付。
  10. 根据权利要求9所述的支付方法，其特征在于，所述安全支付授权码还包括支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种，所述支付安全码是基于支付设备的设备号或所述标识信息生成的；
    所述支付方法还包括：
    获取所述安全支付授权码中的所述支付信息；
    其中，所述根据所述安全支付授权码进行支付，包括：
    根据所述支付信息进行支付。
  11. 根据权利要求10所述的支付方法，其特征在于，所述获取所述安全支付授权码中的支付信息，包括：
    获取所述安全支付授权码中的第一支付授权码；
    从所述第一支付授权码中获取所述支付信息。
  12. 根据权利要求11所述的支付方法，其特征在于，所述支付方法还包括：
    接收支付授权码请求消息，所述支付授权码请求消息是支付设备接收到支付授权码的请求指令后发送的；
    向所述支付设备发送响应消息，所述响应消息携带所述第一支付授权码；
    其中，所述安全支付授权码为所述支付设备在可信执行环境TEE中根据所述第一支付授权码和所述TEE中的支付安全码生成的。
  13. 根据权利要求10所述的支付方法，其特征在于，所述支付方法还包括：
    接收支付信息请求消息，所述支付信息请求消息是支付设备接收到支付授权码的请求指令后发送的；
    向所述支付设备发送响应消息，所述响应消息携带所述支付信息；
    其中，所述安全支付授权码为所述支付设备在TEE中根据所述支付信息和所述TEE中的支付安全码生成的。
  14. 根据权利要求10所述的支付方法，其特征在于，所述安全支付授权码为支付设备在TEE中根据预先存储在所述支付设备中的所述支付信息和TEE中的安全支付码生成的。
  15. 根据权利要求10所述的支付方法，其特征在于，所述安全支付授权码为支付设备根据预先存储在所述支付设备中的所述支付信息生成第二支付授权码后，在TEE中根据所述第二支付授权码和TEE中的安全支付码生成的。
  16. 根据权利要求9至15中任一项所述的支付方法，其特征在于，所述根据所述支付安全码验证所述安全支付授权码的合法性，包括：
    根据支付服务器本地存储的支付信息生成第三支付授权码；
    计算所述第三支付授权码和所述支付服务器本地存储的支付安全码的哈希值；
    确定所述安全支付授权码与所述哈希值匹配，以验证所述安全支付授权码的合法性。
  17. 一种支付设备，其特征在于，包括：
    输入模块，用于接收请求支付的指令；
    获取模块，用于获取可信执行环境TEE中的支付安全码；
    生成模块，用于在TEE中根据所述支付安全码生成安全支付授权码，所述支付安全 码用于支付服务器验证所述安全支付授权码的合法性；
    输出模块，用于所述TEE的可信用户界面TUI显示所述安全支付授权码，以便于所述支付服务器获取所述安全支付授权码，并根据所述安全支付授权码进行支付。
  18. 根据权利要求17所述的支付设备，其特征在于，所述获取模块还用于获取支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种；
    所述生成模块具体用于：在所述TEE中根据所述支付安全码和所述支付信息生成所述安全支付授权码，所述支付安全码是基于支付设备的设备号或所述标识信息生成的。
  19. 根据权利要求18所述的支付设备，其特征在于，所述获取模块具体用于：
    向支付服务器发送所述支付信息的请求消息；
    接收支付服务器发送的响应消息，所述响应消息包括所述支付信息。
  20. 根据权利要求18所述的支付设备，其特征在于，所述获取模块具体用于：
    向支付服务器发送支付授权码的请求消息；
    接收支付服务器发送的响应消息，所述响应消息包括支付授权码，所述支付授权码携带所述支付信息；
    其中，所述生成模块具体用于：在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
  21. 根据权利要求18所述的支付设备，其特征在于，所述支付信息在接收所述指令之前已存储在支付设备中。
  22. 根据权利要求21所述的支付设备，其特征在于，所述生成模块具体用于：
    根据所述支付信息生成支付授权码；
    在所述TEE中根据所述支付安全码与所述支付授权码生成所述安全支付授权码。
  23. 根据权利要求20或22所述的支付设备，其特征在于，所述生成模块具体用于：
    在所述TEE中计算所述支付安全码和所述支付授权码的哈希值，所述哈希值为所述安全支付授权码。
  24. 根据权利要求17至23中任一项所述的支付设备，其特征在于，所述输出模块具体用于：
    通过二维码或条形码的方式显示所述安全支付授权码于所述TEE中。
  25. 一种支付服务器，其特征在于，包括：
    接收模块，用于接收安全支付授权码，所述安全支付授权码包括支付安全码；
    验证模块，用于根据所述支付安全码验证所述安全支付授权码的合法性；
    支付模块，用于根据所述安全支付授权码进行支付。
  26. 根据权利要求25所述的支付服务器，其特征在于，所述安全支付授权码还包括支付信息，所述支付信息包括支付账号的标识信息、支付类型、支付方式、支付时间、时间戳、随机数产生器中的至少一种，所述支付安全码是基于支付设备的设备号或所述标识信息生成的；
    所述支付服务器还包括获取模块，用于获取所述安全支付授权码中的所述支付信息；
    其中，所述支付模块具体用于根据所述支付信息进行支付。
  27. 根据权利要求26所述的支付服务器，其特征在于，所述获取模块具体用于：
    获取所述安全支付授权码中的第一支付授权码；
    从所述第一支付授权码中获取所述支付信息。
  28. 根据权利要求27所述的支付服务器，其特征在于，所述接收模块还用于接收支付设备发送的支付授权码请求消息；
    所述支付服务器还包括发送模块，用于向所述支付设备发送响应消息，所述响应消息携带所述第一支付授权码；
    其中，所述安全支付授权码为所述支付设备在可信执行环境TEE中根据所述第一支付授权码和所述TEE中的安全支付码生成的。
  29. 根据权利要求26所述的支付服务器，其特征在于，所述接收模块还用于接收支付设备发送的支付信息请求消息；
    所述支付服务器还包括发送模块，用于向所述支付设备发送响应消息，所述响应消息携带所述支付信息；
    其中，所述安全支付授权码为所述支付设备根据所述支付信息和所述TEE中的安全支付码生成的。
  30. 根据权利要求26所述的支付服务器，其特征在于，所述安全支付授权码为支付设备在TEE中根据预先存储在所述支付设备中的所述支付信息和TEE中的安全支付码生成的。
  31. 根据权利要求26所述的支付服务器，其特征在于，所述安全支付授权码为支付设备根据预先存储在所述支付设备中的所述支付信息生成第二支付授权码后，在TEE中根据所述第二支付授权码和TEE中的安全支付码生成的。
  32. 根据权利要求25至31中任一项所述的支付服务器，其特征在于，所述验证模块具体用于：
    根据支付服务器本地存储的支付信息生成第三支付授权码；
    计算所述第三支付授权码和所述支付服务器本地存储的支付安全码的哈希值；
    确定所述安全支付授权码与所述哈希值匹配，以验证所述安全支付授权码的合法性。
PCT/CN2017/086317 2016-06-01 2017-05-27 支付方法、支付设备和支付服务器 WO2017206833A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610389773.2 2016-06-01
CN201610389773.2A CN107451813B (zh) 2016-06-01 2016-06-01 支付方法、支付设备和支付服务器

Publications (1)

Publication Number Publication Date
WO2017206833A1 true WO2017206833A1 (zh) 2017-12-07

Family

ID=60478563

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/086317 WO2017206833A1 (zh) 2016-06-01 2017-05-27 支付方法、支付设备和支付服务器

Country Status (2)

Country Link
CN (1) CN107451813B (zh)
WO (1) WO2017206833A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109544828A (zh) * 2018-12-04 2019-03-29 苏州斯普锐智能***有限公司 基于无线条码扫描平台及移动智能终端的柜台收银***
CN110677261A (zh) * 2019-09-29 2020-01-10 四川虹微技术有限公司 可信二维码生成方法、装置、电子设备及存储介质
CN112365256A (zh) * 2020-11-06 2021-02-12 ***股份有限公司 支付码管理方法、终端设备、服务器、***及存储介质
CN112488681A (zh) * 2020-12-11 2021-03-12 广东广宇科技发展有限公司 基于区块链的授权码支付方法、***、终端及存储介质

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108197913B (zh) * 2017-12-18 2021-01-05 深圳前海微众银行股份有限公司 基于区块链的支付方法、***以及计算机可读存储介质
CN111383015B (zh) 2018-12-29 2023-11-03 华为技术有限公司 交易安全处理方法、装置及终端设备
CN111815318A (zh) * 2020-06-17 2020-10-23 衡水海博云科技有限公司 一种聚合支付的设备、***及方法
US11995643B2 (en) * 2022-05-10 2024-05-28 Capital One Services, Llc System and method for providing a temporary virtual payment card

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101377838A (zh) * 2007-08-30 2009-03-04 北京方维银通科技有限公司 一种数据安全处理方法
US20110251955A1 (en) * 2008-12-19 2011-10-13 Nxp B.V. Enhanced smart card usage
CN103366269A (zh) * 2013-07-05 2013-10-23 李卓桓 一种用于快捷支付的方法、设备及***
CN104143066A (zh) * 2013-05-10 2014-11-12 ***股份有限公司 用于安全性信息交互的设备
CN104301289A (zh) * 2013-07-17 2015-01-21 ***股份有限公司 用于安全性信息交互的设备
CN104363199A (zh) * 2014-09-30 2015-02-18 熊文俊 基于时间同步码的安全认证方法及时间同步码模块
CN105205660A (zh) * 2015-08-28 2015-12-30 深圳市泰久信息***股份有限公司 一种依托二维码技术实现无卡支付的方法

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
MX2013011569A (es) * 2011-04-05 2014-02-28 My Life It Aust Pty Ltd Sistemas y metodos de transaccion financiera.
US20150084785A1 (en) * 2013-09-20 2015-03-26 Mastercard International Incorporated Wireless utility meter reading system and method
CN103634294B (zh) * 2013-10-31 2017-02-08 小米科技有限责任公司 信息验证方法和装置
CN103679440B (zh) * 2013-12-14 2017-01-11 福建省优艾迪网络信息有限公司 一种以二维码为载体的金融收付方法
TWI611358B (zh) * 2014-08-20 2018-01-11 全宏科技股份有限公司 交易裝置、使用其之交易系統與交易方法
CN104573547B (zh) * 2014-10-21 2018-06-19 江苏通付盾信息安全技术有限公司 一种信息交互的安全防范***及其操作实现方法
CN104376462A (zh) * 2014-11-19 2015-02-25 中城智慧科技有限公司 一种安全的扫码支付方法
CN104636917A (zh) * 2015-02-03 2015-05-20 武汉天喻信息产业股份有限公司 一种具备安全支付功能的移动支付***及方法
CN104732388A (zh) * 2015-03-26 2015-06-24 深圳市亚略特生物识别科技有限公司 电子支付方法及***
CN104850988B (zh) * 2015-05-08 2018-07-17 邹骁 一种移动支付***、方法及相关设备
CN104835040A (zh) * 2015-05-26 2015-08-12 浙江维尔科技股份有限公司 一种支付方法及***
CN105069921A (zh) * 2015-07-30 2015-11-18 北京京东尚科信息技术有限公司 用于自提柜的数据识别方法、装置及***
CN110059500A (zh) * 2015-11-30 2019-07-26 华为技术有限公司 用户界面切换方法和终端

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101377838A (zh) * 2007-08-30 2009-03-04 北京方维银通科技有限公司 一种数据安全处理方法
US20110251955A1 (en) * 2008-12-19 2011-10-13 Nxp B.V. Enhanced smart card usage
CN104143066A (zh) * 2013-05-10 2014-11-12 ***股份有限公司 用于安全性信息交互的设备
CN103366269A (zh) * 2013-07-05 2013-10-23 李卓桓 一种用于快捷支付的方法、设备及***
CN104301289A (zh) * 2013-07-17 2015-01-21 ***股份有限公司 用于安全性信息交互的设备
CN104363199A (zh) * 2014-09-30 2015-02-18 熊文俊 基于时间同步码的安全认证方法及时间同步码模块
CN105205660A (zh) * 2015-08-28 2015-12-30 深圳市泰久信息***股份有限公司 一种依托二维码技术实现无卡支付的方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109544828A (zh) * 2018-12-04 2019-03-29 苏州斯普锐智能***有限公司 基于无线条码扫描平台及移动智能终端的柜台收银***
CN110677261A (zh) * 2019-09-29 2020-01-10 四川虹微技术有限公司 可信二维码生成方法、装置、电子设备及存储介质
CN110677261B (zh) * 2019-09-29 2023-05-12 四川虹微技术有限公司 可信二维码生成方法、装置、电子设备及存储介质
CN112365256A (zh) * 2020-11-06 2021-02-12 ***股份有限公司 支付码管理方法、终端设备、服务器、***及存储介质
CN112488681A (zh) * 2020-12-11 2021-03-12 广东广宇科技发展有限公司 基于区块链的授权码支付方法、***、终端及存储介质

Also Published As

Publication number Publication date
CN107451813B (zh) 2021-05-18
CN107451813A (zh) 2017-12-08

Similar Documents

Publication Publication Date Title
WO2017206833A1 (zh) 支付方法、支付设备和支付服务器
US10601795B2 (en) Service processing method and electronic device
US11410156B2 (en) NFC payment method and terminal
EP3693911B1 (en) Card linking method and terminal
WO2018228199A1 (zh) 一种授权方法以及相关设备
CN109600223B (zh) 验证方法、激活方法、装置、设备及存储介质
US11934505B2 (en) Information content viewing method and terminal
US11488234B2 (en) Method, apparatus, and system for processing order information
AU2018421189B2 (en) Method for quickly opening application or application function, and terminal
US10078599B2 (en) Application access control method and electronic apparatus implementing the same
CN107005619B (zh) 一种注册移动销售点终端pos的方法、对应装置及***
WO2019072039A1 (zh) 一种业务证书管理方法、终端及服务器
JP6552714B2 (ja) データ処理方法およびシステム、ならびにウェアラブル電子デバイス
CN104954126B (zh) 敏感操作验证方法、装置及***
WO2017211205A1 (zh) 一种白名单更新方法和装置
WO2018223797A1 (zh) 数据响应方法、终端设备以及服务器
EP4307198A2 (en) Card binding method and terminal
EP3764258B1 (en) Constructing common trusted application for a plurality of applications
WO2020024929A1 (zh) 对电子身份证的业务适用范围进行升级的方法和终端设备
WO2015035936A1 (zh) 身份验证方法、身份验证装置和身份验证***
CN108737341B (zh) 业务处理方法、终端及服务器
CN115712889A (zh) 设备验证的***、方法、装置、电子设备及介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17805778

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17805778

Country of ref document: EP

Kind code of ref document: A1