WO2023142436A1 - 认证方法、支付方法、装置及设备 - Google Patents

认证方法、支付方法、装置及设备 Download PDF

Info

Publication number
WO2023142436A1
WO2023142436A1 PCT/CN2022/112455 CN2022112455W WO2023142436A1 WO 2023142436 A1 WO2023142436 A1 WO 2023142436A1 CN 2022112455 W CN2022112455 W CN 2022112455W WO 2023142436 A1 WO2023142436 A1 WO 2023142436A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
token
server
payment
identity information
Prior art date
Application number
PCT/CN2022/112455
Other languages
English (en)
French (fr)
Inventor
刘刚
詹成初
才华
Original Assignee
***股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ***股份有限公司 filed Critical ***股份有限公司
Publication of WO2023142436A1 publication Critical patent/WO2023142436A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN

Definitions

  • the application belongs to the technical field of payment security, and in particular relates to an authentication method, payment method, device and equipment.
  • Embodiments of the present application provide an authentication method, a payment method, a device, and a device, which can improve transaction security of IoT devices in a payment scenario.
  • the embodiment of the present application provides an authentication method, which is applied to an Internet of Things device, and the Internet of Things device has a built-in first token, and the method includes:
  • the first information includes the first token and the association information between the second token and the identity information and payment information, wherein the first token is the first server pair It is determined after the authentication of the identity information is passed, and the second token is generated by the second server after the authentication of the payment information is passed;
  • the first information is stored in the security chip.
  • the IoT device is provided with a security chip
  • the method Before sending the identity information of the IoT device to the mobile device, the method also includes;
  • a pair of keys is generated through the security chip, and the keys include a first public key and a first private key;
  • Send the identity information of the IoT device to the mobile device including:
  • the identity information is encrypted by the first private key and sent to the mobile device, so that the mobile device authenticates the identity information by the first public key after sending the identity information to the first server.
  • the first token is encrypted and stored in the security chip.
  • the payment information corresponds to one or more payment cards, and there are one or more second tokens, and the second tokens are in one-to-one correspondence with the payment cards.
  • the embodiment of the present application provides an authentication method, which is applied to the first server, and the method includes:
  • the payment information is sent to the second server for authentication
  • the second token is generated after the second server passes the authentication of the payment information
  • the association information after associating the first token and the second token with the identity information and payment information is sent to the IoT device and the mobile device.
  • the identity information is information encrypted by a first private key, and the first private key is generated by a security chip of the IoT device;
  • Authentication of identity information through preset rules including:
  • the identity information is authenticated through the first public key, which is generated by the security chip and corresponds to the first private key.
  • the method before receiving the identity information of the IoT device and the payment information of the user sent by the mobile device, the method further includes:
  • the payment information corresponds to one or more payment cards, and there are one or more second tokens, and the second tokens are in one-to-one correspondence with the payment cards.
  • the embodiment of the present application provides an authentication method applied to a mobile device, and the method includes:
  • the second information including the first token, the association information between the second token and identity information and payment information, wherein the first token is determined by the first server according to the identity information,
  • the second token is generated after the second server passes the authentication of the payment information.
  • obtaining the identity information of the IoT device and the payment information of the user includes:
  • the identification code analyze and obtain the identity information, and jump to the first interface corresponding to the page address;
  • the payment information input by the user from the first interface is received.
  • the Internet of Things device is provided with a security chip, and the first token is encrypted and stored in the security chip.
  • the payment information corresponds to one or more payment cards, and there are one or more second tokens, and the second tokens are in one-to-one correspondence with the payment cards.
  • the embodiment of the present application provides a payment method, which is applied to the first server, and the method includes:
  • the transaction request including transaction information corresponding to the transaction event, the first token and identity information of the IoT device, and the transaction information including payment information;
  • the pre-stored mapping information in the first token and the first server determine the corresponding second token, the pre-stored mapping information is the association information of the first token, the second token, identity information and payment information;
  • the balance change information sent by the second server is received and forwarded to the IoT device.
  • the transaction request is information encrypted by a first private key on the IoT device, and the first private key is generated by a security chip of the IoT device;
  • the first token is parsed from the transaction request, including:
  • the transaction request is decrypted by using the first public key to parse the transaction request to obtain the first token.
  • the first public key is generated by the security chip and corresponds to the first private key.
  • the embodiment of the present application provides an authentication device, which is applied to a mobile device, and the device includes:
  • the first acquisition module is used to acquire the identity information of the IoT device and the payment information of the user, and the IoT device has a built-in first token;
  • the first sending module is configured to send the identity information and payment information to the first server, so that after the first server passes the authentication of the identity information, it sends the payment information to the second server for authentication;
  • the first receiving module is configured to receive the first information sent by the first server, the first information includes the association information between the first token, the second token, identity information and payment information, wherein the first token is the first token A server determines according to the identity information, and the second token is generated after the second server passes the authentication of the payment information.
  • the embodiment of the present application provides an authentication device, which is applied to an Internet of Things device, and the Internet of Things device has a built-in first token, which is characterized in that the device includes:
  • the second sending module is configured to send the identity information of the IoT device to the mobile device, so that the mobile device sends the identity information and the payment information of the user to the first server for authentication;
  • the second receiving module is used to receive the second information sent by the first server, the second information includes the first token, the association information between the second token and identity information and payment information, wherein the first token is the first token
  • the first server is determined after passing the authentication of the identity information, and the second token is generated after the second server passes the authentication of the payment information;
  • the saving module is used for saving the second information in the security chip.
  • the embodiment of the present application provides an authentication device, which is applied to the first server, and is characterized in that the device includes:
  • the third receiving module is used to receive the identity information of the IoT device and the payment information of the user sent by the mobile device;
  • a first authentication module configured to authenticate identity information through preset rules
  • the third sending module is used to send payment information to the second server for authentication after the identity information authentication is passed;
  • the fourth receiving module is used to receive the second token sent by the second server, and the second token is generated after the second server passes the payment information authentication;
  • the fourth sending module is used to send the associated information after the first token and the second token are associated with identity information and payment information to the IoT device and the mobile device.
  • the embodiment of the present application provides a payment device, which is applied to the first server, and the device includes:
  • the fifth receiving module is configured to receive a transaction request sent by the Internet of Things device, the transaction request includes transaction information corresponding to the transaction event, the first token and identity information of the Internet of Things device, and the transaction information includes payment information;
  • the first parsing module is configured to parse the transaction request to obtain the first token
  • a determining module configured to determine a corresponding second token according to the first token and pre-stored mapping information in the first server, where the pre-stored mapping information is association information between the first token, the second token, identity information, and payment information ;
  • the fifth sending module is configured to send the second token and the transaction information to the second server, so that after the second server passes the verification of the payment information corresponding to the second token, the third server performs the transaction based on the payment information.
  • the balance deduction operation corresponding to the transaction event generates balance change information;
  • a sixth receiving module configured to receive the balance change information sent by the second server, and forward it to the Internet of Things device.
  • the embodiment of the present application provides an electronic device, the device comprising: a processor and a memory storing computer program instructions;
  • the embodiment of the present application provides a computer storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the above first aspect, second aspect, and third aspect are realized , or the method described in any embodiment of the fourth aspect.
  • the embodiment of the present application provides a computer program product.
  • the instructions in the computer program product are executed by the processor of the electronic device, the electronic device executes the above-mentioned first aspect, the second aspect, and the third aspect. aspect, or the method described in any embodiment of the fourth aspect.
  • the embodiment of the present application provides an authentication method, payment method, device and equipment, wherein in the authentication method, the identity information of the IoT device and the user's payment information are obtained through the mobile device, and the IoT device has a built-in first token; Send the identity information and payment information to the first server, so that after the first server passes the authentication of the identity information, it sends the payment information to the second server for authentication; when the second server passes the authentication of the payment information, a second order is generated.
  • the card is sent to the first server, and the first information and the second information are generated based on the first token, the second token and the associated information between the payment information and sent to the mobile device and the Internet of Things device respectively to complete the authentication.
  • the first token is used as the device token of the IoT device, and the second token is used as the service token corresponding to the payment information.
  • the transaction security can be improved based on the binding relationship between the token and the payment information.
  • FIG. 1 is a schematic flow diagram of an authentication method provided by an embodiment of the present application
  • Fig. 2 is a schematic flow diagram of an authentication method in a specific example of the present application.
  • FIG. 3 is a schematic flowchart of an authentication method provided in another embodiment of the present application.
  • Fig. 4 is a schematic flowchart of an authentication method provided in another embodiment of the present application.
  • FIG. 5 is a schematic flowchart of an authentication method provided in another embodiment of the present application.
  • Fig. 6 is a schematic flowchart of a payment method provided by an embodiment of the present application.
  • Figure 7 is a schematic flow diagram of a payment method in a specific example of the present application.
  • Fig. 8 is a schematic structural diagram of an authentication device provided by an embodiment of the present application.
  • Fig. 9 is a schematic structural diagram of an authentication device provided in another embodiment of the present application.
  • Fig. 10 is a schematic structural diagram of an authentication device provided in another embodiment of the present application.
  • Fig. 11 is a schematic structural diagram of a payment device provided by an embodiment of the present application.
  • Fig. 12 is a schematic structural diagram of an electronic device provided by another embodiment of the present application.
  • the payment method usually used is: the IoT device sends a payment request including the device ID and payment amount to the server, and the server queries the associated payment account according to the device ID, and from the payment account Make a deduction.
  • the disadvantage of this payment method is that the payment security is low, and the payment can only be deducted from the associated payment account determined by the background server, and the IoT device does not have independent payment capabilities.
  • IoT devices In addition, currently IoT devices only support online transactions in payment scenarios, and cannot support offline transactions without the participation of offline POS (Point of sales) devices. Because as far as the current payment technology is concerned, if IoT devices conduct offline transactions, most of them need to rely on IC cards (Integrated Circuit Cards, integrated circuit cards), and POS devices need to be used to initiate transactions based on IC cards, which reduces the convenience of front-end operations. , the complexity of the operation process is high.
  • IC cards Integrated Circuit Cards, integrated circuit cards
  • the embodiments of the present application provide an authentication method, payment method, device and equipment. Safe payment is realized through the security chip and device token set in the IoT device. The following firstly introduces the authentication method provided by the embodiment of the present application.
  • Fig. 1 shows a schematic flowchart of an authentication method provided by an embodiment of the present application.
  • the authentication method is applied to an Internet of Things device, and the first token is built in the Internet of Things device, and the method includes steps S101 to S103:
  • S101 Provide the mobile device with the identity information of the IoT device, so that the mobile device sends the identity information and the user's payment information to the first server for authentication;
  • the first information includes the association information between the first token, the second token, and the payment information, wherein the first token is the determined after the first server passes the authentication of the identity information, and the second token is generated after the second server passes the authentication of the payment information;
  • the identity information of the IoT device and the payment information of the user are acquired through the mobile device, and are sent together to the first server for authentication.
  • the first server authenticates the identity information of the IoT device, it can determine the first token of the IoT device based on the identity information, that is, the token of the IoT device does not need to be transmitted, and the IoT device can be pre-stored in the first server.
  • the corresponding relationship between the device identity information and the first token after verifying that the identity information of the IoT device is legal, it can be determined that the device corresponds to the first token; then the payment information is sent to the second server, and the second server authenticates the payment The legitimacy of the information, and after the authentication is passed, the second token is generated and returned to the first server, and the first server completes the binding of the corresponding IoT device, that is, associates the first token, the second token and the payment information, Sent to IoT devices for storage. In this way, before the payment is realized, the authentication is completed based on the device token of the Internet of Things device (ie, the first token, the same below) and the server, so as to ensure the security of the subsequent payment.
  • the device token of the Internet of Things device ie, the first token, the same below
  • the processor of the Internet of Things device such as MCU (Micro Controller Unit, Micro Control Unit) is connected to a security chip SE (Secure Element), and the security chip SE presets a security domain to establish its The security foundation for IoT devices.
  • MCU Micro Controller Unit, Micro Control Unit
  • SE Secure Element
  • the security domain can verify the legitimacy and security of the server to which the IoT device belongs, and the verification of the security domain can use mature technologies in the field, which will not be repeated here.
  • the security chip SE of the IoT device can be used as a transaction security shield of the device, and based on its own high security performance, the hardware capability of the IoT device can be improved.
  • the first token is encrypted and stored in the security chip SE, and the first token, as the device Token of the IoT device, can be preset into the IoT device together with the security chip at the factory stage or before it is put into use. For example, it can be injected by payment card manufacturers, or by IoT device manufacturers.
  • the first token that is, the device Token of the IoT device
  • the first token has a unique correspondence with the IoT device, and each IoT device has a device Token, so the device Token of the IoT device is globally unique .
  • the authentication method in this embodiment of the present application may also include S104-S105:
  • S104 Generate a pair of keys through the security chip, where the keys include a first public key and a first private key;
  • the security chip SE generates a pair of asymmetric keys, the key includes a first public key and a first private key, wherein the first private key is stored in the security chip, and the first public key is sent to the first server save.
  • step S101 the identity information of the IoT device is provided to the mobile device in step S101, which may specifically include:
  • the identity information is encrypted by the first private key and then sent to the mobile device, so that after the mobile device sends the identity information to the first server, the identity information is encrypted by the first public key Information authentication.
  • the IoT identity information may include one or more of a device ID (Identity Document, identity code), a device manufacturer ID, and a device chip ID (that is, the chip serial number corresponding to the above-mentioned MCU of the device).
  • a device ID Identity Document, identity code
  • the identification code of the IoT device identity information can be displayed for the mobile device to obtain, or the IoT device provides an MCU access interface for the mobile device to obtain the IoT device.
  • Device identity information when the identity information of the IoT device is provided to the mobile device, the identification code of the IoT device identity information can be displayed for the mobile device to obtain, or the IoT device provides an MCU access interface for the mobile device to obtain the IoT device.
  • the identification code may include acquisition request information, and through steps S201-S202, the mobile device scans the identification code to initiate a request to the IoT device, and the IoT device based on the request The identity information is returned to the mobile device, and the mobile device obtains the payment information input by the user through the first interface after receiving the identity information.
  • the identification code may include identity information such as the device ID and device manufacturer ID of the IoT device, and a page address link.
  • the mobile device obtains the identity information of the IoT device by scanning the identification code, and at the same time jumps to the first interface corresponding to the page address to receive the payment information input by the user from the first interface.
  • the Internet of Things device provides an MCU access interface, and the mobile device uses the access interface to obtain the identity information of the Internet of Things device, and then obtains the payment information input by the user through the first interface.
  • the identification code can be a two-dimensional code, or other forms of graphic codes; the identification code can be a static code, or can also be a dynamic code; the identification code can be displayed on the display screen of the IoT device, or It can be displayed in other forms; the embodiment of this application does not make a unique limitation.
  • the identity information obtained by the mobile device is information encrypted by the first private key stored in the security chip SE by the IoT device, which can avoid information leakage during information transmission during the authentication process and cause The risk of being attacked by malicious analysis.
  • the payment information input by the user may include one or more of payment card (such as bank card) card number, anti-counterfeiting code (such as security code CVN2, Card Validation Number 2) and verification code.
  • the payment information may include one or more payment cards.
  • step S203 shown in Figure 2 the mobile device sends the identity information of the IoT device and the user's payment information to the first server, and the legality of the identity information is authenticated by the first server After the authentication of the identity information of the IoT device is passed, the user's payment is authenticated through the second server.
  • the first server may be an IoT device management platform.
  • the mapping relationship between the IoT device and its corresponding first public key and device Token is stored in the database in advance in the first server.
  • the first server receives the identity information of the IoT device sent by the mobile terminal, in step S204, it decrypts and authenticates the identity information through the first public key. If the decryption is successful, the identity of the IoT device is legal and the authentication Pass; otherwise, it is invalid and IoT identity authentication fails.
  • step S204 after passing the authentication of the identity information of the IoT device, the first server determines the first token corresponding to the IoT device based on the analyzed identity information.
  • the first server also sends the user's payment information to the second server.
  • the second server may be the transaction platform of the operator to which the payment card belongs (such as the UnionPay transaction platform corresponding to the UnionPay card).
  • the second server verifies the card number, anti-counterfeiting code, and verification code in the payment information, and confirms the legitimacy of the payment information.
  • the second server generates a second token corresponding to the payment information after authenticating the payment information of the user.
  • the second token as a business token, has a one-to-one relationship with the payment card in the payment information.
  • a first token can be generated; when the payment information contains When the information of multiple payment cards is included, multiple second tokens may be respectively generated corresponding to these payment cards.
  • the second token generated by the second server is returned to the first server, and through step S208, the first server returns the first token corresponding to the above-identified Internet of Things device and the second token returned by the second server
  • the card is bound with the corresponding identity information and payment information, and the corresponding associated information is generated and stored in the first server.
  • one first token can correspond to one or more second tokens, that is, in the embodiment of this application, an IoT device is allowed to bind multiple payment cards for subsequent transactions, satisfying the needs of users. card payment requirements.
  • one of the payment cards can be set as the default payment card during the binding process of the above-mentioned associated information, and the corresponding default payment identifier can be marked in the associated information.
  • the IoT device After the associated information is generated by the first server, the IoT device receives the associated information (that is, the first information) sent by the first server through step S102, and securely stores the first information in the IoT device through step S103. And the associated information can also be sent to the mobile device and displayed for the user to understand.
  • the associated information that is, the first information
  • the first information is safely stored in the IoT device, and in the subsequent payment scenario, transaction payment can be initiated through the payment information in the first information stored in the security chip SE, and the IoT device has the ability to use
  • the hardware capability of secure payment expands the transaction attributes of IoT devices and improves the device's secure payment capabilities.
  • IoT devices authenticated by identity information and payment information can have separate payment capabilities in the subsequent payment process.
  • IoT devices in this embodiment of the application can be based on security
  • the hardware foundation established by the chip initiates transaction payment based on the securely stored payment information and the first token certified by the platform to ensure transaction security and avoid the risk of information being maliciously cracked and attacked during the transmission of transaction information.
  • the first information authenticated by the authentication method of the embodiment of the application is stored in the Internet of Things device and used in the scenario of subsequent transaction payment initiation.
  • this application When the Internet of Things device in the embodiment initiates a transaction based on the payment information of the payment card, it can break away from the front-end's dependence on the IC card physical card body, which is beneficial to improve transaction convenience.
  • the embodiment of the present application may also allow the user to update the payment information stored in the IoT device.
  • the authentication method may also include Steps S301-S303, the specific steps are as follows.
  • S301 Provide the mobile device with the identity information and payment information of the IoT device, so that the mobile device generates updated payment information according to the payment information, and sends the updated payment information and identity information to the first server for authentication .
  • the mobile terminal can obtain the identity information of the IoT device by scanning the identification code or accessing the MCU access interface of the IoT device, and jump to the second interface to display the payment information of the existing payment card stored on the IoT device.
  • the user can generate corresponding updated payment information by inputting operations such as adding a new payment card or deleting a payment card. If the original payment information of payment card 1 is displayed on the second interface, the user enters the payment information of payment card 2 and payment card 3 on the second interface, and marks the payment information of payment card 2 as the default payment card, and deletes the payment
  • the payment information of card 1 generates updated payment information corresponding to payment card 2 and payment card 3.
  • the mobile device sends the identity information and updated payment information to the first server for authentication.
  • S302. Receive third information sent by the first server, where the third information includes association information between the first token, the third token, the identity information, and the updated payment information, wherein the The first token is determined after the first server passes the authentication of the identity information, and the third token is generated after the second server passes the authentication of the updated payment information.
  • the authentication process of the first server for the identity information of the IoT device is the same as the identity information authentication process in the above embodiment
  • the authentication process of the second server for updating the payment information is the same as the authentication process of the payment information in the above embodiment
  • the second server generates a new technical Token after passing the authentication of the updated payment information, that is, the third token, and returns it to the second server, and the second server sends the first token, the third token, the identity information and
  • the updated payment information is bound to generate new associated information (that is, the third information), which is sent to the Internet of Things device for storage, and then sent to the mobile device for display to the user.
  • FIG. 4 shows a schematic flowchart of an authentication method provided by an embodiment of the present application. As shown in Figure 4, the authentication method is applied to the first server, and the method includes steps S401-S405:
  • S401 Receive the identity information of the IoT device and the payment information of the user sent by the mobile device;
  • the first server may be an Internet of Things device management platform, and the first server may perform unified management on several Internet of Things devices.
  • the identity information of the IoT device and the payment information of the user are obtained through the mobile device, and are sent together to the first server for authentication.
  • the first server After the first server authenticates the identity information of the IoT device, it can determine the first token of the IoT device based on the identity information, that is, the token of the IoT device does not need to be transmitted, and the IoT device can be pre-stored in the first server.
  • the corresponding relationship between the device identity information and the first token after verifying that the identity information of the IoT device is legal, it can be determined that the device corresponds to the first token; then the payment information is sent to the second server, and the second server authenticates the payment The legitimacy of the information, and after the authentication is passed, the second token is generated and returned to the first server, and the first server completes the binding of the corresponding IoT device, that is, associates the first token, the second token and the payment information, Sent to IoT devices for storage. In this way, before the payment is realized, the authentication is completed based on the device token of the Internet of Things device (ie, the first token, the same below) and the server, so as to ensure the security of the subsequent payment.
  • the device token of the Internet of Things device ie, the first token, the same below
  • the processor of the IoT device such as MCU (Micro Controller Unit, Micro Control Unit) is connected to a security chip SE (Secure Element), and the security chip SE presets a security domain to establish its IoT The security foundation for connected devices.
  • MCU Micro Controller Unit, Micro Control Unit
  • SE Secure Element
  • the security chip SE of the IoT device can be used as a transaction security shield of the device, and based on its own high security performance, the hardware capability of the IoT device can be improved.
  • the first token is encrypted and stored in the security chip SE.
  • each IoT device has a device Token, that is, the device Token of the IoT device is globally unique.
  • the security chip of the IoT device is also used to generate a pair of asymmetric keys.
  • the key includes a first public key and a first private key, the first private key is stored in the security chip, and the first public key is sent to the first server for storage. Therefore, before the above step S401, the method may also include:
  • the first server may pre-save the mapping association between the identity information of the IoT device and its first token in the database, and after receiving the first public key, associate the first public key with the corresponding IoT device Identity information is stored in association.
  • the first server After the first server saves the first public key, it receives the identity information of the IoT device and the payment information of the user sent by the mobile device through step S401, wherein the identity information of the IoT device may include a device ID (Identity Document, identity code) , device manufacturer ID, and device chip ID.
  • the user's payment information can include one or more of payment card (such as bank card) card number, anti-counterfeiting code (such as security code CVN2, Card Validation Number 2) and verification code.
  • the payment information may include one or more payment cards.
  • the identity information may be information encrypted by the first private key stored in the security chip of the IoT device, then after receiving the identity information of the IoT device and the user's payment After receiving the information, the first server may authenticate the identity information through a preset rule in step S402.
  • step S402 may include:
  • the identity information is authenticated by using a first public key, wherein the first public key is generated by the security chip and corresponds to the first private key.
  • the identity information encrypted by the first private key is a piece of ciphertext. If the ciphertext can be decrypted by the first public key corresponding to the first private key, the identity of the IoT device is legal and the authentication is passed; if the decryption fails, the identity of the IoT device is invalid. , IoT authentication failed.
  • the plaintext of the identity information is decrypted, and the first server can match the corresponding first token from the database based on the plaintext.
  • the payment information is sent to the second server for authentication.
  • the second server may be the transaction platform of the operator to which the payment card belongs (such as the UnionPay transaction platform corresponding to the UnionPay card). The second server verifies the card number, anti-counterfeiting code, and verification code in the payment information, and confirms the legitimacy of the payment information.
  • the second server After the second server authenticates that the payment information of the user is legal, it generates a second token corresponding to the payment information.
  • the second token as a business token, has a one-to-one relationship with the payment card in the payment information.
  • a first token can be generated; when the payment information contains When the information of multiple payment cards is included, multiple second tokens may be respectively generated corresponding to these payment cards.
  • the first server receives the second token sent by the second server through step S404, and combines the first token and the second token with the decrypted identity information and the payment
  • the information is associated and bound to generate corresponding associated information
  • the associated information is stored in the database of the first server, and the associated information is sent to the IoT device and the mobile device respectively through step S405, and the IoT device stores the associated information
  • the associated information enables subsequent transaction payments to be initiated based on the associated information, and the mobile device can display the associated information for the user to view.
  • the payment information is authenticated by the second server, thereby ensuring information security.
  • the first server associates and binds the identity information and payment information of the IoT device with the unique device Token of the IoT device, and feeds it back to the IoT device for storage, so that it can be used in the security chip SE of the IoT device in subsequent payment scenarios.
  • the saved payment information initiates transaction payment, so that IoT devices have independent payment capabilities.
  • the IoT device in the embodiment of the present application can initiate transaction payment based on the hardware foundation established by the security chip and the payment information and the first token that are safely stored and authenticated by the platform.
  • the associated information authenticated by the authentication method of the embodiment of the application is stored in the IoT device and used in the scenario of subsequent transaction payment initiation.
  • the implementation When the Internet of Things device in the example initiates a transaction based on the payment information of the payment card, it can break away from the front-end's dependence on the IC card physical card body, which is conducive to improving transaction convenience.
  • the embodiment of the present application may also allow the user to update the payment information stored in the IoT device.
  • the authentication method may also include steps S406-S410, specifically The steps are as follows.
  • the mobile terminal can obtain the identity information of the IoT device by scanning the identification code or accessing the MCU access interface of the IoT device, and jump to the second interface to display the payment information of the existing payment card stored on the IoT device.
  • the user can generate corresponding updated payment information by inputting a new payment card or deleting a payment card, etc., and send the identity information and updated payment information to the first
  • the server is authenticated.
  • the authentication process of the first server for the identity information of the IoT device is the same as the identity information authentication process of step S402 in the above embodiment
  • the authentication process of the second server for updating the payment information is the same as the authentication process of the payment information in the above embodiment
  • the second server generates a new technical Token after passing the authentication of the updated payment information, that is, the third token, and returns it to the second server, and the second server passes the first token, the third token, the identity
  • the information and the updated payment information are bound to generate new associated information (that is, the third information), which is sent to the Internet of Things device for storage, and then sent to the mobile device for display to the user.
  • Fig. 5 shows a schematic flowchart of an authentication method provided by an embodiment of the present application. As shown in Figure 5, the method is applied to mobile devices, and the method includes steps S501-S503:
  • the second information includes the first token and the association information between the second token, the identity information and the payment information, wherein the The first token is determined by the first server according to the identity information, and the second token is generated after the second server authenticates the payment information.
  • the identity information of the IoT device and the payment information of the user are acquired through the mobile device, and are sent together to the first server for authentication.
  • the first server authenticates the identity information of the IoT device, it can determine the first token of the IoT device based on the identity information, that is, the token of the IoT device does not need to be transmitted, and the IoT device can be pre-stored in the first server.
  • the corresponding relationship between the device identity information and the first token after verifying that the identity information of the IoT device is legal, it can be determined that the device corresponds to the first token; then the payment information is sent to the second server, and the second server authenticates the payment The legitimacy of the information, and after the authentication is passed, the second token is generated and returned to the first server, and the first server completes the binding of the corresponding IoT device, that is, associates the first token, the second token and the payment information, Sent to IoT devices for storage. In this way, before the payment is realized, the authentication is completed based on the device token of the Internet of Things device (ie, the first token, the same below) and the server, so as to ensure the security of the subsequent payment.
  • the device token of the Internet of Things device ie, the first token, the same below
  • the processor of the IoT device such as MCU (Micro Controller Unit, Micro Control Unit) is connected to a security chip SE (Secure Element), and the security chip SE presets a security domain to establish its IoT The security foundation for connected devices.
  • MCU Micro Controller Unit
  • Micro Control Unit Micro Control Unit
  • the security chip SE of the IoT device can be used as a transaction security shield of the device, and based on its own high security performance, the hardware capability of the IoT device can be improved.
  • the first token is encrypted and stored in the security chip SE.
  • each IoT device has a device Token, that is, the device Token of the IoT device is globally unique.
  • the first token stored safely in the security chip it is also used to generate a key, which is an asymmetric key, and the key includes a first public key and a first private key, and the first private key is stored in
  • the first public key is sent to the first server for storage. Therefore, in step S501, in obtaining the identity information of the IoT device and the payment information of the user, the identity information can be information encrypted by the first private key in the security chip of the IoT device, which can avoid information transmission during the authentication process The risk of information leakage that may lead to malicious analysis attacks.
  • the payment information input by the user may include one or more of payment card (such as bank card) card number, anti-counterfeiting code (such as security code CVN2, Card Validation Number 2) and verification code.
  • the payment information may include one or more payment cards.
  • the mobile device when the mobile device acquires the identity information of the IoT device, it may obtain it through parsing the identification code of the IoT device identity information, or obtain it through an MCU access interface provided by the IoT device.
  • the identification code may include acquisition request information, so that the mobile device scans the identification code to initiate a request to the Internet of Things device, and then the Internet of Things The device returns the identity information to the mobile device based on the request, and the mobile device obtains the payment information input by the user through the first interface after receiving the identity information.
  • the identification code may include identity information such as the device ID and device manufacturer ID of the IoT device, and a page address link
  • step S501 may specifically include steps S5011-S5013:
  • S5013. Receive payment information input by the user from the first interface.
  • the mobile device obtains the identity information of the IoT device by scanning the identification code, and at the same time jumps to the first interface corresponding to the page address to receive the payment information input by the user from the first interface.
  • the convenience of inputting payment information can be improved by scanning a code for input.
  • the identification code can be a two-dimensional code, or other forms of graphic codes; the identification code can be a static code, or can also be a dynamic code; the identification code can be displayed on the display screen of the IoT device, or It can be displayed in other forms; the embodiment of this application does not make a unique limitation.
  • the mobile device After acquiring the identity information and payment information, the mobile device sends the identity information and payment information to the first server through step S502.
  • the legality of the identity information is first authenticated, and after the authentication of the identity information of the IoT device is passed, the first server sends the payment information to the second server, and then the user's payment is processed through the second server. certified.
  • the first server may be an IoT device management platform.
  • the mapping relationship between the IoT device and its corresponding first public key and device Token is stored in the database in advance in the first server.
  • the first server receives the identity information of the IoT device sent by the mobile terminal, it decrypts and authenticates the identity information through the first public key. If the decryption is successful, the identity of the IoT device is legal and the authentication is passed; Authentication failed.
  • the first server After passing the authentication of the identity information of the IoT device, the first server determines the first token corresponding to the IoT device based on the analyzed identity information. At the same time, the first server also sends the user's payment information to the second server.
  • the second server may be the transaction platform of the operator to which the payment card belongs (such as the UnionPay transaction platform corresponding to the UnionPay card). The second server verifies the card number, anti-counterfeiting code, and verification code in the payment information to confirm the legitimacy of the payment information.
  • the second server After the second server authenticates that the payment information of the user is legal, it generates a second token corresponding to the payment information.
  • the second token as a business token, has a one-to-one relationship with the payment card in the payment information.
  • a first token can be generated; when the payment information contains When the information of multiple payment cards is included, multiple second tokens may be respectively generated corresponding to these payment cards.
  • the second token generated by the second server is returned to the first server, and the first server determines the first token corresponding to the Internet of Things device, the second token returned by the second server, and the corresponding identity information and payment information Binding is performed to generate corresponding associated information, then the mobile device may receive the second information (that is, the associated information) sent by the first server through step S503, and display the second information for the user to view.
  • one first token can correspond to one or more second tokens, that is, in the embodiment of this application, an IoT device is allowed to bind multiple payment cards for subsequent transactions, satisfying the needs of users. card payment requirements.
  • one of the payment cards can be set as the default payment card during the binding process of the above-mentioned associated information, and the corresponding default payment identifier can be marked in the associated information.
  • transaction payment can be initiated through the payment information in the associated information stored in the security chip SE in the subsequent payment scenario.
  • IoT devices authenticated by identity information and payment information can have separate payment capabilities in the subsequent payment process.
  • IoT devices in this embodiment of the application can be based on security
  • the hardware foundation established by the chip initiates transaction payment based on the securely stored payment information and the first token certified by the platform to ensure transaction security and avoid the risk of transaction information being maliciously cracked and attacked during transmission.
  • the associated information authenticated by the authentication method of the embodiment of the application is stored in the IoT device and used in the scenario of subsequent transaction payment initiation.
  • the implementation When the Internet of Things device in the example initiates a transaction based on the payment information of the payment card, it can break away from the front-end's dependence on the IC card physical card body, which is conducive to improving transaction convenience.
  • the embodiment of the present application may also allow the user to update the payment information stored in the IoT device.
  • the authentication method may also include steps S504-S506:
  • S303 Receive fourth information sent by the first server, where the fourth information includes association information between the first token and the third token, the identity information, and the updated payment information, wherein, The first token is determined by the first server according to the identity information, and the third token is generated after the second server passes the authentication of the updated payment information.
  • the mobile terminal can obtain the identity information of the IoT device by scanning the identification code or accessing the MCU access interface of the IoT device, and jump to the second interface to display the payment information of the existing payment card stored on the IoT device.
  • the user can generate corresponding updated payment information by inputting operations such as adding a new payment card or deleting a payment card.
  • the mobile device sends the identity information and updated payment information to the first server for authentication.
  • the authentication process of the first server for the identity information of the IoT device is the same as the identity information authentication process in the above embodiment
  • the authentication process of the second server for updating the payment information is the same as the authentication process of the payment information in the above embodiment
  • the second server generates a new technical Token after passing the authentication of the updated payment information, that is, the third token, and returns it to the second server, and the second server sends the first token, the third token, the identity information and
  • the updated payment information is bound to generate new associated information (that is, the fourth information), which is sent to the Internet of Things device for storage, and then sent to the mobile device for display to the user.
  • the first information and the second information may include the same associated information
  • the third information and the second information may include the same associated information
  • the four information may include the same associated information.
  • the aforementioned IoT device may be an electronic license plate.
  • the embodiment of the present application After completing the authentication and binding of IoT devices and payment information through the information interaction between IoT devices, mobile devices, the first server and the second server, it can facilitate the participation of IoT devices in transaction payment scenarios and guarantee transactions safety. Therefore, the embodiment of the present application also provides a payment method.
  • Fig. 6 shows a schematic flowchart of a payment method provided by an embodiment of the present application. As shown in Figure 6, the method is applied to the first server, and the method includes steps S601-S605:
  • S605. Receive the balance change information sent by the second server, and forward it to the IoT device.
  • the first server in this embodiment of the present application may be an Internet of Things device management platform.
  • the transaction payment is initiated based on the authenticated identity information and payment information and the first token stored in the security chip.
  • the legality of the transaction information is guaranteed, and the efficiency of the transaction is improved.
  • Transaction security Compared with the traditional IC card transaction, the method of the embodiment of the present application can realize the transaction process based on the payment information of the payment card, but not rely on the physical card body of the payment card, and improve the convenience of payment.
  • the IoT device when a transaction is performed, through step S701, the IoT device sends the transaction information corresponding to the transaction event, the first token of the IoT device stored in the security chip and identity information, encapsulate the data packet generating the transaction request, and send it to the first server.
  • the transaction information may include the time of the current transaction event, event identifier, payment information (such as the payment information of the default payment card), payment amount, and the like.
  • the transaction information, the first token and identity information of the Internet of Things device, etc. can be encrypted by the first private key in the security chip to ensure the security of sensitive information.
  • the first server receives the transaction request sent by the Internet of Things device through step S601, it obtains the first token from the transaction request through step S602, which may specifically include steps:
  • the transaction request is decrypted by using the first public key to parse the transaction request to obtain the first token.
  • the first public key is generated by the security chip and corresponds to the first private key.
  • the first server pre-stores the associated information of the first public key, the first token, the second token, the identity information of the IoT device, and the payment information.
  • the data packet of the transaction request is decrypted by using the first public key, and the plaintext of information such as the first token, identity information, and transaction information is decrypted.
  • the corresponding second token can be determined according to the first token and the pre-stored mapping information in the first server through step S603, wherein the pre-stored mapping information is the associated information.
  • the first server After confirming the second token corresponding to the transaction request, the first server sends a message including the second token and the transaction information to the second server through step S604.
  • the second server may be a transaction platform of the operator to which the payment card belongs (such as a UnionPay transaction platform corresponding to a UnionPay card).
  • the second server pre-stores the mapping relationship data between the second token and the payment information, as shown in FIG. 7, through step S702, the second server can determine the corresponding payment information according to the second token in the message. legality.
  • the second server After verifying that the payment information is legal, through step S703, the second server sends the payment amount and payment information (such as payment card number) in the transaction information to the third server.
  • the third server may be a card issuer system.
  • the third server performs a balance deduction operation based on corresponding transaction events such as payment information and payment amount, and generates balance change information of the payment card.
  • steps S705- S707. Return to the second server, and the second server returns step by step.
  • the first server receives the balance change information sent by the second server through step S605, and forwards it to the IoT device to complete the transaction payment.
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B according to A does not mean determining B only according to A, and B may also be determined according to A and/or other information.
  • FIG. 8 shows a schematic structural diagram of an authentication device provided by an embodiment of the present application. As shown in Figure 8, the device is applied to an Internet of Things device, and the first token is built in the Internet of Things device, and the device includes:
  • the first sending module 801 is configured to provide the mobile device with the identity information of the IoT device, so that the mobile device sends the identity information and the user's payment information to the first server for authentication;
  • the first receiving module 802 is configured to receive second information sent by the first server, where the second information includes association information between the first token and the second token, the identity information, and the payment information , wherein the first token is determined after the first server authenticates the identity information, and the second token is generated after the second server authenticates the payment information;
  • a saving module 803, configured to save the first information.
  • the identity information of the IoT device and the payment information of the user are obtained through the mobile device, and are sent together to the first server for authentication.
  • the first server authenticates the identity information of the IoT device, it can determine the first token of the IoT device based on the identity information, that is, the token of the IoT device does not need to be transmitted, and the IoT device can be pre-stored in the first server.
  • the corresponding relationship between the device identity information and the first token after verifying that the identity information of the IoT device is legal, it can be determined that the device corresponds to the first token; then the payment information is sent to the second server, and the second server authenticates the payment The legitimacy of the information, and after the authentication is passed, the second token is generated and returned to the first server, and the first server completes the binding of the corresponding IoT device, that is, associates the first token, the second token and the payment information, Sent to IoT devices for storage. In this way, before the payment is realized, the authentication is completed based on the device token of the Internet of Things device (ie, the first token, the same below) and the server, so as to ensure the security of the subsequent payment.
  • the device token of the Internet of Things device ie, the first token, the same below
  • the processor of the Internet of Things device such as MCU (Micro Controller Unit, Micro Control Unit) is connected to a security chip SE (Secure Element), and the security chip SE presets a security domain to establish its IoT device.
  • MCU Micro Controller Unit
  • Micro Control Unit Micro Control Unit
  • the security chip SE presets a security domain to establish its IoT device.
  • the security chip SE of the IoT device can be used as a transaction security shield of the device, and based on its own high security performance, the hardware capability of the IoT device can be improved. And the first token is encrypted and stored in the security chip SE.
  • the first token that is, the device Token of the IoT device
  • the first token has a unique correspondence with the IoT device, and each IoT device has a device Token, so the device Token of the IoT device is globally unique .
  • the device may also include:
  • a first generation module configured to generate a pair of keys through the security chip, the keys include a first public key and a first private key;
  • a sixth sending module configured to send the first public key to the first server.
  • the first sending module 801 can specifically be used for:
  • the identity information is encrypted by the first private key and then sent to the mobile device, so that after the mobile device sends the identity information to the first server, the identity information is encrypted by the first public key Information authentication.
  • the identity information of the Internet of Things may include one or more of a device ID (Identity Document, identity code), a device manufacturer ID, and a device chip ID (in this example, the serial number of the chip corresponding to the above-mentioned MCU of the device) kind.
  • a device ID Identity Document, identity code
  • a device manufacturer ID e.g., the manufacturer ID
  • a device chip ID e.g., the serial number of the chip corresponding to the above-mentioned MCU of the device
  • the payment information input by the user may include one or more of payment card (such as bank card) card number, anti-counterfeiting code (such as security code CVN2, Card Validation Number 2) and verification code.
  • the payment information may include one or more payment cards.
  • the second token as a business token, has a one-to-one relationship with the payment card in the payment information.
  • a first token can be generated; when the payment information contains
  • multiple second tokens may be respectively generated corresponding to these payment cards.
  • the device may also include:
  • the second providing module is configured to provide the mobile device with the identity information and payment information of the IoT device, so that the mobile device generates updated payment information according to the payment information, and sends the updated payment information and identity information To the first server authentication;
  • a seventh receiving module configured to receive third information sent by the first server, where the third information includes the first token, the third token, the identity information, and the association information between the updated payment information , wherein the first token is determined after the first server authenticates the identity information, and the third token is generated after the second server authenticates the updated payment information;
  • a second saving module configured to save the third information.
  • FIG. 9 shows a schematic structural diagram of an authentication device provided by an embodiment of the present application. As shown in Figure 9, the device is applied to the first server, and the device includes:
  • the second receiving module 901 is configured to receive the identity information of the IoT device and the payment information of the user sent by the mobile device;
  • the first authentication module 902 is configured to authenticate the identity information through preset rules
  • the second sending module 903 is configured to send the payment information to the second server for authentication after the identity information is authenticated;
  • the third receiving module 904 is configured to receive the second token sent by the second server, the second token is generated after the second server passes the authentication of the payment information;
  • the third sending module 905 is configured to send the associated information after the first token and the second token are associated with the identity information and the payment information to the IoT device and the mobile device.
  • the first server may be an Internet of Things device management platform, and the first server may perform unified management on several Internet of Things devices. Obtain the identity information of the IoT device and the payment information of the user through the mobile device, and send them together to the first server for authentication. After the first server authenticates the identity information of the IoT device, it can determine the first token of the IoT device based on the identity information, that is, the token of the IoT device does not need to be transmitted, and the IoT device can be pre-stored in the first server.
  • the corresponding relationship between the device identity information and the first token after verifying that the identity information of the IoT device is legal, it can be determined that the device corresponds to the first token; then the payment information is sent to the second server, and the second server authenticates the payment The legitimacy of the information, and after the authentication is passed, the second token is generated and returned to the first server, and the first server completes the binding of the corresponding IoT device, that is, associates the first token, the second token and the payment information, Sent to IoT devices for storage. In this way, before the payment is realized, the authentication is completed based on the device token of the IoT device (that is, the first token, the same below) and the server to ensure the security of subsequent payments.
  • the processor of the Internet of Things device such as MCU (Micro Controller Unit, Micro Control Unit) is connected to a security chip SE (Secure Element), and the security chip SE presets a security domain to establish its IoT device.
  • MCU Micro Controller Unit
  • Micro Control Unit Micro Control Unit
  • the security chip SE presets a security domain to establish its IoT device.
  • the security chip SE of the IoT device can be used as a transaction security shield of the device, and based on its own high security performance, the hardware capability of the IoT device can be improved. And the first token is encrypted and stored in the security chip SE.
  • the first token that is, the device Token of the IoT device
  • the first token has a unique correspondence with the IoT device, and each IoT device has a device Token, so the device Token of the IoT device is globally unique .
  • the device may also include:
  • An eighth receiving module configured to receive the first public key sent by the IoT device
  • a third saving module configured to save the first public key.
  • the first server may pre-save the mapping association between the identity information of the IoT device and its first token in the database, and after receiving the first public key, associate the first public key with the corresponding IoT device Identity information is stored in association.
  • the IoT identity information may include one or more of a device ID (Identity Document, identity code), a device manufacturer ID, and a device chip ID.
  • the payment information input by the user may include one or more of payment card (such as bank card) card number, anti-counterfeiting code (such as security code CVN2, Card Validation Number 2) and verification code.
  • the payment information may include one or more payment cards.
  • the second token as a business token, has a one-to-one relationship with the payment card in the payment information.
  • a first token can be generated; when the payment information contains
  • multiple second tokens may be respectively generated corresponding to these payment cards.
  • the device may also include:
  • the ninth receiving module is used to receive the identity information of the IoT device and the updated payment information of the user sent by the mobile device;
  • a second authentication module configured to authenticate the identity information through preset rules
  • a ninth sending module configured to send the updated payment information to the second server for authentication after the identity information is authenticated
  • the tenth receiving module is configured to receive a third token sent by the second server, the third token is generated after the second server passes the authentication of the updated payment information;
  • a tenth sending module configured to send association information after the first token and the third token are associated with the identity information and the updated payment information to the IoT device and the mobile device.
  • FIG. 10 shows a schematic structural diagram of an authentication device provided by an embodiment of the present application. As shown in Figure 10, the device is applied to mobile devices, and the device includes:
  • the first obtaining module 1001 is used to obtain the identity information of the IoT device and the payment information of the user, and the IoT device has a built-in first token;
  • the fourth sending module 1002 is configured to send the identity information and payment information to the first server, so that the first server sends the payment information to the second server for authentication after passing the authentication of the identity information;
  • the fourth receiving module 1003 is configured to receive the first information sent by the first server, the first information includes association information between the first token and the second token, the identity information and the payment information , wherein the first token is determined by the first server according to the identity information, and the second token is generated after the second server passes the authentication of the payment information.
  • the identity information of the IoT device and the payment information of the user are acquired through the mobile device, and are sent together to the first server for authentication.
  • the first server authenticates the identity information of the IoT device, it can determine the first token of the IoT device based on the identity information, that is, the token of the IoT device does not need to be transmitted, and the IoT device can be pre-stored in the first server.
  • the corresponding relationship between the device identity information and the first token after verifying that the identity information of the IoT device is legal, it can be determined that the device corresponds to the first token; then the payment information is sent to the second server, and the second server authenticates the payment The legitimacy of the information, and after the authentication is passed, the second token is generated and returned to the first server, and the first server completes the binding of the corresponding IoT device, that is, associates the first token, the second token and the payment information, Sent to IoT devices for storage. In this way, before the payment is realized, the authentication is completed based on the device token of the Internet of Things device (ie, the first token, the same below) and the server, so as to ensure the security of the subsequent payment.
  • the device token of the Internet of Things device ie, the first token, the same below
  • the processor of the Internet of Things device such as MCU (Micro Controller Unit, Micro Control Unit) is connected to a security chip SE (Secure Element), and the security chip SE presets a security domain to establish its IoT device.
  • MCU Micro Controller Unit
  • Micro Control Unit Micro Control Unit
  • the security chip SE presets a security domain to establish its IoT device.
  • the security chip SE of the IoT device can be used as a transaction security shield of the device, and based on its own high security performance, the hardware capability of the IoT device can be improved. And the first token is encrypted and stored in the security chip SE.
  • the first token that is, the device Token of the IoT device
  • the first token has a unique correspondence with the IoT device, and each IoT device has a device Token, so the device Token of the IoT device is globally unique .
  • the device may also include:
  • the second acquiring module is configured to acquire the identification code of the IoT device, the identification code including the identity information and the page address of the IoT device;
  • the second parsing module is configured to parse the identity information according to the identification code, and jump to the first interface corresponding to the page address;
  • An eleventh receiving module configured to receive payment information input by the user through the first interface.
  • the identity information of the Internet of Things may include one or more of a device ID (Identity Document, identity code), a device manufacturer ID, and a device chip ID (in this example, the serial number of the chip corresponding to the above-mentioned MCU of the device) kind.
  • a device ID Identity Document, identity code
  • a device manufacturer ID e.g., the manufacturer ID
  • a device chip ID e.g., the serial number of the chip corresponding to the above-mentioned MCU of the device
  • the payment information input by the user may include one or more of payment card (such as bank card) card number, anti-counterfeiting code (such as security code CVN2, Card Validation Number 2) and verification code.
  • the payment information may include one or more payment cards.
  • the second token as a business token, has a one-to-one relationship with the payment card in the payment information.
  • a first token can be generated; when the payment information contains
  • multiple second tokens may be respectively generated corresponding to these payment cards.
  • the device may also include:
  • the third obtaining module is used to obtain the identity information of the Internet of Things device and the updated payment information of the user, and the first token is built in the Internet of Things device;
  • An eleventh sending module configured to send the identity information and updated payment information to the first server, so that the first server sends the updated payment information to the second server after passing the authentication of the identity information certification;
  • a twelfth receiving module configured to receive fourth information sent by the first server, the fourth information including the first token, the third token, the identity information and the updated payment information The associated information, wherein the first token is determined by the first server according to the identity information, and the third token is generated after the second server passes the authentication of the updated payment information.
  • FIG. 11 shows a schematic structural diagram of a payment device provided by an embodiment of the present application. As shown in Figure 11, the device is applied to the first server, and the device includes:
  • the fifth receiving module 1101 is configured to receive the transaction request sent by the IoT device, the transaction request is initiated based on the payment information saved by the IoT device, and the transaction request includes the transaction information corresponding to the transaction event, the first token and the identity of the IoT device information;
  • the first parsing module 1102 is configured to parse the transaction request to obtain the first token
  • a determining module 1103, configured to determine a corresponding second token according to the first token and pre-stored mapping information in the first server, where the pre-stored mapping information is the association information of the first token, the second token, and payment information;
  • the fifth sending module 1104 is configured to send the second token and the transaction information to the second server, so that after the second server passes the verification of the payment information corresponding to the second token, the third server will send the payment information based on the payment information. Perform the balance deduction operation corresponding to the transaction event and generate balance change information;
  • the sixth receiving module 1105 is configured to receive the balance change information sent by the second server, and forward it to the IoT device.
  • the first server in this embodiment of the present application may be an Internet of Things device management platform.
  • the transaction payment is initiated based on the authenticated identity information and payment information and the first token stored in the security chip. Compared with the traditional online transaction, the legality of the transaction information is guaranteed and the transaction security is improved. ; Compared with traditional IC card transactions, the method of the embodiment of the present application can realize the transaction process initiated based on the payment information of the payment card, but not relying on the physical card body of the payment card, and improve the convenience of payment.
  • FIG. 12 shows a schematic diagram of a hardware structure of an electronic device provided by an embodiment of the present application.
  • the electronic device may include a processor 1201 and a memory 1202 storing computer program instructions.
  • the processor 1201 may include a central processing unit (CPU), or an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or may be configured to implement one or more integrated circuits in the embodiments of the present application.
  • CPU central processing unit
  • ASIC Application Specific Integrated Circuit
  • Memory 1202 may include mass storage for data or instructions.
  • memory 1202 may include a hard disk drive (Hard Disk Drive, HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (Universal Serial Bus, USB) drive or two or more Combinations of multiple of the above.
  • Storage 1202 may include removable or non-removable (or fixed) media, where appropriate. Under appropriate circumstances, the storage 1202 can be inside or outside the comprehensive gateway disaster recovery device.
  • memory 1202 is a non-volatile solid-state memory.
  • Memory may include read only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical/tangible memory storage devices.
  • ROM read only memory
  • RAM random access memory
  • magnetic disk storage media devices magnetic disk storage media devices
  • optical storage media devices flash memory devices
  • electrical, optical, or other physical/tangible memory storage devices include one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software comprising computer-executable instructions, and when the software is executed (e.g., by one or multiple processors), it is operable to perform the operations described with reference to the authentication method or the payment method according to any of the above-mentioned embodiments of the present application.
  • the processor 1201 reads and executes the computer program instructions stored in the memory 1202 to implement the authentication method or payment method in any of the above embodiments.
  • the electronic device may further include a communication interface 1203 and a bus 1210 .
  • a communication interface 1203 and a bus 1210 .
  • a processor 1201 a memory 1202 , and a communication interface 1203 are connected through a bus 1210 to complete mutual communication.
  • the communication interface 1203 is mainly used to realize the communication between various modules, devices, units and/or devices in the embodiments of the present application.
  • Bus 1210 includes hardware, software, or both, and couples the components of the electronic device to each other.
  • the bus may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), HyperTransport (HT) interconnect, Industry Standard Architecture (ISA) Bus, Infiniband Interconnect, Low Pin Count (LPC) Bus, Memory Bus, Micro Channel Architecture (MCA) Bus, Peripheral Component Interconnect (PCI) Bus, PCI-Express (PCI-X) Bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association Local (VLB) bus or other suitable bus or a combination of two or more of these.
  • Bus 1210 may comprise one or more buses, where appropriate. Although the embodiments of this application describe and illustrate a particular bus, this application contemplates any suitable bus or interconnect.
  • the embodiments of the present application may provide a computer storage medium for implementation.
  • Computer program instructions are stored on the computer storage medium; when the computer program instructions are executed by a processor, the authentication method or payment method in any of the above embodiments is implemented.
  • the embodiments of the present application may provide a computer program product for implementation.
  • the instructions in the computer program product are executed by the processor of the electronic device, the electronic device is made to execute the authentication method or the payment method of any of the above embodiments.
  • Examples of computer readable storage media include non-transitory computer readable storage media such as portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory) ), portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, etc.
  • the functional modules shown in the above structural block diagrams may be implemented as hardware, software, firmware or a combination thereof.
  • it When implemented in hardware, it may be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, a plug-in, a function card, or the like.
  • ASIC application specific integrated circuit
  • the elements of the present application are the programs or code segments employed to perform the required tasks.
  • Programs or code segments can be stored in machine-readable media, or transmitted over transmission media or communication links by data signals carried in carrier waves.
  • "Machine-readable medium” may include any medium that can store or transmit information.
  • machine-readable media examples include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and the like.
  • Code segments may be downloaded via a computer network such as the Internet, an Intranet, or the like.
  • processors may be, but are not limited to, general purpose processors, special purpose processors, application specific processors, or field programmable logic circuits. It can also be understood that each block in the block diagrams and/or flowcharts and combinations of blocks in the block diagrams and/or flowcharts can also be realized by dedicated hardware for performing specified functions or actions, or can be implemented by dedicated hardware and Combination of computer instructions to achieve.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Strategic Management (AREA)
  • Finance (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本申请实施例公开了一种认证方法、支付方法、装置及设备，其中在认证方法中，通过移动设备获取物联网设备的身份信息和用户的支付信息，物联网设备内置有第一令牌；将身份信息和支付信息发送至第一服务器，以使第一服务器对身份信息认证通过后，将支付信息发送至第二服务器认证；当第二服务器对所述支付信息认证通过后生成第二令牌发送至第一服务器，基于第一令牌、第二令牌以及所述支付信息之间的关联信息生成第一信息和第二信息分别发送给移动设备和物联网设备，完成认证。第一令牌作为物联网设备的设备令牌，第二令牌作为对应支付信息的业务令牌，在支付过程中，可以基于令牌与支付信息之间的绑定关系，提高交易安全性。

Description

认证方法、支付方法、装置及设备
相关申请的交叉引用
本申请要求享有于2022年1月26日提交的名称为“认证方法、支付方法、装置及设备”的中国专利申请202210096244.9的优先权，该申请的全部内容通过引用并入本文中。
技术领域
本申请属于支付安全技术领域，尤其涉及一种认证方法、支付方法、装置及设备。
背景技术
随着物联网技术的快速发展，市场中的物联网设备种类更多样化、厂商繁多且管理复杂，使得物联网设备参与到支付场景中涉及的风险更高。
目前的物联网设备在支付场景中，仅支持线上交易，交易安全性低。
发明内容
本申请实施例提供一种认证方法、支付方法、装置及设备，能够提升物联网设备在支付场景中的交易安全性。
第一方面，本申请实施例提供一种认证方法，应用于物联网设备，物联网设备内置有第一令牌，方法包括：
向移动设备发送物联网设备的身份信息，以使所述移动设备将所述身份信息和用户的支付信息发送至第一服务器认证；
接收第一服务器发送的第一信息，第一信息包括第一令牌和所述第二令牌与所述身份信息以及支付信息之间的关联信息，其中，第一令牌为第一服务器对身份信息认证通过后确定的，第二令牌为第二服务器对支付信息认证通过后生成的；
在安全芯片中保存第一信息。
在一些实施例中，物联网设备中设有安全芯片，
在向移动设备发送物联网设备的身份信息之前，方法还包括；
通过安全芯片生成一对密钥，密钥包括第一公钥和第一私钥；
向第一服务器发送第一公钥；
向移动设备发送物联网设备的身份信息，包括：
通过第一私钥对身份信息加密后发送至移动设备，以使移动设备将身份信息发送至第一服务器后，通过第一公钥对身份信息认证。
在一些实施例中，安全芯片中加密存储第一令牌。
在一些实施例中，支付信息对应一个或多个支付卡，第二令牌为一个或多个，第二令牌与支付卡一一对应。
第二方面，本申请实施例提供一种认证方法，应用于第一服务器，方法包括：
接收移动设备发送的物联网设备的身份信息和用户的支付信息；
通过预设规则认证身份信息；
在身份信息认证通过后，向第二服务器发送支付信息以进行认证；
接收第二服务器发送的第二令牌，第二令牌为第二服务器对支付信息认证通过后生成的；
将第一令牌和第二令牌与身份信息以及支付信息关联后的关联信息，发送至物联网设备和移动设备。
在一些实施例中，身份信息为通过第一私钥加密的信息，第一私钥为物联网设备的安全芯片生成；
通过预设规则认证身份信息，包括：
通过第一公钥认证身份信息，第一公钥为安全芯片生成且与第一私钥对应。
在一些实施例中，在接收移动设备发送的物联网设备的身份信息和用户的支付信息之前，方法还包括：
接收物联网设备发送的第一公钥；
保存第一公钥。
在一些实施例中，支付信息对应一个或多个支付卡，第二令牌为一个或多个，第二令牌与支付卡一一对应。
第三方面，本申请实施例提供一种认证方法，应用于移动设备，方法包括：
获取物联网设备的身份信息和用户的支付信息，物联网设备内置有第一令牌；
将身份信息和支付信息发送至第一服务器，以使第一服务器对身份信息认证通过后，将支付信息发送至第二服务器认证；
接收第一服务器发送的第二信息，第二信息包括第一令牌、第二令牌与身份信息以及支付信息之间的关联信息，其中，第一令牌为第一服务器根据身份信息确定，第二令牌为第二服务器对支付信息认证通过后生成。
在一些实施例中，获取物联网设备的身份信息和用户的支付信息，包括：
获取物联网设备的标识码，标识码中包括物联网设备的身份信息和页面地址；
根据标识码，解析得到身份信息，并跳转到页面地址对应的第一界面；
接收用户从第一界面输入的支付信息。
在一些实施例中，物联网设备中设有安全芯片，安全芯片中加密存储第一令牌。
在一些实施例中，支付信息对应一个或多个支付卡，第二令牌为一个或多个，第二令牌与支付卡一一对应。
第四方面，本申请实施例提供一种支付方法，应用于第一服务器，方法包括：
接收物联网设备发送的交易请求，所述交易请求中包括对应交易事件的交易信息、物联网设备的第一令牌和身份信息，所述交易信息中包括支付信息；
从交易请求中解析得到第一令牌；
根据第一令牌以及第一服务器中的预存映射信息，确定对应的第二令 牌，预存映射信息为第一令牌、第二令牌与身份信息以及支付信息的关联信息；
向第二服务器发送所述第二令牌和所述交易信息，以使第二服务器对第二令牌对应的支付信息验证通过后，由第三服务器基于支付信息进行对应交易事件的余额扣除操作并产生余额变动信息；
接收第二服务器发送的余额变动信息，以转发至物联网设备。
在一些实施例中，交易请求为通过物联网设备上的第一私钥加密的信息，第一私钥为物联网设备的安全芯片生成；
从交易请求中解析得到第一令牌，包括：
通过第一公钥解密交易请求，以从交易请求中解析得到第一令牌，第一公钥由安全芯片生成且与第一私钥对应。
第五方面，本申请实施例提供一种认证装置，应用于移动设备，装置包括：
第一获取模块，用于获取物联网设备的身份信息和用户的支付信息，物联网设备内置有第一令牌；
第一发送模块，用于将身份信息和支付信息发送至第一服务器，以使第一服务器对身份信息认证通过后，将支付信息发送至第二服务器认证；
第一接收模块，用于接收第一服务器发送的第一信息，第一信息包括第一令牌、第二令牌与身份信息以及支付信息之间的关联信息，其中，第一令牌为第一服务器根据身份信息确定，第二令牌为第二服务器对支付信息认证通过后生成。
第六方面，本申请实施例提供一种认证装置，应用于物联网设备，物联网设备内置有第一令牌，其特征在于，装置包括：
第二发送模块，用于向移动设备发送物联网设备的身份信息，以使所述移动设备将所述身份信息和用户的支付信息发送至第一服务器认证；
第二接收模块，用于收第一服务器发送的第二信息，第二信息包括第一令牌、第二令牌与身份信息以及支付信息之间的关联信息，其中，第一令牌为第一服务器对身份信息认证通过后确定的，第二令牌为第二服务器对支付信息认证通过后生成的；
保存模块，用于在安全芯片中保存第二信息。
第七方面，本申请实施例提供一种认证装置，应用于第一服务器，其特征在于，装置包括：
第三接收模块，用于接收移动设备发送的物联网设备的身份信息和用户的支付信息；
第一认证模块，用于通过预设规则认证身份信息；
第三发送模块，用于在身份信息认证通过后，向第二服务器发送支付信息以进行认证；
第四接收模块，用于接收第二服务器发送的第二令牌，第二令牌为第二服务器对支付信息认证通过后生成的；
第四发送模块，用于将第一令牌和第二令牌与身份信息以及支付信息关联后的关联信息，发送至物联网设备和移动设备。
第八方面，本申请实施例提供一种支付装置，应用于第一服务器，装置包括：
第五接收模块，用于接收物联网设备发送的交易请求，所述交易请求中包括对应交易事件的交易信息、物联网设备的第一令牌和身份信息，所述交易信息中包括支付信息；
第一解析模块，用于从交易请求中解析得到第一令牌；
确定模块，用于根据第一令牌以及第一服务器中的预存映射信息，确定对应的第二令牌，预存映射信息为第一令牌、第二令牌与身份信息以及支付信息的关联信息；
第五发送模块，用于向第二服务器发送所述第二令牌和所述交易信息，以使第二服务器对第二令牌对应的支付信息验证通过后，由第三服务器基于支付信息进行对应交易事件的余额扣除操作并产生余额变动信息；
第六接收模块，用于接收所述第二服务器发送的所述余额变动信息，以转发至所述物联网设备。
第九方面，本申请实施例提供一种电子设备，所述设备包括：处理器以及存储有计算机程序指令的存储器；
所述处理器执行所述计算机程序指令时实现如上述第一方面、第二方 面、第三方面、或者第四方面任意实施例所述的方法。
第十方面，本申请实施例提供一种计算机存储介质，所述计算机存储介质上存储有计算机程序指令，所述计算机程序指令被处理器执行时实现上述第一方面、第二方面、第三方面、或者第四方面任意实施例所述的方法。
第十一方面，本申请实施例提供一种计算机程序产品，所述计算机程序产品中的指令由电子设备的处理器执行时，使得所述电子设备执行上述第一方面、第二方面、第三方面、或者第四方面任意实施例所述的方法。
本申请实施例提供了一种认证方法、支付方法、装置及设备，其中在认证方法中，通过移动设备获取物联网设备的身份信息和用户的支付信息，物联网设备内置有第一令牌；将身份信息和支付信息发送至第一服务器，以使第一服务器对身份信息认证通过后，将支付信息发送至第二服务器认证；当第二服务器对所述支付信息认证通过后生成第二令牌发送至第一服务器，基于第一令牌、第二令牌以及所述支付信息之间的关联信息生成第一信息和第二信息分别发送给移动设备和物联网设备，完成认证。第一令牌作为物联网设备的设备令牌，第二令牌作为对应支付信息的业务令牌，在支付过程中，可以基于令牌与支付信息之间的绑定关系，提高交易安全性。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对本申请实施例中所需要使用的附图作简单的介绍，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请一个实施例提供的认证方法的流程示意图；
图2是本申请一个具体示例中的认证方法的流程示意图；
图3是本申请另一个实施例提供的认证方法的流程示意图；
图4是本申请再一个实施例提供的认证方法的流程示意图；
图5是本申请又一个实施例提供的认证方法的流程示意图；
图6是本申请一个实施例提供的支付方法的流程示意图；
图7是本申请一个具体示例中的支付方法的流程示意图；
图8是本申请一个实施例提供的认证装置的结构示意图；
图9是本申请另一个实施例提供的认证装置的结构示意图；
图10是本申请再一个实施例提供的认证装置的结构示意图；
图11是本申请一个实施例提供的支付装置的结构示意图；
图12是本申请又一个实施例提供的电子设备的结构示意图。
具体实施方式
下面将详细描述本申请的各个方面的特征和示例性实施例，为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及具体实施例，对本申请进行进一步详细描述。应理解，此处所描述的具体实施例仅意在解释本申请，而不是限定本申请。对于本领域技术人员来说，本申请可以在不需要这些具体细节中的一些细节的情况下实施。下面对实施例的描述仅仅是为了通过示出本申请的示例来提供对本申请更好的理解。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
目前的物联网设备在支付场景中，通常采用的支付方法为：物联网设备将包含设备标识和支付金额的支付请求发送给服务器，服务器根据设备标识查询所关联的支付账户，从该支付账户中进行扣款。
这种支付方法存在的弊端是，支付安全性低，并且只能由后台服务器确定关联的支付账户进行扣款，物联网设备不具备独立的支付能力。
另外，目前物联网设备在支付场景中仅支持线上交易，没有线下POS (Point of sales，销售终端)设备的参与，不能支持线下交易。因为就目前的支付技术来说，物联网设备如果进行线下交易，大多需要依赖于IC卡(Integrated Circuit Card，集成电路卡)，需要借助POS设备基于IC卡发起交易，使得前端操作便利性降低，操作流程复杂度较高。
为了解决现有技术问题，本申请实施例提供了一种认证方法、支付方法、装置及设备。通过在物联网设备中设置的安全芯片和设备令牌，实现安全支付。下面首先对本申请实施例所提供的认证方法进行介绍。
图1示出了本申请一个实施例提供的认证方法的流程示意图。如图1所示，该认证方法应用于物联网设备，该物联网设备中内置有第一令牌，该方法包括步骤S101～S103：
S101.向移动设备提供所述物联网设备的身份信息，以使所述移动设备将所述身份信息和用户的支付信息发送至第一服务器认证；
S102.接收第一服务器发送的第一信息，所述第一信息包括所述第一令牌、第二令牌以及所述支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器对所述身份信息认证通过后确定的，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成的；
S103.保存所述第一信息。
在本申请实施例的认证方法中，通过移动设备获取物联网设备的身份信息和用户的支付信息，一起发送给第一服务器进行认证。第一服务器对物联网设备的身份信息认证通过后，可以基于该身份信息确定物联网设备的第一令牌，即物联网设备的令牌不需要传输，在第一服务器中可以预先存储物联网设备身份信息与第一令牌的对应关系，在认证物联网设备的身份信息合法后，可以确定该设备对应得到第一令牌；然后将支付信息发送到第二服务器，由第二服务器认证支付信息的合法性，并在认证通过后生成第二令牌返回第一服务器，由第一服务器完成对应物联网设备的绑定，即，将第一令牌、第二令牌和支付信息关联，发送给物联网设备保存。这样在实现支付前，先基于物联网设备的设备令牌(即第一令牌，下同)与服务器之间完成认证，保障后续支付的安全性。
在一些具体实施例中，为了加强支付安全性，可以通过增加物联网设 备的硬件能力来实现。可选的，在本申请实施例中，物联网设备的处理器，如MCU(Micro Controller Unit，微控制单元)，连接安全芯片SE(Secure Element)，安全芯片SE预置安全域，以建立其物联网设备的安全基础。
可以理解的是，安全域可以通过物联网设备所属的服务器验证合法性和安全性，安全域的验证可以采用本领域成熟技术，此处不再赘述。
示例性的，在物联网设备的安全芯片SE可以作为该设备的交易安全盾，基于其自身具有的高安全性能，提升物联网设备的硬件能力。并且安全芯片SE中加密存储有第一令牌，该第一令牌作为物联网设备的设备Token，可以与安全芯片一起在出厂阶段或投入使用前预置到物联网设备中。如可以由支付卡厂商注入，或由物联网设备厂商注入。
所述第一令牌，也即物联网设备的设备Token，与物联网设备之间具有唯一的对应关系，每个物联网设备具有一个设备Token，故而物联网设备的设备Token在全局具有唯一性。
可选的，在安全芯片SE的安全域通过验证后，在步骤S101之前，本申请实施例的认证方法还可以包括S104～S105：
S104.通过所述安全芯片生成一对密钥，所述密钥包括第一公钥和第一私钥；
S105.向所述第一服务器发送所述第一公钥。
示例性的，安全芯片SE生成一对非对称密钥，该密钥包括第一公钥和第一私钥，其中第一私钥保存在该安全芯片中，第一公钥发送给第一服务器保存。
这样在步骤S101中向移动设备提供所述物联网设备的身份信息，具体可以包括：
通过所述第一私钥对所述身份信息加密后发送至所述移动设备，以使所述移动设备将所述身份信息发送至所述第一服务器后，通过第一公钥对所述身份信息认证。
在步骤S101中，物联网身份信息可以包括设备ID(Identity Document，身份标识码)、设备厂商ID、以及设备芯片ID(即设备上述 MCU对应的芯片序列号)中的一种或多种。在一些示例中，向移动设备提供所述物联网设备的身份信息时，可以通过展示物联网设备身份信息的标识码供移动设备获取，或者物联网设备提供MCU访问接口，供移动设备获取物联网设备的身份信息。
参考图2所示，当通过标识码提供身份信息时，标识码中可以包括获取请求信息，通过步骤S201～S202，使得移动设备扫描标识码向物联网设备发起请求，进而物联网设备基于该请求返回身份信息至移动设备，移动设备接收到该身份信息后通过第一界面获取用户输入的支付信息。
标识码中可以包括物联网设备的设备ID和设备厂商ID等身份信息和页面地址链接。移动设备通过扫描标识码，获取物联网设备的身份信息，同时跳转到该页面地址对应的第一界面，以接收用户从第一界面输入的支付信息。
或者物联网设备提供MCU访问接口，移动设备用过该访问接口获取物联网设备的身份信息，然后通过第一界面获取用户输入的支付信息。
示例性的，所述标识码可以为二维码，也可以为其他形式的图形码；标识码可以为静态码，或者也可以为动态码；标识码可以通过物联网设备的显示屏展示，也可以通过其他形式展示；本申请实施例不做唯一限定。
示例性的，所述移动设备获取的所述身份信息是通过物联网设备在安全芯片SE中存储的第一私钥加密后的信息，可以避免在认证过程中进行信息传输时发生信息泄露而导致被恶意解析攻击的风险。
示例性的，用户输入的支付信息可以包括支付卡(如银行卡)的***、防伪码(如安全码CVN2，Card Validation Number 2)和验证码等信息中的一种或多种。一个具体示例中，支付信息中可以包括一个或多个支付卡。
本申请实施例中，通过图2中所示的步骤S203，移动设备将物联网设备的身份信息和用户的支付信息发送到第一服务器中，通过第一服务器对该身份信息的合法性进行认证，在物联网设备的身份信息认证通过后，再通过第二服务器对用户的支付进行认证。
示例性的，第一服务器可以为物联网设备管理平台。第一服务器中预 先在数据库中存储物联网设备与其所对应的第一公钥以及设备Token之间的映射关系。参考图2，当第一服务器接收到移动终端发送的物联网设备身份信息后，在步骤S204中，通过第一公钥对该身份信息进行解密认证，解密成功，则物联网设备身份合法，认证通过；否则不合法，物联网身份认证失败。
在步骤S204中，第一服务器对物联网设备身份信息认证通过后，基于解析的身份信息确定该物联网设备对应的第一令牌。同时，通过步骤S205，第一服务器还将用户的支付信息发送至第二服务器。示例性的，该第二服务器可以为支付卡所属运营方的交易平台(如银联卡对应的银联交易平台)。第二服务器对支付信息中的***、防伪码、验证码进行验证，确认支付信息的合法性。
可以理解的是，支付卡运营方对应的服务器对支付卡的合法性认证为本领域成熟技术，此处不再赘述。
参考图2，通过步骤S206，第二服务器认证用户的支付信息合法后，生成对应支付信息的第二令牌。示例性的，第二令牌作为业务Token，与支付信息中的支付卡具有一一对应的关系，当支付信息中包含一个支付卡的信息时，可以生成一个第一令牌；当支付信息中包含多个支付卡的信息时，可以对应这些支付卡分别生成多个第二令牌。
通过步骤S207，第二服务器生成的第二令牌返回至第一服务器，并通过步骤S208，由第一服务器将上述确定的物联网设备对应的第一令牌、第二服务器返回的第二令牌与对应的身份信息和支付信息进行绑定，生成对应的关联信息，存储在第一服务器中。在该关联信息中，一个第一令牌可以对应一个或多个第二令牌，也即本申请实施例中，允许一个物联网设备绑定多个支付卡进行后续的交易，满足用户的多卡支付需求。一个示例中，为提升后续支付的便利性，可以在上述关联信息的绑定过程中，将其中一个支付卡设置为默认支付卡，并可以在所述关联信息中标记对应默认支付标识。
第一服务器生成的所述关联信息后，物联网设备通过步骤S102接收第一服务器发送的该关联信息(也即第一信息)，并通过步骤S103将第 一信息安全保存在物联网设备中。并且该关联信息还可以发送给移动设备，显示给用户了解。
本申请实施例中，第一信息安全保存在物联网设备中，可以在后续支付场景中，通过在安全芯片SE中保存的第一信息中的支付信息发起交易支付，物联网设备具有了可用于安全支付的硬件能力，扩展了物联网设备的交易属性，提高了设备安全支付能力。这样，通过身份信息和支付信息认证后的物联网设备在后续支付过程中，可以具有单独的支付能力，一方面，相对于传统的线上交易，本申请实施例中的物联网设备可以基于安全芯片建立的硬件基础，根据所安全保存的通过平台认证过的支付信息和第一令牌发起交易支付，保障交易安全性，避免信息在交易信息在传输过程中被恶意破解攻击的风险。另一方面，通过本申请实施例的认证方法认证后的第一信息保存在物联网设备中，用于后续发起交易支付的场景中，相对于传统的依赖IC卡完成的线下交易，本申请实施例中的物联网设备基于支付卡的支付信息发起交易时，可以脱离前端对IC卡物理卡体的依赖，利于提升交易便利性。
可选的，为满足用户的多种需求，本申请实施例中还可以允许用户对物联网设备中保存的支付信息进行更新。具体的，本申请实施例中，如果用户需要对物联网设备添加新的支付卡进行请求认证绑定，或想要删除已绑定的支付卡，则如图3所示，认证方法还可以包括步骤S301～S303，具体步骤如下所示。
S301.向移动设备提供所述物联网设备的身份信息和支付信息，以使所述移动设备根据所述支付信息生成更新支付信息，并将所述更新支付信息和身份信息发送至第一服务器认证。
移动终端可以通过扫描标识码或接入物联网设备的MCU访问接口，获取物联网设备的身份信息，并跳转到第二界面显示物联网设备上保存的已有支付卡的支付信息。
用户可以在移动设备上第二界面显示的支付信息的基础上，通过输入新增支付卡或删除支付卡等操作生成对应的更新支付信息。如第二界面上显示原设置的支付卡1的支付信息，用户在第二界面输入支付卡2和支付 卡3的支付信息，并对支付卡2的支付信息标记默认支付卡的标记，删除支付卡1的支付信息，生成对应支付卡2和支付卡3的更新支付信息。移动设备将所述身份信息和更新支付信息发送到第一服务器进行认证。
S302.接收第一服务器发送的第三信息，所述第三信息包括所述第一令牌、第三令牌、所述身份信息以及所述更新支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器对所述身份信息认证通过后确定的，所述第三令牌为所述第二服务器对所述更新支付信息认证通过后生成的。
S303.保存所述第三信息。
本实施例中，第一服务器对物联网设备身份信息的认证过程与上述实施例中的身份信息认证过程相同，第二服务器对更新支付信息的认证过程与上述实施例中支付信息的认证过程相同，第二服务器对更新支付信息认证通过后生成新的技术Token，也即第三令牌，返回到第二服务器，由第二服务器将第一令牌、第三令牌、所述身份信息以及所述更新支付信息绑定，生成新的关联信息(也即第三信息)，发送到物联网设备保存，并发送给移动设备显示给用户。
图4示出了本申请实施例提供的一种认证方法的流程示意图。如图4所示，该认证方法应用于第一服务器，方法包括步骤S401～S405：
S401.接收移动设备发送的物联网设备的身份信息和用户的支付信息；
S402.通过预设规则认证所述身份信息；
S403.在所述身份信息认证通过后，向第二服务器发送所述支付信息以进行认证；
S404.接收第二服务器发送的第二令牌，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成的；
S405.将第一令牌和所述第二令牌与所述身份信息以及所述支付信息关联后的关联信息，发送至所述物联网设备和所述移动设备。
在本申请实施例中，第一服务器可以为物联网设备管理平台，第一服务器可以对若干物联网设备进行统一管理。本申请实施例的认证方法中，通过移动设备获取物联网设备的身份信息和用户的支付信息，一起发送给 第一服务器进行认证。第一服务器对物联网设备的身份信息认证通过后，可以基于该身份信息确定物联网设备的第一令牌，即物联网设备的令牌不需要传输，在第一服务器中可以预先存储物联网设备身份信息与第一令牌的对应关系，在认证物联网设备的身份信息合法后，可以确定该设备对应得到第一令牌；然后将支付信息发送到第二服务器，由第二服务器认证支付信息的合法性，并在认证通过后生成第二令牌返回第一服务器，由第一服务器完成对应物联网设备的绑定，即，将第一令牌、第二令牌和支付信息关联，发送给物联网设备保存。这样在实现支付前，先基于物联网设备的设备令牌(即第一令牌，下同)与服务器之间完成认证，保障后续支付的安全性。
可选的，为了加强支付安全性，物联网设备的处理器，如MCU(Micro Controller Unit，微控制单元)，连接安全芯片SE(Secure Element)，安全芯片SE预置安全域，以建立其物联网设备的安全基础。
示例性的，在物联网设备的安全芯片SE可以作为该设备的交易安全盾，基于其自身具有的高安全性能，提升物联网设备的硬件能力。并且安全芯片SE中加密存储有第一令牌。该第一令牌与物联网设备之间具有唯一的对应关系，每个物联网设备具有一个设备Token，也即物联网设备的设备Token在全局具有唯一性。
物联网设备的安全芯片除了安全保存第一令牌外，还用于生成一对非对称密钥。该密钥包括第一公钥和第一私钥，该第一私钥保存在安全芯片中，第一公钥发送到第一服务器中保存。因此在上述步骤S401之前，方法还可以包括：
接收物联网设备发送的所述第一公钥；
保存所述第一公钥。
第一服务器中可以预先将物联网设备的身份信息与其第一令牌之间的映射关联保存在数据库中，并在收到第一公钥后，将该第一公钥与对应的物联网设备身份信息关联保存。
第一服务器保存第一公钥之后，通过步骤S401接收移动设备发送的物联网设备的身份信息和用户的支付信息，其中，物联网设备的身份信息 可以包括设备ID(Identity Document，身份标识码)、设备厂商ID、以及设备芯片ID。用户的支付信息可以包括支付卡(如银行卡)的***、防伪码(如安全码CVN2，Card Validation Number 2)和验证码等信息中的一种或多种。一个具体示例中，支付信息中可以包括一个或多个支付卡。
示例性的，为了提高认证信息的安全性，所述身份信息可以为通过物联网设备的安全芯片中存储的第一私钥加密的信息，则在接收到物联网设备的身份信息和用户的支付信息后，第一服务器可以通过步骤S402通过预设规则认证所述身份信息。具体的，步骤S402可以包括：
通过第一公钥认证所述身份信息，其中，所述第一公钥为所述安全芯片生成且与所述第一私钥对应。
第一私钥加密的身份信息为一段密文，如果该密文可以被第一私钥对应的第一公钥解密，则物联网设备身份合法，认证通过；解密失败则物联网设备身份不合法，物联网身份认证失败。
认证物联网设备身份合法，解密出身份信息的明文，第一服务器可以基于该明文从数据库中匹配出对应第一令牌。并且通过步骤S403向第二服务器发送所述支付信息以进行认证，一个示例中，第二服务器可以为支付卡所属运营方的交易平台(如银联卡对应的银联交易平台)。第二服务器对支付信息中的***、防伪码、验证码进行验证，确认支付信息的合法性。
第二服务器认证用户的支付信息合法后，生成对应支付信息的第二令牌。示例性的，第二令牌作为业务Token，与支付信息中的支付卡具有一一对应的关系，当支付信息中包含一个支付卡的信息时，可以生成一个第一令牌；当支付信息中包含多个支付卡的信息时，可以对应这些支付卡分别生成多个第二令牌。
第二服务器生成第二令牌后，第一服务器通过步骤S404接收第二服务器发送的第二令牌，并将第一令牌和所述第二令牌与解密出来的身份信息以及所述支付信息关联绑定，生成对应的关联信息，该关联信息保存在第一服务器的数据库中，并通过步骤S405将该关联信息分别发送至所述物联网设备和所述移动设备，物联网设备保存该关联信息以使后续基于该 关联信息发起交易支付，移动设备可以将该关联信息显示给用户查看。
本申请实施例中，通过第一服务器对物联网设备的身份信息认证后，再通过第二服务器认证支付信息，保障了信息安全性。第一服务器对物联网设备的身份信息和支付信息与物联网设备的唯一设备Token关联绑定，反馈给物联网设备存储，这样可以在后续支付场景中，通过在物联网设备的安全芯片SE中保存的支付信息发起交易支付，使得物联网设备具有单独的支付能力。一方面，相对于传统的线上交易，本申请实施例中的物联网设备可以基于安全芯片建立的硬件基础，根据所安全保存的通过平台认证过的支付信息和第一令牌发起交易支付，保障交易安全性，避免信息在交易信息在传输过程中被恶意破解攻击的风险。另一方面，通过本申请实施例的认证方法认证后的关联信息保存在物联网设备中，用于后续发起交易支付的场景中，相对于传统的依赖IC卡完成的线下交易，本申请实施例中的物联网设备基于支付卡的支付信息发起交易时，可以脱离前端对IC卡物理卡体的依赖，利于提升交易便利性。
可选的，为满足用户的多种需求，本申请实施例中还可以允许用户对物联网设备中保存的支付信息进行更新。具体的，本申请实施例中，如果用户需要对物联网设备添加新的支付卡进行请求认证绑定，或想要删除已绑定的支付卡，则认证方法还可以包括步骤S406～S410，具体步骤如下所示。
S406.接收移动设备发送的物联网设备的身份信息和用户的更新支付信息。
移动终端可以通过扫描标识码或接入物联网设备的MCU访问接口，获取物联网设备的身份信息，并跳转到第二界面显示物联网设备上保存的已有支付卡的支付信息。
用户可以在移动设备上第二界面显示的支付信息的基础上，通过输入新增支付卡或删除支付卡等操作生成对应的更新支付信息，并将所述身份信息和更新支付信息发送到第一服务器进行认证。
S407.通过预设规则认证所述身份信息。
S408.在所述身份信息认证通过后，向第二服务器发送所述更新支付信 息以进行认证。
S409.接收第二服务器发送的第三令牌，所述第三令牌为所述第二服务器对所述更新支付信息认证通过后生成的。
S410.将第一令牌和所述第三令牌与所述身份信息以及所述更新支付信息关联后的关联信息，发送至所述物联网设备和所述移动设备。
本实施例中，第一服务器对物联网设备身份信息的认证过程与上述实施例中步骤S402的身份信息认证过程相同，第二服务器对更新支付信息的认证过程与上述实施例中支付信息的认证过程相同，第二服务器对更新支付信息认证通过后生成新的技术Token，也即第三令牌，返回到第二服务器，由第二服务器将第一令牌、第三令牌、所述身份信息以及所述更新支付信息绑定，生成新的关联信息(也即第三信息)，发送到物联网设备保存，并发送给移动设备显示给用户。
图5示出了本申请实施例提供的一种认证方法的流程示意图。如图5所示，该方法应用于移动设备，方法包括步骤S501～S503：
S501.获取物联网设备的身份信息和用户的支付信息，所述物联网设备内置有第一令牌；
S502.将所述身份信息和支付信息发送至第一服务器，以使所述第一服务器对所述身份信息认证通过后，将所述支付信息发送至第二服务器认证；
S503.接收所述第一服务器发送的第二信息，所述第二信息包括第一令牌和所述第二令牌与所述身份信息以及所述支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器根据所述身份信息确定，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成。
在本申请实施例的认证方法中，通过移动设备获取物联网设备的身份信息和用户的支付信息，一起发送给第一服务器进行认证。第一服务器对物联网设备的身份信息认证通过后，可以基于该身份信息确定物联网设备的第一令牌，即物联网设备的令牌不需要传输，在第一服务器中可以预先存储物联网设备身份信息与第一令牌的对应关系，在认证物联网设备的身份信息合法后，可以确定该设备对应得到第一令牌；然后将支付信息发送 到第二服务器，由第二服务器认证支付信息的合法性，并在认证通过后生成第二令牌返回第一服务器，由第一服务器完成对应物联网设备的绑定，即，将第一令牌、第二令牌和支付信息关联，发送给物联网设备保存。这样在实现支付前，先基于物联网设备的设备令牌(即第一令牌，下同)与服务器之间完成认证，保障后续支付的安全性。
示例性的，为了加强支付安全性，物联网设备的处理器，如MCU(Micro Controller Unit，微控制单元)，连接安全芯片SE(Secure Element)，安全芯片SE预置安全域，以建立其物联网设备的安全基础。
示例性的，在物联网设备的安全芯片SE可以作为该设备的交易安全盾，基于其自身具有的高安全性能，提升物联网设备的硬件能力。并且安全芯片SE中加密存储有第一令牌。该第一令牌与物联网设备之间具有唯一的对应关系，每个物联网设备具有一个设备Token，也即物联网设备的设备Token在全局具有唯一性。
安全芯片中除了安全保存的第一令牌外，还用于生成密钥，该密钥为非对称密钥，该密钥包括第一公钥和第一私钥，该第一私钥保存在安全芯片中，第一公钥发送到第一服务器中保存。因此在步骤S501中，获取物联网设备的身份信息和用户的支付信息中，该身份信息可以为通过物联网设备安全芯片中的第一私钥加密的信息，可以避免在认证过程中进行信息传输时发生信息泄露而导致被恶意解析攻击的风险。
示例性的，用户输入的支付信息可以包括支付卡(如银行卡)的***、防伪码(如安全码CVN2，Card Validation Number 2)和验证码等信息中的一种或多种。一个具体示例中，支付信息中可以包括一个或多个支付卡。
在一些示例中，移动设备获取所述物联网设备的身份信息时，可以通过物联网设备身份信息的标识码解析获取，或者通过物联网设备提供MCU访问接口获取。
可选的，如果通过物联网设备身份信息的标识码解析获取物联网设备的身份信息，则该标识码中可以包括获取请求信息，使得移动设备扫描标识码向物联网设备发起请求，进而物联网设备基于该请求返回身份信息至 移动设备，移动设备接收到该身份信息后通过第一界面获取用户输入的支付信息。
或者，可选的，标识码中可以包括物联网设备的设备ID和设备厂商ID等身份信息和页面地址链接，则步骤S501具体可以包括步骤S5011～S5013：
S5011.获取所述物联网设备的标识码，所述标识码中包括物联网设备的身份信息和页面地址；
S5012.根据所述标识码，解析得到所述身份信息，并跳转到所述页面地址对应的第一界面；
S5013.接收用户从所述第一界面输入的支付信息。
移动设备通过扫描标识码，获取物联网设备的身份信息，同时跳转到该页面地址对应的第一界面，以接收用户从第一界面输入的支付信息。本实施例可以通过扫码输入的方式，提高支付信息录入的便捷性。
示例性的，所述标识码可以为二维码，也可以为其他形式的图形码；标识码可以为静态码，或者也可以为动态码；标识码可以通过物联网设备的显示屏展示，也可以通过其他形式展示；本申请实施例不做唯一限定。
移动设备获取身份信息和支付信息后，通过步骤S502将所述身份信息和支付信息发送至第一服务器。在第一服务器中，首先对该身份信息的合法性进行认证，在物联网设备的身份信息认证通过后，第一服务器将支付信息发送给第二服务器，再通过第二服务器对用户的支付进行认证。
示例性的，第一服务器可以为物联网设备管理平台。第一服务器中预先在数据库中存储物联网设备与其所对应的第一公钥以及设备Token之间的映射关系。当第一服务器接收到移动终端发送的物联网设备身份信息后，通过第一公钥对该身份信息进行解密认证，解密成功，则物联网设备身份合法，认证通过；否则不合法，物联网身份认证失败。
第一服务器对物联网设备身份信息认证通过后，基于解析的身份信息确定该物联网设备对应的第一令牌。同时，第一服务器还将用户的支付信息发送至第二服务器。示例性的，该第二服务器可以为支付卡所属运营方的交易平台(如银联卡对应的银联交易平台)。第二服务器对支付信息中 的***、防伪码、验证码进行验证，确认支付信息的合法性。
第二服务器认证用户的支付信息合法后，生成对应支付信息的第二令牌。示例性的，第二令牌作为业务Token，与支付信息中的支付卡具有一一对应的关系，当支付信息中包含一个支付卡的信息时，可以生成一个第一令牌；当支付信息中包含多个支付卡的信息时，可以对应这些支付卡分别生成多个第二令牌。
第二服务器生成的第二令牌返回至第一服务器，通过第一服务器将上述确定的物联网设备对应的第一令牌、第二服务器返回的第二令牌与对应的身份信息和支付信息进行绑定，生成对应的关联信息，则移动设备可以通过步骤S503接收所述第一服务器发送的第二信息(也即所述关联信息)，并显示该第二信息供用户查看。
在第二信息中，一个第一令牌可以对应一个或多个第二令牌，也即本申请实施例中，允许一个物联网设备绑定多个支付卡进行后续的交易，满足用户的多卡支付需求。一个示例中，为提升后续支付的便利性，可以在上述关联信息的绑定过程中，将其中一个支付卡设置为默认支付卡，并可以在所述关联信息中标记对应默认支付标识。
本申请实施例中，基于移动设备实现的物联网设备与平台之间的认证方法，可以在后续支付场景中，通过在安全芯片SE中保存的关联信息中的支付信息发起交易支付。这样，通过身份信息和支付信息认证后的物联网设备在后续支付过程中，可以具有单独的支付能力，一方面，相对于传统的线上交易，本申请实施例中的物联网设备可以基于安全芯片建立的硬件基础，根据所安全保存的通过平台认证过的支付信息和第一令牌发起交易支付，保障交易安全性，避免交易信息在传输过程中被恶意破解攻击的风险。另一方面，通过本申请实施例的认证方法认证后的关联信息保存在物联网设备中，用于后续发起交易支付的场景中，相对于传统的依赖IC卡完成的线下交易，本申请实施例中的物联网设备基于支付卡的支付信息发起交易时，可以脱离前端对IC卡物理卡体的依赖，利于提升交易便利性。
可选的，为满足用户的多种需求，本申请实施例中还可以允许用户对 物联网设备中保存的支付信息进行更新。具体的，本申请实施例中，如果用户需要对物联网设备添加新的支付卡进行请求认证绑定，或想要删除已绑定的支付卡，则认证方法还可以包括步骤S504～S506：
S504.获取物联网设备的身份信息和用户的更新支付信息，所述物联网设备内置有第一令牌；
S505.将所述身份信息和更新支付信息发送至第一服务器，以使所述第一服务器对所述身份信息认证通过后，将所述更新支付信息发送至第二服务器认证；
S303.接收所述第一服务器发送的第四信息，所述第四信息包括第一令牌和所述第三令牌与所述身份信息以及所述更新支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器根据所述身份信息确定，所述第三令牌为所述第二服务器对所述更新支付信息认证通过后生成。
移动终端可以通过扫描标识码或接入物联网设备的MCU访问接口，获取物联网设备的身份信息，并跳转到第二界面显示物联网设备上保存的已有支付卡的支付信息。
用户可以在移动设备上第二界面显示的支付信息的基础上，通过输入新增支付卡或删除支付卡等操作生成对应的更新支付信息。移动设备将所述身份信息和更新支付信息发送到第一服务器进行认证。
本实施例中，第一服务器对物联网设备身份信息的认证过程与上述实施例中的身份信息认证过程相同，第二服务器对更新支付信息的认证过程与上述实施例中支付信息的认证过程相同，第二服务器对更新支付信息认证通过后生成新的技术Token，也即第三令牌，返回到第二服务器，由第二服务器将第一令牌、第三令牌、所述身份信息以及所述更新支付信息绑定，生成新的关联信息(也即第四信息)，发送到物联网设备保存，并发送给移动设备显示给用户。
可以理解的是，上述各实施例中的，相同的关联信息发送到不同的设备后，可以通过不同技术术语表示，如第一信息和第二信息可以包括相同的关联信息，第三信息和第四信息可以包括相同的关联信息。
示例性的，上述物联网设备可以为电子车牌。
在通过物联网设备、移动设备、第一服务器以及第二服务器之间的信息交互，完成物联网设备和支付信息的认证和绑定后，可以利于物联网设备参与到交易支付场景中，保障交易安全性。因此本申请实施例还提供了一种支付方法。
图6示出了本申请实施例提供的一种支付方法的流程示意图。如图6所示，该方法应用于第一服务器，方法包括步骤S601～S605：
S601.接收物联网设备发送的交易请求，所述交易请求中包括对应交易事件的交易信息、物联网设备的第一令牌和身份信息，所述交易信息中包括支付信息；
S602.从交易请求中解析得到第一令牌；
S603.根据第一令牌以及第一服务器中的预存映射信息，确定对应的第二令牌，预存映射信息为第一令牌、第二令牌与支付信息的关联信息；
S604.向第二服务器发送所述第二令牌和所述交易信息，以使第二服务器对第二令牌对应的支付信息验证通过后，由第三服务器基于支付信息进行对应交易事件的余额扣除操作并产生余额变动信息；
S605.接收第二服务器发送的余额变动信息，以转发至物联网设备。
本申请实施例中的第一服务器可以为物联网设备管理平台。本申请实施例的支付方法中，基于认证后的身份信息和支付信息以及安全芯片中存储的第一令牌发起交易支付，相对于传统的线上交易，保障了交易信息的合法性，提高了交易安全性；相对于传统的IC卡交易，本申请实施例的方法可以实现基于支付卡的支付信息、但不依赖支付卡的物理卡体发起的交易流程，提高支付的便利性。
可选的，本申请实施例中，参考图7所示，在进行一次交易时，通过步骤S701，物联网设备将对应交易事件的交易信息、安全芯片中存储的物联网设备的第一令牌和身份信息，封装生成交易请求的数据包，发送至第一服务器。
交易信息可以包括当前交易事件的时间、事件标识、支付信息(如默认支付卡的支付信息)、支付金额等。
该交易请求的数据包中，交易信息、物联网设备的第一令牌和身份信 息等，可以通过所述安全芯片中的第一私钥加密，以保障敏感信息的安全性。
对应的，第一服务器通过步骤S601接收物联网设备发送的交易请求后，通过步骤S602从交易请求中解析得到第一令牌，具体可以包括步骤：
通过第一公钥解密交易请求，以从交易请求中解析得到第一令牌，第一公钥由安全芯片生成且与第一私钥对应。
第一服务器预先存储有第一公钥、第一令牌、第二令牌、物联网设备身份信息以及支付信息的关联信息。通过第一公钥对交易请求的数据包进行解密，解密出第一令牌、身份信息以及交易信息等信息的明文。然后可以通过步骤S603根据第一令牌以及第一服务器中的预存映射信息，确定对应的第二令牌，其中，该预存映射信息即所述关联信息。
确认交易请求对应的第二令牌后，第一服务器通过步骤S604向第二服务器发送包含所述第二令牌和所述交易信息的报文。示例性的，第二服务器可以为支付卡所属运营方的交易平台(如银联卡对应的银联交易平台)。该第二服务器中预先存储有第二令牌与支付信息的映射关系数据，则参考图7所示，通过步骤S702，第二服务器可以根据报文中的第二令牌确定对应的支付信息的合法性。
验证该支付信息合法后，通过步骤S703，第二服务器将交易信息中支付金额和支付信息(如支付卡***等)发送给第三服务器。示例性的，该第三服务器可以为发卡机构***，通过步骤S704，第三服务器基于支付信息和支付金额等对应交易事件进行余额扣除操作，并产生该支付卡的余额变动信息，通过步骤S705～S707，返回到第二服务器，并由第二服务器逐级返回。
故而，第一服务器通过步骤S605接收第二服务器发送的余额变动信息，以转发至物联网设备，完成交易支付。
另外，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表 示前后关联对象是一种“或”的关系。
应理解，在本申请实施例中，“与A相应的B”表示B与A相关联，根据A可以确定B。但还应理解，根据A确定B并不意味着仅仅根据A确定B，还可以根据A和/或其它信息确定B。
图8示出了本申请实施例提供一种认证装置的结构示意图。如图8所示，该装置应用于物联网设备，所述物联网设备内置有第一令牌，装置包括：
第一发送模块801，用于向移动设备提供所述物联网设备的身份信息，以使所述移动设备将所述身份信息和用户的支付信息发送至第一服务器认证；
第一接收模块802，用于接收第一服务器发送的第二信息，所述第二信息包括所述第一令牌和第二令牌与所述身份信息以及所述支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器对所述身份信息认证通过后确定的，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成的；
保存模块803，用于保存所述第一信息。
在本申请实施例中，通过移动设备获取物联网设备的身份信息和用户的支付信息，一起发送给第一服务器进行认证。第一服务器对物联网设备的身份信息认证通过后，可以基于该身份信息确定物联网设备的第一令牌，即物联网设备的令牌不需要传输，在第一服务器中可以预先存储物联网设备身份信息与第一令牌的对应关系，在认证物联网设备的身份信息合法后，可以确定该设备对应得到第一令牌；然后将支付信息发送到第二服务器，由第二服务器认证支付信息的合法性，并在认证通过后生成第二令牌返回第一服务器，由第一服务器完成对应物联网设备的绑定，即，将第一令牌、第二令牌和支付信息关联，发送给物联网设备保存。这样在实现支付前，先基于物联网设备的设备令牌(即第一令牌，下同)与服务器之间完成认证，保障后续支付的安全性。
可选的，本申请实施例中，物联网设备的处理器，如MCU(Micro Controller Unit，微控制单元)，连接安全芯片SE(Secure Element)，安 全芯片SE预置安全域，以建立其物联网设备的安全基础。
示例性的，在物联网设备的安全芯片SE可以作为该设备的交易安全盾，基于其自身具有的高安全性能，提升物联网设备的硬件能力。并且安全芯片SE中加密存储有第一令牌。
所述第一令牌，也即物联网设备的设备Token，与物联网设备之间具有唯一的对应关系，每个物联网设备具有一个设备Token，故而物联网设备的设备Token在全局具有唯一性。
可选的，本申请实施例中，装置还可以包括：
第一生成模块，用于通过所述安全芯片生成一对密钥，所述密钥包括第一公钥和第一私钥；
第六发送模块，用于向所述第一服务器发送所述第一公钥。
对应的，第一发送模块801具体可以用于：
通过所述第一私钥对所述身份信息加密后发送至所述移动设备，以使所述移动设备将所述身份信息发送至所述第一服务器后，通过第一公钥对所述身份信息认证。
示例性的，物联网身份信息可以包括设备ID(Identity Document，身份标识码)、设备厂商ID、以及设备芯片ID(本示例中为设备上述MCU对应的芯片的序列号)中的一种或多种。
用户输入的支付信息可以包括支付卡(如银行卡)的***、防伪码(如安全码CVN2，Card Validation Number 2)和验证码等信息中的一种或多种。一个具体示例中，支付信息中可以包括一个或多个支付卡。
示例性的，第二令牌作为业务Token，与支付信息中的支付卡具有一一对应的关系，当支付信息中包含一个支付卡的信息时，可以生成一个第一令牌；当支付信息中包含多个支付卡的信息时，可以对应这些支付卡分别生成多个第二令牌。
可选的，本申请实施例中，装置还可以包括：
第二提供模块，用于向移动设备提供所述物联网设备的身份信息和支付信息，以使所述移动设备根据所述支付信息生成更新支付信息，并将所述更新支付信息和身份信息发送至第一服务器认证；
第七接收模块，用于接收第一服务器发送的第三信息，所述第三信息包括所述第一令牌、第三令牌、所述身份信息以及所述更新支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器对所述身份信息认证通过后确定的，所述第三令牌为所述第二服务器对所述更新支付信息认证通过后生成的；
第二保存模块，用于保存所述第三信息。
图9示出了示出了本申请实施例提供一种认证装置的结构示意图。如图9所示，该装置应用于第一服务器，装置包括：
第二接收模块901，用于接收移动设备发送的物联网设备的身份信息和用户的支付信息；
第一认证模块902，用于通过预设规则认证所述身份信息；
第二发送模块903，用于在所述身份信息认证通过后，向第二服务器发送所述支付信息以进行认证；
第三接收模块904，用于接收第二服务器发送的第二令牌，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成的；
第三发送模块905，用于将第一令牌和所述第二令牌与所述身份信息以及所述支付信息关联后的关联信息，发送至所述物联网设备和所述移动设备。
在本申请实施例中，第一服务器可以为物联网设备管理平台，第一服务器可以对若干物联网设备进行统一管理。通过移动设备获取物联网设备的身份信息和用户的支付信息，一起发送给第一服务器进行认证。第一服务器对物联网设备的身份信息认证通过后，可以基于该身份信息确定物联网设备的第一令牌，即物联网设备的令牌不需要传输，在第一服务器中可以预先存储物联网设备身份信息与第一令牌的对应关系，在认证物联网设备的身份信息合法后，可以确定该设备对应得到第一令牌；然后将支付信息发送到第二服务器，由第二服务器认证支付信息的合法性，并在认证通过后生成第二令牌返回第一服务器，由第一服务器完成对应物联网设备的绑定，即，将第一令牌、第二令牌和支付信息关联，发送给物联网设备保存。这样在实现支付前，先基于物联网设备的设备令牌(即第一令牌，下 同)与服务器之间完成认证，保障后续支付的安全性。
可选的，本申请实施例中，物联网设备的处理器，如MCU(Micro Controller Unit，微控制单元)，连接安全芯片SE(Secure Element)，安全芯片SE预置安全域，以建立其物联网设备的安全基础。
示例性的，在物联网设备的安全芯片SE可以作为该设备的交易安全盾，基于其自身具有的高安全性能，提升物联网设备的硬件能力。并且安全芯片SE中加密存储有第一令牌。
所述第一令牌，也即物联网设备的设备Token，与物联网设备之间具有唯一的对应关系，每个物联网设备具有一个设备Token，故而物联网设备的设备Token在全局具有唯一性。
可选的，本申请实施例中，装置还可以包括：
第八接收模块，用于接收物联网设备发送的所述第一公钥；
第三保存模块，用于保存所述第一公钥。
第一服务器中可以预先将物联网设备的身份信息与其第一令牌之间的映射关联保存在数据库中，并在收到第一公钥后，将该第一公钥与对应的物联网设备身份信息关联保存。
示例性的，物联网身份信息可以包括设备ID(Identity Document，身份标识码)、设备厂商ID、以及设备芯片ID中的一种或多种。
用户输入的支付信息可以包括支付卡(如银行卡)的***、防伪码(如安全码CVN2，Card Validation Number 2)和验证码等信息中的一种或多种。一个具体示例中，支付信息中可以包括一个或多个支付卡。
示例性的，第二令牌作为业务Token，与支付信息中的支付卡具有一一对应的关系，当支付信息中包含一个支付卡的信息时，可以生成一个第一令牌；当支付信息中包含多个支付卡的信息时，可以对应这些支付卡分别生成多个第二令牌。
可选的，本申请实施例中，装置还可以包括：
第九接收模块，用于接收移动设备发送的物联网设备的身份信息和用户的更新支付信息；
第二认证模块，用于通过预设规则认证所述身份信息；
第九发送模块，用于在所述身份信息认证通过后，向第二服务器发送所述更新支付信息以进行认证；
第十接收模块，用于接收第二服务器发送的第三令牌，所述第三令牌为所述第二服务器对所述更新支付信息认证通过后生成的；
第十发送模块，用于将第一令牌和所述第三令牌与所述身份信息以及所述更新支付信息关联后的关联信息，发送至所述物联网设备和所述移动设备。
图10示出了本申请实施例提供一种认证装置的结构示意图。如图10所示，该装置应用于移动设备，所装置包括：
第一获取模块1001，用于获取物联网设备的身份信息和用户的支付信息，所述物联网设备内置有第一令牌；
第四发送模块1002，用于将所述身份信息和支付信息发送至第一服务器，以使所述第一服务器对所述身份信息认证通过后，将所述支付信息发送至第二服务器认证；
第四接收模块1003，用于接收所述第一服务器发送的第一信息，所述第一信息包括第一令牌和第二令牌与所述身份信息以及所述支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器根据所述身份信息确定，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成。
在本申请实施例，通过移动设备获取物联网设备的身份信息和用户的支付信息，一起发送给第一服务器进行认证。第一服务器对物联网设备的身份信息认证通过后，可以基于该身份信息确定物联网设备的第一令牌，即物联网设备的令牌不需要传输，在第一服务器中可以预先存储物联网设备身份信息与第一令牌的对应关系，在认证物联网设备的身份信息合法后，可以确定该设备对应得到第一令牌；然后将支付信息发送到第二服务器，由第二服务器认证支付信息的合法性，并在认证通过后生成第二令牌返回第一服务器，由第一服务器完成对应物联网设备的绑定，即，将第一令牌、第二令牌和支付信息关联，发送给物联网设备保存。这样在实现支付前，先基于物联网设备的设备令牌(即第一令牌，下同)与服务器之间完成认证，保障后续支付的安全性。
可选的，本申请实施例中，物联网设备的处理器，如MCU(Micro Controller Unit，微控制单元)，连接安全芯片SE(Secure Element)，安全芯片SE预置安全域，以建立其物联网设备的安全基础。
示例性的，在物联网设备的安全芯片SE可以作为该设备的交易安全盾，基于其自身具有的高安全性能，提升物联网设备的硬件能力。并且安全芯片SE中加密存储有第一令牌。
所述第一令牌，也即物联网设备的设备Token，与物联网设备之间具有唯一的对应关系，每个物联网设备具有一个设备Token，故而物联网设备的设备Token在全局具有唯一性。
可选的，本申请实施例中，装置还可以包括：
第二获取模块，用于获取所述物联网设备的标识码，所述标识码中包括物联网设备的身份信息和页面地址；
第二解析模块，用于根据所述标识码，解析得到所述身份信息，并跳转到所述页面地址对应的第一界面；
第十一接收模块，用于接收用户从所述第一界面输入的支付信息。
示例性的，物联网身份信息可以包括设备ID(Identity Document，身份标识码)、设备厂商ID、以及设备芯片ID(本示例中为设备上述MCU对应的芯片的序列号)中的一种或多种。
用户输入的支付信息可以包括支付卡(如银行卡)的***、防伪码(如安全码CVN2，Card Validation Number 2)和验证码等信息中的一种或多种。一个具体示例中，支付信息中可以包括一个或多个支付卡。
示例性的，第二令牌作为业务Token，与支付信息中的支付卡具有一一对应的关系，当支付信息中包含一个支付卡的信息时，可以生成一个第一令牌；当支付信息中包含多个支付卡的信息时，可以对应这些支付卡分别生成多个第二令牌。
可选的，本申请实施例中，装置还可以包括：
第三获取模块，用于获取物联网设备的身份信息和用户的更新支付信息，所述物联网设备内置有第一令牌；
第十一发送模块，用于将所述身份信息和更新支付信息发送至第一服 务器，以使所述第一服务器对所述身份信息认证通过后，将所述更新支付信息发送至第二服务器认证；
第十二接收模块，用于接收所述第一服务器发送的第四信息，所述第四信息包括第一令牌和所述第三令牌与所述身份信息以及所述更新支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器根据所述身份信息确定，所述第三令牌为所述第二服务器对所述更新支付信息认证通过后生成。
图11示出了本申请实施例提供一种支付装置的结构示意图。如图11所示，该装置应用于第一服务器，该装置包括：
第五接收模块1101，用于接收物联网设备发送的交易请求，交易请求基于物联网设备保存的支付信息发起，交易请求中包括对应交易事件的交易信息、物联网设备的第一令牌和身份信息；
第一解析模块1102，用于从交易请求中解析得到第一令牌；
确定模块1103，用于根据第一令牌以及第一服务器中的预存映射信息，确定对应的第二令牌，预存映射信息为第一令牌、第二令牌与支付信息的关联信息；
第五发送模块1104，用于向第二服务器发送所述第二令牌和所述交易信息，以使第二服务器对第二令牌对应的支付信息验证通过后，由第三服务器基于支付信息进行对应交易事件的余额扣除操作并产生余额变动信息；
第六接收模块1105，用于接收所述第二服务器发送的所述余额变动信息，以转发至所述物联网设备。
本申请实施例中的第一服务器可以为物联网设备管理平台。本申请实施例中，基于认证后的身份信息和支付信息以及安全芯片中存储的第一令牌发起交易支付，相对于传统的线上交易，保障了交易信息的合法性，提高了交易安全性；相对于传统的IC卡交易，本申请实施例的方法可以实现基于支付卡的支付信息、但不依赖支付卡的物理卡体发起的交易流程，提高支付的便利性。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以 援引到对应功能模块的功能描述，并能达到其相应的技术效果，为简洁描述，在此不再赘述。
图12示出了本申请实施例提供的电子设备的硬件结构示意图。
电子设备可以包括处理器1201以及存储有计算机程序指令的存储器1202。
具体地，上述处理器1201可以包括中央处理器(CPU)，或者特定集成电路(Application Specific Integrated Circuit，ASIC)，或者可以被配置成实施本申请实施例的一个或多个集成电路。
存储器1202可以包括用于数据或指令的大容量存储器。举例来说而非限制，存储器1202可包括硬盘驱动器(Hard Disk Drive，HDD)、软盘驱动器、闪存、光盘、磁光盘、磁带或通用串行总线(Universal Serial Bus，USB)驱动器或者两个或更多个以上这些的组合。在合适的情况下，存储器1202可包括可移除或不可移除(或固定)的介质。在合适的情况下，存储器1202可在综合网关容灾设备的内部或外部。在特定实施例中，存储器1202是非易失性固态存储器。
存储器可包括只读存储器(ROM)，随机存取存储器(RAM)，磁盘存储介质设备，光存储介质设备，闪存设备，电气、光学或其他物理/有形的存储器存储设备。因此，通常，存储器包括一个或多个编码有包括计算机可执行指令的软件的有形(非暂态)计算机可读存储介质(例如，存储器设备)，并且当该软件被执行(例如，由一个或多个处理器)时，其可操作来执行参考根据本申请上述任意实施例的认证方法或支付方法所描述的操作。
处理器1201通过读取并执行存储器1202中存储的计算机程序指令，以实现上述任意实施例的认证方法或支付方法。
在一个示例中，电子设备还可包括通信接口1203和总线1210。其中，如图12所示，处理器1201、存储器1202、通信接口1203通过总线1210连接并完成相互间的通信。
通信接口1203，主要用于实现本申请实施例中各模块、装置、单元和/或设备之间的通信。
总线1210包括硬件、软件或两者，将电子设备的部件彼此耦接在一起。举例来说而非限制，总线可包括加速图形端口(AGP)或其他图形总线、增强工业标准架构(EISA)总线、前端总线(FSB)、超传输(HT)互连、工业标准架构(ISA)总线、无限带宽互连、低引脚数(LPC)总线、存储器总线、微信道架构(MCA)总线、***组件互连(PCI)总线、PCI-Express(PCI-X)总线、串行高级技术附件(SATA)总线、视频电子标准协会局部(VLB)总线或其他合适的总线或者两个或更多个以上这些的组合。在合适的情况下，总线1210可包括一个或多个总线。尽管本申请实施例描述和示出了特定的总线，但本申请考虑任何合适的总线或互连。
另外，结合上述实施例中的认证方法或支付方法，本申请实施例可提供一种计算机存储介质来实现。该计算机存储介质上存储有计算机程序指令；该计算机程序指令被处理器执行时实现上述任意实施例的认证方法或支付方法。
另外，结合上述实施例中的认证方法或支付方法，本申请实施例可提供一种计算机程序产品来实现。该计算机程序产品中的指令由电子设备的处理器执行时，使得所述电子设备执行上述任意实施例的认证方法或支付方法。计算机可读存储介质的示例包括非暂态计算机可读存储介质，如便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件等。
需要明确的是，本申请并不局限于上文所描述并在图中示出的特定配置和处理。为了简明起见，这里省略了对已知方法的详细描述。在上述实施例中，描述和示出了若干具体的步骤作为示例。但是，本申请的方法过程并不限于所描述和示出的具体步骤，本领域的技术人员可以在领会本申请的精神后，作出各种改变、修改和添加，或者改变步骤之间的顺序。
以上所述的结构框图中所示的功能模块可以实现为硬件、软件、固件或者它们的组合。当以硬件方式实现时，其可以例如是电子电路、专用集成电路(ASIC)、适当的固件、插件、功能卡等等。当以软件方式实现 时，本申请的元素是被用于执行所需任务的程序或者代码段。程序或者代码段可以存储在机器可读介质中，或者通过载波中携带的数据信号在传输介质或者通信链路上传送。“机器可读介质”可以包括能够存储或传输信息的任何介质。机器可读介质的例子包括电子电路、半导体存储器设备、ROM、闪存、可擦除ROM(EROM)、软盘、CD-ROM、光盘、硬盘、光纤介质、射频(RF)链路，等等。代码段可以经由诸如因特网、内联网等的计算机网络被下载。
还需要说明的是，本申请中提及的示例性实施例，基于一系列的步骤或者装置描述一些方法或***。但是，本申请不局限于上述步骤的顺序，也就是说，可以按照实施例中提及的顺序执行步骤，也可以不同于实施例中的顺序，或者若干步骤同时执行。
上面参考根据本申请的实施例的方法、装置(***)和计算机程序产品的流程图和/或框图描述了本申请的各方面。应当理解，流程图和/或框图中的每个方框以及流程图和/或框图中各方框的组合可以由计算机程序指令实现。这些计算机程序指令可被提供给通用计算机、专用计算机、或其它可编程数据处理装置的处理器，以产生一种机器，使得经由计算机或其它可编程数据处理装置的处理器执行的这些指令使能对流程图和/或框图的一个或多个方框中指定的功能/动作的实现。这种处理器可以是但不限于是通用处理器、专用处理器、特殊应用处理器或者现场可编程逻辑电路。还可理解，框图和/或流程图中的每个方框以及框图和/或流程图中的方框的组合，也可以由执行指定的功能或动作的专用硬件来实现，或可由专用硬件和计算机指令的组合来实现。
以上所述，仅为本申请的具体实施方式，所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的***、模块和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。应理解，本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。

Claims (21)

  1. 一种认证方法，应用于物联网设备，所述物联网设备内置有第一令牌，所述方法包括：
    向移动设备提供所述物联网设备的身份信息，以使所述移动设备将所述身份信息和用户的支付信息发送至第一服务器认证；
    接收第一服务器发送的第一信息，所述第一信息包括所述第一令牌、第二令牌、所述身份信息以及所述支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器对所述身份信息认证通过后确定的，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成的；
    保存所述第一信息。
  2. 根据权利要求1所述的方法，其中，所述物联网设备中设有安全芯片，
    在所述向移动设备提供所述物联网设备的身份信息之前，所述方法还包括；
    通过所述安全芯片生成一对密钥，所述密钥包括第一公钥和第一私钥；
    向所述第一服务器发送所述第一公钥；
    所述向移动设备提供所述物联网设备的身份信息，包括：
    通过所述第一私钥对所述身份信息加密后发送至所述移动设备，以使所述移动设备将所述身份信息发送至所述第一服务器后，通过第一公钥对所述身份信息认证。
  3. 根据权利要求2所述的方法，其中，所述安全芯片中加密存储所述第一令牌。
  4. 根据权利要求1所述的方法，其中，所述支付信息对应一个或多个支付卡，所述第二令牌为一个或多个，第二令牌与支付卡一一对应。
  5. 一种认证方法，应用于第一服务器，所述方法包括：
    接收移动设备发送的物联网设备的身份信息和用户的支付信息；
    通过预设规则认证所述身份信息；
    在所述身份信息认证通过后，向第二服务器发送所述支付信息以进行 认证；
    接收第二服务器发送的第二令牌，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成的；
    将第一令牌和所述第二令牌与所述身份信息以及所述支付信息关联后的关联信息，发送至所述物联网设备和所述移动设备。
  6. 根据权利要求5所述的方法，其中，所述身份信息为通过第一私钥加密的信息，所述第一私钥为所述物联网设备的安全芯片生成；
    所述通过预设规则认证所述身份信息，包括：
    通过第一公钥认证所述身份信息，所述第一公钥为所述安全芯片生成且与所述第一私钥对应。
  7. 根据权利要求6所述的方法，其中，在所述接收移动设备发送的物联网设备的身份信息和用户的支付信息之前，所述方法还包括：
    接收物联网设备发送的所述第一公钥；
    保存所述第一公钥。
  8. 根据权利要求5所述的方法，其中，所述支付信息对应一个或多个支付卡，所述第二令牌为一个或多个，第二令牌与支付卡一一对应。
  9. 一种认证方法，应用于移动设备，所述方法包括：
    获取物联网设备的身份信息和用户的支付信息，所述物联网设备内置有第一令牌；
    将所述身份信息和支付信息发送至第一服务器，以使所述第一服务器对所述身份信息认证通过后，将所述支付信息发送至第二服务器认证；
    接收所述第一服务器发送的第二信息，所述第二信息包括第一令牌和所述第二令牌与所述身份信息以及所述支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器根据所述身份信息确定，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成。
  10. 根据权利要求9所述的方法，其中，所述获取物联网设备的身份信息和用户的支付信息，包括：
    获取所述物联网设备的标识码，所述标识码中包括物联网设备的身份信息和页面地址；
    根据所述标识码，解析得到所述身份信息，并跳转到所述页面地址对应的第一界面；
    接收用户从所述第一界面输入的支付信息。
  11. 根据权利要求10所述的方法，其中，所述物联网设备中设有安全芯片，所述安全芯片中加密存储所述第一令牌。
  12. 根据权利要求9所述方法，其中，所述支付信息对应一个或多个支付卡，所述第二令牌为一个或多个，第二令牌与支付卡一一对应。
  13. 一种支付方法，应用于第一服务器，所述方法包括：
    接收物联网设备发送的交易请求，所述交易请求中包括对应交易事件的交易信息、物联网设备的第一令牌和身份信息，所述交易信息中包括支付信息；
    从所述交易请求中解析得到所述第一令牌；
    根据所述第一令牌以及所述第一服务器中的预存映射信息，确定对应的第二令牌，所述预存映射信息为所述第一令牌、所述第二令牌与所述身份信息和支付信息的关联信息；
    向第二服务器发送所述第二令牌和所述交易信息，以使第二服务器对所述第二令牌对应的支付信息验证通过后，由第三服务器基于所述支付信息进行对应所述交易事件的余额扣除操作并产生余额变动信息；
    接收所述第二服务器发送的所述余额变动信息，以转发至所述物联网设备。
  14. 根据权利要求13所述的方法，其中，所述交易请求为通过物联网设备上的第一私钥加密的信息，所述第一私钥为所述物联网设备的安全芯片生成；
    所述从所述交易请求中解析得到所述第一令牌，包括：
    通过第一公钥解密所述交易请求，以从所述交易请求中解析得到所述第一令牌，所述第一公钥由所述安全芯片生成且与所述第一私钥对应。
  15. 一种认证装置，应用于物联网设备，所述物联网设备内置有第一令牌，其特征在于，所述装置包括：
    第一发送模块，用于向移动设备提供所述物联网设备的身份信息，以 使所述移动设备将所述身份信息和用户的支付信息发送至第一服务器认证；
    第一接收模块，用于接收第一服务器发送的第二信息，所述第二信息包括所述第一令牌和第二令牌与所述身份信息以及所述支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器对所述身份信息认证通过后确定的，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成的；
    保存模块，用于保存所述第一信息。
  16. 一种认证装置，应用于第一服务器，其特征在于，所述装置包括：
    第二接收模块，用于接收移动设备发送的物联网设备的身份信息和用户的支付信息；
    第一认证模块，用于通过预设规则认证所述身份信息；
    第二发送模块，用于在所述身份信息认证通过后，向第二服务器发送所述支付信息以进行认证；
    第三接收模块，用于接收第二服务器发送的第二令牌，所述第二令牌为所述第二服务器对所述支付信息认证通过后生成的；
    第三发送模块，用于将第一令牌和所述第二令牌与所述身份信息以及所述支付信息关联后的关联信息，发送至所述物联网设备和所述移动设备。
  17. 一种认证装置，应用于移动设备，所述装置包括：
    第一获取模块，用于获取物联网设备的身份信息和用户的支付信息，所述物联网设备内置有第一令牌；
    第四发送模块，用于将所述身份信息和支付信息发送至第一服务器，以使所述第一服务器对所述身份信息认证通过后，将所述支付信息发送至第二服务器认证；
    第四接收模块，用于接收所述第一服务器发送的第一信息，所述第一信息包括第一令牌和第二令牌与所述身份信息以及所述支付信息之间的关联信息，其中，所述第一令牌为所述第一服务器根据所述身份信息确定， 所述第二令牌为所述第二服务器对所述支付信息认证通过后生成。
  18. 一种支付装置，应用于第一服务器，所述装置包括：
    第五接收模块，用于接收物联网设备发送的交易请求，所述交易请求中包括对应交易事件的交易信息、物联网设备的第一令牌和身份信息，所述交易信息中包括支付信息；
    第一解析模块，用于从所述交易请求中解析得到所述第一令牌；
    确定模块，用于根据所述第一令牌以及所述第一服务器中的预存映射信息，确定对应的第二令牌，所述预存映射信息为所述第一令牌、所述第二令牌与所述身份信息以及支付信息的关联信息；
    第五发送模块，用于向第二服务器发送所述第二令牌，以使第二服务器对所述第二令牌对应的支付信息验证通过后，由第三服务器基于所述支付信息进行对应所述交易事件的余额扣除操作并产生余额变动信息；
    第六接收模块，用于接收所述第二服务器发送的所述余额变动信息，以转发至所述物联网设备。
  19. 一种电子设备，包括：处理器以及存储有计算机程序指令的存储器；
    所述处理器执行所述计算机程序指令时实现如权利要求1-4、或者权利要求5-8、或者权利要求9-12、或者权利要求13-14中任意一项所述的方法。
  20. 一种计算机存储介质，所述计算机存储介质上存储有计算机程序指令，所述计算机程序指令被处理器执行时实现如权利要求1-4、或者权利要求5-8、或者权利要求9-12、或者权利要求13-14中任意一项所述的方法。
  21. 一种计算机程序产品，所述计算机程序产品中的指令由电子设备的处理器执行时，使得所述电子设备执行如权利要求1-4、或者权利要求5-8、或者权利要求9-12、或者权利要求13-14中任意一项所述的方法。
PCT/CN2022/112455 2022-01-26 2022-08-15 认证方法、支付方法、装置及设备 WO2023142436A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210096244.9A CN114463012A (zh) 2022-01-26 2022-01-26 认证方法、支付方法、装置及设备
CN202210096244.9 2022-01-26

Publications (1)

Publication Number Publication Date
WO2023142436A1 true WO2023142436A1 (zh) 2023-08-03

Family

ID=81411842

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/112455 WO2023142436A1 (zh) 2022-01-26 2022-08-15 认证方法、支付方法、装置及设备

Country Status (2)

Country Link
CN (1) CN114463012A (zh)
WO (1) WO2023142436A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114463012A (zh) * 2022-01-26 2022-05-10 ***股份有限公司 认证方法、支付方法、装置及设备
CN115049378A (zh) * 2022-06-08 2022-09-13 支付宝(杭州)信息技术有限公司 一种业务执行方法、装置、设备和计算机可读介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170091758A1 (en) * 2015-09-30 2017-03-30 Bank Of America Corporation Merchant tokenization migration infrastructure system
CN109034780A (zh) * 2018-06-25 2018-12-18 深圳市金溢科技股份有限公司 车载移动支付方法、***及其v2x车载装置、v2x路侧pos装置
US20190392430A1 (en) * 2018-06-21 2019-12-26 Mastercard International Incorporated Computer system and computer-implemented method for secure payment transaction
CN112819454A (zh) * 2021-01-22 2021-05-18 ***股份有限公司 支付方法、网关设备、服务器及存储介质
WO2021174968A1 (zh) * 2020-03-03 2021-09-10 支付宝(杭州)信息技术有限公司 支付方法、装置及设备
CN114463012A (zh) * 2022-01-26 2022-05-10 ***股份有限公司 认证方法、支付方法、装置及设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170091758A1 (en) * 2015-09-30 2017-03-30 Bank Of America Corporation Merchant tokenization migration infrastructure system
US20190392430A1 (en) * 2018-06-21 2019-12-26 Mastercard International Incorporated Computer system and computer-implemented method for secure payment transaction
CN109034780A (zh) * 2018-06-25 2018-12-18 深圳市金溢科技股份有限公司 车载移动支付方法、***及其v2x车载装置、v2x路侧pos装置
WO2021174968A1 (zh) * 2020-03-03 2021-09-10 支付宝(杭州)信息技术有限公司 支付方法、装置及设备
CN112819454A (zh) * 2021-01-22 2021-05-18 ***股份有限公司 支付方法、网关设备、服务器及存储介质
CN114463012A (zh) * 2022-01-26 2022-05-10 ***股份有限公司 认证方法、支付方法、装置及设备

Also Published As

Publication number Publication date
CN114463012A (zh) 2022-05-10

Similar Documents

Publication Publication Date Title
CN109150548B (zh) 一种数字证书签名、验签方法及***、数字证书***
KR102358546B1 (ko) 장치에 대해 클라이언트를 인증하기 위한 시스템 및 방법
WO2023142436A1 (zh) 认证方法、支付方法、装置及设备
CN105850073B (zh) 信息***访问认证方法及装置
EP2859488B1 (en) Enterprise triggered 2chk association
US20170244676A1 (en) Method and system for authentication
CN111431719A (zh) 一种移动终端密码保护模块、移动终端及密码保护方法
CN107784499B (zh) 近场通信移动终端的安全支付***及方法
TWI632798B (zh) 伺服器、行動終端機、網路實名認證系統及方法
WO2013184267A1 (en) Enhanced 2chk authentication security with query transactions
US20110119750A1 (en) Method for improving network application security and the system thereof
US9836618B2 (en) System and method of authentication of a first party respective of a second party aided by a third party
CN115760082A (zh) 数字化支付处理方法、装置、设备、***及介质
WO2015109958A1 (zh) 一种基于协商密钥的数据处理方法和手机
CN104079527A (zh) 一种信息处理方法及电子设备
CN109858235B (zh) 一种便携式设备及其暗码获取方法和装置
CN116777584A (zh) 数据处理方法、装置、设备、介质及产品
CN114584324B (zh) 一种基于区块链的身份授权方法和***
TWI728212B (zh) 基於密文的身份驗證方法
KR20180037168A (ko) Otp를 이용한 상호 인증 방법 및 시스템
KR20180039037A (ko) 온라인 서비스 서버와 클라이언트 간의 상호 인증 방법 및 시스템
CN113807843A (zh) 绑卡方法、用户终端、服务器、***及存储介质
Terbu et al. One mobile ID to secure physical and digital Identity
KR101879842B1 (ko) Otp를 이용한 사용자 인증 방법 및 시스템
CN106385318A (zh) 基于椭圆方程的sdk验证方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22923240

Country of ref document: EP

Kind code of ref document: A1