A two-dimensional code payment method and a two-dimensional code payment system

Abstract

The application relates to a two-dimensional code payment method and a two-dimensional code payment system. The method comprises the following steps: a mobile terminal generates a payment request and sends the payment request to a payment server; the mobile terminal generates a pair of public and private keys based on the payment request, and the payment server generates a first token based on the payment request; the mobile terminal acquires a public key of a merchant server and generates a first payment code based on the pair of public and private keys, the first token and the public key of the merchant server, and displays the first payment code; a merchant POS terminal acquires the first payment code and sends first ciphertext information together with payment information to the merchant server; the merchant server decrypts the first ciphertext information by using a private key of the merchant server to obtain the first token, and performs primary verification based on the obtained first token and geographical position information by the payment server; in the case that the verification is unsuccessful, a second token is generated, and similar secondary verification is performed based on the second token. Through the secondary verification, the risk of the two-dimensional code being stolen and used can be effectively reduced.

Description

Technical Field

[0002] This invention relates to mobile payment technology, and more specifically, to a QR code payment method and a QR code payment system. Background Technology

[0003] In the current mobile payment ecosystem, QR code payments are mainly divided into active scanning and passive scanning modes. The mainstream passive scanning mode generally incorporates a dynamic token mechanism, where the backend server generates a time-sensitive barcode or QR code based on a specific algorithm, typically with an expiration period of 60 seconds or less. This mechanism, to some extent, prevents the risk of static images being misused for extended periods. However, this security mechanism based on a "time window" has inherent logical flaws.

[0004] The fundamental flaw in existing technology lies in the fact that anyone holding a copy of the token can initiate a transaction as long as it remains valid. This means that if a user opens their payment code while waiting in line to pay, and is then secretly photographed or recorded by criminals using a telephoto lens, or if the user's mobile device is unfortunately infected with malware capable of taking screenshots, an attacker can obtain a valid image of the payment code. In the tens of seconds before the token expires, an attacker has the complete capability to deduct funds remotely using technical means, causing the user to suffer financial losses. This type of risk is known as "screen sharing attack" or "remote skimming."

[0005] On the other hand, besides the risks on the user side, there are also certain risks associated with the merchant terminal. For example, in existing technologies, it is common for a POS terminal to arbitrarily change the merchant ID through software configuration (i.e., "code skipping" or "code manipulation"), which leads to distorted transaction information and makes it difficult to track money laundering and other illegal activities. Therefore, how to ensure the immutable physical binding between the POS terminal and the merchant's identity from the technical level is another major problem that existing payment systems urgently need to solve. Summary of the Invention

[0006] In order to solve the problems in the prior art, the present invention aims to provide a QR code payment method and a QR code payment system that can improve the security of QR code payment.

[0007] The QR code payment method of this invention is implemented through a mobile terminal, a merchant POS terminal, a merchant server, and a payment server, and includes the following steps: In the request step, the mobile terminal generates a payment request and sends it to the payment server; The key generation step involves generating a public-private key pair based on the payment request mobile terminal. The first token generation step involves the payment server generating a first token based on the payment request and returning the first token to the mobile terminal. The public key acquisition steps involve the mobile terminal obtaining the merchant's server public key from the merchant's POS terminal. In the first encryption step, the mobile terminal generates first ciphertext information based on the pair of public and private keys, the first token, and the merchant server's public key, and generates a first payment code based on the first ciphertext information. In the first display step, the mobile terminal displays the first payment code; In the first sending step, the merchant's POS terminal obtains the first payment code and sends the first encrypted information in the first payment code together with the payment information to the merchant's server. In the first decryption step, the merchant server uses its private key to decrypt the first ciphertext information to obtain the first token, and then sends the decrypted first token and the payment information to the payment server; and In the initial verification step, the payment server performs an initial verification based on the first token obtained through decryption.

[0008] Optionally, the first payment code may further include the geographical location information of the mobile terminal. In the first sending step, the merchant POS terminal further sends the geographical location information of the mobile terminal in the first payment code to the merchant server. In the first decryption step, the merchant server uses its private key to decrypt the second ciphertext information to obtain the first token, and then sends the decrypted first token, payment information, and the geographical location information of the mobile terminal to the payment server. In the initial verification step, the payment server performs the initial verification based on the decrypted first token and the geographical location information of the mobile terminal. In the event of initial verification failure, the QR code payment method further includes the following steps: In the second token generation step, the payment server generates a corresponding second token based on the first token and sends it to the mobile terminal. In the second encryption step, the mobile terminal obtains the second ciphertext information based on the merchant server's public key, the pair of public and private keys, and the second token, and generates a second payment code based on the second ciphertext information. In the second display step, the mobile terminal displays the second payment code; In the second sending step, the merchant POS terminal obtains the second payment code and sends the second encrypted information in the second payment code together with the payment information to the merchant server. In the second decryption step, the merchant server uses its private key to decrypt the second encrypted information, obtaining the second token and the payment information, and then sends them to the payment server; and The second verification step involves the payment server performing a second verification based on the decrypted second token, and executing the payment action if the second verification is successful.

[0009] Optionally, the public and private keys include a mobile terminal private key and a mobile terminal public key. In the first encryption step, the mobile terminal uses its private key to encrypt the first token and uses the merchant server's public key to encrypt the mobile terminal's public key to obtain the first ciphertext information. In the second encryption step, the mobile terminal uses the mobile terminal private key to encrypt the second token and uses the merchant server public key to encrypt the mobile terminal public key to obtain the second ciphertext information.

[0010] Optionally, in the public key acquisition step, the mobile terminal obtains the merchant server public key from the merchant POS terminal via near-field communication.

[0011] Optionally, the payment server pre-stores the binding relationship between the merchant server's public key and the merchant serial number used to uniquely identify the merchant's POS terminal. The payment information includes a merchant serial number. In the secondary verification step, the payment server performs secondary verification based on the decrypted second token and the merchant serial number in the payment information.

[0012] Optionally, in the second token generation step, the payment server transforms the first token based on a timestamp and / or the payment server's private key to generate a second token.

[0013] Optionally, the mobile terminal has a main screen and a rear screen. The first display step includes: displaying the first payment code on the main screen and triggering the display of the first payment code on the back screen based on the detection of a first preset action. The second display step includes: displaying the second payment code on the main screen and triggering the display of the second payment code on the rear screen based on the detection of a second preset action.

[0014] Optionally, the first preset action and the second preset action are the same action.

[0015] Optionally, the first preset action and the second preset action are different actions.

[0016] Optionally, the first preset action and the second preset action are selected from the following actions: The action of shaking a mobile device; Actions that obstruct the front-facing camera of a mobile device.

[0017] Optionally, the shaking motion of the mobile terminal can be detected by a gyroscope on the mobile terminal.

[0018] Optionally, the action of obstructing the front-facing camera of the mobile terminal can be detected by a light sensor, infrared sensor, or focus sensor on the mobile terminal.

[0019] The present invention discloses a QR code payment method implemented on a mobile terminal, which includes the following steps: The request step involves generating a payment request and sending it to the appropriate server. The key generation step involves generating a public-private key pair based on the payment request. First token receiving step: Receive the first token; Steps to obtain the public key: Obtain the merchant server's public key; The first encryption step involves generating first ciphertext information based on the public-private key pair, the first token, and the merchant server's public key, and then generating a first payment code based on the first ciphertext information; and In the first display step, the mobile terminal displays the first payment code.

[0020] Optionally, the first payment code may also include the geographical location information of the mobile terminal. The QR code payment method further includes the following steps: The second token receiving step involves receiving the second token. The second encryption step involves generating a second payment code based on the merchant server's public key, the pair of public and private keys, and the second token, and generating a second payment code based on the first ciphertext information. The second display step involves displaying the second payment code.

[0021] Optionally, the public and private keys include a mobile terminal private key and a mobile terminal public key. In the first encryption step, the mobile terminal uses its private key to encrypt the first token and uses the merchant server's public key to encrypt the mobile terminal's public key to obtain the first ciphertext information. In the second encryption step, the mobile terminal uses the mobile terminal private key to encrypt the second token and uses the merchant server public key to encrypt the mobile terminal public key to obtain the second ciphertext information.

[0022] Optionally, in the public key acquisition step, the mobile terminal acquires the merchant server's public key via near-field communication.

[0023] Optionally, the mobile terminal has a main screen and a rear screen. The first display step includes: displaying the first payment code on the main screen and triggering the display of the first payment code on the back screen based on the detection of a first preset action. The second display step includes: displaying the second payment code on the main screen and triggering the display of the second payment code on the rear screen based on the detection of a second preset action.

[0024] Optionally, the first preset action and the second preset action may be the same action or different actions.

[0025] Optionally, the first preset action and the second preset action are selected from the following actions: The action of shaking a mobile device; Actions that obstruct the front-facing camera of a mobile device.

[0026] Optionally, the shaking motion of the mobile terminal is detected by a gyroscope on the mobile terminal. The action of obstructing the front camera of the mobile terminal is detected by the light sensor, infrared sensor, or focus sensor of the mobile terminal.

[0027] According to one aspect of the present invention, a QR code payment system includes: a mobile terminal, a merchant POS terminal, a merchant server, and a payment server, wherein the mobile terminal includes: The near-field communication module is used to obtain the merchant server's public key from the merchant's POS terminal; A security module is used to generate a payment request and send it to a payment server, generate a public-private key pair based on the payment request, generate first encrypted information based on the public-private key pair, a first token generated by the payment server, and the merchant server's public key, and generate a first payment code based on the first encrypted information; and The display control module is used to display the first payment code. The merchant POS terminal is used to obtain the first payment code and send the first encrypted information in the first payment code, along with the payment information, to the merchant server. The merchant server is used to decrypt the first ciphertext information using its private key to obtain a first token, and then sends the decrypted first token and the payment information to the payment server. The payment server is used to generate a first token based on the payment request and return the first token to the mobile terminal, and perform initial verification based on the decrypted first token.

[0028] Optionally, the first payment code may also include the geographical location information of the mobile terminal. The payment server generates a corresponding second token based on the first token and sends it to the mobile terminal. The mobile terminal's security module obtains the second encrypted information based on the merchant server's public key, the pair of public and private keys, and the second token, and generates a second payment code based on the second encrypted information. The display control module is further used to display the second payment code. The payment server performs secondary verification based on the decrypted second token and executes the payment action if the secondary verification is successful.

[0029] A mobile terminal according to one aspect of the present invention, the mobile terminal having a main screen and a rear screen, further comprising: The near-field communication module is used to obtain the merchant's server public key via near-field communication. A security module is used to generate a payment request, generate a public-private key pair based on the payment request, generate first encrypted information based on the public-private key pair, a received first token, and the merchant server's public key, generate a first payment code based on the first encrypted information, and generate second encrypted information based on the public-private key pair, a received second token, and the merchant server's public key, and generate a second payment code based on the second encrypted information; and The display control module is used to display the first payment code and the second payment code. The display control module is configured as follows: Displaying the first payment code on the main screen and triggering the display of the first payment code on the rear screen based on the detection of a first preset action; and The second payment code is displayed on the main screen and triggered to be displayed on the back screen based on the detection of a second preset action.

[0030] Optionally, the first preset action and the second preset action may be the same action or different actions.

[0031] Optionally, the first preset action and the second preset action are selected from the following actions: The action of shaking a mobile device; Actions that obstruct the front-facing camera of a mobile device.

[0032] Optionally, the mobile terminal further includes: A light sensor module is used to detect actions that obstruct the front-facing camera of the mobile terminal; and The displacement detection module is used to detect the shaking motion of the mobile terminal.

[0033] The present invention provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the QR code payment method.

[0034] A computer device according to one aspect of the present invention includes a storage module, a processor, and a computer program stored on the storage module and executable on the processor, wherein the processor executes the computer program to implement the QR code payment method.

[0035] A computer program product according to one aspect of the present invention includes a computer program that, when executed by a processor, implements the QR code payment method.

[0036] As described above, the QR code payment method and QR code payment system of the present invention continuously display the payment code twice through the back screen of the mobile phone, which can reduce the risk of the payment code being stolen during the QR code payment process. Specifically, firstly, displaying the payment code through the back screen of the mobile phone reduces the possibility of being maliciously photographed during the display of the payment code on the main screen, and secondly, verifying the associated token of the second payment code reduces the payment risk after the payment code is maliciously stolen. Attached Figure Description

[0037] The described and other objects and advantages of the invention will become more fully clear from the following detailed description taken in conjunction with the accompanying drawings, wherein like or similar elements are denoted by the same reference numerals.

[0038] Figure 1 This is a flowchart illustrating a QR code payment method according to an embodiment of the present invention.

[0039] Figure 2 This is a flowchart illustrating a QR code payment method according to an embodiment of the present invention. Detailed Implementation

[0040] The following are some embodiments of the present invention, intended to provide a basic understanding of the invention. They are not intended to identify key or decisive elements of the invention or to limit the scope of protection sought.

[0041] For the purposes of brevity and illustrativeness, the principles of the invention are described herein primarily with reference to exemplary embodiments thereof. However, those skilled in the art will readily recognize that the same principles are equivalently applicable to all types of QR code payment methods and systems of the present invention, and that these same principles can be implemented therein, and that any such variations do not depart from the true spirit and scope of the invention.

[0042] Furthermore, reference is made in the following description to the accompanying drawings, which illustrate specific exemplary embodiments. Electrical, mechanical, logical, and structural modifications may be made to these embodiments without departing from the spirit and scope of the invention. Moreover, while features of the invention are disclosed in conjunction with only one of several embodiments, this feature may be combined with one or more other features of other embodiments if desired and / or advantageous for any given or identifiable function. Therefore, the following description should not be considered limiting in any sense, and the scope of the invention is defined by the appended claims and their equivalents.

[0043] Terms such as “possessing” and “comprising” indicate that, in addition to having units (modules) and steps that are directly and explicitly stated in the specification and claims, the technical solution of the present invention does not exclude the presence of other units (modules) and steps that are not directly or explicitly stated.

[0044] The QR code payment method of the present invention is implemented through a mobile terminal, a merchant POS terminal, a merchant server, and a payment server, and includes the following steps: In the request step, the mobile terminal generates a payment request and sends it to the payment server; The key generation step involves generating a public-private key pair based on the payment request mobile terminal. The first token generation step involves the payment server generating a first token based on the payment request and returning the first token to the mobile terminal. The public key acquisition steps involve the mobile terminal obtaining the merchant's server public key from the merchant's POS terminal. In the first encryption step, the mobile terminal generates first ciphertext information based on the pair of public and private keys, the first token, and the merchant server's public key, and generates a first payment code based on the first ciphertext information. The first payment code further includes the mobile terminal's geographical location information. In the first display step, the mobile terminal displays the first payment code; In the first sending step, the merchant POS terminal obtains the first payment code and sends the first encrypted information and geographical location information in the first payment code together with the payment information to the merchant server. In the first decryption step, the merchant server uses its private key to decrypt the first ciphertext information to obtain the first token, and then sends the decrypted first token, the payment information, and the geographical location information to the payment server; and In the initial verification step, the payment server performs an initial verification based on the decrypted first token and geographical location information, and continues the following steps if the initial verification fails; In the second token generation step, the payment server generates a corresponding second token based on the first token and sends it to the mobile terminal. In the second encryption step, the mobile terminal obtains the second ciphertext information based on the merchant server's public key, the pair of public and private keys, and the second token, and generates a second payment code based on the second ciphertext information. In the second display step, the mobile terminal displays the second payment code; In the second sending step, the merchant POS terminal obtains the second payment code and sends the second encrypted information in the second payment code together with the payment information to the merchant server. In the second decryption step, the merchant server uses its private key to decrypt the second encrypted information, obtaining the second token and the payment information, and then sends them to the payment server; and The second verification step involves the payment server performing a second verification based on the decrypted second token, and executing the payment action if the second verification is successful.

[0045] Thus, the security of payments is further enhanced through the two-factor authentication mechanism. Specifically, when the initial authentication fails, a second token is generated and a second authentication is performed, which effectively prevents the risk of mismatched geographical locations or stolen tokens and ensures the accurate execution of payment actions.

[0046] The public and private keys include the mobile terminal's private key and the mobile terminal's public key. In the first encryption step, the mobile terminal uses its private key to encrypt the first token and uses the merchant server's public key to encrypt the mobile terminal's public key to obtain the first ciphertext information. In the second encryption step, the mobile terminal uses the mobile terminal private key to encrypt the second token and uses the merchant server public key to encrypt the mobile terminal public key to obtain the second ciphertext information.

[0047] Therefore, by encrypting the token using the mobile terminal's private and public keys, the confidentiality and integrity of the token during transmission are ensured. Simultaneously, encrypting the mobile terminal's public key using the merchant server's public key further enhances the security of public key transmission, preventing the public key from being tampered with or replaced.

[0048] In the public key acquisition step, the mobile terminal obtains the merchant server public key from the merchant POS terminal via near-field communication.

[0049] Therefore, obtaining the merchant's server public key via near-field communication (NFC) simplifies the public key acquisition process and improves the user experience. At the same time, the security of NFC ensures that the public key is not stolen or tampered with during transmission.

[0050] Specifically, the payment server pre-stores the binding relationship between the merchant server public key and the merchant serial number used to represent the uniqueness of the merchant's POS terminal. The payment information includes the merchant serial number. In the secondary verification step, the payment server performs secondary verification based on the decrypted second token and the merchant serial number in the payment information.

[0051] By pre-storing the binding relationship between the merchant server's public key and the merchant's serial number in the payment server and including the merchant's serial number in the payment information, the payment server can verify the merchant's identity during secondary verification, preventing unauthorized merchants from accessing the system and enhancing the security of the payment process.

[0052] In the second token generation step, the payment server transforms the first token based on the timestamp and the payment server's private key to generate the second token.

[0053] The payment server transforms the first token based on the timestamp and the payment server's private key to generate a second token, which increases the complexity and unpredictability of the token, effectively preventing the token from being cracked or reused, and improving the security of the payment process.

[0054] The mobile terminal has a main screen and a back screen. The first display step includes: displaying the first payment code on the main screen and triggering the display of the first payment code on the back screen based on the detection of a first preset action. The second display step includes: displaying the second payment code on the main screen and triggering the display of the second payment code on the back screen based on the detection of a second preset action.

[0055] By utilizing the main screen and back screen of the mobile terminal, the payment code is displayed on the back screen when a preset action is detected, which reduces the risk of the payment code on the main screen being maliciously photographed, while improving the flexibility and convenience of user operation.

[0056] Wherein, the first preset action and the second preset action are the same action, or the first preset action and the second preset action are different actions. The first preset action and the second preset action are selected from the following actions: shaking the mobile terminal; blocking the front camera of the mobile terminal.

[0057] Therefore, by triggering the display of the payment code on the rear screen through preset actions such as shaking the mobile device or blocking the front-facing camera, users can choose from multiple operation methods, increasing the flexibility and convenience of user operation. At the same time, these actions also have a certain degree of concealment, reducing the risk of malicious observation and imitation.

[0058] The shaking motion of the mobile terminal is detected by its gyroscope. This gyroscope-based detection of the shaking motion enables accurate recognition of user actions. The gyroscope's high-precision detection capability ensures accurate identification of the shaking motion, preventing false or missed triggers and improving the stability and reliability of the payment process.

[0059] The action of obstructing the front-facing camera of the mobile terminal is detected by the light sensor, infrared sensor, or focus sensor of the mobile terminal.

[0060] Therefore, by detecting actions that obstruct the front-facing camera using light sensors, infrared sensors, or focus sensors, non-contact recognition of user operations is achieved. This detection method not only improves the convenience of user operation but also offers a degree of concealment, reducing the risk of malicious observation and imitation. Simultaneously, the precise detection capabilities of the sensors ensure accurate recognition of obstruction actions, enhancing the security of the payment process.

[0061] Figure 1 This is a flowchart illustrating a QR code payment method according to an embodiment of the present invention.

[0062] like Figure 1 As shown, the QR code payment method of one embodiment of the present invention mainly consists of the following five stages: initialization and security handshake stage S100; first display screen switching stage S200; initial verification and risk control verification stage S300; second display screen switching stage S400; and second verification and transaction execution stage S500. The steps 1 to 11 of the QR code payment method of one embodiment of the present invention will be described below in the order of these stages.

[0063] Phase 1: Initialization and Security Handshake Phase S100.

[0064] Step 1: The mobile terminal's security module sends a payment request to the payment server.

[0065] For example, as an implementation, a user unlocks their mobile device at the merchant's checkout counter, opens the "Wallet APP," and clicks the "Payment Code" function icon. The "Wallet APP" sends a token request to a remote payment server via the network, and the payment server generates and returns the initial transaction token (first token) to the mobile device.

[0066] Step 2: Key generation and near-field public key acquisition.

[0067] Sub-operation 2.1: The user's mobile terminal's security module (SE) responds to the payment request and dynamically creates a pair of asymmetric keys based on a specified algorithm, such as a random number generation algorithm: the mobile terminal's public key and the mobile terminal's private key.

[0068] Sub-operation 2.2: The user brings the mobile terminal close to the merchant's POS terminal to establish a near-field communication link through near-field communication technology (such as NFC, Bluetooth or infrared).

[0069] Sub-operation 2.3: The merchant POS terminal sends its pre-stored merchant server public key to the user's mobile terminal via a near-field communication link.

[0070] The technical advantage of step 2 is that it enables key preparation, ensuring that the public key required for encryption comes from a physically nearby real POS terminal, thus preventing remote fraudulent merchant scams.

[0071] Second stage: First display screen switching stage S200.

[0072] Step 3: Generate the first payment code using double encryption.

[0073] Sub-operation 3.1: The security module of the mobile terminal uses the aforementioned mobile terminal private key to encrypt the first token, generating an encrypted first token.

[0074] Sub-operation 3.2: The mobile terminal's security module uses the obtained merchant server public key to encrypt the mobile terminal's public key, generating an encrypted mobile terminal public key.

[0075] Sub-operation 3.3: The security module of the mobile terminal encodes the above two sets of ciphertext into a QR code graphic, that is, generates and displays the first payment code.

[0076] The technical advantage of step 3 is that even if the first payment code is intercepted, only the merchant server holding the corresponding private key can decrypt it, thus ensuring the targeted transmission of information.

[0077] Step 4: The first preset action triggers the first primary and backup screen switching display.

[0078] Specifically, when a user performs a first preset action (e.g., covering the front camera with their palm), the front camera of the mobile terminal detects that the ambient light sensor detects a significant decrease in brightness, the infrared sensor detects a significant decrease in reflection time, or the focus sensor detects an abnormally close focus distance and no obvious image texture. When one or more such sensor information is generated, the sensor module of the mobile terminal transmits this sensor information to the processor of the mobile terminal. After receiving the sensor information, the processor of the mobile terminal instructs the display driver module to turn off the main screen display (screen off) and simultaneously turn on the back screen and render and display the first payment code.

[0079] The technical advantage of step 4 is that it can display the payment code on the back screen where it is not easy for others to take pictures, which can effectively prevent physical privacy.

[0080] Phase 3: Initial verification and risk control verification phase S300.

[0081] Step 5: The merchant's POS terminal decrypts the first token and sends it up.

[0082] Specifically, the merchant's POS terminal scans the first payment code displayed on the back screen to obtain encrypted data. This data, along with payment information such as the payee's account, payee's account, payment amount, and merchant ID, is then sent to the merchant server. The merchant server uses its private key to decrypt the mobile terminal's public key, which is encrypted using the merchant server's public key. After obtaining the mobile terminal's public key, it uses the mobile terminal's public key to decrypt the first token, which is encrypted using the mobile terminal's private key, to obtain the first token. The first token, along with the payee's account, payee's account, payment amount, merchant ID, and merchant server's public key, is then sent to the payment server for payment processing.

[0083] The technical effect of step 5 is to complete the secure flow of data and the initial verification of the merchant's identity.

[0084] Step 6: Payment server risk control assessment.

[0085] Specifically, the payment server receives the request and compares the location of the mobile terminal with the location of the merchant's POS terminal (the location information of the merchant's POS terminal is pre-stored in the payment server). If the locations are inconsistent (or if other risk control rules are triggered), it is determined to be a risky transaction and enters the secondary verification process.

[0086] The technical effect of step 6 is that it can block suspicious transactions in real time and trigger a higher level of verification mechanism when the prescribed risk control rules are triggered.

[0087] Fourth stage: Second display screen switching stage S400.

[0088] Step 7: Token transformation and distribution.

[0089] Specifically, the payment server generates a second token based on the first token, the timestamp, and the payment server's private key, and sends a secondary verification request to the user's mobile terminal's security module.

[0090] The technical effect of step 7 is that dynamically generating a second token associated with the first token ensures the timeliness and uniqueness of the verification.

[0091] Step 8: User confirmation and generation of the second payment code.

[0092] Specifically, after receiving the secondary verification request, the security module of the user's mobile terminal confirms the secondary verification request on the main screen of the mobile terminal. The security module obtains the second token. Similarly, the security module encrypts the second token to generate a second payment code (the encryption method of the second token is the same as that of the first token) and displays the second payment code on the main screen.

[0093] Step 9: The second preset action triggers the second main and backup screen switching display.

[0094] Specifically, the user performs a second preset action, such as shaking the mobile terminal. After the mobile terminal's gyroscope detects the displacement, it triggers the main screen switch again, that is, the second payment code is displayed on the back screen and the main screen is turned off.

[0095] The technical effect of step 9 is that displaying payment on the back screen can reduce the risk of being maliciously photographed while the payment code is displayed on the main screen, and can also reconfirm the payment intention through the user's physical actions.

[0096] Phase 5: Secondary Verification and Transaction Execution Phase S500.

[0097] Step 10: The merchant's POS terminal decrypts the second token and sends it up.

[0098] The merchant's POS terminal scans the second payment code on the back screen of the mobile terminal to obtain the second token and other payment information, and sends it to the merchant's server. The merchant's server decrypts the second token (in the same way as the first token, so it will not be described again), and sends the second token, the merchant's server public key, the merchant number, and other payment information to the payment server.

[0099] Step 11: Secondary verification and payment execution.

[0100] The payment server obtains the second token and decrypts it using its public key to obtain the first token'. It then determines whether the first token' matches the first token in the first payment code and whether the merchant server's public key matches the merchant number. If they match, the payment process is complete.

[0101] As described above, according to the QR code payment method of the present invention, when the risk control system of the payment server detects a potential risk (such as a mismatch in geographical location), it will not directly reject the payment, but will instead initiate a secondary verification process. This secondary verification process can effectively prevent the risk of QR code theft.

[0102] Furthermore, the QR code payment method of the present invention breaks through the limitations of traditional single-screen display and creatively utilizes the characteristics of mobile terminals with a main screen and a back screen. Once triggered by a preset action, the display will be switched immediately, for example, the main screen facing the user will be turned off and the back screen facing the outside will be activated to display the payment code. This screen switching display mechanism can ensure that the payment code is displayed on the back screen most of the time, thereby greatly increasing the difficulty of malicious theft such as taking photos secretly.

[0103] Furthermore, at the cryptographic level, a higher level of security can be provided through double asymmetric encryption and token association. For example, the mobile terminal uses a built-in security unit to generate a temporary mobile terminal public key and a mobile terminal private key. The security unit, namely the SE chip, has physical tamper-proof characteristics, thereby ensuring that the private key cannot be extracted by Trojans at the operating system level. At the same time, the information contained in the payment code is not the original token, but ciphertext encrypted with two layers: The first layer of encryption: the original payment token (first Token1) is signed using the mobile terminal's private key. This ensures that the token can only be decrypted by the entity holding the corresponding mobile terminal public key, and proves the authenticity of the token's source (non-repudiation); The second layer of encryption: the mobile terminal's public key is encrypted using the merchant server's public key. This ensures that only the legitimate merchant system holding the corresponding merchant server's private key can decrypt it and obtain the mobile terminal's public key.

[0104] On the other hand, the merchant POS terminal stores the merchant server's public key, which is strictly bound to the merchant POS terminal's device serial number (SN). During payment interaction, the mobile terminal obtains the public key from the merchant POS terminal via NFC or Bluetooth. If the public key uploaded in the payment request does not match the merchant number recorded in the background, the payment server will directly reject the transaction.

[0105] Figure 2 This is a structural block diagram illustrating a QR code payment system according to an embodiment of the present invention.

[0106] like Figure 2 As shown, a QR code payment system according to an embodiment of the present invention includes: a mobile terminal 100, a merchant POS terminal 200, a merchant server 300, and a payment server 400.

[0107] The mobile terminal 100 includes: The near-field communication module 110 is used to obtain the merchant server public key from the merchant POS terminal; Security module 120 is used to generate a payment request and send it to a payment server, generate a public-private key pair based on the payment request, generate first encrypted information based on the public-private key pair, a first token generated by the payment server, and the merchant server's public key, generate a first payment code based on the first encrypted information, obtain second encrypted information based on the merchant server's public key, the public-private key pair, and the second token, and generate a second payment code based on the second encrypted information; and Display control module 130 is used to display the first payment code and the second payment code; The light sensor module 140 is used to detect actions that obstruct the front-facing camera of the mobile terminal; The displacement detection module 150 is used to detect the shaking motion of the mobile terminal.

[0108] Merchant POS terminal 200 is used to obtain a first payment code and send the first encrypted information in the first payment code, along with payment information, to merchant server 300. Merchant server 300 is used to decrypt the first encrypted information using merchant server private key to obtain a first token and send the decrypted first token and the payment information to payment server 400.

[0109] The payment server 400 is used to generate a first token based on a payment request and return the first token to the mobile terminal, and to perform initial verification based on the decrypted first token. It is also used to generate a second token based on a secondary verification request and return the second token to the mobile terminal, and to perform secondary verification based on the decrypted second token. If the secondary verification is successful, the payment action is executed.

[0110] The light sensor module 140 includes, but is not limited to, an ambient light sensor, an infrared sensor, and a focus sensor. The displacement detection module 150 includes, but is not limited to, a gyroscope.

[0111] The display control module 130 is configured as follows: Displaying the first payment code on the main screen and triggering the display of the first payment code on the rear screen based on the detection of a first preset action; and The second payment code is displayed on the main screen and triggered to be displayed on the back screen based on the detection of a second preset action.

[0112] The first preset action and the second preset action may be the same action or different actions.

[0113] The first preset action and the second preset action are selected from the following actions: The action of shaking a mobile device; Actions that obstruct the front-facing camera of a mobile device.

[0114] As described above, the mobile terminal can detect a first preset action (such as a user blocking the front camera) by calling its light sensor module (such as an ambient light sensor, an infrared sensor, or a focus sensor), and can also call its displacement detection module (such as a gyroscope) to detect a second preset action (such as shaking the mobile terminal). By detecting the first preset action and the second preset action, the first screen display switch and the second screen display switch are triggered respectively, which can reduce the possibility of being maliciously photographed while the payment code is displayed on the main screen.

[0115] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Those skilled in the art can conceive of other feasible variations or substitutions based on the technical scope disclosed in the present invention, and such variations or substitutions are all covered within the scope of protection of the present invention. In the absence of conflict, the embodiments of the present invention and the features thereof can also be combined with each other. The scope of protection of the present invention is determined by the claims.

Claims

1. A QR code payment method, characterized in that, This is achieved through mobile terminals, merchant POS terminals, merchant servers, and payment servers, including the following steps: In the request step, the mobile terminal generates a payment request and sends it to the payment server; The key generation step involves generating a public-private key pair based on the payment request mobile terminal. The first token generation step involves the payment server generating a first token based on the payment request and returning the first token to the mobile terminal. The public key acquisition steps involve the mobile terminal obtaining the merchant's server public key from the merchant's POS terminal. In the first encryption step, the mobile terminal generates first ciphertext information based on the pair of public and private keys, the first token, and the merchant server's public key, and generates a first payment code based on the first ciphertext information. In the first display step, the mobile terminal displays the first payment code; In the first sending step, the merchant's POS terminal obtains the first payment code and sends the first encrypted information in the first payment code together with the payment information to the merchant's server. In the first decryption step, the merchant server uses its private key to decrypt the first ciphertext information to obtain the first token, and then sends the decrypted first token and the payment information to the payment server; and In the initial verification step, the payment server performs an initial verification based on the first token obtained through decryption.

2. The QR code payment method as described in claim 1, characterized in that, The first payment code further includes the geographical location information of the mobile terminal. In the first sending step, the merchant POS terminal further sends the geographical location information of the mobile terminal in the first payment code to the merchant server. In the first decryption step, the merchant server uses its private key to decrypt the second ciphertext information to obtain the first token, and then sends the decrypted first token, payment information, and the geographical location information of the mobile terminal to the payment server. In the initial verification step, the payment server performs the initial verification based on the decrypted first token and the geographical location information of the mobile terminal. In the event of initial verification failure, the QR code payment method further includes the following steps: In the second token generation step, the payment server generates a corresponding second token based on the first token and sends it to the mobile terminal. In the second encryption step, the mobile terminal obtains the second ciphertext information based on the merchant server's public key, the pair of public and private keys, and the second token, and generates a second payment code based on the second ciphertext information. In the second display step, the mobile terminal displays the second payment code; In the second sending step, the merchant POS terminal obtains the second payment code and sends the second encrypted information in the second payment code together with the payment information to the merchant server. In the second decryption step, the merchant server uses its private key to decrypt the second encrypted information, obtaining the second token and the payment information, and then sends them to the payment server; and The second verification step involves the payment server performing a second verification based on the decrypted second token, and executing the payment action if the second verification is successful.

3. The QR code payment method as described in claim 2, characterized in that, Its features are, The public and private keys include the mobile terminal's private key and the mobile terminal's public key. In the first encryption step, the mobile terminal uses its private key to encrypt the first token and uses the merchant server's public key to encrypt the mobile terminal's public key to obtain the first ciphertext information. In the second encryption step, the mobile terminal uses the mobile terminal private key to encrypt the second token and uses the merchant server public key to encrypt the mobile terminal public key to obtain the second ciphertext information.

4. The QR code payment method as described in claim 2, characterized in that, In the public key acquisition step, the mobile terminal obtains the merchant server public key from the merchant POS terminal via near-field communication.

5. The QR code payment method as described in claim 4, characterized in that, The payment server pre-stores the binding relationship between the merchant server's public key and the merchant serial number used to uniquely identify the merchant's POS terminal. The payment information includes a merchant serial number. In the secondary verification step, the payment server performs secondary verification based on the decrypted second token and the merchant serial number in the payment information.

6. The QR code payment method as described in claim 4, characterized in that, In the second token generation step, the payment server transforms the first token based on a timestamp and / or the payment server's private key to generate a second token.

7. The QR code payment method as described in claim 6, characterized in that, Its features are, The mobile terminal has a main screen and a rear screen. The first display step includes: displaying the first payment code on the main screen and triggering the display of the first payment code on the back screen based on the detection of a first preset action. The second display step includes: displaying the second payment code on the main screen and triggering the display of the second payment code on the rear screen based on the detection of a second preset action.

8. The QR code payment method as described in claim 7, characterized in that, Its features are, The first preset action and the second preset action are the same action.

9. The QR code payment method as described in claim 7, characterized in that, Its features are, The first preset action and the second preset action are different actions.

10. The QR code payment method as described in claim 8 or 9, characterized in that, Its features are, The first preset action and the second preset action are selected from the following actions: The action of shaking a mobile device; Actions that obstruct the front-facing camera of a mobile device.

11. The QR code payment method as described in claim 10, characterized in that, Its features are, The shaking motion of the mobile terminal was detected by the gyroscope on the mobile terminal.

12. The QR code payment method as described in claim 10, characterized in that, Its features are, The action of obstructing the front camera of the mobile terminal is detected by the light sensor, infrared sensor, or focus sensor of the mobile terminal.

13. A QR code payment method, characterized in that, This QR code payment method is implemented on a mobile terminal and includes the following steps: The request step involves generating a payment request and sending it to the appropriate server. The key generation step involves generating a public-private key pair based on the payment request. First token receiving step: Receive the first token; Steps to obtain the public key: Obtain the merchant server's public key; The first encryption step involves generating first ciphertext information based on the public-private key pair, the first token, and the merchant server's public key, and then generating a first payment code based on the first ciphertext information; and In the first display step, the mobile terminal displays the first payment code.

14. The QR code payment method as described in claim 13, characterized in that, The first payment code also includes the mobile terminal's geographic location information. The QR code payment method further includes the following steps: The second token receiving step involves receiving the second token. The second encryption step involves generating a second payment code based on the merchant server's public key, the pair of public and private keys, and the second token, and generating a second payment code based on the first ciphertext information. The second display step involves displaying the second payment code.

15. The QR code payment method as described in claim 14, characterized in that, Its features are, The public and private keys include the mobile terminal's private key and the mobile terminal's public key. In the first encryption step, the mobile terminal uses its private key to encrypt the first token and uses the merchant server's public key to encrypt the mobile terminal's public key to obtain the first ciphertext information. In the second encryption step, the mobile terminal uses the mobile terminal private key to encrypt the second token and uses the merchant server public key to encrypt the mobile terminal public key to obtain the second ciphertext information.

16. The QR code payment method as described in claim 15, characterized in that, In the public key acquisition step, the mobile terminal obtains the merchant server's public key via near-field communication.

17. The QR code payment method as described in claim 16, characterized in that, Its features are, The mobile terminal has a main screen and a rear screen. The first display step includes: displaying the first payment code on the main screen and triggering the display of the first payment code on the back screen based on the detection of a first preset action. The second display step includes: displaying the second payment code on the main screen and triggering the display of the second payment code on the rear screen based on the detection of a second preset action.

18. The QR code payment method as described in claim 7, characterized in that, Its features are, The first preset action and the second preset action are either the same action or different actions.

19. The QR code payment method as described in claim 18, characterized in that, Its features are, The first preset action and the second preset action are selected from the following actions: The action of shaking a mobile device; Actions that obstruct the front-facing camera of a mobile device.

20. The QR code payment method as described in claim 19, characterized in that, The shaking motion of the mobile terminal is detected by the gyroscope on the mobile terminal. The action of obstructing the front camera of the mobile terminal is detected by the light sensor, infrared sensor, or focus sensor of the mobile terminal.

21. A QR code payment system, the QR code payment system comprising: The mobile terminal, merchant POS terminal, merchant server, and payment server are characterized in that, The mobile terminal includes: The near-field communication module is used to obtain the merchant server's public key from the merchant's POS terminal; A security module is used to generate a payment request and send it to a payment server, generate a public-private key pair based on the payment request, generate first encrypted information based on the public-private key pair, a first token generated by the payment server, and the merchant server's public key, and generate a first payment code based on the first encrypted information; and The display control module is used to display the first payment code. The merchant POS terminal is used to obtain the first payment code and send the first encrypted information in the first payment code, along with the payment information, to the merchant server. The merchant server is used to decrypt the first ciphertext information using its private key to obtain a first token, and then sends the decrypted first token and the payment information to the payment server. The payment server is used to generate a first token based on the payment request and return the first token to the mobile terminal, and perform initial verification based on the decrypted first token.

22. The QR code payment system as described in claim 21, characterized in that, The first payment code also includes the mobile terminal's geographic location information. The payment server generates a corresponding second token based on the first token and sends it to the mobile terminal. The mobile terminal's security module obtains the second encrypted information based on the merchant server's public key, the pair of public and private keys, and the second token, and generates a second payment code based on the second encrypted information. The display control module is further used to display the second payment code. The payment server performs secondary verification based on the decrypted second token and executes the payment action if the secondary verification is successful.

23. A mobile terminal, characterized in that, The mobile terminal has a main screen and a rear screen, and further, the mobile terminal includes: The near-field communication module is used to obtain the merchant's server public key via near-field communication. A security module is used to generate a payment request, generate a public-private key pair based on the payment request, generate first encrypted information based on the public-private key pair, a received first token, and the merchant server's public key, generate a first payment code based on the first encrypted information, and generate second encrypted information based on the public-private key pair, a received second token, and the merchant server's public key, and generate a second payment code based on the second encrypted information; and The display control module is used to display the first payment code and the second payment code. The display control module is configured as follows: Displaying the first payment code on the main screen and triggering the display of the first payment code on the rear screen based on the detection of a first preset action; and The second payment code is displayed on the main screen and triggered to be displayed on the back screen based on the detection of a second preset action.

24. The mobile terminal as described in claim 23, characterized in that, The first preset action and the second preset action may be the same action or different actions.

25. The mobile terminal as described in claim 24, characterized in that, The first preset action and the second preset action are selected from the following actions: The action of shaking a mobile device; Actions that obstruct the front-facing camera of a mobile device.

26. The mobile terminal as described in claim 25, characterized in that, The mobile terminal further includes: A light sensor module is used to detect actions that obstruct the front-facing camera of the mobile terminal; and The displacement detection module is used to detect the shaking motion of the mobile terminal.

27. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the QR code payment method according to any one of claims 1 to 20.

28. A computer device comprising a storage module, a processor, and a computer program stored on the storage module and executable on the processor, characterized in that, When the processor executes the computer program, it implements the QR code payment method according to any one of claims 1 to 20.

29. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the QR code payment method according to any one of claims 1 to 20.

Images