Transaction processing method, system, device, electronic device and storage medium

Abstract

The present disclosure provides a transaction processing method, device, electronic device and medium for a first service end, which relates to the field of information security or the financial field, etc. The transaction processing method includes: receiving a transaction request sent by a first user end among N user ends, wherein the transaction request includes at least one of transaction data and a digital certificate; sending the transaction request to a transaction verification service end among M second service ends, so that the transaction verification service end outputs a verification result based on the transaction request, wherein N and M are integers greater than or equal to 1; and obtaining the verification result and sending it to the first user end, so that the first user end performs transaction processing based on the verification result. The present disclosure also provides a transaction processing method, device, electronic device and medium for a user end.

Description

Technical Field

[0001] The present disclosure relates to the field of information security or finance, and more specifically to a transaction processing method, system, device, equipment, medium and program product. Background Art

[0002] In the process of transaction processing, the identity of the transaction party is usually confirmed first to ensure the security of the transaction. For example, when a user of a financial institution initiates a transaction such as registration, transfer, loan or purchase of financial products, the financial institution will first confirm the identity of the user and then process the transaction after the user's identity is confirmed.

[0003] In the related art, financial institutions may directly interact with the user end used by the user through multiple servers to confirm the user's identity. For example, the multiple servers include a server for generating keys for users, a server for applying for digital certificates, a server for managing digital certificates, or a server for verifying passwords.

[0004] In the process of implementing the concept of the present disclosure, the inventors found that there are at least the following problems in the prior art:

[0005] Financial institutions have a large number of users. The above-mentioned multiple servers generally perform the same functional interaction process with multiple user terminals to achieve the purpose of confirming the identity of the corresponding user. However, multiple servers may be implemented based on different technical architectures, and there are differences in interaction methods, communication formats, etc. In the process of interacting with multiple user terminals, repeated system construction work is added, and the reusability of the interaction function is low. Summary of the invention

[0006] In view of the above problems, the present disclosure provides a transaction processing method, apparatus, device, medium and program product that improves the reusability of functions and avoids the problem of duplicate system construction.

[0007] One aspect of an embodiment of the present disclosure provides a transaction processing method for a first server, comprising: receiving a transaction request sent by a first user terminal among N user terminals, wherein the transaction request includes at least one of transaction data and a digital certificate; sending the transaction request to a transaction verification server among M second server terminals, so that the transaction verification server outputs a verification result based on the transaction request, wherein N and M are integers greater than or equal to 1; and obtaining the verification result and sending it to the first user terminal, so that the first user terminal performs transaction processing based on the verification result.

[0008] According to an embodiment of the present disclosure, the M second service ends include a cloud certificate service end, the transaction data includes transaction information and a first signature component, the first signature component is obtained by the first user end signing the transaction information based on a first private key component, wherein, before sending the transaction request to the transaction verification service end, the method further includes: sending the transaction data to the cloud certificate service end so that the cloud certificate service end signs the transaction data based on the second private key component to obtain a second signature component; receiving the second signature component sent by the cloud certificate service end; and obtaining a first transaction signature of the transaction data based on the first signature component and the second signature component.

[0009] According to an embodiment of the present disclosure, the M second service ends include a password verification service end, and before sending the transaction data to the cloud certificate server end, it also includes: receiving a user password sent by the first user end; sending the user password to the password verification service end, so that the password verification service end outputs a password verification result based on the user password; and when the password verification result is passed, determining to send the transaction data to the cloud certificate server end.

[0010] According to an embodiment of the present disclosure, when the verification result is a failure, the method further includes: obtaining a second transaction signature of the transaction data based on the first signature component and the second signature component; sending the transaction request to the cloud certificate server, so that the cloud certificate server outputs a verification result based on the transaction request, wherein the transaction request includes the second transaction signature; and obtaining the verification result and sending it to the first user terminal.

[0011] According to an embodiment of the present disclosure, before receiving the transaction request sent by the user terminal, it also includes: obtaining first user data of the first user terminal; and verifying the digital certificate based on the first user data and obtaining a verification result.

[0012] According to an embodiment of the present disclosure, the M second service ends include a cloud certificate service end. When the verification result is passed, the method further includes: sending a preprocessing request to the cloud certificate service end, so that the cloud certificate service end generates initialization data based on the preprocessing request; and obtaining the initialization data and sending it to the first user end, so that the first user end generates the transaction request based on the initialization data.

[0013] According to an embodiment of the present disclosure, the M second service ends include a cloud certificate service end, and before receiving the transaction request sent by the user end, it also includes: receiving a first request sent by the first user end, wherein the first request includes a first public key component; sending the first request to the cloud certificate service end, so that the cloud certificate service end generates public key information based on the first public key component; and sending the public key information to the first user end.

[0014] According to an embodiment of the present disclosure, the M second service terminals include a CA certification center, and the method also includes: receiving a second request sent by the first user terminal, wherein the second request includes second user data and the public key information; sending the second request to the CA certification center so that the CA certification center generates the digital certificate based on the second user data and the public key information; and obtaining the digital certificate sent by the CA certification center.

[0015] Another aspect of an embodiment of the present disclosure provides a transaction processing method applied to a first user terminal among N user terminals, comprising: sending a transaction request to a first server terminal, so that the first server terminal sends the transaction request to a transaction verification server terminal among M second server terminals, wherein the transaction request includes at least one of transaction data and a digital certificate, and N and M are integers greater than or equal to 1; receiving a verification result sent by the first server terminal, wherein the transaction verification server terminal outputs the verification result based on at least one of the transaction data and the digital certificate; and performing transaction processing based on the verification result.

[0016] According to an embodiment of the present disclosure, the first user terminal includes a first application, and the first application includes a signature verification station SDK. Before sending a transaction request to the first server, the method also includes: performing the following operations based on the first application to receive the user's transaction operation; and calling the signature verification station SDK in response to the transaction operation to obtain the transaction request through the signature verification station SDK.

[0017] Another aspect of the embodiment of the present disclosure provides a transaction processing system. The transaction processing system includes N user terminals, M second service terminals and a first service terminal, wherein N and M are integers greater than or equal to 1. Specifically, it includes: a first user terminal, wherein the N user terminals include the first user terminal, the first user terminal is used to send a transaction request, wherein the transaction request includes at least one of transaction data and a digital certificate; the first service terminal is used to receive the transaction request and send the transaction request to a transaction verification service terminal among the M second service terminals; the transaction verification service terminal is used to output a verification result based on the transaction request, so that the first service terminal sends the verification result to the first user terminal, and the first user terminal performs transaction processing based on the verification result.

[0018] Another aspect of the disclosed embodiment provides a transaction processing device for a first server, comprising: a request receiving module, a request forwarding module, and a verification forwarding module. The request receiving module is used to receive a transaction request sent by a first user terminal among N user terminals, wherein the transaction request includes at least one of transaction data and a digital certificate; the request forwarding module is used to send the transaction request to a transaction verification server among M second server terminals, so that the transaction verification server outputs a verification result based on the transaction request, wherein N and M are integers greater than or equal to 1; and the verification forwarding module is used to obtain the verification result and send it to the first user terminal, so that the first user terminal performs transaction processing based on the verification result.

[0019] Another aspect of the disclosed embodiment provides a transaction processing device for a first user terminal among N user terminals, comprising: a request sending module, a verification receiving module and a transaction processing module. The request sending module is used to send a transaction request to a first server terminal, so that the first server terminal sends the transaction request to a transaction verification server terminal among M second server terminals, wherein the transaction request includes at least one of transaction data and a digital certificate, wherein N and M are integers greater than or equal to 1; the verification receiving module is used to receive a verification result sent by the first server terminal, wherein the verification result is obtained by the transaction verification server terminal verifying the transaction request; and the transaction processing module is used to perform transaction processing based on the verification result.

[0020] Another aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method as described above.

[0021] Another aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method as described above.

[0022] Another aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0023] One or more of the above-mentioned embodiments have the following advantages or beneficial effects: it can at least partially solve the problems of a large amount of repetitive system construction work and low reusability of interactive functions, by receiving a transaction request sent by a user terminal, and sending the transaction request to a transaction verification server among M second servers, and sending the verification result to the user terminal after obtaining it, so that the user terminal performs transaction processing, thereby enabling N user terminals to interact with the first server, and M second servers to also interact with the first server, which can reduce repetitive system construction work and improve the reusability of interactive functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0025] Figure 1 The application scenario diagram of the transaction processing method according to the embodiment of the present disclosure is schematically shown;

[0026] Figure 2 A design flow chart of a transaction processing service according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 3 A flowchart of a transaction processing method for a first server according to an embodiment of the present disclosure is schematically shown;

[0028] Figure 4 A flowchart of sending public key information to a first user terminal according to an embodiment of the present disclosure is schematically shown;

[0029] Figure 5 Schematically shows a flow chart of obtaining a digital certificate according to an embodiment of the present disclosure;

[0030] Figure 6 Schematically shows a flow chart of verifying a digital certificate according to an embodiment of the present disclosure;

[0031] Figure 7 Schematically shows a flow chart of obtaining initialization data according to an embodiment of the present disclosure;

[0032] Figure 8A flowchart of a transaction processing method for a first server according to another embodiment of the present disclosure is schematically shown;

[0033] Fig. 9 A flowchart of verifying a user password according to an embodiment of the present disclosure is schematically shown;

[0034] Fig.10 A flowchart of checking a transaction request according to an embodiment of the present disclosure is schematically shown;

[0035] Fig.11 A flowchart of a transaction processing method for a first user terminal according to an embodiment of the present disclosure is schematically shown;

[0036] Fig.12 Schematically shows a flow chart of obtaining a transaction request according to an embodiment of the present disclosure;

[0037] Fig.13 The schematic diagram shows an architecture diagram of a transaction processing system according to an embodiment of the present disclosure;

[0038] Fig.14 Schematically shows an architecture diagram of a transaction processing system according to another embodiment of the present disclosure;

[0039] Fig.15A and Fig. 15B A flowchart schematically shows a transaction processing system providing a transaction processing service according to an embodiment of the present disclosure;

[0040] Fig.16 The structure block diagram of the transaction processing device for the first server according to the embodiment of the present disclosure is schematically shown;

[0041] Fig.17 A block diagram schematically shows a structure of a transaction processing device for a first user terminal according to an embodiment of the present disclosure; and

[0042] Fig.18 A block diagram of an electronic device suitable for implementing a transaction processing method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0043] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0044] Usually, the user's identity can be confirmed based on the user's private key signature and digital certificate. In the entire signing and verification process (for example, including verifying the user's private key signature and digital certificate), the CA certification center, transaction verification server, cloud certificate server or digital certificate management server also participate. At the same time, depending on the different levels of transaction security control, if necessary, password verification (such as static password, fingerprint recognition, face recognition) can be added during actual transaction authentication.

[0045] When different users use multiple client terminals, or one user uses multiple client terminals, if each client terminal interacts with multiple servers simultaneously, on the one hand, each client terminal is connected to multiple servers at the same time, and these servers may be implemented based on different technical architectures, and there are differences in interaction methods and communication formats, which will generate high work complexity for the development of the client terminal or the implementation of functions of each server terminal for the client terminal, system management, etc. On the other hand, when multiple client terminals initiate transaction operations and perform identity authentication, repeated system construction work is added, and the reusability of interactive functions is low.

[0046] The embodiment of the present disclosure provides a transaction processing method for a first server. The transaction processing method includes: receiving a transaction request sent by a first user terminal among N user terminals, wherein the transaction request includes at least one of transaction data and a digital certificate. Sending the transaction request to a transaction verification server among M second server terminals, so that the transaction verification server outputs a verification result based on the transaction request, wherein N and M are integers greater than or equal to 1. And obtaining the verification result and sending it to the first user terminal, so that the first user terminal performs transaction processing based on the verification result.

[0047] According to an embodiment of the present disclosure, by receiving a transaction request sent by a user terminal, and sending the transaction request to a transaction verification server among M second servers, and sending the verification result to the user terminal after obtaining it, so that the user terminal performs transaction processing, thereby enabling N user terminals to interact with the first server terminal, and M second servers to also interact with the first server terminal, it is possible to reduce repeated system construction work and improve the reusability of interactive functions.

[0048] It should be noted that the transaction processing method, device, system, and electronic device provided in the embodiments of the present disclosure can be used in the field of information security, and can also be used in various fields other than the field of information security, such as the financial field, etc. The application fields of the transaction processing method, device, system, and electronic device provided in the embodiments of the present disclosure are not limited.

[0049] In the technical solution disclosed in the present invention, the collection, storage, use, processing, transmission, provision or application of user personal information involved complies with the provisions of relevant laws and regulations, takes necessary confidentiality measures, and does not violate public order and good morals.

[0050] Figure 1 The application scenario diagram of the transaction processing method according to the embodiment of the present disclosure is schematically shown.

[0051] like Figure 1 As shown, the application scenario 100 according to this embodiment includes R terminal devices (e.g., 111, 112, ..., 11R), a first server 120, and S second servers (e.g., 131, 132, ..., 13S), where R and S are integers greater than or equal to 1. A network (not shown in the figure) can be used to provide a medium for a communication link between the R terminal devices and the first server 120, and a network can be used to provide a medium for a communication link between the first server 120 and the S second servers. The network can include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0052] Different users or one user uses any one or more of the R terminal devices to interact with the first server 120 through the network to receive or send messages, etc. Various communication client applications may be installed on each of the R terminal devices, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0053] The R terminal devices may be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0054] The first server 120 and the S second servers may be servers that provide various services, such as a background management server that provides support for websites browsed by users using the R terminal devices (only as an example). The background management server can analyze and process the received user request and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to the user request) to the terminal device.

[0055] According to an embodiment of the present disclosure, the N user terminals may be N terminal devices among the R terminal devices, and the first user terminal may be any terminal device. The N user terminals may also be N applications in any terminal device among the R terminal devices, and the first user terminal may be any application. The present disclosure does not limit this.

[0056] According to an embodiment of the present disclosure, the first server may be set in the first server 120, and the M second servers may be set in any one or more of the S second servers. For example, the first server is deployed in the first server 120, and the M second servers are deployed in M ​​servers of the S second servers.

[0057] In some embodiments of the present disclosure, the transaction processing method applied to the first service end can generally be executed by the first server 120. Accordingly, the transaction processing device applied to the first service end provided in the embodiments of the present disclosure can generally be arranged in the server 120. The transaction processing method applied to the first service end provided in the embodiments of the present disclosure can also be executed by a server or server cluster that is different from the server 120 and can communicate with R terminal devices and / or S second servers. Accordingly, the transaction processing device applied to the first service end provided in the embodiments of the present disclosure can also be arranged in a server or server cluster that is different from the server 120 and can communicate with R terminal devices and / or S second servers.

[0058] In some embodiments of the present disclosure, the transaction processing method applied to the user end can generally be executed by any terminal device. Accordingly, the transaction processing device applied to the user end provided by the embodiments of the present disclosure can generally be set in any terminal device.

[0059] It should be understood that Figure 1 The number of terminal devices, first servers and S second servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0060] First, in order to clearly explain the concept of the transaction processing method, device, system, equipment, medium and program product of the embodiment of the present disclosure, the following is based on Figure 1 The described scene, combined with Figure 2 The process of providing a fully functional closed-loop transaction processing service according to an embodiment of the present disclosure is described in detail.

[0061] Figure 2 The design flow chart of the transaction processing service according to the embodiment of the present disclosure is schematically shown.

[0062] like Figure 2 As shown, the full-function transaction processing service includes operations S210 to S250.

[0063] In operation S210, in response to the user's application for activation, the user terminal submits user-related information (such as user ID, personal information, device ID, etc.), applies for activation of a digital certificate, and performs a legitimacy check.

[0064] In operation S220, a key is generated. The user end and the second server end (eg, a cloud certificate server end among the M second servers) respectively generate public and private key pair components required to form a digital certificate, and store them in the user end and the second server end respectively.

[0065] To ensure the secure storage and use of public and private keys, for example, the key dispersion and collaborative signature technology of the national secret SM2 algorithm (for example only) can be used to generate public and private key pairs on the user side and the second server side respectively, that is, the complete public and private keys are split into several user-side components and server-side components. There is no direct logical relationship between the components, and other components cannot be deduced based on some components.

[0066] In operation S230, based on the generated key components, the user end and the second server end compose a complete public key and generate a corresponding digital certificate through a CA (Certificate Authority) certification center, which is then stored.

[0067] In operation S240, first, signature preprocessing is performed, and before initiating the transaction signature, the digital certificate availability check is performed and the signature initial value is obtained. Then, the transaction data is coordinated and signed to obtain the transaction signature.

[0068] In operation S250, the transaction request is submitted for transaction verification to confirm the legitimacy of the user's identity.

[0069] In operation S260, for a scenario where transaction verification fails, the first user end, the first service end, and the second service end are supported to perform verification and confirmation (eg, verification of digital certificates) in order to locate and analyze the problem.

[0070] The following will be based on Figure 1 The scene described by Figure 3 to Figure 12 The transaction processing method of the embodiment of the present disclosure is described in detail.

[0071] Figure 3 A flowchart of a transaction processing method for a first service end according to an embodiment of the present disclosure is schematically shown.

[0072] like Figure 3 As shown, the transaction processing method of the embodiment of the present disclosure includes operations S310 to S330.

[0073] In operation S310, a transaction request sent by a first user terminal among N user terminals is received, wherein the transaction request includes at least one of transaction data and a digital certificate.

[0074] According to the embodiments of the present disclosure, referring to Figure 1For example, a user initiates a payment operation using the terminal device 111 (i.e., the first user terminal) and may send a transaction request to the first server terminal in the form of a message. The transaction data in the transaction request may include information such as the payee information, the payee information, the payment amount, or the transaction subject.

[0075] In operation S320, the transaction request is sent to a transaction verification server among the M second servers, so that the transaction verification server outputs a verification result based on the transaction request (such as based on at least one of the transaction data and the digital certificate), where N and M are integers greater than or equal to 1.

[0076] In some embodiments of the present disclosure, a transaction request may include transaction data but not a digital certificate. For example, the digital certificate is stored in the first server, so that the first server can retrieve the corresponding digital certificate after receiving the transaction request and send the transaction request and the digital certificate together to the transaction verification server.

[0077] In other embodiments of the present disclosure, for example, when performing authentication operations that do not involve the transfer of property, the transaction request may include a digital certificate but not transaction data, so that the identity of the user can be confirmed by the transaction verification service end verifying the digital certificate.

[0078] In some other embodiments of the present disclosure, the transaction request may include transaction data and a digital certificate. The transaction request is then sent to the transaction verification service end for verification by the first service end.

[0079] In operation S330, a verification result is obtained and sent to the first user terminal, so that the first user terminal performs transaction processing based on the verification result.

[0080] In the related art, when a user uses the first user terminal to conduct a transaction, he may interact directly with M second service terminals, so that the financial institution can determine the identity of the user who initiated the transaction before processing the transaction. The M second service terminals may have different service architectures and communication rules. Therefore, whether one user terminal interacts with M second service terminals at the same time, or M second service terminals directly interact with N user terminals to provide identity authentication services, it is highly complex. For example, each transaction request sent by N user terminals may be encrypted, and different user terminals have different encryption rules. Then the M second service terminals may store multiple decryption tools or data in advance, so that different tools can be called for decryption during each identity confirmation process.

[0081] According to the embodiments of the present disclosure, referring to Figure 2, the first server can call M related interfaces of the second server based on each process according to the full-featured transaction processing service. When encapsulating and implementing the corresponding functions, the specific interaction details can be shielded from the user. It can also realize the information maintenance of the user's digital certificate, synchronously manage the status, activation time, validity period, etc. of the certificate, so as to facilitate the verification of the validity of the certificate during the use of the digital certificate.

[0082] According to the embodiments of the present disclosure, according to the needs of N user terminals to interact with the first server terminal, development can be performed based on the service architecture and communication rules of the party representing the first server terminal, without considering multiple servers as in the prior art. In addition, M second servers can be connected to the party representing the first server terminal without adding redundant system duplication work.

[0083] According to an embodiment of the present disclosure, by receiving a transaction request sent by a user terminal, and sending the transaction request to a transaction verification server among M second servers, and sending the verification result to the user terminal after obtaining it, so that the user terminal performs transaction processing, N user terminals interact with the first server, and M second servers also interact with the first server, the complexity can be reduced, repeated system construction work can be reduced, and the reusability of interactive functions can be improved.

[0084] Figure 4 The flowchart of sending public key information to the first user terminal according to an embodiment of the present disclosure is schematically shown.

[0085] like Figure 4 As shown, the embodiment of the present disclosure may send public key information to the first user terminal before operation S310, specifically including operations S410 to S430.

[0086] In operation S410, a first request sent by a first client is received, wherein the first request includes a first public key component.

[0087] In operation S420, a first request is sent to the cloud certificate server, so that the cloud certificate server generates public key information based on the first public key component.

[0088] According to an embodiment of the present disclosure, two independent parties can perform security processing in the transaction process based on the SM2 algorithm. First, the first user terminal and the cloud certificate service end each independently generate a private key component. Among them, the first user terminal generates a first public key component and a first private key component, and the cloud certificate service end first generates a second private key component. Then, after the cloud certificate service end receives the first public key component of the first user terminal, it generates complete public key information based on the first public key component and the second private key component.

[0089] In operation S430, the public key information is sent to the first client.

[0090] According to the embodiments of the present disclosure, the first user terminal and the cloud certificate server terminal each independently generate a private key component, and the first server terminal finally performs collaborative signing, which can ensure the security of the transaction.

[0091] Figure 5 The flowchart of obtaining a digital certificate according to an embodiment of the present disclosure is schematically shown.

[0092] like Figure 5 As shown, the embodiment of the present disclosure can obtain a digital certificate after operation S430, which specifically includes operations S510 to S530.

[0093] In operation S510, a second request sent by a first user terminal is received, wherein the second request includes second user data and public key information.

[0094] In operation S520, the second request is sent to the CA certification center, so that the CA certification center generates a digital certificate based on the second user data and the public key information.

[0095] In operation S530, a digital certificate sent by a CA certification center is obtained.

[0096] According to the embodiment of the present disclosure, after the first server obtains the digital certificate, it sends it to the first client. The first server can also manage the number of times and time for each client to obtain the digital certificate, thereby strengthening the security management of the transaction.

[0097] In some embodiments, the first server can store the digital certificate locally and create a digital certificate management file to store the correspondence between the data of different users (such as the device ID, user account or user information of the first user, etc.) and the digital certificate, so that the first server can provide certificate management functions and reduce the development work of the first user.

[0098] Figure 6 The flowchart of verifying a digital certificate according to an embodiment of the present disclosure is schematically shown.

[0099] like Figure 6 As shown, the embodiment of the present disclosure may perform availability verification on the digital certificate before operation S210, specifically including operations S610 to S620.

[0100] In operation S610, first user data of a first user terminal is obtained.

[0101] According to an embodiment of the present disclosure, the first user data may include a device ID, user personal information, or information of the first user terminal, etc.

[0102] In operation S620, the digital certificate is verified based on the first user data, and a verification result is obtained.

[0103] According to the embodiment of the present disclosure, after obtaining the first user data, the corresponding digital certificate can be called through the preset certificate management file. The information in the certificate management file is compared with the information in the digital certificate to verify the validity of the digital certificate, such as the validity period of the digital certificate, or the user's personal information (which can be dynamically updated) is compared with the corresponding information in the digital certificate. If the verification fails, there is no need to continue the transaction request, which improves the efficiency of transaction processing and reduces the pressure on the back end.

[0104] According to the embodiments of the present disclosure, referring to Figure 1 For example, if a user uses the same application in terminal devices 111 and 112, it is considered that the user uses two client terminals. Then the first server terminal can store the digital certificate information generated by the user in the two client terminals in the certificate management file.

[0105] In some embodiments, when the user uses the terminal device 111 to perform corresponding operations, if the digital certificate in the terminal device 111 expires, the digital certificate in the terminal device 112 can be called for use on the premise of confirming the user's personal information. In other embodiments, the number of times a user applies for a digital certificate can be managed to prevent abuse of system resources or prevent illegal personnel from attacking through multiple applications.

[0106] Figure 7 The flowchart of obtaining initialization data according to an embodiment of the present disclosure is schematically shown.

[0107] like Figure 7 As shown, after the digital certificate is verified and the verification result is passed, initialization data can be obtained through operations S710 to S720.

[0108] In operation S710, a preprocessing request is sent to a cloud certificate server, so that the cloud certificate server generates initialization data based on the preprocessing request.

[0109] In operation S720, initialization data is acquired and sent to the first user terminal, so that the first user terminal generates a transaction request based on the initialization data.

[0110] According to an embodiment of the present disclosure, for example, the initialization data may be signature auxiliary data generated by the cloud certificate server, and the first user terminal signs the transaction data based on the first private key component and the signature auxiliary data to obtain a transaction request. In some embodiments of the present disclosure, the pre-processing request may include information such as the transaction category, and the initialization data may be a transaction request instruction generated for the transaction category. The first user terminal generates a transaction request according to the instruction according to a preset corresponding rule. The present disclosure does not specifically limit the content of the initialization data.

[0111] Figure 8 A flowchart of a transaction processing method for a first server according to another embodiment of the present disclosure is schematically shown.

[0112] like Figure 8 As shown, the transaction processing method of the embodiment of the present disclosure may include operations S310 to S330, and before operation S320, may also include operations S810 to S830. The contents of operations S310 to S330 may refer to Figure 3 , which will not be elaborated here. In addition, the transaction data includes transaction information and a first signature component, and the first signature component is obtained by the first user terminal signing the transaction information based on the first private key component.

[0113] In operation S810, the transaction data is sent to the cloud certificate server, so that the cloud certificate server signs the transaction data based on the second private key component to obtain a second signature component.

[0114] According to an embodiment of the present disclosure, the first user terminal may first initiate a preprocessing request to obtain initialization data. The first user terminal signs the transaction data using the initialization data and the first private key component to obtain a first signature component.

[0115] In operation S820, a second signature component sent by the cloud certificate server is received.

[0116] In operation S830, a first transaction signature of the transaction data is obtained based on the first signature component and the second signature component.

[0117] According to an embodiment of the present disclosure, the transaction request sent to the transaction verification service end may include a digital certificate, transaction data, and a first transaction signature (the first signature component may no longer be included). For example, the transaction verification service end verifies the digital certificate, transaction data, and the first transaction signature at the same time. First, the signature of the CA certification center on the digital certificate is verified based on the public key information of the CA certification center. Then, the first transaction signature is verified using the public key information of the first user end. After all verifications are passed, the verification result is passed.

[0118] In some embodiments of the present disclosure, after the cloud certificate server signs the transaction data based on the second private key component to obtain the second signature component, it can directly perform the collaborative signing operation on behalf of the first server to obtain the first transaction signature, and finally return the first transaction signature to the first server.

[0119] According to the embodiment of the present disclosure, on the basis of the first user end and the cloud certificate server end storing the private key components respectively, during the signing process, the first user end and the cloud certificate server end interactively transmit the auxiliary signature tool to obtain the signature components respectively. Finally, the first server end performs the collaborative signature to obtain the first transaction signature. Thus, the security of transaction verification can be improved.

[0120] Fig. 9 The flowchart of verifying a user password according to an embodiment of the present disclosure is schematically shown.

[0121] like Fig. 9 As shown, the embodiment of the present disclosure may further verify the user password before operation S810, which specifically includes operations S910 to S930.

[0122] In operation S910, a user password sent by a first user terminal is received.

[0123] In operation S920, the user password is sent to the password verification service end, so that the password verification service end outputs a password verification result based on the user password.

[0124] In operation S930, when the password verification result is passed, it is determined to send the transaction data to the cloud certificate server.

[0125] According to the embodiments of the present disclosure, the password of the user is first verified, and the subsequent transaction processing flow is performed only after passing the verification, thereby improving the efficiency and security of transaction processing.

[0126] Fig.10 The flowchart of verifying a transaction request according to an embodiment of the present disclosure is schematically shown.

[0127] like Fig.10 As shown, when the verification result obtained in operation S310 is a failure, the embodiment of the present disclosure may perform operations S1010 to S1030 to check the consistency of the digital certificate.

[0128] In operation S1010, a second transaction signature of the transaction data is obtained based on the first signature component and the second signature component.

[0129] In operation S1020, the transaction request is sent to the cloud certificate server, so that the cloud certificate server outputs a verification result based on the transaction request, wherein the transaction request includes the second transaction signature.

[0130] In operation S1030, a verification result is obtained and sent to the first user terminal.

[0131] According to an embodiment of the present disclosure, for example, the first user terminal sends a verification application to the first server terminal, and the first server terminal may include transaction data, a first transaction signature, a second transaction signature, a digital certificate, and public key information of the first user terminal in the transaction request (for example, it can be retrieved by referring to operations S410 to S420).

[0132] On the one hand, the cloud certificate server can compare whether the second transaction signature is the same as the first transaction signature to detect problems in the collaborative signature stage. On the other hand, the cloud certificate server can use the same steps as the transaction verification server to verify the transaction request. For example, first, use the public key information of the CA certification center to verify the digital certificate. Then, compare the public key information of the first user end with the public key information recorded on the digital certificate. Then, when the first transaction signature is the same as the second transaction signature, use the public key information of the first user end to verify any transaction signature. Or when the first transaction signature is different from the second transaction signature, verify the two transaction signatures separately.

[0133] The cloud certificate server outputs the verification result by comparing or verifying the results of each of the above links, troubleshooting the existing problems, and finally, the first server sends the verification result to the first user terminal to help the user locate and analyze the problem.

[0134] Fig.11 A flowchart of a transaction processing method for a first user terminal according to an embodiment of the present disclosure is schematically shown.

[0135] like Fig.11 As shown, the transaction processing method of the embodiment of the present disclosure can be used for the first user terminal among N user terminals, and specifically includes operations S1110 to S1130.

[0136] In operation S1110, a transaction request is sent to the first server, so that the first server sends the transaction request to a transaction verification server among the M second servers, wherein the transaction request includes at least one of transaction data and a digital certificate, wherein N and M are integers greater than or equal to 1.

[0137] In operation S1120, a verification result sent by the first server is received, wherein the verification result is obtained by the transaction verification server verifying the transaction request.

[0138] In operation S1130, transaction processing is performed based on the verification result.

[0139] Fig.12The flowchart of obtaining a transaction request according to an embodiment of the present disclosure is schematically shown.

[0140] like Fig.12 As shown, before operation S1110 sends a transaction request to the first server, operations S1210 to S1220 may be performed based on the first application. The first client includes a first application, and the first application includes a signature verification SDK (Software Development Kit).

[0141] In operation S1210, a transaction operation of a user is received.

[0142] In operation S1220, the signature verification SDK is called in response to the transaction operation to obtain a transaction request through the signature verification SDK.

[0143] According to the embodiments of the present disclosure, the signature verification platform SDK is a development toolkit provided to third-party application software to realize user identity authentication in financial transactions, and supports one or more identity authentication methods, such as digital certificates, static passwords, fingerprints, SMS, media authentication, etc. Based on the ability of the signature verification platform SDK to output identity authentication usage functions to third parties (such as application developers), the development difficulty and technical threshold of promoting identity authentication services (such as digital certificate products) are reduced.

[0144] According to an embodiment of the present disclosure, the first application may further include a security SDK. The security SDK is used to be embedded in the first application using a digital certificate to provide support for functions such as public and private key generation, key storage, and transaction message signing of the first application.

[0145] In the disclosed embodiment, the signature verification SDK can have the same communication mode, calling method, etc. as the first server, and the security SDK can be embedded in the signature verification SDK. When the user uses the first application to perform a transaction, the first application calls the signature verification SDK, and then the signature verification SDK interacts with the security SDK and the first server. In addition to transaction data such as user personal information and transaction information, during the transaction operation, relevant information required for the use of digital certificates (such as hardware and APP information, etc.) can be obtained by calling the corresponding method of the signature verification SDK to simplify the development workload of the mobile application APP.

[0146] Based on the above transaction processing method, the present disclosure also provides a transaction processing system.

[0147] Fig.13 The architecture diagram of a transaction processing system 1300 according to an embodiment of the present disclosure is schematically shown.

[0148] like Fig.13As shown, the transaction processing system of the embodiment of the present disclosure may include N user terminals, M second service terminals and a first service terminal, wherein N and M are integers greater than or equal to 1. The details are as follows.

[0149] The first user terminal may be any one of user terminal 1, user terminal 2, ... user terminal N, and the first user terminal is used to send a transaction request, wherein the transaction request includes at least one of transaction data and a digital certificate. Each user terminal may be an application (App), and a security SDK is embedded in each application.

[0150] The first server is used to receive a transaction request and send the transaction request to a transaction verification server among the M second servers.

[0151] The transaction verification server is used to output a verification result based on the transaction request, so that the first server sends the verification result to the first user end, and the first user end performs transaction processing based on the verification result.

[0152] According to an embodiment of the present disclosure, the transaction processing system further includes a cloud certificate server. The cloud certificate server can be used to store a server-side key pair and perform corresponding signature calculations, etc. For example, the cloud certificate server is used to respond to a preprocessing request initiated by the first server and generate initialization data. And, it is used to sign the transaction data based on the second private key component to obtain a second signature component. Or, public key information is generated based on the first public key component stored on the user side.

[0153] According to an embodiment of the present disclosure, the transaction processing system may further include a CA certification center. The CA certification center is used to generate and distribute digital certificates, for example, to generate a digital certificate based on the second user data and public key information, and send it to the first server.

[0154] According to an embodiment of the present disclosure, in order to adapt to the use of identity authentication services in complex scenarios, the first server may provide services to the outside in the form of cloud services such as public clouds.

[0155] Fig.14 The schematic diagram shows an architecture diagram of a transaction processing system 1400 according to another embodiment of the present disclosure, wherein the transaction processing system 1400 is one embodiment of the transaction processing system 1300 .

[0156] like Fig.14 As shown, the transaction processing system 1400 of the embodiment of the present disclosure may include N user terminals, M second service terminals and a first service terminal, wherein N and M are integers greater than or equal to 1.

[0157] According to the embodiments of the present disclosure, the signature verification SDK is embedded in each of the N user terminals, that is, in each application, and the security SDK is embedded in the signature verification SDK. When the user uses the first application to perform a transaction, the first application calls the signature verification SDK, and then the signature verification SDK interacts with the security SDK and the first server. For details, please refer to operation S1210 and operation S1220. The integrated signature verification SDK based on full-function services can more efficiently output digital certificate functions to third parties, reducing the development difficulty and technical threshold for promoting identity authentication products.

[0158] Among them, the first server, transaction verification server, cloud certificate server or CA certification center in the transaction processing system 1400 are the same as those in the transaction processing system 1300 and will not be elaborated here.

[0159] Fig.15A and Fig. 15B The flowchart of a transaction processing system providing transaction processing services according to an embodiment of the present disclosure is schematically shown.

[0160] like Fig.15A and Fig. 15B As shown, the transaction processing system 1300 providing the transaction processing service may include operations S1510 to S1560, which are as follows.

[0161] like Fig.15A As shown, in operation S1510, the user terminal applies for activation of a digital certificate, including operations S1511 to S1514.

[0162] In operation S1511, the user terminal submits relevant information to the first server terminal to apply for activation of a digital certificate.

[0163] In operation S1512, after receiving the relevant information, the first server may store it locally and send it to the cloud certificate server at the same time, so that the cloud certificate server adds a new activation record.

[0164] In operation S1513, the cloud certificate server notifies the first server after adding the activation record. In some embodiments, the cloud certificate server can store relevant records of all users in advance, and after receiving the activation application, it can perform a legality check to determine whether the applicant user has the authority to apply. For example, if it is found that the applicant user is a blacklisted user, the activation can be rejected.

[0165] In operation S1514, the first server may locally file the newly added activation record and return it to the user terminal.

[0166] like Fig.15A As shown, in operation S1520, a key component is obtained, including operations S1521 to S1525.

[0167] In operation S1521, for example, the user end first generates a user end public-private key pair, ie, a first private key component and a first public key component, based on the SM2 algorithm.

[0168] In operation S1522, the client sends the first public key component to the first server.

[0169] In operation S1523, the first server sends the first public key component to the cloud certificate server.

[0170] In operation S1524, after receiving the first public key component, the cloud certificate server performs preprocessing. For example, if the digital certificate used in the identity authentication process complies with the PKCS#10 standard, P10 preprocessing can be performed. In addition, the cloud certificate server can generate a second private key component, and obtain complete public key information based on the second private key component and the first public key component, and then store it locally. Finally, the P10 preprocessed data and public key information are returned to the first server.

[0171] In operation S1525, the first server returns the above data to the user end.

[0172] like Fig.15A As shown, in operation S1530, a digital certificate is obtained, including operations S1531 to S15310.

[0173] In operation S1531, the user terminal uses the first private key component to sign the content of the request to generate a digital certificate, such as user personal information, device ID, and other content.

[0174] In operation S1532, the client may put the signature data into a certificate request data packet and submit it to the first server to apply for a digital certificate.

[0175] In operation S1533, the first server requests to obtain request data for sending to the CA certification center, such as a P10 data file, from the cloud certificate server.

[0176] In operation S1534, taking the generation of a P10 data request as an example, the cloud certificate server may parse the certificate request data packet. Then, the second private key component is used to sign the parsed signature data to obtain complete private key signature data. Then, the signature data and the public key information are placed in the structure specified by P10 to generate a P10 data file. Finally, the P10 data file is sent to the first server.

[0177] In operation S1535, the first server sends a request including the P10 data file to the CA certification center.

[0178] In operation S1536, the CA authentication center generates a digital certificate and returns it to the first server. It should be noted that the CA authentication center can generate a digital certificate based on existing technology or technology to be developed in the future, and the first server fills in the request sent to the CA authentication center with data that meets the requirements, which is not limited in this disclosure.

[0179] In operation S1537, the first server sends the digital certificate to the cloud certificate server, requesting verification of the digital certificate.

[0180] In operation S1538, the cloud certificate server verifies the digital certificate and finally returns the verification result to the first server.

[0181] In operation S1539, the first server can store the digital certificate locally and fill relevant information into the digital certificate management file, such as the certificate status, activation time, validity period, etc., to facilitate the subsequent maintenance of the user's digital certificate information and to facilitate the verification of the validity of the certificate during the use of the digital certificate. Finally, the digital certificate is returned to the user.

[0182] In operation S15310, the user stores the digital certificate.

[0183] Although the above describes the various operations of the method in a specific order, the embodiments of the present disclosure are not limited thereto, and the above operations can be performed in other orders as needed. For example, step S1520 can be performed after step S1530, or can be performed simultaneously. In some embodiments, the cloud service server can generate a second private key component and a second public key component in operation S1524 without obtaining public key information. Then, in operation S1534, complete public key information is first obtained (for example, based on the first public key component and the second public key component), and then the P10 data file is generated. Then in operation S1539, the first service end can send the public key information to the user end, so that the user end saves it in operation S15310, wherein the first service end can only send the public key information, and the digital certificate is saved locally to reduce the storage pressure of the user end.

[0184] like Fig. 15B As shown, if a user initiates a transaction using a user terminal, then in operation S1540, a signature initialization process may be performed first, including operations S1541 to S1545.

[0185] In operation S1541, the user terminal calls public key information, for example, the application calls the security SDK to obtain it. When the signature verification SDK is embedded in the application, the signature verification SDK can be called to interact with the security SDK to obtain the public key information.

[0186] In operation S1542, the user terminal sends the public key information and the user personal information to the first server terminal.

[0187] In operation S1543, the first server verifies the validity of the digital certificate based on the public key information and the user's personal information. In some embodiments, the first server can verify based on the information in the digital certificate management file to determine whether the public key information, the user's personal information and the information in the digital certificate are consistent. After the verification is passed, a signature preprocessing request is initiated to the cloud certificate.

[0188] In operation S1544, the cloud certificate server performs a signature preprocessing operation and generates initialization data to send to the first server.

[0189] In operation S1545, the first server sends initialization data to the client.

[0190] like Fig. 15B As shown, in operation S1550, transaction legitimacy verification is performed, including operations S1551 to S1559.

[0191] In operation S1551, the user terminal signs the transaction information using the first private key component to obtain a first signature component.

[0192] In operation S1552, the user terminal sends a transaction request to the first server terminal, the transaction request includes transaction data, and the transaction data includes transaction information and a first signature component. In some embodiments, the user terminal may send a user password to the first server terminal, and the user password may include a numeric and character password, or a biometric password (such as biometric data such as fingerprints, voiceprints, eyes or faces).

[0193] In operation S1553, the first server sends the user password to the password verification server to initiate password verification.

[0194] In operation S1554, the password verification server performs verification based on the password pre-registered by the user and returns the verification result to the first server.

[0195] In operation S1555, when the password verification is passed, the first server sends the transaction data to the cloud certificate server and requests the server to sign.

[0196] In operation S1556, the cloud certificate server signs the transaction data using the second signature private key and returns the signature to the first server.

[0197] In operation S1557, the first server sends the transaction request to the transaction verification server.

[0198] In operation S1558, the transaction verification service end verifies the transaction request. For example, when the transaction request includes transaction data and a digital certificate. First, the validity of the digital certificate can be verified, for example, the signature of the CA certification center on the digital certificate can be verified using the public key of the CA certification center. Then, after the digital certificate is verified, the first transaction signature of the transaction data can be verified based on the user's public key information, wherein the acquisition of the first transaction signature can refer to operation S830, which is not described in detail here. Finally, the transaction verification result is sent to the first service end.

[0199] In operation S1559, the first service end sends the transaction verification result to the user end, so that the user end processes the transaction according to the verification result. For example, if the verification result is passed, the user end continues to execute the transaction. If the verification result is not passed, the execution is stopped and the user is prompted that the transaction has failed.

[0200] like Fig. 15B As shown, in operation S1560, when the verification result is a failure, a verification application is performed, including operations S1561 to S1565.

[0201] In operation S1561, the client obtains a first public key component.

[0202] In operation S1562, the user terminal submits a verification request to the first server terminal, wherein the verification request may include a first public key component.

[0203] In operation S1563, the first server may send the digital certificate and the verification request to the cloud certificate server.

[0204] In operation S1564, the cloud certificate server recalculates and obtains the public key information, and checks it with the public key information on the digital certificate, and finally sends the check result to the first server.

[0205] In operation S1565, the first server sends the verification result to the user terminal.

[0206] Although the above describes the various operations of the method in a specific order, the embodiments of the present disclosure are not limited thereto, and the above operations can be performed in other orders as needed, or can be performed selectively, for example, in order to strengthen transaction security control, the added password verification server performs identity authentication, and in some embodiments, steps S1553 and S1554 can be omitted. In some other embodiments, each operation in operations S1510 to S1560 can be an interactive process encapsulated in the first server.

[0207] Based on the above transaction processing method, the present disclosure also provides a transaction processing device for a first service end, and a transaction processing device for a user end. Fig.16 and Fig.17 The above-mentioned device is described in detail.

[0208] Fig.16 The structural block diagram of the transaction processing device 1600 for the first service end according to an embodiment of the present disclosure is schematically shown.

[0209] like Fig.16 As shown, the transaction processing device 1600 of this embodiment includes a request receiving module 1610 , a request forwarding module 1620 and a verification forwarding module 1630 .

[0210] The request receiving module 1610 may, for example, perform operation S310 to receive a transaction request sent by a first user terminal among N user terminals, wherein the transaction request includes at least one of transaction data and a digital certificate.

[0211] The request forwarding module 1620 may, for example, perform operation S320 to send the transaction request to a transaction verification server among the M second servers, so that the transaction verification server outputs a verification result based on the transaction request, where N and M are integers greater than or equal to 1. And

[0212] The verification forwarding module 1630 may, for example, perform operation S330 to obtain a verification result and send the result to the first user terminal, so that the first user terminal performs transaction processing based on the verification result.

[0213] Fig.17 The structural block diagram of the transaction processing device 1700 for the first user terminal according to an embodiment of the present disclosure is schematically shown.

[0214] like Fig.17 As shown, the transaction processing device 1700 of this embodiment includes a request sending module 1710 , a verification receiving module 1720 and a transaction processing module 1730 .

[0215] The request sending module 1710 can, for example, perform operation S1110, which is used to send a transaction request to the first server, so that the first server sends the transaction request to a transaction verification server among M second servers, wherein the transaction request includes at least one of transaction data and a digital certificate, wherein N and M are integers greater than or equal to 1.

[0216] The verification receiving module 1720 may, for example, perform operation S1120 to receive a verification result sent by the first server, wherein the verification result is obtained by the transaction verification server verifying the transaction request.

[0217] The transaction processing module 1730 may, for example, execute operation S1130 to perform transaction processing based on the verification result.

[0218] According to an embodiment of the present disclosure, any multiple modules in the transaction processing device 1600 or the transaction processing device 1700 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one module in the transaction processing device 1600 or the transaction processing device 1700 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one module in the transaction processing device 1600 or the transaction processing device 1700 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0219] Fig.18 A block diagram of an electronic device suitable for implementing a transaction processing method according to an embodiment of the present disclosure is schematically shown.

[0220] like Fig.18 As shown, the electronic device 1800 according to an embodiment of the present disclosure includes a processor 1801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1802 or a program loaded from a storage part 1808 into a random access memory (RAM) 1803. The processor 1801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1801 may also include an onboard memory for caching purposes. The processor 1801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0221] In RAM 1803, various programs and data required for the operation of electronic device 1800 are stored. Processor 1801, ROM 1802 and RAM 1803 are connected to each other via bus 1804. Processor 1801 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1802 and / or RAM 1803. It should be noted that the program can also be stored in one or more memories other than ROM 1802 and RAM 1803. Processor 1801 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0222] According to an embodiment of the present disclosure, the electronic device 1800 may further include an input / output (I / O) interface 1805, which is also connected to the bus 1804. The electronic device 1800 may further include one or more of the following components connected to the I / O interface 1805: an input portion 1806 including a keyboard, a mouse, etc. An output portion 1807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc. A storage portion 1808 including a hard disk, etc. And a communication portion 1809 including a network interface card such as a LAN card, a modem, etc. The communication portion 1809 performs communication processing via a network such as the Internet. A drive 1810 is also connected to the I / O interface 1805 as needed. A removable medium 1811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1810 as needed, so that the computer program read therefrom is installed into the storage portion 1808 as needed.

[0223] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments. It may also exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0224] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1802 and / or RAM 1803 described above and / or one or more memories other than ROM 1802 and RAM 1803.

[0225] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method according to the embodiment of the present disclosure.

[0226] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1801. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0227] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 1809, and / or installed from a removable medium 1811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0228] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1809, and / or installed from the removable medium 1811. When the computer program is executed by the processor 1801, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0229] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0230] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0231] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A transaction processing method, applied to a first server, comprising: Receiving a transaction request sent by a first user terminal among the N user terminals, wherein the transaction request includes at least one of transaction data and a digital certificate; Sending the transaction request to a transaction verification server among the M second servers, so that the transaction verification server outputs a verification result based on the transaction request, wherein the M second servers have different service architectures and communication rules, and the first server is used to call relevant interfaces of the M second servers based on each process according to a full-function transaction processing service, N is an integer greater than or equal to 1, and M is an integer greater than or equal to 2; and The verification result is obtained and sent to the first user terminal, so that the first user terminal performs transaction processing based on the verification result.

2. The transaction processing method according to claim 1, wherein: The M second servers include a cloud certificate server, the transaction data includes transaction information and a first signature component, the first signature component is obtained by signing the transaction information by the first user terminal based on a first private key component, wherein before sending the transaction request to the transaction verification server, the method further includes: Sending the transaction data to the cloud certificate server, so that the cloud certificate server signs the transaction data based on the second private key component to obtain a second signature component; receiving the second signature component sent by the cloud certificate server; and A first transaction signature for the transaction data is obtained based on the first signature component and the second signature component.

3. The transaction processing method according to claim 2, wherein: The M second service ends include a password verification service end, and before sending the transaction data to the cloud certificate service end, further include: Receiving a user password sent by the first user terminal; sending the user password to the password verification service end, so that the password verification service end outputs a password verification result based on the user password; and When the password verification result is passed, it is determined to send the transaction data to the cloud certificate service end.

4. The transaction processing method according to claim 2, wherein: When the verification result is failure, the method further includes: Obtaining a second transaction signature for the transaction data based on the first signature component and the second signature component; sending the transaction request to the cloud certificate server, so that the cloud certificate server outputs a verification result based on the transaction request, wherein the transaction request includes the second transaction signature; and The verification result is obtained and sent to the first user terminal.

5. The transaction processing method according to claim 1, wherein: Before receiving the transaction request sent by the user terminal, the method further includes: Obtaining first user data of the first user terminal; and The digital certificate is verified based on the first user data, and a verification result is obtained.

6. The transaction processing method according to claim 5, wherein: The M second servers include a cloud certificate server, and when the verification result is passed, the method further includes: Sending a preprocessing request to the cloud certificate server so that the cloud certificate server generates initialization data based on the preprocessing request; and The initialization data is obtained and sent to the first user terminal, so that the first user terminal generates the transaction request based on the initialization data.

7. The transaction processing method according to claim 1, wherein: The M second servers include a cloud certificate server, and before receiving the transaction request sent by the user terminal, further include: Receiving a first request sent by the first client, wherein the first request includes a first public key component; Sending the first request to the cloud certificate server so that the cloud certificate server generates public key information based on the first public key component; and The public key information is sent to the first user terminal.

8. The transaction processing method according to claim 7, wherein: The M second service terminals include a CA certification center, and the method further includes: Receiving a second request sent by the first user terminal, wherein the second request includes second user data and the public key information; Sending the second request to the CA certification center so that the CA certification center generates the digital certificate based on the second user data and the public key information; and Obtain the digital certificate sent by the CA certification center.

9. A transaction processing method, applied to a first user terminal among N user terminals, comprising: Sending a transaction request to a first server, so that the first server sends the transaction request to a transaction verification server among M second servers, wherein the transaction request includes at least one of transaction data and a digital certificate, the M second servers have different service architectures and communication rules, the first server is used to call relevant interfaces of the M second servers based on each process according to a full-function transaction processing service, N is an integer greater than or equal to 1, and M is an integer greater than or equal to 2; receiving a verification result sent by the first server, wherein the transaction verification server outputs the verification result based on the transaction request; and Transaction processing is performed based on the verification result.

10. The transaction processing method according to claim 9, wherein: The first user terminal includes a first application program, and the first application program includes a signature verification SDK. Before sending the transaction request to the first server terminal, the method further includes: Based on the first application, perform the following operations: Receive transaction operations from users; and In response to the transaction operation, the signature verification SDK is called to obtain the transaction request through the signature verification SDK.

11. A transaction processing system, comprising N user terminals, M second service terminals and a first service terminal, wherein: The M second servers have different service architectures and communication rules. The first server is used to call the relevant interfaces of the M second servers based on each process according to the full-function transaction processing service. N is an integer greater than or equal to 1, and M is an integer greater than or equal to 2, specifically including: A first user terminal, wherein the N user terminals include the first user terminal, and the first user terminal is used to send a transaction request, wherein the transaction request includes at least one of transaction data and a digital certificate; A first server end, configured to receive the transaction request, and send the transaction request to a transaction verification server end among the M second servers; The transaction verification server is used to output a verification result based on the transaction request, so that the first server sends the verification result to the first user end, and the first user end performs transaction processing based on the verification result.

12. A transaction processing device, applied to a first server, comprising: A request receiving module, configured to receive a transaction request sent by a first user terminal among the N user terminals, wherein the transaction request includes at least one of transaction data and a digital certificate; a request forwarding module, configured to send the transaction request to a transaction verification server among the M second servers, so that the transaction verification server outputs a verification result based on the transaction request, wherein the M second servers have different service architectures and communication rules, the first server is configured to call relevant interfaces of the M second servers based on each process according to a full-function transaction processing service, N is an integer greater than or equal to 1, and M is an integer greater than or equal to 2; and The verification forwarding module is used to obtain the verification result and send it to the first user end, so that the first user end performs transaction processing based on the verification result.

13. A transaction processing device, applied to a first user terminal among N user terminals, comprising: a request sending module, configured to send a transaction request to a first server, so that the first server sends the transaction request to a transaction verification server among M second servers, wherein the transaction request includes at least one of transaction data and a digital certificate, wherein the M second servers have different service architectures and communication rules, and the first server is configured to call relevant interfaces of the M second servers based on each process according to a full-function transaction processing service, wherein N is an integer greater than or equal to 1, and M is an integer greater than or equal to 2; a verification receiving module, configured to receive a verification result sent by the first server, wherein the verification result is obtained by the transaction verification server verifying the transaction request; and A transaction processing module is used to perform transaction processing based on the verification result.

14. An electronic device comprising: One or more memories storing executable instructions; as well as One or more processors execute the executable instructions to implement the method according to any one of claims 1 to 10.

15. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 10.

16. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images