Data processing method, system, device, equipment, medium and computer product

Abstract

The invention discloses a data processing method, system and device, equipment, a medium and a computer product. The invention belongs to the technical field of data processing. The method comprises: according to identity information of a user carried in a voucher application request initiated by a payment application system, determining an identity voucher set, the identity voucher set comprising a user identity voucher for representing a personal identity of the user and an account identity voucher for representing a payment account of the user, the device identity credential is used for representing the user payment device; and based on the identity credential set, determining a digital identity credential used for proving the digital identity of the user in the electronic payment service and reflecting the payment willingness of the user. Thus, the fusion type digital identity certificate integrating multiple attributes of the user personal identity, the user payment account and the user payment equipment realizes anonymization and desensitization processing of the user transaction data, eliminates the possibility of leaking the user transaction data from the source, and improves the security of the user transaction data.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a data processing method, system, device, equipment, medium and computer product. Background Art

[0002] In the field of electronic payment, the authorization of payment transactions depends on the verification of the payment account and user identity by the account issuer. Specifically, it is necessary to confirm that the payment transaction is initiated by the real user, in accordance with the real payment intention of the user, and using a real and valid payment account.

[0003] In related technologies, user transaction data such as payment account data and user identity data related to payment transactions usually need to be transmitted between multiple processing terminals for processing payment transactions, such as the merchant terminal and the resource transfer terminal. However, the prevention of data leakage risks depends on the protection capabilities of each processing terminal, and it is difficult to ensure the data security of the entire payment transaction. Data leakage is prone to occur during the data transmission process, reducing the security of user transaction data. Summary of the invention

[0004] The embodiments of the present application provide a data processing method, system, device, equipment, medium and computer product, which can solve the problem in related technologies that user transaction data is easily leaked and tampered with, thereby reducing the security of transaction data.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, which is applied to a payment switching system, and the method includes:

[0006] Receive a credential application request initiated by the payment application system, which carries the user's identity information;

[0007] Determine the user's identity credential set based on the identity information, the identity credential set includes the user identity credential, the account identity credential and the device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device;

[0008] Based on the user identity credential, account identity credential and device identity credential, a digital identity credential is determined. The digital identity credential is a credential used to prove the user's digital identity in electronic payment services and reflect the user's willingness to pay.

[0009] In a second aspect, an embodiment of the present application provides a data processing device, which is applied to a payment switching system. The device may include:

[0010] A receiving module, used to receive a credential application request initiated by a payment application system, the credential application request carrying the user's identity information;

[0011] A determination module, used to determine the user's identity credential set based on the identity information, the identity credential set including the user identity credential, the account identity credential and the device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device;

[0012] The determination module is also used to determine the digital identity credential based on the user identity credential, the account identity credential and the device identity credential. The digital identity credential is a credential used to prove the user's digital identity in the electronic payment business and reflect the user's willingness to pay.

[0013] In a third aspect, an embodiment of the present application provides a data processing system, including a payment application system and a payment switching system; wherein:

[0014] The payment application system is used to initiate a credential application request, which carries the user's identity information;

[0015] The payment switching system is used to determine the user's identity credential set based on the identity information, the identity credential set includes the user identity credential, the account identity credential and the device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device;

[0016] The payment switching system is also used to determine the digital identity credential based on the user identity credential, account identity credential and device identity credential. The digital identity credential is a credential used to prove the user's digital identity in electronic payment services and reflect the user's willingness to pay.

[0017] In a fourth aspect, an embodiment of the present application provides a computer device, the computer device comprising: a processor and a memory storing computer program instructions;

[0018] When the processor executes the computer program instructions, the data processing method shown in the first aspect is implemented.

[0019] In a fifth aspect, an embodiment of the present application provides a computer storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the data processing method shown in the first aspect is implemented.

[0020] In a sixth aspect, an embodiment of the present application provides a chip, the chip including a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the data processing method shown in the first aspect.

[0021] In a seventh aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the data processing method shown in the first aspect.

[0022] The data processing method, system, apparatus, device, medium and computer product of the embodiments of the present application determine the user's identity credential set through the user's identity information carried in the credential application request initiated by the payment application system, and the identity credential set includes a user identity credential, an account identity credential and a device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device; then, based on the user identity credential, the account identity credential and the device identity credential, a digital identity credential is determined, and the digital identity credential is a credential used to prove the user's digital identity in electronic payment services and reflect the user's willingness to pay. In this way, a hybrid digital identity credential is created that integrates multiple attributes of the user's personal identity, user's payment account, and user's payment device, and establishes an integrated credential of personal identity, device identity, and account identity. This can be used as a credential to prove the user's true willingness to pay from multiple dimensions when an electronic payment transaction occurs, and the user's transaction data can be anonymized and desensitized, thereby eliminating the possibility of leakage of user transaction data during electronic payment transactions at the source, avoiding the situation where user transaction data is easily leaked and tampered with, improving the security of transaction data while reducing the transmission encryption, storage encryption and other resources invested by each processing end to protect user transaction data. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0024] Figure 1 A schematic diagram of the structure of a data processing system provided in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of a structure for generating a digital identity credential of a data processing system provided in an embodiment of the present application;

[0026] Figure 3 A schematic diagram of the structure of digital identity credential storage and transmission of a data processing system provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of the structure of a digital identity credential transmission of a data processing system provided in an embodiment of the present application;

[0028] Figure 5 A schematic diagram of the structure of digital identity credential verification of a data processing system provided in an embodiment of the present application;

[0029] Figure 6 A flowchart of a data processing method provided in an embodiment of the present application;

[0030] Figure 7 is a structural schematic diagram of a data processing device provided by an embodiment of the present application;

[0031] Figure 8 It is a schematic diagram of the structure of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0032] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0033] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0034] The acquisition, storage, use, and processing of data (including but not limited to the features and information in the text) in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0035] In the field of electronic payment, the authorization of a payment transaction depends on the verification of the payment account and user identity by the account issuer. It is necessary to confirm that the payment transaction is initiated by the real user, in accordance with the real payment intention of the user, and using a real and valid payment account. In the traditional payment business process, the account issuer verifies the user transaction data such as payment account data and user identity data after receiving the payment transaction. In this process, since the payment account data and user identity data are transmitted in plain text between multiple processing terminals such as the merchant terminal and the resource transfer terminal for processing payment transactions. However, the prevention of data leakage risks depends on the protection capabilities of each processing terminal, it is difficult to ensure the data security of the entire payment transaction. Data leakage is prone to occur during the data transmission process, reducing the security of user transaction data.

[0036] Specifically, the current electronic payment transaction authentication model generally provides an information collection portal on the accepting merchant or acceptance institution's own page. With the user's authorization, the user's payment account data, user identity data and other user transaction data are collected, and then transmitted to the transfer institution through the background system, and then forwarded to the account issuer. After receiving the payment transaction, the account issuer verifies the payment account data, user identity data and other user transaction data. Therefore, the account issuer needs to obtain the user's authorization from the accepting merchant or acceptance institution every time a payment event occurs, directly collect the payment account data and user identity data, and transmit them in the payment network. On the one hand, the user needs to repeatedly provide the payment account data, user identity data and user transaction data when a payment event occurs, which affects the convenience of payment; on the other hand, the collection, transmission, storage and use of user transaction data depends on the protection capabilities of each processing node to prevent data leakage risks, and it is difficult to ensure security throughout the process.

[0037] Furthermore, the current verification of payment account data by the account issuer can be achieved by verifying account data such as financial institution account, payment account number, etc. submitted by the user when initiating payment, or authentication data such as payment password, SMS verification code, biometric data, etc. These data are directly collected by the accepting merchant or acceptance institution and transmitted to the account issuer through the transfer institution. For the verification of user identity, the account issuer performs comparative verification based on the retained information. This method relies on the retained information of the account issuer. If there is an abnormality in the retained information, the user identity cannot be verified. Although the account issuer can call the verification service of the identity information management authority to perform secondary verification on the payment account data, it will increase the processing of access verification service during the transaction, which prolongs the transaction processing chain and reduces the processing efficiency of payment transactions.

[0038] And, the verification of user identity by the account issuer usually includes the following methods: first, the user identity data obtained during the transaction is compared with the identity data retained when the user opens the account. If the match is consistent, it is considered to be verified; second, the account issuer transmits the user identity data obtained during the transaction to the identity data management authority for secondary verification of the identity data. Only when the verification conclusion of the identity data management authority is obtained, it is considered to be verified. However, the user's authorization to use the payment account data and user identity data in each electronic payment transaction reflects that the user recognizes the payment behavior at that time, agrees to use a fixed account for payment, and agrees to use the user's user identity data in this payment. However, the authorization of each transaction requires the user to provide relevant information, which is prone to the risk of information being misused; the acceptance agency, the transfer agency, and the account issuing agency keep records of the information provided by the user in the transaction log, which is prone to the risk of information leakage.

[0039] In order to solve the above technical problems, the embodiments of the present application provide a data processing system, method, apparatus, computer device and storage medium.

[0040] Based on this, the following will combine the attached Figures 1 to 8 , describes in detail the data processing system, method, apparatus, computer equipment and storage medium of the embodiments of the present application. It should be noted that these embodiments are not intended to limit the scope of the disclosure of the present application.

[0041] First, in order to better illustrate the contents of the embodiments of the present application, the following are respectively combined with Figures 1 to 5 According to the process of generation, storage, transmission and verification of digital identity credentials, a data processing system provided in an embodiment of the present application is described as follows.

[0042] In some embodiments of the present application, for the generation of digital identity credentials, the data processing system may include a payment application system 101, a payment acceptance system 102, and a payment switching system 103. The payment application system 101 may be an electronic device of the user, and the electronic device may be a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted electronic device, or other device with a payment function. The payment acceptance system 102 may be a merchant's payment collection device, and the payment collection device may be a point of sales (POS), a code scanning cash register, a mobile phone, a tablet computer, or other device with a payment collection function. The payment switching system 103 is a server or cloud server that is connected to the payment application system 101 and the payment acceptance system 102 and generates digital identity credentials.

[0043] Specifically, the payment application system 101 is used to initiate a credential application request, and the credential application request carries the user's identity information.

[0044] The payment acceptance system 102 is used to send the credential application request initiated by the payment application system 101 to the payment switching system 103 .

[0045] The payment switching system 103 is used to receive the credential application request sent by the payment acceptance system 102; according to the identity information in the credential application request, determine the user's identity credential set, the identity credential set includes user identity credential, account identity credential and device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device. The payment switching system is also used to determine the digital identity credential based on the user identity credential, account identity credential and device identity credential, the digital identity credential is a credential used to prove the user's digital identity in the electronic payment business and reflect the user's willingness to pay.

[0046] In this embodiment, the identity credential set in the embodiment of the present application includes three identity credentials, namely, user identity credentials, account identity credentials and device identity credentials. Based on this, the payment switching system needs to interact with the identity authentication system, the account issuer system and the payment device management system respectively to obtain the corresponding identity credentials. Figure 2 A process for determining identity credentials in a set of identity credentials is described in detail.

[0047] like Figure 2 As shown, the embodiment of generating a digital identity credential can still be used. In addition to including the following Figure 1 In addition to the system shown, an identity authentication system 201 , an account issuer system 202 and a payment device manager system 203 may also be included.

[0048] Among them, the identity authentication system 201 can be a system of an identity authentication institution for verifying the personal identity of a user. The account issuer system 202 is the issuer of the user's payment account. For example, if the user's payment account is a bank card account, then the account issuer system 202 can be the system of the financial institution that issued the bank card; for another example, if the user's payment account is a mobile payment account, then the account issuer system 202 can be the system of the mobile payment institution to which the mobile payment account belongs. The payment device manager system 203 can be the system of the device manufacturer server of the device corresponding to the payment application system 101.

[0049] In some embodiments of the present application, the data processing system further includes an identity authentication system 201, so that a user identity certificate can be generated by the identity authentication system to verify the user's personal identity. Specifically, the payment switching system 103 is specifically used to send a first request to the identity authentication system, and the first request carries identity information. The identity authentication system 201 is used to verify the identity information, and when the identity information passes the verification, digitally sign the identity information to obtain a user identity certificate corresponding to the identity information; and send the user identity certificate to the payment switching system 103.

[0050] For example, Figure 2 As shown, the process of issuing and obtaining a user identity credential may include the payment application system 101 sending the collected identity information such as bank card password, social communication number, user name, and identity document number to the payment transfer system 103 through the acceptance institution system 102, and performing identity authentication through the payment transfer system 103 and the identity authentication system 201. Specifically, the identity authentication system 201 receives the identity information sent by the payment transfer system 103, and uses the credential service capability established by the identity authentication system 201 based on blockchain technology to verify the identity information. When the identity information passes the verification, the identity information such as the identity document number can be digitally signed through the system certificate of the identity authentication system 201 to obtain the identity credential identification code. At this time, the identity credential identification code can be used as the user identity credential.

[0051] In other embodiments of the present application, an account identity credential may be generated by the account issuer system 202 to verify the association between the user and the user's legitimate user payment account. Based on this, the data processing system also includes the account issuer system 202.

[0052] Based on this, the payment switching system 103 is also used to obtain the user's user personal certificate according to the identity information; digitally sign the identity information and the user identity certificate through the user personal certificate to obtain the first signature data; send a second request to the account issuer system 202, and the second request carries the first signature data. The account issuer system 202 is used to verify the first association relationship between the identity information and the user's user payment account based on the first signature data, and digitally sign the identity information and the user payment account when the first association relationship is verified to obtain the account identity certificate; send the account identity certificate to the payment switching system 103. Here, the user personal certificate in the embodiment of the present application can be a digital certificate used to verify personal identity, which is usually issued by an authoritative third-party organization, such as a certificate authority (CA), and can contain the user's public key, issuer information, validity period and other data to ensure the authenticity and security of the user's identity when conducting network transactions or accessing protected resources.

[0053] For example, Figure 2 As shown, the process of issuing and obtaining the account identity certificate may include that the payment switching system 103 may obtain the user's personal certificate based on the identity information, and digitally sign the identity information and the user identity certificate through the user's personal certificate to obtain the first signature data, so as to inform the account issuer system 202 of the authenticity of its identity information and the user identity certificate. Then, the account issuer system 202 is used to verify the first association relationship between the identity information in the first signature data and the user payment account of the user through the association relationship between the preset identity information and the user payment account established by the account issuer system 202 based on the first signature data. When the first association relationship passes the verification, the system certificate of the general account issuer system 202 is used to digitally sign the identity information and the user payment account to obtain the account identity certificate, so as to send the account identity certificate to the payment switching system 103.

[0054] In other embodiments of the present application, the data processing system also includes a payment device management system 203, and the credential application request also carries device information of the user payment device used by the user, such as a device identifier, a device physical address, and other information used to identify the user payment device.

[0055] Based on this, the payment switching system 103 is also used to obtain the user's personal certificate based on the identity information; digitally sign the identity information, device information and user identity certificate through the user's personal certificate to obtain the second signature data; send a third request to the payment device system, and the third request carries the second signature data. The payment device management system 303 is used to verify the second association relationship between the identity information and the device information based on the second signature data, and when the second association relationship passes the verification, digitally sign the identity information and the device information to obtain the device identity certificate; and send the device identity certificate to the payment device system.

[0056] For example, reference may still be made to Figure 2 , the process of obtaining the device identity certificate may include that the certificate application request initiated by the payment application system 101 may also carry the device information of the user payment device used by the user. At this time, the payment switching system 103 may digitally sign the identity information, user identity certificate and device information through the user's personal certificate to obtain the second signature data, so as to inform the payment device management system 303 of the authenticity of its identity information and user identity certificate. Then, the second signature data is sent to the payment device management system 303. In this way, the payment device management system 303 can verify the second association relationship between the identity information in the second signature data and the user payment device of the user based on the second signature data through the association relationship between the preset identity information and the user payment device established by the payment device management system 303 (or, using the device management capability established by the payment device management system 303 based on the blockchain technology). In this way, when the second association relationship passes the verification, the identity information and device information are digitally signed through the system certificate of the payment device management system 303 to obtain the device identity certificate, so as to send the device identity certificate to the payment switching system 103.

[0057] Therefore, the digital identity credential provided in the embodiment of the present application is a fusion digital identity credential that integrates multiple attributes such as the user's personal identity, payment account, and payment device. It can be used as a credential to prove the user's true willingness to pay from multiple dimensions when the electronic payment transaction occurs. It has changed the current payment scenario, where the user's true intention can only be reflected by verifying the verification elements associated with the payment account entered by the user. For each system in the transaction chain, such as the payment application system 101, the payment acceptance system 102, the payment transfer system 103, and the account issuer system 202, if the digital identity credential is accepted, the digital identity credential can be used as a basis for identifying the user and judging whether the payment behavior is in line with the user's wishes. This method can be used as a supplement to the existing account verification element verification method, or as a substitute for the existing verification method.

[0058] In other embodiments of the present application, Figure 3 As shown, for the custody of digital identity credentials, the data processing system may also include a credential custodian system 301 for storing and verifying digital identity credentials. Here, the credential custodian system 301 may be a server in the payment switching system 103 for storing and verifying digital identity credentials, or a server or system of a neutral third party for storing and verifying digital identity credentials, such as a credential custody service based on blockchain technology.

[0059] Based on this, the data processing system provided in the embodiment of the present application also includes a credential custodian system 301; wherein the payment switching system 103 is also used to send a fourth request to the credential custodian system, and the fourth request carries the user identity credential, the account identity credential and the device identity credential. The credential custodian system 301 is used to verify the third association relationship between the user identity credential, the account identity credential and the device identity credential based on the fourth request, and to generate a credential custodian certificate when the third association relationship is verified; and to send the credential custodian certificate to the credential custodian system. The payment switching system 103 is also used to digitally sign the user identity credential, the account identity credential and the device identity credential through the credential custodian certificate and the user's personal certificate to obtain a digital identity credential.

[0060] Exemplarily, after the payment switching system 103 obtains the user identity certificate, account identity certificate, and device identity certificate, the three types of identity certificates are sent to the certificate depository system 301. The certificate depository system 301 can be associated with the designated user according to the user identity certificate identification code stored in advance, and the authenticity is guaranteed by verifying the digital signatures made by the identity authentication system 201, the account issuer system 202, and the payment device management system 203. When the identity certificate verified by the three parties is passed, the certificate depository certificate can be sent to the certificate depository system. In this way, the payment switching system 103 can digitally sign the user identity certificate, account identity certificate, and device identity certificate through the user's personal certificate and the certificate depository certificate to obtain a digital identity certificate. The digital identity certificate can be sent to the payment application system 101 so that it can be retained on the user device corresponding to the payment application system 101, such as a security chip and / or payment application stored in the user device. And, the digital identity certificate can also be retained in the certificate depository system 301 for use in subsequent verification.

[0061] Therefore, this application is a privately proposed digital identity credential security authentication method, which can integrate the digital signature authentication of various information systems, namely the identity authentication system 201, the account issuer system 202, and the payment device manager system 203, and can achieve traceability of the entire digital signature authentication process and tamper-proofing of the entire data transmission process. It has high security, availability and non-repudiation, and changes the current payment scenario where only transaction details data can be queried at each transaction processing node as transaction evidence, effectively reducing the cost of restoring abnormal situations in payment scenarios.

[0062] Here, it should be noted that in addition to sending the digital identity credentials to the credential custodian system 301, in order to improve the verification efficiency of the credential custodian system 301, the payment switching system 103 can also send the processing information of the identity credential set and the public key of the digital signature of the target system to the credential custodian system 301. In this way, the credential custodian system 30 can retain relevant information on the blockchain through the data storage capability established by the credential custodian system 301 based on blockchain technology, for use in subsequent verification services.

[0063] Therefore, the digital identity certificate security authentication method proposed in the embodiment of the present application can achieve evidence storage through secure technical means. When a dispute occurs in an electronic payment transaction, each system can obtain the corresponding digital identity certificate through the entry query of the certificate depository system 301 as evidence for resolving the transaction dispute. Through the digital identity certificate that is more easily recognized by all parties and retained on a neutral third party (or blockchain), the trust problem of each system in other transaction participants is effectively solved.

[0064] In some other embodiments of the present application, a process of delivering digital identity credentials is provided.

[0065] In the embodiment of the present application, when the payment application system 101 initiates a payment request, according to the user's authorization, the digital identity credential can be read from the security chip and / or payment application of the user device where the payment application system 101 is located, and the digital identity credential can be sent to various systems on the transaction processing path through the payment request along with the transaction order, such as the payment acceptance system 102, the payment transfer system 103, the account issuer system 202 and the credential depository system 301. These systems can obtain and use the digital identity credential in the payment request or transaction order. Figure 4 As shown, the payment application system 101 can generate a payment request based on the digital identity certificate and the transaction order. During the transaction processing, each system obtains the digital identity certificate from the payment request and uses the information therein as needed. Each system can verify the digital identity certificate as needed, and this type of verification is achieved through the certificate verification service capability provided by the certificate depository system.

[0066] In some further embodiments of the present application, credential verification is performed for digital identity credentials.

[0067] In the embodiment of the present application, each party involved in the electronic payment transaction, such as Figure 5 As shown, the payment acceptance system 102 , the payment switching system 103 and the account issuer system 202 can all perform voucher verification by calling the voucher verification capability provided by the voucher depository system 301 .

[0068] like Figure 5 As shown, the credential depository system 301 is also used to store the digital identity credentials carried by the second instruction, the processing information of the identity credential set, and the public keys of the digital signatures of multiple processing systems based on the second instruction sent by the payment switching system. In the case where the payment application system initiates a payment request, it receives a verification request sent by the target system, the payment request carries the transaction order and the target credential, and the target credential includes the digital identity credential; based on the verification request, the target credential is verified with the digital identity credential, the processing information of the identity credential set, and the public keys of the digital signatures of multiple processing systems, wherein the target system includes at least one of the following: the payment acceptance system that accepts the payment request, the payment switching system, and the account issuer system for settling the transaction order; in the case where the target credential is verified, the verification pass information is sent to the target system.

[0069] Exemplarily, the electronic payment transaction participant, i.e., the target system, initiates a credential verification request using the credential verification capability provided by the credential depository system 301. The credential depository system 301 verifies the digital identity credential, and if the verification is successful, sends verification success information to the target system.

[0070] Here, the digital identity credential security authentication method proposed in the embodiment of the present application uses a trusted identity credential that circulates within the entire business process, and focuses the authentication process on a specific business role. Other roles in the business chain can directly use the digital identity credential without repeated verification. This changes the situation in which each transaction processing node needs to collect user identity information and send it to the identity authentication source agency for verification in the payment scenario, so that one-time verification can be used in multiple places, effectively reducing the overall cost of identity authentication in the payment transaction chain.

[0071] In summary, the embodiments of the present application provide a digital identity credential that is anonymized, desensitized, verifiable, transferable and authenticated by multiple parties, which replaces the current mode of transmitting and verifying original, plaintext payment account data and user identity data. It can ensure the data security of the entire payment transaction process, avoid data leakage that is prone to occur during the early transmission of transaction data from the source, improve the security of user transaction data, and reduce the cost of transmission encryption, storage encryption and other resources invested by various systems to protect user transaction data.

[0072] Then, combine the following Figure 6 A data processing method provided in an embodiment of the present application is described as follows.

[0073] Figure 6 A flowchart of a data processing method provided in an embodiment of the present application.

[0074] like Figure 6 As shown, the data processing method can be applied to Figures 1 to 5 The payment transfer system shown in , based on this, the data processing method may specifically include the following steps:

[0075] Step 610, receiving a credential application request initiated by the payment application system, the credential application request carries the user's identity information; Step 620, determining the user's identity credential set based on the identity information, the identity credential set includes a user identity credential, an account identity credential and a device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device; Step 630, determining a digital identity credential based on the user identity credential, the account identity credential and the device identity credential, the digital identity credential is a credential used to prove the user's digital identity in electronic payment services and reflect the user's willingness to pay.

[0076] Therefore, the embodiment of the present application integrates a fusion digital identity credential including multiple attributes of the user's personal identity, the user's payment account and the user's payment device, and establishes an integrated credential of personal identity, device identity and account identity. It can be used as a credential to prove the user's true payment intention from multiple dimensions when the electronic payment transaction occurs, and realizes the anonymization and desensitization of user transaction data, thereby eliminating the possibility of leakage of user transaction data in the process of electronic payment transactions from the source, avoiding the situation where user transaction data is easily leaked and tampered with, and improving the security of transaction data. At the same time, it reduces the transmission encryption, storage encryption and other resources invested by each data processing end to protect user transaction data.

[0077] The above steps are described in detail below, as shown below.

[0078] In step 610, in some embodiments of the present application, the payment switching system may receive a credential application request initiated by the payment application system forwarded by the payment acceptance system, and the credential application request carries the user's identity information. The identity information in the embodiments of the present application may include but is not limited to user personal information, such as bank card password, social communication number, user name, and identity document number.

[0079] Involving step 620, the identity credential set in the embodiment of the present application includes three identity credentials, namely, user identity credentials, account identity credentials and device identity credentials. Based on this, the steps of how to determine different identity credentials are explained separately below.

[0080] In some embodiments of the present application, the user identity credentials may be determined through the following steps 6201 and 6202. Based on this, the step 620 may specifically include steps 6201 and 6202.

[0081] Step 6201, send a first request to the identity authentication system, the first request carries identity information, the first request is used to request the identity authentication system to verify the identity information, and generate a user identity credential corresponding to the identity information if the identity information passes the verification, the user identity credential is the data obtained after the identity authentication system digitally signs the identity information.

[0082] Step 6202, receiving the user identity credentials sent by the identity authentication system.

[0083] Exemplarily, the identity authentication system may send the identity information to the identity authentication system so that the identity authentication system performs identity authentication. Specifically, the identity authentication system receives the identity information sent by the payment switching system, and uses the credential service capability established by the identity authentication system based on blockchain technology to verify the identity information. When the identity information passes the verification, the identity information such as the identity document number may be digitally signed through the system certificate of the identity authentication system to obtain the identity credential identification code, and at this time, the identity credential identification code may be used as the user identity credential.

[0084] In some other embodiments of the present application, the account identity credentials may be determined through the following steps 6203 and 6206. Based on this, the step 620 may specifically include steps 6203 and 6206.

[0085] Step 6203, obtaining the user's personal certificate based on the identity information.

[0086] Step 6204, digitally sign the identity information and user identity credentials through the user's personal certificate to obtain the first signature data.

[0087] Step 6205, send a second request to the account issuer system, the second request carries the first signature data, the second request is used to request the account issuer system to verify the first association relationship between the identity information and the user's user payment account based on the first signature data, and generate an account identity credential if the first association relationship passes the verification. The account identity credential is data obtained after the account issuer system digitally signs the identity information and the user payment account.

[0088] Step 6206, receiving the account identity credentials sent by the identity authentication system.

[0089] Exemplarily, the payment switching system can obtain the user's personal certificate based on the identity information, and digitally sign the identity information and the user's identity credential through the user's personal certificate to obtain the first signature data, so as to inform the account issuer system of the authenticity of the identity information and the user's identity credential. In this way, the account issuer system can verify the first association between the identity information in the first signature data and the user's payment account based on the first signature data and the association between the preset identity information and the user's payment account. When the first association is verified, the system certificate of the universal account issuer system is used to digitally sign the identity information and the user's payment account to obtain the account identity credential, so as to send the account identity credential to the payment switching system, thereby obtaining the account identity credential.

[0090] In some other embodiments of the present application, the device identity credential can be determined by the following steps 6207 and 6210. Based on this, the credential application request also carries the device information of the user payment device used by the user. The step 620 can specifically include steps 6207 and 6210.

[0091] Step 6207, obtaining the user's personal certificate based on the identity information.

[0092] Step 6208, digitally sign the identity information, device information and user identity credentials through the user's personal certificate to obtain the second signature data.

[0093] Step 6209, sending a third request to the payment device system, the third request carrying the second signature data, the third request is used to request the payment device system to verify the second association relationship between the identity information and the device information based on the second signature data, and generate a device identity credential if the second association relationship passes the verification, the device identity credential is the data obtained after the payment device system performs a data signature on the identity information and the device information.

[0094] Step 6210, receiving the device identity certificate sent by the payment device system.

[0095] Exemplarily, the credential application request initiated by the payment application system may also carry the device information of the user payment device used by the user. At this time, the payment switching system may digitally sign the identity information, user identity credential and device information through the user's personal certificate to obtain the second signature data, so as to inform the payment device management system of the authenticity of its identity information and user identity credential, that is, to send the second signature data to the payment device management system. In this way, the payment device management system can verify the second association relationship between the identity information in the second signature data and the user payment device based on the second signature data and the association relationship between the preset identity information and the user payment device (or, using the device management capability established by the payment device management system based on blockchain technology). In this way, when the second association relationship passes the verification, the identity information and device information are digitally signed through the system certificate of the payment device management system to send the account identity credential to the payment switching system, thereby obtaining the device identity credential.

[0096] Therefore, during the payment preparation stages such as user registration, real-name authentication, and account binding, while verifying the user's real-name identity, an identity certificate that can represent the user's personal identity is obtained, and the account identity certificate is obtained from the account issuer system; for payment scenarios with personal payment devices, the device identity certificate is obtained from the device system, thereby establishing a digital identity certificate that integrates personal identity, device identity, and account identity. As a certificate from multiple sources, the digital identity certificate can be deposited in a neutral third party, or blockchain technology can be used to put the certificate on the chain, further reducing the risk of tampering when using a single-source certificate. It should be noted that identity information includes the user's ID number, and the user identity certificate includes an identity certificate identification code generated based on the user's ID number; the account identity certificate includes an identity certificate identification code generated based on the user's ID number and the user's user payment account; the device identity certificate includes an identity certificate identification code generated based on the user's ID number and the device identification number of the user payment device used by the user.

[0097] Involving step 630, in some embodiments of the present application, step 630 may specifically include steps 6301 to 6303.

[0098] Step 6301, sending a fourth request to the credential custodian system, the fourth request carrying the user identity credentials, the account identity credentials and the device identity credentials, the fourth request is used to request the credential custodian system to verify the third association relationship among the user identity credentials, the account identity credentials and the device identity credentials, and generate a credential custodian certificate when the third association relationship verification is successful.

[0099] Step 6302, receiving the credential custodian certificate sent by the credential custodian system.

[0100] Step 6303, digitally sign the user identity credential, account identity credential and device identity credential through the credential custodian certificate and the user's personal certificate to obtain a digital identity credential.

[0101] Exemplarily, after the payment switching system obtains the user identity credential, account identity credential, and device identity credential, the three types of identity credential are sent to the credential depository system, so that the credential depository system can associate the user identity credential identification code stored in advance with the designated user, and verify the digital signatures made by the identity authentication system, the account issuer system, and the payment device management system to ensure authenticity. If the identity credential verification by the three parties passes, the credential depository certificate can be sent to the credential depository system. In this way, the payment switching system 103 can digitally sign the user identity credential, account identity credential, and device identity credential through the user's personal certificate and the credential depository certificate to obtain a digital identity credential.

[0102] Furthermore, the above step 6303 may specifically include steps 63031 to 63033.

[0103] Step 63031, according to the preset business type, extract the business credential data corresponding to the preset business type from the user identity credential, the account identity credential and the device identity credential respectively.

[0104] Step 63032, data fusion is performed on the preset business credential data corresponding to the business type extracted from the user identity credential, the account identity credential and the device identity credential to obtain a fused credential file.

[0105] Step 63033, digitally sign the integrated credential file using the credential custodian certificate and the user's personal certificate to obtain a digital identity credential.

[0106] Exemplarily, business credential data corresponding to the preset business type can also be extracted from the user identity credential, account identity credential and device identity credential according to the preset business type, so as to be integrated into a digital identity credential. Specifically, according to the preset business type, business credential data corresponding to the preset business type are extracted respectively, such as attributes that can confirm the user identity, payment account, and the association relationship of the payment device, and attributes that can determine the authenticity of the user's authorization to use the current device and the account initiating the payment, etc. Then, these data can be integrated to obtain a fused credential file, and the credential depository certificate and the user's personal certificate are used to digitally sign the fused credential file to obtain a digital identity credential, forming a digital identity credential used to prove the user's digital identity in the electronic payment business and reflect the user's willingness to pay.

[0107] In addition, in some embodiments of the present application, after step 630, the data processing method may further include step 6401, sending a first instruction to the payment application system, the first instruction carrying the digital identity credential, the first instruction being used to instruct the payment application system to store the digital identity credential, and to use the digital identity credential as a credential for proving the user's digital identity in the electronic payment business and reflecting the user's willingness to pay when the payment device initiates a payment request.

[0108] And, in some other embodiments of the present application, after step 630, the data processing method may further include step 6402, sending a second instruction to the credential custodian system, the second instruction carrying the digital identity credential, processing information for determining the identity credential set, and the public key of the digital signature of the target system, the second instruction being used to instruct the credential custodian system to store the digital identity credential, and verifying the data related to the identity credential set based on the processing information and the public key when the payment device initiates a payment request, wherein the target system includes at least one of the following: a payment acceptance system for accepting payment requests, a payment transfer system, and an account issuer system for settling transaction orders carried in payment requests.

[0109] Therefore, the voucher depository system provides voucher information storage and query service capabilities. When or after payment occurs, each system can verify the voucher as needed, which can be used to verify the real-time authorization of the payment transaction during the payment process, and to verify the investigation and evidence collection when there are disputes, risks, regulatory inspections, etc. after the payment occurs. The validity of the voucher is guaranteed by the voucher depository system.

[0110] Based on this, in the transaction stage, after step 630, the data processing method may further include steps 6501 to 6503, as specifically shown below.

[0111] Step 6501, receiving a payment request initiated by the payment application system. The payment request carries a transaction order and a target credential. The target credential includes a digital identity credential or a business feature credential. The business feature credential is data obtained by digitally signing the business features related to the transaction order extracted from the digital identity credential. The business feature credential is used to prove the digital identity of the user in the business related to the transaction order and is a credential reflecting the user's willingness to pay.

[0112] Step 6502, a verification request is sent to the credential depository system. The verification request carries the target credential. The verification request is used to request the credential depository system to verify the target credential and generate verification pass information if the target credential is verified.

[0113] Therefore, after obtaining the digital identity certificate, the digital identity certificate is used as the basis for identifying the user's identity and willingness to pay. If the compliance of the digital identity certificate itself needs to be verified, it can be done through the verification service provided by the certificate depository system, which effectively reduces the difficulty of achieving mutual recognition among multiple business parties.

[0114] Step 6503, upon receiving the verification information sent by the credential custodian system, based on the user payment account in the transaction order, a resource transfer request is sent to the account issuer system corresponding to the user payment account. The resource transfer request carries the target credential and the transaction order. The resource transfer request is used to request the account issuer system to verify the target credential through the credential custodian system, and settle the transaction order when the target credential is verified.

[0115] Therefore, during the actual payment stage of the user, the digital identity credentials are delivered to all parties involved in the payment business according to the actual needs of the payment scenario. During the credential delivery process, the digital identity credentials are used to ensure integrity and authenticity, reducing the risk of the digital identity credentials being tampered with by a certain party.

[0116] The present application also provides a data processing device, specifically in combination with Figure 7 Provide detailed explanation.

[0117] Figure 7 It is a structural diagram of a data processing device provided by an embodiment of the present application.

[0118] In some embodiments of the present application, Figure 7 The data processing device shown can be arranged in the payment switching system provided in the embodiment of the present application.

[0119] like Figure 7 As shown, the data processing device 70 may specifically include:

[0120] The receiving module 701 is used to receive a credential application request initiated by the payment application system, and the credential application request carries the user's identity information;

[0121] Determination module 702, used to determine the user's identity credential set according to the identity information, the identity credential set includes user identity credential, account identity credential and device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device;

[0122] The determination module 702 is also used to determine the digital identity credential based on the user identity credential, the account identity credential and the device identity credential. The digital identity credential is a credential used to prove the user's digital identity in the electronic payment business and reflect the user's willingness to pay.

[0123] The data processing device 70 in the embodiment of the present application is described in detail below.

[0124] In some embodiments of the present application, the data processing device 70 in the embodiments of the present application may further include a sending module; wherein,

[0125] A sending module, used to send a first request to the identity authentication system, the first request carries identity information, the first request is used to request the identity authentication system to verify the identity information, and generate a user identity credential corresponding to the identity information if the identity information passes the verification, the user identity credential is data obtained after the identity authentication system digitally signs the identity information;

[0126] The receiving module 701 may also be used to receive user identity credentials sent by an identity authentication system.

[0127] In some embodiments of the present application, the data processing device 70 in the embodiment of the present application may also include an acquisition module, a processing module and a sending module; wherein,

[0128] The acquisition module is used to obtain the user's personal certificate based on the identity information;

[0129] A processing module, used to digitally sign the identity information and the user identity credential through the user's personal certificate to obtain first signature data;

[0130] a sending module, configured to send a second request to the account issuer system, the second request carrying the first signature data, the second request being used to request the account issuer system to verify the first association relationship between the identity information and the user payment account of the user based on the first signature data, and to generate an account identity credential if the first association relationship passes the verification, the account identity credential being data obtained after the account issuer system digitally signs the identity information and the user payment account;

[0131] The receiving module 701 can also be used to receive the account identity certificate sent by the identity authentication system.

[0132] In some embodiments of the present application, the data processing device 70 in the embodiment of the present application may also include an acquisition module, a processing module and a sending module; wherein,

[0133] An acquisition module, used to acquire a user personal certificate of the user according to the identity information when the credential application request also carries the device information of the user payment device used by the user;

[0134] A processing module, used to digitally sign the identity information, device information and user identity certificate through the user's personal certificate to obtain second signature data;

[0135] a sending module, configured to send a third request to the payment device system, the third request carrying the second signature data, the third request being used to request the payment device system to verify the second association relationship between the identity information and the device information based on the second signature data, and to generate a device identity credential when the second association relationship passes the verification, the device identity credential being data obtained after the payment device system performs a data signature on the identity information and the device information;

[0136] The receiving module 701 may also be used to receive a device identity certificate sent by a payment device system.

[0137] In some embodiments of the present application, the identity information includes a user identification document number, and the user identity credential includes an identity credential identification code generated based on the user identification document number;

[0138] The account identity credential includes an identity credential identification code generated based on the user's identity document number and the user's user payment account number;

[0139] The device identity credential includes an identity credential identification code generated based on the user's identity document number and the device identification number of the user payment device used by the user.

[0140] In some embodiments of the present application, the data processing device 70 in the embodiment of the present application may also include a sending module and a processing module; wherein,

[0141] a sending module, configured to send a fourth request to the credential depository system, the fourth request carrying the user identity credential, the account identity credential, and the device identity credential, the fourth request being used to request the credential depository system to verify a third association relationship among the user identity credential, the account identity credential, and the device identity credential, and to generate a credential depository certificate when the third association relationship verification passes;

[0142] The receiving module 701 may also be used to receive a credential depository certificate sent by the credential depository system;

[0143] The processing module is used to digitally sign the user identity certificate, account identity certificate and device identity certificate through the certificate depository certificate and the user's personal certificate to obtain a digital identity certificate.

[0144] In some embodiments of the present application, the processing module may be specifically used to extract business credential data corresponding to a preset business type from the user identity credential, the account identity credential, and the device identity credential, respectively, according to the preset business type;

[0145] Performing data fusion on preset business credential data corresponding to the business type extracted from the user identity credential, the account identity credential, and the device identity credential to obtain a fused credential file;

[0146] The fused credential file is digitally signed using the credential custodian certificate and the user's personal certificate to obtain a digital identity credential.

[0147] In some embodiments of the present application, the data processing device 70 in the embodiments of the present application may further include a sending module; wherein,

[0148] A first instruction is sent to the payment application system, the first instruction carrying the digital identity credential, the first instruction is used to instruct the payment application system to store the digital identity credential, and to use the digital identity credential as a credential for proving the user's digital identity in the electronic payment business and reflecting the user's willingness to pay when the payment device initiates a payment request.

[0149] In some embodiments of the present application, the data processing device 70 in the embodiments of the present application may further include a sending module; wherein,

[0150] A second instruction is sent to the credential custodian system, the second instruction carries the digital identity credential, processing information for determining the identity credential set, and the public key of the digital signature of the target system, the second instruction is used to instruct the credential custodian system to store the digital identity credential, and verify the data related to the identity credential set based on the processing information and the public key when the payment device initiates a payment request, wherein the target system includes at least one of the following: a payment acceptance system for accepting payment requests, a payment switching system, and an account issuer system for settling transaction orders carried in payment requests.

[0151] In some embodiments of the present application, the data processing device 70 in the embodiments of the present application may further include a sending module; wherein,

[0152] The receiving module 701 is also used to receive a payment request initiated by the payment application system, the payment request carries a transaction order and a target credential, the target credential includes a digital identity credential or a business feature credential, the business feature credential is data obtained by digitally signing a business feature related to the transaction order extracted from the digital identity credential, and the business feature credential is used to prove the digital identity of the user in the business related to the transaction order and a credential reflecting the user's willingness to pay;

[0153] A sending module is used to send a verification request to the credential depository system. The verification request carries the target credential. The verification request is used to request the credential depository system to verify the target credential and generate verification pass information if the target credential is verified;

[0154] The sending module is also used to, upon receiving the verification information sent by the credential custodian system, send a resource transfer request to the account issuer system corresponding to the user payment account based on the user payment account in the transaction order. The resource transfer request carries the target credential and the transaction order. The resource transfer request is used to request the account issuer system to verify the target credential through the credential custodian system, and settle the transaction order when the target credential is verified.

[0155] Therefore, the data processing device of the embodiment of the present application can determine the user's identity credential set through the user's identity information carried in the credential application request initiated by the payment application system, and the identity credential set includes user identity credentials, account identity credentials and device identity credentials, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device; then, based on the user identity credential, account identity credential and device identity credential, determine the digital identity credential, which is a credential used to prove the user's digital identity in the electronic payment business and reflect the user's willingness to pay. In this way, a hybrid digital identity credential is created that integrates multiple attributes of the user's personal identity, user's payment account, and user's payment device, and establishes an integrated credential of personal identity, device identity, and account identity. This can be used as a credential to prove the user's true willingness to pay from multiple dimensions when an electronic payment transaction occurs, and the user's transaction data can be anonymized and desensitized, thereby eliminating the possibility of leakage of user transaction data during electronic payment transactions at the source, avoiding the situation where user transaction data is easily leaked and tampered with, improving the security of transaction data while reducing the transmission encryption, storage encryption and other resources invested by each processing end to protect user transaction data.

[0156] Based on the same inventive concept, the present application also provides a computer device. Figure 8 Provide detailed explanation.

[0157] Figure 8 It is a schematic diagram of the structure of a computer device provided by an embodiment of the present application.

[0158] like Figure 8 As shown, the computer device may include at least one of the following involved in the embodiments of the present application: an electronic device corresponding to the payment application system, a server corresponding to the payment switching system, a server corresponding to the identity authentication system, a server corresponding to the account issuer system, a server corresponding to the payment device manager system, a server corresponding to the credential depository system, and an electronic device or server corresponding to the payment acceptance system. The computer device may include a processor 801 and a memory 802 storing computer program instructions.

[0159] Specifically, the processor 801 may include a central processing unit (CPU), or an application specific integrated circuit (Application Specific Integrated Circuit (ASTC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0160] The memory 802 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 802 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 802 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 802 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 802 is a non-volatile solid-state memory. In a specific embodiment, the memory 802 includes a solid-state storage (ROM). In appropriate cases, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM) or a flash memory or a combination of two or more of these.

[0161] The processor 801 implements any one of the data processing methods in the above embodiments by reading and executing computer program instructions stored in the memory 802 .

[0162] In one example, the computer device may further include a communication interface 803 and a bus 810. Figure 8 As shown, the processor 801, the memory 802, and the communication interface 803 are connected via a bus 810 and communicate with each other.

[0163] The communication interface 803 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0164] Bus 810 includes hardware, software or both, and the parts of flow control device are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industry standard system (ETSA) bus, front side bus (FSB), hypertransport (HT) interconnection, industry standard system (TSA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel system (MCA) bus, peripheral component interconnection (PCT) bus, PCT-Express (PCT-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 810 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0165] The data processing device can execute the data processing method in the embodiment of the present application, thereby realizing the combination Figures 1 to 8 The data processing method and device described.

[0166] In addition, in combination with the data processing method in the above embodiments, the present application embodiment can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the data processing methods in the above embodiments is implemented.

[0167] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0168] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0169] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0170] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A data processing method, characterized in that: Applied to payment switching systems, including: Receiving a credential application request initiated by a payment application system, wherein the credential application request carries the user's identity information; Determine the user's identity credential set according to the identity information, the identity credential set including the user identity credential, the account identity credential and the device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device; Based on the user identity credential, the account identity credential and the device identity credential, a digital identity credential is determined, where the digital identity credential is a credential used to prove the digital identity of the user in the electronic payment business and to reflect the user's willingness to pay.

2. The method according to claim 1, characterized in that Determining the user's identity credential set according to the identity information includes: Sending a first request to an identity authentication system, the first request carrying the identity information, the first request being used to request the identity authentication system to verify the identity information, and generating a user identity credential corresponding to the identity information if the identity information passes the verification, the user identity credential being data obtained after the identity authentication system digitally signs the identity information; Receive the user identity credential sent by the identity authentication system.

3. The method according to claim 2, characterized in that Determining the user's identity credential set according to the identity information includes: According to the identity information, obtaining the user's personal certificate; Digitally signing the identity information and the user identity credential using the user personal certificate to obtain first signature data; Sending a second request to the account issuer system, the second request carrying the first signature data, the second request being used to request the account issuer system to verify the first association relationship between the identity information and the user payment account of the user based on the first signature data, and generating the account identity credential if the first association relationship passes the verification, the account identity credential being data obtained after the account issuer system digitally signs the identity information and the user payment account; Receive the account identity credential sent by the identity authentication system.

4. The method according to claim 2, characterized in that: The credential application request also carries device information of a user payment device used by the user; and determining the user's identity credential set based on the identity information includes: According to the identity information, obtaining the user's personal certificate; Digitally signing the identity information, the device information and the user identity certificate using the user personal certificate to obtain second signature data; Sending a third request to the payment device system, the third request carrying the second signature data, the third request being used to request the payment device system to verify the second association relationship between the identity information and the device information based on the second signature data, and generating the device identity credential if the second association relationship passes the verification, the device identity credential being data obtained after the payment device system performs a data signature on the identity information and the device information; Receive the device identity credential sent by the payment device system.

5. The method according to any one of claims 1 to 4, characterized in that: The identity information includes the user's identity document number, and the user's identity credential includes an identity credential identification code generated based on the user's identity document number; The account identity certificate includes an identity certificate identification code generated based on the user's identity document number and the user's user payment account number; The device identity credential includes an identity credential identification code generated based on the user identity document number and the device identification number of the user payment device used by the user.

6. The method according to claim 1, characterized in that The determining of the digital identity credential based on the user identity credential, the account identity credential and the device identity credential includes: Sending a fourth request to the credential depository system, the fourth request carrying the user identity credential, the account identity credential, and the device identity credential, the fourth request being used to request the credential depository system to verify a third association relationship among the user identity credential, the account identity credential, and the device identity credential, and generating a credential depository certificate when the third association relationship is verified successfully; Receiving the credential depository certificate sent by the credential depository system; The user identity credential, the account identity credential and the device identity credential are digitally signed by using the credential depository certificate and the user's personal certificate to obtain the digital identity credential.

7. The method according to claim 6, characterized in that The step of digitally signing the user identity certificate, the account identity certificate and the device identity certificate by using the certificate depository certificate and the user's personal certificate to obtain the digital identity certificate includes: According to the preset business type, extracting business credential data corresponding to the preset business type from the user identity credential, the account identity credential and the device identity credential respectively; fusing preset business credential data corresponding to the business type extracted from the user identity credential, the account identity credential, and the device identity credential to obtain a fused credential file; The fusion credential file is digitally signed by the credential depository certificate and the user's personal certificate to obtain the digital identity credential.

8. The method according to claim 1, characterized in that The method further comprises: A first instruction is sent to the payment application system, wherein the first instruction carries the digital identity credential, and the first instruction is used to instruct the payment application system to store the digital identity credential and use the digital identity credential as a credential for proving the user's digital identity in the electronic payment business and reflecting the user's willingness to pay when the payment device initiates a payment request.

9. The method according to claim 1, characterized in that: The method further comprises: A second instruction is sent to the credential depository system, wherein the second instruction carries the digital identity credential, processing information for determining the identity credential set, and a public key of a digital signature of a target system, wherein the second instruction is used to instruct the credential depository system to store the digital identity credential and verify data related to the identity credential set based on the processing information and the public key when the payment device initiates a payment request, wherein the target system includes at least one of the following: a payment acceptance system for accepting the payment request, the payment switching system, and an account issuer system for settling the transaction order carried in the payment request.

10. The method according to claim 1 or 9, characterized in that: The method further comprises: Receive a payment request initiated by the payment application system, the payment request carrying a transaction order and a target credential, the target credential including the digital identity credential or the business feature credential, the business feature credential being data obtained by digitally signing a business feature related to the transaction order extracted from the digital identity credential, the business feature credential being used to prove the digital identity of the user in the business related to the transaction order and a credential reflecting the user's willingness to pay; Sending a verification request to the credential depository system, the verification request carrying the target credential, the verification request being used to request the credential depository system to verify the target credential, and generating verification pass information if the target credential is verified; Upon receiving the verification information sent by the credential custodian system, based on the user payment account in the transaction order, a resource transfer request is sent to the account issuer system corresponding to the user payment account, and the resource transfer request carries the target credential and the transaction order. The resource transfer request is used to request the account issuer system to verify the target credential through the credential custodian system, and settle the transaction order when the target credential is verified.

11. A data processing system, characterized in that: Including payment application system and payment transfer system; among which, The payment application system is used to initiate a credential application request, wherein the credential application request carries the user's identity information; The payment switching system is used to determine the user's identity credential set based on the identity information, wherein the identity credential set includes a user identity credential, an account identity credential, and a device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device; The payment switching system is also used to determine a digital identity credential based on the user identity credential, the account identity credential and the device identity credential. The digital identity credential is a credential used to prove the user's digital identity in the electronic payment business and reflect the user's willingness to pay.

12. The system according to claim 11, characterized in that The data processing system also includes an identity authentication system; wherein, The payment switching system is specifically used to send a first request to the identity authentication system, where the first request carries the identity information; The identity authentication system is used to verify the identity information, and when the identity information passes the verification, digitally sign the identity information to obtain a user identity certificate corresponding to the identity information; and send the user identity certificate to the payment switching system.

13. The system according to claim 12, characterized in that The data processing system also includes an account issuer system; wherein, The payment switching system is further used to obtain a user personal certificate of the user according to the identity information; digitally sign the identity information and the user identity credential through the user personal certificate to obtain first signature data; and send a second request to the account issuer system, wherein the second request carries the first signature data; The account issuer system is used to verify the first association relationship between the identity information and the user's user payment account based on the first signature data, and when the first association relationship is verified, digitally sign the identity information and the user payment account to obtain the account identity certificate; and send the account identity certificate to the payment switching system.

14. The system according to claim 12, characterized in that The credential application request also carries device information of a user payment device used by the user, and the data processing system also includes a payment device management system; wherein, The payment switching system is further used to obtain a user personal certificate of the user according to the identity information; digitally sign the identity information, the device information and the user identity certificate through the user personal certificate to obtain second signature data; and send a third request to the payment device system, wherein the third request carries the second signature data; The payment device management system is used to verify the second association relationship between the identity information and the device information based on the second signature data, and if the second association relationship passes the verification, perform data signing on the identity information and the device information to obtain the device identity credential; and send the device identity credential to the payment device system.

15. The system according to claim 11, characterized in that The data processing system also includes a voucher depository system; wherein, The payment switching system is further used to send a fourth request to the credential depository system, wherein the fourth request carries the user identity credential, the account identity credential and the device identity credential; The credential depository system is configured to verify, based on the fourth request, a third association relationship among the user identity credential, the account identity credential, and the device identity credential, and generate a credential depository certificate if the third association relationship is verified successfully; and send the credential depository certificate to the credential depository system; The payment switching system is also used to digitally sign the user identity certificate, the account identity certificate and the device identity certificate through the certificate depository certificate and the user's personal certificate to obtain the digital identity certificate.

16. The system according to claim 15, wherein the credential depository system is further configured to, based on a second instruction sent by the payment switching system, store the digital identity credential carried by the second instruction, information on a process for determining the identity credential set, and public keys of digital signatures of multiple processing systems; In the case where the payment application system initiates a payment request, receiving a verification request sent by the target system, the payment request carries a transaction order and a target credential, and the target credential includes the digital identity credential; Based on the verification request, verify the target credential through the digital identity credential, the processing information for determining the identity credential set and the public key of the digital signature of multiple processing systems, wherein the target system includes at least one of the following: the payment acceptance system for accepting the payment request, the payment switching system and the account issuer system for settling the transaction order; When the target credential is verified, verification pass information is sent to the target system.

17. A data processing device, applied to a payment switching system, comprising: A receiving module, used to receive a credential application request initiated by a payment application system, wherein the credential application request carries the user's identity information; A determination module, configured to determine a set of identity credentials of the user according to the identity information, wherein the set of identity credentials includes a user identity credential, an account identity credential, and a device identity credential, wherein the user identity credential is a credential used to represent the user's personal identity, the account identity credential is a credential used to represent the user's payment account, and the device identity credential is a credential used to represent the user's payment device; The determination module is also used to determine a digital identity credential based on the user identity credential, the account identity credential and the device identity credential, wherein the digital identity credential is a credential used to prove the user's digital identity in the electronic payment business and reflect the user's willingness to pay.

18. A computer device, the device comprising: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the steps of the data processing method according to any one of claims 1 to 10 are implemented.

19. A storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the steps of the data processing method according to any one of claims 1 to 10.

20. A computer program product, characterized in that The program product is stored in a storage medium, and the program product is executed by at least one processor to implement the steps of the data processing method according to any one of claims 1 to 10.

Images