Account processing method and device, equipment, storage medium and program product
By determining and removing the flag and check bits in the account processing, encrypting the intermediate account and generating a marked account, the problems of insufficient account processing reliability and transaction security in the existing technology are solved, and higher account protection and transaction security are achieved.
Patent Information
- Application Number
- CN202411696505.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-25
- Publication Date
- 2025-02-28
AI Technical Summary
After the prior art encrypted account, the check bits and flag bits cannot be recognized, resulting in poor reliability of account processing, and the verification process and flag bit recognition process of encrypted account cannot be performed during the transaction, affecting the security of the transaction.
By obtaining the identification of the channel server and external applications, obtaining the encryption key, and determining the flag bit and check bit in the initial account, eliminating it, encrypting the intermediate account, generating a cipher-text account, and generating a tagged account in combination with the flag bit, check bit and cipher-text account.
It effectively protects the real account, avoids the problem of not identifying the flag and check digits, improves the reliability of account processing, and enhances the security of transactions.
Smart Images
Figure CN119538294A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to an account processing method, device, equipment, storage medium and program product. Background Art
[0002] When users make purchases through third-party applications (eg, shopping software, entertainment software, etc.), they need to pay through a real account (eg, a bank account).
[0003] In the related art, in order to avoid leaking the real account number to a third-party application, when the account number needs to be provided to the third-party application, the account number is usually encrypted and the encrypted account number is provided to the third-party application. However, after the account number is encrypted, the check bit and the flag bit cannot be identified in the encrypted account number, making it impossible to perform check processing and flag bit identification processing on the encrypted account number, resulting in poor reliability of account processing. Summary of the invention
[0004] The present application provides an account processing method, device, equipment, storage medium and program product to solve the problem of poor reliability of account processing.
[0005] In a first aspect, the present application provides a method for processing an account, comprising:
[0006] Obtaining an account marking request sent by a channel server, the account marking request including an initial account, an identifier of the channel server and an identifier of an external application, the channel server being used to assist the external application in conducting transactions;
[0007] Obtaining an encryption key according to the identifier of the channel server and the identifier of the external application;
[0008] Determine a flag bit and a check bit in the initial account, and determine the account number in the initial account except the flag bit and the check bit as an intermediate account;
[0009] Encrypt the intermediate account number according to the encryption key to obtain a ciphertext account number;
[0010] A marked account is generated according to the identifier of the channel server, the identifier of the external application, the flag bit, the check bit and the ciphertext account, and the marked account is sent to the channel server.
[0011] In a possible implementation, encrypting the intermediate account according to the encryption key to obtain a ciphertext account includes:
[0012] Dividing the intermediate account into a front portion account and a rear portion account;
[0013] Perform multiple iterative encryption processes on the front part of the account and the back part of the account according to the encryption key to obtain a front encrypted account and a back encrypted account;
[0014] The ciphertext account is determined according to the pre-encryption account and the post-encryption account.
[0015] In a possible implementation, performing multiple iterative encryption processes on the front part of the account and the back part of the account according to the encryption key to obtain the front encrypted account and the back encrypted account includes:
[0016] For the first iteration process, determining a first front result and a first back result according to the encryption key, the front part account number and the back part account number;
[0017] For the i-th iteration process, determine the i-th result before and the i-th result after according to the encryption key, the i-1-th result before and the i-1-th result after, where i is a positive integer greater than 1;
[0018] The front result obtained by the Kth iterative processing is determined as the front encrypted account, and the rear result obtained by the last iterative processing is determined as the rear encrypted account, where K is a preset number of iterations and K is an integer greater than 1.
[0019] In a possible implementation, determining a first front result and a first back result according to the encryption key, the front part account number and the back part account number includes:
[0020] The latter part of the account number is encrypted by using the encryption key to obtain an encrypted value;
[0021] Performing an XOR operation on the first part of the account number and the encrypted value to obtain an operation value;
[0022] The latter partial account number is determined as the first former result, and the calculated value is determined as the first latter result.
[0023] In a possible implementation, generating a marked account according to the identifier of the channel server, the identifier of the external application, the flag bit, the check bit, and the ciphertext account includes:
[0024] Determining a target identifier according to the identifier of the channel server and the identifier of the external application;
[0025] The target identifier, the flag bit, the ciphertext account number and the check bit are combined to obtain the marked account number.
[0026] In a possible implementation, obtaining an encryption key according to the identifier of the channel server and the identifier of the external application includes:
[0027] Sending a key acquisition request to an encryption device, wherein the key acquisition request includes an identifier of the channel server and an identifier of the external application;
[0028] The encryption key sent by the encryption device is received, where the encryption key is generated by the encryption device according to the identifier of the server and the identifier of the external application.
[0029] In a possible implementation, determining a flag bit and a check bit in the initial account number includes:
[0030] Determine the card type corresponding to the initial account;
[0031] According to the card type, the first M digits of the initial account number are determined as the flag digits, where M is an integer greater than or equal to 1;
[0032] According to the card type, the last N digits of the initial account number are determined as the check digits, where N is an integer greater than or equal to 1.
[0033] In a second aspect, the present application provides an account processing device, comprising: a first acquisition module, a second acquisition module, a determination module, an encryption module and a processing module, wherein:
[0034] The first acquisition module is used to acquire an account mark request sent by a channel server, wherein the account mark request includes an initial account, an identifier of the channel server and an identifier of an external application, and the channel server is used to assist the external application in conducting transactions;
[0035] The second acquisition module is used to acquire an encryption key according to the identifier of the channel server and the identifier of the external application;
[0036] The determination module is used to determine a flag bit and a check bit in the initial account, and determine the account number in the initial account other than the flag bit and the check bit as an intermediate account;
[0037] The encryption module is used to encrypt the intermediate account according to the encryption key to obtain a ciphertext account;
[0038] The processing module is used to generate a marked account according to the identifier of the channel server, the identifier of the external application, the flag bit, the check bit and the ciphertext account, and send the marked account to the channel server.
[0039] In a possible implementation manner, the encryption module is specifically used for:
[0040] Dividing the intermediate account into a front portion account and a rear portion account;
[0041] Perform multiple iterative encryption processes on the front part of the account and the back part of the account according to the encryption key to obtain a front encrypted account and a back encrypted account;
[0042] The ciphertext account is determined according to the pre-encryption account and the post-encryption account.
[0043] In a possible implementation manner, the encryption module is specifically used for:
[0044] For the first iteration process, determining a first front result and a first back result according to the encryption key, the front part account number and the back part account number;
[0045] For the i-th iteration process, determine the i-th result before and the i-th result after according to the encryption key, the i-1-th result before and the i-1-th result after, where i is a positive integer greater than 1;
[0046] The front result obtained by the Kth iterative processing is determined as the front encrypted account, and the rear result obtained by the last iterative processing is determined as the rear encrypted account, where K is a preset number of iterations and K is an integer greater than 1.
[0047] In a possible implementation manner, the encryption module is specifically used for:
[0048] The latter part of the account number is encrypted by the encryption key to obtain an encrypted value;
[0049] Performing an XOR operation on the first part of the account number and the encrypted value to obtain an operation value;
[0050] The latter partial account number is determined as the first former result, and the calculated value is determined as the first latter result.
[0051] In a possible implementation manner, the processing module is specifically used to:
[0052] Determining a target identifier according to the identifier of the channel server and the identifier of the external application;
[0053] The target identifier, the flag bit, the ciphertext account number and the check bit are combined to obtain the marked account number.
[0054] In a possible implementation manner, the second acquisition module is specifically configured to:
[0055] Sending a key acquisition request to an encryption device, wherein the key acquisition request includes an identifier of the channel server and an identifier of the external application;
[0056] The encryption key sent by the encryption device is received, where the encryption key is generated by the encryption device according to the identifier of the server and the identifier of the external application.
[0057] In a possible implementation manner, the determining module is specifically configured to:
[0058] Determine the card type corresponding to the initial account;
[0059] According to the card type, the first M digits of the initial account number are determined as the flag digits, where M is an integer greater than or equal to 1;
[0060] According to the card type, the last N digits of the initial account number are determined as the check digits, where N is an integer greater than or equal to 1.
[0061] In the third aspect, an embodiment of the present application provides an account processing device, comprising: at least one processor and a memory; the memory stores computer execution instructions; at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the account processing method as described in the first aspect above and various possible designs of the first aspect.
[0062] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the account processing method as described in the first aspect and various possible designs of the first aspect are implemented.
[0063] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the account processing method as described in the first aspect and various possible designs of the first aspect.
[0064] The account processing method, device, equipment, storage medium and program product provided by the present application, when processing an account, encrypts the intermediate account of the account (the account except the flag bit and the check bit) to obtain a ciphertext account, and processes the flag bit, the check bit and the ciphertext account to obtain a marked account. In the above process, not only the real account is protected, but also the problem of not being able to identify the flag bit and the check bit is avoided, thereby improving the reliability of account processing. Furthermore, the problem of being unable to verify the encrypted account and identify the flag bit during the transaction process is avoided, thereby improving the security of the transaction. BRIEF DESCRIPTION OF THE DRAWINGS
[0065] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0066] Figure 1 A schematic diagram of the system architecture provided for an embodiment of the present application;
[0067] Figure 2 A flowchart of an account processing method provided in an embodiment of the present application;
[0068] Figure 3 A schematic diagram of a process for generating a ciphertext account provided in an embodiment of the present application;
[0069] Figure 4 A flowchart of another account processing method provided for an embodiment of the present application;
[0070] Figure 5 A schematic diagram of the structure of an account processing device provided in an embodiment of the present application;
[0071] Figure 6 A schematic diagram of the structure of the account processing device provided in an embodiment of the present application.
[0072] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION
[0073] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0074] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.
[0075] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.
[0076] For ease of understanding, the following Figure 1 , the system architecture applicable to the embodiments of the present application is described.
[0077] Figure 1 This is a schematic diagram of the system architecture provided by the embodiment of this application. Figure 1 , including a terminal device 101, a channel server 102, a transaction server 103 and an account processing device 104.
[0078] The terminal device is provided with an external application (also called a third-party application), and the user can make purchases through the external application in the terminal device. In the process of making purchases through the external application, payment needs to be made through the channel server and the transaction server. For example, the channel server can be a server authorized by the bank to make payments, and the transaction server can be the backend server of the bank.
[0079] During the payment process through the channel server and the transaction server, when it is necessary to provide the account number of the transaction account to an external application, the account processing device can process the account number to obtain a marked account number and provide the marked account number to the third-party application to avoid leaking the real account number to the external application.
[0080] In the related art, in order to avoid leaking the real account number to a third-party application, when the account number needs to be provided to the third-party application, the account number is usually encrypted and the encrypted account number is provided to the third-party application. However, after the account number is encrypted, the check bit and the flag bit cannot be identified in the encrypted account number, making it impossible to perform check processing and flag bit identification processing on the encrypted account number, resulting in poor reliability of account number processing. Furthermore, during the transaction process, since it is impossible to perform check processing and flag identification processing on the encrypted account number, the transaction security may be poor.
[0081] In view of the above technical problems, in the embodiment of the present application, in order to avoid the problem that the flag bit and the check bit cannot be identified in the marked account, when processing the account, the intermediate account of the account (the account other than the flag bit and the check bit) is encrypted to obtain the ciphertext account, and the flag bit, the check bit and the ciphertext account are processed to obtain the marked account. In the above process, not only the real account is protected, but also the problem of not being able to identify the flag bit and the check bit is avoided, thereby improving the reliability of account processing. Furthermore, the problem that the encrypted account cannot be verified and the flag bit cannot be identified during the transaction process is avoided, thereby improving the security of the transaction.
[0082] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.
[0083] Figure 2 This is a flowchart of an account processing method provided in an embodiment of the present application. Figure 2 As shown, the method may include the following steps:
[0084] S201. Obtain an account marking request sent by a channel server.
[0085] The execution subject of the embodiment of the present application may be an account processing device, or an account processing apparatus in the account processing device. The account processing apparatus may be implemented by software, or by a combination of software and hardware.
[0086] The account tag request includes the initial account, the identifier of the channel server and the identifier of the external application.
[0087] The account tagging request is used to request tagging of the initial account.
[0088] The initial account number is a real account number to be marked. For example, the initial account number can be a user's bank card number.
[0089] The channel server is used to assist in transactions. For example, the channel server can be a server corresponding to a payment application.
[0090] The external application is an application installed in the terminal device, and the user can perform operations such as shopping through the external application in the terminal device to initiate payment. For example, the external application can be shopping software, entertainment software, etc.
[0091] The channel server is used to assist external applications in conducting transactions. For example, the channel server is used to assist external applications in making payments. The channel server may be a server authorized by a bank to make payments.
[0092] During a payment process, when the channel server needs to provide an account number to an external application and there is no marked account corresponding to the account number in the channel server, the channel server can send an account marking request to the account processing device to request the account processing device to mark the account number.
[0093] S202: Obtain an encryption key according to the identifier of the channel server and the identifier of the external application.
[0094] The length of the encryption key may be a preset length, for example, the preset length may be 128 bits.
[0095] The encryption key can be obtained in the following manner: sending a key acquisition request to the encryption device, the key acquisition request includes the channel server identifier and the external application identifier; receiving the encryption key sent by the encryption device, the encryption key is generated by the encryption device according to the server identifier and the external application identifier. Optionally, the encryption device can process the server identifier and the external application identifier through the SM4 national encryption algorithm to obtain the encryption key.
[0096] After the encryption key is obtained, the identifier of the channel server, the identifier of the external application and the encryption key may be stored correspondingly.
[0097] S203: Determine a flag bit and a check bit in the initial account, and determine the account number other than the flag bit and the check bit in the initial account as an intermediate account.
[0098] The initial account number usually includes a flag bit and a check bit.
[0099] The flag bit can be used to indicate the issuing authority corresponding to the initial account number, and the flag bit is usually located in the first few digits of the initial account number.
[0100] The check digit is used to verify the initial account number, and is usually located at the last few digits of the initial account number.
[0101] The flag bit and the check bit can be determined in the initial account in the following manner: determine the card type corresponding to the initial account; determine the first M bits of the initial account as the flag bit according to the card type, and determine the last N bits of the initial account as the check bit according to the card type. Wherein, M is an integer greater than or equal to 1; N is an integer greater than or equal to 1.
[0102] The card type may indicate the issuing authority corresponding to the initial account number. The initial account number may be identified from the first digit of the initial account number in a sequence from front to back until the card type is obtained.
[0103] There may be a preset correspondence between the card type and M and N. Accordingly, M and N may be determined based on the card type and the preset correspondence, and the first M digits of the initial account number may be determined as flag digits. Based on the card type, the last N digits of the initial account number may be determined as check digits.
[0104] For example, the preset corresponding relationship may be as shown in Table 1:
[0105] Table 1
[0106] Card Type M N Card Type 1 5 1 Card Type 2 4 4 Card Type 3 4 4 …… …… ……
[0107] Please refer to Table 1. When the card type is different, the corresponding M and N may be the same or different. For example, when the card type corresponding to the account number is card type 1, the first 5 digits of the account number are the flag digits, and the last digit of the account number is the check digit.
[0108] For example, assuming that the initial account number is 18 digits, if M is 4 and N is 4, the first 4 digits of the initial account number are determined as the flag digit, the last 4 digits of the initial account number are determined as the check digit, and the middle 10 digits of the initial account number are determined as the intermediate account number. Assuming that the initial account number is 123411111222225555, the flag digit can be determined to be 1234, the check digit is 5555, and the intermediate account number is 1111122222.
[0109] S204. Encrypt the intermediate account number according to the encryption key to obtain a ciphertext account number.
[0110] The ciphertext account can be obtained in the following manner: divide the intermediate account into a front account and a rear account; perform multiple iterative encryption processes on the front account and the rear account according to the encryption key to obtain a front encrypted account and a rear encrypted account; determine the ciphertext account based on the front encrypted account and the rear encrypted account.
[0111] Optionally, if the number of digits of the intermediate account number is an even number, the intermediate account number may be evenly divided to obtain a front account number and a rear account number, and the lengths of the front account number and the rear account number are the same. For example, assuming that the intermediate account number is 10 digits, the first 5 digits of the intermediate account number may be determined as the front account number, and the last 5 digits of the intermediate account number may be determined as the rear account number.
[0112] Optionally, if the number of digits in the intermediate account is an odd number, the difference between the number of digits in the front part and the rear part is 1. For example, assuming that the intermediate account is 9 digits, the first 4 digits of the intermediate account can be determined as the front part, and the last 5 digits of the intermediate account can be determined as the rear part.
[0113] The algorithm and encryption key can be retained in FF1 format, and the front part of the account and the back part of the account can be encrypted multiple times to obtain the front encrypted account and the back encrypted account. Figure 3 The process of multiple iterative encryption processing is described in the illustrated embodiment and will not be repeated here.
[0114] The pre-encrypted account number and the post-encrypted account number can be concatenated to obtain the ciphertext account number.
[0115] For example, assuming the middle account number is 111111222222, divide the account into two parts, the front part is 111111, and the back part is 222222. After multiple iterative encryption of these two parts of the account according to the encryption key, the front encrypted account number is 123456 and the back encrypted account number is 456789, so the ciphertext account number is 123456456789.
[0116] S205. Generate a marked account according to the identifier of the channel server, the identifier of the external application, the flag bit, the check bit and the ciphertext account.
[0117] The marked account may be generated in the following manner: determining the target identifier according to the identifier of the channel server and the identifier of the external application; combining the target identifier, the flag bit, the ciphertext account number and the check bit to obtain the marked account number.
[0118] The channel server ID and the external application ID can be concatenated to obtain the target ID.
[0119] For example, assuming that the channel server identifier is 001, the external application identifier is 002, the flag bit is 1111, the ciphertext account is 22222222, and the check bit is 3333, the target identifier can be 001002, and the marked account can be as shown in Table 2:
[0120] Table 2
[0121] Target identification Flags Ciphertext account Check digit 001002 1111 22222222 3333
[0122] Referring to Table 2, it can be determined that the marked account number is: 00100211112222222223333.
[0123] S206. Send the marked account to the channel server.
[0124] In the embodiment of the present application, when processing the account, the front part of the account and the back part of the account are encrypted multiple times according to the encryption key to obtain the ciphertext account, and the channel server identifier, the external application identifier, the flag bit, the ciphertext account and the check bit are combined to obtain the marked account. In the above process, not only the real account is protected, but also the problem of not being able to identify the flag bit and the check bit is avoided, the reliability of account processing is improved, and further, the problem of being unable to verify the encrypted account and identify the flag bit during the transaction process is avoided, thereby improving the security of the transaction.
[0125] Based on any of the above embodiments, Figure 3 , the generation process of the ciphertext account ( Figure 2 S204) in the embodiment is described in detail.
[0126] Figure 3 This is a schematic diagram of the generation process of the encrypted account provided in the embodiment of this application. Figure 3 , the method may include:
[0127] S301, dividing the intermediate account into a front part account and a rear part account.
[0128] The execution process of S301 may refer to S204 and will not be described in detail here.
[0129] S302. Encrypt the latter part of the account number using the encryption key to obtain an encrypted value.
[0130] S303, perform an XOR operation on the first part of the account number and the encrypted value to obtain an operation value.
[0131] S304, determining the latter part of the account as the first front result, and determining the calculated value as the first rear result.
[0132] S305. Initialize i to 2.
[0133] S306. Determine the i-th result before and the i-th result after according to the encryption key, the i-1-th result before and the i-1-th result after.
[0134] The i-th result before and the i-th result after can be determined in the following manner: the i-th result after is encrypted according to an encryption key to obtain an encrypted value, and the encrypted value is XOR-ed with the i-1-th result before to obtain an operation value, which is determined as the i-th result after, and the i-1-th result after is determined as the i-th result before.
[0135] For example, assuming that i is 2, the first before result is A1, the first after result is B1, B1 is encrypted according to the encryption key to obtain an encrypted value, and the encrypted value and A1 are XORed to obtain B2, B2 is determined as the second after result, and B1 is determined as the second before result.
[0136] For example, assuming that i is 3, the second result before is A2, the second result after is B2, B2 is encrypted according to the encryption key to obtain an encrypted value, and the encrypted value and A2 are XORed to obtain B3, B3 is determined as the third result after, and B2 is determined as the third result before.
[0137] S307: Determine whether i is equal to K.
[0138] If yes, execute S309.
[0139] If not, execute S308.
[0140] K is a preset number of iterations, and K is an integer greater than or equal to 1.
[0141] The number of iterations may be determined according to actual needs. For example, the number of iterations may be set to 10.
[0142] S308. Update i to i+1.
[0143] After S308, S306 is executed.
[0144] S309: Determine the front result obtained by the Kth iterative processing as the front encrypted account, and determine the rear result obtained by the last iterative processing as the rear encrypted account.
[0145] S310. Determine the ciphertext account according to the pre-encrypted account and the post-encrypted account.
[0146] The pre-encrypted account number and the post-encrypted account number may be combined to obtain a ciphertext account number.
[0147] For example, if the pre-encrypted account number is 1234 and the post-encrypted account number is 5678, the ciphertext account number is 12345678.
[0148] In the embodiment of the present application, the first part of the account and the second part of the account are iteratively encrypted multiple times according to the encryption key to obtain the ciphertext account. Figure 3 The method shown in the embodiment protects the middle part of the account (the front part of the account and the back part of the account), ensures the security of the ciphertext account, and improves the reliability of account processing.
[0149] Figure 4 This is a flowchart of another account processing method provided in the embodiment of the present application. Figure 4 , the method may include:
[0150] S401. The channel server sends an account marking request to the account processing device.
[0151] The account tag request includes the initial account, the identifier of the channel server and the identifier of the external application.
[0152] The execution process of S401 can refer to the execution process of S201, which will not be described in detail here.
[0153] S402: The account processing device sends a key acquisition request to the encryption device.
[0154] The key acquisition request includes the identifier of the channel server and the identifier of the external application.
[0155] S403: The encryption device sends the encryption key to the account processing device.
[0156] The encryption algorithm of the encryption device can be the SM4 national encryption algorithm.
[0157] After obtaining the encryption key, the encryption device can store the channel server identifier, the external application identifier, and the encryption key in correspondence.
[0158] S404: The account processing device determines a flag bit and a check bit in the initial account, and determines the account number other than the flag bit and the check bit in the initial account as an intermediate account.
[0159] The flag bit can be used to indicate the issuing authority of the initial account number, and is usually located in the first few digits of the initial account number. The check bit is used to verify the initial account number, and is usually located in the last few digits of the initial account number.
[0160] For example, assuming the initial account number is 1234511111115678, according to the card type and the preset correspondence, the first 4 digits of the initial account number are determined as the flag digits, and the last 3 digits of the initial account number are determined as the check digits, then the intermediate account number is 511111115.
[0161] S405: The account processing device divides the intermediate account into a front account portion and a rear account portion.
[0162] S406. The account processing device encrypts the latter part of the account using the encryption key to obtain an encrypted value.
[0163] S407. The account processing device performs an XOR operation on the first part of the account and the encrypted value to obtain an operation value.
[0164] S408. The account processing device determines the latter part of the account as the first front result, and determines the calculated value as the first rear result.
[0165] S409. Initialize i to 2.
[0166] S410: The account processing device determines the i-th result before and the i-th result after according to the encryption key, the i-1-th result before and the i-1-th result after.
[0167] S411. Determine whether i is equal to K.
[0168] If yes, execute S413.
[0169] If not, execute S412.
[0170] S412. Update i to i+1.
[0171] After S412, S410 is executed.
[0172] S413: The account processing device determines the front result obtained by the Kth iterative processing as the front encrypted account, and determines the rear result obtained by the last iterative processing as the rear encrypted account.
[0173] S414. The account processing device determines the ciphertext account according to the pre-encrypted account and the post-encrypted account.
[0174] The execution process of S405-S414 can refer to the execution process of S301-S310, which will not be repeated here.
[0175] S415: The account processing device determines the target identifier according to the identifier of the channel server and the identifier of the external application.
[0176] The channel server identifier and the external application identifier may be concatenated in sequence to obtain a target identifier.
[0177] For example, assuming that the channel server's ID is 301 and the external application's ID is 011, the target ID is 301011.
[0178] S416. The account processing device combines the target identifier, the flag bit, the ciphertext account number and the check bit to obtain a marked account number.
[0179] S417: The account processing device sends the marked account to the channel server.
[0180] In actual application, the account processing device can receive the marked account sent by the channel server, and decrypt the marked account based on the encryption key, flag bit, check bit and target identifier to obtain the user's initial account.
[0181] In the embodiment of the present application, when processing the account, the intermediate account (the account except the flag bit and the check bit) of the account is encrypted to obtain the ciphertext account, and the target identifier, flag bit, ciphertext account and check bit are combined to obtain the marked account. In the above process, not only the real account is protected, but also the problem of not being able to identify the flag bit and the check bit is avoided, and the reliability of account processing is improved. Further, the transaction process is avoided. The problem of being unable to verify the encrypted account and identify the flag bit, and the problem of leaking the real account to a third-party application is avoided, thereby improving the security of the transaction.
[0182] Figure 5 For a structural diagram of an account processing device provided in an embodiment of the present application, see Figure 5 The service processing device 10 includes a first acquisition module 11, a second acquisition module 12, a determination module 13, an encryption module 14 and a processing module 15, wherein:
[0183] The first acquisition module 11 is used to acquire an account mark request sent by a channel server, wherein the account mark request includes an initial account, an identifier of the channel server and an identifier of an external application, and the channel server is used to assist the external application in conducting transactions;
[0184] The second acquisition module 12 is used to acquire an encryption key according to the identifier of the channel server and the identifier of the external application;
[0185] The determination module 13 is used to determine a flag bit and a check bit in the initial account, and determine the account number in the initial account other than the flag bit and the check bit as an intermediate account;
[0186] The encryption module 14 is used to encrypt the intermediate account according to the encryption key to obtain a ciphertext account;
[0187] The processing module 15 is used to generate a marked account according to the identifier of the channel server, the identifier of the external application, the flag bit, the check bit and the ciphertext account, and send the marked account to the channel server.
[0188] The account processing device provided in the embodiment of the present application can execute the method shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.
[0189] In a possible implementation manner, the encryption module 14 is specifically used for:
[0190] Dividing the intermediate account into a front portion account and a rear portion account;
[0191] Perform multiple iterative encryption processes on the front part of the account and the back part of the account according to the encryption key to obtain a front encrypted account and a back encrypted account;
[0192] The ciphertext account is determined according to the pre-encryption account and the post-encryption account.
[0193] In a possible implementation manner, the encryption module 14 is specifically used for:
[0194] For the first iteration process, determining a first front result and a first back result according to the encryption key, the front part account number and the back part account number;
[0195] For the i-th iteration process, determine the i-th result before and the i-th result after according to the encryption key, the i-1-th result before and the i-1-th result after, where i is a positive integer greater than 1;
[0196] The front result obtained by the Kth iterative processing is determined as the front encrypted account, and the rear result obtained by the last iterative processing is determined as the rear encrypted account, where K is a preset number of iterations and K is an integer greater than 1.
[0197] In a possible implementation manner, the encryption module 14 is specifically used for:
[0198] The latter part of the account number is encrypted by using the encryption key to obtain an encrypted value;
[0199] Performing an XOR operation on the first part of the account number and the encrypted value to obtain an operation value;
[0200] The latter partial account number is determined as the first former result, and the calculated value is determined as the first latter result.
[0201] In a possible implementation manner, the processing module 15 is specifically used to:
[0202] Determining a target identifier according to the identifier of the channel server and the identifier of the external application;
[0203] The target identifier, the flag bit, the ciphertext account number and the check bit are combined to obtain the marked account number.
[0204] In a possible implementation manner, the second acquisition module 12 is specifically configured to:
[0205] Sending a key acquisition request to an encryption device, wherein the key acquisition request includes an identifier of the channel server and an identifier of the external application;
[0206] The encryption key sent by the encryption device is received, where the encryption key is generated by the encryption device according to the identifier of the server and the identifier of the external application.
[0207] In a possible implementation manner, the determining module 13 is specifically configured to:
[0208] Determine the card type corresponding to the initial account;
[0209] According to the card type, the first M digits of the initial account number are determined as the flag digits, where M is an integer greater than or equal to 1;
[0210] According to the card type, the last N digits of the initial account number are determined as the check digits, where N is an integer greater than or equal to 1.
[0211] The account processing device provided in this embodiment can be used to execute the account processing method shown in the above method embodiment. Its implementation principle and technical effect are similar and will not be described in detail here.
[0212] Figure 6 This is a schematic diagram of the structure of the account processing device provided in the embodiment of the present application. Figure 6 As shown, the account processing device 20 may include: a transceiver 21 , a processor 22 , and a memory 23 .
[0213] The processor 22 executes the computer execution instructions stored in the memory, so that the processor 22 executes the scheme in the above embodiment. The processor 22 can be a general-purpose processor, including a central processing unit CPU, a network processor (NP), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
[0214] The memory 23 is connected to the processor 22 via a system bus and completes communication between them. The memory 23 is used to store computer program instructions.
[0215] The transceiver 21 may be used to obtain the account marking request and specific information of the account marking request.
[0216] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The transceiver is used to realize the communication between the database access device and other computers (such as clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory.
[0217] An embodiment of the present application also provides a chip for running instructions, which is used to execute the technical solution of the account processing method in the above embodiment.
[0218] An embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the technical solution of the account processing method in the above embodiment.
[0219] An embodiment of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, the technical solution of the account processing method in the above embodiment can be implemented.
[0220] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.
[0221] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.
[0222] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
[0223] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.
[0224] It should be understood that the above processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.
[0225] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.
[0226] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.
[0227] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.
[0228] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic control unit or a main control device.
[0229] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.
[0230] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.
Claims
1. An account processing method, characterized in that: include: Obtaining an account marking request sent by a channel server, the account marking request including an initial account, an identifier of the channel server and an identifier of an external application, the channel server being used to assist the external application in conducting transactions; Obtaining an encryption key according to the identifier of the channel server and the identifier of the external application; Determine a flag bit and a check bit in the initial account, and determine the account number in the initial account except the flag bit and the check bit as an intermediate account; Encrypt the intermediate account number according to the encryption key to obtain a ciphertext account number; A marked account is generated according to the identifier of the channel server, the identifier of the external application, the flag bit, the check bit and the ciphertext account, and the marked account is sent to the channel server.
2. The method according to claim 1, characterized in that The intermediate account is encrypted according to the encryption key to obtain a ciphertext account, including: Dividing the intermediate account into a front portion account and a rear portion account; Perform multiple iterative encryption processes on the front part of the account and the back part of the account according to the encryption key to obtain a front encrypted account and a back encrypted account; The ciphertext account is determined according to the pre-encryption account and the post-encryption account.
3. The method according to claim 2, characterized in that Performing multiple iterative encryption processes on the front part of the account and the back part of the account according to the encryption key to obtain the front encrypted account and the back encrypted account, including: For the first iteration process, determining a first front result and a first back result according to the encryption key, the front part account number and the back part account number; For the i-th iteration process, determine the i-th result before and the i-th result after according to the encryption key, the i-1-th result before and the i-1-th result after, where i is a positive integer greater than 1; The front result obtained by the Kth iterative processing is determined as the front encrypted account, and the rear result obtained by the last iterative processing is determined as the rear encrypted account, where K is a preset number of iterations and K is an integer greater than 1.
4. The method according to claim 3, characterized in that Determining a first front result and a first back result according to the encryption key, the front part account number and the back part account number includes: The latter part of the account number is encrypted by the encryption key to obtain an encrypted value; Performing an XOR operation on the first part of the account number and the encrypted value to obtain an operation value; The latter partial account number is determined as the first former result, and the calculated value is determined as the first latter result.
5. The method according to any one of claims 1 to 4, characterized in that: Generating a marked account according to the identifier of the channel server, the identifier of the external application, the flag bit, the check bit and the ciphertext account includes: Determining a target identifier according to the identifier of the channel server and the identifier of the external application; The target identifier, the flag bit, the ciphertext account number and the check bit are combined to obtain the marked account number.
6. The method according to any one of claims 1 to 5, characterized in that: Acquiring an encryption key according to the identifier of the channel server and the identifier of the external application includes: Sending a key acquisition request to an encryption device, wherein the key acquisition request includes an identifier of the channel server and an identifier of the external application; The encryption key sent by the encryption device is received, where the encryption key is generated by the encryption device according to the identifier of the server and the identifier of the external application.
7. The method according to any one of claims 1 to 6, characterized in that: Determining a flag bit and a check bit in the initial account number includes: Determine the card type corresponding to the initial account; According to the card type, the first M digits of the initial account number are determined as the flag digits, where M is an integer greater than or equal to 1; According to the card type, the last N digits of the initial account number are determined as the check digits, where N is an integer greater than or equal to 1.
8. An account processing device, characterized in that: include: A first acquisition module, a second acquisition module, a determination module, an encryption module and a processing module, wherein: The first acquisition module is used to acquire an account mark request sent by a channel server, wherein the account mark request includes an initial account, an identifier of the channel server and an identifier of an external application, and the channel server is used to assist the external application in conducting transactions; The second acquisition module is used to acquire an encryption key according to the identifier of the channel server and the identifier of the external application; The determination module is used to determine a flag bit and a check bit in the initial account, and determine the account number in the initial account other than the flag bit and the check bit as an intermediate account; The encryption module is used to encrypt the intermediate account according to the encryption key to obtain a ciphertext account; The processing module is used to generate a marked account according to the identifier of the channel server, the identifier of the external application, the flag bit, the check bit and the ciphertext account, and send the marked account to the channel server.
9. An account processing device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.
11. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.