Non-tax fund settlement method and system based on handheld bank code scanning authentication

Abstract

The invention discloses a non-tax fund settlement method and system based on handheld bank code scanning authentication, and the use safety is improved by adopting a handheld bank code scanning authentication mode. Specifically, if verification is carried out in a short message verification code mode, after a mobile terminal of a user is stolen, the risk that fund is stolen due to the fact that the stolen terminal is used for carrying out short message authentication exists. Due to the fact that the handheld bank code scanning authentication is adopted, in the authentication process, handheld bank application login can be forcibly carried out in the step of sending the handheld bank session identifier, if the handheld bank application is not in the login state, the handheld bank application is aroused to execute login authentication, even if the mobile terminal is stolen, login verification of the handheld bank application cannot be passed, and therefore the mobile terminal can be prevented from being stolen. Therefore, the use safety is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a non-tax funds clearing method and system based on mobile banking code scanning authentication. Background Art

[0002] With the continuous reform of the electronicization of fiscal bills, the traditional offline non-tax collection on campus has gradually been replaced by online payment, resulting in a vacuum in campus non-tax business management and obstruction in the collection of non-tax fees, making it difficult for the school's non-tax fees to be safely remitted to the treasury. Summary of the invention

[0003] The present application provides a non-tax fund settlement method and system based on mobile banking code scanning authentication, which uses mobile banking code scanning authentication to improve the security of users' non-tax fund settlement operations. The technical solution is as follows.

[0004] In a first aspect, a non-tax funds settlement method based on mobile banking code scanning authentication is provided, the method comprising:

[0005] In the campus non-tax payment scenario, the client terminal receives the fiscal non-tax fee into a dedicated account and sends a QR code acquisition request to the server. The QR code acquisition request includes a first user identifier, which is used to identify the user to which the client terminal belongs;

[0006] The server receives the QR code acquisition request sent by the client terminal, generates an authorization QR code and a random token corresponding to the authorization QR code, and sends the authorization QR code and the random token to the client terminal;

[0007] The client terminal displays the authorization QR code and encrypts the random token to obtain an encrypted token. The client terminal periodically sends a QR code status query request to the server, the QR code status query request carries the encrypted token, and the QR code status query request is used to query the status of the authorization QR code;

[0008] The server receives the QR code status query request, verifies the encrypted token to obtain an authentication result, and if the authentication result is successful, the server sends the status of the authorization QR code to the client terminal;

[0009] When the mobile terminal is in a logged-in state of the mobile banking application, the mobile terminal scans the authorization QR code displayed on the client terminal through the mobile banking application, and sends a mobile banking session identifier and an identifier of the authorization QR code to the server, wherein the mobile banking session identifier is used to identify the session between the mobile banking application and the server;

[0010] The server receives the mobile banking session identifier and the identifier of the authorization QR code sent by the mobile terminal, and obtains a second user identifier based on the mobile banking session identifier, where the second user identifier is used to identify a user who logs in to the mobile banking application;

[0011] The server verifies whether the second user identifier is consistent with the first user identifier; if the second user identifier is consistent with the first user identifier, notifies the mobile terminal of the authentication result; the mobile terminal receives the authentication result sent by the server and sends a confirmation operation command to the server;

[0012] The service end receives the confirmation operation command sent by the mobile terminal, and performs a legality verification on the confirmation operation command; after the confirmation operation command passes the legality verification, the service end executes the non-tax funds settlement operation.

[0013] In some implementations, encrypting the random token includes:

[0014] The client terminal concatenates a random string of fixed length and no repetition after the random token;

[0015] The client terminal encrypts the random token after the random character string is concatenated;

[0016] The verifying the encrypted token to obtain an authentication result includes:

[0017] The server decrypts the encrypted token;

[0018] If the decryption fails or the random string obtained by decryption already exists in the request record, the server determines that the authentication result is an authentication failure. The request record includes a random string obtained by decrypting the encrypted token from the client terminal in the historical code scanning authentication process.

[0019] In some implementations, the client terminal encrypts the random token concatenated with the random character string, including:

[0020] The client terminal uses an asymmetric SM2 encryption algorithm to encrypt the random token concatenated with the random string using a public key;

[0021] The server decrypts the encrypted token, including:

[0022] The server adopts the asymmetric SM2 encryption algorithm and uses the private key to decrypt the encrypted token.

[0023] In some implementations, the server performs a non-tax funds clearing operation, including:

[0024] The client terminal receives the non-tax payment slip input by the user, and sends the non-tax payment slip to the server;

[0025] The server queries the payment amount corresponding to the non-tax payment slip;

[0026] The service end compares the payment amount corresponding to the non-tax payment slip with the balance of the special account;

[0027] If the balance of the special account is greater than or equal to the payment amount corresponding to the non-tax payment slip, the service end provides a QR code to the client terminal, and the mobile terminal scans the QR code provided by the client terminal to perform a confirmation settlement operation;

[0028] If the balance of the special account is less than the payment amount corresponding to the non-tax payment slip, the service end sends an error prompt message to the client terminal.

[0029] In some implementations, the non-tax payment slip includes a first non-tax payment slip and a second non-tax payment slip, and the performing of the confirmation and settlement operation includes:

[0030] Execute the first batch of non-tax settlement operations for the first non-tax payment book;

[0031] A second batch of non-tax settlement operations is performed on the second non-tax payment receipt.

[0032] In some implementations, before the server provides the QR code to the client terminal, the method further includes:

[0033] The client terminal receives the bills to be settled selected by the user, and sends the selected bills to the server;

[0034] The service end determines that the payment amount corresponding to the non-tax payment slip is consistent with the amount of the checked bill.

[0035] In the second aspect, a non-tax fund clearing system based on mobile banking code scanning authentication is provided, the system comprising a client terminal, a service terminal and a mobile terminal;

[0036] The client terminal is used to receive the fiscal non-tax fees into a special account in the campus non-tax payment scenario, and send a QR code acquisition request to the server, wherein the QR code acquisition request includes a first user identifier, and the first user identifier is used to identify the user to which the client terminal belongs;

[0037] The server is used to receive the QR code acquisition request sent by the client terminal, generate an authorization QR code and a random token corresponding to the authorization QR code, and send the authorization QR code and the random token to the client terminal;

[0038] The client terminal is further used to display the authorization QR code, encrypt the random token to obtain an encrypted token, and periodically send a QR code status query request to the server, wherein the QR code status query request carries the encrypted token, and the QR code status query request is used to query the status of the authorization QR code;

[0039] The server is also used to receive the QR code status query request, verify the encrypted token to obtain an authentication result, and if the authentication result is successful, send the status of the authorization QR code to the client terminal;

[0040] The mobile terminal is used to scan the authorization QR code displayed on the client terminal through the mobile banking application when the mobile banking application is in a logged-in state, and send a mobile banking session identifier and an identifier of the authorization QR code to the server, wherein the mobile banking session identifier is used to identify a session between the mobile banking application and the server;

[0041] The server is further configured to receive the mobile banking session identifier and the authorization QR code identifier sent by the mobile terminal, query and obtain a second user identifier based on the mobile banking session identifier, where the second user identifier is used to identify a user who logs in to the mobile banking application; verify whether the second user identifier is consistent with the first user identifier; if the second user identifier is consistent with the first user identifier, notify the mobile terminal of the authentication result;

[0042] The mobile terminal is further configured to receive the authentication result sent by the server and send a confirmation operation command to the server;

[0043] The service end is also used to receive the confirmation operation command sent by the mobile terminal and perform legality verification on the confirmation operation command; after the confirmation operation command passes the legality verification, the non-tax funds settlement operation is executed.

[0044] In some implementations, the client terminal is used to concatenate a random string of fixed length and non-repetitive after the random token; and encrypt the random token after the concatenation of the random string;

[0045] The server is used to decrypt the encrypted token; if the decryption fails or the random string obtained by decryption already exists in the request record, the authentication result is determined to be authentication failure, and the request record includes the random string obtained by decrypting the encrypted token from the client terminal in the historical code scanning authentication process.

[0046] In some embodiments, the client terminal is used to use an asymmetric SM2 encryption algorithm to encrypt a random token concatenated with a random string using a public key; the server is used to use an asymmetric SM2 encryption algorithm to decrypt the encrypted token using a private key.

[0047] In some implementations, the client terminal is used to receive a non-tax payment slip input by a user and send the non-tax payment slip to the server;

[0048] The service end is used to query the payment amount corresponding to the non-tax payment slip; compare the payment amount corresponding to the non-tax payment slip with the balance of the special account; if the balance of the special account is greater than or equal to the payment amount corresponding to the non-tax payment slip, provide a QR code to the client terminal;

[0049] The mobile terminal is used to scan the QR code provided by the client terminal to perform a confirmation and settlement operation;

[0050] The service end is also used to send an error prompt message to the client terminal if the balance of the special account is less than the payment amount corresponding to the non-tax payment slip.

[0051] In some embodiments, the non-tax payment slip includes a first non-tax payment slip and a second non-tax payment slip, and the mobile terminal is used to perform a first batch of non-tax settlement operations on the first non-tax payment slip; and to perform a second batch of non-tax settlement operations on the second non-tax payment slip.

[0052] In some embodiments, the client terminal is further used to receive bills to be settled selected by the user and send the selected bills to the server; the server is also used to determine that the payment amount corresponding to the non-tax payment slip is consistent with the amount of the selected bill.

[0053] It can be seen that the embodiments of the present application have the following beneficial effects:

[0054] The embodiment of the present application improves the safety of use by adopting the palm banking code scanning authentication method. Specifically, if the SMS verification code method is used for verification, after the user's mobile terminal is stolen, there is a risk of using the stolen terminal for SMS authentication, resulting in theft of funds. However, since the palm banking code scanning authentication is adopted, during the authentication process, the palm banking application login will be forced at the step of sending the palm banking session identifier. If the palm banking application is not in the logged-in state, the palm banking application will be called up to perform login authentication. Therefore, even if the mobile terminal is stolen, the palm banking application login verification cannot be passed, thereby improving the safety of use. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a flow chart of a mobile banking code scanning authentication method provided by an embodiment of the present application;

[0056] Figure 2 It is a schematic diagram of a non-tax funds settlement method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0058] The following is an explanation of some terminology concepts involved in the embodiments of the present application.

[0059] Token: In computer networks and distributed systems, a token usually refers to a credential that proves digital identity or access authorization, which can implement authorization control over user access to services.

[0060] Non-tax revenue refers to all revenues, other than taxes, obtained by state organs at all levels, public institutions, social groups that perform government functions, and other organizations through the use of state power, government credibility, and the rights and interests of owners of state-owned resources (assets) in accordance with the law.

[0061] Non-tax payment code: an identification code used for non-tax revenue payment, generated and encoded by the Ministry of Finance in accordance with the "General Interface Message Specification for Electronic Payment" and the "Government Non-Tax Revenue Payment Identification Code Specification", and used to control and track each non-tax revenue collection business to ensure fund security and information accuracy.

[0062] Asymmetric encryption: also known as public key encryption, is an important encryption mechanism. The keys are divided into public keys and private keys, which consist of a pair of keys. Generally, the public key is used for encryption and the private key is used for decryption.

[0063] Client: In a computer network or distributed system, a client usually refers to a process or application that initiates a request. The client can be deployed on a variety of user devices, such as PCs, mobile phones, tablets, etc.

[0064] Server: The server is a process or application that provides computing resources, storage, and service access. It undertakes the core business logic of the system and provides services to a large number of clients through standard interfaces.

[0065] The following is an example of an application scenario of the embodiment of the present application.

[0066] Traditional non-tax fund settlement adopts offline collection and settlement methods. Students bring cash to school to complete payment. After the fees are collected, the school settles the funds to the finance department through the counter or designated channels. With the development of mobile Internet, the popularization of online payment and the development of financial electronicization, non-tax payment has gradually shifted from offline to online, but there is a vacuum in campus non-tax business management and obstruction in the collection of non-tax fees. It is impossible to ensure that the school's non-tax fees are safely, timely, fully, accurately and conveniently handed over to the finance department.

[0067] The non-tax payment code is an identification code issued by the finance department for non-tax revenue payment, which is used to control and track each non-tax revenue collection business to ensure fund security and information accuracy; code scanning authentication can avoid direct input of sensitive information and enhance authorization security, but early code scanning login may face security threats such as code scanning information being reused and session hijacking. The token authentication mechanism can generate a temporary random verification code to verify the user's identity and prevent login information from being reused.

[0068] Currently, there are two scenarios for the collection of non-tax funds on campus.

[0069] Scenario 1. The finance department issues a non-tax payment code for each non-tax fee. Parents use the non-tax payment code to pay directly through mobile terminals, and the funds go directly to the finance department without clearing. The disadvantage is that it is necessary to check the collection of non-tax fees regularly to ensure that each parent can receive notifications and complete the payment.

[0070] Scenario 2: The finance department entrusts the school to collect non-tax fees, and the school will settle the funds to the finance department after collecting all the non-tax funds. The disadvantage is that it must wait for all the funds to be collected and then settle them uniformly, and it is impossible to settle some funds. At the same time, if online settlement is adopted, there is a risk of token leakage.

[0071] The embodiment of the present application targets scenario 2, combining mobile banking code scanning verification, tokens, and non-tax payment codes to provide a non-tax fund settlement method based on mobile banking code scanning authentication in a campus scenario. This method uses mobile banking code scanning authentication and asymmetric encryption tokens for authentication, which can avoid token leakage and prevent request replay, and ensure the security of non-tax fund settlement; it uses non-tax payment receipts issued by the finance department for settlement, and supports users to confirm payment information and payment amounts; it supports checking bills and completing non-tax fund settlement according to the specified bill amount. The embodiment of the present application supports schools to complete the integrated collection and settlement of non-tax funds online. At the same time, the finance department can issue payment codes as needed, and the school settles non-tax funds in batches.

[0072] The basic technical solutions of the embodiments of the present application include:

[0073] 1. The financial department authorizes the school to issue bills to collect non-tax fees, and parents complete the bill payment.

[0074] 2. The financial department shall issue a non-tax payment receipt.

[0075] 3. The school enters the non-tax payment slip, selects the bill to be settled, and clears the funds by scanning the QR code on the mobile banking app.

[0076] The embodiment of the present application completes the settlement of the school's non-tax fees by combining the Agricultural Bank of China's mobile banking QR code scanning authentication and direct payment of non-tax payment slips, thereby improving the security and convenience of fund settlement. The specific steps of the embodiment of the present application are as follows.

[0077] Please refer to the attached Figure 1 , attached Figure 1 This is a flow chart of a mobile banking code scanning authentication method provided in an embodiment of the present application. The mobile banking code scanning authentication method includes the following steps.

[0078] Step S110: The client terminal generates a QR code acquisition request, and the client terminal sends the QR code acquisition request to the server. The QR code acquisition request is used to request to obtain a unique QR code. The QR code acquisition request includes a first user identifier, and the first user identifier is used to identify the user to which the client terminal belongs.

[0079] Step S120: The server receives a QR code acquisition request sent by the client terminal.

[0080] Step S122: The server generates a unique authorization QR code identifier and a random token corresponding to the authorization QR code, and sends the authorization QR code and the random token to the client terminal.

[0081] In addition, the server sets the expiration time of the authorization QR code and the initial state of the authorization QR code. The states of the authorization QR code include unauthenticated state, authenticated state, and expired state. When the server generates the authorization QR code, the server sets the initial state of the authorization QR code to the unauthenticated state.

[0082] In some implementations, the server establishes a correspondence between the authorization QR code, token, authorization QR code status, and user identification.

[0083] Step S130: The client terminal receives the authorization QR code identifier and token returned by the server. The client terminal generates an authorization QR code based on the authorization QR code identifier, and displays the authorization QR code, which is used for scanning by the ABC mobile banking application. Then the client terminal periodically sends a QR code status query request to poll the server at a predetermined frequency, and the QR code status query request is used to query the status of the authorization QR code.

[0084] In order to improve the security of the entire process information transmission, in step S130, the client terminal will encrypt the token returned by the server to obtain the encrypted token. The QR code status query request sent by the client terminal carries the encrypted token.

[0085] In some implementations of encrypting the token, the client terminal concatenates a random string of fixed length and no repetition after the token, and encrypts the token after the random string is concatenated. In some implementations of sending the token, the client terminal sends an authorization QR code status query request to the server, and the authorization QR code status query request carries the user identification and the encrypted token.

[0086] In some implementations, the encryption method used by the client terminal for the token is asymmetric SM2 encryption. For example, the client terminal uses an asymmetric SM2 encryption algorithm to encrypt the random token concatenated with the random string using a public key.

[0087] Step S140: The server receives the QR code status query request sent by the client terminal, and obtains the encrypted token carried in the QR code status query request. The server verifies the encrypted token to obtain the authentication result.

[0088] In some embodiments, the server decrypts the encrypted token. If the server fails to decrypt the token, the server determines that the client terminal's QR code status query request is illegal, and determines that the authentication result of the client terminal is an authentication failure. If the server successfully decrypts the token, the server determines that the client terminal's QR code status query request is legal, and the server queries the status of the client terminal's authorization QR code. If the status of the authorization QR code is unauthenticated, the server sends a new token to the client terminal.

[0089] In some implementations of token decryption, the above-mentioned authorization QR code status query request also carries a user identifier. Based on the user identifier, the server queries the pre-established correspondence between the authorization QR code ID, token, authorization QR code status and user identifier to obtain the token corresponding to the user identifier and the authorization QR code status. After the server decrypts the encrypted token carried in the authorization QR code status query request, it compares the decrypted token with the token obtained by query. If the decrypted token is inconsistent with the queried token, the server determines that the token decryption fails. If the decrypted token is consistent with the queried token, the server determines that the token decryption is successful.

[0090] In some embodiments, the server maintains a request record for the token. The request record includes a random string obtained by the server after decrypting the encrypted token from the client terminal in the historical code scanning authentication process. When the token is successfully decrypted, the server determines whether the decrypted random string exists in the request record. If the decrypted random string exists in the request record, the server determines that the authentication result is an authentication failure, and the server refuses the client terminal to pass the authentication, which can effectively prevent attacks such as token interception and request replay. If the decrypted random string does not exist in the request record, the server will add the decrypted random string to the request record.

[0091] Step S150: If the authentication result is successful, the server sends the status of the authorization QR code to the client terminal.

[0092] In some embodiments, if the status of the authorization QR code queried by the server is unauthenticated, the server returns a new token to the client terminal. After receiving the new token, the client terminal encrypts the new token and returns the encrypted token to the server. If the status of the authorization QR code queried by the server is authenticated, the server sends the authenticated token to the client terminal so that the client terminal can use the subsequent fund settlement function normally. If the status of the authorization QR code queried by the server is expired, the server sends a notification message to the client terminal that the authorization QR code has expired. After receiving the notification message that the authorization QR code has expired, the client terminal will repeat step S110 to obtain a new authorization QR code.

[0093] Step S160: The user logs in to the ABC mobile banking application running in the mobile terminal, and the mobile banking application triggers a code scanning authentication operation. When the mobile banking application is in the logged-in state, the mobile banking application responds to the code scanning authentication operation, scans the authorization QR code displayed on the client terminal to obtain the authorization QR code identifier, and then the mobile banking application sends the authorization QR code identifier and the mobile banking session identifier to the server. When the mobile banking application is not logged in, the mobile banking application prompts the user to log in. The mobile banking session identifier is used to identify the session between the mobile banking application and the server.

[0094] Step S170: The server receives the mobile banking session identifier and the authorization QR code identifier sent by the mobile terminal ABC mobile banking application. The server queries the customer information who scans the code based on the mobile banking session identifier to obtain a second user identifier, which is used to identify the user who logs in to the mobile banking application.

[0095] Step S180: The server verifies whether the second user identifier is consistent with the first user identifier to determine whether the user who logs into the mobile banking application and the user who logs into the client terminal are the same user.

[0096] Step S182: If the second user identifier is consistent with the first user identifier, that is, the customer information verification is successful, the server notifies the mobile terminal of the verification result so that the user can confirm the settlement. For example, the server sends a confirmation settlement request to the client, and the confirmation settlement request carries the verification result.

[0097] Step S184: If the second user identifier is inconsistent with the first user identifier, the server returns an error prompt message to the mobile terminal.

[0098] In some embodiments, after the server successfully verifies the customer information, it also queries the status of the authorization QR code based on the identifier of the authorization QR code, and the server updates the status of the authorization QR code to an authenticated state. Subsequently, the client terminal can determine that the status of the authorization QR code is updated to an authenticated state when rotating the authorization QR code status.

[0099] Step S190: The mobile terminal receives the authentication result sent by the server, and in response to the user's click confirmation operation, the mobile terminal sends a confirmation operation command to the server.

[0100] Step S192: The server receives the confirmation operation command sent by the mobile terminal, and performs a legality verification on the confirmation operation command; after the confirmation operation command passes the legality verification, the server performs subsequent non-tax funds settlement operations.

[0101] The method provided in this embodiment adopts the mobile banking code scanning authentication method to improve the security of users' non-tax fund settlement operations. Furthermore, the use of encrypted tokens improves the security of information transmission. Specifically, in the mobile banking code scanning authentication process, the client terminal concatenates a random string with the token returned by the server, and then uses the public key to asymmetrically encrypt the token concatenated with the random string. The server uses the private key to decrypt the encrypted token. During the entire interaction process, even if a third party obtains the QR code status query request message, it cannot identify the specific information; at the same time, the server maintains a request record for the token to ensure that even if the message is intercepted, the token cannot be reused, reducing the risk of token theft; in addition, even if a third party obtains a token by capturing the QR code status query request, the third party cannot encrypt the token without knowing the public key of the server used by the client to encrypt the token, so that the token returned by the third party to the server will not be successfully decrypted by the server, so that the third party will not pass the code scanning authentication.

[0102] The above describes the mobile banking code scanning authentication process provided by the embodiment of the present application. After executing the mobile banking code scanning authentication process, the non-tax fund settlement process can be executed if the code scanning authentication is successful. The following is an example of the non-tax fund settlement process provided by the embodiment of the present application. Please refer to the attached Figure 2 , attached Figure 2 Schematic diagram of a non-tax fund settlement method provided in an embodiment of the present application. Figure 2 The method shown includes the following steps.

[0103] Step S200: The user inputs the non-tax payment slip issued by the finance department on the client terminal. The client terminal receives the non-tax payment slip input by the user and sends the non-tax payment slip to the server.

[0104] Step S210: The server queries the non-tax payment elements corresponding to the non-tax payment slip. The non-tax payment elements include payment status, payment amount, collection unit code, collection unit name, payee, payee account number, etc. The user confirms whether the non-tax payment elements are correct.

[0105] Step S212: The user selects the bills to be settled, the client terminal receives the bills to be settled selected by the user, and the client terminal sends the selected bills to the server.

[0106] Step S214: The server compares the payment amount corresponding to the non-tax payment slip with the amount of the selected bill. If the payment amount corresponding to the non-tax payment slip is the same as the amount of the selected bill, the subsequent steps can be performed.

[0107] Step S212 and step S214 are optional steps, and in some other implementations, step S212 and step S214 do not need to be performed.

[0108] Step S216: The server queries the balance of the school's non-tax collection special account, compares the balance of the non-tax special account with the amount on the non-tax payment slip, and if it is determined that the balance of the non-tax special account is greater than or equal to the payment amount corresponding to the non-tax payment slip, executes the following step S218 to ensure that the balance is sufficient. In some embodiments, the server also compares the name of the school with the name of the payee in the non-tax payment element corresponding to the non-tax payment slip, and if the name of the school is the same as the name of the payee, executes step S218 again.

[0109] Step S218: After verification, the server provides a QR code for the user to scan and authenticate. If the QR code authentication is successful, execute step S220. If the QR code authentication is unsuccessful, execute step S222.

[0110] Step S220: The user scans the QR code through the ABC mobile banking to confirm the settlement and perform the non-tax settlement operation.

[0111] In order to avoid mispayment or duplicate payment, the non-tax payment elements corresponding to the payment slip will be queried first during the process and given to the user for confirmation. At the same time, the problem of duplicate payment can be avoided by scanning the QR code through the mobile banking app for authentication.

[0112] Step S222: The server sends a prompt message to the mobile terminal, indicating that the QR code verification fails.

[0113] The method provided in this embodiment realizes the online operation process of school non-tax fund settlement through non-tax payment receipts, and the whole process is operated online; it supports the school to re-confirm the non-tax payment elements and the amount of payment paid by students, and can improve the accuracy of fund flow and information flow and submit it to the finance department in a timely manner.

[0114] In some implementations, the finance department is supported to issue payment receipts multiple times, and different payment receipts are used for the school to settle non-tax expenses in batches, providing convenience for the school's non-tax settlement. Each payment receipt is used to settle a batch of non-tax expenses. For example, the non-tax payment receipt includes a first non-tax payment receipt and a second non-tax payment receipt. The mobile terminal performs the first batch of non-tax settlement operations on the first non-tax payment receipt, and performs the second batch of non-tax settlement operations on the second non-tax payment receipt, so that two batches of non-tax settlement operations can be performed through two non-tax payment receipts.

[0115] In some implementations, in step S130 of mobile banking code scanning authentication, each polling request updates the token. Specifically, when the client terminal polls the server's QR code status, each request to the server returns a new token to the client terminal, and the client terminal carries the new token for the next polling until the user confirms or cancels the operation.

[0116] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0117] A refers to B, which means that A is the same as B or A is a simple variant of B.

[0118] The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects, rather than to describe the specific order of the objects, and cannot be understood as indicating or implying relative importance. For example, the first non-tax payment book and the second non-tax payment book are used to distinguish different non-tax payment books, rather than to describe the specific order of the non-tax payment books, and cannot be understood as the first non-tax payment book being more important than the second non-tax payment book.

[0119] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in accordance with the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk SolidState Disk (SSD)), etc.

[0120] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A non-tax funds clearing method based on mobile banking code scanning authentication, characterized in that: The method comprises: In the campus non-tax payment scenario, the client terminal receives the fiscal non-tax fee into a dedicated account and sends a QR code acquisition request to the server. The QR code acquisition request includes a first user identifier, which is used to identify the user to which the client terminal belongs; The server receives the QR code acquisition request sent by the client terminal, generates an authorization QR code and a random token corresponding to the authorization QR code, and sends the authorization QR code and the random token to the client terminal; The client terminal displays the authorization QR code and encrypts the random token to obtain an encrypted token. The client terminal periodically sends a QR code status query request to the server, the QR code status query request carries the encrypted token, and the QR code status query request is used to query the status of the authorization QR code; The server receives the QR code status query request, verifies the encrypted token to obtain an authentication result, and if the authentication result is successful, the server sends the status of the authorization QR code to the client terminal; When the mobile terminal is in a logged-in state of the mobile banking application, the mobile terminal scans the authorization QR code displayed on the client terminal through the mobile banking application, and sends a mobile banking session identifier and an identifier of the authorization QR code to the server, wherein the mobile banking session identifier is used to identify the session between the mobile banking application and the server; The server receives the mobile banking session identifier and the identifier of the authorization QR code sent by the mobile terminal, and obtains a second user identifier based on the mobile banking session identifier, where the second user identifier is used to identify a user who logs in to the mobile banking application; The server verifies whether the second user identifier is consistent with the first user identifier; if the second user identifier is consistent with the first user identifier, notifies the mobile terminal of the authentication result; the mobile terminal receives the authentication result sent by the server and sends a confirmation operation command to the server; The service end receives the confirmation operation command sent by the mobile terminal, and performs a legality verification on the confirmation operation command; after the confirmation operation command passes the legality verification, the service end executes the non-tax funds settlement operation.

2. The method according to claim 1, characterized in that The encrypting the random token includes: The client terminal concatenates a random string of fixed length and no repetition after the random token; The client terminal encrypts the random token after the random character string is concatenated; The verifying the encrypted token to obtain an authentication result includes: The server decrypts the encrypted token; If the decryption fails or the random string obtained by decryption already exists in the request record, the server determines that the authentication result is an authentication failure. The request record includes a random string obtained by decrypting the encrypted token from the client terminal in the historical code scanning authentication process.

3. The method according to claim 2, characterized in that The client terminal encrypts the random token after the random character string is concatenated, including: The client terminal uses an asymmetric SM2 encryption algorithm to encrypt the random token concatenated with the random string using a public key; The server decrypts the encrypted token, including: The server adopts the asymmetric SM2 encryption algorithm and uses the private key to decrypt the encrypted token.

4. The method according to claim 1, characterized in that: The server performs non-tax fund clearing operations, including: The client terminal receives the non-tax payment slip input by the user, and sends the non-tax payment slip to the server; The server queries the payment amount corresponding to the non-tax payment slip; The service end compares the payment amount corresponding to the non-tax payment slip with the balance of the special account; If the balance of the special account is greater than or equal to the payment amount corresponding to the non-tax payment slip, the service end provides a QR code to the client terminal, and the mobile terminal scans the QR code provided by the client terminal to perform a confirmation settlement operation; If the balance of the special account is less than the payment amount corresponding to the non-tax payment slip, the service end sends an error prompt message to the client terminal.

5. The method according to claim 4, characterized in that The non-tax payment book includes a first non-tax payment book and a second non-tax payment book, and the execution confirmation and liquidation operation includes: Execute the first batch of non-tax settlement operations for the first non-tax payment book; A second batch of non-tax settlement operations is performed on the second non-tax payment receipt.

6. The method according to claim 4, characterized in that Before the server provides the QR code to the client terminal, the method further includes: The client terminal receives the bills to be settled selected by the user, and sends the selected bills to the server; The service end determines that the payment amount corresponding to the non-tax payment slip is consistent with the amount of the checked bill.

7. A non-tax funds clearing system based on mobile banking code scanning authentication, characterized in that: The system includes a client terminal, a server terminal and a mobile terminal; The client terminal is used to receive the fiscal non-tax fees into a special account in the campus non-tax payment scenario, and send a QR code acquisition request to the server, wherein the QR code acquisition request includes a first user identifier, and the first user identifier is used to identify the user to which the client terminal belongs; The server is used to receive the QR code acquisition request sent by the client terminal, generate an authorization QR code and a random token corresponding to the authorization QR code, and send the authorization QR code and the random token to the client terminal; The client terminal is further used to display the authorization QR code, encrypt the random token to obtain an encrypted token, and periodically send a QR code status query request to the server, wherein the QR code status query request carries the encrypted token, and the QR code status query request is used to query the status of the authorization QR code; The server is also used to receive the QR code status query request, verify the encrypted token to obtain an authentication result, and if the authentication result is successful, send the status of the authorization QR code to the client terminal; The mobile terminal is used to scan the authorization QR code displayed on the client terminal through the mobile banking application when the mobile banking application is in a logged-in state, and send a mobile banking session identifier and an identifier of the authorization QR code to the server, wherein the mobile banking session identifier is used to identify a session between the mobile banking application and the server; The server is further configured to receive the mobile banking session identifier and the authorization QR code identifier sent by the mobile terminal, and obtain a second user identifier based on the mobile banking session identifier, where the second user identifier is used to identify a user who logs in to the mobile banking application; Verifying whether the second user identifier is consistent with the first user identifier; if the second user identifier is consistent with the first user identifier, notifying the mobile terminal of the authentication result; The mobile terminal is further configured to receive the authentication result sent by the server and send a confirmation operation command to the server; The service end is also used to receive the confirmation operation command sent by the mobile terminal and perform legality verification on the confirmation operation command; after the confirmation operation command passes the legality verification, the non-tax funds settlement operation is executed.

8. The system according to claim 7, characterized in that The client terminal is used to splice a random string of fixed length and non-repetitive after the random token; and encrypt the random token after splicing the random string; The server is used to decrypt the encrypted token; If the decryption fails or the random string obtained by decryption already exists in the request record, the authentication result is determined to be authentication failure. The request record includes a random string obtained by decrypting the encrypted token from the client terminal in the historical code scanning authentication process.

9. The system according to claim 8, characterized in that The client terminal is used to adopt an asymmetric SM2 encryption algorithm and use a public key to encrypt the random token after splicing the random character string; the server is used to adopt an asymmetric SM2 encryption algorithm and use a private key to decrypt the encrypted token.

10. The system according to claim 7, characterized in that The client terminal is used to receive the non-tax payment slip input by the user and send the non-tax payment slip to the server; The server is used to query the payment amount corresponding to the non-tax payment slip; Compare the payment amount corresponding to the non-tax payment slip with the balance of the special account; if the balance of the special account is greater than or equal to the payment amount corresponding to the non-tax payment slip, provide a QR code to the customer terminal; The mobile terminal is used to scan the QR code provided by the client terminal to perform a confirmation and settlement operation; The service end is also used to send an error prompt message to the client terminal if the balance of the special account is less than the payment amount corresponding to the non-tax payment slip.

Images