Secure Payment Method and System on Network and Route Server

• US 20080228655A1
• Filed: 07/18/2006
• Published: 09/18/2008
• Est. Priority Date: 07/18/2005
• Status: Abandoned Application

• Current Assignee: China Unionpay Company Limited
• Original Assignee: China Unionpay Company Limited
• Inventors: Guo, Rui, Lv, Xufeng, Yang, Jiachu, Kang, Jianming
• Application Number:
  US11/994,365
• Publication Number:
  US 20080228655A1
• Time in Patent Office: Days
• US Class Current: 705/76
• CPC Class Codes: G06Q 20/108 Remote banking, e.g. home banking
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A payment system on network provides a platform based on the existing various transaction modes so that the current transaction modes can be operated on the secure payment platform which the present invention provides. The current transaction modes has the following kinds: a free process mode of the acquirer institution, a direct authentication mode of the card issuing institution, a secure input mode of the bank union and the other patent mode which the bank applies. The secure payment system can solve the technology disadvantage that the existing transaction flow is disorder and the resource is waste. The method of the present invention not only can be realized and its security is high, but also can achieve the less consumed time and the high transaction success using the existing private network. If the present invention has not received the transaction process result within the preset time, the acquirer subsystem puts forward a request for inquiring and notifies the inquired result of the merchant, thereby the difficulty of the following clear is reduced.

Claims

1. A system for secure online payment, comprising a card holder terminal, a merchant website, an acquiring subsystem and at lease one card issuing subsystem, wherein, the system further comprises a routing unit connected with the acquiring subsystem and the card issuing subsystem;

wherein;

the routing unit comprises;

a storing module, which is adapted to store a transaction mode adopted by each card issuing subsystem and routing information and processing procedure corresponding to a Bank Identification Number of each card number;

a processing module, which is adapted to determine the transaction mode adopted by the corresponding card issuing subsystem according to the card number received from the acquiring subsystem, and perform processing according to the corresponding processing procedure.

2. The system for secure online payment according to claim 1, further comprises a security plug-in unit, which is connected with the acquiring subsystem or is arranged in the acquiring subsystem;

the security plug-in unit is adapted to establish a data exchange between the merchant website, card holder terminal and the routing unit;

card number information of a card holder is obtained via an interaction with the card holder terminal, and the routing information or corresponding processing procedure is obtained via an interaction with the routing unit.

3. The system for secure online payment according to claim 1, further comprises a security authentication and authorization unit, which is connected with the card issuing subsystem or is arranged in the card issuing subsystem;

the security authentication and authorization unit at least comprises an authentication subunit and a notification subunit, the authentication subunit is adapted to perform identity authentication on the card holder;

the notification subunit is adapted to constitute an online transaction result with a result of the identity authentication performed by the security authentication and authorization unit on the card holder and a withholding result from the card issuing subsystem, and transmit the online transaction result to the card holder terminal via Internet.

4. The system for secure online payment according to claim 3, wherein the routing unit stores routing information of the security authentication and authorization unit corresponding to each card issuing subsystem adopting a direct authentication and authorization mode.

5. The system for secure online payment according to claim 1, further comprises a card holder security control unit, which is adapted to establish an interaction with the card holder terminal, and receive security information indicating an identity of the card holder that is input by the card holder.

6. The system for secure online payment according to claim 5, wherein the routing unit stores routing information of the card holder security control unit corresponding to each card issuing subsystem adopting a card holder security control unit authentication mode.

7. The system for secure online payment according to claim 6, further comprises a card holder security interaction unit, the card holder security interaction unit is connected to the card holder security control unit, so as to send authentication information to the card holder via a channel that is agreed on in advance, receive authentication information input by the card holder, and perform authentication on the authentication information.

8. The system for secure online payment according to claim 7, wherein the card holder security control unit, routing unit and the card holder security interaction unit are arranged on the same server.

9. The system for secure online payment according to claim 5, wherein the security plug-in unit comprises:

a merchant authentication unit, which is adapted to perform identity authentication on a merchant who initiates an order transaction request;

an interaction control unit, which is adapted to control a data exchange with the merchant website, card holder terminal, routing unit, security authentication and authorization unit and card holder security control unit;

a data storing unit, which is adapted to store data comprising merchant information; and

an authentication and transmission unit, which is adapted to perform security authentication on data packets received and transmitted.

10. A routing server, comprising:

a storing unit, which is adapted to store a transaction mode adopted by each card issuing subsystem as well as routing information and processing procedure corresponding to a Bank Identification Number of each card number;

a processing unit for direct authentication and authorization mode, which is adapted to return routing information of a security authentication and authorization unit corresponding to the card number, when the card issuing subsystem corresponding to the card number adopts a direct authentication and authorization mode;

a processing unit for card holder security control unit authentication mode, which is adapted to return routing information of the card holder security control unit, when the card issuing subsystem corresponding to the card number adopts a card holder security control unit authentication mode; and

a processing unit for acquiring subsystem self-processing mode, which is adapted to inform the corresponding acquiring subsystem of the processing mode, when the card issuing subsystem corresponding to the card number adopts an acquiring subsystem self-processing mode.

11. A method for secure online payment, comprising:

obtaining, by an acquiring subsystem, a transaction request and card number information of a card holder;

determining, by a routing unit, a transaction mode adopted by a corresponding card issuing subsystem according to the card number, and processing information according to a corresponding processing procedure; and

performing, by the acquiring subsystem or the card issuing subsystem, transaction settlement, and returning result information.

12. The method for secure online payment according to claim 11, wherein:

if the card issuing subsystem corresponding to the card number adopts an acquiring subsystem self-processing mode, the routing unit notifies the corresponding acquiring subsystem; and

the acquiring subsystem performs the transaction settlement and returns the result information.

13. The method for secure online payment according to claim 11, wherein:

if the card issuing subsystem corresponding to the card number adopts a card holder security control unit authentication mode, the routing unit returns routing information of the card holder security control unit;

the card holder security control unit establishes an interaction with a card holder terminal, and receives security information indicating a card holder identity that is input by the card holder;

the card issuing subsystem performs authentication and transaction settlement, and returns the result information.

14. The method for secure online payment according to claim 11, wherein:

if the card issuing subsystem corresponding to the card number adopts a direct authentication and authorization mode, the routing unit returns routing information of a security authentication and authorization unit corresponding to the card number;

the card issuing subsystem performs authentication and transaction settlement, and returns the result information.

15. A method for secure online payment, comprising:

(1) establishing an interaction between a card holder and a security plug-in unit when a merchant website receives order information from the card holder, and receiving, by the security plug-in unit, a card number for paying a transaction amount input by the card holder;

(2) forwarding, by the security plug-in unit, the card number and order information to a routing unit;

determining, by the routing unit, whether a card holder security control unit authentication mode is adopted according to the card number input by the card holder;

if yes, transmitting routing information of a corresponding card holder security control unit to the security plug-in unit; and

transmitting, by the security plug-in unit, the card number and card holder information to the card holder security control unit;

(3) establishing, by the card holder security control unit, an interaction with the card holder, receiving security information indicating an identity of the card holder that is input by the card holder, and transmitting the security information to the security plug-in unit;

(4) packaging, by the security plug-in unit, the security information and the order information into a transaction request message, and sending the transaction request message to a corresponding card issuing subsystem via a cross-bank switching center or according to the routing information provided by the routing unit; and

(5) performing, by the card issuing subsystem, identity authentication and authorization on the transaction request message as well as performing the withholding, and returning a processing result.

16. The method for secure online payment according to claim 15, wherein the interaction between the card holder security control unit and the card holder is accomplished through the following steps:

b1;

the card holder security control unit transmits the card number to a card holder security interaction unit, the card holder security interaction unit returns a User Interface Requirement to the card holder security control unit;

b2;

the card holder security interaction unit transmits authentication information to the card holder via a channel that is agreed on in advance;

b3;

the card holder security control unit receives input information, and transmits the input information to the card holder security interaction unit; and

b4;

the card holder security interaction unit performs authentication on the input information, and transmits authenticated information to the card holder security control unit.

17. The method for secure online payment according to claim 15 further comprises:

guiding, by the security plug-in unit, the card holder to establish a Security Socket Layer security channel with the card holder security control unit to perform authentication;

performing authentication on a validity of a card holder certificate and establishing a channel for providing a secure data transmission; and

when the validity of the certificate is approved, showing, by the card holder security control unit, on a browser on a card holder terminal that the card holder needs to input information, obtaining a Distinguish Name of the certificate and the card number input by the card holder via a Security Socket Layer server module, and verifying whether the certificate and the card number is effectively bound;

if they are effectively bound, transmitting the information input by the card holder to the security plug-in unit;

otherwise, transmitting an authentication failed result to the security plug-in unit.

18. A method for secure online payment, comprising:

(1) submitting, by a card holder terminal, an order to a merchant website;

(2) initiating, by the merchant website, a transaction request to an acquiring subsystem;

(3) establishing, by the acquiring subsystem, an interaction with the card holder terminal, and obtaining card number information input by the card holder;

(4) transmitting, by the acquiring subsystem, the card number information and transaction information to a routing unit;

(5) if a card issuing institution corresponding to the card number adopts a card issuing institution direct authentication and authorization mode, transmitting, by the routing unit, the card number information and the transaction information to a security authentication and authorization unit corresponding to the card issuing institution;

(6) performing, by the security authentication and authorization unit, authentication on the card holder;

(7) when the authentication is passed, performing withholding by a card issuing subsystem;

(8) transmitting, by the card issuing subsystem, a withholding result and an authentication result to the acquiring subsystem; and

(9) informing the merchant by the acquiring subsystem.

19. The method for secure online payment according to claim 18, wherein between step (5) and step (6), the method further comprises:

determining, by the security authentication and authorization unit, whether the card holder is registered, and returning a registration result to the routing unit;

allocating, by the routing unit, a unique transaction identification code to the present payment, and allocating the registration result and the identification code to the acquiring subsystem; and

if the registration result is that the card holder is registered, sending, by the acquiring subsystem, the card number information, order information and a service identification code to the security authentication and authorization unit, and requesting to perform authentication on the card holder.

20. The method for secure online payment according to claim 19, wherein transaction result information is transmitted to the acquiring subsystem through the following steps:

the card issuing subsystem sends an advice of an online transaction result to a cross-bank switching center, wherein the online transaction result contains a unique transaction identification code;

when a response to the online transaction result is not received within a predetermined period of time, the card issuing subsystem resends the advice of the online transaction result for a limited number of times;

when receiving the online transaction result, the cross-bank switching center returns a response message, and sends the online transaction result to the corresponding acquiring subsystem;

when the response to the online transaction result is not received within a predetermined period of time, the cross-bank switching center resends the advice of the online transaction result to the acquiring subsystem for a limited number of times.

21. The method for secure online payment according to claim 20, further comprises:

performing, by the cross-bank switching center, settlement within a predefined period of time according to a transaction identification code, wherein the cross-bank switching center collects all the online transaction result advices within the predefined period of time, and sends them to the corresponding acquiring subsystem; and

sending, by the acquiring subsystem, the online transaction result advice that was not received to the corresponding merchant website.

22. The method for secure online payment according to claim 18, wherein transaction result information is sent to the acquiring subsystem through the following steps:

the card issuing subsystem constitutes an online transaction result with the authentication result and the withholding result, and transmits the online transaction result to the card holder terminal via Internet, wherein the online transaction result further comprises a transaction identification code;

the card holder terminal transmits the online transaction result to the acquiring subsystem via Internet.

23. A method for secure online payment, comprising:

(1) submitting, by a card holder terminal, an order to a merchant website;

(2) initiating, by the merchant website, a transaction request to an acquiring subsystem;

(3) establishing, by the acquiring subsystem, an interaction with the card holder terminal, and obtaining card number information input by the card holder;

(4) transmitting, by the acquiring subsystem, the card number information and transaction information to a routing unit;

(5) if a card issuing institution corresponding to the card number adopts a card issuing institution direct authentication and authorization mode, transmitting, by the routing unit, the card number information and the transaction information to a security authentication and authorization unit corresponding to the card issuing institution;

(6) performing, by the security authentication and authorization unit, authentication on the card holder;

(7) when the authentication is passed, performing withholding by a card issuing subsystem, and returning a transaction result;

(8) if the acquiring subsystem does not receive the online transaction result within a predefined period of time, sending, by the acquiring subsystem, a purchase confirmation advice to the card issuing subsystem via a cross-bank switching center or a routing unit; and

(9) when receiving the purchase confirmation advice, searching, by the card issuing subsystem, a corresponding database;

when it is found that a corresponding withholding is performed, returning acceptance information to the acquiring subsystem.

24. The method for secure online payment according to claim 23, further comprises:

summarizing and transmitting, by the cross-bank switching center, all the confirmation transactions that are not accepted within a predefined period of time to the card issuing subsystem, and comparing and inspecting, by the card issuing subsystem, all the confirmation transactions that are not accepted.