Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention.
Specifically, fig. 1 is a schematic view of a partial structure of a financial self-service terminal system provided in an embodiment of the present application, and as shown in fig. 1, the financial self-service terminal system includes: financial self-service terminal and server.
Given below is a possible implementation of a financial self-service terminal, with continued reference to fig. 1, the financial self-service terminal includes: acard reader 101, akeypad 102, amemory 103, afirst processor 104 and afirst communication interface 105.
Thecard reader 101 reads user bank card information and transmits the read bank card information to thefirst processor 104. The user bank card may be: magnetic stripe cards, chip cards.
The user enters a user password on thepassword keypad 102, encrypts the user password with the key, and sends the encrypted password to thefirst processor 104.
With continued reference to fig. 1, the server includes: asecond communication interface 201 and asecond processor 202.
Thesecond communication interface 201 is used for performing communication connection with a server. Asecond processor 202, configured to process a transaction message sent by the financial self-service terminal, for example: checking the information in the transaction message, decrypting the ciphertext in the transaction message, and the like; and the financial self-service terminal is also used for sending a return message according to the transaction message and controlling the financial self-service terminal to execute the user transaction request.
The financial self-service terminal and the service terminal communicate through thefirst communication interface 105 and thesecond communication interface 201. The financial self-service terminal and the service end can communicate in a private line or public network mode. The dedicated Line mode is required to perform communication in a wired connection mode on a physical link, for example, a DSL (Digital Subscriber Line), an optical fiber, and other wired connection modes; in the public network communication mode, in addition to a wired access mode, a wireless mode can be adopted for communication in a physical layer, such as a Wi-Fi mode, a cellular network mode and the like. In order to construct a corresponding network system, the solution of the present application should further include other necessary network nodes, such as a gateway, a switch, an access device, and the like, which are not described herein again. For example, taking the financial operation of the user based on the bank card as an example, referring to fig. 1, the data such as the bank card information, the password, and the transaction request input by the user, received by thefirst processor 104, are encrypted and then sent to the server through thefirst communication interface 105. The server receives the encrypted data through thesecond communication interface 201, thesecond processor 202 decrypts and verifies the encrypted data, control information is generated according to a verification result, the control information is sent to the financial self-service terminal through thesecond communication interface 201, and the financial self-service terminal obtains the control information through thefirst communication interface 105. Thefirst processor 104 of the financial self-service terminal processes the control information, and the financial self-service terminal executes the user request according to the control information.
In some scenarios, optionally, other interaction devices may be further disposed on the financial self-service terminal, so that the user may input a control request. Such as a touch screen, a scanning gun, etc.
For example, when a user uses a financial self-service terminal for transaction, the user may scan a two-dimensional code on the mobile terminal by displaying the two-dimensional code, and send the scanning result to thefirst processor 104, and thefirst processor 104 parses the two-dimensional code according to the encoding rule of the two-dimensional code, so as to identify a user ID (iDentity). Thefirst communication interface 105 transmits the user ID and the transaction information to the server, the server receives the user ID through thesecond communication interface 201, and thesecond processor 202 finds the corresponding user according to the user ID and processes the transaction according to the transaction information.
The touch screen is used for displaying user input information. The user may also make inputs through the touch screen.
Based on the financial self-service terminal system provided above, a service invocation method is provided below to implement information interaction between the financial self-service terminal and the service end, fig. 2 is a schematic flow diagram of the service invocation method provided in an embodiment of the present application, and as shown in fig. 2, the method includes:
s201, the financial self-service terminal receives a transaction request input by a user.
Specifically, the transaction request may be: withdrawal transactions, transfer transactions, balance inquiry transactions, etc.
S202, the financial self-service terminal calls a corresponding transaction message template according to the transaction type in the transaction request. The transaction message template comprises preset transaction parameters corresponding to transaction types.
Taking the transaction type as the withdrawal transaction as an example, a transaction message template corresponding to the withdrawal transaction is called, and transaction parameters used for the withdrawal transaction are preset in the transaction message template. For example, the preset transaction parameters include: account number, password, amount, balance, etc.
Optionally, the transaction message template content may be implemented in a form of maintaining a relationship table, as shown in table 1, a "bit" represents a domain number, the transaction message template content is 0 to 63, 64 domains are total, each domain is preset with a transaction parameter, and each preset transaction parameter has a plurality of data therein. "attribute" indicates the maximum length supported by the domain in which it is located. The "type" indicates the information format in the domain, for example, if the transaction message template is used on the self-service terminal device of the service provider, the type supports all formats of the specification set by the service provider. The "request" and the "response" indicate whether the domain needs to be uploaded to the server or read from a return message sent by the server, and optionally, when the value of the "request" or the "response" is M, the domain needs to be uploaded or sent; when the value of "request" or "response" is C, it is not necessarily sent up or down. If the value of "request" or "response" is M, when a message (i.e. a package) is sent to the server or a return message (i.e. an unpack) sent by the server is read, no corresponding data is found, and an error prompt is given when the package or the unpack is performed. "data transmission", if a packet packaging process, the contents of the data transmission are read. "data reception", if it is an unpacking process, the group reads the content of data reception. The definition of the domain name and the remark indicate that the domain is explained and convenient for developers to view the information of the domain during configuration. When unpacking and packing, the transaction data needed in the transaction process can be obtained from the input of the user by comparing with the preset transaction parameters in the transaction message template.
TABLE 1
For example, on field 3 with bit number 2. The attribute is 20, and represents that the maximum length of the allowed input on the 3 rd field is 20 bits. The request has a value of M, indicating that the contents of the field must be included in the request message when packaged. The response is an M value, indicating that the contents of the field must be read from the return message when unpacking. The remark information in the domain name definition is the transaction amount, and the parameter indicating the 3 rd domain is the transaction amount. And in the transaction process, the financial self-service terminal acquires the transaction type according to the transaction information of the user and calls the template. And acquiring transaction parameters according to the transaction message template, reading preset transaction parameters in the transaction message template in a domain sequence in a sequence-by-sequence manner, and acquiring transaction data according to a 3 rd domain corresponding interface function by comparing the preset transaction parameters in the 3 rd domain when the preset transaction parameters in the 3 rd domain are read. If the length of the acquired transaction data is larger than the attribute value 20 of the 3 rd field, carrying out error prompt; when packaging, the request is an M value, and the transaction data is not acquired through a corresponding interface function, so that error prompt is performed; and when unpacking is carried out, the request is M, the transaction data is not acquired through the corresponding interface function, and error prompt is carried out.
Similarly, on field 4, with bit number 3. The attribute is 12, and represents the maximum length of the allowed input on the 4 th field is 12 bits. The request is a value of C, indicating that the contents of the field do not have to be included in the request message when packaged. The response is a value of C, indicating that the contents of the field do not have to be read from the return message when unpacking. The remark information in the domain name list is an additional amount, and the parameter indicating the 4 th domain is the additional amount. In bank regulations, cross-bank withdrawals involve an additional amount, intra-bank withdrawals do not involve an additional amount, and therefore the additional amount does not have to be acquired. The 4 th field is not necessarily acquired, and whether the transaction data is to be acquired according to the preset transaction parameters of the 4 th field needs to be judged according to the reading condition of the preset transaction parameters of other related fields.
It should be noted that the preset transaction parameters corresponding to different transaction types may be completely different or partially different, so that different transaction types may correspond to different transaction message templates. For example, the withdrawal transaction corresponds to the template 1, the transfer transaction corresponds to the template 2, the payment transaction corresponds to the template 3, and if an application function is newly added, a transaction message template 4 corresponding to the application function is newly created. In actual use, the financial self-service terminal acquires the corresponding template according to the transaction type input by the user.
And S203, the financial self-service terminal acquires corresponding transaction information according to the transaction message template.
Specifically, the transaction information is transaction data corresponding to the transaction type, such as a transaction amount input by the user. Optionally, the transaction information is obtained according to the transaction message template through an interface function. As shown above, taking the bank card payment transaction as an example, information is obtained through the corresponding function interface according to the preset transaction parameters of the transaction message template.
Optionally, the transaction information is obtained through an interface function, and the specific obtaining process may include the following steps: still take the bank card payment transaction of the user as an example, when the preset transaction parameters include an account number, the card reader device is started by opening the card reader function. And calling an initialization card reader function, initializing the card reader, and clearing residual information of the last transaction, such as a card number, a password and the like of the last transaction. And controlling the card reader to read bank card information including an account number through a card reader function. And when the preset transaction parameters comprise the password, acquiring the password in the password keyboard by acquiring the ciphertext function.
And S204, the financial self-service terminal generates a corresponding transaction message according to the transaction information and sends the transaction message to the server. Wherein, the transaction message contains transaction information.
Specifically, the transaction data collected according to the transaction message template is packaged in the transaction message, and the transaction information of the self-service terminal is sent to the server side in the form of the transaction message.
S205, the financial self-service terminal receives a return message issued by the server, and analyzes the content of the return message according to the transaction message template to acquire control information.
Specifically, the return message carries control information and is sent to the financial self-service terminal. The transaction message template comprises preset transaction parameters required for completing the transaction, and the control information is acquired according to the preset transaction parameters in the transaction message template.
And S206, the financial self-service terminal executes the transaction request according to the control information.
In this embodiment, transaction data corresponding to the user transaction request is collected according to the form of the transaction message template. Similarly, the control information sent by the server is interpreted according to the transaction message template. When the financial self-service terminal needs to newly add a transaction application, a transaction message template can be newly added according to transaction data required to be acquired by the newly added transaction application, and transaction data of a user can be acquired according to preset transaction parameters on the transaction message template, so that a complicated process of re-developing a new program is omitted. And due to the use of the transaction message template, the financial self-service terminal can be quickly put into use.
Optionally, fig. 3 is a schematic flowchart of a service invocation method according to another embodiment of the present application, as shown in fig. 3, S204 includes:
s204-1, the financial self-service terminal receives the transaction information input by the user.
And S204-2, the financial self-service terminal generates a corresponding transaction message according to the transaction information.
S204-3, the financial self-service terminal encrypts the transaction message to obtain a ciphertext.
In the transmission process of the message, if the transaction information input by the user is transmitted to the server side in a form without any verification, the transaction information is easily intercepted and tampered in the transmission process, so that the transaction information is leaked. Therefore, the encrypted character string needs to be obtained by encrypting the transaction message, and the server and the financial self-service terminal verify whether the message is data which is not tampered or not by verifying the encrypted character string by the two parties. The keys used for encryption include: a master key and a work key.
The main key is filled in the password keyboard by a manufacturer before the financial self-service terminal leaves a factory. The teller can actively sign in or the financial self-service terminal actively initiates the sign-in transaction when the financial self-service terminal detects that the transaction is the first time of the day, and obtains the work key issued by the service terminal. And the service end issues the work key to the financial self-service terminal through a return message of the sign-in transaction of the financial self-service terminal. The working key includes: MACKey (Message Authentication Code Key) and inkey (Personal Identification Key). Wherein, PINKey encrypts the user password. The MACKey is used for encrypting other transaction information except a user password and calculating a MAC value.
And at the financial self-service terminal side, calculating the MAC value by using the transaction message and the MACKey, obtaining a ciphertext, and adding the ciphertext into the transmission message to send to the server side. The ciphertext comprises a master key check value, namely a user password encrypted by PINKEy and various information encrypted by MACKey.
Optionally, in a public network environment, since the transaction packet is directly transmitted and is easily intercepted and tampered, stability and security of the transaction cannot be guaranteed, SSL (Secure Sockets Layer) encryption and decryption need to be additionally performed on the entire transaction packet, so as to ensure that the client and the server can communicate securely.
Optionally, fig. 4 is a schematic flowchart of a service invocation method according to another embodiment of the present application, as shown in fig. 4, after S204, the method includes:
s301, the server side checks the ciphertext through a first preset condition.
Alternatively, the verification key may use a key. The first preset condition may be that the ciphertext is verified through the MACKey of the server.
Specifically, the master key filled by the financial self-service terminal side is consistent with the master key stored by the service side. After receiving the ciphertext, the server side calculates an MAC value by using the stored MACKey of the server side and the received transaction message, judges whether the MAC value calculated by the server side is consistent with the MAC value of the financial self-service terminal side, and if not, the transaction message is tampered in the transmission process; if yes, the transaction message is not tampered, and S302 is executed.
S302, if the verification is successful, acquiring the transaction information in the transaction message, and generating a return message after the transaction is accepted.
With reference to fig. 2 to fig. 4, the following describes an example of signaling interaction between the financial self-service terminal and the server, and specifically, fig. 5 is a signaling interaction intention between the financial self-service terminal and the server according to the present application.
As shown in fig. 5, the signaling interaction between the financial self-service terminal and the service end includes the following steps:
step 1, the financial self-service terminal acquires transaction information input by a user and generates a transaction message.
And 2, encrypting the financial self-service terminal transaction message to obtain a ciphertext.
And 3, the server side acquires the ciphertext according to the transaction message and verifies the ciphertext according to a first preset condition.
And 4, if the verification is successful, the server side acquires the transaction information.
And 5, after the transaction is accepted by the server, generating a return message.
And 6, the financial self-service terminal receives the return message and executes user transaction according to the return message.
And if the verification result in the step 5 is that the transaction information is correct and meets the transaction condition, returning a message to control the financial self-service terminal to execute the transaction.
Optionally, the transaction information comprises any combination of one or more of: transaction type, transaction amount, magnetic stripe information, and chip information.
Wherein the magnetic stripe information comprises a card number.
Optionally, fig. 6 is a schematic flow chart of a service invoking method according to another embodiment of the present application, and as shown in fig. 6, after the transaction packet is sent to the server, the method includes:
s401, the server side obtains the cipher text password according to the transaction message.
In case the transaction requires a password to be verified, the password may also be verified. Specifically, the PINKey value of the server side is consistent with the PINKey value of the financial self-service terminal side, when the password is verified, the server side calls a corresponding user password according to the account number, encrypts the user password through the PINKey to obtain an encryption result of the PINKey of the server side, compares the encryption result of the PINKey of the server side with the encryption result of the PINKey of the financial self-service terminal side, and if the encryption results of the two sides are consistent, the user password is verified successfully; and if the encryption results of the two sides are not consistent, the user password verification fails.
S402, the server side verifies the ciphertext password according to a second preset condition to obtain a verification result.
This embodiment provides a financial self-service terminal structure for executing the above method class embodiments, and fig. 7 is a schematic diagram of a financial self-service terminal structure of a service invocation system provided in this application embodiment, as shown in fig. 7, the service invocation system includes a financial self-service terminal and a service end, the financial self-service terminal is in communication connection with the service end, and the financial self-service terminal specifically includes: a first obtainingmodule 501, afirst generating module 502 and a first executingmodule 503.
A first obtainingmodule 501, configured to receive a transaction request input by a user; the transaction message template is used for calling a corresponding transaction message template according to the transaction type in the transaction request; the transaction message template comprises preset transaction parameters corresponding to transaction types; acquiring corresponding transaction information according to the transaction message template; the transaction information is actual transaction data corresponding to the transaction type.
Thefirst generating module 502 is configured to generate a corresponding transaction message according to the transaction information, and send the transaction message to the server; the transaction message contains transaction information.
The first obtainingmodule 501 is further configured to receive a return message sent by the server, and analyze the content of the return message according to the transaction message template to obtain the control information.
And an executingmodule 503, configured to execute the transaction request according to the control information.
Referring to fig. 1, the functions of the first obtainingmodule 501 shown in fig. 7 may be implemented by thefirst processor 104 of fig. 1. Specifically, thefirst processor 104 receives a transaction request input by a user through thepassword keyboard 102 or the touch screen according to a corresponding transaction message template, and acquires transaction information through thecard reader 101.
The functions of thefirst generation module 502 may be implemented by thefirst processor 104 of fig. 1.
The functions of thefirst execution module 503 may also be implemented by thefirst processor 104 of fig. 1.
Specifically, the server sends a return message to the financial self-service terminal through thesecond communication interface 201. The financial self-service terminal receives the return message through thefirst communication interface 105, thefirst processor 104 calls the program in thememory 103 to acquire the control information in the return message, and thefirst processor 104 executes the transaction request of the user according to the control information.
Optionally, fig. 8 is a schematic structural view of a financial self-service terminal of a service invocation system according to another embodiment of the present application, and on the basis of fig. 7, a financial self-service terminal is further provided, as shown in fig. 8, the financial self-service terminal further includes: anencryption module 601.
Theencryption module 601 is configured to encrypt the transaction packet to obtain a ciphertext.
Optionally, on the basis of the partial structural schematic diagram of the system provided in fig. 1, with respect to the server in fig. 1, fig. 9 is a structural schematic diagram of the server of the service invoking system provided in an embodiment of the present application, as shown in fig. 9, the server includes: averification module 701 and asecond generation module 702.
Thechecking module 701 is configured to check the ciphertext according to a first preset condition.
Thesecond generating module 702 is configured to obtain transaction information in the transaction message, and generate a return message after accepting the transaction.
Optionally, the transaction information comprises any combination of one or more of: transaction type, transaction amount, magnetic stripe information, and chip information.
Fig. 10 is a schematic diagram of a server side structure of a service invocation system according to another embodiment of the present application, and as shown in fig. 10, the server side includes: asecond acquisition module 801.
The second obtainingmodule 801 is configured to obtain the ciphertext password according to the transaction packet.
Thechecking module 701 is further configured to check the ciphertext password under a second preset condition to obtain a checking result.
The above-mentioned apparatus is used for executing the method provided by the foregoing embodiment, and the implementation principle and technical effect are similar, which are not described herein again.
Optionally, the present invention also provides a program product, such as a computer readable storage medium, comprising a program for performing the steps of the method of fig. 2 or 3 when executed by thefirst processor 104 and for performing the steps of the method of fig. 4 or 6 when executed by thesecond processor 202.
In the embodiments provided in the present invention, it should be understood that the disclosed system and method can be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, a division of a unit is merely a logical division, and an actual implementation may have another division, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
Units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.
The integrated unit implemented in the form of a software functional unit may be stored in a computer readable storage medium. The software functional unit is stored in a storage medium and includes several instructions to enable a computer device (which may be a personal computer, a server, or a network device) or a processor (processor) to execute some steps of the methods according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a U disk, a removable hard disk, a Read-Only Memory (ROM), a magnetic disk, or an optical disk.