Now life has been inseparable from wechat/Alipay electronic payment, usually go out to eat, shopping as long as take a mobile phone, you can solve everything, so that now has not touched the true 💰 for a long time.

Once I went out to have a meal and waited in line to pay for it. I was so bored that I was ready to pull out my cell phone and fight the wilderness, only to find that the place was not connected to the Internet.

Look at the mobile phone clearly signal full grid, but is to show the network is not connected, apple mobile phone users pain, who uses who knows.

Voice-over: really Diss use Intel baseband Iphone, 📶 good bad, nothing network will flash off ~

Back to the point, because THERE is no Internet, and I have no money, so I am afraid that when I pay, because my phone has no Internet, I can not use Alipay to deduct money. Is thinking, has been arranged to me, regardless of 37, 21, first use alipay to try, really can’t ye don’t eat.

However, unexpectedly, when the merchant scanned the payment code on Alipay to pay, although my mobile phone did not pop up the page of successful payment, but the merchant terminal showed successful payment and successfully printed out the receipt. After a while, my mobile phone received a message of payment deduction from Alipay.

Because my recent work is related to wechat/Alipay, the overall payment process is relatively clear, but why the payment code can be offline payment is not very clear, so I did some research, and thus I have today’s article.

Popular Science payment method

Before we talk about the offline principle of payment code, let’s first introduce two common payment methods to students who are not familiar with Alipay/wechat payment methods.

There are two commonly used payment methods for offline payment on wechat and Alipay. One is that we open the mobile phone and take the initiative to scan the code card provided by the merchant. This payment method is generally called primary scanning payment (users take the initiative to scan the code).

Take Alipay as an example, the payment process is shown in the figure below:

The second is that we open the mobile phone, show our payment code, and then the merchant uses the code scanning gun and other tools to obtain the payment code to complete the payment, this payment method is generally called scanned payment (the user is scanned).

Take Alipay as an example, the payment process is shown in the figure below:

For the first method, the APP on the mobile phone needs to scan the code and then pop up the window to confirm the payment. In this way, the payment cannot be completed when the mobile phone has no network. Therefore, the situation without network mentioned above refers to the payment code payment scenario.

Payment code Payment process

Before talking about offline payment by payment code, let’s first take a look at the overall process of payment code. Take supermarket shopping as an example, the payment information flow of one-time payment code is shown in the figure:

This process merchant background system is required to call the alipay barcode payment interface to complete the payment.

Because the merchant background needs online networking and alipay background communication, so the offline payment of payment code refers to the situation that the client does not have the network, and the merchant end must be online in real time.

The process of invoking the payment code interface is shown in the figure below:

Through the above two figures, we have an overall understanding of the payment code interaction process.

In fact, the technical scheme of payment code can be divided into two situations: the client is online and offline. Let’s look at the specific implementation methods of the two schemes.

Here, by the way, I send you a classic learning materials, I used in university and work of the classic e-book library (including data structure, operating system, C++/C, network classics, front-end programming classics, Java related, programmer cognition, career development), interview and job summary are packed here.

Click here to get directly:

Computer Classics required reading list (including download methods)

On-line code scheme

The client online code scheme, this should be relatively easy to think of, as long as alipay/wechat in the case of login, click the payment button, the client calls the background system application payment code interface.

After receiving the request, the background system generates a payment code, and then saves the relationship between the payment code and the user in the database, and returns it to the client.

As long as the client displays the payment code within the validity period, the payment can be completed, otherwise the QR code will expire.

Using this scheme, it is relatively safe because the server generates the code every time, and the server can control idempotent without the risk of client forgery.

In addition, even if we need to adjust the payment code rules, such as increasing the number of payment codes by one digit, we just need to adjust the server code, and the client does not need to upgrade.

However, the disadvantages of this scheme are also obvious. The client must be connected online in real time, and without the network, the payment code cannot be obtained.

In addition, some smart devices now support Alipay payment, and a large part of these devices are not connected to the Internet (such as Mi Band 4), so it is impossible to use the online code scheme.

Based on this situation, so began to have offline code scheme.

Offline code scheme

Speaking of offline code we may be relatively strange, but in fact if you look carefully, in fact, many scenes are used offline code.

For example, when you go to black Internet cafes to play fantasy westward travel, the account is always stolen.

Have no way, spent a brushstroke heavy capital bought a netease general order, every time when logging in, besides input user name and password beyond, still need input dynamic password. Accounts have rarely been stolen since then.

For example, every time netease pays, we need to input the bank card password and the dynamic code on e-Bank Shield to complete the payment.

Voice-over:Here to make fun of it again, the net silver shield really super difficult to use before, always drive incompatible. Still remember at the beginning with net silver recharge yellow diamond, made a whole afternoon did not succeed -!

Of course, all of the above may be old, and many of you may not have used them, but there are popular mobile Authenticator apps such as Google Authenticator.

This token, dynamic generation of one-time Password (OTP, One-time Password), can prevent Password theft caused by security risks.

In fact, the payment code offline scheme technology prototype is based on this scheme, so let’s use Google Authenticator to understand how it works.

Principle of dynamic password technology

First of all, if we need to use Google Authenticator, we need to turn on the secondary authentication function on the website. Take Google account as an example, the following Settings can be found in the setting of two-step authentication:

When we click on Settings, a QR code will pop up and then scan the binding using the Google Authenticator APP.

When we bind, the Google Authenticator APP will display the dynamic code.

Let’s parse the qr code, which corresponds to the following string:

Otpauth ://totp/Google%[email protected]? Secret =xxxx&issuer=Google copy codeCopy the code

In the above strings, the most important is the secret string, which is a string encoded in BASE32. When it is really used, it needs to be decoded in BASE32, and the pseudo-codes are processed as follows:

original_secret = xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx secret = BASE32_DECODE(TO_UPPERCASE(REMOVE_SPACES(original_secret))) copies the codeCopy the code

The client and server will keep a copy of the key at the same time, and both sides will use the same algorithm to compare the correctness of the dynamic code.

Taking the client as an example, to generate a dynamic code, first we need to go through a signature function. Here **Google Authenticator ** uses HMAC-SHA1, which is a message verification code based on hash. A more secure one-way hash function such as SHA1 can be used to generate the signature.

The signature function pseudo-codes are as follows:

Hmac = SHA1(secret + SHA1(secret + input)) copies the codeCopy the code

In the above function, input takes the current time divisible by 30.

Input = CURRENT_UNIX_TIME() / 30 Copy codeCopy the code

Here time acts as a dynamic parameter, so that dynamic codes can be generated continuously.

In addition, this is divisible by 30 to give the captchas a 30-second validity period.

In this way, the user can have enough time to prepare to enter the dynamic code. In addition, there may be time deviation between the client and the server. The interval of 30 seconds can shield such difference with a high probability.

Voiceover: This validity period is actually very serious, if it is long, the security will be poor.

If it’s short, the user experience is poor and it’s not easy to type and prepare.

After the hMAC-SHA1 signature function, we get a string of length 40, which we also need to convert to 6 digits for user input. The pseudo-codes processed are as follows:

four_bytes = hmac[LAST_BYTE(hmac):LAST_BYTE(hmac) + 4] large_integer = INT(four_bytes) small_integer = large_integer % 1,000,000 copy codeCopy the code

The complete algorithm pseudo-code is as follows:

original_secret = xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx secret = BASE32_DECODE(TO_UPPERCASE(REMOVE_SPACES(original_secret))) input = CURRENT_UNIX_TIME() / 30 hmac = SHA1(secret + SHA1(secret + input)) four_bytes = hmac[LAST_BYTE(hmac):LAST_BYTE(hmac) + 4] large_integer = INT(four_bytes) Small_integer = LARge_INTEGER % 1,000,000 Copy codeCopy the code

When the client uploads the dynamic code to the server, the server queries the database to obtain the key corresponding to the user, then uses the same algorithm to process and generate a dynamic code, and finally compares whether the dynamic code uploaded by the client is consistent with that generated by the server.

Payment code offline scheme

We know the implementation scheme of dynamic password above, and the principle of payment code generation is basically the same.

However, the payment code offline scheme adopts dynamic key (globally unique) and periodically requests the server to change the key to ensure higher security.

In addition, in the one-time dynamic password scheme, both parties need to be based on the same secret key, so the server needs to know exactly the correct user behind this. In the preceding login scenario, enter a user name during login, and the server can query the corresponding key in the database.

However, in the payment scenario of payment code, the payment process only passes a payment code, and the corresponding user can be deducted. Don’t worry, this payment code must contain the corresponding user information.

Therefore, the corresponding algorithm of payment code will be more complex than dynamic code, so as to effectively ensure security.

I don’t know if you want to know about this algorithm.

Haha, just kidding, this algorithm is beyond our grasp.

We do not know the core algorithm of Alipay, but we can understand a fur from other people’s open design scheme.

Here xiao Hei brother to give you a zhihu netizen @ opposite direction of zhong answer offline TWO-DIMENSIONAL code implementation, give you look look.

Payment code offline code disadvantages

Finally, let’s look at the disadvantages of offline payment code scheme:

First, the algorithm adjustment is not flexible. If the relevant algorithm is greatly adjusted, the client may need to be upgraded, and the server also needs to be compatible with the payment code generated by the old and new algorithms during this period.

Second, security issues, normal circumstances related to the key can not be obtained by ordinary users, but there is no heart. They may obtain the phone user Root rights or jailbreak the phone, use malicious programs to obtain the key, and then randomly generate payment codes.

This might make you worry about your wallet. But AT this point, I think it is too much to worry about, ant Group so many gods, not nothing, they must have a lot of measures to ensure the security of payment.

The third problem is data collision. The calculation of payment code generated by user A is consistent with that of user B, which is the same as the Hash algorithm. No matter how good the algorithm is, it has the probability to generate the same Hash value.

This results in user B being charged instead of user A. Come so, very black dragon really, tell to B user, indescribable was buckled money.

But don’t worry, I think it’s still lower than winning the lottery, so don’t worry too much about it.

Even if it is mistakenly deducted, rest assured that Alipay will surely lose money with customers because of such a large volume.

At the same time to share a system of Java books, suitable for small white to god of all kinds of needs are sorted out.

Click here: Java Details pack

The last

Finally, to sum up, we usually use payment code to pay. In fact, the principle is that the merchant terminal obtains the payment code of our mobile phone APP (which is actually a string of numbers), and then invokes the alipay payment interface in the background to complete the deduction.

In this process, the merchant side daemon must be online, but for our client, it can be online or offline.

If our client is online, we can send the payment code to the client through the server. This way is more secure and flexible, but for the weak network environment, the experience is very poor.

If our client does not have the network, then through the client through a certain algorithm to generate the payment code, the server received after the relevant verification, confirm which user, confirm the validity of the code, and complete the deduction. This method is suitable for the situation where the client does not have a network, but is relatively inflexible and less secure.

Hey hey, understand the principle, have feel or very interesting ~

Next time you wait in line to pay, don’t be embarrassed if your phone has no Internet connection

reference

  1. www.zhihu.com/question/49…
  2. Garbagecollected.org/2014/09/14/…