Card reader security module shared system and methodTechnical field
The present invention relates to a kind of card reader security module shared system and method, particularly relate to a kind of card reader security module shared system and method for smart card.
Background technology
Intelligent card reader (Smart card reader) thus be a kind ofly to have one or more connectors and link to each other with PC and receive PC instruction and operate smart card (Smart card) or the equipment of security module in each connector, be used to obtain, revise or store the related data in the smart card.Card reader is used in many industries such as hospital, bank, traffic, hotel, social security, telecommunications at present, uses very extensively.Basically every kind of smart card that relates to sensitive data all needs its corresponding security module to carry out encrypting and decrypting just to obtain operating right or clear data in addition, and for example social security is used security module, bank that the social security standard is arranged and used security module, I.D. that the PBOC standard is arranged and use security module that reading identity card card surface information is arranged etc.Traditional card reader all is to take smart card and security module pattern one to one; Even want to realize data manipulation to certain card, just need be in card reader embedded its corresponding security module, card reader circuit structured flowchart as shown in Figure 1; Wherein for corresponding four kinds of different smart cards; This card reader is integrated 4security module 4003a, 4003b, 4003c and 4003d, when the order of card read-write operation is sent at the terminal, MCU (microcontroller) 4001 receives and resolves this card read-write operation order throughcommunication module 4002; And choose the card decryption information that corresponding security module produces, carry out read-write operation through 4004 pairs of smart cards of card operational module.So, the card reader that function is complicated just needs embedded more security module, and the cost of every card reader also increases thereupon.Because the increase of equipment cost; Embedded security module does not have backup basically in the card reader; Therefore, if certain security module is damaged in the process of using, then card reader can't be operated this type of card; And and be identical in the employed security module kind of a lot of small field, man-to-man pattern makes that the utilization factor of security module is also different.
Summary of the invention
The technical matters that the present invention will solve is to take smart card and security module pattern one to one for the card reader that overcomes prior art; Cause cost up and the security module utilization rate of card reader not high defective, provide a kind of security module by a plurality of card reader shared card reader security module shared system and method.
The present invention solves above-mentioned technical matters through following technical proposals:
The invention provides a kind of card reader security module shared system, be characterized in that this card reader security module shared system comprises:
Several card reader are used for reading from the PC terminal card operational order and read the card decryption information from the security module shared device, and card is carried out read-write operation;
One security module shared device is used to described card reader the card decryption information is provided;
Several PC terminals are used for sending the card operational order and reading card read-write operation result through PC;
Wherein this security module shared device is electrically connected described card reader, and described card reader and corresponding described PC terminal are electrically connected.
Preferably, said card reader comprises:
One first microcontroller is used to resolve the card operational order, and carries out this card operational order through control first communication module and card module for reading and writing;
One first communication module is used for communicating by letter with the security module shared device;
One second communication module is used for the terminal communication with PC;
One card module for reading and writing is used for card is carried out read-write operation;
Wherein this first microcontroller is electrically connected with first communication module, second communication module and card module for reading and writing respectively.
Preferably, this card reader also comprises one first encrypting and decrypting module, is used for data encryption that first communication module is sent and the data decryption that this first communication module is received.
Preferably, this first encrypting and decrypting module adopts the symmetric key algorithm pattern.
Preferably, this card reader also comprises a read-write reminding module, is used to point out the read-write operation to card.
Preferably, this read-write reminding module is a hummer and a light emitting diode.
Preferably, this card reader also comprises an extended memory, is used to store the card operational order of microcontroller parsing and the data that first communication module sends or receives.
Preferably, this security module shared device comprises:
One second microcontroller is used for resolving card decryption information request command that card reader sends and reads the card decryption information of card reader request from security module;
One the 3rd communication module is used for communicating by letter with card reader;
Several security modules are used to produce the card decryption information;
Wherein this second microcontroller is electrically connected with the 3rd communication module and described security module respectively.
Preferably, this security module shared device also comprises one second encrypting and decrypting module, is used for data encryption that the 3rd communication module is sent and the data decryption that this first communication module is received.
Preferably, this security module shared device also comprises a time stamp generator, is used to the second encrypting and decrypting module time stamp data is provided.
Preferably, this second encrypting and decrypting module adopts the symmetric key algorithm pattern.
Preferably, this security module shared device also comprises some subsequent use security modules, is used for when security module is damaged, and replacing damaged security module provides the card decryption information.
Preferably, this security module shared device also comprises a reminding module, and being used for prompting has security module to damage.
Preferably, this reminding module is some light emitting diodes.
Preferably, said security module is the security module that is used for social security, financial transaction and/or I.D. field.
Preferably, this security module shared device is electrically connected through RS485 bus or Wi-Fi with described card reader.
Preferably, said PC terminal is electrically connected through RS232 bus or USB with described card reader.
The present invention also provides a kind of card reader security module of aforesaid card reader security module shared system to share method, is characterized in may further comprise the steps:
S101, the PC terminal sends read write command to card reader;
S102, card reader receives this read write command and resolves this read write command, send and read the ordering of card decryption information to the security module shared device;
S103, card reader receives the card decryption information of security module shared device feedback;
S104, card reader carries out read-write operation through the card decryption information to card.
Preferably, wherein this card reader comprises one first microcontroller and a card module for reading and writing, and at step S102Also comprise step S before1021: whether first microcontroller of card reader detects this read write command needs the card decryption information, if testing result is that then the card module for reading and writing through card reader does not directly carry out read-write operation to card.
Preferably, this card reader also comprises one first encrypting and decrypting module, and this safe sharing module comprises one the 3rd communication module and one second encrypting and decrypting module, and at step S102In also comprise step:
S1022, card reader reads the ordering to the security module shared device of card decryption information through what the first encrypting and decrypting module send to be encrypted;
S1023, the security module shared device second encrypting and decrypting module decrypts this read the order of card decryption information, and feed back to card reader after will corresponding card decryption information being encrypted through the 3rd communication module and the second encrypting and decrypting module.
Preferably, at step S103In also comprise step S1031: the card decryption information that the first encrypting and decrypting module decrypts of card reader is encrypted by the security module shared device.
Preferably, wherein this card reader comprises one first communication module, and at step S102Also comprise step S before1024: card reader is sent this card reader address designation to security module shared device through first communication module.
Preferably, wherein this card reader comprises one first microcontroller, and at step S103Also comprise step S afterwards1032: whether the address designation that first microcontroller of card reader detects in the card decryption information that receives is consistent with the address designation of this card reader, if testing result then abandons this card decryption information for not.
Preferably, this card reader also comprises a read-write reminding module, and at step S102In also comprise step S1025: the read-write reminding module of card reader sends information.
Preferably, this information is light, acoustical signal.
Preferably, this security module shared device comprises one second microcontroller, a reminding module, security module and subsequent use security module, and at step S101Also comprise step S before1011: whether the read-write that second microcontroller of security module shared device detects security module is normal, if testing result is then closed this security module, and opened corresponding subsequent use security module for not, reminding module sends information warning.
Preferably, this information warning is a light signal.
Preferably, wherein this card reader comprises one second communication module, and at step S104Also comprise step S afterwards1041: card reader will be carried out the read-write operation result to card through second communication module and sent to the PC terminal.
Preferably, wherein this card reader comprises one first microcontroller, and at step S103Also comprise step S afterwards1033: whether first microcontroller of card reader detects the operation of reading this card decryption information finishes, if testing result is then returned step S for not103
Positive progressive effect of the present invention is:
Through making card reader can share security module, simplified the structure of card reader, the cost of saving; Adopted the pattern of shared security module simultaneously,, reduced the quantity of security module with respect to traditional card reader; Reduced cost on the whole, in addition that security module is independent, make the maintenance of security module be more prone to; When security module is damaged, be convenient to maintenance more in addition, provide cost savings the service efficiency that has improved security module.Current encryption the between this external card reader and the security module also provides safeguard protection for card reader to the read-write operation of card.
Description of drawings
Fig. 1 is the circuit block diagram of smart card reader of the prior art.
Fig. 2 is the system construction drawing of the preferred embodiment of card reader security module shared system of the present invention.
Fig. 3 is the circuit block diagram of card reader of the preferred embodiment of card reader security module shared system of the present invention.
Fig. 4 is the circuit block of security module shared device of the preferred embodiment of card reader security module shared system of the present invention.
Fig. 5 is the process flow diagram that card reader security module of the present invention is shared the preferred embodiment of method.
Embodiment
Provide preferred embodiment of the present invention below in conjunction with accompanying drawing, to specify technical scheme of the present invention.
Shown in Figure 2 is the system construction drawing of the preferred embodiment of card reader security module shared system of the present invention; Wherein this card reader security module shared system comprises 100,16 card reader 201-216 of a security module shared device and 16 PC terminal 301-316; Wherein this PC terminal 301-316 is electrically connected with corresponding card reader 201-216 respectively through USB (USB) or RS232 interface, and this card reader 201-216 also is electrically connected with security module shareddevice 100 through a RS485 bus or Wi-Fi.Wherein this securitymodule sharing module 100 is used to card reader 201-216 the card decryption information is provided; Described card reader 201-216 is used to read the card operational order of PC terminal transmission and the card decryption information that security module shareddevice 100 sends; And card carried out read-write operation, the card read-write operation result that described PC terminal 301-316 is used to send the card operational order and reads card reader 201-216 feedback.
Wherein this PC terminal 301-316 and card reader 201-216 are electrically connected the electrical connection pattern of pattern and this card reader 201-216 and security module shareddevice 100; Those skilled in the art can select different electrical connection patterns as required for use, thereby realizes identical technique effect.The quantity at this card reader and PC terminal in addition; Those skilled in the art can select the quantity at different card reader and PC terminal as required; Selecting 16 card reader 201-216 and 16 PC terminal 301-316 in this enforcement for use is the communication speeds for the security module shareddevice 100 that matees this card reader 201-216 and be electrically connected with it; Because the communication speed of the security module of the security module shareddevice 100 that adopts in the present embodiment is generally at 200-300K; Communication speed for the security module that do not influence this security module shareddevice 100; More than the speed of RS485 bus was must be than the communication speed of the security module of this security module shareddevice 100 fast again, promptly the above communication speed of 400-600K just can be satisfied the demand, and satisfies corresponding communication speed so the card reader quantity in the RS485 bus is not more than 16 ability.
For the PC terminal in the present embodiment, those skilled in the art can select suitable circuit as required for use, and device is realized identical functions and effect.
Card reader 201-216 is identical in the present embodiment; And the circuit structure block diagram of this card reader is as shown in Figure 3; Wherein this card reader comprises a MCU2001,communication module 2002 and 2003, a card module for reading and writing 2004, an encrypting anddecrypting module 2005, anexpansion storer 2006 and a read-write reminding module 2007; Wherein this read-write reminding module comprises a hummer 2007a and a light emitting diode (LED) 2007b in the present embodiment, and wherein those skilled in the art can select for use not unison components and parts and circuit to reach identical prompting effect as required.
Wherein this MCU2001 is electrically connected withcommunication module 2002 and 2003, card module for reading and writing 2004, encrypting anddecrypting module 2005,expansion storer 2006 and read-write reminding module 2007 respectively.
In the present embodiment; This MCU2001 is used to resolve the card operational order; And through control first communication module and this card operational order of card module for reading and writing execution; Thiscommunication module 2003 is used for communicating by letter with security module shareddevice 100; Thiscommunication module 2002 is used for the terminal communication with PC; This card module for reading and writing 2004 is used for card is carried out read-write operation, and this encrypting anddecrypting module 2005 is used for data encryption ofcommunication module 2003 being sent with the symmetric key algorithm pattern and the data decryption that thiscommunication module 2003 is received, and this extended memory is used for the data that card operational order that store M CU2001 resolves andcommunication module 2003 send or receive; This read-write reminding module is used to point out the read-write operation to card, in the present embodiment this read-write reminding module 2007 through hummer 2007a and LED2007b send light, acoustical signal is pointed out the read-write operation to card.Wherein for the symmetric key algorithm of this encrypting anddecrypting module 2005, those skilled in the art can adopt other AES to reach identical function and effect to the data encryption according to the needs of Cipher Strength.
The circuit structure block diagram of the security module shareddevice 100 in the present embodiment is as shown in Figure 4; Wherein this security module shareddevice 100 comprises a MCU1001, a communication module 1002,4 security module 1003a, 1003b, 1003c and 1003d, 4 subsequent use security module 1004a, 1004b, 1004c and 1004d, an encrypting and decrypting module 1005, a time stamp generator 1006 and a reminding module 1007; Wherein said security module 1003a, 1003b, 1003c and 1003d and subsequent use security module 1004a, 1004b, 1004c and 1004d are the security module that is used for social security, financial transaction and/or I.D. field; And those skilled in the art can select the security module and the subsequent use security module in other quantity and different application field according to the needs of card image deciphering, thereby reaches the effect that same security module is shared.In addition, this reminding module comprises 4 LED1007a, 1007b, 1007c and 1007d, can select for use not unison components and parts and circuit to reach identical prompting effect as required for those skilled in the art.
Wherein this MCU1001 is electrically connected with communication module 1002,4 security module 1003a, 1003b, 1003c and 1003d, 4 subsequent use security module 1004a, 1004b, 1004c and 1004d, encrypting and decrypting module 1005, time stamp generator 1006 and reminding modules 1007 respectively.
Wherein MCU1001 is used for resolving the card decryption information request command of card reader transmission and reads the card decryption information that card reader 201-216 asks from security module 1003a, 1003b, 1003c and 1003d; Communication module 1002 is used for communicating by letter with card reader 201-216; These 4 security module 1003a, 1003b, 1003c and 1003d are used to produce the card decryption information; This encrypting and decrypting module 1005 is used for the data that communication module 1005 sends or receives are encrypted or deciphered with symmetric key algorithm; This time stamp generator 1006 is used to the time stamp data that encrypting and decrypting module 1005 is provided for encrypting; Subsequent use security module 1004a, 1004b, 1004c and 1004d are used for when security module is damaged; Replacing damaged security module provides the card decryption information, and this reminding module 1007 is used for prompting has security module to damage, and this reminding module 1007 sends light signal through LED1007a, 1007b, 1007c and 1007d and points out the security module damage in the present embodiment.Wherein for the symmetric key algorithm of this encrypting and decrypting module 1005, those skilled in the art can adopt other AES to reach identical function and effect to the data encryption according to the needs of Cipher Strength.
The principle of work of the card reader security module shared system in the present embodiment is:
The initialization of card reader security module shared system; Wherein the MCU1001 of security module shareddevice 100 carries out read operation to security module 1003a, 1003b, 1003c and 1003d; Whether thereby detecting security module 1003a, 1003b, 1003c and 1003d damages; If security module is arranged to be damaged; Then this MCU1001 closes this security module, and opens the subsequent use security module corresponding with the security module of this damage, and sends the prompting light signal through LED corresponding with the security module of this damage in the reminding module.
After this; A PC terminal in the 301-316 of PC terminal is sent the card operational order through RS232 or USB interface to the card reader that is electrically connected with this PC terminal; The MCU2001 of this card reader receives this card operational order throughcommunication module 2002; And this card operational order resolved; Store then in card operational order to theextended memory 2006 of this parsing, after this send card decryption information request command according to this card operational order, wherein this card decryption information request command comprises the home address of this card reader; The encrypting anddecrypting module 2005 of this card reader is encrypted this card decryption information request command through symmetric key algorithm, and is sent to security module shareddevice 100 throughcommunication unit 2003.
Security module shareddevice 100 receives the card decryption information request command of this encryption through communication module 1002; The card decryption information request command of this encryption that receives is deciphered with symmetric key algorithm through encrypting and decrypting module 1005 then; After this MCU1001 carries out this card decryption information request command; Read the card decryption information that corresponding security module produces; The home address of the card reader that receives this card decryption information is encrypted and loaded to MCU1001 control encrypting and decrypting module 1005 and time stamp generator 1006 through symmetric key algorithm and time stamp data to this card decryption information then, and the card decryption information through communication module 1002 these encryptions of transmission is to card reader then.
Card reader reads the card decryption information of this encryption throughcommunication module 2003; At first whether the card reader home address of the card decryption information loading of this encryption of MCU2001 detection is consistent with the home address of this card reader; As if inconsistent, abandon the card decryption information of this encryption.MCU2001 detects and whether reads the card decryption information of this this encryption that finishes then; If testing result is for denying; Then MCU2001 sends the card operational order once more and sends card decryption information request command to security module shareddevice 100; Otherwise MCU2001 control encrypting anddecrypting module 2005 is through the card decryption information of this encryption of symmetric key algorithm deciphering, after this stores card decryption information to theextended memory 2006 after this deciphering, and MCU2001 serves as execution this card operational order in basis through the card module for reading and writing with this card decryption information then; Behind the card EO, this MCU2001 sends the card operating result throughcommunication module 2002.
After this, the card operating result that card reader is sent is read at the PC terminal.
Shown in Figure 5 is the process flow diagram that card reader security module of the present invention is shared the preferred embodiment of method, comprising:
Step 100, the initialization of card reader security module shared system, card reader, PC terminal and security module shared device power in the system.
Whetherstep 101, security module shared device detect has security module to damage, if testing result for being, then gets intostep 102, otherwise gets intostep 103.
Step 102 is closed the security module of this damage, opens corresponding subsequent use security module and the LED through reminding module sends the light information.
Step 103, the PC terminal is sent the card operational order through RS232 or USB interface to card reader.
Step 104, card reader receives and resolves this card operational order, and stores the extended memory of this card operational order to card reader.
Step 105, whether card reader detects this card operational order needs the card decryption information, if testing result then gets intostep 112 for not.
Step 106, card reader is sent the card decryption information request command of encrypting with the symmetric cryptographic key algorithm pattern, and wherein this card decryption information request command comprises the home address of this card reader.
Step 107, security module shared device receive also and separate the close request command of information with this card of symmetric cryptographic key algorithm pattern deciphering, resolve this card decryption information request command after this deciphering then, and read the card decryption information of corresponding security module generation.
Step 108, the security module shared device is encrypted with the symmetric cryptographic key algorithm pattern the card decryption information, and loads the home address of corresponding card reader, sends this card decryption information then.
Step 109, card reader receive the card decryption information of this encryption, and whether with the home address of this card reader consistent, for not, then abandon this card decryption information like testing result if detecting the card reader home address that this card decryption information loads, and enteringstep 111.
Step 110, extended memory is deciphered and be stored to card reader with the symmetric cryptographic key algorithm pattern to the card decryption information of this encryption.
Step 111, card reader detect whether read the card decryption information of this encryption that finishes, if testing result is then returnedstep 106 for not.
Step 112, card reader is to card execute card operational order and send light, the acoustical signal of read-write prompting.
Step 113, card reader is sent to the PC terminal with the result of card operation.
Step 114, flow process finishes.
Repeatedly carry out operation if desired, only need repeatedly repeat above-mentioned flow process, just can realize repeatedly carrying out purpose the operation of card to card.
Though more than described embodiment of the present invention, it will be understood by those of skill in the art that these only illustrate, protection scope of the present invention is limited appended claims.Those skilled in the art can make numerous variations or modification to these embodiments under the prerequisite that does not deviate from principle of the present invention and essence, but these changes and modification all fall into protection scope of the present invention.