CN103745351B - A kind of acquisition method and system for transmitting cipher key T K - Google Patents

Abstract

The present invention discloses a kind of acquisition method and system for transmitting cipher key T K.The acquisition method of the transmission key, comprises the following steps：S1, operation terminal carry out operation validity certification by PC and server；After S2, certification are legal, operation terminal gathers the transmission cipher key T K that POS terminal is produced by USB；The transmission cipher key T K collected is sent to server by S3, operation terminal by PC.It is connected and is authenticated by PC between operation terminal and server in the method and system of the present invention.It is authenticated during operation, it is necessary to which operator's card is inserted on operation terminal device, by the software on PC and POS terminal equipment communication and gathers TK after certification, POS terminal gathers TK security and compatibility.

Description

A kind of acquisition method and system for transmitting cipher key T K

Technical field

The present invention relates to e-payment field, more particularly to a kind of acquisition method and system for transmitting cipher key T K.

Background technology

Bank card（BANK Card）Increasingly popularized as the means of payment, common bank card paying system includes salePoint terminal（Point Of Sale, POS）, POS receive single system（POSP）, code keypad（PIN PAD）With hardware encryption equipment（Hardware and Security Module, HSM）.Wherein POS terminal can receive bank card information, with communication work(Can, and receive the instruction completion financial transaction information and the equipment exchanged for information about of teller；POS receives single system to POS terminalManaged concentratedly, including parameter is downloaded, key is downloaded, the transaction request of receiving, processing or forwarding POS terminal, and whole to POSLoopback transaction results information is held, is the system of centralized management and trading processing；Code keypad（PIN PAD）It is that various finance are handed overEasily related key carries out safe storage protection, and PIN is encrypted the safety means of protection；Hardware encryption equipment（HSM）It is the peripheral hardware devices that transmission data are encrypted, the encryption and decryption, checking message and document source for PIN are justTrue property and storage key.Personal identification code（Personal Identification Number, PIN）, i.e. personal identification number isThe data message of holder's identity legitimacy is recognized in on-line transaction, any link does not permit in cyber-net systemPerhaps occur in clear text manner；Terminal master key（Terminal Master Key, TMK）, it is close to working when POS terminal worksThe master key that key is encrypted, encrypting storing is in system database；POS terminal is widely used in bank card and pays occasion, thanSuch as manufacturer's shopping, hotel accommodations, are a kind of indispensable modernization means of payment, have incorporated the various fields of people's lifeClose.Bank card, particularly debit card, are typically all provided with PIN by holder, and in payment process is carried out, POS terminal is except upperSend outside the data such as the magnetic track information of bank card, also want holder to input the identity legitimacy that PIN verifies holder for issuing bank,Ensure bank card safety of payment, protect the property safety of holder.In order to prevent PIN reveal or be cracked, it is desirable to from terminal toIt is whole that safe encipherment protection is carried out to PIN in the whole information interactive process of issuing bank, not in computer network systemAny link, PIN occurs in clear text manner, therefore the PIN of receiving input at present POS terminal requires outfit key management bodySystem.

The key code system of POS terminal is divided into two grades：Terminal master key（TMK）And working key（WK）.Wherein TMK in WK moreDuring new, WK is encrypted protection.Unique TMK is shared between every POS terminal and POS, it is necessary to have safeguard protection,Ensure can only write device and participate in calculate, it is impossible to read；TMK is a very crucial root key, if TMK is intercepted, workMake key to be just easier to be cracked, will seriously threaten bank card safety of payment.So TMK can be downloaded safely to POS terminal,Key as whole POS terminal security.It is as follows that existing TMK download scenarios are concluded below：

1st, key mother POS schemes：User receives transmission of the single system hardware encryption equipment as key mother POS inputs in POSEncryption key.POS terminal receives single system initiating terminal master key download request by key mother POS to POS, and POS receives single systemDriving hardware encryption equipment generates terminal master key at random, and is transferred to transmission encryption keys key mother POS, key motherPOS is obtained terminal master key in plain text, is saved in POS whole with POS terminal, POS terminal is transmitted further to after transmission encryption key decryptionCode keypad is held, so as to realize that POS terminal and POS receive the synchronization of terminal master key between single system.

2nd, IC-card decryption scheme：User receives transmission encryption of the single system hardware encryption equipment as being injected in IC-card in POSKey.IC-card is inserted POS terminal by user, and POS terminal receives single system initiating terminal master key download request to POS, and POS receives singleSystem drive hardware encryption equipment generates terminal master key at random, and is transferred to transmission encryption keys POS terminal, and POS is wholeTransmission encryption key decryption terminal master key ciphertext in the IC-card of end, obtains terminal master key in plain text, is saved in POS terminal closeCode key disk, so as to realize that POS terminal and POS receive the synchronization of terminal master key between single system.

Above two scheme all has the disadvantage that：Terminal master key is appeared in outside safety means in plain text, to take precautions against keyDisclosure risk, the download of terminal master key must control the safe computer room progress in administrative center, be downloaded eventually by manually concentratingHold master key.So as to bring, " maintenance centre's computer room workload is big；Equipment needs to transport under the safe computer room of administrative center after dispatching from the factoryTrade company can be just deployed to by carrying key, and cost of transportation rises；In order to concentrate lower dress key, it is necessary to substantial amounts of human hand and working time,Maintenance cost is big, maintenance period length " the problems such as.

The content of the invention

In order to solve the above technical problems, one aspect of the present invention is to provide a kind of collection for transmitting cipher key T KMethod, comprises the following steps：

S1, operation terminal carry out operation validity certification by PC and server；

After S2, certification are legal, operation terminal gathers the transmission cipher key T K that POS terminal is produced by USB；

The transmission cipher key T K collected is sent to server by S3, operation terminal by PC.

Another technical scheme of the present invention is to provide a kind of acquisition system for transmitting cipher key T K, including server and serviceThe PC of device communication connection and the operation terminal communicated to connect with PC, the operation terminal include：Authentication module, collectionModule and the first sending module；

Authentication module is used to carry out operation validity certification with server by PC；

Acquisition module is used for after authentication module authentication operation is legal, and the transmission key that POS terminal is produced is gathered by USBTK；

The transmission cipher key T K that first sending module is used to collect acquisition module is sent to server by PC.

Beneficial effect of the present invention：It is connected in the method and system of the present invention between operation terminal and server by PCAnd be authenticated., it is necessary to which operator's card is inserted on operation terminal device during operation, and determine time that operator's card can be activatedNumber and expired time are no more than regulation, when number of times or time expire, it is necessary to keeper's card is inserted into operation terminal, to behaviourWork person's card is reset.Operation terminal is connected after being authenticated with POS terminal by USB line, passes through the software energy on PCEnough and POS terminal equipment communication simultaneously gathers TK, and such a Structure and Process makes in no introducing collection TK operations, the life of original factoryProduce flow constant, it is compatible, when needing collection TK data, carried out after the certification by operating terminal, add POS terminal collectionTK security and compatibility.

Brief description of the drawings

Fig. 1 is a kind of execution flow chart of an embodiment of transmission cipher key T K of present invention acquisition method；

Fig. 2 is a kind of structured flowchart of transmission cipher key T K of the present invention one embodiment of acquisition system；

Main element symbol description：

1st, transmission cipher key T K acquisition system；10th, server；20th, PC；30th, terminal is operated；31st, authentication module；32、Acquisition module；33rd, the first sending module.

Embodiment

To describe the technology contents of the present invention in detail, feature, the objects and the effects being constructed, below in conjunction with embodimentAnd coordinate accompanying drawing to be explained in detail.

To solve technical problem present in background technology, the present invention uses a kind of new master key download scenarios, passed throughPOS terminal randomly generates TK（Transmission Key, transmit key）, the TK after generation is stored in the password of POS terminalIn keyboard, and TK is sent to KMS by transmission means required under various application scenarios（Key Management System,Key management system, for management terminal master key TMK）In.

As POS terminal application download terminal master key TMK, KMS systems use TK ciphering terminal master key TMK, and willTerminal master key ciphertext after encryption is sent to POS terminal, and POS terminal is decrypted to master key ciphertext with TK after receiving, obtainedIt is stored in terminal master key TMK, and by terminal master key TMK in code keypad.

In this way, by TK ciphering terminal master key TMK, enabling TMK to carry out remote transmission, facilitate TMK safety download.

In some scenarios, the TK produced using operation terminal collection POS terminal, and be responsible for by operation terminal transmitting TKGive MTMS systems（Material Tracking Management System, Tracing Material system, mainly in plant producedUse）, TK is managed by MTMS systematic unities, and TK is sent to corresponding KMS systems, the course of conveying is differentiated by CA centersOperate the identity of terminal, MTMS systems and KMS systems.TK acquisition operations can be facilitated using operation terminal collection TK（Can be withRealize key collection etc.）The rights management gathered with TK；It can be facilitated using MTMS systems and TK is managed collectively, it is convenient to sell laterThe data search of POS terminal and download when repairing afterwards, can be realized by the single bulk transfer TK of production by MTMS systems, facilitate TKTransfer management, prevent TK misinformate to mistake object；Introducing CA centers can prevent pseudo-terminal and puppet KMS systems from stealing TK.

TMK is encrypted above by being sent after operation terminal collection transmission cipher key T K to bank end, then it is whole by POSEnd remote download encrypted through TK after TMK method can ensure TMK transmission safety, due to TK be protection TMK safely downloadKey, it is therefore desirable to produce POS terminal factory build can realize safety collection transmission cipher key T K while to protectHold the constant operation terminal of the original mode of production of factory and server.

Just the technical scheme of above mentioned problem is overcome to be described in detail the present invention below.

Referring to Fig. 1, being a kind of execution flow chart for the acquisition method for transmitting cipher key T K of the present invention, this method includes stepSuddenly：

S1, operation terminal carry out operation validity certification by PC and server；

After S2, certification are legal, operation terminal gathers the transmission cipher key T K that POS terminal is produced by USB；

The transmission cipher key T K collected is sent to server by S3, operation terminal by PC.

In the present embodiment, the step S1 is specifically included：

Operator's card that S11, operation terminal read insertion operation terminal obtains operator message, and operator message is led toCross PC to send to server, subsequently into step S12；

S12, server judge whether it is corresponding with operator card judge activation number of times whether be finished or whetherExpired time is reached, if so, into step S13, if not, it is determined that operation terminal operation is legal and enters step S2；

Keeper's card that S13, operation terminal read insertion operation terminal obtains Administrator Info, and Administrator Info is led toCross PC to send to server, subsequently into step S14；

Administrator Info described in S14, server authentication, and when certification by after, setting with the operator readCard is corresponding to allow activation number of times and expired time, is then back to step S11.

Wherein, the server in above-mentioned steps can be MTMS systems.

In the present embodiment, the step S2 is specifically included：

After certification is legal, operation terminal control POS terminal removes original transmission cipher key T K；Terminal is operated to receive POS wholeThe transmission cipher key T K that end is generated using code keypad.

Referring to Fig. 2, being a kind of structured flowchart for the acquisition system for transmitting cipher key T K of the present invention.Above-mentioned one kind transmission is closeKey TK acquisition method is applied in the system.

PC 20, Yi Jiyu that the acquisition system 1 of the transmission cipher key T K includes server 10, is connected with server communicationThe operation terminal 30 of PC communication connection, the operation terminal 30 includes：Authentication module 31, acquisition module 32 and first send mouldBlock 33；The server 10 can be MTMS systems.

31 pieces of certification mould is used to carry out operation validity certification with server by PC；

Acquisition module 32 is used for after authentication module authentication operation is legal, and the transmission for gathering POS terminal generation by USB is closeKey TK；

The transmission cipher key T K that first sending module 33 is used to collect acquisition module is sent to server by PC.

In the present embodiment, the authentication module 31 specifically includes the first transmitting element, the second transmitting element, the clothesBusiness device includes judge module, certification setting module；

Operator's card that first transmitting element is used to read insertion operation terminal obtains operator message, and operator is believedBreath is sent to server by PC；

Judge module is used to judge that operator's card described in the operator message of the first transmitting element transmission to be corresponding and judgedWhether activation number of times is finished or whether reaches expired time, if notifying the second transmitting element to perform operation, and collection is notified if notModule performs operation；

Second transmitting element be used for when judge module judge operator card it is corresponding judge activation number of times be finished orDuring up to expired time, the keeper's card for reading insertion operation terminal obtains Administrator Info, and Administrator Info is passed through into PCSend to server；

Certification setting module be used for the transmitting element of certification second send Administrator Info, and when certification by after, setIt is corresponding with operator's card to allow activation number of times and expired time, then notify the first transmitting element to perform operation.

In the present embodiment, the acquisition module 32 specifically includes removing module, acquisition module；

Removing module is used for after authentication module authentication operation is legal, and control POS terminal removes original transmission cipher key T K；

Acquisition module is used for after authentication module authentication operation is legal, receives the biography that POS terminal uses code keypad to generateDefeated cipher key T K.

Beneficial effect of the present invention：It is connected in the method and system of the present invention between operation terminal and server by PCAnd be authenticated., it is necessary to which operator's card is inserted on operation terminal device during operation, and it is determined to the number of times and expired of activationTime, no more than regulation, when number of times or time expire, it is necessary to which keeper's card is inserted into operation terminal, sticks into operatorRow is reset.Operation terminal is connected after being authenticated with POS terminal by USB line, can be whole with POS by the software on PCEnd equipment communicates and gathers TK, and such a Structure and Process makes in no introducing collection TK operations, and the production procedure of original factory is notBecome, it is compatible, when needing collection TK data, carried out after the certification by operating terminal, add the safety that POS terminal gathers TKProperty and compatibility.

Embodiments of the invention are the foregoing is only, are not intended to limit the scope of the invention, it is every to utilize this hairEquivalent structure or equivalent flow conversion that bright specification and accompanying drawing content are made, or directly or indirectly it is used in other related skillsArt field, is included within the scope of the present invention.

Claims (2)

1. a kind of acquisition method for transmitting cipher key T K, it is characterised in that comprise the following steps：

S1, operation terminal carry out operation validity certification by PC and server；The step S1 is specifically included：

Operator's card that S11, operation terminal read insertion operation terminal obtains operator message, and operator message is passed through into PCMachine is sent to server, subsequently into step S12；

S12, server judge whether it is corresponding with operator card judge activation number of times whether be finished or whether reachExpired time, if so, into step S13, if not, it is determined that operation terminal operation is legal and enters step S2；

Keeper's card that S13, operation terminal read insertion operation terminal obtains Administrator Info, and Administrator Info is passed through into PCMachine is sent to server, subsequently into step S14；

Administrator Info described in S14, server authentication, and when certification by after, operator's card pair that setting is read with describedThat answers allows activation number of times and expired time, is then back to step S11；

After S2, certification are legal, operation terminal control POS terminal removes original transmission cipher key T K；Terminal is operated to receive POS terminalThe transmission cipher key T K generated using code keypad；Terminal is operated to gather the transmission cipher key T K that POS terminal is produced by USB；

The transmission cipher key T K collected is sent to server by S3, operation terminal by PC.

2. a kind of acquisition system for transmitting cipher key T K, it is characterised in that the PC that is connected including server, with server communication,And the operation terminal communicated to connect with PC, the operation terminal includes：Authentication module, acquisition module and first send mouldBlock；

Authentication module is used to carry out operation validity certification with server by PC；

Acquisition module is used for after authentication module authentication operation is legal, and the transmission cipher key T K that POS terminal is produced is gathered by USB；

The acquisition module specifically includes removing module, acquisition module；

Removing module is used for after authentication module authentication operation is legal, and control POS terminal removes original transmission cipher key T K；

Acquisition module is used for after authentication module authentication operation is legal, and the transmission for receiving POS terminal using code keypad generation is closeKey TK；

The transmission cipher key T K that first sending module is used to collect acquisition module is sent to server by PC；

The authentication module specifically includes the first transmitting element, the second transmitting element, and the server includes judge module, certificationSetting module；

Operator's card that first transmitting element is used to read insertion operation terminal obtains operator message, and operator message is led toPC is crossed to send to server；

Judge module is used to judge that operator's card described in the operator message of the first transmitting element transmission to be corresponding and judges activationWhether number of times is finished or whether reaches expired time, if notifying the second transmitting element to perform operation, acquisition module is notified if notPerform operation；

Second transmitting element is used to judge that activation number of times is finished or reached when judge module judges that operator's card is correspondingDuring time phase, the keeper's card for reading insertion operation terminal obtains Administrator Info, and Administrator Info is sent by PCTo server；

Certification setting module be used for the transmitting element of certification second send Administrator Info, and when certification by after, setting with graspWork person's card is corresponding to allow activation number of times and expired time, then notifies the first transmitting element to perform operation.