Smart card batch encryption and personalization method and system

Abstract

The invention provides an intelligent card batch encryption and personalization method. The intelligent card batch encryption and personalization method comprises the following steps: creating a user card file structure and a PSAM card file structure of a main client; dispersing an application master control key of the user card and an application master control key of the PSAM card based on the master client root key, and writing a corresponding application master control key into a key file of the PSAM card according to a preset key writing list; wherein the number of key application master control keys in the preset key writing list is smaller than the number of dispersed key application master control keys of the PSAM card; creating sub-customers in batches, calculating a sub-customer root key of each sub-customer based on the main customer root key, and storing the sub-customer root key in the key file; acquiring final customer information, acquiring and activating the PSAM card and the user card, performing bidirectional authentication on the PSAM card and the user card, and writing the acquired final customer information into the user card after the authentication is passed; wherein when the PSAM card is activated, the PSAM card is verified based on the master client root key, and the application master control key lacked in the PSAM card is added after verification is passed.

Description

Technical Field

[0001] The present invention relates to the field of smart card encryption technology, and in particular to a smart card batch encryption and personalization method and system. Background Art

[0002] With the rapid development of science and technology, smart cards, as a highly secure, compact, portable, and geographically unrestricted identity authentication tool, have been widely used in various fields. This has also led to an increasing demand for smart card encryption technology to ensure the security performance of smart cards during use.

[0003] The encryption method of existing smart cards is usually to calculate the key based on the unique characteristic information of the customer and user card to achieve one-time key distribution, so that all customer cards can be uniformly encrypted and initialized in the company management agency. For example, CN101739758A discloses a smart card encryption method, which first writes the first security root key into the reader and the second security root key into the encryptor of the key management center; then generates the access key of the smart card according to the serial number of the smart card, the first security root key and the second security root key; finally, writes the access key into the smart card. This technical solution does not require the system to maintain an operation password for each smart card, thereby reducing the burden on the reader and writer, and can be applied in large networks.

[0004] However, for batches of small and medium-sized customers, this type of card encryption has the following problems: it is impossible to encrypt small customer cards in a centralized manner, and more supply chain resources are needed to cope with scattered demands, which also has a significant impact on the rapid implementation and launch of smart card services for small and medium-sized customers.

[0005] In order to solve the above problems, people have been seeking an ideal technical solution. Summary of the invention

[0006] The purpose of the present invention is to address the deficiencies of the prior art and thus provide a smart card batch encryption and personalization method and system to achieve hierarchical security management of customer keys, while ensuring the security of card keys, and regularly completing card encryption initialization in batches.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is: A first aspect provides a smart card batch encryption and personalization method, comprising the following steps: Create a card file structure: create a user card file structure and a PSAM card file structure for the main customer, each file structure includes a key file, and the key file stores at least a root key of the main customer, wherein the root key of the main customer is generated according to the system root key and the unique tag of the main customer; Initialize the card key: disperse the application master key of the user card based on the master customer root key and write it into the key file of the user card; disperse the application master key of the PSAM card based on the master customer root key, and write the corresponding application master key into the key file of the PSAM card according to the preset key write list; wherein the number of key application master keys in the preset key write list is less than the number of key application master keys of the dispersed PSAM card; Generate secondary keys: create sub-customers in batches, calculate the sub-customer root key of each sub-customer based on the master customer root key and store it in the key file; Card personalization: obtain the end customer information, apply for a sub-customer root key of a sub-customer, and import it into the local key server through the local key service; obtain and activate the PSAM card and user card, perform two-way authentication on the PSAM card and the user card, and write the obtained end customer information into the user card after the authentication is passed; among them, when activating the PSAM card, verify the PSAM card based on the main customer root key, and after the verification is passed, add the missing application master key in the PSAM card and update the existing application master key in the PSAM card.

[0008] Furthermore, the application master key of the PSAM card includes the cardholder basic information key, account information key, transaction control key, and wallet transaction key.

[0009] Further, verifying the PSAM card based on the master customer root key, and adding the missing application master key in the PSAM card and updating the existing application master key in the PSAM card after the verification is passed include: Calculate the card application authentication key using the master customer root key and the unique identifier of the PSAM card; Use external authentication to verify the card authentication key of the PSAM card. After passing the external authentication, obtain the PSAM card update write permission; A new application master key is calculated based on the sub-client root key and the unique identifier of the PSAM card, and the new application master key is written into the key file of the PSAM card as the missing application master key in the PSAM card, or updated into the key file of the PSAM card as an update key of the existing application master key in the PSAM card.

[0010] Further, when activating a user card, the application master key of the user card is calculated using the master client root key and the unique identifier of the user card; Use external authentication to verify the application master key of the user card. After passing the external authentication, obtain the user card update write permission; A new application master key is calculated based on the sub-client root key and the application unique identifier, and the new application master key is updated into the key file of the user card as an update key of the existing application master key in the user card.

[0011] Furthermore, the steps of calculating the sub-customer root key of each sub-customer based on the master customer root key are: Obtaining customer information of each sub-customer, wherein the customer information includes at least a unique customer ID; Convert the unique customer ID to a fixed length as a sub-customer key factor; The sub-client root key is dispersed based on the system root key and the sub-client key factors.

[0012] A second aspect provides a smart card batch encryption and personalization system, comprising: A master customer card file structure creation module: used to create a master customer's user card file structure and a PSAM card file structure for the master customer, each file structure includes a key file, and the key file stores at least a master customer root key, wherein the master customer root key is generated according to a system root key and a master customer unique tag; A card key initialization module is used to disperse the application master key of the user card based on the master customer root key and write it into the key file of the user card; disperse the application master key of the PSAM card based on the master customer root key, and write the corresponding application master key into the key file of the PSAM card according to the preset key write list; wherein the number of key application master keys in the preset key write list is less than the number of key application master keys of the dispersed PSAM card; Secondary key generation module: used to create sub-customers in batches, calculate the sub-customer root key of each sub-customer based on the main customer root key and store it in the key file; Card personalization module: used to obtain the end customer information, apply for a sub-customer root key of a sub-customer, and import it into the local key server through the local key service; obtain and activate the PSAM card and user card, perform two-way authentication on the PSAM card and the user card, and write the obtained end customer information into the user card after the authentication is passed; among them, when activating the PSAM card, verify the PSAM card based on the main customer root key, and add the missing application master key in the PSAM card and update the existing application master key in the PSAM card after the verification is passed.

[0013] The present invention has outstanding substantive features and significant progress compared to the prior art. Specifically, in the smart card application scenario, the present invention only writes part of the application master key of the PSAM card into the key file of the PSAM card when performing card encryption initialization. Only when the card is personalized can the complete updated application master key be obtained to write the sub-customer information, thereby separating the card personalization from the card encryption initialization, and realizing the batch operation of the card encryption initialization. Through this technical solution, it is possible to achieve hierarchical security management of customer keys. While ensuring the security of card keys, card encryption initialization can be completed in batches on a regular basis, reducing the frequent involvement of human resources in the supply chain, effectively reducing management costs, and creating a "small and medium-sized one-card agency model" that is convenient for company external offices, agents, and operating agencies to flexibly manage customers' personalized keys on their own, greatly improving the efficiency of implementing the smart card business system for small and medium-sized customers. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a schematic diagram of the process of the present invention.

[0015] Figure 2 It is a system structure diagram of the present invention. DETAILED DESCRIPTION

[0016] The technical solution of the present invention is further described in detail below through specific implementation methods.

[0017] Example 1 This embodiment provides a smart card batch encryption and personalization method, such as Figure 1 As shown, the following steps are included: Create card file structure: Create the user card file structure and PSAM card file structure of the main customer, each file structure includes a key file.

[0018] In a specific implementation, the cards include but are not limited to user cards and PSAM cards, wherein the user cards include but are not limited to CPU cards and M1 cards.

[0019] For a CPU card, its file structure includes application directory, application file, key file, etc., wherein the application directory is used to define the application, the application file is used to define the file under each application, and the key file is used to define the read-write key corresponding to the file to ensure the security and integrity of the data; it can be understood that there can be one or more applications, and there can also be one or more application files corresponding to each application. In specific implementation, the read-write key in the key file can be a common key, or one key per card, one key per application, or one key per file.

[0020] For M1 card, its file structure includes sector application definition, sector block data file, sector key file, etc. Specifically, sectors are used to simulate application structure, each sector is used as an application, each block of sector data is used as a file, and sector key is controlled by sector A key and B key. Similarly, the key of key file can be one key per card, one key per zone, or one key per pass. For PSAM cards, its file structure includes application files, key files, public information files, terminal information files, etc. Application files are used to define multiple files under each application, and key files are used to store multiple keys under the application; similarly, the read and write keys in the key files can be common keys, or one key per card, one key per application, or one key per file.

[0021] It should be noted that there must be and can only be one key file in each directory. In this embodiment, the key file stores at least the master customer root key, where the master customer root key is generated by a secure decentralized algorithm based on the system root key and the master customer unique tag; the decentralized algorithm includes but is not limited to symmetric decryption, hash encryption, custom encryption and other algorithms.

[0022] Specifically, the system root key RootKey is provided by a key service unit, which includes but is not limited to hardware encryption machines, key ukeys, cloud keys, fixed keys, etc.; the key service unit can provide various interfaces, and the interface types are not limited to TCP, HTTP, HTTPS, GRPC, NATS and other methods.

[0023] The unique identifier of the main customer refers to the unique characteristic information CustFlag0 of the main customer. After the main customer is selected, the unique characteristic information CustFlag0 is determined at the same time; the main customer key factor CustFlag1 is calculated based on the unique characteristic information CustFlag0, and the main customer root key RootKey1 is calculated using the system root key RootKey and the main customer key factor CustFlag1 obtained above.

[0024] Initialize the card key: based on the master customer root key, disperse the application master key of the user card and write it into the key file of the user card; based on the master customer root key, disperse the application master key of the PSAM card, and write the corresponding application master key into the key file of the PSAM card according to the preset key write list; among which, the number of key application master keys in the preset key write list is less than the number of key application master keys of the dispersed PSAM card.

[0025] Specifically, based on the master customer root key RootKey1, the initialization key values ​​of various application master keys of the user card and PSAM card are generated through a secure distribution algorithm. The distribution algorithm includes but is not limited to symmetric encryption algorithms (3DES or SM4, etc.), hash algorithms, custom algorithms, etc.

[0026] It is understandable that, since the sub-customer information factor does not participate in the key dispersion of the initialization card key, the customer information is not distinguished when the card is encrypted in the centralized initialization. In order to prevent the use of the existing initial card key for personalized card issuance, this embodiment only writes part of the application master key when the key file corresponding to the PSAM card is initialized to write the application master key. Specifically, the missing part of the application master key is one or more of the key keys.

[0027] Specifically, the PSAM card has multiple application master keys, among which the key keys include the cardholder basic information key, account information key, transaction control key, and wallet transaction key; when in use, the key application master keys to be written to the PSAM card and the key application master keys missing are determined according to the file specifications of each enterprise for user cards. The selection criteria are that the smart card encrypted with the above scheme cannot open accounts, issue cards, and conduct transactions in the traditional standard business system.

[0028] Specifically, assuming that the root key in the encryption machine is RootKey (16 bytes), the steps to initialize the card key are: 1) Select the main customer, obtain the main customer dispersion factor custflag1 (8-byte multiple), and based on RootKey and custflag1, use the 3DES / SM4 key dispersion algorithm to obtain the main customer key RootKey1 (16 bytes); 2) Find the card and obtain the card's unique identification number (4 bytes). Based on the card's unique identification number, the dispersion factor SNR1 (8 bytes) can be calculated. 3) Calculate the application master key: Each card supports multiple applications. Assuming the application identifier is DF01 (2 bytes), the dispersion factor APP01 (8 bytes) can be calculated based on the application identifier; Based on RootKey1, APP01 and SNR1, the 3DES / SM4 key dispersion algorithm is used and dispersed twice to obtain the application master key (16 bytes); 4) Calculate business key: There can be multiple business file keys under an application. Each file has a file ID (01~0F). Based on the file ID, the dispersion factor FID01 (8 bytes) can be calculated. Based on RootKey1, APP01, FID01 and SNR1, the 3DES / SM4 key distribution algorithm is used to distribute the key three times to obtain the file key (16 bytes).

[0029] It should be noted that the above adopts a three-level key dispersion mode, which is the most complex and secure mode. In actual situations, a two-level dispersion mode can also be adopted, that is, dispersion to the application master key.

[0030] Generate secondary keys: create sub-customers in batches, calculate the sub-customer root key of each sub-customer based on the main customer root key, and store it in the key file.

[0031] It should be noted that the sub-customer here refers to the end customer, which is under the jurisdiction of the secondary management unit and the application system is deployed at the end customer.

[0032] Specifically, the steps for calculating the sub-customer root key of each sub-customer based on the master customer root key are: Obtaining customer information of each sub-customer, wherein the customer information includes at least a unique customer ID; Convert the unique customer ID to a fixed length as a sub-customer key factor; The sub-customer root key RootKey2 is dispersed according to the system root key and the sub-customer key factors.

[0033] The sub-customer root key RootKey2 and the main customer root key RootKey1 form a secondary key.

[0034] Among them, each smart card supports multiple applications, and each application has a unique application identifier. Therefore, the application dispersion factor is calculated based on the application identifier, and the secondary application master key is obtained based on the application dispersion factor and the sub-customer root key RootKey2 to manage the application key; each application can have multiple files, and each file has a unique file identifier. Therefore, the file dispersion factor is calculated based on the file identifier, and the secondary file key is obtained based on the file dispersion factor and the sub-customer root key RootKey2.

[0035] It should be noted that the dispersion algorithm used to disperse the sub-customer root key based on the system root key and the sub-customer key factor is consistent with the dispersion algorithm used in the initialization card key stage, laying the foundation for subsequent verification.

[0036] After obtaining the sub-customer root key, store one or more sub-customer root keys in a key file or Ukey device; among them, the master customer root key RootKey1 must also be stored in the key file or Ukey device.

[0037] Card personalization: Obtain sub-customer information to determine the final customer information, apply for a set of secondary keys, and import them into the local key server through the local key service.

[0038] Randomly select a number of user cards and PSAM cards after card key initialization, and prepare for personalized card issuance; Activate the user card and PSAM card, perform two-way authentication on the PSAM card and the user card, and write the acquired sub-customer information into the user card after the authentication is passed. Specifically, the sub-customer information includes name, work number, and validity period.

[0039] It should be noted that before performing two-way authentication on the PSAM card and the user card, it is necessary to activate the PSAM card and verify the PSAM card; and activate the user card and verify the user card.

[0040] Specifically, when activating the PSAM card, the PSAM card is verified based on the main customer root key, and after the verification is passed, the missing application master key in the PSAM card is added and the existing application master key in the PSAM card is updated.

[0041] In specific implementation, the above technical solution includes the following steps: Calculate the card application authentication key using the master customer root key and the unique identifier of the PSAM card; Use external authentication to verify the card authentication key of the PSAM card. After passing the external authentication, obtain the PSAM card update write permission; A new application master key is calculated based on the sub-client root key and the unique identifier of the PSAM card, and the new application master key is written into the key file of the PSAM card as the application master key missing in the PSAM card, or updated into the key file of the PSAM card as the update key of the application master key already in the PSAM card. The key step is to make up for the missing application master key in the PSAM card.

[0042] Assume that a certain end customer's secondary key has been obtained (through key authorization or Ukey); the primary customer root key contained in the secondary key is the master customer root key RootKey1; the secondary customer root key contained is the sub-customer root key RootKey2; Assume that the card serial number of the PSAM card that has been encrypted from the main customer is SNR1, and assume that the PSAM card lacks key No. 01 (account file key); the method for completing key No. 01 of the card is as follows: 1) Use the 3DES / SM4 algorithm to hash RootKey1+ SNR1 to obtain the card's authentication key. Use the authentication key to perform external authentication on the card. After the authentication passes, continue: 2) Use the 3DES / SM4 algorithm to hash RootKey2 + SNR1 to obtain key 01, and write or update the key value to the card.

[0043] Further, when activating a user card, the application master key of the user card is calculated using the master client root key and the unique identifier of the user card; Use external authentication to verify the application master key of the user card. After passing the external authentication, obtain the user card update write permission; A new application master key is calculated based on the sub-client root key and the application unique identifier, and the new application master key is updated into the key file of the user card as an update key of the existing application master key in the user card.

[0044] Taking the CPU card as an example, assuming that the main customer root key is RootKey1, the user card unique serial number is ASN1, and the application number is DF01; then in the initialization card key stage, the application master key is calculated; Specifically, the key dispersion algorithm in 3DES / SM4 is used, and the main customer root key RootKey1 is dispersed and hashed using the dispersion factor ASN1 to obtain the application master key appkey1; Among them, the main customer root key RootKey1 is 16 bytes, the dispersion factor is a multiple of 8 bytes, and the dispersed application master key appkey1 is a 16-byte key.

[0045] When activating the user card, use the instruction set in the PBOC specification to verify the application master key. The specific steps are as follows: Connect the user card, select application DF01, use the key dispersion algorithm in 3DES / SM4, and use the dispersion factor ASN1 to perform a dispersed hash on the main customer root key RootKey1 to obtain the application master key appkey1; Get an 8-byte random number, use the key dispersion algorithm in 3DES / SM4, use the application master key appkey1 to encrypt the random number, and get vdata8; Send the external authentication command 0082000008 + vdata8 to the user card. After verification by the internal chip of the user card, if 0x9000 is returned, it means that the application master key verification has passed, and the key update permission under the application can be obtained; otherwise, it means that the application master key verification has not passed, and the key update permission under the application cannot be obtained.

[0046] In specific implementation, the steps of performing two-way authentication on the PSAM card and the user card include: The terminal device sends a random number acquisition command to the user card to obtain a random number generated by the card (obtaining the random number of the card); wherein the PASM card is installed on the terminal device; The terminal device sends an encryption command to the PSAM card to encrypt the random number (obtain ciphertext); The terminal device sends an external authentication command with the above encryption result (ciphertext) to the user card; After the user card is verified, it is determined whether the authentication is successful. If successful, subsequent security operations such as writing or reading can be performed.

[0047] At this point, the encryption and personalization process of all cards for one customer has been completed; by repeating the card personalization process, the card personalization operations of multiple customers can be completed, and multiple secondary institutions can perform customer card personalization operations at the same time and at any time.

[0048] Through this technical solution, it is possible to achieve hierarchical security management of customer keys. While ensuring the security of card keys, card encryption initialization can be completed in batches on a regular basis, reducing the frequent involvement of human resources in the supply chain, effectively reducing management costs, and creating a "small and medium-sized one-card agency model" that is convenient for company external offices, agents, and operating agencies to flexibly manage customers' personalized keys on their own, greatly improving the efficiency of implementing the smart card business system for small and medium-sized customers.

[0049] Example 2 This embodiment provides a smart card batch encryption and personalization system, such as Figure 2 As shown, including: A master customer card file structure creation module: used to create a master customer's user card file structure and a PSAM card file structure for the master customer, each file structure includes a key file, and the key file stores at least a master customer root key, wherein the master customer root key is generated according to a system root key and a master customer unique tag; A card key initialization module is used to disperse the application master key of the user card based on the master customer root key and write it into the key file of the user card; disperse the application master key of the PSAM card based on the master customer root key, and write the corresponding application master key into the key file of the PSAM card according to the preset key write list; wherein the number of key application master keys in the preset key write list is less than the number of key application master keys of the dispersed PSAM card; Secondary key generation module: used to create sub-customers in batches, calculate the sub-customer root key of each sub-customer based on the main customer root key and store it in the key file; Card personalization module: used to obtain the end customer information, apply for a sub-customer root key of a sub-customer, and import it into the local key server through the local key service; obtain and activate the PSAM card and user card, perform two-way authentication on the PSAM card and the user card, and write the obtained end customer information into the user card after the authentication is passed; among them, when activating the PSAM card, verify the PSAM card based on the main customer root key, and add the missing application master key in the PSAM card and update the existing application master key in the PSAM card after the verification is passed.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present invention, which should be included in the scope of the technical solution for protection of the present invention.

Claims

1. A method for batch encryption and personalization of smart cards, characterized in that: The following steps are involved: Create a card file structure: create a user card file structure and a PSAM card file structure for the main customer, each file structure includes a key file, and the key file stores at least a root key of the main customer, wherein the root key of the main customer is generated according to the system root key and the unique tag of the main customer; Initialize the card key: disperse the application master key of the user card based on the master customer root key and write it into the key file of the user card; disperse the application master key of the PSAM card based on the master customer root key, and write the corresponding application master key into the key file of the PSAM card according to the preset key write list; wherein the number of key application master keys in the preset key write list is less than the number of key application master keys of the dispersed PSAM card; Generate secondary keys: create sub-customers in batches, calculate the sub-customer root key of each sub-customer based on the master customer root key and store it in the key file; Card personalization: obtain the end customer information, apply for a sub-customer root key of a sub-customer, and import it into the local key server through the local key service; obtain and activate the PSAM card and the user card, perform two-way authentication on the PSAM card and the user card, and write the obtained end customer information into the user card after the authentication is passed; among them, when activating the PSAM card, verify the PSAM card based on the main customer root key, and after the verification is passed, add the missing application master key in the PSAM card based on the sub-customer root key and update the existing application master key in the PSAM card.

2. A smart card batch encryption and personalization method according to claim 1, characterized in that: The application master keys of the PSAM card include the cardholder basic information key, account information key, transaction control key, and wallet transaction key.

3. A smart card batch encryption and personalization method according to claim 1, characterized in that: Verifying the PSAM card based on the master customer root key, and adding the missing application master key in the PSAM card and updating the existing application master key in the PSAM card after verification include: Calculate the card application authentication key using the master customer root key and the unique identifier of the PSAM card; Use external authentication to verify the card authentication key of the PSAM card. After passing the external authentication, obtain the PSAM card update write permission; A new application master key is calculated based on the sub-client root key and the unique identifier of the PSAM card, and the new application master key is written into the key file of the PSAM card as the missing application master key in the PSAM card, or updated into the key file of the PSAM card as an update key of the existing application master key in the PSAM card.

4. A smart card batch encryption and personalization method according to claim 1, characterized in that: When activating a user card, the application master key of the user card is calculated using the master customer root key and the unique identifier of the user card; Use external authentication to verify the application master key of the user card. After passing the external authentication, obtain the user card update write permission; A new application master key is calculated based on the sub-client root key and the application unique identifier, and the new application master key is updated into the key file of the user card as an update key of the existing application master key in the user card.

5. The method for batch encryption and personalization of smart cards according to claim 1, characterized in that: The steps to calculate each sub-customer's sub-customer root key based on the master customer root key are: Obtaining customer information of each sub-customer, wherein the customer information includes at least a unique customer ID; Convert the unique customer ID to a fixed length as a sub-customer key factor; The sub-client root key is dispersed based on the system root key and the sub-client key factors.

6. A smart card batch encryption and personalization method according to claim 1, characterized in that: The dispersion algorithm used when dispersing the sub-client root key based on the system root key and the sub-client key factor is consistent with the dispersion algorithm used in the initialization card key stage.

7. A smart card batch encryption and personalization system, characterized in that: include: A master customer card file structure creation module: used to create a master customer's user card file structure and a PSAM card file structure for the master customer, each file structure includes a key file, and the key file stores at least a master customer root key, wherein the master customer root key is generated according to a system root key and a master customer unique tag; A card key initialization module is used to disperse the application master key of the user card based on the master customer root key and write it into the key file of the user card; disperse the application master key of the PSAM card based on the master customer root key, and write the corresponding application master key into the key file of the PSAM card according to the preset key write list; wherein the number of key application master keys in the preset key write list is less than the number of key application master keys of the dispersed PSAM card; Secondary key generation module: used to create sub-customers in batches, calculate the sub-customer root key of each sub-customer based on the main customer root key and store it in the key file; Card personalization module: used to obtain the end customer information, apply for a sub-customer root key of a sub-customer, and import it into the local key server through the local key service; obtain and activate the PSAM card and user card, perform two-way authentication on the PSAM card and the user card, and write the obtained end customer information into the user card after the authentication is passed; among them, when activating the PSAM card, verify the PSAM card based on the main customer root key, and add the missing application master key in the PSAM card and update the existing application master key in the PSAM card after the verification is passed.

Images