A key management system, device, storage medium, and computer program product

Abstract

This application relates to the field of computer technology and discloses a key management system, device, storage medium, and computer program product. The system includes: a key generation module, used to process merchant terminal information sent by a merchant file management system using an encryption machine to generate a CUPS key; and to perform trans-encryption processing on CUPA keys sent by the UnionPay merchant management platform or uploaded by UnionPay branches to obtain a trans-encrypted key; and a key distribution module, used to send the CUPS key and the trans-encrypted key to a transaction system, a merchant terminal key database, and a preset key receiving address or a payment terminal management system, so that the CUPS key and the trans-encrypted key are downloaded to the target terminal. The key management system provided by this application can automate the entire process of merchant file acquisition, key generation, and distribution, effectively solving the problems of low key download efficiency and slow process in the prior art.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a key management system, device, storage medium, and computer program product. Background Technology

[0002] Merchants rely heavily on payment terminals for their daily payment operations. These electronic devices support various payment methods, including credit cards, debit cards, and digital wallets. Common examples include counter POS machines and mobile payment terminals, which transmit and process sensitive data such as cardholder account information and PIN codes during transactions. The security of this sensitive information and the integrity of transaction data depend on the support of encryption keys.

[0003] In existing technologies, the key downloading and activation methods for merchant payment terminals typically involve manual processing, with the production network segment and business network segment isolated from each other. The production network segment is responsible for generating keys and processing payment transactions, while the business network segment is responsible for entering merchant information and submitting applications. Due to network segment isolation, automatic coordination is impossible, and key-related operations can only be performed in batches. This manual processing method is inefficient, directly resulting in a slow process for merchant key downloading and activation. Therefore, it is urgent to solve this technical problem. Summary of the Invention

[0004] In view of the above situation, embodiments of this application provide a key management system, device, storage medium, and computer program product, which aim to solve the above problems or at least partially solve the above problems.

[0005] In a first aspect, embodiments of this application provide a key management system, the system comprising: The key generation module is used to process merchant terminal information sent by the merchant file management system using an encryption machine to generate a CUPS key; and to re-encrypt the CUPA key sent by the UnionPay merchant management platform or uploaded by UnionPay branches to obtain a re-encrypted key. The key distribution module is used to send the CUPS key and the encryption key to the transaction system, the merchant terminal key database, and a preset network receiving address or payment terminal management system, so that the CUPS key and the encryption key are downloaded to the target terminal.

[0006] Secondly, embodiments of this application also provide an electronic device, including: a processor; and a memory arranged to store computer-executable instructions, which, when executed, enable the processor to perform the functions in the aforementioned key management system.

[0007] Thirdly, embodiments of this application also provide a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, enable the electronic device to perform the functions in the aforementioned key management system.

[0008] Fourthly, an optional implementation of this application also provides a computer program product, which carries program code, and the instructions included in the program code can be used to implement the functions in the key management system as described in the first aspect.

[0009] By employing the above technical solutions, the present application provides a key management system, device, storage medium, and computer program product. This system can automatically process merchant terminal information synchronized from the merchant file management system through a key generation module and with the aid of an encryption machine to generate a CUPS key and re-encrypt the CUPA key sent by UnionPay to obtain a re-encrypted key, without requiring manual intervention in the key generation process. At the same time, the key distribution module can automatically send the two types of keys to the transaction system, the merchant terminal key database, and to a preset network receiving address or payment terminal management system. This breaks down the collaboration barriers caused by the isolation between the production network segment and the business network segment, replaces the traditional manual operation, improves the efficiency of key generation and distribution, speeds up the process of merchant key download and activation, enhances key management security, reduces operational and leakage risks, and realizes full automation of the merchant file acquisition, key generation, and distribution process, effectively solving the problems of low key download efficiency and slow process in the prior art.

[0010] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0011] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A schematic diagram of the key management system provided in an embodiment of this application is shown; Figure 2 A schematic diagram of the structure of a key management system provided in another embodiment of this application is shown; Figure 3 This paper illustrates a system interaction diagram for key downloading provided in an embodiment of this application. Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0013] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0014] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such use can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the term "comprising" and its variations should be interpreted as open-ended terms meaning "including but not limited to."

[0015] As mentioned earlier, in existing technologies, the key downloading and activation methods for merchant payment terminals typically involve manual processing under conditions where the production network segment and the business network segment are isolated. The production network segment is responsible for generating keys and processing payment transactions, while the business network segment is responsible for entering merchant information and submitting applications. Due to network segment isolation, automatic coordination is impossible, and key-related operations can only be performed in batches. This manual processing method is inefficient, directly resulting in a slow process for merchant key downloading and activation. Therefore, it is urgent to solve this technical problem. Based on this, this invention proposes a key management system, device, storage medium, and computer program product, which will be described in detail below through specific embodiments.

[0016] Figure 1 This paper illustrates a flowchart of a key management system provided in an embodiment of this application, in conjunction with... Figure 1 As shown, the key management system 100 provided in this application embodiment includes: The key generation module 101 is used to process the merchant terminal information sent by the merchant file management system using an encryption machine to generate a CUPS key; and to re-encrypt the CUPA key sent by the UnionPay merchant management platform or uploaded by UnionPay branches to obtain a re-encrypted key. The key distribution module 102 is used to send the CUPS key and the encryption key to the transaction system, the merchant terminal key database, and to a preset network receiving address or the payment terminal management system, so that the CUPS key and the encryption key are downloaded to the target terminal.

[0017] Combination Figure 3 As shown in this embodiment, the Merchant Document Management System (DM) is a system that stores basic information about local merchants and terminals. It is operated by a UnionPay branch, which enters merchant information into the system, generating merchant IDs, terminal IDs, and other merchant terminal information. The merchant ID is a unique identifier for the merchant within the payment system, used to distinguish different merchant entities; the terminal ID is a unique identifier for the payment terminal used by the corresponding merchant, used to locate the specific terminal device. After these two types of information are entered into the Merchant Document Management System by the UnionPay branch, they are synchronized to the key management system in this embodiment.

[0018] Regarding the step of "using an encryption machine to process merchant terminal information sent by the merchant file management system and generate a CUPS key", specifically, the encryption machine's built-in random number generator can be called to generate the plaintext of the CUPS key. Then, the master control key pre-deployed in the encryption machine is used to encrypt the generated plaintext CUPS key, and finally, a CUPS key protected by the master control key is obtained. For example, in real-world scenarios, a 128-bit AES type CUPS key plaintext is often generated, and then encrypted with a 3DES algorithm master control key to obtain a CUPS key protected by the master control key.

[0019] The UnionPay Merchant Management Platform is a dedicated management platform built by UnionPay. Its core function is to respond to the registration operations of branch offices and generate CUPA keys based on the merchant information submitted by the merchants. This system will match and encrypt the CUPA keys by combining the UnionPay branch office number and the merchant terminal information, ensuring that the CUPA keys can only be used by legitimate merchants' legitimate terminals, while also supporting cross-system key security collaboration.

[0020] Regarding the step of "re-encrypting the CUPA key sent by the UnionPay Merchant Management Platform or uploaded by UnionPay branches to obtain a re-encryption key," specifically, one could first decrypt the CUPA key in the encryption machine according to the decryption method and corresponding parameters specifically provided by UnionPay to obtain the plaintext of the CUPA key; then, encrypt the plaintext of the CUPA key according to the encryption specifications and algorithms preset by this key management system to obtain the encryption key for one's own system; finally, call the master control key pre-deployed in the encryption machine to encrypt the obtained key again, completing the entire re-encryption process, and ultimately generating a re-encryption key that can be securely synchronized to transaction systems and other platforms and is protected by the master control key.

[0021] In this embodiment, the transaction system is a system used to process various payment-related transaction processes. It can receive transaction requests, process transaction data, and protect and verify transaction messages based on information such as the acquired CUPS key and encryption key, thereby ensuring the security and validity of the transaction.

[0022] The merchant terminal key database is a database that stores various key information corresponding to merchant terminals. In this embodiment, it binds and stores the merchant number, terminal number and corresponding CUPS key, encryption key, etc., to provide data support for subsequent key query, verification and other operations, and ensures that different systems can obtain the legitimate key of the corresponding merchant terminal when they need to use the key.

[0023] The key distribution module sends keys to either a preset network receiving address or a payment terminal management system. If the key is sent to the preset network receiving address, it can be manually retrieved from the network receiving address and packaged into the master POS terminal, which then packages it into the target terminal. If the key is sent to the payment terminal management system, it automatically binds the key to the terminal and distributes it, thus successfully packaging both types of keys into the target terminal.

[0024] As can be seen, the key management system provided in this application embodiment, through the key generation module and with the help of an encryption machine, can automatically process the merchant terminal information synchronized by the merchant file management system to generate a CUPS key, and perform re-encryption processing on the CUPA key sent by the UnionPay side to obtain a re-encrypted key, without the need for manual intervention in the key generation process; at the same time, the key distribution module can automatically send the two types of keys to the transaction system, the merchant terminal key database, and distribute them to the preset network receiving address or the payment terminal management system, breaking down the collaboration barriers caused by the isolation between the production network segment and the business network segment, replacing the traditional manual operation, improving the efficiency of key generation and distribution, accelerating the process of merchant key download and activation, improving key management security, reducing operational and leakage risks, and realizing full automation of the merchant file acquisition, key generation, and distribution process, effectively solving the problems of low key download efficiency and slow process in the prior art.

[0025] The key management system described above will be explained in detail below.

[0026] In some embodiments, the target terminal is a first TPOS terminal, and the key management system is implemented using a browser / server system architecture, with the server including a web server and an application server; the key generation module and the key distribution module are deployed on the application server. The key generation module is also used for: Using the encryption machine, the security module number of the target terminal sent by the merchant file management system is processed to generate a device key; The device key is sent to the merchant terminal key database and the TPOS platform, so that the TPOS platform binds the device key, the security module number, the CUPS key, and the encryption key. The web server is equipped with a key query module for: In response to the user's download operation, the CUPS key and the encryption key corresponding to the target terminal are downloaded to the preset network receiving address, so that the CUPS key and the encryption key can be downloaded into the target terminal using the master POS machine.

[0027] Figure 2 A schematic diagram of a key management system according to another embodiment of this application is shown. The following is in conjunction with... Figure 2 This embodiment will now be described. In this embodiment, the key management system is implemented using a browser / server system architecture. The server includes a web server and an application server. The application server is equipped with a key generation module and a key distribution module, and the web server is equipped with a key query module 103.

[0028] The first TPOS terminal is a payment terminal equipped with a security module, used for merchant payment transaction processing. The TPOS platform is a system specifically designed to serve this terminal. The TPOS platform acts as a central hub for information transmission and reception between the terminal and the telephone payment system, enabling telephone payment functions and services. In practical applications, transactions from the first TPOS terminal first undergo preliminary key verification and transaction data preprocessing through the TPOS platform before being transmitted to the transaction system. In other words, the TPOS platform is the front-end system of the transaction system, responsible for connecting the terminal and the transaction system, and handling data relay.

[0029] The security module number is a unique identifier for the security module (a hardware module used to store keys and ensure transaction security) built into the first TPOS terminal. For example, the security module number of a certain first TPOS terminal can be "SM20250012345678", where "SM" represents the security module, "2025" is the year of production, and "0012345678" is the unique serial number of the module.

[0030] During implementation, the key generation module obtains the security module number of the first TPOS terminal from the merchant file management system and passes it to the encryption machine. The encryption machine calls its built-in key generation algorithm to generate a corresponding device key based on the security module number. Then, the key generation module sends the device key to the TPOS platform, enabling the TPOS platform to bind the device key, security module number, CUPS key, and encryption key. This achieves precise association between the first TPOS terminal, the corresponding merchant entity, and various keys, ensuring that the device key, CUPS key, and encryption key can only be used by the corresponding first TPOS terminal and its associated merchant. At the same time, as a front-end system of the transaction system, the TPOS platform can quickly verify the terminal identity and the legality of the key when a transaction occurs after binding this information, preventing the key from being misappropriated by illegal terminals or merchants and ensuring the security and compliance of transactions.

[0031] To download the key to the target terminal of the first TPOS terminal type, the key administrator of the UnionPay branch can log in to the query platform provided by the key query module deployed on the web server to download the key. In specific implementation, for example, after the branch key administrator accesses the query platform webpage, the system first triggers the account and password verification logic: reads the account and password entered by the administrator, matches them with the branch administrator account information (including the branch identifier and role permission tags) stored in the backend account database, and loads the function menu of the query platform after successful verification.

[0032] When an administrator executes the "Query Key Processing Results" function, the system receives the query conditions entered by the administrator (such as merchant number and processing time range), and automatically includes the "branch identifier" bound to the administrator account as a hidden filter condition, and sends a query request to the backend key database. The program filters out key data from the database that "matches the affiliated branch + meets the query conditions" (only including the key processing results of merchants under that branch, such as generation success / failure, distribution status), organizes the filtered results into a list, and returns it to the front-end webpage for display.

[0033] When an administrator executes the "Download Key File" function, the program first verifies the ownership of the file to be downloaded, confirming that the merchant corresponding to the key file belongs to the current administrator's branch office. Simultaneously, it checks the file's processing status (it must be "processed complete" before downloading). After successful verification, the program calls the backend file storage interface to read the corresponding key file data, generates a temporary download link based on a preset network receiving address, and returns it to the front end for the administrator to download. At the same time, the system can automatically record download operation logs (including the operator, operation time, and downloaded key file number), synchronously storing them in the log database for easy traceability by the head office.

[0034] Afterwards, the staff who obtained the keys can import the key files into the master POS machine. Then, the staff can take the master POS machine to the deployment site of the first TPOS terminal and directly install these two types of keys into the hardware chip of the first TPOS terminal through the hardware interface (such as serial port or USB) of the master POS machine. After the installation is completed, the terminal can be restarted and used to process transactions.

[0035] In some embodiments, the target terminal is a second TPOS terminal or a smart terminal, and the key distribution module is used to: send the CUPS key and the encryption key to the payment terminal management system; The key generation module is also used for: The terminal device number sent by the payment terminal management system is received, and the terminal device number is processed by the encryption machine to generate a terminal device key. The terminal device key is sent to the merchant terminal key database and the payment terminal management system, so that the payment terminal management system binds the terminal device key, the terminal device number, the CUPS key, and the encryption key, thereby downloading the CUPS key and the encryption key into the target terminal.

[0036] In this embodiment, the second TPOS terminal is a simplified version of the TPOS terminal that adapts to the terminal device number association mode and has basic payment functions. It can complete the association of merchant terminal information and key binding by relying on the device number, such as a portable Bluetooth TPOS terminal. The smart terminal is a terminal device that is equipped with a smart operating system (such as Android or HarmonyOS) and integrates payment functions and multi-scenario application capabilities. It supports identity recognition and key management through the terminal device number, such as smart POS machines, commercial tablet computers with payment modules, and self-service cash registers.

[0037] The payment terminal management system is a back-end system specifically designed for key management, device control, and data synchronization of target terminals such as second TPOS terminals and smart terminals. Its core functions include: receiving CUPS keys, encryption keys, and terminal device keys sent by the key management system; associating terminal device numbers with merchant terminal information; completing the precise binding and automatic distribution of keys to terminals; and supporting subsequent key maintenance and terminal status monitoring. In practice, this system can be specifically TMS (Terminal Management System) or TSS (Smart Terminal Management System).

[0038] In this embodiment, the key distribution module sends the CUPS key and the encryption key to the payment terminal management system. At the same time, the key generation module receives the terminal device number of the target terminal transmitted by the payment terminal management system, encrypts the terminal device number using an encryption machine, generates a terminal device key, and synchronizes the terminal device key to the payment terminal management system and the merchant terminal key database. After receiving the above three types of keys, the payment terminal management system associates and binds them with the terminal device number and the corresponding merchant terminal information. Through the system background automatic synchronization mechanism, the key is directly downloaded to the second TPOS terminal or smart terminal to complete the key activation configuration.

[0039] When a subsequent transaction is initiated, the second TPOS terminal or smart terminal first completes its own legitimacy verification using the terminal device key, and then encrypts the transaction data (such as card number and amount) using the encryption key or CUPS key. The encrypted transaction data, along with the terminal device number and merchant terminal information, is sent to the transaction system. The transaction system calls the corresponding terminal device key and CUPS key stored in the merchant terminal key database to decrypt and verify the identity. After confirming that the key, terminal, and merchant match, the transaction is completed, and finally the encrypted transaction result is returned to the terminal. The entire process ensures the security of transaction data and the verification of terminal legitimacy through the key.

[0040] like Figure 2 As shown, in some embodiments, the web server is further deployed with a key management module 104, which is used to implement at least one of the following: Configure the encryption machine according to the encryption machine configuration instructions sent by the key administrator through the front-end page; Receive the key processing rule configuration instruction sent by the key administrator through the front-end page, and configure at least one of the key generation rule and indexing rule; In response to the key administrator's key processing progress query command sent through the front-end page, key processing progress data is generated and displayed.

[0041] In this embodiment, a key management module is also deployed on the web server. The key management module provides a key management front-end interface to the key administrators of UnionPay headquarters, so that the key administrators can configure encryption machines, key generation rules, etc.

[0042] The encryption machine configuration command is sent by the UnionPay head office key administrator via a web page. It is used to set or adjust relevant operating parameters of the encryption machine. Its core purpose is to ensure that the encryption machine can adapt to the key management system's business requirements, such as key generation and encryption conversion. For example, the administrator can send a command specifying the encryption algorithm type used by the encryption machine (e.g., AES algorithm for symmetric key systems, RSA algorithm for asymmetric key systems), or setting the key length of the encryption machine (e.g., 256 bits, 1024 bits), or enabling the encryption machine's security verification module.

[0043] In practice, UnionPay's head office key administrator can input or select corresponding configuration parameters (such as encryption algorithm, key length, communication protocol, etc.) according to business needs in the encryption machine configuration interface, forming an encryption machine configuration command and submitting it. After receiving the command, the key management module on the web server first verifies whether the administrator's operation permission is legitimate, and at the same time checks whether the configuration parameters meet the system's support range and the encryption machine's hardware requirements. After successful verification, the key management module sends the configuration command and related parameters to the corresponding encryption machine through a preset dedicated communication channel. After receiving the command, the encryption machine parses it, applies the new configuration parameters and completes its own settings, and then returns a confirmation message of successful configuration to the key management module. The key management module feeds back the confirmation result to the front-end management platform, displaying it to the administrator in the form of text prompts or status updates, completing the entire configuration process.

[0044] Key generation rules are the standards and requirements that must be followed when generating keys to ensure that keys comply with business scenarios and security specifications. For example, the key system is determined based on the terminal type (such as POS machine or smart terminal) in the merchant's profile. Ordinary POS terminals use the AES-256 algorithm of the symmetric key system to generate keys, while smart terminals use the RSA asymmetric key system to generate key pairs. At the same time, it is stipulated that the key validity period is one year and that the generated key must contain a combination of numbers and special characters. Indexing rules are the rules for assigning unique identifiers to the generated keys to quickly associate and query keys. For example, the combination of "merchant number + terminal number + key type + generation timestamp" is used as the key index. For example, if the merchant number is 100001, the terminal number is TPOS202405, the key type is transaction key, and the timestamp is 202405201530, the corresponding index is 100001-TPOS202405-TRANS-202405201530.

[0045] In practice, UnionPay's head office key administrator can select the rule type (generation, index) to be set or modified in the key rule management interface. In the corresponding rule editing interface, parameters are input or adjusted according to business change requirements, such as changing the key validity period in the key generation rule to 2 years, or adjusting the timestamp format in the index rule to "year month day hour minute second millisecond". After completing the parameter settings, the operation command is submitted. After receiving the command, the key management module on the web server updates the corresponding rule configuration table in the system's backend database and records the operation log (including the modifier, modification time, original parameters, and new parameters). Finally, the key management module feeds back the successful setting / modification result to the front-end page, prompting the administrator that the operation is complete and the new rule takes effect immediately or at a preset time.

[0046] During implementation, UnionPay's head office key administrator can input query conditions (such as merchant number, terminal number, key generation time period, key type, etc.) into the key processing progress query interface and click the query button to send a query command. After receiving the command, the key management module of the web server retrieves the corresponding key processing-related data from the backend database according to the query conditions, including the time when the key received merchant information, the generation status (not started / processing / completed), the encryption machine processing time, the distribution status of each downstream platform (pending distribution / distributing / completed / distribution failed), and the reason for failure (if any). The module organizes and summarizes the retrieved scattered data to generate structured progress data, visually displaying the overall processing progress with a progress bar, distinguishing the status of each stage with different status labels, and associating them with the corresponding time nodes. Subsequently, the module transmits the organized progress data to the front-end page, displaying it to the administrator in the form of a list or details page, while also providing a data export function (such as exporting to an Excel file) for the administrator to view, retain, or further analyze. The data is synchronized in real time throughout the process, ensuring that the administrator obtains the latest processing progress.

[0047] This embodiment deploys a key management module on a web server, enabling UnionPay's head office key administrators to conveniently configure encryption machines, flexibly set or modify key generation and indexing rules via a front-end page, and query key processing progress in real time and obtain intuitively displayed data. This improves the flexibility, accuracy, and operability of key management, making key processing more aligned with actual business needs, and enhances the transparency and control efficiency of the key management process. Figure 1 The automated key generation and distribution functions of the proposed solution complement each other, further ensuring the stable, efficient, and compliant operation of the key management system.

[0048] In some embodiments, the trading system includes at least one of the following: a clearing and processing trading platform, and a marketing service trading platform.

[0049] In this embodiment, the clearing and processing transaction platform includes, but is not limited to: China UnionPay interbank transaction clearing system, new generation cloud-based multi-core interbank clearing core system, new generation cardless business transfer and clearing platform, UnionPay cloud platform, etc.

[0050] Marketing service transaction platforms include, but are not limited to: UnionPay Merchant Services Shangyingtong (a points marketing platform developed by UnionPay Merchant Services Co., Ltd., which integrates core functions such as points accumulation, consumption redemption and marketing activity management), and marketing alliance platforms (such as Taobao Alliance platform, Baidu Alliance platform, etc.).

[0051] In some embodiments, the key distribution module, when sending the CUPS key and the encryption key to the transaction system, is specifically used for: Merchant file information is extracted from the merchant files corresponding to the target terminal sent by the merchant file management system. The merchant file information includes: payment channels and marketing platform access status. Based on the preset file-transaction system mapping relationship, the target transaction system is determined according to the merchant file information, and the CUPS key and the encryption key are sent to the target transaction system.

[0052] In this embodiment, when the key distribution module is executed, it extracts two key pieces of information from the merchant profile of the target terminal: one is the "payment channel" (e.g., "China UnionPay" or "a third-party payment institution"), and the other is the "marketing platform access status" (specifically, whether it has been connected to a specific "marketing alliance platform", such as "Shangyingtong" or "Taobao Alliance").

[0053] The module then queries the preset file-transaction system mapping relationship, determines the clearing and processing transaction system based on the "payment channel" (such as "China UnionPay Interbank Transaction Clearing System" or "New Generation Cardless Business Transfer Clearing Platform"); at the same time, it determines the corresponding marketing service transaction system based on the specific "marketing alliance platform" it accesses (such as the "Shangyingtong" system).

[0054] Ultimately, the module distributes the key in parallel to the clearing platform determined by the payment channel and the marketing platform determined by the marketing affiliate platform. If the file shows that no marketing affiliate platform is connected, the key is only distributed to the clearing platform.

[0055] In this embodiment, the key distribution module extracts merchant profile information from the merchant profile corresponding to the target terminal, combines it with the preset profile-transaction system mapping relationship, determines the target transaction system, and then sends the CUPS key and the encryption key. This achieves accurate key distribution to the corresponding transaction system, avoids key mis-sending to irrelevant systems, adapts to deployment scenarios of different merchants corresponding to different transaction systems, improves the targeting and flexibility of key distribution, and ensures the accuracy and security of key distribution. This provides reliable support for subsequent operations such as encrypted transactions based on the corresponding key in the transaction system.

[0056] In some embodiments, the key distribution module sends the CUPS key and the encryption key to the transaction system, the merchant terminal key database, and a preset network receiving address or payment terminal management system via a message queue.

[0057] In this embodiment, during implementation, the key distribution module first encapsulates the CUPS key and the encryption key into a message and sends it to the MQ. The receiving parties, such as the transaction system, the merchant terminal key database, the system corresponding to the preset network receiving address, and the payment terminal management system, then obtain the message from the MQ and parse the key.

[0058] This embodiment utilizes a message queue to distribute CUPS keys and encryption keys to the transaction system, merchant terminal key database, and preset key receiving addresses or payment terminal management system. This approach leverages the characteristics of message queues to ensure efficient and reliable key transmission, guaranteeing that relevant systems and terminals obtain the necessary keys in a timely manner. Furthermore, flexible receiver configuration adapts to different deployment scenarios, providing key support for subsequent financial payment security operations such as transaction encryption and terminal authentication. This ensures the consistency and security of key distribution and meets the key management compliance requirements in the financial payment field.

[0059] In some embodiments, the key management system adopts a dual-machine hot standby architecture. In this embodiment, dual-machine hot standby (HA) is an underlying architecture solution to ensure high system availability. Its core is the deployment of two identically configured primary and backup servers. These servers maintain data and business status consistency in real time through incremental synchronization technology. Under normal circumstances, the primary server handles all business operations (key generation, key distribution, etc.), while the backup server remains on standby. When the primary server fails, the system automatically and seamlessly switches to the backup server to avoid business interruption. The key management system in this embodiment adopts an HA dual-machine hot standby architecture, enabling cross-data center disaster recovery. The primary and backup servers ensure real-time consistency of key-related data (including key information, distribution records, system configuration, etc.) through incremental synchronization technology. During failover, the key distribution path can be seamlessly connected. This approach not only rapidly responds to disaster recovery needs through precise synchronization and intelligent switching but also maximizes business continuity and key data security, achieving high system availability and high security.

[0060] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Figure 4 As shown, at the hardware level, this electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or it may include non-volatile memory, such as at least one disk drive. Of course, this electronic device may also include other hardware required for other business operations.

[0061] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0062] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0063] The processor reads the corresponding computer program from non-volatile memory into main memory and then runs it, forming a key management system at the logical level. The processor executes the program stored in memory and specifically performs the aforementioned methods.

[0064] The processor may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0065] This electronic device enables the key management system to... Figure 1 The functions of the embodiments shown are not described in detail here.

[0066] This application also proposes a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by an electronic device including multiple applications, enable the electronic device to perform the functions of the key management system provided in various embodiments of this application.

[0067] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0069] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0070] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0071] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0072] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0073] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0074] This application also provides a computer program product that carries program code. The instructions included in the program code can be used to implement the functions of the key management system described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0075] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0076] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0077] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A key management system, characterized in that, The system includes: The key generation module is used to process merchant terminal information sent by the merchant file management system using an encryption machine to generate a CUPS key; and to re-encrypt the CUPA key sent by the UnionPay merchant management platform or uploaded by UnionPay branches to obtain a re-encrypted key. The key distribution module is used to send the CUPS key and the encryption key to the transaction system, the merchant terminal key database, and a preset network receiving address or payment terminal management system, so that the CUPS key and the encryption key are downloaded to the target terminal.

2. The system according to claim 1, characterized in that, The target terminal is a first TPOS terminal. The key management system is implemented using a browser / server system architecture, and the server includes a web server and an application server. The key generation module and the key distribution module are deployed on the application server. The key generation module is also used for: Using the encryption machine, the security module number of the target terminal sent by the merchant file management system is processed to generate a device key; The device key is sent to the merchant terminal key database and the TPOS platform, so that the TPOS platform binds the device key, the security module number, the CUPS key, and the encryption key. The web server is equipped with a key query module for: In response to the user's download operation, the CUPS key and the encryption key corresponding to the target terminal are downloaded to the preset network receiving address, so that the CUPS key and the encryption key can be downloaded into the target terminal using the master POS machine.

3. The system according to claim 1, characterized in that, The target terminal is a second TPOS terminal or a smart terminal. The key distribution module is used to send the CUPS key and the encryption key to the payment terminal management system. The key generation module is also used for: The terminal device number sent by the payment terminal management system is received, and the encryption machine is used to process the terminal device number to generate a terminal device key. The terminal device key is sent to the merchant terminal key database and the payment terminal management system, so that the payment terminal management system binds the terminal device key, the terminal device number, the CUPS key, and the encryption key, thereby downloading the CUPS key and the encryption key into the target terminal.

4. The system according to claim 2, characterized in that, The web server also deploys a key management module to implement at least one of the following: Configure the encryption machine according to the encryption machine configuration instructions sent by the key administrator through the front-end page; Receive the key processing rule configuration instruction sent by the key administrator through the front-end page, and configure at least one of the key generation rule and indexing rule; In response to the key administrator's key processing progress query command sent through the front-end page, key processing progress data is generated and displayed.

5. The system according to claim 1, characterized in that, The trading system includes at least one of the following: a clearing and processing trading platform and a marketing service trading platform.

6. The system according to claim 5, characterized in that, The key distribution module, when sending the CUPS key and the encryption key to the transaction system, is specifically used for: Merchant file information is extracted from the merchant files corresponding to the target terminal sent by the merchant file management system. The merchant file information includes: payment channels and marketing platform access status. Based on the preset file-transaction system mapping relationship, the target transaction system is determined according to the merchant file information, and the CUPS key and the encryption key are sent to the target transaction system.

7. The system according to claim 1, characterized in that, The key distribution module sends the CUPS key and the encryption key to the transaction system, the merchant terminal key database, and a preset network receiving address or payment terminal management system via a message queue.

8. An electronic device, comprising: processor; as well as A memory configured to store computer-executable instructions, characterized in that, when executed, the executable instructions cause the processor to perform the functions of the system as described in any one of claims 1-7.

9. A computer-readable storage medium storing one or more programs, characterized in that, When the one or more programs are executed by an electronic device including multiple applications, the electronic device enables the electronic device to perform the functions of the system as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product carries program code, and the instructions included in the program code can be used to implement the functions of the system as described in any one of claims 1-7.

Images