A cloud card encryption method and system

Abstract

The present invention relates to a cloud card encryption method and system, belonging to the technical field of smart card key management. A terminal reads card information through a card reading device and initiates a card transaction encryption request to a server, wherein the card transaction encryption request includes card identity information; the server receives the card transaction encryption request, generates a key calculation command, and sends the key calculation command to an encryption device; the encryption device receives the key calculation command, performs key calculation, and returns the key to the server; the server receives the key and sends the key to the terminal; the terminal receives the key and writes the key into a card to be encrypted through a card writing device to complete card encryption, so as to solve the problem of difficulty in managing card encryption authorization data in the prior art.

Description

Technical Field

[0001] The present invention relates to a cloud card encryption method and system, belonging to the technical field of smart card key management. Background Art

[0002] Smart cards are commonly used in existing public transportation systems, catering systems, identity recognition systems, access control, water and electricity meter systems, city cards, campus cards, city small payments and other applications. In the application of smart cards, encryption mechanisms are usually used to encrypt the cards for payment security and personal privacy considerations. Of course, for card management, the management party also hopes to unify customer information and authorization management to facilitate management and data analysis.

[0003] The encryption devices of smart cards disclosed in the prior art usually use offline applications to complete card encryption, and for a single customer application, the encryption operation device type is single. For example, the Chinese invention patent with application publication number CN106779021A and invention name "Smart Card Key Management System" discloses a smart card key management system, including an encryption machine, a key front-end system, a management workstation and a database server; the key front-end system includes a controller, a smart card reader, a mother card control card and a mother card, the controller is connected to the smart card reader, and the smart card reader is connected to the mother card control card and the mother card; the encryption machine and the database server are connected to the controller of the key front-end system; the management workstation is connected to the database server, so as to realize the management of IC cards and key filling.

[0004] However, the encryption device completes key acquisition offline, encrypts data through the encryption machine, and then stores the encrypted content in the database. On the one hand, the system is based on a simple CS structure, which requires the deployment of complex functional modules on the terminal and the establishment of a direct connection with the encryption device to obtain the corresponding key data, resulting in the card encryption work relying on a specific encryption device; on the other hand, the encryption is completed by offline application. For a single customer application, after encrypting the card, the data is stored in the database, resulting in the lack of unified customer information and authorization management in the management system, and complex data management and low efficiency. Summary of the invention

[0005] The purpose of the present invention is to provide a cloud card encryption method and system to solve the problem of difficulty in managing card encryption authorization data in the prior art.

[0006] To achieve the above object, the technical solution of the present invention is: the present invention provides a cloud card encryption method, comprising the following steps:

[0007] 1) The terminal reads the card information through the card reader and initiates a card transaction encryption request to the server, wherein the card transaction encryption request includes the card identity information;

[0008] 2) The server receives the card transaction encryption request, generates a key calculation command, and sends the key calculation command to the encryption device;

[0009] 3) The encryption device receives the key calculation command, performs key calculation, and returns the key to the server;

[0010] 4) The server receives the key and sends the key to the terminal;

[0011] 5) The terminal receives the key and writes the key into the card to be encrypted through the card writing device to complete the card encryption.

[0012] After the present invention reads the card information through the card reading device set by the terminal, it initiates a card transaction encryption request to the server. After receiving the request, the server establishes a connection with the encryption device, obtains the corresponding key data, and then returns it to the terminal for writing the card key data. By introducing the server to process the encryption request, the cost of terminal deployment is reduced. At the same time, since the customer card information management and authorization management are uniformly implemented on the server, the card encryption authorization process is effectively controlled, the difficulty of user data management is reduced, and the effectiveness of card encryption business operation and maintenance management is improved.

[0013] Furthermore, in step 1), the card identity information includes a card serial number and a transaction random number.

[0014] Furthermore, the step 2) also includes: when the server receives the card transaction encryption request, it verifies the legitimacy of the parameter information and the authorization information.

[0015] Furthermore, the step 2) also includes: the server performs process branch control management on the request data according to the request type and business type of the received card transaction encryption request, and performs branch diversion processing.

[0016] Furthermore, the step 2) also includes: the server converts the communication protocol according to the type of the encryption machine to obtain a key calculation command that can be recognized by the encryption machine.

[0017] The present invention also provides a cloud card encryption system, including a terminal, a server and an encryption device, wherein the terminal includes a card reading device and a card writing device, and the terminal interacts with the server, and the server interacts with the encryption device to implement the following steps:

[0018] 1) The terminal reads the card information through the card reader and initiates a card transaction encryption request to the server, wherein the card transaction encryption request includes the card identity information;

[0019] 2) The server receives the card transaction encryption request, generates a key calculation command, and sends the key calculation command to the encryption device;

[0020] 3) The encryption device receives the key calculation command, performs key calculation, and returns the key to the server;

[0021] 4) The server receives the key and sends the key to the terminal;

[0022] 5) The terminal receives the key and writes the key into the card to be encrypted through the card writing device to complete the card encryption.

[0023] Furthermore, in step 1), the card identity information includes a card serial number and a transaction random number.

[0024] Furthermore, the step 2) also includes: when the server receives the card transaction encryption request, it verifies the legitimacy of the parameter information and the authorization information.

[0025] Furthermore, the step 2) also includes: the server performs process branch control management on the request data according to the request type and business type of the received card transaction encryption request, and performs branch diversion processing.

[0026] Furthermore, the step 2) also includes: the server converts the communication protocol according to the type of the encryption machine to obtain a key calculation command that can be recognized by the encryption machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 is a system principle diagram of an embodiment of a cloud card encryption system of the present invention;

[0028] Figure 2 is a schematic diagram of a method in an embodiment of a remote card encryption system of the present invention;

[0029] Figure 3 It is a schematic diagram of branching processing of different types of data by the server in the embodiment of the remote card encryption system of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the embodiments described are only part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0031] The features and performance of the present invention are further described in detail below in conjunction with the embodiments.

[0032] Cloud card encryption system implementation example:

[0033] like Figure 1 As shown, this embodiment proposes a cloud card encryption system, including a terminal, a server and an encryption device.

[0034] The terminal has devices such as a card reader and writer, a controller, and a display device, and is deployed with client software. In this embodiment, the card reader and writer can read card information and also write corresponding key data. As other implementations, separate card readers and writers can also be used, and the card readers and writers are connected to the controller respectively. The terminal obtains the card information read by the card reader and writer, and then initiates an encryption request to start the encryption operation. The display device is provided with a browsing interface, etc., to facilitate the user's query and display needs.

[0035] The servers include database servers, business processing servers, etc. Each server is deployed with corresponding interfaces, such as storage interfaces, query interfaces, etc., which are used to call when performing related business processing.

[0036] In this embodiment, the server calculates the card key by establishing a connection with an encryption device. In this embodiment, the encryption device includes but is not limited to a key calculation system such as a hardware encryption machine, an encryption server, and an encryption dongle.

[0037] In this embodiment, Figure 2 As shown, the method of encrypting the card using the above-mentioned cloud card encryption system mainly includes the following steps:

[0038] 1) The terminal reads the card information through the card reader and initiates a card transaction encryption request to the server, wherein the card transaction encryption request includes the card identity information.

[0039] A card service operation is initiated in the terminal, and a card search operation application is initiated to the card reader / writer. When the application fails, an error code is directly returned. In this embodiment, the card search application can be initiated periodically by the controller or by the user by inputting corresponding demand information.

[0040] The controller sends a working status detection instruction to the card reader / writer device based on the card search application. When the working status is abnormal, it directly returns an error. When working normally, it sends a card search instruction to the card reader / writer device. The card reader / writer device and the card interact through the card search instruction. If the card search instruction fails to execute, it directly returns an error code. After the card search is successful, the card identity information is returned. The card identity information includes the card's unique serial number and transaction random number.

[0041] After obtaining the card identity information, the controller issues a card transaction encryption request to the cloud service system. The card transaction encryption request includes the card unique serial number, transaction random number and customer information identifier.

[0042] 2) The server receives the card transaction encryption request, generates a key calculation command, and sends the key calculation command to the encryption device.

[0043] After receiving the encrypted card transaction request, the server will connect to the database server to verify the legitimacy of the parameter information and the authorization information. After the information is verified, the process branch control management is carried out on the terminal request type and business type data, and branch diversion is carried out; after receiving a single business request, the server will perform logic processing and data processing on the business.

[0044] like Figure 3 As shown, the terminal service types include card encryption and card recycling. The terminal request types include: card operation application (customer account, card unique number, random number, card type, etc.), card operation submission (update application status, generate card operation record), card operation rollback (cancel application status, delete temporary record).

[0045] The server's branching and diversion processing of terminal request type and business type data mainly includes:

[0046] First, according to the original operation request of the terminal, it is divided into three types: card operation application, card operation submission, and card operation rollback. Among them, card operation application refers to applying to the back-end encryption device for writing card key data for the card, and at the same time changing the card interaction state to the application state; card operation submission means that the terminal has successfully written the above-mentioned card writing key data into the card, and changed the card interaction state to the submission state, and at the same time stored it in the library to form a record; card operation rollback state means that the terminal failed to write the key data to the card, and changed the card interaction state to the rollback state.

[0047] After receiving a single business request, the server performs logic processing and data processing on the business:

[0048] Business logic processing is to abstract the common part according to the business situation, personalize the compatible difference part, jump to the designated branch processing process according to different business branches, pull the supporting parameters of the designated branch, assemble the supporting business data, and wait for the subsequent module to process.

[0049] 1) Different request type branches require different input business parameters and output data domains;

[0050] 2) Different business type branches require different input business parameters, different numbers of keys, and different output key data formats;

[0051] 3) Different card type branches require different operation instructions, different key algorithms, and different output key data formats;

[0052] 4) Assembled supporting business data: including data type, key type, key index, initial key, etc.;

[0053] Business data processing: convert the input and output data in the module into a data format that can be recognized by the upper or lower software modules. Mainly includes:

[0054] 1) Input data processing: Convert the format of the supporting business data assembled in the "business logic processing" (software module) into an input data stream that can be recognized by the "key operation module" (software module).

[0055] 2) Key operation module: executes the above input data stream and returns the output data stream;

[0056] 3) Output data processing: Convert the output data stream returned by the "key calculation module" into a new format.

[0057] Parse the required key data and then assemble the encrypted output data according to different business types.

[0058] The server also performs data protocol conversion on the logical business processing data again, converts it according to the communication protocol of the encryption device, and finally forms a business request command that can be recognized by the encryption device, that is, a key calculation command.

[0059] 3) The encryption device receives the key calculation command, performs key calculation, and returns the key to the server.

[0060] 4) The server receives the key and sends the key to the terminal.

[0061] The key calculation command that the encryption device can recognize is sent to the encryption device for key calculation, and the key value and ciphertext result are returned to the terminal step by step. If it fails, an error code is returned.

[0062] 5) The terminal receives the key and writes the key into the card to be encrypted, completing the card encryption.

[0063] After receiving the key return data from the server, the terminal sends a card write encryption instruction to the card reader / writer device, which includes the key data of the card; the card reader / writer device and the card interact through the card encryption instruction, and write multiple card key data one by one. If the instruction execution fails, an error code is directly returned; otherwise, after all the instructions are executed successfully, a card encryption success mark is returned, and the results are returned to the display device of the terminal step by step for display in the display interface. At this point, the encryption process of the card is completed.

[0064] The card reading and writing device in this embodiment is a smart card reading and writing device, such as a smart reader / writer, a card issuer, a batch card issuer, etc.

[0065] In this embodiment, the above-mentioned cards that can perform encryption operations are not limited to CPU cards, M1 cards, ID cards, photoelectric cards, SAM cards, key master cards and other card types.

[0066] Cloud card encryption method embodiment:

[0067] This embodiment also provides a cloud card encryption method, including the following steps:

[0068] 1) The terminal reads the card information through the card reader and initiates a card transaction encryption request to the server, wherein the card transaction encryption request includes the card identity information;

[0069] 2) The server receives the card transaction encryption request, generates a key calculation command, and sends the key calculation command to the encryption device;

[0070] 3) The encryption device receives the key calculation command, performs key calculation, and returns the key to the server;

[0071] 4) The server receives the key and sends the key to the terminal;

[0072] 5) The terminal receives the key and writes the key into the card to be encrypted through the card writing device to complete the card encryption.

[0073] The specific implementation process of the above steps has been described in detail in the above cloud card encryption system embodiment, so it will not be repeated here.

[0074] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. The patent protection scope of the present invention shall be based on the claims. All equivalent structural changes made using the contents of the description and drawings of the present invention should also be included in the protection scope of the present invention.

Claims

1. A cloud card encryption method, characterized in that: The steps include: 1) The terminal reads the card information through the card reader and initiates a card transaction encryption request to the server, wherein the card transaction encryption request includes the card identity information; 2) The server receives the card transaction encryption request, generates a key calculation command, and sends the key calculation command to the encryption device; the server performs process branch control management on the request data according to the request type and business type of the received card transaction encryption request, and performs branch diversion processing: 3) The encryption device receives the key calculation command, performs key calculation, and returns the key to the server; 4) The server receives the key and sends the key to the terminal; 5) The terminal receives the key and writes the key into the card to be encrypted through the card writing device to complete the card encryption.

2. The cloud card encryption method according to claim 1, characterized in that: In the step 1), the card identity information includes a card serial number and a transaction random number.

3. The cloud card encryption method according to claim 1, characterized in that: The step 2) also includes: when the server receives the card transaction encryption request, it verifies the legitimacy of the parameter information and the authorization information.

4. The cloud card encryption method according to claim 1, characterized in that: The step 2) also includes: the server converts the communication protocol according to the type of the encryption machine to obtain a key calculation command that can be recognized by the encryption machine.

5. A cloud card encryption system, characterized in that: The system comprises a terminal, a server and an encryption device, wherein the terminal comprises a card reader and a card writer, wherein the terminal interacts with the server, and the server interacts with the encryption device to implement the following steps: 1) The terminal reads the card information through the card reader and initiates a card transaction encryption request to the server, wherein the card transaction encryption request includes the card identity information; 2) The server receives the card transaction encryption request, generates a key calculation command, and sends the key calculation command to the encryption device; the server performs process branch control management on the request data according to the request type and business type of the received card transaction encryption request, and performs branch diversion processing: 3) The encryption device receives the key calculation command, performs key calculation, and returns the key to the server; 4) The server receives the key and sends the key to the terminal; 5) The terminal receives the key and writes the key into the card to be encrypted through the card writing device to complete the card encryption.

6. The cloud card encryption system according to claim 5, characterized in that: In the step 1), the card identity information includes a card serial number and a transaction random number.

7. The cloud card encryption system according to claim 5, characterized in that: The step 2) also includes: when the server receives the card transaction encryption request, it verifies the legitimacy of the parameter information and the authorization information.

8. The cloud card encryption system according to claim 5, characterized in that: The step 2) also includes: the server converts the communication protocol according to the type of the encryption machine to obtain a key calculation command that can be recognized by the encryption machine.

Images