Credit card validity period data transmission and processing encryption method and system

Abstract

The present invention relates to the field of automatic program design and information verification technology, and specifically to a credit card validity period data transmission processing encryption method and system, including setting a data use point and assigning a unique security number, using the security number to establish a data transmission relationship and assigning a point-to-point encryption and decryption key and a local symmetric encryption and decryption key to perform encryption and decryption operations on the credit card validity period data, combining point-to-point encryption and local symmetric encryption to achieve the encryption requirements of each working node in the data transmission and processing process of the credit card validity period data, and can achieve rapid security management without affecting the existing business, and meet the security specifications.

Description

Technical Field

[0001] The present invention relates to the field of automatic program design and information verification technology, and in particular to a credit card validity period data transmission processing encryption method and system. Background Art

[0002] The People's Bank of China has added a new bank card validity period to the C3 field defined in the "Personal Financial Information Protection Security Specification". Since there was no bank card validity period in the C3 field in the previous specification, when implementing the credit card system, the credit card validity period type field is processed as a normal business field, and is processed in plain text in customer channels, employee channels, data lines, transaction links, file exchanges and other applications and links without any special processing. The existing credit card system processes the credit card validity period as normal business data, and both the transmission layer and the storage layer use plain text processing, which does not meet the existing security compliance specifications. Summary of the invention

[0003] In order to address the deficiencies of the prior art, the present invention proposes a credit card validity period data transmission and processing encryption method and system, which combines point-to-point encryption and local symmetric encryption to achieve the encryption requirements of each working node during the data transmission and processing of the credit card validity period data, and can achieve rapid and secure management without affecting existing business, and meet security specifications.

[0004] To achieve the above objectives, the technical solutions adopted by the present invention include:

[0005] A credit card validity period data transmission and processing encryption method, characterized by comprising:

[0006] S1. According to the usage requests of all credit card validity period data, data usage points are set respectively;

[0007] S2. Assign a unique security number to each data usage point; the security number is associated with the corresponding data usage point;

[0008] S3. According to the effective transmission path of the credit card validity period data, respectively set the data transmission relationship between each data usage point; the data transmission relationship includes an ordered combination of security numbers;

[0009] S4. Allocate independent point-to-point encryption and decryption keys for each data transmission relationship;

[0010] S5, using the point-to-point encryption and decryption key to encrypt and decrypt the credit card validity period data during the transmission process between the data usage points;

[0011] S6. Allocate a unique local symmetric encryption and decryption key to each data usage point; the local symmetric encryption and decryption key is associated with the security number corresponding to the data usage point;

[0012] S7. Use the local symmetric encryption and decryption key to encrypt and decrypt the credit card validity period data when it is used internally at each data usage point.

[0013] Furthermore, the data usage points include a client terminal, a bank staff terminal, an external data terminal, a credit card core terminal, a data storage terminal and a credit card security terminal.

[0014] Furthermore, the security number includes at least an independent data usage point identification bit, a security level identification bit and a transmission path identification bit.

[0015] Furthermore, the step S3 includes the following sub-steps:

[0016] S31, obtaining the expected transmission path of credit card validity period data;

[0017] S32, identifying a data usage point corresponding to a data transmission starting point and a data usage point corresponding to a data transmission end point included in the expected transmission path;

[0018] S33, verify whether the transmission path identification bits of the security numbers of the data usage points corresponding to the data transmission starting point and the data transmission end point match;

[0019] S34, when the transmission path identification bit is verified to match, a data transmission relationship is established according to the security numbers corresponding to the order of the data transmission starting point and the data transmission end point;

[0020] S35. When the transmission path identification bit is verified to be mismatched, the establishment of the data transmission relationship is refused and an error message is fed back.

[0021] Furthermore, the step S4 includes the following sub-steps:

[0022] S41, verify whether the security level identification bits of the data usage point security numbers corresponding to the data transmission starting point and the data transmission end point match;

[0023] S42, when the security level identification bits are verified to match, point-to-point encryption and decryption keys are allocated according to the security level identification bits;

[0024] S43. When the security level identification bits are verified to be mismatched, point-to-point encryption and decryption keys are allocated according to the security level identification bits with a higher security level at the data transmission starting point and the data transmission end point.

[0025] Furthermore, the step S6 comprises the following sub-steps:

[0026] S61, verify the security level identification bit of the data usage point security number;

[0027] S62. Allocate local symmetric encryption and decryption keys according to the security level identification bit.

[0028] Furthermore, the step S7 includes the following sub-steps:

[0029] S71, verify whether the security level identification bit corresponding to the point-to-point encryption and decryption key used to receive the credit card validity period data matches the security level identification bit corresponding to the local symmetric encryption and decryption key;

[0030] S72. When the verification matches, the local symmetric encryption and decryption key is used to encrypt and decrypt the credit card validity period data when it is used internally at each data usage point;

[0031] S73. When the verification does not match, that is, the security level of the security level identification bit corresponding to the point-to-point encryption and decryption key is higher than the security level identification bit corresponding to the local symmetric encryption and decryption key, the encryption and decryption operations are rejected and an error message is fed back.

[0032] The present invention also relates to a credit card validity period data transmission and processing encryption system, which is characterized by comprising:

[0033] A security number management module is used to assign a unique security number to each data usage point;

[0034] Point-to-point encryption and decryption service module, used to set up data transmission relationships between various data usage points and allocate independent point-to-point encryption and decryption keys for each data transmission relationship;

[0035] The local symmetric encryption and decryption service module is used to allocate a unique local symmetric encryption and decryption key to each data usage point.

[0036] The present invention also relates to a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and the computer program implements the above method when executed by a processor.

[0037] The present invention also relates to an electronic device, characterized in that it comprises a processor and a memory;

[0038] The memory is used to store point-to-point encryption and decryption keys and local symmetric encryption and decryption keys;

[0039] The processor is used to execute the above method by calling the point-to-point encryption and decryption key and the local symmetric encryption and decryption key.

[0040] The beneficial effects of the present invention are:

[0041] The credit card validity period data transmission and processing encryption method and system of the present invention combine point-to-point encryption and local symmetric encryption to realize the encryption requirements of each working node in the data transmission and processing process of the credit card validity period data, and can achieve rapid and safe management without affecting the existing business, and meet the security specifications. The point-to-point encryption and decryption operation of the credit card validity period field ensures that the encryption of the transaction message field is traceable, and the components of the decryption field have decryption authority; through the local symmetric encryption service, an independent and secure symmetric encryption key is allocated to each data usage point, and the key is obtained and stored in the memory, which is responsible for the encryption and decryption of the fields within the application. The key released to the system by the local symmetric key service can only be used within the system, and cannot be used by external systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flow chart of the encryption method for credit card validity period data transmission and processing according to the present invention.

[0043] Figure 2 This is a schematic diagram of the structure of the credit card validity period data transmission and processing encryption system of the present invention. DETAILED DESCRIPTION

[0044] In order to more clearly understand the content of the present invention, it will be described in detail with reference to the drawings and embodiments.

[0045] The first aspect of the present invention relates to a process of steps as follows Figure 1 The credit card validity period data transmission and processing encryption method shown includes:

[0046] S1. Data usage points are set according to all credit card validity period data usage requests. The optional data usage points include the client, bank staff, external data, credit card core, data storage, and credit card security, all systems and user terminals that use credit card validity period data. In this step, the differences between the data usage points, especially the differences in security permissions during verification, are not specifically defined, but only provide the necessary basis for subsequent steps.

[0047] S2. Allocate a unique security number to each data usage point; the security number is associated with the corresponding data usage point, and at least includes an independent data usage point identification bit, a security level identification bit, and a transmission path identification bit. For a data usage point, an additionally configured security number is used to define its properties, wherein the data usage point identification bit uniquely corresponds to the data usage point; the security level identification bit defines the highest security level possessed by the data usage point, and the security levels of different data usage points can be compared through the security level identification bit; the transmission path identification bit is a statistical set type of identification, which is used to describe the path set to which the data usage point belongs. For multiple data usage points belonging to the same path set (with the same transmission path identification bit), a path for transmitting credit card validity period data can be established.

[0048] S3. According to the preset effective transmission path of the credit card validity period data, the data transmission relationship between each data usage point is set respectively, and the data transmission relationship includes an ordered combination of security numbers. Specifically, it can be achieved through the following steps: S31, obtaining the expected transmission path of the credit card validity period data, for example, obtaining the functional systems (data use points) involved in the use process and the required data flow order from the use request of the credit card validity period data; S32, identifying the data use point corresponding to the data transmission starting point and the data use point corresponding to the data transmission end point contained in the expected transmission path, that is, clarifying the data use point involved in the expected transmission path, so as to obtain the corresponding security number; S33, verifying whether the security number transmission path identification bits of the data use point corresponding to the data transmission starting point and the data transmission end point match, that is, verifying whether the security number transmission path identification bits of the data use point corresponding to the data transmission starting point and the data transmission end point are consistent, and whether the two belong to the same path set; S34, when the transmission path identification bits are verified to match, that is, it is verified that the expected path is a valid path, and the corresponding security numbers are combined in order of the data transmission starting point and the data transmission end point to establish a data transmission relationship, for example, the two security numbers can be directly combined in the order of the starting point first and the end point to form the specific data transmission relationship; S35, when the transmission path identification bits are verified to be mismatched, refusing to establish the data transmission relationship and feeding back an error message. It should be noted that for the same two data usage points, the direction of credit card validity period data transmission needs to be taken into consideration, that is, data transmission from data usage point A to data usage point B and data transmission from data usage point B to data usage point A are two different paths, and the data transmission relationship between the data usage points needs to be set separately.

[0049] S4. Allocate independent point-to-point encryption and decryption keys for each data transmission relationship, specifically including: S41. Verify whether the security level identification bits of the data usage point security numbers corresponding to the data transmission starting point and the data transmission end point match, that is, compare whether the security levels represented by the security level identification bits of the data usage point security numbers corresponding to the data transmission starting point and the data transmission end point are the same, and verify whether the two data uses can provide an equal security level when using the credit card validity period data; S42. When the security level identification bits are verified to match, allocate point-to-point encryption and decryption keys based on the security level identification bits. For example, when the security levels of the two data usage points are verified to be consistent, it means that the credit card validity period data can be transmitted between the two without causing leakage; S43. When the security level identification bits are verified to be mismatched, allocate point-to-point encryption and decryption keys based on the security level identification bits with a higher security level in the data transmission starting point and the data transmission end point. At this time, since the security levels of the two data usage points are different, especially it is uncertain whether the credit card validity period data can be transmitted risk-free at the data usage point with a low security level, the point-to-point encryption and decryption keys are allocated according to the data usage point with a higher security level to ensure that the higher security level requirements are met.

[0050] S5. Use the point-to-point encryption and decryption key to encrypt and decrypt the credit card validity period data during the transmission process between the data usage points. The point-to-point encryption and decryption key allocated at this time can meet the security level requirements during the transmission process, so the allocated point-to-point encryption and decryption key can be processed and used without worrying about security risks caused by data transmission.

[0051] S6. Verify the security level identification bit of the data usage point security number, and assign a unique local symmetric encryption and decryption key to each data usage point based on the security level identification bit. The local symmetric encryption and decryption key is associated with the security number corresponding to the data usage point. The local symmetric encryption and decryption key is used for the encryption and decryption needs of the local functional system (data usage point) when using the credit card validity period data. It is assigned to different data usage points based on their security levels to ensure that the local symmetric encryption and decryption key can meet the security level requirements of the data usage point.

[0052] S7, using the local symmetric encryption and decryption key to perform encryption and decryption operations on the credit card validity period data when it is used internally at each data usage point. In particular, in combination with the transmission process of the credit card validity period data, the following can be performed: S71, verifying whether the security level identification bit corresponding to the point-to-point encryption and decryption key used to receive the credit card validity period data matches the security level identification bit corresponding to the local symmetric encryption and decryption key, that is, verifying whether the credit card validity period data received after the transmission process can truly match the available security level of the data usage point, and further ensuring the security of the use of the credit card validity period data through this additional verification; S72, when the verification matches, using the local symmetric encryption and decryption key to perform encryption and decryption operations on the credit card validity period data when it is used internally at each data usage point; S73, when the verification does not match, that is, the security level of the security level identification bit corresponding to the point-to-point encryption and decryption key (from the verification results of step S4 and related sub-steps) is higher than the security level identification bit corresponding to the local symmetric encryption and decryption key, at this time, regardless of the specific reason for this situation, it is directly determined that the data usage point does not have the security level authority to use the credit card validity period data, and the encryption and decryption operations are refused and an error message is fed back.

[0053] Through the above method, combined with the point-to-point encryption and decryption methods and local symmetric encryption and decryption methods, it is possible to fully verify and protect the credit card expiration date data, and avoid functional modules (data usage points) with insufficient security level permissions from erroneously using high-security level credit card expiration date data.

[0054] Another aspect of the present invention relates to a credit card validity period data transmission and processing encryption system, the structure of which is as follows: Figure 2 As shown, including:

[0055] A security number management module is used to assign a unique security number to each data usage point;

[0056] Point-to-point encryption and decryption service module, used to set up data transmission relationships between various data usage points and allocate independent point-to-point encryption and decryption keys for each data transmission relationship;

[0057] The local symmetric encryption and decryption service module is used to allocate a unique local symmetric encryption and decryption key to each data usage point.

[0058] By using this system, the above-mentioned operation processing method can be executed and the corresponding technical effects can be achieved.

[0059] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the method in the above embodiment, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the method in the above embodiment are implemented.

[0060] An embodiment of the present invention also provides an electronic device for executing the above method. As an implementation device of the method, the electronic device has at least a processor and a memory, and in particular, the memory stores data and related computer programs required for executing the method, such as point-to-point encryption and decryption keys and local symmetric encryption and decryption keys, etc., and the processor calls the data and programs in the memory to execute all the steps of the implementation method and obtains the corresponding technical effect.

[0061] Preferably, the electronic device may include a bus architecture, the bus may include any number of interconnected buses and bridges, and the bus will include various circuits linked together by one or more processors and memories. The bus may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are all well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter may be the same component, i.e., a transceiver, providing a unit for communicating with various other systems over a transmission medium. The processor is responsible for managing the bus and general processing, while the memory may be used to store data used by the processor when performing operations.

[0062] In addition, the electronic device may further include components such as a communication module, an input unit, an audio processor, a display, and a power supply. The processor (or controller, operation control) used may include a microprocessor or other processor device and / or a logic device, which receives input and controls the operation of various components of the electronic device; the memory may be one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory, or other suitable devices, which may store the above-mentioned related data information, and may also store a program for executing related information, and the processor may execute the program stored in the memory to realize information storage or processing, etc.; the input unit is used to provide input to the processor, for example, it may be a key or a touch input device; the power supply is used to provide power to the electronic device; the display is used to display display objects such as images and text, for example, it may be an LCD display. The communication module is a transmitter / receiver that sends and receives signals via an antenna. The communication module (transmitter / receiver) is coupled to the processor to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal. Based on different communication technologies, multiple communication modules may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module (transmitter / receiver) is also coupled to a speaker and a microphone via an audio processor to provide an audio output via the speaker and receive an audio input from the microphone, thereby realizing a common telecommunication function. The audio processor may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor is also coupled to a central processor, so that recording can be performed on the machine through the microphone, and the sound stored on the machine can be played through the speaker.

[0063] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0064] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0065] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0066] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0067] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A credit card validity period data transmission and processing encryption method, characterized in that: include: S1. According to the usage requests of all credit card validity period data, data usage points are set respectively; S2. Assign a unique security number to each data usage point; the security number is associated with the corresponding data usage point; S3. According to the effective transmission path of the credit card validity period data, respectively set the data transmission relationship between each data usage point; the data transmission relationship includes an ordered combination of security numbers; S4. Allocate independent point-to-point encryption and decryption keys for each data transmission relationship; S5, using the point-to-point encryption and decryption key to encrypt and decrypt the credit card validity period data during the transmission process between the data usage points; S6. Allocate a unique local symmetric encryption and decryption key to each data usage point; the local symmetric encryption and decryption key is associated with the security number corresponding to the data usage point; S7, using the local symmetric encryption and decryption key to encrypt and decrypt the credit card validity period data when it is used internally at each data usage point; In step S7, in conjunction with the transmission process of the credit card validity period data, the following is performed: S71, verify whether the security level identification bit corresponding to the point-to-point encryption and decryption key used to receive the credit card validity period data matches the security level identification bit corresponding to the local symmetric encryption and decryption key; S72. When the verification matches, the local symmetric encryption and decryption key is used to encrypt and decrypt the credit card validity period data when it is used internally at each data usage point; S73. When the verification does not match, that is, the security level of the security level identification bit corresponding to the point-to-point encryption and decryption key is higher than the security level identification bit corresponding to the local symmetric encryption and decryption key, the encryption and decryption operations are rejected and an error message is fed back.

2. The method according to claim 1, characterized in that The data usage points include the client side, the bank staff side, the external data side, the credit card core side, the data storage side and the credit card security side.

3. The method according to claim 1, characterized in that The security number at least includes an independent data usage point identification bit, a security level identification bit and a transmission path identification bit.

4. The method according to claim 3, characterized in that The step S3 comprises the following sub-steps: S31, obtaining the expected transmission path of credit card validity period data; S32, identifying a data usage point corresponding to a data transmission starting point and a data usage point corresponding to a data transmission end point included in the expected transmission path; S33, verify whether the transmission path identification bits of the security numbers of the data usage points corresponding to the data transmission starting point and the data transmission end point match; S34, when the transmission path identification bit is verified to match, a data transmission relationship is established according to the security numbers corresponding to the order of the data transmission starting point and the data transmission end point; S35. When the transmission path identification bit is verified to be mismatched, the establishment of the data transmission relationship is refused and an error message is fed back.

5. The method according to claim 4, characterized in that The step S4 comprises the following sub-steps: S41, verify whether the security level identification bits of the data usage point security numbers corresponding to the data transmission starting point and the data transmission end point match; S42, when the security level identification bits are verified to match, point-to-point encryption and decryption keys are allocated according to the security level identification bits; S43. When the security level identification bits are verified to be mismatched, point-to-point encryption and decryption keys are allocated according to the security level identification bits with a higher security level at the data transmission starting point and the data transmission end point.

6. The method according to claim 5, characterized in that The step S6 comprises the following sub-steps: S61, verify the security level identification bit of the data usage point security number; S62. Allocate local symmetric encryption and decryption keys according to the security level identification bit.

7. A credit card validity period data transmission and processing encryption system, characterized in that: include: A security number management module is used to assign a unique security number to each data usage point; Point-to-point encryption and decryption service module, used to set up data transmission relationships between various data usage points and allocate independent point-to-point encryption and decryption keys for each data transmission relationship; The local symmetric encryption and decryption service module is used to allocate a unique local symmetric encryption and decryption key to each data usage point; Execute the method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store point-to-point encryption and decryption keys and local symmetric encryption and decryption keys; The processor is used to execute the method according to any one of claims 1 to 6 by calling a point-to-point encryption and decryption key and a local symmetric encryption and decryption key.

Images