Multiple transaction system key synchronization method and system

Abstract

The present invention discloses a method and system for synchronizing keys of multiple transaction systems, which can be used in the field of big data resource scheduling technology. The method includes: a cooperative institution device receives a newly created key pair and newly created key pair attribute values sent by a branch, sends a key replacement request to each transaction system, so that each transaction system sends a push key request to the acquiring business management system after receiving the request, receives the newly created key pair returned by the acquiring business management system, and returns a key replacement success message; after receiving the key replacement success message returned by all transaction systems, sends a key deletion request to each transaction system, so that each transaction system deletes the old key pair after receiving the request and returns a key deletion success message; after receiving the key deletion success message returned by all transaction systems, uses the newly created key pair to sign all transactions. The present invention can ensure that cooperative institutions can safely replace keys while maintaining uninterrupted transaction business, thereby improving customer experience.

Description

Technical Field

[0001] The present invention relates to the technical field of big data resource scheduling, and in particular to a method and system for synchronizing keys of multiple transaction systems. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention that are recited in the claims. No statement herein is admitted to be prior art by virtue of its inclusion in this section.

[0003] When the information systems of two institutions or organizations need to communicate with each other, they typically sign and verify transaction messages to ensure the accuracy and security of the information exchange. Signing and verification require both parties to agree on a key before the transaction. In the past, passwords and keys were exchanged offline, typically by recording the key in an envelope, CD, or USB drive and handing it over in person. Now, with improved online security measures, advances in encryption technology, and the emergence of standardized encryption algorithms, keys can be exchanged online. This means that organizations A and B can exchange and update passwords and keys online. In shared bank acquiring services, banks, acting as acquiring agents, are required to provide online application submission interfaces, merchant information query interfaces, and various online transaction interfaces to their acquiring institutions or non-acquirers (collectively referred to as partner institutions). In addition to banks, WeChat and Alipay also offer this agent acquiring service. However, unlike bank information systems, WeChat and Alipay's information systems utilize a unified transaction gateway that uses the standard RSA encryption algorithm. They also provide partner institutions with a page for setting and updating transaction keys online. When a partner organization needs to set or update the signature verification key, it only needs to use any machine that can generate an RSA key pair. After generating the key, it can log in to the WeChat and Alipay systems and send the public key to WeChat and Alipay to complete the real-time setting or update of the key.

[0004] The methods used by WeChat and Alipay are not suitable for some banking systems for two main reasons: 1. Banks use their own proprietary encryption algorithms and do not use the publicly available RSA encryption algorithm. This black-box encryption algorithm can improve the security of banking information systems. However, it also requires that communication keys be generated by the bank's information system. 2. Due to historical reasons, some banks do not provide a unified interface gateway. This means that when various transaction subsystems jointly provide services to partner institutions, each transaction needs to be encrypted, decrypted, and signed separately. This creates the problem of synchronized key switching between subsystems. Failure to synchronize key switching is extremely dangerous and may cause some transactions at partner institutions to fail, impacting the customer experience. The impact is even greater for chain merchants with high transaction volumes, potentially leading to longer waiting times for customers.

[0005] Therefore, there is an urgent need for a key synchronization solution for multiple transaction systems that can overcome the above problems. Summary of the Invention

[0006] An embodiment of the present invention provides a method for synchronizing keys of multiple transaction systems, which is used to synchronize keys of multiple transaction systems, ensure that partner institutions can safely replace keys while maintaining transaction services, and improve customer experience. The method includes:

[0007] The cooperative institution device receives the newly created key pair and newly created key pair attribute value sent by the branch;

[0008] The cooperative institution device sends a key replacement request to each transaction system. After receiving the key replacement request, each transaction system sends a push key request to the acquiring business management system, receives the newly created key pair returned by the acquiring business management system according to the push key request, and returns a key replacement success message;

[0009] After receiving the key replacement success information returned by all transaction systems, the cooperative institution device sends a key deletion request to each transaction system, so that each transaction system deletes the old key pair according to the key deletion request and returns a key deletion success information after receiving it;

[0010] After receiving the key deletion success information returned by all transaction systems, the cooperative institution device uses the newly created key pair to sign all transactions.

[0011] An embodiment of the present invention provides a cooperative institution device for synchronizing keys of multiple transaction systems. The device is used to synchronize keys of multiple transaction systems, ensuring that cooperative institutions can securely replace keys while maintaining uninterrupted transaction services, thereby improving customer experience. The cooperative institution device includes:

[0012] A key pair receiving module is used to receive the newly created key pair and the newly created key pair attribute value sent by the branch;

[0013] a replacement request sending module, configured to send a key replacement request to each transaction system, wherein each transaction system, upon receiving the key replacement request, sends a push key request to the acquiring business management system, receives a newly created key pair returned by the acquiring business management system in response to the push key request, and returns a key replacement success message;

[0014] a deletion request sending module, configured to send a key deletion request to each trading system after receiving key replacement success information returned by all trading systems, wherein each trading system deletes the old key pair according to the key deletion request and returns a key deletion success information after receiving the key deletion request;

[0015] The transaction signing module is used to sign all transactions with the newly created key pair after receiving the key deletion success information returned by all transaction systems.

[0016] An embodiment of the present invention further provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for synchronizing keys of multiple transaction systems when executing the computer program.

[0017] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned method for synchronizing keys of multiple transaction systems.

[0018] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the above-mentioned method for synchronizing keys of multiple transaction systems.

[0019] In an embodiment of the present invention, a cooperative institution device receives a newly created key pair and newly created key pair attribute values sent by a branch through a cooperative institution device; the cooperative institution device sends a key replacement request to each transaction system. Upon receiving the key replacement request, each transaction system sends a push key request to the acquiring business management system, receives the newly created key pair returned by the acquiring business management system based on the push key request, and returns a key replacement success message; upon receiving the key replacement success messages returned by all transaction systems, the cooperative institution device sends a key deletion request to each transaction system. Upon receiving the key deletion success messages returned by all transaction systems, the cooperative institution device deletes the old key pair based on the key deletion request and returns a key deletion success message; upon receiving the key deletion success messages returned by all transaction systems, the cooperative institution device uses the newly created key pair to sign all transactions. In an embodiment of the present invention, the cooperative institution device sends a key replacement request to each transaction system, receives the key replacement success messages returned by all transaction systems, sends a key deletion request to each transaction system, and then, upon receiving the key deletion success messages returned by all transaction systems, uses the newly created key pair to sign all transactions. This allows for key synchronization across multiple transaction systems, ensuring that cooperative institutions can safely replace keys while maintaining uninterrupted transaction services, thereby improving customer experience.

[0020] An embodiment of the present invention provides a method for synchronizing keys of multiple transaction systems, which is used to synchronize keys of multiple transaction systems, ensure that partner institutions can safely replace keys while maintaining transaction services, and improve customer experience. The method includes:

[0021] After receiving the key replacement request, the transaction system sends a push key request to the acquiring business management system, wherein the key replacement request is sent by the cooperative institution device to each transaction system after receiving the new key pair and the new key pair attribute value sent by the branch;

[0022] The transaction system receives the newly created key pair returned by the acquiring business management system according to the push key request;

[0023] The transaction system returns the key replacement success information to the cooperative institution device;

[0024] After receiving the key deletion request, the transaction system deletes the old key pair according to the key deletion request and returns the key deletion success information to the cooperative organization device, wherein the key deletion request is sent by the cooperative organization device to each transaction system after receiving the key replacement success information returned by all transaction systems.

[0025] An embodiment of the present invention provides a trading system for synchronizing keys of multiple trading systems. The system is used to synchronize keys of multiple trading systems, ensuring that partner institutions can securely replace keys while maintaining uninterrupted trading operations, thereby improving customer experience. The trading system includes:

[0026] a push request sending module, configured to send a push key request to the acquiring business management system after receiving a key replacement request, wherein the key replacement request is sent by the cooperative institution device to each transaction system after receiving the new key pair and the new key pair attribute value sent by the branch;

[0027] A newly created key pair receiving module, configured to receive the newly created key pair returned by the acquiring business management system in response to the push key request;

[0028] A replacement success information return module is used to return the key replacement success information to the cooperative organization device;

[0029] The old key pair deletion module is used to delete the old key pair according to the key deletion request after receiving it, and return the key deletion success information to the cooperative organization device, wherein the key deletion request is sent by the cooperative organization device to each transaction system after receiving the key replacement success information returned by all transaction systems.

[0030] An embodiment of the present invention further provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for synchronizing keys of multiple transaction systems when executing the computer program.

[0031] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned method for synchronizing keys of multiple transaction systems.

[0032] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the above-mentioned method for synchronizing keys of multiple transaction systems.

[0033] In an embodiment of the present invention, after receiving a key replacement request, the transaction system sends a push key request to the acquiring business management system, wherein the key replacement request is sent by the cooperative institution device to each transaction system after receiving the newly created key pair and the newly created key pair attribute value sent by the branch; the transaction system receives the newly created key pair returned by the acquiring business management system according to the push key request; the transaction system returns a key replacement success message to the cooperative institution device; after receiving a key deletion request, the transaction system deletes the old key pair according to the key deletion request and returns a key deletion success message to the cooperative institution device, wherein the key deletion request is sent by the cooperative institution device to each transaction system after receiving the key replacement success message returned by all transaction systems. In the embodiment of the present invention, after receiving a key replacement request, the transaction system sends a push key request to the acquiring business management system, receives the newly created key pair returned by the acquiring business management system based on the push key request, and returns key replacement success information to the cooperative institution device. Then, after receiving a key deletion request, the transaction system deletes the old key pair based on the cooperative institution device identifier and the old key pair attribute value, and returns key deletion success information to the cooperative institution device, thereby achieving key synchronization of multiple transaction systems, ensuring that the cooperative institution can safely replace keys while keeping the transaction business uninterrupted, and improving customer experience.

[0034] An embodiment of the present invention provides a multiple transaction system key synchronization system for synchronizing multiple transaction system keys, ensuring that cooperative institutions can safely replace keys while maintaining uninterrupted transaction operations, thereby improving customer experience. The system includes: an acquiring business management system, a cooperative institution device, and multiple transaction systems, wherein the acquiring business management system is used to generate a new key pair and new key pair attribute values after receiving a key pair generation request from a branch, and after receiving a push key request, determine and return the new key pair corresponding to the push key request. The cooperative institution device includes the above-mentioned multiple transaction system key synchronization cooperative institution devices, and the transaction system includes the above-mentioned multiple transaction system key synchronization transaction systems. In this embodiment of the present invention, the cooperative institution device sends a key replacement request to each transaction system. After receiving the key replacement request, the transaction system sends a push key request to the acquiring business management system, receives the new key pair returned by the acquiring business management system based on the push key request, and returns a key replacement success message to the cooperative institution device. After receiving the key replacement success information returned by all transaction systems, a key deletion request is sent to each transaction system. After receiving the key deletion request, the transaction system deletes the old key pair according to the key deletion request and returns the key deletion success information to the cooperative institution device. Then, after receiving the key deletion success information returned by all transaction systems, the cooperative institution device uses the newly created key pair to sign all transactions.

[0035] The embodiments of the present invention can effectively prevent the failure of some transactions of cooperative institutions and the impact on customer experience. For chain merchants with relatively large transaction volumes, it can avoid the problem of prolonged waiting time for customers. It solves the problem of synchronous or asynchronous key replacement between several subsystems within the bank, and can achieve key synchronization of multiple transaction systems, ensuring that cooperative institutions can safely replace keys while keeping transaction business uninterrupted, thereby improving customer experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0037] Figure 1 Schematic diagram of a method for synchronizing keys of multiple transaction systems according to an embodiment of the present invention;

[0038] Figure 2 Schematic diagram of another method for synchronizing keys of multiple transaction systems according to an embodiment of the present invention;

[0039] Figure 3Schematic diagram of another method for synchronizing keys of multiple transaction systems according to an embodiment of the present invention;

[0040] Figures 4 to 6 A schematic diagram of synchronous or asynchronous key replacement between several subsystems within an existing bank;

[0041] Figures 7 to 10 A schematic diagram of key synchronization of multiple transaction systems in a specific embodiment of the present invention;

[0042] Figure 11 This is a diagram showing the structure of a cooperative organization device for synchronizing keys of multiple transaction systems in an embodiment of the present invention;

[0043] Figure 12 A diagram showing the structure of a trading system for synchronizing keys of multiple trading systems in an embodiment of the present invention;

[0044] Figure 13 4 is a structural diagram of a key synchronization system for multiple transaction systems in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention. The acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations.

[0046] In order to synchronize the keys of multiple trading systems, ensure that cooperative institutions can replace keys safely without interrupting their trading business, and improve customer experience, the embodiment of the present invention provides a method for synchronizing the keys of multiple trading systems, such as Figure 1 As shown, the method may include:

[0047] Step 101: The cooperative institution device receives the newly created key pair and newly created key pair attribute value sent by the branch;

[0048] Step 102: The partner organization device sends a key replacement request to each transaction system. Upon receiving the key replacement request, each transaction system sends a push key request to the acquiring business management system, receives the newly created key pair returned by the acquiring business management system in response to the push key request, and returns a key replacement success message.

[0049] Step 103: After receiving the key replacement success information returned by all transaction systems, the cooperative institution device sends a key deletion request to each transaction system. The key deletion request causes each transaction system to delete the old key pair according to the key deletion request and return a key deletion success information.

[0050] Step 104: After receiving the key deletion success information returned by all transaction systems, the cooperative institution device uses the newly created key pair to sign all transactions.

[0051] Depend on Figure 1 As shown, the embodiment of the present invention receives the newly created key pair and the newly created key pair attribute value sent by the branch through the cooperative institution device; the cooperative institution device sends a key replacement request to each transaction system, and the key replacement request enables each transaction system to send a push key request to the acquiring business management system after receiving it, and receive the newly created key pair returned by the acquiring business management system according to the push key request, and return a key replacement success message; after receiving the key replacement success message returned by all transaction systems, the cooperative institution device sends a key deletion request to each transaction system, and the key deletion request enables each transaction system to delete the old key pair according to the key deletion request after receiving it and return a key deletion success message; after receiving the key deletion success message returned by all transaction systems, the cooperative institution device uses the newly created key pair to sign all transactions. In the embodiment of the present invention, the cooperative institution device sends a key replacement request to each transaction system. After receiving the key replacement success information returned by all transaction systems, it sends a key deletion request to each transaction system. Then, after receiving the key deletion success information returned by all transaction systems, it uses the newly created key pair to sign all transactions, thereby achieving key synchronization of multiple transaction systems, ensuring that the cooperative institution can safely replace keys while keeping the transaction business uninterrupted, and improving customer experience.

[0052] In one embodiment, the key replacement request includes the cooperative organization device identification and the new key pair attribute value, the push key request includes the cooperative organization device identification and the new key pair attribute value, and the key deletion request includes the cooperative organization device identification and the old key pair attribute value.

[0053] In one embodiment, Figure 2 As shown, the multiple transaction system key synchronization method further includes:

[0054] Step 201: Before sending a key deletion request to each transaction system, the cooperative institution device sends a green light transaction to each transaction system;

[0055] Step 202: After receiving the green light transaction success information returned by all transaction systems, the cooperative institution device sends a key deletion request to each transaction system;

[0056] Step 203: When the cooperative institution device receives a green light transaction failure message returned by any transaction system, it generates a second error message.

[0057] In one embodiment, the newly created key pair attribute value includes a key pair generation date and a hash value.

[0058] In order to synchronize the keys of multiple trading systems, ensure that the cooperative institutions can replace the keys safely without interrupting the trading business, and improve the customer experience, the embodiment of the present invention provides another method for synchronizing the keys of multiple trading systems, such as Figure 3 As shown, the method may include:

[0059] Step 301: After receiving the key replacement request, the transaction system sends a push key request to the acquiring business management system. The key replacement request is sent by the partner institution device to each transaction system after receiving the new key pair and the new key pair attribute value sent by the branch.

[0060] Step 302: The transaction system receives the newly created key pair returned by the acquiring business management system in response to the key push request.

[0061] Step 303: The transaction system returns a key replacement success message to the cooperative institution device;

[0062] Step 304: After receiving the key deletion request, the transaction system deletes the old key pair according to the key deletion request and returns key deletion success information to the cooperation organization device, wherein the key deletion request is sent by the cooperation organization device to each transaction system after receiving key replacement success information returned by all transaction systems.

[0063] In one embodiment, the key replacement request includes the cooperative organization device identification and the new key pair attribute value, the push key request includes the cooperative organization device identification and the new key pair attribute value, and the key deletion request includes the cooperative organization device identification and the old key pair attribute value.

[0064] In one embodiment, the method for synchronizing keys of multiple transaction systems also includes: before the transaction system sends a push key request to the acquiring business management system, the transaction system checks the number of keys of the cooperative institution device corresponding to the cooperative institution device identifier in the transaction system; if the number of keys is a pair, a push key request is sent to the acquiring business management system; otherwise, a first error message is generated.

[0065] In one embodiment, the key synchronization method for multiple transaction systems also includes: after receiving a key deletion request, the transaction system checks the number of key pairs of the cooperative institution device corresponding to the cooperative institution device identifier in the transaction system. If the number of key pairs is greater than one pair, and the key pair generation date in the old key pair attribute value is earlier than the new key pair generation date, the old key pair is deleted and a key deletion success message is generated.

[0066] The following is a specific example illustrating the specific application of key synchronization for multiple transaction systems in the embodiments of the present invention. This invention is essentially a shared acquiring system, meaning that acquiring institutions outside of banks or non-acquirers can entrust banks to handle acquiring or collection transactions on their behalf. We collectively refer to these entrusted institutions as partner institutions. Banks provide partner institutions with multiple access channels, including online API interfaces, dedicated MIS system channels, and direct, express dedicated lines. When partner institutions access transactions through banks, they must verify the transaction signature and password. This verification verifies that the transaction is initiated by the partner institution and ensures that the transaction content cannot be viewed or tampered with by others. WeChat and Alipay also provide a similar service—API payment. Their APIs also require signature and password verification. However, the WeChat and Alipay API payment keys are generated by merchants themselves and then directly pasted on the WeChat and Alipay websites. Banks cannot do this because their signature and password verification algorithms are proprietary, not the standard RSA algorithms. Simply put, the keys must be generated by the bank itself. Furthermore, WeChat and Alipay have implemented a unified payment gateway, but banks, for historical reasons, need to maintain multiple access channels so that transactions can be managed independently according to their existing system architecture. This creates the need to synchronously or asynchronously rekey the transaction systems of these channels.

[0067] The following describes the key asynchronization problem that may occur between the transaction system and the cooperative institution when the keys are replaced synchronously or asynchronously between several subsystems within the bank in the prior art. Figures 4 to 6 As shown, Figure 4 For the existing service architecture of WeChat and Alipay, Figure 5 This is the bank's existing service architecture. When keys are first set up, the partner institution has not yet begun transactions, so there's no issue with key synchronization between the transaction system and the partner institution. However, this issue may arise at other times, when a partner institution discovers a key leak or needs to update its keys. The bank's existing transaction key generation, setup, and usage process is as follows: 1. The partner institution requests a key update. After confirmation from the relevant business personnel, the acquiring business management system generates symmetric keys P and K. 2. The relevant business personnel sends the system-generated private key P to the partner institution. The system sends the key pair P (private key) and K (public key) to transaction systems A, B, and C (or more systems) that require encryption and signature verification. 3. The partner institution uses private key P to sign the transaction, signing the transaction message as needed and sending it to transaction system A, B, or C. 4. Transaction system A, B, or C uses public key K to verify the transaction. If verification passes, further processing and a result are returned; if not, an error is reported.

[0068] Suppose a partner institution discovers that its old key is insecure or routinely replaces it according to security regulations. The partner institution's original key pair is P0 and K0. Following the key replacement steps above, assume that a new key pair P1 and K1 is generated in step 2. Transaction systems A, B, and C simultaneously replace their private key K1 with the partner institution's new public key, but the partner institution has not yet replaced its public key P1 and is still using P0 to sign transactions. This will cause all transactions sent by the partner institution to the bank to fail.

[0069] Therefore, the inventors discovered that the key update time needs to be mutually agreed upon, preferably set by the partner institution. Transaction Systems A, B, and C within the banking system must provide the partner institution with a key update transaction (or service) called ChangeKey (key change request). This transaction ensures that the transaction system will only activate the new key after receiving and verifying the request. To confirm the key pair specified by the partner institution, a hash function is used to generate a hash value for the key pair: hash(P+K). This hash value must be submitted when the ChangeKey transaction is called to confirm that the partner institution's key change request is correct.

[0070] It is not enough for both parties to change the keys at the same time at the agreed time, other problems will arise in the system. Figure 6 Schematic diagram of the situation where the key replacement for some systems fails. For example, suppose the cooperative institution currently uses the key pair (P1, K1) and needs to update to the key pair (P2, K2). After it successfully calls the ChangeKey transaction of transaction system A, it fails to call the ChangeKey transaction of transaction system B. At this time, if the cooperative institution does not switch to the new key P2, then all transactions sent to transaction system A will report an error, while transactions sent to transaction systems B and C will not report an error. This situation where some transactions report errors poses a great threat to the business continuity of the cooperative institution. Therefore, in the embodiment of the present invention, transaction system A, transaction system B and transaction system C must be able to support two sets of key pairs for the same cooperative institution at the same time. This can avoid the problem of some transaction systems failing to update keys during real-time key pair updates, which may cause errors in some transactions of the cooperative institution.

[0071] However, allowing the same partner institution to use two sets of keys simultaneously for an extended period of time presents a serious security risk: the system cannot determine whether a partner institution experienced a malfunction during key replacement or whether a system vulnerability allowed an intruder to generate a new set of keys for transactions. Therefore, the method and system described herein also prohibit multiple subsystems of the banking system from maintaining two sets of key pairs for the same partner institution for more than two days. If this period of time has not been completed, the earliest added key is retained, while later added keys are deleted, and the event is logged in the audit log.

[0072] Based on the transaction system's ability to simultaneously support the use of two sets of transaction keys by the same partner institution, this paper designs a method for smoothly switching transaction keys across multiple transaction systems. The method described in this paper stipulates that multiple subsystems of a bank should provide a key deletion transaction (service) called RemoveKey. This transaction deletes old keys, and partner institutions can invoke this transaction to remove expired keys. The parameter of this transaction is the hash value corresponding to the old key. The RemoveKey transaction should adhere to the following rules: After deletion, there must be at least one partner institution's key pair in the system, and the creation date of the remaining key must be greater than the deleted key. This rule ensures that partner institutions do not mistakenly delete all their keys, resulting in a situation where transactions cannot proceed.

[0073] To avoid excessive involvement in key distribution, this method stipulates that the acquiring business management system must provide a password-retrieval transaction, called a PullKey, to each transaction system in the bank's information system that provides services to a partner institution. The PullKey parameters are the partner institution number, the key pair creation date, and the key pair hash value. The PullKey transaction returns the private and public keys generated by the partner institution. The channel access control component must control the systems that can invoke the PullKey transaction, restricting it to only transaction systems A, B, and C. Furthermore, access to the PullKey transaction by each system must be reported to the security audit system, which can analyze PullKey transaction logs to assess the security of the request. For example, if multiple attempts to retrieve the same partner institution's key fail, it may indicate that the partner institution's key has been brute-forced.

[0074] Figures 7 to 10The following is a schematic diagram of key synchronization for multiple trading systems in a specific embodiment of the present invention. Assume that there are three trading systems requiring keys: Trading System A, Trading System B, and Trading System C. Partner A1's current key pair is (P0, K0), the key pair generation date is D0, and the key pair hash value is H0. For security reasons, partner A1 requests a key replacement from a bank branch. The key synchronization mechanism designed in this method then follows these steps:

[0075] 1. The branch creates a new key pair (P1, K1) for partner institution A1 in the acquiring business management system. The key pair is generated on D1 and has a hash value of H1.

[0076] 2. The branch sends the new key pair to partner institution A1 using traditional methods.

[0077] 3. Partner institution A1 is preparing to change its key pair. A1 first sends a ChangeKey(A1, D1, H1) request to trading system A, indicating that it is preparing to change the key of this partner institution (A1) to the H1 key pair generated on D1.

[0078] 4. After receiving the request, trading system A first checks the number of keys in system A1. If it has a pair, it sends a PullKey(A1, D1, H1) request to the acquiring business management system. After checking, the acquiring business management system finds that the key can be returned and returns the key pair (P1, K1) to trading system A.

[0079] 5. Trading system A saves the key information and the key pair attributes D1 and H1.

[0080] 6. Repeat steps 3, 4, and 5 for trading systems B and C. If a rekey error occurs on any trading system, the rekey process is terminated. After manual analysis of the cause, the request can be returned or the trading system can be processed and the rekey operation can be repeated. Continue until the ChangeKey (A1, D1, H1) requests for all three trading systems are successful.

[0081] 7. The partner institution attempts to use the key pair (P1, K1) to send a green light transaction to each system. Only when all trading systems have green light transactions can the next steps be continued. Otherwise, the key replacement process is suspended and manual analysis is required.

[0082] 8. Partner A1 is ready to delete the old key pair (P0, K0). A1 first sends a RemoveKey(A1, D0, H0) request to trading system A, indicating that it is ready to delete the old key pair (P0, K0) of this partner (A1).

[0083] 9. After receiving the request, trading system A first checks the number of keys in system A1. If the number of keys is greater than 1 and the key to be deleted is older, the key pair (P0, K0) is deleted and a success message is returned.

[0084] 10. Repeat steps 8 and 9 for trading systems B and C. If any trading system encounters a key deletion error, retry the transaction or manually delete the old key. Continue until all three trading systems have successfully deleted the old key.

[0085] 11. Partner A1 signs all transactions using the new key pair. This completes the key change process.

[0086] In this specific embodiment, Figure 9 As shown, the cooperative institution first applies to the branch for key replacement. The branch provides feedback on the key pair, hash value, and generation date. The cooperative institution initiates the institution key replacement service using the old key, sends 3. Key information: hash value and generation date to the head office, and requests the transaction system to replace the institution key. Each institution pulls the key from the key acquisition service. The cooperative institution initiates a green light test transaction with the new key and then sends a request to delete the old password. After each institution deletes the old key, it uses the new key to send encrypted transactions.

[0087] In this specific embodiment, the acquiring business management system uses key generator hardware to generate a new key pair and a new key pair attribute value; the cooperative institution device and the transaction system include encryption and decryption hardware for transmitting keys.

[0088] It should be noted that the ChangeKey request is a request to change the key, the PullKey request is a request to push the key, and the RemoveKey request is a request to delete the key.

[0089] Based on the same inventive concept, embodiments of the present invention also provide a collaborative organization device for synchronizing keys across multiple trading systems, as described in the following embodiments. Because the principles underlying these solutions are similar to those of the method for synchronizing keys across multiple trading systems, the implementation of the collaborative organization device can be referenced to the implementation of the method, and any repetitions will not be repeated.

[0090] Figure 11 FIG. 1 is a structural diagram of a cooperative institution device for synchronizing keys of multiple transaction systems in an embodiment of the present invention. Figure 11 As shown, the cooperation mechanism device includes:

[0091] The key pair receiving module 1101 is used to receive the newly created key pair and the newly created key pair attribute value sent by the branch;

[0092] A replacement request sending module 1102 is configured to send a key replacement request to each transaction system. Upon receiving the key replacement request, each transaction system sends a push key request to the acquiring business management system, receives the newly created key pair returned by the acquiring business management system in response to the push key request, and returns a key replacement success message.

[0093] A deletion request sending module 1103 is configured to send a key deletion request to each trading system after receiving key replacement success information returned by all trading systems. The key deletion request causes each trading system to delete the old key pair according to the key deletion request and return a key deletion success information.

[0094] The transaction signing module 1104 is used to sign all transactions using the newly created key pair after receiving the key deletion success information returned by all transaction systems.

[0095] Based on the same inventive concept, embodiments of the present invention also provide a trading system for synchronizing keys across multiple trading systems, as described in the following embodiments. Because the principles underlying these solutions are similar to those of the method for synchronizing keys across multiple trading systems, the implementation of the trading system can be referenced to the implementation of the method, and any repetitions will not be repeated.

[0096] Figure 12 FIG. 1 is a structural diagram of a trading system for synchronizing keys of multiple trading systems in an embodiment of the present invention. Figure 12 As shown, the trading system includes:

[0097] Push request sending module 1201, configured to send a push key request to the acquiring business management system after receiving a key replacement request, wherein the key replacement request is sent by the partner institution device to each transaction system after receiving the new key pair and the new key pair attribute value sent by the branch;

[0098] A newly created key pair receiving module 1202 is configured to receive a newly created key pair returned by the acquiring business management system in response to the push key request;

[0099] The key replacement success information return module 1203 is used to return the key replacement success information to the cooperative organization device;

[0100] The old key pair deletion module 1204 is used to delete the old key pair according to the key deletion request after receiving it, and return the key deletion success information to the cooperative organization device, wherein the key deletion request is sent by the cooperative organization device to each transaction system after receiving the key replacement success information returned by all transaction systems.

[0101] Based on the same inventive concept, embodiments of the present invention also provide a system for synchronizing multiple trading system keys, as described in the following embodiments. Since the principles for resolving these issues are similar to those of the method for synchronizing multiple trading system keys, the implementation of the system for synchronizing multiple trading system keys can be referenced to the implementation of the method, and any repetitions will not be repeated.

[0102] Figure 13 FIG. 1 is a structural diagram of a key synchronization system for multiple transaction systems according to an embodiment of the present invention. Figure 13 As shown, the multiple transaction system key synchronization system includes: an acquiring business management system, a cooperative institution device and multiple transaction systems, wherein the acquiring business management system is used to generate a new key pair and a new key pair attribute value after receiving a key pair generation request from a branch, and after receiving a push key request, determine the new key pair corresponding to the push key request and return it.

[0103] Based on the aforementioned inventive concept, an embodiment of the present invention further provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the aforementioned multiple transaction system key synchronization method when executing the computer program.

[0104] Based on the aforementioned inventive concept, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the aforementioned method for synchronizing keys of multiple transaction systems is implemented.

[0105] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the above-mentioned method for synchronizing keys of multiple transaction systems.

[0106] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0108] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0110] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for synchronizing keys of multiple transaction systems, characterized in that: include: The cooperative institution device receives the newly created key pair and newly created key pair attribute value sent by the branch; The newly created key pair and the newly created key pair attribute value are created by the branch for the cooperative institution device in the acquiring business management system; The partner institution device sends a key replacement request to each transaction system. Upon receiving the key replacement request, each transaction system checks the number of keys in its system. If it has a pair, it sends a push key request to the acquiring business management system, receives the newly created key pair returned by the acquiring business management system based on the push key request, and returns a key replacement success message. Each transaction system supports two sets of key pairs for the same partner institution device at the same time. The parameters of the push key request are the partner institution number, the generation date of the key pair, and the hash value of the key pair. The channel access control component restricts the transaction systems that call the push key request. The access status of each system to the push key request is sent to the security audit system, which analyzes the push key request log to analyze the security of the request. After receiving the key replacement success information returned by all transaction systems, the cooperative institution device sends a key deletion request to each transaction system. The key deletion request causes each transaction system to check the number of keys in the system after receiving it. If the number of keys is greater than 1 and the key requested for deletion is old, the old key pair is deleted according to the key deletion request and a key deletion success message is returned. After deletion, there is at least one key pair in the partner institution's device in the trading system, and the creation date of the remaining key is greater than the deleted key; After receiving the key deletion success message from all transaction systems, the partner institution's device will use the newly created key pair to sign all transactions; If the cooperative institution device does not receive the key replacement success information returned by all trading systems within two days, the trading system shall retain the earliest added key, delete the keys added later, and record the event in the audit log.

2. The method for synchronizing keys of multiple transaction systems according to claim 1, wherein: The key replacement request includes the cooperative organization device identification and the new key pair attribute value, the key push request includes the cooperative organization device identification and the new key pair attribute value, and the key deletion request includes the cooperative organization device identification and the old key pair attribute value.

3. The method for synchronizing keys of multiple transaction systems according to claim 2, wherein: Also includes: The cooperative institution device sends a green light transaction to each transaction system before sending a delete key request to each transaction system; After receiving the green light transaction success information returned by all transaction systems, the cooperative institution device sends a key deletion request to each transaction system; When the cooperative institution device receives the green light transaction failure information returned by any transaction system, it generates the second error message.

4. The method for synchronizing keys of multiple transaction systems according to claim 2, wherein: The newly created key pair attribute value includes the key pair generation date and the hash value.

5. A method for synchronizing keys of multiple transaction systems, characterized in that: include: After receiving the key replacement request, the transaction system checks the number of keys in the system. If there is exactly one pair, it sends a push key request to the acquiring business management system. The key replacement request is sent by the partner institution device to each transaction system after receiving the new key pair and new key pair attribute values sent by the branch; the new key pair and new key pair attribute values are established by the branch for the partner institution device in the acquiring business management system. The transaction system receives the newly created key pair returned by the acquiring business management system according to the push key request; The trading system returns a successful key replacement message to the partner institution's device. Each trading system supports two key pairs for the same partner institution's device. The parameters of the push key request are the partner institution number, the key pair generation date, and the key pair's hash value. The channel access control component restricts the trading system that can call the push key request. The access status of each system to the push key request is sent to the security audit system, which analyzes the push key request log to analyze the security of the request. After receiving the key deletion request, the transaction system checks the number of keys in the system. If the number of keys is greater than 1 and the date of the key requested for deletion is earlier, the old key pair is deleted according to the key deletion request, and the key deletion success information is returned to the cooperative institution device, wherein the key deletion request is sent by the cooperative institution device to each transaction system after receiving the key replacement success information returned by all transaction systems; after deletion, there is no less than 1 pair of keys of the cooperative institution device in the transaction system, and the creation date of the remaining keys is greater than the deleted key; if the transaction system does not return the key replacement success information to the cooperative institution device for more than two days, the transaction system retains the earliest added key, deletes the keys added later, and registers the event in the audit log.

6. The method for synchronizing keys of multiple transaction systems according to claim 5, wherein: The key replacement request includes the cooperative organization device identification and the new key pair attribute value, the key push request includes the cooperative organization device identification and the new key pair attribute value, and the key deletion request includes the cooperative organization device identification and the old key pair attribute value.

7. The method for synchronizing keys of multiple transaction systems according to claim 6, wherein: Also includes: Before sending a push key request to the acquiring business management system, the transaction system checks the number of keys of the cooperative institution device corresponding to the cooperative institution device identifier in the transaction system. If the number of keys is a pair, a push key request is sent to the acquiring business management system; otherwise, a first error message is generated.

8. The method for synchronizing keys of multiple transaction systems according to claim 6, wherein: Also includes: After receiving the key deletion request, the transaction system checks the number of key pairs of the cooperative institution device corresponding to the cooperative institution device identifier in the transaction system. If the number of key pairs is greater than one pair, and the key pair generation date in the old key pair attribute value is earlier than the new key pair generation date, the old key pair is deleted and a key deletion success message is generated.

9. A cooperative institution device for synchronizing keys of multiple transaction systems, characterized in that: include: A key pair receiving module is used to receive the newly created key pair and the newly created key pair attribute value sent by the branch; The newly created key pair and the newly created key pair attribute value are created by the branch for the cooperative institution device in the acquiring business management system; A replacement request sending module is configured to send a key replacement request to each transaction system. Upon receiving the key replacement request, each transaction system checks the number of keys in its system. If it has a pair, it sends a push key request to the acquiring business management system, receives the newly created key pair returned by the acquiring business management system in response to the push key request, and returns a key replacement success message. Each transaction system supports two sets of key pairs for the same partner institution device at the same time. The parameters of the push key request are the partner institution number, the generation date of the key pair, and the hash value of the key pair. The channel access control component restricts the transaction systems that call push key requests. The access status of each system to push key requests is sent to the security audit system, which analyzes the push key request logs to determine the security of the request. a deletion request sending module, configured to, after receiving key replacement success information returned by all trading systems, check the number of keys in the system; if the number of keys is greater than one and the key to be deleted is older, send a key deletion request to each trading system, causing each trading system to delete the old key pair according to the key deletion request and return a key deletion success message; After deletion, there is at least one key pair in the partner institution's device in the trading system, and the creation date of the remaining key is greater than the deleted key; The transaction signing module is used to sign all transactions with the newly created key pair after receiving the key deletion success information returned by all transaction systems; If the cooperative institution device does not receive the key replacement success information returned by all trading systems within two days, the trading system shall retain the earliest added key, delete the keys added later, and record the event in the audit log.

10. A trading system for synchronizing keys of multiple trading systems, characterized in that: include: a push request sending module, configured to, upon receiving a key replacement request, check the number of keys in the system and, if there is exactly one pair, send a push key request to the acquiring business management system, wherein the key replacement request is sent by the partner institution device to each transaction system after receiving a new key pair and new key pair attribute values sent by the branch; the new key pair and new key pair attribute values are established by the branch in the acquiring business management system for the partner institution device; A newly created key pair receiving module, configured to receive the newly created key pair returned by the acquiring business management system in response to the push key request; The successful key replacement information return module is used to return the key replacement success information to the partner institution device. Each trading system supports two sets of key pairs for the same partner institution device. The parameters of the push key request are the partner institution number, the key pair generation date, and the key pair hash value. The channel access control component is used to restrict the trading system that calls the push key request. The access status of each system to the push key request is sent to the security audit system, which analyzes the push key request log to analyze the security of the request. The old key pair deletion module is used to check the number of keys of this system after receiving a key deletion request. If the number of keys is greater than 1 and the date of the key applied for deletion is earlier, the old key pair is deleted according to the key deletion request, and the key deletion success information is returned to the cooperative institution device, wherein the key deletion request is sent by the cooperative institution device to each trading system after receiving the key replacement success information returned by all trading systems; after deletion, there is no less than 1 pair of keys of the cooperative institution device in the trading system, and the creation date of the remaining keys is greater than the deleted key; if the trading system does not return the key replacement success information to the cooperative institution device for more than two days, the trading system retains the earliest added key, deletes the keys added later, and registers the event in the audit log.

11. A key synchronization system for multiple transaction systems, characterized in that: include: An acquiring business management system, a cooperative institution device and multiple transaction systems, wherein the acquiring business management system is used to generate a new key pair and a new key pair attribute value after receiving a key pair generation request from a branch, and to determine and return the new key pair corresponding to the push key request after receiving a push key request, the cooperative institution device includes the cooperative institution device for synchronizing multiple transaction system keys as described in claim 9, and the transaction system includes the transaction system for synchronizing multiple transaction system keys as described in claim 10.

12. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

14. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images