Payment terminal comprehensive key management method, system and computer readable storage medium

Abstract

The present invention discloses a payment terminal comprehensive key management method, system and computer-readable storage medium, which relate to the field of secure communication. The technical solution of the present invention is: the key management platform determines the key type based on the basic information of the payment terminal, synthesizes the initial key using the key algorithm, and then activates the payment terminal; based on the key management platform, a key distribution preparation instruction is issued, and the activated payment terminal uploads its own storage information to the key management platform; based on the storage information and the initial key, an encrypted working key is formed; a key storage strategy is formulated; the activated payment terminal reads the encrypted working key and the key storage strategy; and after decryption, key download and key storage are completed. The technical solution of the present invention is to install a payment terminal application unit before the payment terminal leaves the factory to realize key pre-entry, the operation process is simple, the key is issued after the network activation authentication, and it can be installed at any time, reducing manual intervention, improving the security of key installation, and reducing costs.

Description

Technical Field

[0001] The present invention relates to the field of secure communications, and in particular to a payment terminal integrated key management method, system and computer-readable storage medium. Background Art

[0002] Before a new payment terminal leaves the factory or a repaired payment terminal leaves the factory again, an initial key must be installed. The existing process of importing keys into payment terminals is complicated. Specifically, the installation of keys in existing payment terminals involves the installation of multiple types of keys, and different types of keys require different installation procedures. Therefore, the administrator needs to manage the background and terminal programs for each type of key installation separately, which makes the existing process of importing keys into payment terminals complicated. Summary of the invention

[0003] The object of the present invention is to provide a payment terminal comprehensive key management method, system and computer-readable storage medium to solve the problem of complex key import process and high cost in traditional payment terminals.

[0004] In order to achieve the above-mentioned purpose, a technical solution of the first aspect of the present invention is a payment terminal comprehensive key management method, which includes: collecting basic information of the payment terminal to download the key; based on the basic information, the key management platform determines the key type, and synthesizes the initial key based on the key type and the key components in the basic information; activates the payment terminal to download the key based on the initial key; the key management platform issues a key distribution preparation instruction, and based on the key distribution preparation instruction, the activated payment terminal uploads its own storage information to the key management platform; based on the storage information and the initial key, an encrypted working key is formed, and a key storage strategy is formulated based on the storage information; the activated payment terminal reads the encrypted working key and the key storage strategy; the activated payment terminal decrypts and completes key downloading and key storage.

[0005] According to a further technical solution, the method further includes: establishing a communication connection between the key management platform and the key algorithm module; wherein, synthesizing the initial key based on the key type and the key components in the basic information is specifically as follows: based on the basic information, the key management platform retrieves the key components; the key management platform transmits the key type and the key components to the key algorithm module; based on the key type and the key components, the key algorithm module synthesizes the initial key.

[0006] In a further technical solution, the method further comprises: establishing a communication connection between the payment terminal for downloading the key and a payment terminal interaction platform; wherein, activating the payment terminal based on the initial key is specifically:

[0007] S101, based on the initial key, the key payment terminal to be downloaded generates a public key and a private key;

[0008] S102, signing using private key;

[0009] S103, uploading the public key and the signature to the payment terminal interaction platform;

[0010] S104, the payment terminal interaction platform verifies the signature using the received public key;

[0011] If the signature is legitimate, the key payment terminal to be downloaded is successfully activated;

[0012] If the signature is illegal, activation of the payment terminal for the key to be downloaded fails, and the process returns to S101;

[0013] A further technical solution, the method also includes: establishing a communication connection between the key management platform and the payment terminal interaction platform; the payment terminal interaction platform retrieves the basic information of the activated payment terminal and records the activated status information of the activated payment terminal; the payment terminal interaction platform sends the retrieved and recorded information to the key management platform.

[0014] According to a further technical solution, the method further includes: establishing a communication connection between the key management platform and a message service module; wherein the key management platform issues a key distribution preparation instruction, and based on the key distribution preparation instruction, the activated payment terminal uploads its own storage information to the key management platform, specifically: the key management platform identifies the activated payment terminal and generates a key distribution preparation instruction; the key distribution preparation instruction is stored in the message service module; after the activated payment terminal reads the key distribution preparation instruction from the message service module, it uploads its own storage information to the key management platform.

[0015] A further technical solution, before the activated payment terminal reads the encryption working key and the key storage policy, also includes the following steps: the key management platform stores the message of distributing the key to the message service platform; the message service platform notifies the activated payment terminal to download the key and the key storage policy.

[0016] A further technical solution, wherein an encrypted working key is formed based on the storage information and the initial key, and a key storage strategy is formulated based on the storage information, specifically: based on the storage information, the key management platform generates a key serial number KSN and formulates a key storage strategy; based on the key serial number KSN, the key algorithm in the storage information and the initial key, a working key of the activated payment terminal is formed; and the working key is encrypting the working key based on the public key of the activated payment terminal to obtain an encrypted working key.

[0017] A further technical solution is that the activated payment terminal reads the encrypted working key and the key storage policy; the activated payment terminal decrypts to complete key download and key storage, specifically: the activated payment terminal reads the encrypted working key and the key storage policy from the key management platform; the activated payment terminal decrypts the encrypted working key using a private key to obtain a key; and stores the key according to the key storage policy.

[0018] A technical solution of the second aspect of the present invention is a system of a comprehensive key management method for a payment terminal, the system comprising: a key management platform, which determines the function of the key type based on the basic information of the payment terminal to be downloaded; sends a key distribution preparation instruction based on the activation status information of the payment terminal; formulates a key storage strategy based on the storage information of the activated payment terminal; encrypts the working key by the public key of the payment terminal and sends it to the payment terminal application unit and generates a key distribution instruction. The payment terminal application unit is installed in any payment terminal, collects the basic information and storage information of the payment terminal to be downloaded, and uploads the basic information and storage information to the key management platform; is also responsible for reading the encrypted working key, decrypting the encrypted key, and storing the key according to the key storage strategy. The key algorithm hardware server is responsible for synthesizing the initial key based on the key component and key type of the acquiring institution; and is also responsible for synthesizing the working key based on the key type and initial key of the payment terminal in the activated state. The payment terminal interaction platform activates the payment terminal to be downloaded; the message service module stores and sends the key distribution preparation instruction and the key distribution instruction.

[0019] A technical solution of the third aspect of the present invention is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the payment terminal comprehensive key management method are implemented.

[0020] The above-mentioned technical scheme of the present invention aims to solve the technical problems of complex and high cost of key importing process in traditional payment terminals. By pre-entering the key information of the payment terminal into the key management platform, and then synchronously synthesizing different types of working keys and distributing them to the payment terminal during the key download request process of the payment terminal, the key import process is simplified and labor costs are reduced.

[0021] Specifically, a payment terminal application unit is installed in the payment terminal to which the key is to be downloaded. Through the payment terminal application unit, basic information including the SN of the payment terminal to which the key is to be downloaded, the acquiring institution to which the payment terminal to which the key is to be downloaded belongs, the acquiring institution information, the key components of the acquiring institution, etc. are sent to the key management platform to complete the pre-entry of the payment terminal key information.

[0022] Based on the key information of the payment terminal, the key management platform determines the key type of the payment terminal to be downloaded, and at the same time calls the key algorithm module. The key algorithm module synthesizes the initial key based on the key type and the key component of the acquiring institution. Here, the key algorithm module can be a key algorithm hardware server independent of the key management platform. Then, based on the initial key, the payment terminal interaction platform activates the payment terminal to be downloaded, calls the basic information of the activated payment terminal, and records the activated status information of the activated payment terminal, and then uploads it to the key management platform. The key management platform identifies the activation status information of the payment terminal and sends a key distribution preparation instruction. The payment terminal application unit uploads the storage information of the activated payment terminal to the key management platform. The key management platform formulates a key storage strategy including key storage location, key index and key algorithm based on the storage information. At the same time, the key management platform generates a KSN based on the basic information of the payment terminal, calls the key algorithm module, and the key algorithm module synthesizes the working key based on the KSN, the corresponding key algorithm and the initial key. The key management platform encrypts the working key based on the storage information of the payment terminal and its public key to form an encrypted working key. The payment terminal application unit downloads and decrypts the encrypted working key, and stores the key according to the downloaded key storage policy, thereby completing the key download of the payment terminal to be downloaded.

[0023] The above technical solution of the present invention solves the problems of complicated process and high labor cost of traditional key importing method by pre-entering the key information of the payment terminal, and the key management platform distributes the working key according to the key information of the payment terminal. Based on the key information of the payment terminal, in each request of the payment terminal, the key management platform distributes different types of keys such as SM4, 3DES, DUKPT to the payment terminal to protect the security of data during the use of the payment terminal. The present invention can flexibly manage different types of keys of different acquiring institutions with the above technical solution, and realize the secure storage of multiple types of keys of the same payment terminal according to the key storage strategy of the payment terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flowchart of a comprehensive key management method for a payment terminal;

[0025] Figure 2 It is a structural diagram of a comprehensive key management system for payment terminals. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation methods described herein are only used to explain the present invention and are not used to limit the present invention.

[0027] like Figure 1As shown, a payment terminal integrated key management method according to an embodiment of the present invention includes:

[0028] Step 101, collecting basic information of the payment terminal to be downloaded key;

[0029] Here, the basic information includes the payment terminal SN of the key to be downloaded, the acquiring institution to which the payment terminal of the key to be downloaded belongs, the acquiring institution information, the key components of the acquiring institution, etc.

[0030] The payment terminal to be downloaded of the key is installed with a payment terminal application unit that is in communication connection with the key management platform, and the payment terminal application unit uploads the collected basic information to the key management platform.

[0031] Step 102, based on the basic information, the key management platform determines the key type, and synthesizes the initial key based on the key type and the key components in the basic information; here, the types of the initial key include SM4, 3DES, BDK of DUKPT, etc.

[0032] At least before step 102, a communication connection between the key management platform and the key algorithm module is established.

[0033] Among them, the synthesizing the initial key based on the key type and the key components in the basic information is specifically: based on the basic information, the key management platform retrieves the key components; the key management platform transmits the key type and the key components to the key algorithm module; based on the key type and the key components, the key algorithm module synthesizes the initial key.

[0034] Step 103: activating the key payment terminal to be downloaded based on the initial key.

[0035] At least before step 103, a communication connection is established between the payment terminal to be downloaded with the payment terminal interaction platform.

[0036] The activating the payment terminal based on the initial key is specifically:

[0037] S101, based on the initial key, the key payment terminal to be downloaded generates a public key and a private key;

[0038] S102, signing using private key;

[0039] S103, uploading the public key and the signature to the payment terminal interaction platform;

[0040] S104, the payment terminal interaction platform verifies the signature using the received public key;

[0041] If the signature is legitimate, the key payment terminal to be downloaded is successfully activated;

[0042] If the signature is illegal, activation of the payment terminal for the key to be downloaded fails, and the process returns to S101.

[0043] Step 104, the key management platform issues a key distribution preparation instruction, and based on the key distribution preparation instruction, the activated payment terminal uploads its own storage information to the key management platform;

[0044] At least before step 104, the payment terminal interaction platform retrieves the basic information of the activated payment terminal and records the activated status information of the activated payment terminal; the payment terminal interaction platform sends the retrieved and recorded information to the key management platform.

[0045] At least before step 104, a communication connection is established between the key management platform and the message service module. The key management platform issues a key distribution preparation instruction, and based on the key distribution preparation instruction, the activated payment terminal uploads its own storage information to the key management platform, specifically: the key management platform identifies the activated payment terminal and generates a key distribution preparation instruction; the key distribution preparation instruction is stored in the message service module; after the activated payment terminal reads the key distribution preparation instruction from the message service module, it uploads its own storage information to the key management platform.

[0046] Step 105, forming an encrypted working key based on the storage information and the initial key, and formulating a key storage strategy based on the storage information, specifically: based on the storage information, the key management platform generates a key serial number KSN and formulates a key storage strategy; based on the key serial number KSN, the key algorithm in the storage information and the initial key, forming the working key of the activated payment terminal; encrypting the working key based on the public key of the activated payment terminal to obtain an encrypted working key.

[0047] Step 106, the activated payment terminal reads the encryption working key and the key storage policy, the activated payment terminal decrypts, and completes key download and key storage, specifically: the activated payment terminal reads the encryption working key and the key storage policy from the key management platform; the activated payment terminal decrypts the encryption working key using a private key to obtain the key; and stores the key according to the key storage policy.

[0048] At least before step 106, the following steps are also included: the key management platform stores the message of key distribution to the message service platform; the message service platform notifies the activated payment terminal to download the key and the key storage strategy.

[0049] A more detailed explanation:

[0050] (I) In this embodiment, activating the payment terminal based on the initial key is specifically:

[0051] S101, based on the initial key, the payment terminal application unit on the payment terminal to download the key generates an ECC public key and a private key;

[0052] S102, use the private key to sign and issue an activation application, that is, the payment terminal application unit uses the ECC private key to calculate the TOKEN and complete the signature;

[0053] S103, the payment terminal application unit uploads the ECC public key and the signature to the payment terminal interaction platform;

[0054] S104, the payment terminal interaction platform receives and saves the ECC public key and the signature, then verifies the signature using the received public key, and gives a reliability evaluation of the payment terminal to be downloaded the key;

[0055] If the signature is legitimate, the payment terminal to be downloaded with the key is reliable and the activation of the payment terminal to be downloaded with the key is successful;

[0056] If the signature is illegal, the payment terminal for the key to be downloaded is unreliable, and activation of the payment terminal for the key to be downloaded fails, and the process returns to S101.

[0057] (II) In this embodiment, each time the payment terminal to be downloaded requests a key download, the pre-entered key basic information is different. Therefore, the key type determined by the key management platform based on each pre-entered key basic information is also inconsistent. Therefore, the key management platform will call the key algorithm consistent with the determined key type in the key algorithm module to calculate the key and distribute it to the payment terminal that issued the request. The payment terminal will also store the key according to the key storage strategy formulated by the key management platform. In this process, human participation is reduced, and the distribution of different types of keys from different acquiring institutions can be achieved, and the secure storage of multiple types of keys in the same payment terminal can also be achieved.

[0058] like Figure 2 As shown, a key management system according to an embodiment of the present invention includes:

[0059] The key management platform has the function of determining the key type based on the basic information of the payment terminal to which the key is to be downloaded; the function of sending key distribution preparation instructions based on the activation status information of the payment terminal; the function of formulating key storage strategies based on the storage information of the activated payment terminal; the function of encrypting the working key through the public key of the payment terminal and sending it to the payment terminal application unit and generating key distribution instructions.

[0060] The payment terminal application unit is installed in any payment terminal and has the function of collecting the basic information and storage information of the payment terminal to be downloaded with the key, and uploading the basic information and storage information to the key management platform; it also has the function of reading the encryption working key, decrypting the encryption key and storing the key according to the key storage policy.

[0061] The key algorithm hardware server has the function of synthesizing the initial key based on the key component and key type of the acquiring institution; and has the function of synthesizing the working key based on the key type and initial key of the activation state of the payment terminal.

[0062] The payment terminal interaction platform has the function of activating the payment terminal to be downloaded with the key;

[0063] The message service module has the function of storing and sending key distribution preparation instructions and key distribution instructions.

[0064] A computer-readable storage medium according to an embodiment of the present invention stores a computer program, and when the computer program is executed by a processor, the steps of the payment terminal integrated key management method are implemented.

[0065] By adopting the above-mentioned technical scheme disclosed in the present invention, the following beneficial effects are obtained: the key management of the technical scheme of the present invention is highly standardized, and the payment terminal application unit is installed before the payment terminal leaves the factory to realize key pre-entry. The operation process is simple, and only the working key needs to be distributed after the online activation authentication is passed. It can be installed at any time, reducing manual intervention and improving the security of the payment terminal key installation process.

[0066] The technical solution of the present invention integrates the complex management procedures of multiple types of keys into one system, realizes the management of different types of keys for different payment terminals, and helps payment terminal manufacturers to flexibly manage the keys of different groups of customers. It reduces manual intervention and saves time and effort.

[0067] The technical solution of the present invention realizes autonomous distribution of payment terminal keys, remote distribution of keys to payment terminals, and formulation of storage strategies for key storage, etc. By formulating strategies to achieve key storage, the key storage security level and storage location can be ensured. This key storage method is flexible, avoids conflicts in the installation of multiple keys in the payment terminal, and does not affect the use of the payment terminal.

[0068] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be considered as the scope of protection of the present invention.

Claims

1. A payment terminal integrated key management method, characterized in that: The method comprises: Collect basic information of the payment terminal to download the key; Based on the basic information, the key management platform determines the key type, and synthesizes the initial key based on the key type and the key components in the basic information; activating the key payment terminal to be downloaded based on the initial key; The key management platform issues a key distribution preparation instruction, and based on the key distribution preparation instruction, the activated payment terminal uploads its own storage information to the key management platform; forming an encrypted working key based on the storage information and the initial key, and formulating a key storage strategy based on the storage information; The activated payment terminal reads the encryption working key and the key storage policy; The activated payment terminal decrypts, and completes key download and key storage; The method further includes, before activating the payment terminal for the key to be downloaded based on the initial key, establishing a communication connection between the payment terminal for the key to be downloaded and a payment terminal interaction platform; The activating the payment terminal based on the initial key is specifically: S101, based on the initial key, the key payment terminal to be downloaded generates a public key and a private key; S102, signing using private key; S103, uploading the public key and the signature to the payment terminal interaction platform; S104, the payment terminal interaction platform verifies the signature using the received public key; If the signature is legitimate, the key payment terminal to be downloaded is successfully activated; If the signature is illegal, activation of the payment terminal for the key to be downloaded fails, and the process returns to S101; The forming of the encryption working key based on the storage information and the initial key, and formulating the key storage strategy based on the storage information, are specifically: Based on the storage information, the key management platform generates a key serial number KSN and formulates a key storage strategy; forming a working key of the activated payment terminal based on the key serial number KSN, the key algorithm in the stored information and the initial key; Encrypting the working key based on the public key of the activated payment terminal to obtain an encrypted working key; The activated payment terminal reads the encrypted working key and the key storage policy; the activated payment terminal decrypts and completes key download and key storage, specifically: The activated payment terminal reads the encryption working key and the key storage policy from the key management platform; The activated payment terminal decrypts the encrypted working key using a private key to obtain a key; storing the key according to the key storage strategy; The method further comprises: at least before step S104, establishing a communication connection between the key management platform and the payment terminal interaction platform; The payment terminal interaction platform retrieves basic information of the activated payment terminal and records activated status information of the activated payment terminal; The payment terminal interaction platform sends the retrieved and recorded information to the key management platform; The method further comprises, at least before step S104, establishing a communication connection between the key management platform and the message service module; The key management platform issues a key distribution preparation instruction, and based on the key distribution preparation instruction, the activated payment terminal uploads its own storage information to the key management platform, specifically: The key management platform identifies the activated payment terminal and generates a key distribution preparation instruction; Storing the key distribution preparation instruction in the message service module; After reading the key distribution preparation instruction from the message service module, the activated payment terminal uploads its own storage information to the key management platform.

2. The payment terminal integrated key management method according to claim 1, characterized in that: The method further comprises: at least before step S102, establishing a communication connection between the key management platform and the key algorithm module; The synthesizing the initial key based on the key type and the key components in the basic information is specifically: Based on the basic information, the key management platform retrieves the key component; The key management platform transmits the key type and the key component to the key algorithm module; Based on the key type and the key components, the key algorithm module synthesizes an initial key.

3. The payment terminal integrated key management method according to claim 1, characterized in that: Before the activated payment terminal reads the encryption working key and the key storage policy, the following steps are also included: The key management platform stores the message of key distribution in the message service platform; The message service platform notifies the activated payment terminal to download the key and the key storage policy.

4. A system for implementing the payment terminal comprehensive key management method as described in any one of claims 1 and 2, characterized in that: The system comprises: The key management platform determines the function of the key type based on the basic information of the payment terminal to be downloaded; sends a key distribution preparation instruction based on the activation status information of the payment terminal; formulates a key storage strategy based on the storage information of the activated payment terminal; encrypts the working key with the public key of the payment terminal and sends it to the payment terminal application unit and generates a key distribution instruction; The payment terminal application unit is installed in any payment terminal, collects basic information and storage information of the payment terminal to be downloaded with the key, and uploads the basic information and storage information to the key management platform; it is also responsible for reading the encryption working key, decrypting the encryption key, and storing the key according to the key storage policy; The key algorithm hardware server is responsible for synthesizing the initial key based on the key component and key type of the acquirer; it is also responsible for synthesizing the working key based on the key type and initial key of the activated payment terminal; Payment terminal interaction platform, activating the payment terminal to be downloaded key; The message service module stores and sends key distribution preparation instructions and key distribution instructions.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the payment terminal comprehensive key management method according to any one of claims 1 and 2 are implemented.

Images