A method for switching four-level plaintext data to national secret encryption storage

Abstract

The present invention provides a method for switching four-level plaintext data from encrypted storage to national secrets, and relates to the field of computer technology. The method comprises the following steps: S1. A bank front-end and a UnionPay front-end convert a received ciphertext encrypted using an international key into a ciphertext encrypted using an internal national secret key Sm4 according to configuration parameters; and S2. Determining the encryption method used for the current password. The method generates a four-level data MAC for verification, further protecting customer information, improving institutional security, and reducing operational risks. Furthermore, the method switches the storage method of the customer password and the generation method of the ICVN, CVV, and CVV2 to national secrets, thereby enhancing the confidentiality of the customer's four-level sensitive information, preventing customer information leakage, improving information security, and reducing the financial risks associated with card use.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method for switching four-level plaintext data to national secret encryption storage. Background Art

[0002] The overall solution of the credit card system covers comprehensive management of the entire credit card life cycle, including modules involving customers' online financial and non-financial password verification and four-level information verification, including manual authorization, electronic credit card information query, card activation, account information verification, third-party quick payment activation verification, identity verification, real-time electronic credit card creation and financial transaction password verification. Summary of the Invention

[0003] (1) Technical problems solved

[0004] In response to the shortcomings of the existing technology, the present invention provides a method for switching four-level plaintext data to national secret encryption storage, which solves the problem that traditional encryption storage methods are not conducive to improving the confidentiality of customers' four-level sensitive information, preventing customer information leakage, improving information security levels, and reducing the risks of customers using card funds.

[0005] (2) Technical solution

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for switching four-level plaintext data to national secret encryption storage, comprising the following steps:

[0007] S1. The bank's front-end and UnionPay front-end convert the received ciphertext encrypted with the international key into ciphertext encrypted with the internal national secret key Sm4 according to the configuration parameters;

[0008] S2. Determine the encryption method used by the current password. If it is international encryption, call the encryption machine to use international instructions to decrypt and check with the password transmitted in the message. If it is national encryption, call the encryption machine to use national secret instructions to decrypt and check with the password transmitted in the message;

[0009] S3. After the ciphertext currently encrypted using the international key is verified to be correct, the encryption machine instruction is called to execute the conversion encryption to national encryption and stored in the card medium table, and the encryption method currently used by the card medium is updated to national encryption Sm4;

[0010] S4. Generate a MAC using the generated password and store it in the card media table;

[0011] S5. Mark the current card medium of the new card as a national secret card according to the configuration parameters. When generating the card file, call the encryption machine to use the national secret key to generate CVV, CVV2, and ICVN.

[0012] The query password and payment password use the national secret algorithm specifically including: If the system supports the SM4 algorithm, then the institution-level parameter switch is used to force the SM4 encryption to be enabled, and the internal support for the SM4 algorithm is enabled. The financial front-end UnionPay front-end and the in-bank front-end transformation receive the PINBLOCK. Regardless of whether the password is encrypted by 3DES or SM4 algorithm, it is converted into the PINBLOCK of the internal key encrypted by the SM4 algorithm through the encryption instruction and saved in the 63 field of the message. If it is not enabled, the default logic is to convert it into the PINBLOCK of the internal key encrypted by the 3DES algorithm through the encryption instruction and save it in the 52 field of the message. The current system uses the 3DES algorithm instruction to generate and verify PINOFFSET. The media information table adds a new field encryption algorithm to identify the algorithm type used for the current PINOFFSET calculation. It is not initialized online and is not configured. The default is 3DES algorithm. When the transaction verifies the password, if the encryption algorithm flag is SM4, the SM4 algorithm instruction is called to verify PINOFFS ET, otherwise, the 3DES algorithm instruction is still called to verify the PINOFFSET. The existing data will be modified later in the password 14090-Password Setting and 14091-Password Modification to determine whether it is changed to a PINOFFSET that supports the SM4 algorithm. If the institution-level parameter "Whether SM4 encryption is forced to be enabled" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag remains unchanged at 3DES. For the newly added query password and payment password, determine whether the SM4 algorithm PINOFFSET is supported. If the institution-level parameter "Whether SM4 encryption is forced to be enabled" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag is set to 3DES.

[0013] Preferably, the transaction password and CVV, ICVN, and CVV2 in the card medium stored in the current system are all encrypted and calculated using international algorithms. After using this method, the customer's transaction password after verifying the password or changing the password is protected by the national secret key. After replacing the card, making a new card, or converting the virtual card to a physical card, the customer's CVV, ICVN, and CVV2 are all generated and verified using the national secret algorithm.

[0014] Preferably, after the parameters are turned on, the cards and passwords of existing customers support international password verification and CVV, ICVN, and CVV2 verification, which will not be affected by the national password transformation.

[0015] Preferably, the generated password is used to generate a MAC using a national secret key and stored in the card medium table. In financial transactions, the password verification will call the encryption machine to verify the integrity of the password.

[0016] Preferably, the current card medium flag of the newly produced card is marked as a national secret card according to the configuration parameters, and when generating the card production file, the encryption machine is called to use the national secret key to generate CVV, CVV2, and I CVN.

[0017] Preferably, the bank's front-end and the UnionPay front-end convert the received ciphertext encrypted using the international key into ciphertext encrypted using the internal national secret key Sm4 according to the configuration parameters.

[0018] Preferably, CVV, CVV2, and ICVN data are generated using the national secret method, including: a new field is added to the TM_MEDIA media card layer, the previous encryption algorithm and encryption algorithm respectively identify the algorithm type used for the previous and current CVV, CVV2, and ICVN calculations, the stock data is not initialized when going online, the previous encryption algorithm and encryption algorithm fields are not configured, and the default is 3DES algorithm. When the national secret transformation is online, the previous encryption algorithm and encryption algorithm fields in TM_MEDIA are not configured, and the default is 3DES algorithm. For card replacement, card renewal, and new card production, if the institution layer parameter is forced to enable SM 4. If encryption is enabled, the media processing system sets the media card encryption algorithm field to SM4, and updates the previous encryption algorithm field to the encryption algorithm field. Otherwise, the media processing system sets the media card encryption algorithm field to 3DES, and updates the previous encryption algorithm field to the encryption algorithm field. CVV, CVV2, and ICVN inventory data use the default 3DES algorithm. If the institution-level parameter "Whether to Force Enable SM4 Encryption" is enabled, the card files CVV, CVV2, and ICVN for card replacement, card renewal, and new card issuance are all generated using the SM4 algorithm, and the media card encryption algorithm identifier is set to SM4.

[0019] Preferably, the fourth-level data integrity protection specifically includes: a new field MAC is added to the media information table to save the verification value, and for existing data, the MAC value is not set by default and no verification is performed. If whether to force SM4 encryption is enabled is turned on, the password of the existing card and the password for activating the new card are modified, a verification value is generated and saved in the MAC field. During the transaction, if the MAC verification of whether to enable sm4 is enabled and the MAC field is not empty, the MAC is verified first, and then the PINOFFSET is verified. If the MAC verification is successful, the PINOFFSET is verified. If the MAC verification is unsuccessful, the PINOFFSET is no longer verified. The newly added authorization rule returns the corresponding response code based on the MAC verification result in the MPS. If the MAC verification of whether to enable sm4 is not enabled or the MAC field is empty, the MAC is not verified and the PINOFFSET is directly verified.

[0020] Preferably, a method and steps for switching four-level plaintext data to national secret encryption storage:

[0021] a. When verifying the password for a financial transaction, the customer password information table is read. If the current encryption method is Sm4, the national secret command is used to decrypt the password. The ciphertext sent in the message is also decrypted and verified using the national secret command. If the verification is correct, a message indicating that the password verification is successful is returned.

[0022] b. When verifying the password integrity of a financial transaction, the MAC and password ciphertext of the customer's password information table are read. The password ciphertext is encrypted with the national secret key and then compared with the retrieved MAC. If they are consistent, the integrity check passes;

[0023] c. Password setting and password modification: Determine whether the SM4 algorithm's PINOFFSET is supported. If the organization-level parameter "Force SM4 encryption" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag is set to 3DES. The verification part is the same as step a.

[0024] d. For existing data, the MAC value is not set by default and no verification is performed. If you enable SM4 encryption, modify the password of the existing card and the password for activating a new card, generate a verification value, and save it to the MAC field. The verification part is the same as step b.

[0025] (3) Beneficial effects

[0026] The present invention provides a method for switching four-level plaintext data to national secret encryption storage. It has the following beneficial effects:

[0027] 1. The present invention provides a method for switching four-level plaintext data to national secret encryption storage. This method switches the storage method of customer passwords and the generation method of ICVN, CVV, and CVV2 to use national secret protection, which helps to improve the confidentiality of customers' four-level sensitive information, helps prevent customer information leakage, improves the information security level, and reduces the financial risk of customers using cards.

[0028] 2. The present invention provides a method for switching four-level plaintext data to national secret encryption storage. The method generates a four-level data MAC for verification, which is used to further protect customer information, improve institutional security, and reduce personnel operation risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a system flow chart for switching four-level plaintext data to national secret encryption storage according to the present invention;

[0030] Figure 2 This is a flow chart of a method for switching four-level plaintext data to national secret encrypted storage according to the present invention. DETAILED DESCRIPTION

[0031] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0032] Example:

[0033] like Figure 1-2 As shown, an embodiment of the present invention provides a method for switching four-level plaintext data to national secret encryption storage, including the following steps:

[0034] S1. The bank's front-end and UnionPay front-end convert the received ciphertext encrypted with the international key into ciphertext encrypted with the internal national secret key Sm4 according to the configuration parameters;

[0035] S2. Determine the encryption method used by the current password. If it is international encryption, call the encryption machine to use international instructions to decrypt and check with the password transmitted in the message. If it is national encryption, call the encryption machine to use national secret instructions to decrypt and check with the password transmitted in the message;

[0036] S3. After the ciphertext currently encrypted using the international key is verified to be correct, the encryption machine instruction is called to execute the conversion encryption to national encryption and stored in the card medium table, and the encryption method currently used by the card medium is updated to national encryption Sm4;

[0037] S4. Generate a MAC using the generated password and store it in the card media table;

[0038] S5. Mark the current card medium of the new card as a national secret card according to the configuration parameters. When generating the card file, call the encryption machine to use the national secret key to generate CVV, CVV2, and ICVN.

[0039] The query password and payment password use the national secret algorithm specifically including: If the system supports the SM4 algorithm, then the institution-level parameter switch is used to force the SM4 encryption to be enabled, and the internal support for the SM4 algorithm is enabled. The financial front-end UnionPay front-end and the in-bank front-end transformation receive the PINBLOCK. Regardless of whether the password is encrypted by 3DES or SM4 algorithm, it is converted into the PINBLOCK of the internal key encrypted by the SM4 algorithm through the encryption instruction and saved in the 63 field of the message. If it is not enabled, the default logic is to convert it into the PINBLOCK of the internal key encrypted by the 3DES algorithm through the encryption instruction and save it in the 52 field of the message. The current system uses the 3DES algorithm instruction to generate and verify PINOFFSET. The media information table adds a new field encryption algorithm to identify the algorithm type used for the current PINOFFSET calculation. It is not initialized online and is not configured. The default is 3DES algorithm. When the transaction verifies the password, if the encryption algorithm flag is SM4, the SM4 algorithm instruction is called to verify PINOFFS ET, otherwise, the 3DES algorithm instruction is still called to verify the PINOFFSET. The existing data will be modified later in the password 14090-Password Setting and 14091-Password Modification to determine whether it is changed to a PINOFFSET that supports the SM4 algorithm. If the institution-level parameter "Whether SM4 encryption is forced to be enabled" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag remains unchanged at 3DES. For the newly added query password and payment password, determine whether the SM4 algorithm PINOFFSET is supported. If the institution-level parameter "Whether SM4 encryption is forced to be enabled" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag is set to 3DES.

[0040] The transaction passwords and CVV, ICVN, and CVV2 in the card media currently stored in the system are all encrypted and calculated using international algorithms. After using this method, the customer's transaction password will be protected by the national secret key after verifying the password or changing the password. When replacing the card, making a new card, or converting the virtual card to a physical card, the customer's CVV, ICVN, and CVV2 will all be generated and verified using the national secret algorithm.

[0041] After the parameters are enabled, existing customers' cards and passwords support international password verification and CVV, ICVN, and CVV2 verification, which will not be affected by the national password transformation.

[0042] The generated password is used to generate a MAC using the national secret key and stored in the card medium table. In financial transactions, the password verification will call the encryption machine to verify the integrity of the password.

[0043] According to the configuration parameters, the current card medium flag of the newly produced card is marked as a national secret card. When generating the card production file, the encryption machine is called to use the national secret key to generate CVV, CVV2, and ICVN.

[0044] The bank's front-end and UnionPay's front-end will convert the ciphertext received using the international key into ciphertext encrypted using the internal national secret key Sm4 according to the configuration parameters.

[0045] CVV, CVV2, and ICVN data are generated using the national secret method, including: new fields are added to the TM_MEDIA media card layer, the previous encryption algorithm and encryption algorithm respectively identify the algorithm types used for the previous and current CVV, CVV2, and I CVN calculations. The existing data is not initialized when going online. The previous encryption algorithm and encryption algorithm fields are not configured, and the default algorithm is 3DES. When this national secret transformation is launched, the previous encryption algorithm and encryption algorithm fields in TM_MEDIA are not configured, and the default algorithm is 3DES. For card replacement, card renewal, and new card issuance, if the institutional layer parameter "Whether to force SM4 encryption to be enabled" is enabled, the media processing system sets the media card encryption algorithm field to SM4, and updates the previous encryption algorithm field to the encryption algorithm field. Otherwise, the media processing system sets the media card encryption algorithm field to 3DES, and updates the previous encryption algorithm field to the encryption algorithm field. The CVV, CVV2, and ICVN stock data use the default 3DES algorithm. If the institutional layer parameter "Whether to force SM4 encryption to be enabled" is enabled, the card issuance files CVV, CVV2, and I CVN for card replacement, card renewal, and new card issuance are all generated using the SM4 algorithm, and the media card encryption algorithm identifier is set to SM4.

[0046] The four-level data integrity protection specifically includes: a new field MAC is added to the media information table to save the verification value. For existing data, the MAC value is not set by default and no verification is performed. If it is turned on to force the SM4 encryption, the password of the existing card is modified, the password for activating a new card is set, a verification value is generated, and saved to the MAC field. During the transaction, if the MAC verification of whether to enable sm4 is enabled and the MAC field is not empty, the MAC is verified first, and then the PINOFFSET is verified. If the MAC verification is successful, the PINOFFSET is verified. If the MAC verification is unsuccessful, the PINOFFSET is no longer verified. The new authorization rule returns the corresponding response code based on the MAC verification result in the MPS. If the MAC verification of whether to enable sm4 is not enabled or the MAC field is empty, the MAC is not verified and the PINOFFSET is verified directly.

[0047] A system procedure for switching four-level plaintext data to national secret encryption storage:

[0048] a. When verifying the password for a financial transaction, the customer password information table is read. If the current encryption method is Sm4, the national secret command is used to decrypt the password. The ciphertext sent in the message is also decrypted and verified using the national secret command. If the verification is correct, a message indicating that the password verification is successful is returned.

[0049] b. When verifying the password integrity of a financial transaction, the MAC and password ciphertext of the customer's password information table are read. The password ciphertext is encrypted with the national secret key and then compared with the retrieved MAC. If they are consistent, the integrity check passes;

[0050] c. Password setting and password modification: Determine whether the SM4 algorithm's PINOFFSET is supported. If the organization-level parameter "Force SM4 encryption" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag is set to 3DES. The verification part is the same as step a.

[0051] d. For existing data, the MAC value is not set by default and no verification is performed. If you enable SM4 encryption, modify the password of the existing card, set the password for activating a new card, generate a verification value, and save it to the MAC field. The verification part is the same as b.

[0052] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A method for switching four-level plaintext data to national secret encryption storage, characterized by: The following steps are involved: S1. The bank's front-end and UnionPay front-end convert the received ciphertext encrypted with the international key into ciphertext encrypted with the internal national secret key Sm4 according to the configuration parameters; S2. Determine the encryption method used by the current password. If it is international encryption, call the encryption machine to use international instructions to decrypt and check with the password transmitted in the message. If it is national encryption, call the encryption machine to use national secret instructions to decrypt and check with the password transmitted in the message; S3. After the ciphertext currently encrypted using the international key is verified to be correct, the encryption machine instruction is called to execute the conversion encryption to national encryption and stored in the card medium table, and the encryption method currently used by the card medium is updated to national encryption Sm4; S4. Generate a MAC using the generated password and store it in the card media table; S5. Mark the current card medium of the new card as a national secret card according to the configuration parameters. When generating the card file, call the encryption machine to use the national secret key to generate CVV, CVV2, and ICVN. The query password and payment password use the national secret algorithm specifically including: If the system supports the SM4 algorithm, then the institution-level parameter switch is used to force the SM4 encryption to be enabled, and the internal support for the SM4 algorithm is enabled. The financial front-end UnionPay front-end and the in-bank front-end transformation receive the PINBLOCK. Regardless of whether the password is encrypted by 3DES or SM4 algorithm, it is converted into the PINBLOCK of the internal key encrypted by the SM4 algorithm through the encryption instruction and saved in the 63 field of the message. If it is not enabled, the default logic is to convert it into the PINBLOCK of the internal key encrypted by the 3DES algorithm through the encryption instruction and save it in the 52 field of the message. The current system uses the 3DES algorithm instruction to generate and verify PINOFFSET. The media information table adds a new field encryption algorithm to identify the algorithm type used for the current PINOFFSET calculation. It is not initialized online and is not configured. The default is 3DES algorithm. When the transaction verifies the password, if the encryption algorithm flag is SM4, the SM4 algorithm instruction is called to verify PINOFFS ET, otherwise, the 3DES algorithm instruction is still called to verify the PINOFFSET. The existing data will be modified later in the password 14090-Password Setting and 14091-Password Modification to determine whether it is changed to a PINOFFSET that supports the SM4 algorithm. If the institution-level parameter "Whether SM4 encryption is forced to be enabled" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag remains unchanged at 3DES. For the newly added query password and payment password, determine whether the SM4 algorithm PINOFFSET is supported. If the institution-level parameter "Whether SM4 encryption is forced to be enabled" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag is set to 3DES.

2. The method for switching four-level plaintext data to national secret encryption storage according to claim 1, characterized in that: The transaction passwords and CVV, ICVN, and CVV2 in the card media currently stored in the system are all encrypted and calculated using international algorithms. After using this method, the customer's transaction password will be protected by the national secret key after verifying the password or changing the password. When replacing the card, making a new card, or converting the virtual card to a physical card, the customer's CVV, ICVN, and CVV2 will all be generated and verified using the national secret algorithm.

3. The method for switching four-level plaintext data to national secret encryption storage according to claim 1, characterized in that: After the parameters are enabled, existing customers' cards and passwords support international password verification and CVV, ICVN, and CVV2 verification, which will not be affected by the national password transformation.

4. The method for switching four-level plaintext data to national secret encryption storage according to claim 1, characterized in that: The generated password is used to generate a MAC using the national secret key and stored in the card medium table. In financial transactions, the password verification will call the encryption machine to verify the integrity of the password.

5. The method for switching four-level plaintext data to national secret encryption storage according to claim 1, characterized in that: According to the configuration parameters, the current card medium flag of the newly produced card is marked as a national secret card. When generating the card production file, the encryption machine is called to use the national secret key to generate CVV, CVV2, and ICVN.

6. The method for switching four-level plaintext data to national secret encryption storage according to claim 1, characterized in that: The bank's front-end and UnionPay's front-end will convert the ciphertext encrypted with the international key into the ciphertext encrypted with the internal national secret key Sm4 according to the configuration parameters.

7. The method for switching four-level plaintext data to national secret encryption storage according to claim 1, characterized in that: CVV / CVV2 / ICVN data is generated using the national secret method, including: TM_MEDIA media card layer new fields, the last encryption algorithm and encryption algorithm respectively identify the last and current CVV, CVV2, ICVN calculation algorithm type, online without initializing the existing data, the last encryption algorithm and encryption algorithm fields are not configured, the default is 3DES algorithm, online this national secret transformation, TM_MEDIA last encryption algorithm and encryption algorithm fields are not configured, the default is 3DES algorithm, card replacement, card renewal, new card, if the institution layer parameters are forced to enable SM4 encryption If encryption is enabled, the media processing system sets the media card encryption algorithm field to SM4, and the previous encryption algorithm field is updated to the encryption algorithm field. Otherwise, the media processing system sets the media card encryption algorithm field to 3DES, and the previous encryption algorithm field is updated to the encryption algorithm field. CVV, CVV2, ICVN stock data, the default 3DES algorithm, if the institution-level parameter "Whether to force SM4 encryption" is enabled, the card files CVV, CVV2, and ICVN for card replacement, card renewal, and new card making are all generated using the SM4 algorithm, and the media card encryption algorithm identifier is set to SM4.

8. The method for switching four-level plaintext data to national secret encryption storage according to claim 1, characterized in that: The four-level data integrity protection specifically includes: a new field MAC is added to the media information table to save the verification value. For existing data, the MAC value is not set by default and no verification is performed. If it is turned on to force the SM4 encryption, the password of the existing card is modified, the password for activating a new card is set, a verification value is generated, and saved to the MAC field. During the transaction, if the MAC verification of whether to enable sm4 is enabled and the MAC field is not empty, the MAC is verified first, and then the PINOFFSET is verified. If the MAC verification is successful, the PINOFFSET is verified. If the MAC verification is unsuccessful, the PINOFFSET is no longer verified. The new authorization rule returns the corresponding response code based on the MAC verification result in the MPS. If the MAC verification of whether to enable sm4 is not enabled or the MAC field is empty, the MAC is not verified and the PINOFFSET is verified directly.

9. The method for switching four-level plaintext data to national secret encryption storage according to claim 1, characterized in that: a. When verifying the password for a financial transaction, the customer password information table is read. If the current encryption method is Sm4, the national secret command is used to decrypt the password. The ciphertext sent in the message is also decrypted and verified using the national secret command. If the verification is correct, a message indicating that the password verification is successful is returned. b. When verifying the password integrity of a financial transaction, the MAC and password ciphertext of the customer's password information table are read. The password ciphertext is encrypted with the national secret key and then compared with the retrieved MAC. If they are consistent, the integrity check passes; c. Password setting and password modification: Determine whether the SM4 algorithm's PINOFFSET is supported. If the organization-level parameter "Force SM4 encryption" is enabled, the new password is saved by calling the SM4 algorithm instruction to generate the PINOFFSET, and the encryption algorithm flag is set to SM4. Otherwise, the 3DES algorithm instruction is still called to generate the PINOFFSET, and the encryption algorithm flag is set to 3DES. The verification part is the same as step a. d. For existing data, the MAC value is not set by default and no verification is performed. If you enable SM4 encryption, modify the password of the existing card and the password for activating a new card, generate a verification value, and save it to the MAC field. The verification part is the same as step b.

Images