Key update methods, key management systems, devices, storage media and products

Abstract

This application provides a key update method, a key management system, a device, a storage medium, and a product, relating to the field of information security. The method includes: a POS terminal backend management system calling the POS terminal's key generation interface to generate a public-private key pair via the POS terminal's PIN pad and returning the public key; forwarding the public key to a hardware security module and calling the hardware security module to generate a first working key; the hardware security module encrypting the first working key based on the public key to generate a first ciphertext and a corresponding key verification value, and sending them to the POS terminal; upon receiving the first ciphertext and the key verification value, the POS terminal obtains the first working key based on its private key and updates its current working key to the first working key. In this application, the POS terminal backend management system is used for instruction scheduling, and the encryption and decryption of information are configured in the POS terminal and the hardware security module, enabling remote and efficient updating of the POS terminal's working key.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a key update method, a key management system, a device, a storage medium, and a product. Background Technology

[0002] A POS terminal (Point of Sale) is a commonly used device in the retail and service industries, used for processing transactions, collecting payments, and managing inventory. With continuous technological advancements and evolving consumer demands, POS machines are constantly expanding and innovating in both functionality and form.

[0003] The working key of a POS terminal is stored in the PIN pad and is used to protect data security in financial transactions. Currently, before a POS terminal is deployed to a merchant or when the working key needs to be updated, a specialized POS terminal service provider or acquiring institution typically needs to manually input the working key into the POS terminal's PIN pad using a master POS terminal. However, current POS terminal working keys suffer from problems such as long-term fixed operation, complex update processes, and high labor costs. Therefore, the current problem to be solved is how to achieve remote and efficient updating of POS terminal working keys. Summary of the Invention

[0004] This application provides a key update method, a key management system, a device, a storage medium, and a product to improve the security of POS terminal key updates.

[0005] On one hand, this application provides a key update method applied to a key management system, which includes a POS terminal backend management system, a POS terminal, and a hardware security module. The method includes: when the POS terminal backend management system detects a working key update instruction from the POS terminal, the POS terminal backend management system calls the key generation interface of the POS terminal to generate a public-private key pair on the POS terminal's PIN pad and return the public key; the POS terminal backend management system forwards the public key to the hardware security module and calls the working key generation interface of the hardware security module; after the working key generation interface is called, the hardware security module generates a first working key, encrypts the first working key based on the public key to generate a first ciphertext, and sends the first ciphertext and the corresponding key verification value of the first working key to the POS terminal backend management system, so that the POS terminal backend management system forwards the first ciphertext and the key verification value to the POS terminal; the hardware security module encrypts the first working key in an encryption machine format to generate a second ciphertext and sends it to the POS terminal backend management system; wherein, the hardware security module obtains the current working key based on the second ciphertext; after receiving the first ciphertext and the key verification value, the POS terminal obtains the first working key based on the private key and updates the current working key to the first working key.

[0006] In one possible implementation, obtaining the first working key based on the private key includes: using the private key to decrypt the first ciphertext to obtain the second working key; encrypting a preset verification character based on the second working key to obtain the third ciphertext; comparing the third ciphertext with the key verification value for consistency; if the comparison result is consistent, the second working key is used as the first working key; if the match fails, the corresponding warning is executed.

[0007] In one possible implementation, the system further includes a personal settlement platform; the method further includes: when the POS terminal detects a card transaction, the POS terminal encrypts the bank card identifier and password based on the current working key to generate a fourth ciphertext, and sends the fourth ciphertext to the POS terminal backend management; the POS terminal backend management sends the fourth ciphertext, the bank card identifier corresponding to the fourth ciphertext, and the second ciphertext to the hardware security module, so that the hardware security module returns a national cryptographic password envelope; the POS terminal backend management sends the bank card identifier and the national cryptographic password envelope to the personal settlement platform; the personal settlement platform verifies the password based on the received bank card identifier and the national cryptographic password envelope and returns the verification result to the POS terminal through the POS terminal backend management.

[0008] In one possible implementation, the hardware security module includes a local master key, which is used to decrypt the second ciphertext generated after encryption in the encryption machine format; the hardware security module returns a national cryptographic envelope, including: the hardware security module uses the local master key to decrypt the second ciphertext to obtain the current working key, and uses the current working key to decrypt the fourth ciphertext to obtain the decryption result; the hardware security module encapsulates the national cryptographic envelope based on the decryption result, and returns the national cryptographic envelope to the POS terminal backend management.

[0009] In one possible implementation, the national cryptographic envelope includes a flag bit; the method further includes: if the personal settlement platform detects that the national cryptographic envelope has passed the verification, then a preset value is written into the flag bit of the national cryptographic envelope; if the national cryptographic envelope fails the verification, then no operation is performed.

[0010] In one possible implementation, the method further includes: when the POS terminal backend management detects that an update scenario has been triggered, generating a working key update instruction; wherein the update scenario includes at least one of the following: the POS terminal usage time exceeds a preset time, the bank card account has an internal or external credit default record, the bank card account has a clearing anomaly, the cumulative amount of bank card account transfers to private parties exceeds a first preset amount, and the cumulative amount of bank card account transfers to public parties exceeds a second preset amount; wherein the first preset amount exceeds the second preset amount.

[0011] On the other hand, this application provides a key management system, including: a POS terminal backend management system, a POS terminal, and a hardware security module; the POS terminal backend management system is used to call the key generation interface of the POS terminal when a working key update instruction of the POS terminal is detected, so that the POS terminal's PIN pad generates a public-private key pair and returns the public key; the POS terminal backend management system is also used to forward the public key to the hardware security module and call the working key generation interface of the hardware security module; the hardware security module is used to generate a first working key after the working key generation interface is called, and encrypt the first working key based on the public key to generate a first ciphertext, and send the first ciphertext and the key verification value corresponding to the first working key to the POS terminal backend management system, so that the POS terminal backend management system forwards the first ciphertext and the key verification value to the POS terminal; the hardware security module is also used to send a second ciphertext generated by encrypting the first working key in an encryption machine format to the POS terminal backend management system; wherein, the hardware security module obtains the current working key based on the second ciphertext; the POS terminal is used to obtain the first working key based on the private key after receiving the first ciphertext and the key verification value, and update the current working key to the first working key.

[0012] On the other hand, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the above method.

[0013] On the other hand, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the above-described method.

[0014] On the other hand, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0015] The key update method, key management system, device, storage medium, and product provided in this application include: a POS terminal backend management system calling the POS terminal's key generation interface to generate a public-private key pair on the POS terminal's PIN pad and returning the public key; forwarding the public key to a hardware security module and calling the hardware security module to generate a first working key; the hardware security module encrypting the first working key based on the public key to generate a first ciphertext and a corresponding key verification value, and sending them to the POS terminal; upon receiving the first ciphertext and the key verification value, the POS terminal obtains the first working key based on its private key and updates the current working key to the first working key; the hardware security module then encrypts the first working key in an encryption machine format to generate a second ciphertext, which is then sent to the POS terminal backend management system. In this application's solution, the POS terminal backend management system is used for instruction scheduling, and the encryption and decryption of information are configured in the POS terminal and the hardware security module, enabling remote and efficient updating of the POS terminal's working key. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] Figure 1 The flowchart of the key update method provided in Embodiment 1 is illustrated in the figure below;

[0018] Figure 2 The flowchart of the key update method provided in Embodiment 1 is illustrated in the figure below;

[0019] Figure 3 The flowchart of the key update method provided in Embodiment 1 is illustrated in the figure below;

[0020] Figure 4 The flowchart of the key update method provided in Embodiment 1 is illustrated in the figure below;

[0021] Figure 5 The diagram below illustrates the structure of the key management system provided in Embodiment 2.

[0022] Figure 6 The diagram above illustrates the interaction of the key management system provided in Embodiment 2.

[0023] Figure 7 The diagram above illustrates the interaction of the key management system provided in Embodiment 2.

[0024] Figure 8 The diagram below illustrates the structure of the electronic device provided in Embodiment 3.

[0025] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0026] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0027] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning. The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to be omnipresent but not exclusive. For example, a product or device that comprises a series of components is not necessarily limited to those components that are explicitly listed, but may include other components that are not explicitly listed or that are inherent to such products or devices. The term "module" as used in this application refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code capable of performing the functions associated with that element.

[0028] During transactions, POS terminals can accept bank card information and follow teller instructions to complete financial transaction information and related information exchange. Among these, the Personal Identification Number (PIN), or personal bank card password, is data used to identify the cardholder's identity in online transactions and must not appear in plaintext at any stage of the computer and network system. Therefore, the PIN is usually encrypted using a working key before transmission. However, this long-term fixed working key is also at risk of being stolen by hackers. Current working key initialization and update processes require a specialized service provider or acquiring institution to take the PIN pad corresponding to the POS terminal to a secure area and re-insert the terminal's master key into the PIN pad using a master POS terminal. However, this approach is complex, time-consuming, and costly to maintain, resulting in relatively low working key security.

[0029] The technical content provided in this application aims to solve the aforementioned technical problems in related technologies. The key update method, key management system, device, storage medium, and product of this application include: a POS terminal backend management system calling the key generation interface of the POS terminal to generate a public-private key pair on the POS terminal's PIN pad and returning the public key; forwarding the public key to a hardware security module and calling the hardware security module to generate a first working key; the hardware security module encrypting the first working key based on the public key to generate a first ciphertext and a key verification value corresponding to the first working key, and sending them to the POS terminal; after receiving the first ciphertext and the key verification value, the POS terminal obtains the first working key based on the private key and updates the current working key to the first working key; the hardware security module encrypting the first working key in an encryption machine format to generate a second ciphertext and sending it to the POS terminal backend management system. In this application's solution, the POS terminal backend management system is used for instruction scheduling, and the encryption and decryption of information are configured in the POS terminal and the hardware security module, enabling remote and efficient updating of the POS terminal's working key.

[0030] The technical solutions of this application will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. In the description of this application, unless otherwise expressly specified and limited, the terms should be broadly understood within the art. The embodiments of this application will now be described with reference to the accompanying drawings.

[0031] Example 1

[0032] Figure 1 The diagram above illustrates a flowchart of a key update method, such as... Figure 1 As shown, the method includes:

[0033] Step 101: When the POS terminal backend management detects the POS terminal's working key update instruction, the POS terminal backend management calls the POS terminal's key generation interface to enable the POS terminal's PIN pad to generate a public-private key pair and return the public key; the POS terminal backend management forwards the public key to the hardware security module and calls the hardware security module's working key generation interface.

[0034] Step 102: After calling the working key generation interface, the hardware security module generates a first working key, encrypts the first working key based on the public key to generate a first ciphertext, and sends the first ciphertext and the key verification value corresponding to the first working key to the POS terminal backend management, so that the POS terminal backend management forwards the first ciphertext and the key verification value to the POS terminal; the hardware security module encrypts the first working key in the encryption machine format to generate a second ciphertext and sends it to the POS terminal backend management; wherein, the hardware security module obtains the current working key based on the second ciphertext;

[0035] Step 103: After receiving the first ciphertext and key verification value, the POS terminal obtains the first working key based on the private key and updates the current working key to the first working key.

[0036] In practical applications, there are various ways to implement POS terminal back-end management. For example, it can be implemented through computer programs, such as application software; or it can be implemented through media that store relevant computer programs, such as USB flash drives or cloud drives; or it can be implemented through physical devices that integrate or install relevant computer programs, such as chips.

[0037] In this example, the POS terminal's working key update command can take various forms. For example, it could be an update command proactively sent by online counter staff or maintenance engineers, an update command generated according to a pre-set fixed period, or an update command triggered by conditions such as a POS terminal restart or a program error. The POS terminal's backend management calls the POS terminal's key generation interface to enable the POS terminal's PIN pad to generate a public-private key pair and return the public key. Specifically, the POS terminal's key generation interface can be a web service interface or an HTTP API interface. In practical applications, SSL / TLS (Secure Sockets Layer / Transport Layer Security) protocols can be used to encrypt HTTP communication. Encrypting and protecting the data transmitted through the interface effectively prevents data theft or tampering, improving system security. When generating the public and private keys, the POS terminal's PIN pad uses asymmetric algorithms such as RSA encryption or elliptic curve cryptography. It should be noted that when the POS terminal's PIN pad returns the public key to the POS terminal's backend management after generating the public and private keys, it encrypts the public key using the current working key (i.e., the unupdated working key) before transmission. After receiving the public key, the POS terminal backend management forwards the public key to the hardware security module and calls the hardware security module's working key generation interface.

[0038] After the working key generation interface is called, the hardware security module generates a first working key, encrypts the first working key based on the public key to generate a first ciphertext, and sends the first ciphertext and the corresponding key verification value to the POS terminal backend management, so that the POS terminal backend management forwards the first ciphertext and the key verification value to the POS terminal. In related technologies, a hardware security module, also known as an HSM (Hardware Security Module), is a hardware security module used to protect and manage encryption keys, perform encryption operations, and provide security services. A hardware security module typically includes a dedicated hardware security chip, secure storage, an isolated environment, and security software to provide highly secure key management and encryption functions. Specifically, the hardware security module can generate the first working key based on symmetric algorithms such as DES (Data Encryption Standard) or AES (Advanced Encryption Standard). In this example, encrypting the first working key with the public key ensures that the encrypted first ciphertext can only be decrypted by the POS terminal possessing the corresponding private key. On the other hand, the hardware security module sends the second ciphertext generated by encrypting the first working key in an encryption machine format to the POS terminal backend management. The hardware security module can obtain the current working key based on the second ciphertext. The hardware security module can also locally encrypt the second ciphertext using the first working key in an encryption machine format, facilitating local decryption of the second ciphertext. In this example, by encrypting the first working key with different keys, the possibility of cracking the first or second ciphertext during transmission can be reduced. Furthermore, configuring the encryption and decryption of the working key on the POS terminal or the hardware security module, with the POS terminal backend management only used for ciphertext transmission, also improves the security of the working key. In practical applications, the POS terminal backend management may manage multiple POS terminals. The POS terminal backend management can store a list of POS terminal numbers and their corresponding second ciphertexts using key-value pairs. The second ciphertext contains the current working key of that POS terminal. To facilitate understanding the role of the second ciphertext, let's take POS terminal A sending its public key as an example. POS terminal A encrypts its public key using its current working key and sends it to the POS terminal backend management system. The POS terminal backend management system then sends the encrypted public key sent by POS terminal A, along with the second ciphertext corresponding to POS terminal A in the list, to the hardware security module. This allows the hardware security module to locally decrypt the second ciphertext corresponding to POS terminal A to obtain the current working key, and further, the public key. This example avoids the POS terminal backend management system performing decryption and encryption, reducing the probability of public key or working key leakage.

[0039] After receiving the first ciphertext and key check value, the POS terminal obtains the first working key based on its private key and updates the current working key to the first working key. The key check value, also known as the KCV (Key Check Value), verifies the accuracy of key transmission and import. There are several ways to implement it. For example, the working key can be processed according to rules, such as bitwise XOR or hash operations, and the result can be used as the key check value. Another method is to encrypt the working key with 16 hexadecimal zeros, and use the encrypted result as the key check value. It should be noted that the POS terminal and the hardware security module maintain consistency in generating the key check value, and the validity of the working key is proven if the key check value generated by the POS terminal matches the key check value received from the hardware security module.

[0040] The key update method of this application includes: the POS terminal backend management calls the POS terminal's key generation interface to enable the POS terminal's PIN pad to generate a public-private key pair and return the public key; the public key is forwarded to the hardware security module, and the hardware security module generates a first working key; the hardware security module, based on the public key, encrypts the first working key to generate a first ciphertext and sends the corresponding key verification value to the POS terminal; after receiving the first ciphertext and key verification value, the POS terminal obtains the first working key based on the private key and updates the current working key to the first working key; the hardware security module then encrypts the first working key in an encryption machine format to generate a second ciphertext and sends it to the POS terminal backend management. In this example scheme, the POS terminal backend management is used for instruction scheduling, and the encryption and decryption of information are configured in the POS terminal and the hardware security module, enabling remote and efficient updating of the POS terminal's working key.

[0041] As an example, Figure 2 The diagram illustrates a flowchart of a key update method. Figure 2 As shown, based on any example, step 103, obtaining the first working key based on the private key, includes:

[0042] Step 201: Decrypt the first ciphertext using the private key to obtain the second working key;

[0043] Step 202: Encrypt the preset verification characters based on the second working key to obtain the third ciphertext;

[0044] Step 203: Compare the third ciphertext and the key verification value for consistency. If the comparison result is consistent, the second working key is used as the first working key; if the match fails, the corresponding warning is executed.

[0045] In this example, the second working key, obtained by decrypting the first ciphertext using the private key, is used as the working key to be verified. The verification rule involves comparing the third ciphertext, obtained by encrypting a preset verification character based on the second working key, with the key verification value. Specifically, the preset verification character can be 16 hexadecimal zeros, or data carried in the first ciphertext, such as time information or the first 8 bytes of the first ciphertext. It should be noted that the hardware security module generates the key verification value according to the agreed-upon generation rules, and the POS terminal generates the third ciphertext according to the same rules. The POS terminal then compares the key verification value with the third ciphertext. This example scheme can verify the validity of the working key in the first ciphertext.

[0046] As an example, Figure 3 The diagram illustrates a flowchart of a key update method. Figure 3 As shown, based on any example, the system also includes a personal settlement platform; the key update method also includes:

[0047] Step 301: When the POS terminal detects a card swipe transaction, the POS terminal encrypts the bank card identifier and password based on the current working key to generate a fourth ciphertext, and sends the fourth ciphertext to the POS terminal backend management.

[0048] Step 302: The POS terminal backend management sends the fourth ciphertext, the bank card identifier corresponding to the fourth ciphertext, and the second ciphertext to the hardware security module, so that the hardware security module returns the national cryptographic password envelope; the POS terminal backend management sends the bank card identifier and the national cryptographic password envelope to the personal settlement platform.

[0049] Step 303: The personal settlement platform verifies the received bank card identifier and national cryptographic password envelope and returns the verification result to the POS terminal through the POS terminal backend management.

[0050] In this example, the bank card can include credit cards and debit cards, and the bank card identifier can be the card number or the bank card account number. In one example, after the POS terminal sends the fourth ciphertext to the POS terminal backend management, the POS terminal backend management retrieves the second ciphertext corresponding to the POS terminal from a list containing multiple second ciphertexts, based on the POS terminal's device ID or number. On the other hand, the hardware security module decrypts the received second ciphertext corresponding to the POS terminal to obtain the POS terminal's current working key, and uses this key to decrypt the fourth ciphertext to obtain the bank card identifier and password within it, then encapsulates it in a national cryptographic encryption envelope. This national cryptographic encryption envelope refers to a digital envelope that uses national cryptographic algorithms such as SM2, SM3, and SM4 for data encryption and protection. In practical applications, the SM2 asymmetric encryption algorithm can be used to encrypt the data, the SM3 hash algorithm to calculate the data digest, and the SM4 symmetric encryption algorithm to protect the key. The hardware security module uses dedicated hardware and security chips, with strict physical and logical security measures, effectively preventing various attack methods, such as side-channel attacks and physical attacks. Therefore, encapsulating information using national cryptographic standards through a hardware security module can improve the security of the encapsulated information. After receiving the bank card identifier and the national cryptographic standard envelope, the personal settlement platform verifies the credentials and returns the verification result to the POS terminal through the POS terminal's backend management. In practical applications, the personal settlement platform can be a third-party payment platform or a bank's online banking payment platform. This example solution can improve the security of bank card transactions.

[0051] As an example, Figure 4 The diagram illustrates a flowchart of a key update method. Figure 4 As shown, based on any example, the hardware security module includes a local master key, which is used to decrypt the second ciphertext generated after encryption in the encryption machine format; in step 302, the hardware security module returns a national cryptographic envelope, including:

[0052] Step 401: The hardware security module uses the local master key to decrypt the second ciphertext to obtain the current working key, and then uses the current working key to decrypt the fourth ciphertext to obtain the decryption result.

[0053] Step 402: The hardware security module encapsulates the national cryptographic password envelope based on the decryption result and returns the national cryptographic password envelope to the POS terminal backend management.

[0054] In this example, the hardware security module stores different data or keys locally and manages them using a local master key. In practical applications, the hardware security module can map the generated second ciphertext to the corresponding local master key. When the POS terminal's backend management returns the second ciphertext, it can link to the corresponding local master key based on the mapping relationship. In this example, the decryption result includes the bank card PIN and the bank card identifier sent by the POS terminal. In one example, the national cryptographic envelope can also match the bank card identifier in the decryption result with the bank card identifier sent by the POS terminal's backend management to verify the consistency of the bank card identifier data. This example's solution, by decrypting the second ciphertext using the hardware security module's local master key, can improve the security of the national cryptographic envelope packaging.

[0055] As yet another example, the national cryptographic envelope includes a flag bit; the key update method also includes:

[0056] If the personal settlement platform detects that the national cryptographic password envelope has passed the verification, it will write a preset value into the flag field of the national cryptographic password envelope; if the national cryptographic password envelope fails the verification, no operation will be performed.

[0057] In this example, the flag bit indicates the verification status of the national cryptographic encryption envelope. For example, a flag bit of the preset value 1 indicates that the national cryptographic encryption envelope has been verified; other values ​​indicate that it has not been verified or has failed. Specifically, the flag bit can only be written by the personal settlement platform and is read-only during the transmission of the national cryptographic encryption envelope. This example's solution allows for quick determination of the verification status of the national cryptographic encryption envelope through its flag bit.

[0058] As yet another example, key update methods also include:

[0059] When the POS terminal backend management detects that an update scenario has been triggered, a working key update instruction is generated. The update scenario includes at least one of the following: the POS terminal usage time exceeds the preset time, the bank card account has an internal or external credit default record, the bank card account has a clearing anomaly, the cumulative amount of bank card account transfers to private parties exceeds the first preset amount, and the cumulative amount of bank card account transfers to corporate parties exceeds the second preset amount. The first preset amount is greater than the second preset amount.

[0060] In practical applications, a preset duration of 5 or 6 hours can be set, or adjusted based on the number of times the same POS terminal is accessed. For example, if the number of accesses exceeds 10, the preset duration can be reduced from 5 hours to 4 hours. On the other hand, internal credit records for bank card accounts can be obtained through the bank's internal blacklist; external blacklists of bank card accounts can be queried through websites or public documents. Furthermore, the bank's established clearing blacklist can be accessed to check for any clearing anomalies in bank card accounts. Additionally, by setting a first preset amount for private transfers to be greater than a second preset amount for public transfers, the security of public transfers can be improved. In practical applications, the first preset amount can be set to 1 million or 1.2 million yuan, and the second preset amount to 500,000 or 600,000 yuan. As an example, if another update scenario triggers 5 to 10 minutes after any of the above update scenarios, the generation time of the working key update instruction corresponding to the other scenario can be delayed to improve the rationality of the working key update. This example provides different trigger scenarios for generating working key update instructions, which can improve the security of the key management system.

[0061] The key update method provided in this embodiment includes: the POS terminal backend management calling the POS terminal's key generation interface to generate a public-private key pair on the POS terminal's PIN pad and returning the public key; forwarding the public key to the hardware security module and calling the hardware security module to generate a first working key; the hardware security module encrypting the first working key based on the public key to generate a first ciphertext and a key verification value corresponding to the first working key and sending them to the POS terminal; after receiving the first ciphertext and the key verification value, the POS terminal obtains the first working key based on the private key and updates the current working key to the first working key; the hardware security module encrypting the first working key in an encryption machine format to generate a second ciphertext and sending it to the POS terminal backend management. In this application's solution, the POS terminal backend management is used for instruction scheduling, and the encryption and decryption of information are configured in the POS terminal and the hardware security module, enabling remote and efficient updating of the POS terminal's working key.

[0062] Example 2

[0063] Figure 5 The diagram above illustrates the structure of the key management system provided in Embodiment 2 of this application. Figure 5 As shown, the system includes: POS terminal back-end management 51, POS terminal 52, and hardware security module 53;

[0064] The POS terminal backend management 51 is used to call the key generation interface of the POS terminal 52 when a working key update instruction of the POS terminal 52 is detected, so that the PIN pad of the POS terminal 52 generates a public-private key pair and returns the public key; the POS terminal backend management 51 is also used to forward the public key to the hardware security module 53 and call the working key generation interface of the hardware security module 53.

[0065] The hardware security module 53 is used to generate a first working key after the working key generation interface is called, and to encrypt the first working key based on the public key to generate a first ciphertext. The first ciphertext and the key verification value corresponding to the first working key are sent to the POS terminal backend management 51 so that the POS terminal backend management 51 forwards the first ciphertext and the key verification value to the POS terminal 52. The hardware security module 53 is also used to send a second ciphertext generated by encrypting the first working key in the encryption machine format to the POS terminal backend management 51. The hardware security module 53 obtains the current working key based on the second ciphertext.

[0066] The POS terminal 52 is used to obtain the first working key based on the private key after receiving the first ciphertext and the key verification value, and update the current working key to the first working key.

[0067] In practical applications, there are multiple ways to implement the POS terminal back-end management 51. For example, it can be implemented through computer programs, such as application software; or it can be implemented as a medium storing relevant computer programs, such as a USB flash drive or cloud drive; or it can be implemented through a physical device that integrates or installs relevant computer programs, such as a chip.

[0068] In this example, the working key update command for POS terminal 52 can take various forms. For example, it could be an update command actively sent by online counter staff or maintenance engineers, an update command generated according to a pre-set fixed period, or an update command triggered by conditions such as a restart of POS terminal 52 or a program error in POS terminal 52. The POS terminal backend management 51 calls the key generation interface of POS terminal 52 to enable the POS terminal 52's PIN pad to generate a public-private key pair and return the public key. Specifically, the POS terminal's key generation interface can be a web service interface or an HTTP API interface. In practical applications, SSL / TLS (Secure Sockets Layer / Transport Layer Security) protocols can be used to encrypt HTTP communication. Encrypting and protecting the data transmitted through the interface effectively prevents data theft or tampering, improving system security. When generating the public-private key, the POS terminal's PIN pad uses asymmetric algorithms such as RSA encryption or elliptic curve cryptography. It should be noted that when the POS terminal's keypad returns the public key to the POS terminal backend management 51 after generating the public and private keys, it encrypts the public key using the current working key (i.e., the unupdated working key) before transmitting it. Upon receiving the public key, the POS terminal backend management 51 forwards it to the hardware security module 53 and calls the working key generation interface of the hardware security module 53.

[0069] After the working key generation interface is called, the hardware security module 53 generates a first working key, encrypts the first working key based on the public key to generate a first ciphertext, and sends the first ciphertext and the key verification value corresponding to the first working key to the POS terminal backend management 51, so that the POS terminal backend management 51 forwards the first ciphertext and the key verification value to the POS terminal 52. In related technologies, the hardware security module 53, also known as an HSM (Hardware Security Module), is a hardware security module 53 used to protect and manage encryption keys, perform encryption operations, and provide security services. The hardware security module 53 typically includes a dedicated hardware security chip, secure storage, an isolated environment, and security software to provide highly secure key management and encryption functions. Specifically, the hardware security module 53 can generate the first working key based on a symmetric algorithm such as the DES (Data Encryption Standard) or AES (Advanced Encryption Standard) algorithm. In this example, encrypting the first working key with the public key ensures that the encrypted first ciphertext can only be decrypted by the POS terminal 52, which possesses the corresponding private key. On the other hand, the hardware security module 53 sends the second ciphertext generated by encrypting the first working key in an encryption machine format to the POS terminal backend management 51; wherein, the hardware security module 53 can obtain the current working key based on the second ciphertext. The hardware security module 53 encrypts the first working key locally in an encryption machine format to generate the second ciphertext, which facilitates local decryption of the second ciphertext by the hardware security module 53. In this example, by encrypting the first working key with different keys, the possibility of cracking the first or second ciphertext during transmission can be reduced; in addition, configuring the encryption and decryption of the working key in the POS terminal 52 or the hardware security module 53, and using the POS terminal backend management 51 only for ciphertext transmission, can also improve the security of the working key. In practical applications, the POS terminal backend management 51 may manage multiple POS terminals 52. The POS terminal backend management 51 can store the POS terminal 52 number-second ciphertext in a list using key-value pairs, where the second ciphertext stores the current working key of the POS terminal 52. To facilitate understanding of the role of the second ciphertext, taking the POS terminal 52 with the number A sending its public key as an example, the POS terminal 52 with the number A will encrypt its public key with the current working key and send it to the POS terminal backend management 51. The POS terminal backend management 51 will then send the encrypted public key sent by the POS terminal 52 with the number A and the second ciphertext corresponding to the POS terminal 52 with the number A in the list to the hardware security module 53. This will allow the hardware security module 53 to locally decrypt the second ciphertext corresponding to the POS terminal 52 with the number A to obtain the current working key and further obtain the public key.The solution in this example avoids decryption and encryption performed by the POS terminal's backend management, reducing the probability of public key or working key leakage.

[0070] After receiving the first ciphertext and the key verification value, the POS terminal 52 obtains the first working key based on its private key and updates the current working key to the first working key. The key verification value, also known as the KCV (Key Check Value), verifies the accuracy of key transmission and import. There are several ways to implement it. For example, the working key can be processed according to rules, such as bitwise XOR or hash operations, and the result can be used as the key verification value. Another method is to encrypt the working key with 16 hexadecimal zeros and use the encrypted result as the key verification value. It should be noted that the POS terminal 52 and the hardware security module 53 maintain the same method for generating the key verification value, and the validity of the working key is proven if the key verification value generated by the POS terminal 52 matches the key verification value sent by the hardware security module 53.

[0071] Figure 6 The diagram illustrates an interactive schematic of a key management system. Figure 6 As shown, after the POS terminal backend management 51 detects the working key update instruction, it calls the key generation interface of the POS terminal 52 to enable the POS terminal 52's PIN pad to generate a public-private key pair and return the public key. The POS terminal backend management 51 sends the public key to the hardware security module 53 and calls the working key generation interface of the hardware security module 53 to enable the hardware security module 53 to generate a first working key. The first working key is then encrypted into a first ciphertext using the public key and encrypted into a second ciphertext using an encryption machine format. The hardware security module 53 forwards the first ciphertext and the key verification value corresponding to the first working key to the POS terminal 52 through the POS terminal backend management 51, and sends the second ciphertext to the POS terminal backend management 51 so that the POS terminal backend management 51 stores the second ciphertext. Based on the private key and the received first ciphertext and the key verification value corresponding to the first working key, the POS terminal 52 updates the current working key to the first working key.

[0072] The key management system in this example includes: a POS terminal backend management system that calls the POS terminal's key generation interface to generate a public-private key pair from the POS terminal's PIN pad and returns the public key; and a system that forwards the public key to a hardware security module and calls the hardware security module to generate a first working key. The hardware security module, based on the public key, encrypts the first working key to generate a first ciphertext and sends the corresponding key verification value to the POS terminal. Upon receiving the first ciphertext and key verification value, the POS terminal obtains the first working key based on its private key and updates its current working key to the first working key. The hardware security module then encrypts the first working key again in a cryptographic format to generate a second ciphertext, which is then sent to the POS terminal backend management system. In this application's scheme, the POS terminal backend management system is used for instruction scheduling, and the encryption and decryption of information are configured in the POS terminal and the hardware security module, enabling remote and efficient updates to the POS terminal's working key.

[0073] As an example, POS terminal 52 is specifically used for:

[0074] Use the private key to decrypt the first ciphertext to obtain the second working key;

[0075] After encrypting the preset verification characters based on the second working key, the third ciphertext is obtained;

[0076] The third ciphertext and the key verification value are compared for consistency. If the comparison result is consistent, the second working key is used as the first working key; if the match fails, the corresponding warning is executed.

[0077] In this example, the second working key, obtained by decrypting the first ciphertext using the private key, is used as the working key to be verified. The verification rule involves comparing the third ciphertext, obtained by encrypting a preset verification character based on the second working key, with the key verification value. Specifically, the preset verification character can be 16 hexadecimal zeros, or data carried in the first ciphertext, such as time information or the first 8 bytes of the first ciphertext. It should be noted that the hardware security module generates the key verification value according to the agreed-upon generation rules, and the POS terminal 52 generates the third ciphertext according to the same rules. The POS terminal 52 then compares the key verification value with the third ciphertext. This example scheme can verify the validity of the working key in the first ciphertext.

[0078] As an example, the system also includes a personal settlement platform 54;

[0079] POS terminal 52 is also used to: when a card swipe transaction is detected, encrypt the bank card identifier and password based on the current working key to generate a fourth ciphertext, and send the fourth ciphertext to POS terminal backend management 51;

[0080] The POS terminal back-end management 51 is also used to: send the fourth ciphertext, the bank card identifier corresponding to the fourth ciphertext, and the second ciphertext to the hardware security module 53, so that the hardware security module 53 returns the national cryptographic password envelope; the POS terminal back-end management 51 is also used to: send the bank card identifier and the national cryptographic password envelope to the personal settlement platform 54;

[0081] The personal settlement platform 54 is used to: verify the identity of the received bank card identifier and national cryptographic password envelope, and return the verification result to the POS terminal 52 through the POS terminal backend management 51.

[0082] In this example, the bank card may include credit cards and debit cards, and the bank card identifier can be the card number or the bank card account number. In one example, after the POS terminal 52 sends the fourth ciphertext to the POS terminal backend management 51, the POS terminal backend management 51 retrieves the second ciphertext corresponding to the POS terminal 52 from a list containing multiple second ciphertexts, based on the device ID or number of the POS terminal 52. On the other hand, the hardware security module 53 decrypts the received second ciphertext corresponding to the POS terminal 52 to obtain the current working key of the POS terminal 52, and uses the current working key of the POS terminal 52 to decrypt the fourth ciphertext to obtain the bank card identifier and password in the fourth ciphertext, and then encapsulates it in a national cryptographic encryption envelope. The national cryptographic encryption envelope refers to a digital envelope that uses national cryptographic algorithms such as SM2, SM3, and SM4 for data encryption and protection. In practical applications, the SM2 asymmetric encryption algorithm can be used to encrypt the data, the SM3 hash algorithm can be used to calculate the data digest, and the SM4 symmetric encryption algorithm can be used to protect the key. The hardware security module 53 employs dedicated hardware and a security chip, featuring stringent physical and logical security measures to effectively prevent various attack methods, such as side-channel attacks and physical attacks. Therefore, encapsulating information using national cryptographic standards through the hardware security module enhances the security of the encapsulated information. Upon receiving the bank card identifier and the national cryptographic standard envelope, the personal settlement platform 54 verifies the credentials and returns the verification result to the POS terminal 52 via the POS terminal backend management system 51. In practical applications, the personal settlement platform 54 can be a third-party payment platform or a bank's online banking payment platform. This example solution improves the security of bank card transactions.

[0083] Figure 7 The diagram illustrates an interactive schematic of a key management system. Figure 7As shown, when the POS terminal 52 detects a card transaction, it encrypts the bank card identifier and password based on the current working key to generate a fourth ciphertext, and sends the fourth ciphertext to the POS terminal backend management 51. The POS terminal backend management 51 determines the second ciphertext based on the POS terminal 52 number, and sends the fourth ciphertext, the corresponding bank card identifier, and the second ciphertext to the hardware security module 53. The hardware security module 53 uses its local master key to decrypt the second ciphertext to obtain the current working key, decrypts the fourth ciphertext based on the current working key, encapsulates the decryption result into a national cryptographic password envelope, and returns the national cryptographic password envelope to the POS terminal backend management 51. The POS terminal 52 sends the national cryptographic password envelope and the corresponding bank card identifier to the personal settlement platform 54, so that the personal settlement platform 54 can verify the password based on the received bank card identifier and national cryptographic password envelope, and return the verification result, and send the verification result to the POS terminal 52.

[0084] As an example, hardware security module 53 includes a local master key, which is used to decrypt a second ciphertext generated after encryption in a cryptographic machine format; hardware security module 53 is specifically used for:

[0085] Use the local master key to decrypt the second ciphertext to obtain the current working key, and then use the current working key to decrypt the fourth ciphertext to obtain the decryption result;

[0086] Based on the decryption result, the national cryptographic password envelope is encapsulated and returned to the POS terminal backend management 51.

[0087] In this example, the hardware security module 53 stores different data or keys locally and manages them using a local master key. In practical applications, when generating the second ciphertext, the hardware security module 53 can map it to the corresponding local master key. When the POS terminal backend management 51 returns the second ciphertext, it can link to the corresponding local master key according to the mapping relationship. In this example, the decryption result includes the bank card password and the bank card identifier sent by the POS terminal 52. In one example, the national cryptographic envelope can also match the bank card identifier in the decryption result with the bank card identifier sent by the POS terminal backend management 51 to verify the consistency of the bank card identifier data. The scheme in this example, which decrypts the second ciphertext using the local master key of the hardware security module, can improve the security of the national cryptographic envelope packaging.

[0088] As yet another example, the national cryptographic envelope includes a flag bit;

[0089] The personal settlement platform 54 is also used to write a preset value into the flag bit of the national cryptographic envelope if the national cryptographic envelope passes the verification; if the national cryptographic envelope fails the verification, no operation is performed.

[0090] In this example, the flag bit indicates the verification status of the national cryptographic encryption envelope. For example, a flag bit of the preset value 1 indicates that the national cryptographic encryption envelope has been verified; other values ​​indicate that it has not been verified or has failed. Specifically, the flag bit can only be written by the personal settlement platform 54 and is read-only during the transmission of the national cryptographic encryption envelope. This example solution allows for quick determination of the verification status of the national cryptographic encryption envelope through its flag bit.

[0091] As another example, the POS terminal backend management 51 is also used to generate a working key update instruction when an update scenario is detected; wherein the update scenario includes at least one of the following: the POS terminal 52 usage time is longer than a preset time, the bank card account has an internal or external credit default record, the bank card account has a clearing anomaly, the cumulative amount of bank card account transfers to private parties is greater than a first preset amount, and the cumulative amount of bank card account transfers to public parties is greater than a second preset amount; wherein the first preset amount is greater than the second preset amount.

[0092] In practical applications, a preset duration can be set to 5 or 6 hours, or adjusted based on the number of times the same POS terminal (52) is accessed. For example, if the number of accesses exceeds 10, the preset duration can be reduced from 5 hours to 4 hours. On the other hand, internal credit records for bank card accounts can be obtained through the bank's internal blacklist; external blacklists of bank card accounts can be queried through websites or public documents. Furthermore, the bank's established clearing blacklist can be accessed to check for any clearing anomalies in bank card accounts. Additionally, by setting a first preset amount for private transfers to be greater than a second preset amount for public transfers, the security of public transfers can be improved. In practical applications, the first preset amount can be set to 1 million or 1.2 million yuan, and the second preset amount to 500,000 or 600,000 yuan. As an example, if another update scenario triggers 5 to 10 minutes after any of the above update scenarios, the generation time of the working key update instruction corresponding to the other scenario can be delayed to improve the rationality of the working key update. This example provides different trigger scenarios for generating working key update instructions, which can improve the security of the key management system.

[0093] The key management system provided in this embodiment includes: a POS terminal backend management system that calls the key generation interface of the POS terminal to generate a public-private key pair on the POS terminal's PIN pad and returns the public key; and forwards the public key to a hardware security module and calls the hardware security module to generate a first working key; the hardware security module sends a first ciphertext generated by encrypting the first working key based on the public key and a key verification value corresponding to the first working key to the POS terminal; after receiving the first ciphertext and the key verification value, the POS terminal obtains the first working key based on the private key and updates the current working key to the first working key; the hardware security module sends a second ciphertext generated by encrypting the first working key in an encryption machine format to the POS terminal backend management system. In this application's solution, the POS terminal backend management system is used for instruction scheduling, and the encryption and decryption of information are configured in the POS terminal and the hardware security module, enabling remote and efficient updating of the POS terminal's working key.

[0094] Example 3

[0095] Figure 8 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of this application. The electronic device includes:

[0096] The electronic device includes a processor 291 and a memory 292; it may also include a communication interface 293 and a bus 294. The processor 291, memory 292, and communication interface 293 can communicate with each other via the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can invoke logical instructions stored in the memory 292 to execute the methods described in the example above.

[0097] Furthermore, the logic instructions in the aforementioned memory 292 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0098] The memory 292, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this application. The processor 291 executes functional applications and data processing by running the software programs, instructions, and modules stored in the memory 292, that is, it implements the methods in the above method examples.

[0099] The memory 292 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 292 may include high-speed random access memory and may also include non-volatile memory.

[0100] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method in any of the embodiments.

[0101] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the method in any of the embodiments.

[0102] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0103] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A key update method, characterized in that, The method is applied to a key management system, which includes a POS terminal backend management system, a POS terminal, and a hardware security module; the method includes: When the POS terminal backend management detects a working key update instruction from the POS terminal, the POS terminal backend management calls the key generation interface of the POS terminal to enable the POS terminal's PIN pad to generate a public-private key pair and return the public key; the POS terminal backend management forwards the public key to the hardware security module and calls the working key generation interface of the hardware security module. After the working key generation interface is called, the hardware security module generates a first working key, encrypts the first working key based on the public key to generate a first ciphertext, and sends the first ciphertext and the key verification value corresponding to the first working key to the POS terminal backend management, so that the POS terminal backend management forwards the first ciphertext and the key verification value to the POS terminal; the hardware security module encrypts the first working key in an encryption machine format to generate a second ciphertext and sends it to the POS terminal backend management; wherein, the hardware security module obtains the current working key based on the second ciphertext; After receiving the first ciphertext and the key verification value, the POS terminal decrypts the first ciphertext using its private key to obtain a second working key; based on the second working key, it encrypts a preset verification character to obtain a third ciphertext; it compares the third ciphertext with the key verification value for consistency; if the comparison result is consistent, it uses the second working key as the first working key and updates the current working key to the first working key; if the match fails, it executes a corresponding warning.

2. The method according to claim 1, characterized in that, The system also includes a personal settlement platform; the method further includes: When the POS terminal detects a card swipe transaction, the POS terminal encrypts the bank card identifier and password based on the current working key to generate a fourth ciphertext, and sends the fourth ciphertext to the POS terminal backend management. The POS terminal backend management sends the fourth ciphertext, the bank card identifier corresponding to the fourth ciphertext, and the second ciphertext to the hardware security module, so that the hardware security module returns the national cryptographic password envelope; the POS terminal backend management sends the bank card identifier and the national cryptographic password envelope to the personal settlement platform; The personal settlement platform verifies the identity of the bank card and the national cryptographic password envelope received, and returns the verification result to the POS terminal through the POS terminal backend management.

3. The method according to claim 2, characterized in that, The hardware security module includes a local master key, which is used to decrypt the second ciphertext generated after encryption in the encryption machine format. The hardware security module returns a national cryptographic envelope, including: The hardware security module uses the local master key to decrypt the second ciphertext to obtain the current working key, and then uses the current working key to decrypt the fourth ciphertext to obtain the decryption result. The hardware security module encapsulates the national cryptographic password envelope based on the decryption result and returns the national cryptographic password envelope to the POS terminal backend management.

4. The method according to claim 2, characterized in that, The national cryptographic envelope includes a flag bit; the method further includes: If the personal settlement platform detects that the national cryptographic password envelope has passed the verification, it writes a preset value into the flag bit of the national cryptographic password envelope; if the national cryptographic password envelope fails the verification, no operation is performed.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: When the POS terminal backend management detects an update scenario trigger, it generates a working key update instruction; wherein, the update scenario includes at least one of the following: the POS terminal usage time exceeds a preset time, the bank card account has an internal or external credit default record, the bank card account has a clearing anomaly, the cumulative amount of bank card account transfers to private parties exceeds a first preset amount, and the cumulative amount of bank card account transfers to corporate parties exceeds a second preset amount; wherein the first preset amount exceeds the second preset amount.

6. A key management system, characterized in that, include: POS terminal back-end management, POS terminal and hardware security module; The POS terminal backend management is used to call the POS terminal's key generation interface when a working key update instruction is detected, so that the POS terminal's PIN pad generates a public-private key pair and returns the public key. The POS terminal backend management is also used to forward the public key to the hardware security module and call the working key generation interface of the hardware security module; The hardware security module is used to generate a first working key after the working key generation interface is called, and to encrypt the first working key based on the public key to generate a first ciphertext. The module then sends the first ciphertext and the key verification value corresponding to the first working key to the POS terminal backend management, so that the POS terminal backend management forwards the first ciphertext and the key verification value to the POS terminal. The hardware security module is further configured to send the second ciphertext generated by encrypting the first working key in an encryption machine format to the POS terminal backend management; wherein, the hardware security module obtains the current working key based on the second ciphertext; The POS terminal is configured to, upon receiving the first ciphertext and the key verification value, decrypt the first ciphertext using a private key to obtain a second working key; encrypt a preset verification character based on the second working key to obtain a third ciphertext; perform a consistency comparison between the third ciphertext and the key verification value; if the comparison result is consistent, use the second working key as the first working key and update the current working key to the first working key; if the matching fails, execute the corresponding warning.

7. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 5.

Images