Intelligent card supply chain level-to-level management method and system

Abstract

The invention relates to a smart card supply chain level-to-level management method and system, and belongs to the technical field of supply chain management. The method comprises the following steps that: a primary management mechanism creates a virtual customer, encrypts and initializes blank smart cards in batches in a unified manner according to virtual customer information, and constructs a corresponding secondary customer key authorization relationship; the primary management mechanism issues the encrypted and initialized smart card and the corresponding secondary client key authorization relationship to the secondary management mechanism according to the order information of the secondary management mechanism; the secondary management mechanism determines a final customer, authorizes and authenticates the smart card according to a final customer order and a secondary customer key authorization relationship corresponding to the smart card, and encrypts and activates the smart card by using final customer information; and after the activated intelligent card is written into the final cardholder information, key calculation is carried out to obtain a final client key. The system is used for implementing the method. The method solves the problems that an existing method cannot quickly respond to small customer intelligent card services and is high in management cost.

Description

Technical Field

[0001] The present invention belongs to the technical field of supply chain management, and in particular relates to a smart card supply chain hierarchical management method and system. Background Art

[0002] From a blank card provided by a card supplier to a user, a smart card needs to go through the process of building an application file for the corresponding business on the blank card, card encryption, card personalization, etc. Among them, the organization that completes the application file construction is usually called the first-level management organization, and the first-level management organization's external offices, agents, cooperative operators, etc. are called second-level management organizations. The organization that finally purchases the smart card application is called the end customer. Take the factory canteen meal card as an example. The organization that builds the canteen card payment business system is the first-level management organization, and the factory is the end customer.

[0003] The supply chain management of smart cards usually includes the following methods: 1) The first-level management agency purchases blank cards from the card supplier, and the final customer goes to the first-level management agency to encrypt the blank cards into the final customer key; 2) After authorization by the first-level management agency, the card supplier directly distributes the blank cards to the second-level management agency or the final customer, and then encrypts the final customer key on the final customer side. When the above two methods are applied to a large number of small customers, some management problems will arise, mainly: 1) Because the needs of small batches of customers are different, it is impossible to centrally encrypt the cards of each small customer, and the management cost is high; 2) The final customer needs to go to the first-level management agency to encrypt the card, which is limited by distance and time, and cannot quickly respond to the mass promotion of small customer smart card business; and to meet the needs of rapid response, it is necessary to invest more supply chain resources, and the management cost is relatively high. Summary of the invention

[0004] The purpose of the present invention is to provide a smart card supply chain hierarchical management method and system to solve the problem that the existing management method cannot quickly respond to small customer smart card business and has high management cost.

[0005] The present invention provides a smart card supply chain hierarchical management method to solve the above technical problems, including: 1) The primary management agency creates virtual customers, performs encryption initialization on blank smart cards in batches according to the virtual customer information, and builds corresponding secondary customer key authorization relationships; encryption initialization refers to building a card space structure on a blank smart card and universally encrypting the application files in the card; the secondary customer key authorization relationship includes an authorization authentication key used to verify the correctness of the smart card key issued by the primary management agency; 2) The primary management agency issues the encrypted initialized smart card and the corresponding secondary customer key authorization relationship to the secondary management agency based on the order information of the secondary management agency; 3) The secondary management agency determines the final customer, authorizes and authenticates the smart card based on the final customer order and the secondary customer key authorization relationship corresponding to the smart card assigned to the final customer, and uses the final customer information to realize encryption activation of the smart card; 4) Write the final cardholder information into the activated smart card and perform key calculation to obtain the final customer key.

[0006] Furthermore, in the process of general encryption of application files, when storing the ciphertext key corresponding to the application file in the smart card, it is stored in a manner of missing one, two or more key keys; when the smart card encryption is activated, the missing key keys of the smart card are supplemented according to the secondary customer key authorization relationship.

[0007] Furthermore, the secondary customer key authorization relationship also includes a primary customer root key and a secondary customer root key; based on the primary customer root key and the unique number of the smart card, an authentication key of the smart card is obtained by using a set encryption algorithm. When the authentication key is consistent with the authorized authentication key in the secondary customer key authorization relationship, the smart card authentication is passed.

[0008] Furthermore, in step 3), when the smart card is a security control card, after the security control card is authenticated, the missing key key is obtained by using a set encryption algorithm based on the secondary customer root key and the business application code of the missing key key, and the key key is written or updated to the security control card; when the smart card is a user card, after the user card is authenticated, the missing key key is obtained by using a set encryption algorithm based on the secondary customer root key, the business application code of the missing key key and the unique number of the security control card used in conjunction with the user card, and the key key is written or updated to the user card.

[0009] Furthermore, the universal encryption is implemented in any of the following ways: 1) the encryption key of each file of all applications in all smart cards is the same; 2) the encryption key of each file of all applications in each smart card is the same, but the encryption key of each smart card is different; 3) the encryption key of each smart card is different, and the encryption key of each file under each application in each smart card is different.

[0010] The beneficial effect of the present invention is that through the method of the present invention, the hierarchical management of the card supply chain can be effectively carried out. While ensuring the security of the card key, the first-level management agency's control over the card key is fully guaranteed, helping the second-level management agency to quickly respond to the business opportunities of small and medium-sized customers' smart card business, while also greatly reducing the supply chain resource cost problems caused by card management.

[0011] The smart card supply chain hierarchical management system provided by the present invention to solve the above technical problems includes a primary management agency, a secondary management agency and an end customer, wherein the primary management agency is used to create a virtual primary customer, perform encryption initialization on a batch of blank smart cards according to the primary customer, and establish a corresponding secondary customer key authorization relationship for the batch of smart cards; according to the order information of the secondary management agency, the primary management agency is used to issue the encrypted initialized smart cards and the corresponding secondary customer key authorization relationship to the secondary management agency; encryption initialization refers to constructing a card space structure on a blank smart card and performing universal encryption on the application files in the card; the secondary customer key authorization relationship includes an authorization authentication key for verifying the correctness of the smart card key issued by the primary management agency; The secondary management agency is used to determine the end customer, authorize and authenticate the smart card based on the end customer order and the secondary customer key authorization relationship corresponding to the smart card allocated to the end customer, and use the end customer information to realize smart card encryption activation; the end customer user writes the final cardholder information into the activated smart card and then performs key calculation to obtain the final customer key.

[0012] Furthermore, in the process of general encryption of application files, when storing the ciphertext key corresponding to the application file in the smart card, it is stored in a manner of missing one, two or more key keys; when the smart card encryption is activated, the missing key keys of the smart card are supplemented according to the secondary customer key authorization relationship.

[0013] Furthermore, the secondary customer key authorization relationship also includes a primary customer root key and a secondary customer root key; based on the primary customer root key and the unique number of the smart card, an authentication key of the smart card is obtained by using a set encryption algorithm. When the authentication key is consistent with the authorized authentication key in the secondary customer key authorization relationship, the smart card authentication is passed.

[0014] Furthermore, in step 3), when the smart card is a security control card, after the security control card is authenticated, the missing key key is obtained by using a set encryption algorithm based on the secondary customer root key and the business application code of the missing key key, and the key key is written or updated to the security control card; when the smart card is a user card, after the user card is authenticated, the missing key key is obtained by using a set encryption algorithm based on the secondary customer root key, the business application code of the missing key key and the unique number of the security control card used in conjunction with the user card, and the key key is written or updated to the user card.

[0015] Furthermore, the universal encryption is implemented in any of the following ways: 1) the encryption key of each file of all applications in all smart cards is the same; 2) the encryption key of each file of all applications in each smart card is the same, but the encryption key of each smart card is different; 3) the encryption key of each smart card is different, and the encryption key of each file under each application in each smart card is different.

[0016] The beneficial effect of the present invention is that through the system of the present invention, the hierarchical management of the card supply chain can be effectively carried out. While ensuring the security of the card key, the first-level management agency's control over the card key is fully guaranteed, helping the second-level management agency to quickly respond to the business opportunities of small and medium-sized customers' smart card business, while also greatly reducing the supply chain resource cost problems caused by card management. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a logical architecture diagram of a smart card supply chain hierarchical management system according to an embodiment of the present invention; Figure 2 It is a flow chart of the smart card supply chain hierarchical management method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The specific implementation of the present invention will be further described below in conjunction with the accompanying drawings.

[0019] The basic idea of ​​the present invention is to manage the supply chain of smart cards in a hierarchical manner. The first-level management agency performs batch encryption initialization on blank smart cards according to one or more virtual customers created, and establishes a key authorization relationship between the virtual customer and the second-level customer. The cards are then issued to the second-level management agency, which encrypts the cards into the final customer key for the final customer based on the second-level customer key authorization relationship. In this way, while ensuring the security of the card key, the first-level management agency fully guarantees the key control of the card, helping the second-level management agency to quickly respond to the business opportunities of small and medium-sized customers' smart card business, and also greatly reducing the supply chain resource cost problem caused by card management.

[0020] Embodiment of the smart card supply chain hierarchical management method of the present invention Based on the above basic ideas, Figure 2 As shown, the smart card supply chain hierarchical management method of this embodiment includes: 1) The primary management agency creates virtual customers, performs encryption initialization on blank smart cards in batches according to the virtual customer information, and builds corresponding secondary customer key authorization relationships; encryption initialization refers to building a card space structure on a blank smart card and universally encrypting the application files in the card; the secondary customer key authorization relationship includes an authorization authentication key used to verify the correctness of the smart card key issued by the primary management agency; 2) The primary management agency issues the encrypted initialized smart card and the corresponding secondary customer key authorization relationship to the secondary management agency based on the order information of the secondary management agency; 3) The secondary management agency determines the final customer, authorizes and authenticates the smart card based on the final customer order and the secondary customer key authorization relationship corresponding to the smart card assigned to the final customer, and uses the final customer information to realize encryption activation of the smart card; 4) Write the final cardholder information into the activated smart card and perform key calculation to obtain the final customer key.

[0021] Among them, smart cards include M1 card (contactless IC card, NXP Mifare1 series), CPU card, PSAM card (PinSecure Access Module Card), ESAM card (Embedded SecureAccess Module Card), mobile phone NFC card, SE card (Secure Element), etc.

[0022] The first-level management agency creates one or more virtual customers, referred to as first-level customers. The information of first-level customers includes customer ID, customer name and second-level customer key authorization relationship; second-level customers refer to second-level customers developed in batches by the second-level management agency based on the authorization of first-level customers, also known as end-customers; end-customer information includes first-level customer ID, second-level customer ID, second-level customer name and second-level customer key authorization relationship.

[0023] As a preferred implementation method, the secondary key authorization relationship includes an authorization authentication key, an authorization quantity, and an authorization validity period. The authorization authentication key is used to verify the correctness of the smart card key issued by the primary management agency. The authorization authentication key is calculated based on the primary customer factor of the smart card, the secondary customer factor, the card feature information, and the set algorithm. The algorithm of the authorization authentication key is consistent with the existing traditional standard algorithm, and symmetric algorithms such as 3DES and SM4 can be used. The authorization quantity is used to control the number of end customers allowed to be created by the secondary management agency.

[0024] When encrypting and initializing a blank smart card, the application files of various smart card structures are usually encrypted universally, and the universal encryption key is stored in the smart card. Universal encryption can be implemented in any of the following ways: 1) The encryption key of each file of all applications in all smart cards is the same; 2) The encryption key of each file of all applications in each smart card is the same, but the encryption key of each smart card is different; 3) The encryption key of each smart card is different, and the encryption key of each file under each application in each smart card is different. Among them, the algorithms involved in the key value calculation process are mainly symmetric algorithms 3DES and SM4, and the card characteristic value hash algorithm is used. The characteristic value includes the card inherent serial number (card unique number), the card custom serial number (ASN), the application number, the file number, etc.

[0025] In order to balance security and computational complexity, this embodiment preferably adopts method 2) to perform universal encryption.

[0026] Various smart cards include user cards and security control cards. User cards include M1 cards, CPU cards, NFC cards, SIM cards, etc. The application files of user cards after initialization include CPU card files and sector files. Security control cards generally refer to PSAM cards, ESAM cards, SE cards, etc. Security control cards are used to store security information such as encryption algorithms, keys, certificates, etc., to achieve security authentication, decryption, digital signature and other functions, and are mainly used in commercial POS machines, network terminals, direct terminals, public transportation systems, mobile payments and other fields. User cards and security control cards are generally used in conjunction with each other, and usually one security control card corresponds to multiple user cards. For example, in a campus card, the card held by students is the user card, and the security control card is set in the canteen card machine, water room water saver, campus supermarket POS machine and other terminal equipment to realize the data reading and writing of the card. In this embodiment, the security control card is used to store the ciphertext key corresponding to the user card application file, and is used in conjunction with the user card.

[0027] In order to ensure the security of smart cards and prevent unauthorized customers from using them, in this embodiment, when constructing the card space structure and general encryption of the user card according to standard logic, one, two or more keys of key application files are intentionally missing; and when the security control card stores the ciphertext key corresponding to the user card application file, it does not store the complete ciphertext key, and also lacks one, two or more key keys. In this way, the user who obtains the user card and the corresponding security control card needs to go through key authorization authentication, and complete the missing key keys in the user card and the missing key keys in the security control card before they can be used normally.

[0028] In this embodiment, when there is one primary customer, the primary management agency initializes the blank smart card according to the unified customer encryption, and builds the corresponding secondary customer key authorization relationship, and then issues the smart card and the corresponding secondary customer key authorization relationship to each secondary management agency according to the order information of the secondary management agency; after the secondary management agency determines the final customer, it allocates the smart card (user card and corresponding security control card) and the corresponding secondary customer key authorization relationship to the final customer according to the final customer's order, and performs encryption activation on the final customer side, or the secondary management agency encrypts and activates the corresponding number of smart cards and allocates them to the final customer according to the final customer's order.

[0029] Before the smart card allocated to the final customer is encrypted and activated, the smart card authorization authentication is first performed according to the secondary key authorization relationship. The intermediate key encrypted by the primary customer is hashed from the primary customer root key. The secondary key authorization relationship includes the primary customer root key, so hash verification can be performed based on the card feature information. As a preferred implementation method, the smart card authorization authentication method is: the secondary key authorization relationship includes the primary customer root key and the secondary customer root key; based on the primary customer root key and the unique number of the smart card, the smart card authentication key is obtained by using a set encryption algorithm, and the smart card is authenticated using the authentication key. When the calculated authentication key is consistent with the authorization authentication key stored in the secondary authorization relationship, the smart card authentication is considered to be successful.

[0030] When performing encryption activation, according to the secondary key authorization relationship, after the set algorithm calculation, the key key missing in the user card and the security control card is obtained, and the user card and the security control card key are updated and supplemented. The smart card includes a user card and a supporting security control card. As a preferred embodiment, when the smart card is a security control card, after the security control card is authenticated, according to the secondary customer root key and the business application code of the missing key key, the set encryption algorithm is used to obtain the missing key key, and the key key is written or updated to the security control card. When the smart card is a user card, after the user card is authenticated, according to the secondary customer root key, the business application code of the missing key key and the unique number of the security control card supporting the user card, the set encryption algorithm is used to obtain the missing key key, and the key key is written or updated to the user card. Among them, the set encryption algorithm is preferably a symmetric encryption algorithm such as 3DES and SM4.

[0031] In the above method for authenticating and completing the key of the security control card and the user card, the key of the security control card and the key of the user card differ by N levels (N is preferably 1 level, but can also be 2 or 3 levels), and the algorithms used for completing the two cards must be consistent. The key update method is an industry standard specification, which can be referred to the PBOC specification and will not be described in detail here.

[0032] The following example further illustrates the authentication and key completion method of this embodiment: Assume that the primary customer root key contained in the secondary key authorization relationship is RootKey1, and the secondary customer root key contained is RootKey2; the PSAM card that has been encrypted by the primary customer is PsamCard1, the unique number of the PSAM card is ASN1, the PSAM card lacks the key Psam01, and the key business application number is App01; then, the completion method of the key Psam01 of the PSAM card is: 1) Use 3DES / SM4 algorithm to hash RootKey1 + ASN1 to obtain the authentication key of the PSAM card, and use the authentication key to authenticate the PSAM card (if the authentication key is consistent with the authorization authentication key in the secondary customer authorization relationship, the authentication is considered to be successful). After the authentication is successful, proceed to the following step 2); 2) Use the 3DES / SM4 algorithm to hash RootKey2 + App01 to obtain the final key of the application file, that is, the missing key Psam01, and write or update the final key value to the PSAM card.

[0033] Assume that the user card that has been encrypted from the first-level customer is UserCard1, the unique number of the user card is ASN2, and the user card lacks the key User01, and the key business application number is App01; then the method to complete the key User01 of the user card is: 1) Use 3DES / SM4 algorithm to hash RootKey1 + ASN2 to obtain the authentication key of the user card, and use the authentication key to authenticate the user card (if the authentication key is consistent with the authorization authentication key in the secondary customer authorization relationship, the authentication is considered to be successful). After the authentication is successful, proceed to the following step 2); 2) Use the 3DES / SM4 algorithm to hash RootKey2 + App01 + ASN2 to obtain the final key of the application file, that is, the missing User01 key, and write or update the final key value to the user card.

[0034] In the above method of completing the PSAM card and the user card, the key of the PSAM card and the key of the user card differ by N levels (N is preferably 1 level, but can also be 2 or 3 levels), and the algorithms used for completing the two cards must be consistent. The key update method belongs to the industry standard specification, which can be referred to the PBOC specification and will not be described in detail here.

[0035] The completed user card is then personalized, including personalized user card information, such as writing the end user's basic information into the card, recalculating and authenticating the secret key using the security control card based on the end customer's basic information, obtaining the end customer key, and finally completing the issuance of the smart card to the end customer.

[0036] In this embodiment, the steps of performing secondary encryption activation on the smart card and personalizing the user card can be completed by the secondary management agency and the final customer respectively, or both can be completed together at the final customer side.

[0037] In this embodiment, the primary management agency manages the inventory of blank smart cards. The secondary management agency manages the inventory of smart cards issued by the primary management agency. When the secondary management agency's inventory is insufficient, it submits an order application to the primary management agency, and the primary management agency issues encrypted and initialized smart cards to the secondary management agency according to the quantity in the order application.

[0038] Embodiment of the smart card supply chain hierarchical management system of the present invention like Figure 1 As shown, the management system includes a primary management agency, a secondary management agency and an end customer. The primary management agency is used to create a virtual primary customer, perform encryption initialization on a batch of blank smart cards according to the primary customers, and build a corresponding secondary customer key authorization relationship for the batch of smart cards; according to the order information of the secondary management agency, the primary management agency is used to issue the encrypted initialized smart cards and the corresponding secondary customer key authorization relationship to the secondary management agency; encryption initialization refers to building a card space structure on a blank smart card and performing universal encryption on the application files in the card; the secondary customer key authorization relationship includes an authorization authentication key used to verify the correctness of the smart card key issued by the primary management agency; The secondary management agency is used to determine the end customer, authorize and authenticate the smart card based on the end customer order and the secondary customer key authorization relationship corresponding to the smart card allocated to the end customer, and use the end customer information to realize smart card encryption activation; the end customer user writes the final cardholder information into the activated smart card and then performs key calculation to obtain the final customer key.

[0039] The specific functions of the primary management agency, the secondary management agency and the final customer can be found in the above management method embodiment, which will not be described in detail here.

Claims

1. A smart card supply chain hierarchical management method, characterized in that: The method includes: 1) The primary management agency creates virtual customers, performs encryption initialization on blank smart cards in batches according to the virtual customer information, and builds corresponding secondary customer key authorization relationships; encryption initialization refers to building a card space structure on a blank smart card and universally encrypting the application files in the card; the secondary customer key authorization relationship includes an authorization authentication key used to verify the correctness of the smart card key issued by the primary management agency; 2) The primary management agency issues the encrypted initialized smart card and the corresponding secondary customer key authorization relationship to the secondary management agency based on the order information of the secondary management agency; 3) The secondary management agency determines the final customer, authorizes and authenticates the smart card based on the final customer order and the secondary customer key authorization relationship corresponding to the smart card assigned to the final customer, and uses the final customer information to realize encryption activation of the smart card; 4) Write the final cardholder information into the activated smart card and perform key calculation to obtain the final customer key.

2. The smart card supply chain hierarchical management method according to claim 1, characterized in that: In the process of general encryption of application files, when storing the ciphertext key corresponding to the application files in the smart card, the storage is performed in a manner in which one, two or more critical keys are missing; When implementing encryption activation of the smart card, the key key missing from the smart card is supplemented according to the secondary customer key authorization relationship.

3. The smart card supply chain hierarchical management method according to claim 1, characterized in that: The secondary customer key authorization relationship also includes the primary customer root key and the secondary customer root key; based on the primary customer root key and the unique number of the smart card, an authentication key of the smart card is obtained by using a set encryption algorithm. When the authentication key is consistent with the authorized authentication key in the secondary customer key authorization relationship, the smart card authentication is passed.

4. The smart card supply chain hierarchical management method according to claim 3, characterized in that: In step 3), when the smart card is a security control card, after the security control card is authenticated, the missing key key is obtained by using a set encryption algorithm according to the secondary customer root key and the business application code of the missing key key, and the key key is written or updated into the security control card; When the smart card is a user card, after the user card is authenticated, the missing key is obtained using a set encryption algorithm based on the secondary customer root key, the business application code of the missing key, and the unique number of the security control card used in conjunction with the user card, and the key is written or updated to the user card.

5. The smart card supply chain hierarchical management method according to claim 1, characterized in that: The universal encryption is implemented in any of the following ways: 1) the encryption key of each file of all applications in all smart cards is the same; 2) the encryption key of each file of all applications in each smart card is the same, but the encryption key of each smart card is different; 3) the encryption key of each smart card is different, and the encryption key of each file under each application in each smart card is different.

6. A smart card supply chain hierarchical management system, characterized in that: The management system includes a primary management agency, a secondary management agency and an end customer. The primary management agency is used to create a virtual primary customer, perform encryption initialization on a batch of blank smart cards according to the primary customers, and build a corresponding secondary customer key authorization relationship for the batch of smart cards; according to the order information of the secondary management agency, the primary management agency is used to issue the encrypted initialized smart cards and the corresponding secondary customer key authorization relationship to the secondary management agency; encryption initialization refers to building a card space structure on a blank smart card and performing universal encryption on the application files in the card; the secondary customer key authorization relationship includes an authorization authentication key used to verify the correctness of the smart card key issued by the primary management agency; The secondary management agency is used to determine the end customer, authorize and authenticate the smart card based on the end customer order and the secondary customer key authorization relationship corresponding to the smart card allocated to the end customer, and use the end customer information to realize smart card encryption activation; the end customer user writes the final cardholder information into the activated smart card and then performs key calculation to obtain the final customer key.

7. The smart card supply chain hierarchical management system according to claim 6, characterized in that: In the process of general encryption of application files, when storing the ciphertext key corresponding to the application files in the smart card, the storage is performed in a manner in which one, two or more critical keys are missing; When implementing encryption activation of the smart card, the key key missing from the smart card is supplemented according to the secondary customer key authorization relationship.

8. The smart card supply chain hierarchical management system according to claim 6, characterized in that: The secondary customer key authorization relationship also includes the primary customer root key and the secondary customer root key; based on the primary customer root key and the unique number of the smart card, an authentication key of the smart card is obtained by using a set encryption algorithm. When the authentication key is consistent with the authorized authentication key in the secondary customer key authorization relationship, the smart card authentication is passed.

9. The smart card supply chain hierarchical management system according to claim 8, characterized in that: In step 3), when the smart card is a security control card, after the security control card is authenticated, the missing key key is obtained by using a set encryption algorithm according to the secondary customer root key and the business application code of the missing key key, and the key key is written or updated into the security control card; When the smart card is a user card, after the user card is authenticated, the missing key is obtained using a set encryption algorithm based on the secondary customer root key, the business application code of the missing key, and the unique number of the security control card used in conjunction with the user card, and the key is written or updated to the user card.

10. The smart card supply chain hierarchical management system according to claim 6, characterized in that: The universal encryption is implemented in any of the following ways: 1) the encryption key of each file of all applications in all smart cards is the same; 2) the encryption key of each file of all applications in each smart card is the same, but the encryption key of each smart card is different; 3) the encryption key of each smart card is different, and the encryption key of each file under each application in each smart card is different.

Images