CN106779703B

CN106779703B - Dynamic realization method and device for centralized management of bank card key

Info

Publication number: CN106779703B
Application number: CN201611068714.1A
Authority: CN
Inventors: 冯春阳; 冯冠杰; 许海洋
Original assignee: Bank of China Ltd
Current assignee: Bank of China Ltd
Priority date: 2016-11-29
Filing date: 2016-11-29
Publication date: 2020-10-27
Anticipated expiration: 2036-11-29
Also published as: CN106779703A

Abstract

The invention relates to a dynamic realization method and a dynamic realization device for centralized management of a bank card key, wherein the method comprises the following steps: acquiring a bank card number when using the bank card for transaction; acquiring an encryption key identification bit corresponding to the current card according to the bank card number, and determining the type of an encryption key by using the encryption key identification bit; if the encryption key type is distributed key encryption, the PINBLOCK corresponding to the bank card number and the distributed key are used for verifying the encryption; after the verification is successful, obtaining a new key, and generating a new PINOFFSET according to the new key and the PINBLock corresponding to the bank card number; and updating the PINOFFSET of the current card by using the new PINOFFSET, modifying the encryption key identification bit of the current card into a centralized key type, and replacing the distributed key of the current card with a centralized key.

Description

Dynamic realization method and device for centralized management of bank card key

Technical Field

The invention relates to the technical field of bank information security, in particular to a dynamic implementation method and a dynamic implementation device for bank card key centralized management based on an online mode.

Background

The bank card password is an important way for a bank system to verify the authenticity of the identity of a client. In the plaintext bank card password input by the client, the bank system generally adopts a hard encryption mode to generate a PINOFFSET ciphertext for storage so as to ensure the security of the client password without leakage.

Multiple systems of a bank may need to exchange conventions in advance ZPK if customer PIN transmission is involved. When the client inputs and sets the bank card plaintext PIN, the upstream front-end system generates ZPK encrypted PINBLock and transmits the PINBLock to the downstream back-end system, and the bank back-end system converts ZPK encrypted PINBLock ciphertext into PVK encrypted PINOFFSET ciphertext data and stores the PINBLock ciphertext data in a database. When the customer transaction inputs the password, the bank background system sends the received ZPK encrypted PINBLOK ciphertext, PVK and PINOFFSET ciphertext in the database to the encryption machine for hard encryption verification, and if the received PINBLOK ciphertext and PVK are consistent, the verification is successful. In the process, the client password authentication is realized through the hardware logic of the encryption machine, and the password plaintext cannot appear outside the hardware of the encryption machine, so that the security of the client password is ensured.

In the process of centralized management of the bank card key, because the bank cards in stock are PINOFFSET generated according to the previous dispersed key, the direct key replacement can cause that the bank cards in stock cannot carry out secret verification; therefore, in order to verify the encryption of all the bank cards after the key set, a special tool needs to be developed, the encryption machine is called to calculate the PINBLOCK by the PINOFFSET according to the previous dispersed key, and then a new PINOFFSET is generated according to the new centralized key. Due to the fact that the quantity of the card stocks is large, updating of the secret key cannot be completed in a short time, the switching window of the system is increased, and the production risk of the system is increased.

Disclosure of Invention

The embodiment of the invention mainly aims to construct a dynamic realization method and a dynamic realization device for the centralized management of bank card keys based on an online mode, abandons the mode of replacing all stock bank cards by keys at one time, adopts the online mode to replace a batch tool conversion mode, and replaces the card keys when a client carries out online transaction of the bank cards.

In order to achieve the above object, the present invention provides a dynamic implementation method for centralized management of bank card keys, which comprises:

acquiring a bank card number when using the bank card for transaction;

acquiring an encryption key identification bit corresponding to the current card according to the bank card number, and determining the type of an encryption key by using the encryption key identification bit;

if the encryption key type is distributed key encryption, the PINBLOCK corresponding to the bank card number and the distributed key are used for verifying the encryption;

after the verification is successful, obtaining a new key, and generating a new PINOFFSET according to the new key and the PINBLock corresponding to the bank card number; and updating the PINOFFSET of the current card by using the new PINOFFSET, modifying the encryption key identification bit of the current card into a centralized key type, and replacing the distributed key of the current card with a centralized key.

Optionally, in an embodiment of the present invention, the method further includes:

if the encryption key type is centralized key encryption, verifying the centralized key corresponding to the bank card number;

and after the password verification is successful, executing the bank card transaction.

Optionally, in an embodiment of the present invention, the bank card number is obtained when a transaction password is input to perform a bank card transaction.

and storing the distributed key and the centralized key of the bank card.

In order to achieve the above object, the present invention further provides a dynamic implementation apparatus for centralized management of bank card keys, including:

the bank card number acquisition unit is used for acquiring a bank card number when using the bank card for transaction;

the encryption key type determining unit is used for acquiring an encryption key identification bit corresponding to the current card according to the bank card number and determining the encryption key type by using the encryption key identification bit;

the first encryption verification unit is used for verifying the encryption by using the PINBLock and the distributed key corresponding to the bank card number if the encryption key type is the distributed key encryption;

the key replacing unit is used for obtaining a new key after the verification of the encryption is successful, and generating a new PINOFFSET according to the new key and the PINBLock corresponding to the bank card number; and updating the PINOFFSET of the current card by using the new PINOFFSET, modifying the encryption key identification bit of the current card into a centralized key type, and replacing the distributed key of the current card with a centralized key.

the second encryption unit is used for verifying the encryption of the concentrated secret key corresponding to the bank card number if the encryption secret key type is the concentrated secret key encryption;

and the transaction unit is used for executing the bank card transaction after the password verification is successful.

Optionally, in an embodiment of the present invention, the bank card number obtaining unit obtains the bank card number when the transaction password is input to perform the bank card transaction.

and the storage unit is used for storing the dispersed key and the centralized key of the bank card.

The technical scheme has the following beneficial effects:

the technical scheme can reduce development cost, complete key centralized work on simple key data migration and optimization of the current password verification and production module, and does not need to develop new tool operation data and encryption machines again.

Meanwhile, the technical scheme shortens the switching time window of key concentration, disperses the unified switching keys into the normal online transaction of the system, ensures the stable transition of the switching system and reduces the risk of system failure.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a block diagram of a dynamic implementation apparatus for centralized management of bank card keys according to an embodiment of the present invention;

fig. 2 is a flowchart of a dynamic implementation method for centralized management of bank card keys according to an embodiment of the present invention;

fig. 3 is a flowchart of the operation of the present embodiment.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

As will be appreciated by one skilled in the art, embodiments of the present invention may be embodied as a system, apparatus, device, method, or computer program product. Accordingly, the present disclosure may be embodied in the form of: entirely hardware, entirely software (including firmware, resident software, micro-code, etc.), or a combination of hardware and software.

According to the embodiment of the invention, an application layer depth detection method and device for extending a firewall and electronic equipment are provided.

In this context, it is to be understood that, in the terms referred to:

1. PIN: personal Identification Number, i.e., the client Personal password.

2. ZPK: a working key is used for encrypting a client clear text PIN to be transmitted between two communication systems.

3. PVK: the PIN Verification Key, i.e., the PIN Verification Key, is used to generate PINOFFSET and to verify the PIN.

4. PINBLOCK: pinlock currently uses mainly the standard ANSI x9.8format (with primary account number information) format, i.e., blocks of data obtained by bitwise xoring of a customer's plaintext PIN against a primary account number. The bank system generally uses a PINBLOCK cipher block encrypted by a key ZPK for a clear text PIN input by a client in the interactive transmission process.

5. PINOFFSET: the actual storage form of the clear text PIN of the bank account number input by the client in the bank system is shown. The bank system converts the received ZPK encrypted pinlock into PVK encrypted PIN cipher, PINOFFSET, and stores it in the bank system database.

Moreover, any number of elements in the drawings are by way of example and not by way of limitation, and any nomenclature is used solely for differentiation and not by way of limitation.

The principles and spirit of the present invention are explained in detail below with reference to several representative embodiments of the invention.

Summary of The Invention

Because of the technical limitation, background systems widely adopted by banks are all scattered subsystems, the condition that a plurality of keys are used nationwide or even in one province often appears in key management, and in order to enhance the safety and facilitate the management and maintenance, each bank carries out large centralization of background core systems, wherein the centralized management of the keys is included; the key centralizing process needs to uniformly replace a plurality of keys which are dispersedly managed by the bank into a centralized key. As an important part in a bank system, the verification processing of the bank card and the change of the key relate to the update of the data of the bank card with mass storage in the bank system, and the workload and the risk are large.

The prior art mainly has the following problems:

1. the cost is high; updating all the memory card encryption modes at one time requires a special batch conversion tool, an encryption machine is called to replace an encryption key, and the tool needs development cost.

2. Efficiency problems; the key updating for the bank card with the large bank stock at one time needs a lot of time, which can increase the time of the key switching window.

3. A risk issue; in the key switching process, once the switching fails, the PINOFFSET encrypted by the old key may be lost, which may cause the client to fail to verify the encryption later, and seriously affects the client experience; and the increase of the key switching window time also brings system risks.

Aiming at the problems, the scheme provides a dynamic realization method for the centralized management of the key of the bank card, an online mode is used for replacing a batch conversion mode, the encryption key and the encryption algorithm of the bank card are gradually modified in a production environment, and the system pressure of the key centralized management is dispersed to a long-term process, so that the centralized management of the existing distributed key is stably, safely and gradually realized.

Principle of operation

The scheme realizes the compatibility of the bank background system to a plurality of keys and a plurality of encryption modes, when a customer inputs a bank card password to carry out transaction, the bank background system carries out encryption verification according to an old encryption method and an old dispersed key corresponding to the current bank card, once the encryption verification is passed, encryption conversion operation is carried out according to PINBLOCK sent on line, and the bank card is dynamically updated into a large concentrated new key identification, thereby realizing the key centralized management of the bank card stored in quantity. In the process, the client does not feel the influence caused by the centralized management of the bank background key.

In the process of on-line transaction of a client, the bank cards of the stock are gradually updated from scattered key management to a uniform large centralized key, and the collection management of the key are smoothly realized.

Having described the general principles of the invention, various non-limiting embodiments of the invention are described in detail below.

Exemplary devices

In conjunction with the working principle of the present application, the device according to an exemplary embodiment of the present invention will be described with reference to fig. 1.

Referring to fig. 1, a block diagram of a dynamic implementation apparatus for centralized management of bank card keys according to an embodiment of the present invention is provided. The method comprises the following steps:

a bank card number obtaining unit 101 for obtaining a bank card number when a transaction is performed using the bank card;

in this embodiment, the bank card number obtaining unit obtains the bank card number when inputting the transaction password to perform the bank card transaction.

An encryption key type determining unit 102, configured to obtain an encryption key identification bit corresponding to a current card according to the bank card number, and determine an encryption key type by using the encryption key identification bit;

the first encryption verification unit 103 is configured to verify the encryption by using the pinlock and the distributed key corresponding to the bank card number if the encryption key type is distributed key encryption;

the key replacing unit 104 is used for obtaining a new key after the verification of the encryption is successful, and generating a new PINOFFSET according to the new key and the PINBLOK corresponding to the bank card number; and updating the PINOFFSET of the current card by using the new PINOFFSET, modifying the encryption key identification bit of the current card into a centralized key type, and replacing the distributed key of the current card with a centralized key.

On the basis of fig. 1, the device further comprises:

In the technical scheme, the first encryption checking module and the second encryption checking module jointly form an encryption checking module, the encryption checking module is compatible with various keys for checking encryption, the type of an encryption key can be inquired and judged according to a card number, a corresponding encryption key is selected according to the type of the encryption key for checking the encryption, and the key replacing unit can use a PINBLock and a centralized key which are sent on line to update PINOFFSET; the client calls the encryption unit when inputting the password, and if the encryption passes and the encryption key is the distributed key, the key exchange unit is called to exchange the encryption key of the current card from the old distributed key to the centralized key.

It will be understood by those skilled in the art that all or part of the processes of the methods of the above embodiments may be implemented by a computer program, which can be stored in a general computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. The storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), or the like.

Those skilled in the art will also appreciate that the various functions performed in the exemplary embodiments of the present invention are implemented as hardware or software, depending upon the particular application and design requirements of the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present embodiments.

Furthermore, although several units of the apparatus are mentioned in the above detailed description, such division is not mandatory only. Indeed, the features and functions of two or more of the units described above may be embodied in one unit, according to embodiments of the invention. Also, the features and functions of one unit described above may be further divided into embodiments by a plurality of units.

Exemplary method

Having described the apparatus of an exemplary embodiment of the present invention, the method of an exemplary embodiment of the present invention is next described with reference to fig. 2.

As shown in fig. 2, a flowchart of a dynamic implementation method for centralized management of bank card keys is provided in an embodiment of the present invention. The method comprises the following steps:

step 201): acquiring a bank card number when using the bank card for transaction;

in this embodiment, the bank card number is obtained when the transaction password is input to perform a bank card transaction.

Step 202): acquiring an encryption key identification bit corresponding to the current card according to the bank card number, and determining the type of an encryption key by using the encryption key identification bit;

step 203): if the encryption key type is distributed key encryption, the PINBLOCK corresponding to the bank card number and the distributed key are used for verifying the encryption;

step 204): after the verification is successful, obtaining a new key, and generating a new PINOFFSET according to the new key and the PINBLock corresponding to the bank card number; and updating the PINOFFSET of the current card by using the new PINOFFSET, modifying the encryption key identification bit of the current card into a centralized key type, and replacing the distributed key of the current card with a centralized key.

In the technical scheme, the distributed key and the centralized key of the bank card are stored.

On the basis of fig. 2, the method further includes:

From the above description, the cryptographic technology of the technical scheme is compatible with multiple cryptographic systems, the encryption machine can be called according to the corresponding encryption mode and the key to perform accurate cryptographic verification on the PINBLOCK sent upwards, and the PIN OFFSET can be regenerated according to the centralized key after the password generated by the distributed key is verified to be correct in an online mode.

An embodiment of the present invention further provides a computer-readable program, where when the program is executed in an electronic device, the program enables a computer to execute the dynamic implementation method for centralized management of a bank card key in the electronic device as shown in fig. 2.

An embodiment of the present invention further provides a storage medium storing a computer-readable program, where the computer-readable program enables a computer to execute the dynamic implementation method for centralized management of bank card keys in an electronic device as shown in fig. 2.

It should be noted that while the operations of the method of the present invention are depicted in the drawings in a particular order, this does not require or imply that the operations must be performed in this particular order, or that all of the illustrated operations must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions.

Examples

In order to more intuitively describe the features and the operation principle of the present invention, the following description is given with reference to a practical application scenario.

Fig. 3 is a flowchart illustrating the operation of the present embodiment. In practice, for a customer password of a bank card, a bank background system mainly stores a PIN OFFSET ciphertext; meanwhile, the bank background system also stores ZPK, a plurality of scattered subsystems PVKs, a large centralized PVK and other system work keys. In the key centralizing process, the integrated bank background system sets an identification bit for each bank card on the basis of storing the PINOFFSET of each bank card, and marks the encryption key type of the current bank card.

For the bank background system after key centralized management, when a customer uses a bank card for transaction for the first time and inputs a password, the bank front-end upstream system sends ZPK encrypted PINBLock to the bank background system; the bank background system queries a database according to the obtained card number to obtain an encryption key type corresponding to the current card; because the customer uses the bank card after the key is integrated in a centralized way for the first time, the current encryption mode is still the key encryption of the distributed key system, and the returned key type is also the initial value, namely the distributed key encryption; at the moment, the background judges which subsystem the current card is before the key encryption according to the card number, and takes out the corresponding key from the database; and then the system sends the uploaded PINBUCK and the extracted corresponding key to the encryption machine, and the encryption machine returns a verification result. Therefore, the system realizes compatibility to a plurality of key verification modes.

After the online verification result of the bank card is returned, if the online verification result of the bank card is successful and the card key type is a dispersed key, the bank background system can perform encryption conversion operation on the current card password, and according to the PINBLOCK sent upwards and a new large centralized key, the encryption is sent to an encryption machine to process and generate a new PINOFFSET, and the function can be realized by simply modifying the existing key generation hardware by using a software multiplexing technology; and then the bank background system can cover the original PIN OFFSET recorded by the current card in the database with the new PINOFFFSET, and meanwhile, the encryption key identification bit of the modified card is of a large centralized key type. And finally, executing the transaction.

If the customer does not use the bank card for the first transaction, when the password is input, the bank front-end upstream system sends ZPK encrypted PINBLock to the bank background system; the bank background system queries a database according to the obtained card number to obtain an encryption key type corresponding to the current card; because the customer does not use the bank card after the key is integrated in the key set for the first time, the current encryption mode is determined as the key encryption of the key set system according to the identification position. And taking out the corresponding centralized key from the database, inputting the key into the encryption machine, and returning a secret verification result by the encryption machine.

And after the online password verification result of the bank card is returned, if the password verification result of the bank card is successful, directly executing the transaction.

Through the above operations, the encryption key of the current bank card completes dynamic migration from the distributed key of the old key system to the centralized key of the new key system; when the customer uses the bank card again and verifies the secret, the system identifies that the current card is encrypted by the centralized secret key, and then the secret is verified by using the centralized secret key according to the centralized secret key system, so that the use of the scattered secret key is completely separated.

With the operation of the new centralized key system, the data encrypted by using the dispersed keys in the bank card stock is gradually reduced, and the key centralized management of the bank system is automatically and smoothly realized.

The technical scheme does not need batch tools, and the development cost is reduced; meanwhile, the whole is divided into parts, so that the problem of overlong window switching time is avoided; the customer sends the PINBLOCK during the transaction, and a special encryption machine instruction is not required to be added to support the inverse calculation of the PINBLOCK, so that the key switching is safer.

The above embodiments are provided to further explain the objects, technical solutions and advantages of the present invention in detail, it should be understood that the above embodiments are merely exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalents, improvements, etc. made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims

1. A dynamic realization method for centralized management of bank card keys is characterized by comprising the following steps:

acquiring a bank card number when using the bank card for transaction;

acquiring an encryption key identification bit corresponding to the current card according to the bank card number, and determining the type of an encryption key by using the encryption key identification bit; wherein the encryption key type is distributed key encryption or centralized key encryption;

after the verification is successful, obtaining a new key, and generating a new PINOFFSET according to the new key and the PINBLock corresponding to the bank card number; updating the PINOFFSET of the current card by using the new PINOFFSET, modifying the encryption key identification bit of the current card into a centralized key type, and replacing the distributed key of the current card with a centralized key;

2. The method of claim 1, wherein the bank card number is obtained upon entry of a transaction password for a bank card transaction.

3. The method of claim 1, further comprising:

and storing the distributed key and the centralized key of the bank card.

4. A dynamic implementation device for centralized management of bank card keys is characterized by comprising:

the encryption key type determining unit is used for acquiring an encryption key identification bit corresponding to the current card according to the bank card number and determining the encryption key type by using the encryption key identification bit; wherein the encryption key type is distributed key encryption or centralized key encryption;

the key conversion unit is used for obtaining a new key after the verification of the encryption is successful, and generating a new PINOFFSET according to the new key and the PINBLock corresponding to the bank card number; updating the PINOFFSET of the current card by using the new PINOFFSET, modifying the encryption key identification bit of the current card into a centralized key type, and replacing the distributed key of the current card with a centralized key;

5. The apparatus of claim 4, wherein the bank card number obtaining unit obtains the bank card number when entering a transaction password to conduct a bank card transaction.

6. The apparatus of claim 4, further comprising: