TW201923641A - Method and device for generating dynamic credit card security code, bank card, and authentication method - Google Patents

Abstract

The invention provides a method for generating a dynamic credit card security code. The method comprise: a dynamic data element is obtained and the dynamic data element is used for replacing one partof a main account number PAN of a credit card to generate an updated main account number PAN; the updated main account number PAN is encrypted to obtain a first data block; and a dynamic credit card security code is generated based on the first data block. In addition, the invention also provides a device for generating a dynamic credit card security code, a bank card, and an authentication methodperformed by an authentication server of a card issuing bank. The calculation links of the generation algorithm are reduced; and the randomness of the calculation result is good.

Description

Method and device for generating dynamic credit card security code, bank card and authentication method

The present invention relates to the field of financial payments, and in particular, to a method and device for generating a dynamic credit card security code, a bank card, and an authentication method.

A credit security code (CVN2) is a set of 3-digit numbers on a credit card. The generation method is that the bank extracts the card account number, validity period, and service code, and arranges them through a series of complicated algorithms. After this number is generated, only the issuing bank and bank card holder know what the number is. The credit card security code is equivalent to the credit card's ID card, and consumers can use this code to make consumption transactions. Because the existing credit security code is printed on the back of the card number on the back of the credit card, it is easy for criminals to misappropriate the user's credit security code, resulting in theft of the user's credit card and poor security. In order to solve the above problems, VISA proposed a time-variable dynamic CVN2 solution, which solves the problem of poor transaction security to a certain extent. However, in the existing solutions, the DES / 3DES generation algorithm is usually used to generate the dynamic credit security code, and the calculation links are many and complicated. Therefore, an improved scheme for generating a dynamic credit card security code is desired. The information disclosed above in the background section of the present invention is only for the purpose of increasing the understanding of the general background of the present invention, and should not be taken as an acknowledgement or any form of suggestion that the information constitutes prior art that is already known to those of ordinary skill in the art.

In view of this, according to one aspect of the present invention, a method for generating a dynamic credit card security code is provided. The method includes: obtaining a dynamic data element, and replacing a part of the main account PAN of the credit card with the dynamic data element, thereby generating an update. Encrypting the updated primary account number PAN to obtain a first data block; and generating the dynamic credit card security code based on the first data block. Compared with the DES / 3DES generation algorithm, the present invention uses the national secret algorithm, which has fewer calculation links and has better randomness of the calculation result. In the above method, the dynamic data element is an event variable factor, so that the dynamic credit card security code changes based on the trigger of the event variable factor. In the above method, the event variable factor corresponds to the number of keystrokes accumulated to the current time after personalization or the number of card shakes after personalization. In the above method, the event variable factor is 8 digits, and when the number of key presses is less than 8 digits, the left side of the key press data is filled with a binary digit 0. In the above method, replacing a part of the credit card's main account number PAN with the dynamic data element to generate an updated main account number PAN includes replacing the leftmost 8-bit digits of the PAN with the dynamic data element. String to generate an updated master account PAN. In the above method, encrypting the updated master account PAN to obtain a first data block includes: concatenating the updated master account PAN, a card expiration date, and a service code in order to construct a first string; 0 is added to the right of the first string to expand the first string into a second data block of 256 bits; and encrypting the second data block by using a unique decentralized key to obtain the first A data block. In the above method, generating the dynamic credit card security code based on the first data block includes: selecting from 0 to 9 digits from left to right from the first data block and aligning the selected digits to the left to obtain A third data block; selecting A to F in hexadecimal from left to right from the first data block and converting it to decimal minus 10 to obtain a fourth data block; The data block is spliced to the right of the third data block to obtain a fifth data block; and the leftmost three digits of the fifth data block are selected as the dynamic credit card security code. In the above method, the dynamic data element is a time variable factor, and the time variable factor is determined based on a current time. According to another aspect of the present invention, a device for generating a dynamic credit card security code is provided. The device includes: obtaining means for obtaining a dynamic data element; and replacement means for replacing a main card of the credit card with the dynamic data element. A part of the account number PAN to generate an updated master account number PAN; an encryption device for encrypting the updated master account number PAN to obtain a first data block; and a generating device for generating a data block based on the first data block The dynamic credit card security code is described. In the above device, the replacement device is configured to replace the leftmost 8-bit digit construction string of the PAN with the dynamic data element, thereby generating an updated master account number PAN. In the above device, the encryption device includes: a concatenating unit for sequentially concatenating the updated master account number PAN, a card expiration date, and a service code to construct a first string; and an expansion unit for passing the Adding 0 to the right of the first string to expand the first string into a second data block of 256 bits; and an encryption unit for encrypting the second data block with a unique decentralized key, thereby The first data block is obtained. In the above device, the generating device is configured to select the digits from 0 to 9 from left to right from the first data block and align the selected digits to the left to obtain a third data block; from the first data block, From the data block, select A to F in hexadecimal from left to right and convert it to decimal and subtract 10 to obtain a fourth data block; stitch the fourth data block to the third data block To the right of the fifth data block, and selecting the leftmost three digits of the fifth data block as the dynamic credit card security code. In the above device, the dynamic data element is an event variable factor, so that the dynamic credit card security code changes based on the trigger of the event variable factor. According to yet another aspect of the present invention, a bank card is provided. The bank card includes: a display module including a display main control chip, wherein the display main control chip includes generating a dynamic credit card as described above. Security code device. In the above bank card, the display module further includes: a display medium; a battery for supplying power to the display medium and the display main control chip; a personalized antenna for writing card initialization parameters; and keys . According to another aspect of the present invention, there is provided an authentication method performed by a card issuing bank authentication server, the method comprising: receiving card information from a payment network, wherein the card information includes a card number, a validity period, and a dynamic credit card security code; Identifying the card as a dynamically variable card according to the master account PAN or the issuing bank identification code BIN, and routing the card information to a dynamically variable authentication system for authentication; and receiving an authentication result from the dynamically variable authentication system, said The authentication result includes whether the dynamic credit card security code falls within a window set by the dynamic variable authentication system. In the above authentication method, the dynamic variable authentication system uses a two-way time window for a time-variable dynamic variable card, and uses a one-way event window for a time-variable dynamic variable card. The technical solution of the present invention mainly uses a dynamically variable digital dCVN2 to replace the static CVN2 currently printed on the back of the bank card. The variable digital is generated based on the SM4 security algorithm and changes based on the triggering of the event variable factor (EBN). It can enhance the security of cardless payment (CNP) transactions and greatly reduce the possibility of fraud by intercepting and storing CVN2 values. Other features and advantages of the method and apparatus of the present invention will become clearer or clarified in more detail through the drawings incorporated herein and the specific embodiments that are subsequently used to illustrate certain principles of the present invention. .

The following description describes specific embodiments of the invention to teach those skilled in the art how to make and use the best mode of the invention. To teach the principles of the invention, some conventional aspects have been simplified or omitted. Those skilled in the art will understand that variations from these embodiments will fall within the scope of the invention. Those skilled in the art will appreciate that the features described below can be combined in various ways to form multiple variations of the invention. Therefore, the present invention is not limited to the specific embodiments described below, but is limited only by the scope of patent applications and their equivalents. In the context of the present invention, the term CVN2 represents a credit card security code, and dCVN2 or dynamic CVN2 represents a dynamic credit card security code, which changes based on the triggering of dynamic data elements. The dynamic data elements include time variable factor (TBN, Time Based Number) and event variable factor (EBN, Event Based Number). The term PAN refers to the main account number of the bank card, and indicates the card issuer and cardholder who can process the transaction. The term BIN refers to the issuing bank identification number, which is the Bank Identification Number. For the purposes of this application, "contactless" or "wireless" may include any method of communication or agreement, including proprietary agreements, in which data is exchanged between two devices without physical coupling. Without limiting the foregoing generality, "contactless" or "wireless" may include data transmission via laser, radio frequency, infrared communications, Bluetooth, or wireless local area network. For the purpose of this application, the term "payment service" may include any application used on a portable consumer device that causes data to be exchanged between the portable consumer device and any other device or location. It should be understood that "payment services" are not limited to financial applications. For the purpose of this application, "payment data" may include those data elements used by payment services to perform transactions for financial applications, and may include any required data elements other than the present invention for non-financial transactions. For example, when the payment service is a magnetic stripe credit card transaction, the "payment profile" may include magnetic track 1 and / or magnetic track 2 information, as understood by those skilled in the credit card industry, such as the main account number, validity period, service code, and data. The "payment profile" may also include a unique card identification number or a service provider's unique identification number. FIG. 1 shows a method 1000 for generating a dynamic credit card security code according to an embodiment of the present invention. In step 110, a dynamic data element is obtained; in step 120, a part of the credit card's main account PAN is replaced with the dynamic data element, thereby generating an updated main account PAN; in step 130, the updated The primary account PAN is encrypted to obtain a first data block; In step 140, the dynamic credit card security code is generated based on the first data block.方法 In method 1000, the dynamic data element may be an event variable factor or a time variable factor. In one embodiment, the dynamic data element is an event variable factor, so that the dynamic credit card security code changes based on the triggering of the event variable factor. In one embodiment, the event variable factor corresponds to the number of keystrokes accumulated to the current number of times after personalization or the number of card shakes after personalization. If the data is less than 8 digits, it is padded to the 8 digits with a binary digit 0 to the left as the TBN. In another embodiment, the dynamic data element is a time variable factor, and the time variable factor is determined based on a current time. For example, the time variable factor (TBN) is a time-based value that is derived based on the following 3 steps: (1) determining the current time expressed in seconds from 00:00:00 on January 1, 1970, Universal Coordination Time; (2) Divide the time obtained in step 1 by the time window value. The time window value is the value expressed in seconds on the chip by the tag 9F5F personalization; (3) The data obtained in step 2 after the decimal point is removed to obtain 8 cn-type data. If the data is less than 8 digits, then 8 digits are truncated from the left as the TBN.一个 In one embodiment, step 120 may include: replacing the leftmost 8-bit digits of the PAN with the dynamic data element to construct a string, thereby generating an updated master account number PAN. In one embodiment, step 130 may include: concatenating the updated main account number PAN, card expiration date, and service code in order to construct a first string; by adding 0 to the right of the first string, The first string is expanded into a second data block of 256 bits; and the second data block is encrypted by using a unique distributed key to obtain the first data block. In one embodiment, step 140 may include: selecting from 0 to 9 digits from left to right from the first data block and aligning the selected digits to the left to obtain a third data block; from the first data block From the data block, select A to F in hexadecimal from left to right and convert it to decimal and subtract 10 to obtain a fourth data block; stitch the fourth data block to the third data block To the right of the fifth data block, and selecting the leftmost three digits of the fifth data block as the dynamic credit card security code. Referring to FIG. 2, FIG. 2 shows an apparatus 2000 for generating a dynamic credit card security code according to an embodiment of the present invention. (2) As shown in FIG. 2, the device 2000 may include an obtaining device 210, a replacement device 220, an encryption device 230, and a generating device 240. In the device 2000, the obtaining device 210 is configured to obtain a dynamic data element. The replacement device 220 is configured to replace a part of the main account PAN of the credit card with the dynamic data element, thereby generating an updated main account PAN. The encryption device 230 is configured to encrypt the updated master account PAN to obtain a first data block. The generating device 240 is configured to generate the dynamic credit card security code based on the first data block.一个 In one embodiment, the replacement device 220 is configured to replace the leftmost 8-bit digit construction string of the PAN with the dynamic data element, thereby generating an updated master account number PAN. In one embodiment, the encryption device 230 further includes: a concatenating unit for concatenating the updated main account number PAN, a card expiration date, and a service code in order to construct a first string; and an expansion unit for passing the 0 is added to the right of the first string to expand the first string into a second data block of 256 bits; and an encryption unit for encrypting the second data block using a unique decentralized key, Thereby, the first data block is obtained. In one embodiment, the generating device 240 is configured to select the digits from 0 to 9 from left to right from the first data block and align the selected digits to the left to obtain a third data block; from the first data block, From the data block, select A to F in hexadecimal from left to right and convert it to decimal and subtract 10 to obtain a fourth data block; stitch the fourth data block to the third data block To the right of the fifth data block, and selecting the leftmost three digits of the fifth data block as the dynamic credit card security code. Referring to FIG. 3, it shows a bank card display module according to an embodiment of the present invention. In one embodiment of the present invention, the bank card may include a display module, and the display module includes a display main control chip, a display medium, a personalized antenna, a battery, and a button (optional). Display media can use e-paper, LCD and other technologies. The battery powers the display medium and the main control chip to calculate dCVN2 and display it. The personalized antenna is used to write some parameters initialized in the card (such as the dynamic CVN2 part). In one embodiment, in the case of dCVN2 generated based on an event variable factor, the display module must include a key for generating an event variable factor EBN based on the number of keys accumulated to the current number of keys after personalization. In another embodiment, when the dCVN2 is generated based on a time variable factor, the display module may not include a button. Whenever the payment service is started, dCVN2 is generated on the portable consumer device for authentication purposes. Figure 4 depicts a method for generating dCVN2 for each transaction according to the present invention. Initially, the leftmost 8-bit digits of the PAN are replaced with TBN or EBN to construct a string, which is recorded as a new PAN. Next, connect the new PAN, card expiration date, and service code from left to right to build a string. Then, put the string in the 256-bit data column and pad 0 to the right to get BlockA. UDK (Unique Distributed Key, Unique Derivation Key) is used to encrypt BlockA to get BlockG. In BlockG, select the numbers from 0 to 9 from left to right and align them to the left to get BlockH. In BlockG, select A to F in hexadecimal from left to right, and then convert each to decimal and subtract 10 to get BlockI. BlockI is spliced to the right of BlockH to get BlockJ. In the end, dCVN2 was chosen as the three leftmost digits of BlockJ. Referring to FIG. 5, FIG. 5 schematically illustrates an authentication process of a dCVN2 bank card according to an embodiment of the present invention. In one embodiment, the card information (card number, expiration date, and dCVN2) is submitted to the card issuer authentication server through the payment network when there is no card transaction. The issuing bank authentication server identifies the card as a dCVN2 bank card according to the PAN or BIN, and routes the authentication request to the dCVN2 authentication system. The dCVN2 authentication system calculates dCVN2 based on its configuration and compares it with the dCVN2 submitted by the card. The comparison result is then returned to the issuing bank authentication server. Finally, the issuing bank's authentication server approves / denies the transaction and informs the payment requester. The basic authentication principle of dCVN2 is to complete the entire authentication process by comparing dCVN2 with the same calculation factor and the same calculation method by the user and the authentication service provider. Generally, the comparison of dCVN2 is completed by the authentication service provider. As long as the dCVN2 value calculated in the card falls within the set of dCVN2 values in the setting window of the background authentication server, the authentication is passed. Dynamic CVN2 bank card synchronization with the system. For dCVN2 bank cards with variable time, background authentication uses a two-way time window; for dCVN2 bank cards with variable events, one-way event windows. In summary, the present invention implements CVN 2-bit dynamic display based on a variety of variable factors and algorithms to ensure the security of transactions. In addition, in the embodiment of the present invention, the function module for generating / displaying dCVN2 in the bank card is independent. When the dCVN2 function cannot be used normally, other functions of the bank card should continue to be used normally. The national secret algorithm used in the present invention has fewer calculation links, and the randomness of the calculation result is better than the DES / 3DES international algorithm. The above examples mainly illustrate the method and device for generating a dynamic credit card security code, the bank card and the authentication system architecture of the present invention. Although only some of the specific embodiments of the present invention have been described, those of ordinary skill in the art should understand that the present invention can be implemented in many other forms without departing from the spirit and scope thereof. Therefore, the illustrated examples and implementations are to be regarded as illustrative rather than restrictive, and the present invention may cover various modifications without departing from the spirit and scope of the present invention as defined by the scope of the appended patent applications. With replacement.

1000‧‧‧Method for generating dynamic credit card security code

110-140‧‧‧step

2000‧‧‧ Device for generating dynamic credit card security code

210‧‧‧ Get Device

220‧‧‧ Replacement device

230‧‧‧ encryption device

240‧‧‧ generating device

Fig. 1 shows a method for generating a dynamic credit card security code according to an embodiment of the present invention; Fig. 2 shows a device for generating a dynamic credit card security code according to an embodiment of the present invention; Fig. 3 is a bank showing an embodiment of the present invention Card display module; FIG. 4 is a flowchart of dCVN2 generation based on an SM4 algorithm according to an embodiment of the present invention; and FIG. 5 schematically illustrates a dCVN2 bank card authentication process according to an embodiment of the present invention .

Claims (17)

A method for generating a dynamic credit card security code, characterized in that the method includes: obtaining dynamic data elements, 替换 replacing a part of the credit card's main account PAN with the dynamic data elements, thereby generating an updated main account PAN; The updated master account PAN is encrypted to obtain a first data block; and the dynamic credit card security code is generated based on the first data block. The method according to claim 1, wherein the dynamic data element is an event variable factor, so that the dynamic credit card security code changes based on a trigger of the event variable factor. The method according to claim 2, wherein the event variable factor corresponds to the number of keystrokes accumulated to the current time after personalization or the number of card shakes after personalization. The method according to claim 3, wherein the variable factor of the event is an 8-digit number, and when the number of key presses is less than 8-digits, a binary number word is used to the left of the data of the key presses. 0 padding. The method according to claim 1, wherein replacing a part of the credit card's main account PAN with the dynamic data element to generate an updated main account PAN includes: 替换 replacing the leftmost part of the PAN with the dynamic data element 8-bit digitally constructed string to generate an updated master account number PAN. The method according to claim 1, wherein encrypting the updated master account PAN to obtain a first data block includes: sequentially connecting the updated master account PAN, a card expiration date, and a service code to construct a first A string; ； expanding the first string into a second data block of 256 bits by adding 0 to the right of the first string; and encrypting the second data block using a unique decentralized key To obtain the first data block. The method according to claim 1, wherein generating the dynamic credit card security code based on the first data block comprises: 选 selecting from 0 to 9 digits from left to right from the first data block and selecting the selected digits Align left to get the third data block; 选 Select from A to F in hexadecimal from the first data block from left to right and convert it to decimal minus 10 to get the fourth data block Stitching the fourth data block to the right of the third data block to obtain a fifth data block; and selecting the leftmost three digits of the fifth data block as the dynamic credit card security code. The method according to claim 1, wherein the dynamic data element is a time variable factor, and the time variable factor is determined based on a current time. A device for generating a dynamic credit card security code, characterized in that the device includes: (i) an acquisition device for acquiring a dynamic data element, and (ii) a replacement device for replacing a part of a main account PAN of the credit card with the dynamic data element, Thereby generating an updated master account number PAN; an encryption device for encrypting the updated master account number PAN to obtain a first data block; and a generating device for generating the dynamic credit card security code based on the first data block . The device according to claim 9, wherein the replacing means is configured to replace the leftmost 8-bit digit construction string of the PAN with the dynamic data element, thereby generating an updated master account number PAN. The device according to claim 9, wherein the encryption device comprises: a concatenating unit for sequentially concatenating the updated master account PAN, a card expiration date, and a service code to construct a first string; an expansion unit For expanding the first string into a second data block of 256 bits by adding 0 to the right of the first string; and an encryption unit for using a unique decentralized key to pair the second data block The data block is encrypted to obtain the first data block. The device according to claim 9, wherein the generating means is configured to select the digits from 0 to 9 from left to right from the first data block and align the selected digits to the left to obtain a third data block ; Select A to F in hexadecimal from left to right in the first data block, and convert it to decimal and subtract 10 to obtain a fourth data block; stitch the fourth data block to A fifth data block is obtained on the right side of the third data block; and the leftmost three digits of the fifth data block are selected as the dynamic credit card security code. The device according to claim 9, wherein the dynamic data element is an event variable factor, so that the dynamic credit card security code changes based on the trigger of the event variable factor. A bank card, characterized in that the bank card includes: a display module, the display module includes a display master chip, wherein the display master chip includes the one described in any one of claims 9 to 13 A device that generates a dynamic credit card security code. The bank card according to claim 14, wherein the display module further comprises: a display medium; a battery for supplying power to the display medium and the display main control chip; a personalized antenna for writing Card initialization parameters; and keys. An authentication method performed by a card issuing bank authentication server, characterized in that the method includes: receiving card information from a payment network, wherein the card information includes a card number, expiration date, and a dynamic credit card security code; according to the main account number PAN or The issuing bank identification code BIN identifies the card as a dynamically variable card, and routes the card information to a dynamically variable authentication system for authentication; and receives an authentication result from the dynamically variable authentication system, the authentication result including the Whether the dynamic credit card security code falls within a window set by the dynamic variable authentication system. The authentication method according to claim 16, wherein the dynamically variable authentication system uses a two-way time window for a time-variable dynamically variable card, and uses a one-way event window for a time-variable dynamically variable card.