TWI668646B - Data processing system and method for multiple POS terminals - Google Patents

Abstract

The present invention relates generally to data processing and, more particularly, to a data processing system and method for a plurality of POS terminals. In a data processing system for a plurality of POS terminals according to an embodiment of the present invention, the plurality of POS terminals are assigned respective unique first master keys for an application user capable of running on the plurality of POS terminals End, which is assigned a common second master key, and the data processing system includes: a communication unit configured to communicate with the plurality of POS terminals; and a processing unit coupled to the communication unit configured to execute An operation associated with the application client, the operation including a check-in process, a connection transaction process, and a batch settlement transaction process, wherein the data involved in the connection transaction processing is based at the POS terminal by the first master The first working key of the key encryption is processed and processed at the processing unit based on the second work key encrypted by the second primary key.

Description

Data processing system and method for multiple POS terminals

The present invention relates generally to data processing and, more particularly, to a data processing system and method for a plurality of POS (Point of Sale) terminals.

In the traditional POS industry, before the terminal is placed in the merchant, the POS terminal specialization service or the acquiring institution needs to manually use the parent POS to the PIN terminal of the POS terminal to fill in the terminal master key, wherein the terminal master key ( TMK) is unique to each POS terminal. Each POS terminal and the connection transaction system share a unique terminal master key, and the connection transaction system calls the encryption machine to randomly generate a PIK (Personal Identification Number Key) code and a MAK (Media Access Control Key). A media access control key) code in which both the PIK code and the MAK code are encrypted in TMK. The PIK code is stored in a PIN pad (PIN PAD) for encrypting a user password such as a personal identification number (PIN), which is used for message authentication (MAC). In the process of connecting transactions, in order to prevent the PIN from being leaked or cracked, it is required to securely encrypt the PIN during the entire information interaction process from the terminal to the issuing bank, and the PIN is not allowed to be in any part of the computer and the network system. The form appears.

As businesses become more prosperous and developed, POS terminals are becoming more widely used. However, the prior art POS terminal has the following disadvantages:

(1) Hardware maintenance costs are high. Usually, a merchant's counter needs to be equipped with multiple POS terminals and corresponding password keyboards, which wastes hardware resources and maintenance costs.

(2) Difficulties in promoting new business. Whenever there is a new business that needs to be promoted, it is necessary to re-burn the POS program and password keyboard filling. For a single business, it is necessary to apply for multiple sets of data nationwide, and the investment is large, and the promotion progress is slow.

It is an object of the present invention to provide a data processing system for a plurality of POS terminals that provides good scalability for new services in an efficient, low cost manner.

In a data processing system for a plurality of POS terminals according to an embodiment of the present invention, the plurality of POS terminals are assigned respective unique first master keys for an application user capable of running on the plurality of POS terminals End, which is assigned a common second master key, and the data processing system includes: a communication unit configured to communicate with the plurality of POS terminals; and a processing unit coupled to the communication unit configured to execute An operation associated with the application client, the operation including a check-in process, a connection transaction process, and a batch settlement transaction process, wherein the data involved in the connection transaction processing is based at the POS terminal by the first master The first working key of the key encryption is processed and processed at the processing unit based on the second work key encrypted by the second primary key.

Preferably, in the above data processing system, the first work key comprises a first PIK code used by the cryptographic keyboard to encrypt the user password and a first MAK code used for message authentication, and the second work gold The key contains a second PIK code used by the processing unit to encrypt the user password and a second MAK code for message authentication.

Preferably, in the above data processing system, the processing unit includes an application terminal specially equipped for the application client to perform the operation.

Preferably, in the above data processing system, the processing unit performs check-in processing in the following manner: when one of the plurality of POS terminals initiates a check-in request to the data processing system for the application client, the first The first work key encrypted by the primary key and returned to the POS terminal that initiated the check-in request, and the first work-entry request for the application client, and the second work encrypted by the second primary key Key.

Preferably, in the above data processing system, the processing unit performs a connection transaction process in the following manner: when one of the plurality of POS terminals initiates a connection transaction processing request to the data processing system by the application client, The connection transaction processing request performs legality verification, and after the legality verification is passed, the user password encrypted by the first PIK code is converted into a user password encrypted by the second PIK code for processing by calling a hardware encryption machine. The data involved in the connection transaction processing.

Preferably, in the above data processing system, the processing unit performs batch settlement transaction processing in the following manner: When one of the plurality of POS terminals initiates a batch settlement transaction processing request to the data processing system for the application client, the first work key and the second work key saved in the processing unit are cleared.

Preferably, in the above data processing system, each POS terminal has a unique device identifier, the application client has a unique application identifier, and the processing unit identifies the device included in the connection transaction processing request by The token and the application identifier are compared to a predetermined association to perform legality verification.

Another object of the present invention is to provide a data processing method for a plurality of POS terminals that can provide good scalability for new services in an efficient and low-cost manner.

A data processing method for a plurality of POS terminals according to an embodiment of the present invention includes the steps of: assigning a plurality of POS terminals with respective unique first master keys; and being an application client capable of running on a plurality of POS terminals Assigning a common second master key; performing operations associated with the application client, the operations including check-in processing, connection transaction processing, and batch settlement transaction processing, wherein the data involved in the connection transaction processing is The POS terminal is processed at the processing unit based on the first work key encrypted by the first master key and based on the second work key encrypted by the second master key.

10‧‧‧Data processing system for multiple POS terminals

110‧‧‧Communication unit

120‧‧‧Processing unit

121A‧‧‧Application terminal

121B‧‧‧Application terminal

21‧‧‧POS terminal

A‧‧‧Application client

B‧‧‧Application client

22‧‧‧POS terminal

A‧‧‧Application client

B‧‧‧Application client

30‧‧‧ acquiring platform

40‧‧‧ hardware encryption machine

S210-S530‧‧‧Steps

A more detailed description of the present invention, which is set forth in the accompanying claims, It is to be understood, however, that the appended claims

1 is a block diagram of a data processing system for a plurality of POS terminals in accordance with one embodiment of the present invention.

2 is a flow chart of a data processing method for a plurality of POS terminals in accordance with another embodiment of the present invention.

3 is a flow chart of a data processing method involving a check-in processing operation in accordance with another embodiment of the present invention.

4 is a flow chart of a data processing method involving a check-in connection transaction data operation in accordance with another embodiment of the present invention.

FIG. 5 is a flow chart of a data processing method involving a check-in lot settlement transaction processing operation according to another embodiment of the present invention.

The invention will now be described more fully hereinafter with reference to the accompanying drawings However, the invention may be embodied in different forms and should not be construed as limited to the various embodiments presented herein. The above-described embodiments are intended to be complete and complete to convey the scope of the present invention to those skilled in the art.

Terms such as "including" and "comprising" are used in addition to the elements and steps that are directly and explicitly stated in the specification and claims. In addition, the technical solutions of the present invention do not exclude the case of having other units and steps that are not directly or explicitly stated.

In this specification, a data processing system refers to a system that can decrypt a message sent by a POS terminal, and simultaneously verify the legality and association relationship between the POS terminal and the application terminal, and includes a processing unit to implement The processing operations required for the magnetic stripe card loan transaction, the PBOC loan transaction, the qPBOC offline transaction, and the like include, but are not limited to, organizing a financial receipt platform message, connecting a hardware encryption machine, and calculating a message MAC.

In this specification, the application client may be an application running on the POS terminal smart operating system configured to perform a payment function by interacting with the data processing system. According to one aspect of the invention, for the same application client running on multiple POS terminals, it has a unique application identifier and is stored in the data processing system.

In this specification, the application terminal may be an application running in a data processing system. According to another aspect of the present invention, each application corresponds to a single application terminal, and the application client completes the connection transaction function through the application terminal.

In accordance with another aspect of the invention, each POS terminal is assigned a respective unique first primary key and a common second primary key is assigned to each application client or application capable of running on multiple POS terminals. Thereby, the data involved in the connection transaction processing is processed at the POS terminal based on the first work key encrypted by the first master key, and in the data processing system such as the connection transaction system based on the second principal gold The second working capital of key encryption The key is used to process the data involved in the connection transaction processing.

According to another aspect of the present invention, when one of a plurality of POS terminals running the same application client initiates a check-in request to the data processing system for the application client, a first work key encrypted with the first primary key is generated. And returning the first work key to the POS terminal that initiates the sign-in request. In addition, if the check-in request is the first check-in request of the application client, a second work key encrypted with the second master key is also generated. Preferably, the first work key comprises a first PIK code used by the cryptographic keyboard to encrypt the user password and a first MAK code for message authentication, and the second work key comprises the processed unit for encrypting the user password. A second PIK code and a second MAK code for message authentication.

According to another aspect of the present invention, for each application client or application, the data processing system is equipped with a dedicated application terminal to perform operations involving the application client, such as, but not limited to, check-in processing, connection transaction processing, and Batch settlement transaction processing, etc., and in the data processing system, an association is established between the application terminal and the application identifier of the identification application client. When the application client initiates the transaction, the application terminal converts the connection transaction data from the POS terminal into the connection transaction data conforming to the application terminal specification, and then processes the same for the same application client. The second master key can thereby process the connection transaction in a unified manner while ensuring payment security, which is advantageous for the introduction of new services.

1 is a block diagram of a data processing system for a plurality of POS terminals in accordance with one embodiment of the present invention.

The data processing system 10 for a plurality of POS terminals shown in FIG. 1 includes a communication unit 110 and a processing unit 120, wherein the communication unit 110 is configured to be associated with a plurality of POS terminals (shown by reference numerals 21 and 22 in FIG. 1) The single platform 30 is in communication with the hardware encryptor 40, and the processing unit 120 is coupled to the communication unit 110 to perform operations associated with the application client, such as check-in processing, connection transaction processing, and batch settlement transaction processing. Preferably, processing unit 120 includes one or more application terminals (shown with reference numerals 121A and 121B in FIG. 1), each application terminal being associated with an application or application client configured to execute an associated application User-side operations. Taking the embodiment shown in FIG. 1 as an example, the POS terminals 21 and 22 both include application clients A and B, the application terminal 121A is associated with the application client A, and the application terminal 121B is associated with the application client B.

2 is a flow chart of a data processing method for a plurality of POS terminals in accordance with another embodiment of the present invention. For ease of explanation, the method of the present embodiment is implemented by means of the data processing system shown in FIG. It should be noted, however, that the present embodiment is not limited to systems having a specific structure.

The data processing method according to the present embodiment includes the following steps: In step S210, a plurality of POS terminals are assigned respective unique first master keys. Then, proceeding to step S220, a common second master key is assigned to one or more application clients capable of running on a plurality of POS terminals. Next, proceeding to step S230, the material processing system 10 performs an operation associated with the application client, the operations including check-in processing, connection transaction processing, and batch settlement transaction processing, etc., wherein the data involved in the connection transaction processing is based on the POS terminal The first work key encrypted by the first master key is processed And processing at the processing unit based on the second work key encrypted by the second master key.

3 is a flow chart of a data processing method involving a check-in processing operation in accordance with another embodiment of the present invention. For ease of explanation, the method of the present embodiment is implemented by means of the data processing system shown in FIG. It should be noted, however, that the present embodiment is not limited to systems having a specific structure.

The data processing method according to the present embodiment includes the following steps: In step S310, the communication unit 110 receives an application client (for example, A in FIG. 1) from one of a plurality of POS terminals (for example, the POS terminal 21 in FIG. 1). The sign-in request includes the device identifier of the POS terminal 21 and an application identifier corresponding to the application client.

Then proceeding to step S320, the application terminal (for example, the application terminal 121A in FIG. 1) related to the application identifier generates a first work key (for example, the first PKI encrypted by the first master key TMK1 by calling the hardware encryption machine 40. The code and the first MAK code) and return the first work key to the POS terminal that initiated the sign-in request.

Next, in step S330, the application terminal 121A confirms whether the current sign-in request is the first sign-in request of the application client A, and if yes, proceeds to step S340, otherwise proceeds to step S350.

In step S340, the application terminal 121A generates a second work key (for example, the first PKI code and the first MAK code) encrypted with the second master key TMK2 by calling the hardware encryption machine 40 and proceeds to step S350.

In step S350, the application terminal 121A saves the first work key and can The second work key that can be generated.

Then, proceeding to step S360, the communication unit 110 transmits a first PIK code to the POS terminal 21, which is stored in the PIN pad of the POS terminal 21 for encrypting the user password PIN.

4 is a flow chart of a data processing method involving a connection transaction processing operation in accordance with another embodiment of the present invention. For ease of explanation, the method of the present embodiment is implemented by means of the data processing system shown in FIG. It should be noted, however, that the present embodiment is not limited to systems having a specific structure.

The data processing method according to the present embodiment includes the following steps: In step S410, the communication unit 110 receives an application client (for example, A in FIG. 1) from one of a plurality of POS terminals (for example, the POS terminal 21 in FIG. 1). a connection transaction request, the connection transaction request including connection transaction data (such as a user password PIN encrypted with a first PIK code and a payment amount), and a device identifier of the POS terminal 21 and an application identifier corresponding to the application client .

In step S420, the application terminal 121A performs legality verification on the received connection transaction processing request, for example, by comparing the device identifier and the application identifier included in the connection transaction processing request with a predetermined association relationship to perform legality. verification. If the legality verification is passed, the process proceeds to step S430, otherwise the operation is terminated.

In step S430, the application terminal 121A determines whether the application associated with the application identifier has been checked in. If not, the process proceeds to step S440, and the check-in processing operation shown in FIG. 3 is performed, otherwise proceeds to step S450. The process also proceeds to step S450 after performing step S440.

In step S450, the application terminal 121A converts the user password encrypted with the first PIK code into a user password encrypted with the second PIK code by calling the hardware encryptor 40.

Then, proceeding to step S460, the application terminal 121A calculates the MAC by using the second MIK code of the second work key, and fills and fills the corresponding message domain according to the point of sale terminal specification to generate a complete message.

Next, in step S470, the application terminal 121A transmits the complete message to the acquiring platform 30.

Subsequently, the process proceeds to step S480, and the application terminal 121A returns the card issuer processing result from the acquirer platform 30 to the POS terminal 21.

FIG. 5 is a flow chart of a data processing method involving a check-in lot settlement transaction processing operation according to another embodiment of the present invention. For ease of explanation, the method of the present embodiment is implemented by means of the data processing system shown in FIG. It should be noted, however, that the present embodiment is not limited to systems having a specific structure.

The data processing method according to the present embodiment includes the following steps: In step S510, the communication unit 110 receives an application client (for example, A in FIG. 1) from one of a plurality of POS terminals (for example, the POS terminal 21 in FIG. 1). Batch settlement transaction processing request.

Next, proceeding to step S520, the application terminal 121A instructs the POS terminal 21 to upload the corresponding device identifier and application identifier.

Subsequently, in step S530, the application terminal 121A clears its saved first work key associated with the POS terminal 21 and the second work key associated with the application A.

The embodiments and examples presented herein are provided to best illustrate The present invention can be implemented and used by those skilled in the art in view of the embodiments of the present invention and its particular application. However, those skilled in the art will appreciate that the above description and examples are provided for ease of illustration and illustration. The descriptions are not intended to cover the various aspects of the invention or to limit the invention to the precise forms disclosed.

In view of the above, the scope of the present disclosure is determined by the scope of the following claims.

Claims (14)

A data processing system for a plurality of POS (Point of Sale) terminals, the plurality of POS terminals being assigned respective unique first master keys, wherein one can be on the plurality of POS terminals a running application client that is assigned a common second master key, and the data processing system includes: a communication unit configured to communicate with the plurality of POS terminals; and a processing unit coupled to the communication unit Configuring to perform operations associated with the application client, the operations including check-in processing, connection transaction processing, and batch settlement transaction processing, wherein the data involved in the connection transaction processing is based on the location at the POS terminal The first work key encrypted by the first master key is processed and processed at the processing unit based on the second work key encrypted by the second master key. The data processing system of claim 1, wherein the first work key comprises a first PIK (Personal Identification Number Key) code used by the cryptographic keyboard to encrypt the user password and used for reporting a first MAK (Media Access Control Key) code for authentication, and the second work key includes a second PIK code used by the processing unit to encrypt the user password and used for message authentication. The second MAK code. The data processing system of claim 1, wherein the processing unit includes an application terminal specially equipped for the application client to perform the operation. The data processing system of claim 1, wherein the processing unit performs check-in processing in the following manner: when one of the plurality of POS terminals initiates a check-in request to the data processing system for the application client, generating Decoding the first work key of the first master key encryption and returning the first work key to the POS terminal that initiated the sign-in request, and the first check-in request for the application client, further generating the second master key encryption The second work key. The data processing system of claim 2, wherein the processing unit performs a connection transaction process in a manner that one of the plurality of POS terminals initiates a connection transaction processing request to the data processing system for the application client At the time, the connection transaction processing request is verified for legality, and after the legality verification is passed, the user password encrypted by the first PIK code is converted into the user password encrypted by the second PIK code by calling the hardware encryption machine. Used to process the data involved in connection transaction processing. The data processing system of claim 1, wherein the processing unit performs batch settlement transaction processing in the following manner: when one of the plurality of POS terminals is the application client When the material processing system initiates the batch settlement transaction processing request, the first work key and the second work key saved in the processing unit are cleared. The data processing system of claim 5, wherein each POS terminal has a unique device identifier, the application client having a unique application identifier, the processing unit including by including the connection transaction processing request The device identifier and the application identifier are compared with a predetermined association to perform legality verification. A data processing method for a plurality of POS terminals, comprising the steps of: assigning a plurality of POS terminals with respective unique first master keys; and assigning to an application client capable of running on a plurality of POS terminals a common second master key; performing an operation associated with the application client, the operations including check-in processing, connection transaction processing, and batch settlement transaction processing, wherein the data involved in the connection transaction processing is at the POS The terminal is processed at the processing unit based on the first work key encrypted by the first master key and based on the second work key encrypted by the second master key. The data processing method of claim 8, wherein the first work key comprises a first PIK code used by the cryptographic keyboard to encrypt the user password and a first MAK code used for message authentication, and the Two work key package A second PIK code for encrypting the user password and a second MAK code for message authentication are included. The data processing method of claim 8, wherein the operation is performed using an application terminal specially provided for the application client. The data processing method of claim 8, wherein the check-in process is performed in the following manner: when one of the plurality of POS terminals initiates a check-in request for the application client, generating the encryption with the first master key The first work key returns the first work key to the POS terminal that initiated the sign-in request, and the first work-entry request for the application client also generates a second work key encrypted with the second master key. The data processing method of claim 9, wherein the connection transaction processing is performed in the following manner: when one of the plurality of POS terminals initiates a connection transaction processing request for the application client, processing the connection transaction Requesting for legality verification, and after the legality verification is passed, converting the user password encrypted by the first PIK code to the user password encrypted by the second PIK code by calling the hardware encryption machine for processing the connection transaction processing data of. The data processing method of claim 8, wherein the batch settlement transaction processing is performed in the following manner: When one of the plurality of POS terminals initiates a batch settlement transaction processing request for the application client, the saved first work key and the second work key are cleared. The data processing method of claim 12, wherein each POS terminal has a unique device identifier, and the application client has a unique application identifier by processing the device identifier included in the connection transaction processing request The validity verification is performed by comparing the application identifier with a predetermined association.