WO2017092654A1

WO2017092654A1 - Pos machine transaction processing method and system

Info

Publication number: WO2017092654A1
Application number: PCT/CN2016/107749
Authority: WO
Inventors: 王琪; 何舟
Original assignee: 中国银联股份有限公司
Priority date: 2015-12-04
Filing date: 2016-11-29
Publication date: 2017-06-08
Also published as: CN105956843A

Abstract

Disclosed in the present invention are a POS machine transaction processing method and system, the method comprises: receiving transaction information transmitted by an entity terminal of a POS machine, the transaction information comprising application identifier information and an encrypted data source after being encrypted by a primary key of the terminal; according to the application identifier information, determining the primary key of the application corresponding to the transaction information; performing a switch encryption on the encrypted data source in the transaction information by using the primary key of the application, and generating result data after performing the switch encryption; transmitting the result data to a remote end. The invention addresses a problem in prior art of resource wastage and low upgrade efficiency.

Description

POS machine transaction processing method and system

This application claims the priority of the Chinese patent application filed on December 4, 2015, submitted to the Intellectual Property Office of the People's Republic of China, application number 201510894192.X, and the invention name is “a POS machine transaction processing method and system”. This is incorporated herein by reference.

Technical field

The present invention relates to the field of electronic communications, and in particular, to a POS transaction processing method and system.

Background technique

POS (Point of Sale) machine terminal is a terminal device for cardholders to pay for credit card after shopping. It is widely used in various supermarkets, shopping malls, hotels, restaurants and other industries. It is currently the process of bank card payment. It is the most widely used, most convenient, and most accepted consumer terminal. At present, POS machines adopt a 3DES-based symmetric key system to protect the cardholder's personal password and transaction information packets with 3DES keys. The security management of the 3DES (Triple DES) key, which is the basis of the symmetric key system, is a matter of great concern to the national regulatory authorities, banks, and bank card acquirers, and requires assurance.

In the traditional POS industry, the POS terminal is usually placed before the merchant, and the POS terminal specialization service or the acquiring institution needs to manually use the PIN of the parent POS to the POS terminal to fill the terminal master key to realize one machine. dense. A unique terminal master key is shared between each POS terminal and the online transaction system, and the online transaction system invokes the encryption machine to randomly generate a PIK (Regional PIN Key) for encrypting the PIN encrypted by the terminal master key. The two parts of the MAK (Information Authentication Key) for identification. The PIK and MAK are stored in the PIN pad and the PIN is encrypted. In the online transaction process, in order to prevent PIN leakage or being cracked, it is required to securely encrypt the PIN from the terminal to the issuing bank during the entire information exchange process, and does not allow any link in the computer and network system, the PIN is in plaintext. The way it appears. However, existing POS transaction processing methods exist The following shortcomings: First: Because for different transactions, a merchant's counter is placed with multiple POS machines and password keyboards, resulting in a waste of hardware resources and maintenance costs. Second: the promotion of new business is difficult. Whenever there is a new business that needs to be promoted, it is necessary to re-burn the POS program and password keyboard filling, and the investment is large and the progress is slow.

In summary, the traditional POS transaction processing method has the problem of waste of resources and low efficiency of upgrade.

Summary of the invention

The embodiment of the invention provides a POS machine transaction processing method and system, which solves the problem of resource waste and low upgrade efficiency in the prior art.

In a first aspect, the method of the present invention includes a POS transaction processing method, the method comprising: receiving transaction information transmitted by a POS entity terminal, the transaction information including application identification information and encryption after being encrypted by a terminal master key a data source; determining, according to the application identification information, an application master key corresponding to the transaction information; using the application master key, performing trans-encryption on the encrypted data source in the transaction information, and generating a trans-encrypted Result data; the result data is sent to the far end.

In a second aspect, based on the same inventive concept, an embodiment of the present invention further provides a POS online transaction processing system, where the system includes:

a receiving unit, configured to receive transaction information sent by a POS entity terminal, where the transaction information includes application identification information and an encrypted data source encrypted by the terminal master key;

a determining unit, configured to determine, according to the application identification information, an application master key corresponding to the transaction information;

An encryption unit, configured to perform trans-encryption of the encrypted data source in the transaction information by using the application master key, and generate trans-encrypted result data;

a sending unit, configured to send the result data to a remote end.

In a third aspect, the embodiment of the present application provides a POS transaction processing device, including: a transceiver and a processor;

The transceiver is configured to receive transaction information sent by a POS entity terminal, where the transaction information includes application identification information and an encrypted data source encrypted by the terminal master key;

The processor is configured to determine, according to the application identification information, an application master key corresponding to the transaction information, and use the application master key to perform trans-encryption on the encrypted data source in the transaction information, and generate Translated encrypted result data;

The transceiver is further configured to send the result data to a remote end.

Further, the transceiver is further configured to: receive POS entity terminal identifier information sent by the POS entity terminal;

The processor is further configured to: determine, according to the transaction information corresponding to the terminal identifier information of the POS entity, that the application identifier in the transaction information is in a preset mapping relationship table, where the mapping relationship table is for each POS machine. A correspondence table between the entity terminal identification information and the application identifier in each of the POS entity terminals.

Further, the processor is specifically configured to determine, according to the POS entity entity terminal identification information, an application identifier in the transaction information corresponding to the POS entity entity terminal identifier information, in the preset mapping relationship table, determine The transaction information satisfies the transaction rule and continues to perform subsequent processing; otherwise, the processing is stopped and the processing failure result is returned.

Further, the encrypted data source includes a personal identification code ciphertext and a transaction data ciphertext; the processor is specifically configured to: use the PIK corresponding to the application master key to identify the personal identifier in the encrypted data source of the transaction information. The code ciphertext is encrypted; using the MAK corresponding to the application master key, the transaction data ciphertext in the encrypted data source of the transaction information is calculated, and the check value MAC of the result data is obtained.

Further, the processor is specifically configured to: determine an application master key corresponding to the application identifier information according to a correspondence between the preset application identifier information and the application master key.

In a fourth aspect, an embodiment of the present invention provides a non-transitory computer readable storage medium, where the non-transitory computer readable storage medium stores computer instructions, where the computer instructions are used to cause the computer to execute any of the above The POS transaction processing method described.

In a fifth aspect, an embodiment of the present invention provides a computer program product, where the computer program is The program includes a computing program stored on a non-transitory computer readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the POS transaction described in any of the above Approach.

On the one hand, the embodiment of the present invention only injects a terminal master key on the same POS terminal, and the POS terminal carries multiple applications, so different transactions can use different applications of the same POS terminal to avoid The resource waste problem of using different POS terminals in different transactions; on the other hand, the application master key corresponding to multiple applications is stored on the POS online transaction system, and the application identifiers of multiple applications and the POS entity terminal Established a correspondence. The POS online trading system encrypts the received transaction information using the application master key through the correspondence between the application identifiers of the multiple applications and the application master key, so that even the transactions with different deduction rates use the same The physical terminal of the POS machine can also be distinguished by the online transaction system through the application master key, which ensures the correctness of the transaction processing. At the same time, when the new application is implemented, only the application primary key in the POS online transaction system needs to be updated. The key does not need to perfuse the application key to each POS entity terminal, which improves the upgrade efficiency.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying for inventive labor.

1 is a POS transaction processing method according to an embodiment of the present invention, involving multiple entities and systems;

2 is a process of a POS entity terminal provided by the prior art using a terminal master key encryption;

FIG. 3 is a schematic flowchart of a method for processing a POS online transaction according to an embodiment of the present invention;

4 is a schematic structural diagram of a POS online transaction processing system according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a POS online transaction processing device according to an embodiment of the present invention.

detailed description

The present invention will be further described in detail with reference to the accompanying drawings, in which . All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The existing POS transaction processing method is usually one machine and one secret. This transaction processing method has the disadvantages of waste of resources and low efficiency of upgrade. With the development of intelligent operating system, intelligent POS terminal is also popularized, and intelligent POS terminal A plurality of applications are usually integrated, and different applications usually have different deduction rates. Therefore, different application master keys are required, and in order to implement a background system for moving the payment application to the POS terminal, the embodiment of the present invention Using the online transaction system to call the hardware encryption machine, the transaction data is converted between the POS terminal and the application program, thereby ensuring the security of payment, improving the flexibility and scalability of the POS terminal service, and realizing a multi-machine the goal of. The POS transaction processing method of the embodiment of the present invention involves multiple entities and systems, and thus the foregoing multiple entities or systems are introduced in advance. Specifically, as shown in Figure 1, it includes:

The POS entity terminal, the POS entity terminal has a terminal identifier, and shares a unique terminal master key with the online transaction system. The terminal master key (TMK) of the physical terminal of the POS machine includes: PIK and MAK, and the PIK is a work key for 3DES encryption of the cardholder's personal identification number (PIN), and the MAK is a card. A work key used to generate a check value (MAC) for transaction data when the POS machine pays for the card.

The PIN pad (PIN PAD) securely protects the PIK and MAK of the terminal master key and encrypts the personal identification code.

Application client, the application client is an application for setting transactions, It runs on a POS terminal with a smart operating system. The application client can complete the payment function by interacting with the online trading system, because the deduction rate of different transactions may be different, so the application clients with different deduction rates usually have corresponding application master keys.

The online transaction system decrypts the packets sent by the physical terminal, and verifies the legality and association relationship between the physical terminal and the application terminal.

A hardware encryption machine, a device that encrypts transaction data, is used for encryption of PINs, verifies the correctness of transaction information and data sources, and stores the terminal master key.

As can be seen from Figure 1, the POS physical terminal is connected to a PIN pad, and the hardware cipher is connected to the online transaction system.

It should be noted that in order to ensure the encryption security of the transaction information of the POS machine, all the current POS acquiring institutions adopt the method of dynamically managing the working key by using the terminal master key, that is, in order to avoid being cracked, the working key It is dynamically changed, that is, each time the POS machine entity terminal issues a sign-in request, the online transaction system automatically generates a new PIK and MAK, and after the TMK is encrypted and protected, it is sent back to the POS entity terminal with the response message. The POS entity terminal receives the PIK and MAK returned by the online transaction system and deposits it into the password keyboard.

In order to describe the process of the POS entity terminal encrypting the original transaction data by using the terminal master key, the embodiment of the present invention further provides FIG. 2, which schematically describes the POS entity terminal using PIK and MAK respectively for personal identification code and transaction. The process of data security protection, including:

Step 101: The POS entity terminal obtains the personal identification code (ie, the PIN plaintext) and the payment transaction data input by the cardholder through the PIN pad as the original data source to be encrypted.

Step 102: The POS entity terminal extracts the PIK work key and the MAK work key saved in the PIN pad, and uses the PIK work key and the MAK work key as the encryption key of the 3DES.

Step 103: The POS entity terminal performs 3DES encryption on the original data source by using PIK and MAK, generates an encrypted PIN ciphertext and generates a check value MAC of the transaction data packet, and the POS entity terminal will contain the PIN ciphertext and the MAC value. The transaction information is sent to an online trading system connected to the physical terminal of the POS machine.

Step 104: The online transaction system uses the same MAK work key as the POS entity terminal. Verify the correctness of the MAC value.

In the embodiment of the present invention, in order to solve the problem of the existing resource waste and the low efficiency of the upgrade, the POS transaction processing method is improved on the online transaction system, and the improvement method is shown in FIG. 3, and the specific implementation method includes:

Step S201: Receive transaction information sent by a POS entity terminal, where the transaction information includes application identification information and an encrypted data source encrypted by the terminal master key.

Step S202: Determine an application master key corresponding to the transaction information according to the application identifier information.

Step S203: Perform trans-encryption of the encrypted data source in the transaction information by using the application master key, and generate trans-encrypted result data.

Step S204, the result data is sent to the remote end.

The execution body of the above steps may be a POS machine background system similar to the online transaction system, and the following mainly introduces the online transaction system as an execution subject.

The encrypted data source in the transaction information received by the online transaction system includes a personal identification code ciphertext and a transaction data ciphertext, and the personal identification code ciphertext and the transaction data ciphertext generation process are as described in FIG. 2 . In addition, the transaction information received by the online transaction system further includes the POS entity terminal identification information of the generated transaction. The online transaction system determines, according to the transaction information corresponding to the terminal identifier information of the POS entity, that the application identifier in the transaction information is in a preset mapping relationship table, where the mapping relationship table is the terminal identification information of each POS entity and A correspondence table between application identifiers in each POS entity terminal.

Specifically, the online transaction system acquires an application client included in each POS entity terminal when each POS entity terminal accesses the network, because different application clients respectively correspond to respective application identification information, wherein the application identification information The utility model mainly includes a merchant number and a terminal number, and establishes a binding relationship between the terminal identifier information of each POS machine entity and the application identifier information of the application client in the POS machine entity terminal.

For example, there is a POS machine in a large supermarket. There are two applications in the POS machine, namely the fresh cash register application and the clothing cash register application. Therefore, when the POS machine accesses the online trading system, A correspondence table between the identifier of the POS machine and the identifier of the fresh cash register application and the logo of the clothing cash register application is established.

After the establishment of the foregoing correspondence table, the embodiment of the present invention further determines whether the transaction generated by the POS entity terminal is legal. Specifically, if the POS entity identification information is used, the POS entity is determined. The application identifier in the transaction information corresponding to the terminal identifier information is determined in the preset mapping relationship table, and the transaction information is determined to satisfy the transaction rule, and the subsequent processing is continued; otherwise, the processing is stopped, and the processing failure result is returned.

For example, if the POS-initiated transaction in the above-mentioned large supermarket is a transaction of fresh products, since the fresh cash register application is not completed in the online trading system, when the transaction is sent When the online trading system is in the background, the online trading system detects that the application identifier corresponding to the transaction generated by the POS entity terminal has no query result in the mapping relationship table, so it is determined that the transaction is an illegal transaction, so the processing is returned. The result of the failure. Of course, if the fresh cash register application is registered in the online trading system, the online trading system will continue to process the transaction.

When the online transaction system judges that the transaction is a legal transaction, the transaction information is further encrypted by using the background hardware encryption machine, and the encryption key is determined before the encryption, specifically, according to the preset application identification information and the application primary key. Corresponding relationship between the keys, determining an application master key corresponding to the application identifier information, and encrypting by using an application master key. The so-called trans-encryption refers to the process of decrypting the encrypted data source according to the PIK of the POS entity terminal, and then encrypting the decrypted encrypted data source according to the application master key.

For example, the online transaction system stores the application master key corresponding to the fresh cash register application and the clothing cash register application stored in the foregoing POS machine, and establishes a mapping between the fresh cash register application identifier and the corresponding master key of the fresh cash register application, and The application of the master key of the clothing cash register application and the clothing cash register application, so that the application master key corresponding to the transaction can be determined immediately after the application identification in the transaction information, so the subsequent acquiring platform can be more applied. The key information of the master key completes the processing of the corresponding transaction fee.

Further, the embodiment of the present invention provides a process for the online transaction system to perform trans-encryption on the transaction information. Specifically, the online transaction system uses the PIK corresponding to the application master key to add the transaction information. The personal identification code ciphertext in the secret data source is encrypted; using the MAK corresponding to the application master key, the transaction data ciphertext in the encrypted data source of the transaction information is calculated, and the MAC of the result data is obtained.

For example, there is a POS physical terminal that carries two application clients in the physical terminal of the POS machine. One application is mainly responsible for the transaction of the general commodity, and the other application is responsible for the transaction. It is the cash register of people's livelihood products, such as gasoline, fertilizer and other people's livelihood products. Because the deduction rates of the transactions corresponding to the two applications are different, the transactions of the two applications will have different application master keys, and the application master key TMK1 corresponding to the cash register application of the common commodity includes PIK1 and MAK1, The application master key TMK2 corresponding to the cashier application of the livelihood product includes PIK2 and MAK2. When the transaction is generated through the cash register application of the livelihood product, the online transaction system transcodes the PIN ciphertext in the transaction information according to the application master key TMK2 corresponding to the cash register application of the livelihood product, so as to avoid The leakage of the terminal master key causes the PIN to be circulated, thereby ensuring the security of the transaction. In addition, the transaction data ciphertext is encrypted by the MAK2 of the application master key TMK2 corresponding to the cash register application of the livelihood product, so that the receipt can be made. The platform derives that the transaction is a livelihood product based on the application master key TMK2, so the correct deduction rate is selected as the transaction fee for the transaction.

In order to describe the implementation method of the POS transaction processing method in the embodiment of the present invention, the embodiment of the present invention is further elaborated by the following examples.

For example, in a rural credit cooperative, there is a POS entity terminal, and the POS terminal includes two application clients, namely: agricultural product client, grain and oil product client. After the POS terminal completes the network configuration and the check-in request, the corresponding relationship between the agricultural product client, the grain and oil product client and the POS physical terminal is completed in the background online transaction system, and the agricultural product client and the agricultural product client are completed. The correspondence between the master key is applied, and the correspondence between the grain and oil product client and the grain and oil product client application master key. When a POS card payment order for the agricultural harvester occurs in the terminal of the POS machine, when the user inputs the password by using the password keyboard, the password keyboard uses the PIK to encrypt and report the PIN input by the cardholder to the online transaction system, and reports the POS at the same time. The terminal identifier and the merchant identifier of the physical entity terminal. After the above steps are completed, the online transaction system performs the following steps according to the POS transaction processing method provided by the embodiment of the present invention:

Step 1: The online transaction system receives the transaction information encrypted by the POS entity terminal by using the terminal master key, where the transaction information includes the corresponding merchant number of the agricultural harvester, and the transaction information further includes a corresponding POS entity terminal identifier.

Step 2: The online transaction system uses the application master key of the farm product client corresponding to the merchant number, and uses the application master key to encrypt and convert the transaction information.

In step three, the online trading system sends the complete result data to the acquiring platform.

In step 4, the acquiring platform sends the result data to the issuing bank for processing, and sends the transaction processing result to the online trading system, and the online trading system returns the transaction result to the terminal.

Based on the same technical concept, an embodiment of the present invention further provides a POS online transaction processing system, which can implement the foregoing method embodiments. As shown in FIG. 4, the system provided by the embodiment of the present invention includes: a receiving unit 401, a determining unit 402, an encrypting unit 403, and a sending unit 404, where:

The receiving unit 401 is configured to receive transaction information sent by the POS entity terminal, where the transaction information includes application identification information and an encrypted data source encrypted by the terminal master key;

a determining unit 402, configured to determine, according to the application identification information, an application master key corresponding to the transaction information;

The encryption unit 403 is configured to perform trans-encryption of the encrypted data source in the transaction information by using the application master key, and generate trans-encrypted result data;

The sending unit 404 is configured to send the result data to the remote end.

The encrypted data source in the transaction information received by the online transaction system includes a personal identification code ciphertext and a transaction data ciphertext, and the personal identification code ciphertext and the transaction data ciphertext generation process are as described in FIG. 2 . In addition, the transaction information received by the online transaction system further includes the POS entity terminal identification information of the generated transaction. The receiving unit 401 of the online transaction system is further configured to: receive the POS entity terminal identification information sent by the POS entity terminal.

After the receiving the transaction information sent by the POS entity terminal, the determining unit 402 is further configured to: determine the transaction according to the transaction information corresponding to the POS entity entity terminal identification information. The application identifier in the information is in a preset mapping relationship table, where the mapping relationship table is a correspondence table between the terminal identification information of each POS entity and the application identifier in each POS entity terminal.

For example, there is a POS machine in a large supermarket. There are two applications in the POS machine, namely the fresh cash register application and the clothing cash register application. Therefore, when the POS machine accesses the online transaction system, a correspondence table between the identifier of the POS machine and the identifier of the fresh cash register application and the identifier of the clothing cash register application is established.

After the establishment of the correspondence table is completed, the embodiment of the present invention further determines whether the transaction generated by the POS entity terminal is legal, and the determining unit 405 is configured to determine, according to the POS entity entity terminal identification information, The application identifier in the transaction information corresponding to the physical terminal identification information of the POS machine, in the preset mapping relationship table, determining that the transaction information satisfies the transaction rule, and continues to perform subsequent processing; otherwise, stopping the processing, and returning the processing failure result.

When the online transaction system judges that the transaction is a legal transaction, the background hardware encryption machine is further used to further encrypt the transaction information, and the encryption key is determined before the encryption, specifically, according to the preset application identification information and the application master key. Corresponding relationship between the application master key corresponding to the application identifier information. The so-called trans-encryption refers to the number of encryptions based on the PIK of the physical terminal of the POS machine. According to the source decryption, the decrypted encrypted data source is encrypted according to the application master key.

Further, the encrypted data source includes a personal identification code ciphertext and a transaction data ciphertext, and the encryption unit 403 is specifically configured to: encrypt the personal identification code ciphertext in the encrypted data source of the transaction information; The MAK corresponding to the key calculates the transaction data ciphertext in the encrypted data source of the transaction information, and obtains the MAC of the result data.

In summary, the embodiment of the present invention only injects a terminal master key on the same POS terminal, and the POS terminal carries multiple applications, so different transactions can use the same POS terminal. Different applications, avoiding different transactions using different POS terminals On the other hand, the application master key corresponding to multiple applications is stored on the POS online transaction system, and the application identifiers of multiple applications are associated with the POS entity terminal. The POS online trading system encrypts the received transaction information using the application master key through the correspondence between the application identifiers of the multiple applications and the application master key, so that even the transactions with different deduction rates use the same The physical terminal of the POS machine can also be distinguished by the online transaction system through the application master key, which ensures the correctness of the transaction processing. At the same time, when the new application is implemented, only the application primary key in the POS online transaction system needs to be updated. The key does not need to perfuse the application key to each POS entity terminal, which improves the upgrade efficiency.

Based on the same technical concept, the embodiment of the present application provides another POS transaction processing device. 5 is a schematic structural diagram of a POS transaction processing device of the present invention, the POS transaction processing device 500 includes: a transceiver 501, a processor 502, a memory 503, and a bus system 504;

The memory 503 is used to store a program. In particular, the program can include program code, the program code including computer operating instructions. The memory 503 may be a random access memory (RAM) or a non-volatile memory, such as at least one disk storage. Only one memory is shown in the figure, of course, the memory can also be set to a plurality as needed. Memory 503 can also be a memory in processor 502.

The memory 503 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof:

Operation instructions: include various operation instructions for implementing various operations.

Operating system: Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.

The method disclosed in the foregoing embodiment of the present application may be applied to the processor 502 or implemented by the processor 502. Processor 502 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 502 or an instruction in a form of software. The processor 502 described above may be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or discrete hardware. Component. Can The methods, steps, and logical block diagrams disclosed in the embodiments of the present application are implemented or executed. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor. The software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like. The storage medium is located in the memory 503, and the processor 502 reads the information in the memory 503 and performs the following steps in conjunction with its hardware:

The transceiver 501 is configured to receive transaction information sent by a POS entity terminal, where the transaction information includes application identification information and an encrypted data source encrypted by the terminal master key;

The processor 502 is configured to determine, according to the application identifier information, an application master key corresponding to the transaction information, and use the application master key to perform trans-encryption on the encrypted data source in the transaction information, and Generating the result data after transcoding;

The transceiver 501 is further configured to send the result data to a remote end.

Optionally, the transceiver 501 is further configured to receive POS entity terminal identifier information sent by the POS entity terminal;

The processor 502 is further configured to: determine, according to the transaction information corresponding to the terminal identifier information of the POS entity, that the application identifier in the transaction information is in a preset mapping relationship table, where the mapping relationship table is for each POS A correspondence table between the physical entity terminal identification information and the application identifier in each of the POS entity terminals.

Optionally, the processor 502 is configured to: determine, according to the POS entity entity terminal identifier information, an application identifier in the transaction information corresponding to the POS entity entity terminal identifier information, in a preset mapping relationship table. Then, it is judged that the transaction information satisfies the transaction rule, and the subsequent processing is continued; otherwise, the processing is stopped, and the processing failure result is returned.

Further, the encrypted data source includes a personal identification code ciphertext and a transaction data ciphertext;

The processor 502 is specifically configured to: encrypt, by using a PIK corresponding to the application master key, the personal identification code ciphertext in the encrypted data source of the transaction information; and calculate the transaction by using a MAK corresponding to the application master key. The transaction data ciphertext in the encrypted data source of the information, and the check value of the result data is obtained. MAC.

Further, the processor 502 is specifically configured to: determine an application master key corresponding to the application identifier information according to a correspondence between the preset application identifier information and the application master key.

The POS transaction processing device of the embodiment of the present invention exists in various forms, including but not limited to:

(1) Mobile communication devices: These devices are characterized by mobile communication functions and are mainly aimed at providing voice and data communication. Such devices include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

(2) Ultra-mobile personal computer equipment: This type of equipment belongs to the category of personal computers, has computing and processing functions, and generally has mobile Internet access. Such terminals include: PDAs, MIDs, and UMPC devices, such as the iPad.

(3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio, video players (such as iPod), handheld game consoles, e-books, and smart toys and portable car navigation devices.

(4) Server: A device that provides computing services. The server consists of a processor, a hard disk, a memory, a system bus, etc. The server is similar to a general-purpose computer architecture, but because of the need to provide highly reliable services, processing power and stability High reliability in terms of reliability, security, scalability, and manageability.

(5) Other electronic devices with data interaction functions.

Those skilled in the art can understand that all or part of the steps of implementing the above embodiments may be completed by a program instructing related hardware, and the program is stored in a storage medium, and includes a plurality of instructions for making a device (which may be a single chip microcomputer). The chip, etc. or processor executes all or part of the steps of the various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

In addition, the present invention also provides a non-transitory computer readable storage medium, the non-transient computing The machine readable storage medium stores computer instructions for causing the computer to perform the POS machine transaction processing method of any of the above.

Additionally, the present invention also provides a computer program product comprising a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer And causing the computer to execute the POS transaction processing method described in any of the above.

While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

A POS machine transaction processing method, characterized in that the method comprises:

Receiving transaction information sent by the POS entity terminal, where the transaction information includes application identification information and an encrypted data source encrypted by the terminal master key;

Determining, according to the application identification information, an application master key corresponding to the transaction information;

Transmitting the encrypted data source in the transaction information by using the application master key, and generating the transcoded result data;

The result data is sent to the far end.
The method of claim 1, wherein the receiving the transaction information sent by the POS entity terminal further comprises:

Receiving POS entity terminal identification information sent by the POS entity terminal;

After the receiving the transaction information sent by the POS entity terminal, before determining the application master key corresponding to the transaction information according to the application identification information, the method further includes:

Determining, according to the transaction information corresponding to the terminal identifier information of the POS entity, the application identifier in the transaction information in a preset mapping relationship table, where the mapping relationship table is the terminal identification information of each POS entity and each of the foregoing A correspondence table between application identifiers in a POS entity terminal.
The method of claim 2, after the receiving the transaction information sent by the POS entity terminal, further comprising:

If the application identifier in the transaction information corresponding to the POS entity entity terminal identification information is determined according to the POS entity entity terminal identification information, in the preset mapping relationship table, determining that the transaction information satisfies the transaction rule and continues to execute Follow-up processing;

Otherwise, stop processing and return to the processing failure result.
The method of claim 1 wherein said source of encrypted data comprises a personal identification code ciphertext and a transaction data ciphertext;

De-encrypting the encrypted data source in the transaction information by using the application master key, including:

Encrypting the personal identification code ciphertext in the encrypted data source of the transaction information by using a PIK corresponding to the application master key;

The transaction data ciphertext in the encrypted data source of the transaction information is calculated using the MAK corresponding to the application master key, and the check value MAC of the result data is obtained.
The method of claim 1, wherein the determining an application master key corresponding to the transaction information according to the application identification information comprises:

The application master key corresponding to the application identifier information is determined according to the correspondence between the preset application identifier information and the application master key.
A POS online transaction processing system, characterized in that the system comprises:

a receiving unit, configured to receive transaction information sent by the POS entity terminal, where the transaction information includes application identification information and an encrypted data source encrypted by the terminal master key;

a determining unit, configured to determine, according to the application identification information, an application master key corresponding to the transaction information;

An encryption unit, configured to perform trans-encryption of the encrypted data source in the transaction information by using the application master key, and generate trans-encrypted result data;

a sending unit, configured to send the result data to a remote end.
The system of claim 6, wherein the receiving unit is further configured to:

Receiving POS entity terminal identification information sent by the POS entity terminal;

After the receiving the transaction information sent by the POS entity terminal, the determining unit is further configured to:

Determining, according to the transaction information corresponding to the terminal identifier information of the POS entity, the application identifier in the transaction information in a preset mapping relationship table, where the mapping relationship table is the terminal identification information of each POS entity and each of the foregoing A correspondence table between application identifiers in a POS entity terminal.
The system of claim 7 further comprising:

a determining unit, configured to determine, according to the POS entity entity terminal identification information, an application identifier in the transaction information corresponding to the POS entity entity terminal identifier information, in the preset mapping relationship table, determining that the transaction information is satisfied Trading rules, continue to perform subsequent processing;

Otherwise, stop processing and return to the processing failure result.
The system according to claim 6, wherein the encrypted data source comprises a personal identification code ciphertext and a transaction data ciphertext; and the encryption unit is specifically configured to:

Encrypting the personal identification code ciphertext in the encrypted data source of the transaction information by using a PIK corresponding to the application master key;

The transaction data ciphertext in the encrypted data source of the transaction information is calculated using the MAK corresponding to the application master key, and the check value MAC of the result data is obtained.
The system of claim 6 wherein said determining unit is specifically configured to:

The application master key corresponding to the application identifier information is determined according to the correspondence between the preset application identifier information and the application master key.
A POS transaction processing device, comprising: a transceiver and a processor;

The transceiver is configured to receive transaction information sent by a POS entity terminal, where the transaction information includes application identification information and an encrypted data source encrypted by the terminal master key;

The processor is configured to determine, according to the application identification information, an application master key corresponding to the transaction information, and use the application master key to perform trans-encryption on the encrypted data source in the transaction information, and generate Translated encrypted result data;

The transceiver is further configured to send the result data to a remote end.
The device of claim 11 wherein said transceiver is further configured to:

Receiving POS entity terminal identification information sent by the POS entity terminal;

The processor is further configured to: determine, according to the transaction information corresponding to the terminal identifier information of the POS entity, that the application identifier in the transaction information is in a preset mapping relationship table, where the mapping relationship table is for each POS machine. A correspondence table between the entity terminal identification information and the application identifier in each of the POS entity terminals.
The device according to claim 12, wherein the processor is specifically configured to:

If the application identifier in the transaction information corresponding to the POS entity entity terminal identification information is determined according to the POS entity entity terminal identification information, in the preset mapping relationship table, determining that the transaction information satisfies the transaction rule and continues to execute Subsequent processing; otherwise, stop processing, return processing loss The result is defeated.
The device according to claim 11, wherein said encrypted data source comprises a personal identification code ciphertext and a transaction data ciphertext;

The processor is specifically configured to: encrypt, by using a PIK corresponding to the application master key, the personal identification code ciphertext in the encrypted data source of the transaction information; and calculate the transaction information by using a MAK corresponding to the application master key. The transaction data ciphertext in the encrypted data source, and the check value MAC of the result data is obtained.
The device according to claim 11, wherein the processor is specifically configured to:

The application master key corresponding to the application identifier information is determined according to the correspondence between the preset application identifier information and the application master key.
A non-transitory computer storage medium, characterized in that the non-transitory computer readable storage medium stores computer executable instructions for causing the computer to perform any of claims 1 to 5 The method described in the item.
A computer program product, comprising: a computing program stored on a non-transitory computer readable storage medium, the computer program comprising the computer executable instructions, when the computer executable instructions When executed by a computer, the computer is caused to perform the method of any one of claims 1 to 5.