WO2019023979A1

WO2019023979A1 - Method for generating configurable pos machine secret key pair, and storage medium

Info

Publication number: WO2019023979A1
Application number: PCT/CN2017/095614
Authority: WO
Inventors: 洪逸轩; 孟陆强
Original assignee: 福建联迪商用设备有限公司
Priority date: 2017-08-02
Filing date: 2017-08-02
Publication date: 2019-02-07
Also published as: CN107637014B; CN107637014A

Abstract

Provided by the present invention are a method for generating a configurable point of sale (POS) machine secret key pair and a computer readable storage medium, the method comprising: presetting a configuration file, parameters in the configuration file comprising a manner of generating a terminal secret key pair; according to the performance that is produced by the terminal, setting parameters for a manner of generating a terminal secret key pair in a corresponding configuration file; during the production process, the terminal obtaining the corresponding configuration file; the terminal parsing the configuration file and generating a secret key pair according to the manner of generating a terminal secret key pair that is set in the configuration file. The present invention may make full use of the performance of a POS machine terminal, while reducing the load of a certificate authority (CA) center service end, and may also reduce the transmission frequency of sensitive data and improve data security; further, the method may ensure consistency in the production processes of equipment having different performances without needing to design different equipment production processes for different asymmetric secret key pair generation solutions according to conditions, while also being able to meet a variety of different needs.

Description

Configurable POS key pair generation method, storage medium

[0001] The present invention relates to the field of electronic payment, and more particularly to a configurable POS machine key pair generation method and a computer readable storage medium.

Background technique

[0002] POS (point of sale) is a multi-functional terminal. It can be installed in a special merchant of a credit card and a network of terminals to connect to a computer to realize automatic transfer of electronic funds. It has support for consumption, pre-authorization, Balance inquiry and transfer functions. Since the data interaction and transmission process between the P0S machine and the merchant background are performed in a zooming environment, in order to ensure the security and reliability during the use of the P0S, it is prevented that someone maliciously listens to the network data and obtains the cardholder information and corresponding The password, the information exchange between the P0S machine and the merchant back-end server must be carried out under a set of tightly-encrypted communication protocols.

[0003] At present, a relatively mature solution is: The P0S terminal applies for the CA certificate through the CA center of the P0S vendor, and the identity and data security communication and the data integrity are completed between the P0S terminal and the merchant background server through the CA security authentication system. Sexuality, non-repudiation and inter-posting services are used to conduct secure communication and security interaction activities. That is, the POS terminal needs to send a request for a certificate to the CA center, rely on the server of the CA center to generate an asymmetric key pair, and return the certificate.

[0004] The disadvantages of the existing methods are as follows: 1) completely relying on the CA center to generate an asymmetric key pair, increasing the operational load of the CA central server, not fully utilizing the performance of the POS terminal, and being unable to flexibly according to the P0S terminal itself. Performance performance for reasonable load balancing. At present, with the development of hard technologies, the performance of P0S terminal devices has different levels. The performance of some high-end P0S machines will be able to quickly generate asymmetric key pairs. 2) The asymmetric key pair is generated by the CA center server and then transmitted back to the P OS terminal. There is a security risk in the data transmission process of the private key. It is necessary to design a complete set of secure transmission private key for transmitting sensitive information data. Program.

[0005] Therefore, it is necessary to provide a POS machine key pair generation method and a computer readable storage medium capable of solving the above problems.

technical problem The technical problem to be solved by the present invention is to provide a configurable POS key pair generation method and a storage medium, which can flexibly configure a key generation manner according to the performance of the POS machine itself, and fully utilize the POS terminal's own resources. Balance the load of the CA center.

Problem solution

Technical solution

[0007] In order to solve the above technical problem, the technical solution adopted by the present invention is:

[0008] A configurable POS key pair generation method includes:

[0009] a preset configuration file, where parameters in the configuration file include a terminal key pair generation manner;

[0010] setting the terminal key pair generation mode in the corresponding configuration file according to the performance of the generated terminal itself;

[0011] in the production process, the terminal acquires a corresponding configuration file;

[0012] The terminal parses the configuration file, and generates a key pair according to the terminal key pair generation manner set in the configuration file.

[0013] Another technical solution provided by the present invention is:

[0014] A computer readable storage medium having stored thereon a computer program, the program being executed by a processor, implementing the following steps:

[0015] a preset configuration file, where parameters in the configuration file include a terminal key pair generation manner;

[0016] setting the terminal key pair generation mode in the corresponding configuration file according to the performance of the generated terminal itself;

[0017] in the production process, the terminal acquires a corresponding configuration file;

[0018] The terminal parses the configuration file, and generates a key pair according to the terminal key pair generation manner set in the configuration file.

Advantageous effects of the invention

Beneficial effect

[0019] The beneficial effects of the present invention are as follows: The present invention sets a configuration file in a pre-production stage, and sets a terminal key pair generation manner according to the performance of the terminal itself. In the subsequent stage of generation, the terminal parses the configuration file to obtain a key. For the generation method, the full use of the performance of the POS terminal and the load of the CA center server can be reduced, and the number of sensitive data transmission can be reduced, and the sensitive data can be reduced during transmission. Fully risk; Further, the configuration of different key generation files in a unified format configuration file ensures consistency of the production process for terminals with different performances.

Brief description of the drawing

DRAWINGS

1 is a schematic flow chart of a configurable POS machine key pair generation method according to the present invention;

2 is a schematic flow chart of Embodiment 1 of the present invention.

Detailed ways

[0022] The most important idea of the present invention is: presetting the configuration file in the pre-production stage, setting the terminal key pair generation mode according to the performance of the terminal itself, and in the subsequent stage of generating, the terminal parses the configuration file to obtain the key pair generation. The way to achieve full utilization of the performance of the POS terminal, to reduce the load of the CA center server.

[0023] Referring to FIG. 1, the present invention provides a configurable POS key pair generation method, including:

[0024] a preset configuration file, where parameters in the configuration file include a terminal key pair generation manner;

[0025] setting the terminal key pair generation mode in the corresponding configuration file according to the performance of the generated terminal itself;

[0026] in the production process, the terminal acquires a corresponding configuration file;

[0027] The terminal parses the configuration file, and generates a key pair according to a terminal key pair generation manner set in the configuration file.

[0028] It can be seen from the above description that the beneficial effects of the present invention are as follows: 1. According to the performance of the POS terminal itself, the asymmetric key pair generation mode is flexibly configured, and the resources of the POS terminal itself are fully utilized, and the balance is reasonably balanced. Some load on the CA center server. 2. Download the configuration table in the pre-production stage of the POS machine, and the subsequent stages of production, the POS machine analyzes the configuration file by itself, and judges the key pair generation mode to ensure the consistency of the production process of various devices with different performances. Designing unused equipment production processes for different asymmetric key pair generation schemes, and meeting and meeting various needs.

[0029] Further, the method for generating a terminal key pair includes: generating, by the terminal, a key pair or generating a key pair by the CA center.

[0030] Further, setting the first parameter corresponds to the autonomous generation of the key pair by the terminal, and the second parameter correspondingly generates the key pair by the CA center. [0031] It can be seen from the above description that for a terminal with higher performance, a key pair can be set by the terminal itself, and for a terminal with lower performance, it can be set by the CA center, and different key generation schemes can be set according to the performance of the terminal.

, more targeted, peers can achieve load balancing.

[0032] Further, the parameters in the configuration file further include a name of the configuration file, a path name stored in the terminal, a version number, and a generation date.

[0033] Further, the configuration file is a readable ini file format or an xml file format.

[0034] As can be seen from the above description, the format of the configuration file is readable, and the related information of the configuration file is recorded at the same time, which facilitates the traceback query.

[0035] Further, according to the performance of the terminal itself, the parameter of the terminal key pair generation mode in the corresponding configuration file is set, specifically:

[0036] The product manager sets the parameter of the terminal key pair generation mode in the corresponding configuration file according to the performance of the produced terminal and the type of the device.

[0037] It can be seen from the above description that the configuration file is produced by the product manager according to the performance of the batch POS machine in the pre-production of the POS machine.

The device type is uniformly set, and the POS machine resolves itself in the subsequent stage, which avoids the security risk of the operation file of the operator of the production line.

[0038] Further, in the production process, the terminal acquires a corresponding configuration file, specifically:

[0039] in the production process of the terminal, the terminal downloads the corresponding configuration file through the production system;

[0040] storing the configuration file.

[0041] As can be seen from the above description, batch downloading of the pipeline can be realized, and the production efficiency is improved.

[0042] Further, the parameter of the terminal key pair generation mode in the corresponding configuration file is set according to the performance of the generated terminal itself, and then further includes: encrypting the configuration file by using a production server.

[0043] As can be seen from the above description, the configuration file is encrypted and transmitted to the terminal securely to achieve confidentiality.

[0044] Further, the method further includes:

[0045] if the configuration file is set to generate a key pair by the terminal autonomously, the asymmetric key pair is generated by the terminal;

[0046] the terminal sends the generated public key in the asymmetric key pair to the CA center;

[0047] The terminal receives a certificate issued by the CA center according to the public key.

[0048] As can be seen from the above, in the production process of some high-performance POS machines, directly according to the setting of the configuration file The terminal itself generates a key pair. The private key is stored in the POS terminal in a secure manner. The public key and other certificate configuration information of the asymmetric key pair can be transmitted to the CA center to apply for the CA certificate. The number of times sensitive data is transmitted, reducing the security risk of sensitive data during transmission.

[0049] Further, the method further includes:

[0050] If the configuration file is set to generate a key pair by the CA center, the terminal sends a certificate issuance request to the CA center.

[0051] The CA center generates a public-private key pair and a certificate according to the request, and delivers the certificate and the generated private key of the public-private key pair to the terminal.

[0052] It can be known from the above that the configuration file is parsed, and the key pair is generated in a corresponding manner according to the generation manner of the terminal key pair set therein, thereby speeding up the key generation efficiency, and simultaneously balancing the terminal and the CA center reasonably. Load.

[0053] Another technical solution provided by the present invention is:

[0054] A computer readable storage medium having stored thereon a computer program, the program being executed by a processor, implementing the following steps:

[0055] a preset configuration file, where parameters in the configuration file include a terminal key pair generation manner;

[0056] setting the terminal key pair generation mode in the corresponding configuration file according to the performance of the generated terminal itself;

[0057] in the production process, the terminal acquires a corresponding configuration file;

[0058] The terminal parses the configuration file, and generates a key pair according to a terminal key pair generation manner set in the configuration file.

[0059] Further, the terminal key pair generation manner includes: the terminal generates a key pair autonomously or generates a key pair by the CA center.

[0060] Further, setting the first parameter corresponds to autonomously generating a key pair by the terminal, and the second parameter correspondingly generates a key pair by the CA center.

[0061] Further, the parameters in the configuration file further include a name of the configuration file, a path name stored in the terminal, a version number, and a generation date.

[0062] Further, the configuration file is a readable ini file format or an xml file format.

[0063] Further, according to the performance of the terminal itself, setting a terminal key pair in the corresponding configuration file The parameter step of the mode is specifically as follows:

[0064] The product manager sets the parameter of the terminal key pair generation mode in the corresponding configuration file according to the performance of the produced terminal and the type of the device.

[0065] Further, in the production process, the terminal acquires a corresponding configuration file step, which is specifically:

[0066] in the production process of the terminal, the terminal downloads the corresponding configuration file through the production system;

[0067] storing the configuration file.

[0068] Further, the step of setting a terminal key pair generation mode in the corresponding configuration file according to the performance of the generated terminal itself, and then, further comprising: encrypting the configuration file by using a production server.

[0069] Further, the program is executed by the processor, and the following steps may be implemented:

[0070] if the configuration file is set to generate a key pair by the terminal autonomously, generating an asymmetric key pair through the terminal;

[0071] the terminal sends the generated public key in the asymmetric key pair to the CA center;

[0072] The terminal receives the certificate issued by the CA center according to the public key.

[0073] Further, the program is executed by the processor, and the following steps may also be implemented:

[0074] If the configuration file is set to generate a key pair by the CA center, the terminal sends a certificate issuance request to the CA center.

[0075] The CA center generates a public-private key pair and a certificate according to the request, and delivers the certificate and the generated private key of the public-private key pair to the terminal.

[0076]

[0077] Embodiment 1

[0078] The performance of the POS machine is high or low. The high-performance POS machine can quickly and autonomously generate an asymmetric key pair, and the private key is stored in the POS machine terminal in a secure manner, and only needs to be paired with the asymmetric key pair. The public key and other certificate configuration information can be sent to the CA center to apply for the CA certificate. The low-performance POS machine generates the key pair with low efficiency. It is not feasible to rely on the POS terminal to generate the asymmetric key pair autonomously. The central server generates an asymmetric key pair and generates a CA certificate. The CA center sends the certificate and the private key (in the secure transmission mode of sensitive data) back to the POS.

[0079] Please refer to FIG. 2, which provides a configurable POS key pair generation method, which can fully utilize the performance of the POS terminal, reduce the load of the CA center server, and reduce the transmission of sensitive data. The number of losses, reducing the security risks of sensitive data during transmission.

[0080] This embodiment may include the following steps:

[0081] S1: a preset configuration file, where parameters in the configuration file include a terminal key pair generation manner;

[0082] Specifically, in the process of generating the POS terminal, the configuration file is generated by setting a certificate in a unified format on the production line, that is, the configuration file. The configuration file may be a readable file format such as an ini file format or an xml file format; the configuration file may further include the following information: a file name saved in the POS terminal, a path name saved in the POS terminal, and a version The number, date of generation, etc., make it easy to locate the location of the configuration file in the POS terminal, and record relevant information for retrospective query.

[0083] S2: According to the performance of the generated terminal itself, the parameter of the terminal key pair generation mode in the corresponding configuration file is set.

[0084] The setting of the parameter of the terminal key pair generation manner may be performed by preset two parameter values to respectively generate a key pair by the terminal and a key pair generated by the CA center. If the value is 0, it is generated by the terminal autonomously, and the value 1 is generated by the CA center.

[0085] Specifically, the POS product manager may set configuration parameters of the corresponding asymmetric key pair generation scheme according to the POS performance and device type produced, and then publish the configured configuration file to the production server; The automatic detection and setting parameters of the configuration file can be automatically configured by configuring the corresponding terminal performance automatic detection mechanism, and then transmitted to the production server securely.

[0086] S3: In the production process, the terminal acquires a corresponding configuration file.

[0087] Specifically, the configuration file is used as a pre-installed configuration file of the POS terminal, and is downloaded from the production system to the POS terminal during the production process of the POS terminal.

[0088] Since the configuration file determines the generation manner of the asymmetric key pair of the POS terminal, it is necessary to ensure that the configuration file has high security. Therefore, preferably, the S3 may specifically include:

[0089] S31: encrypting the configuration file by using a production server;

[0090] S32: in the subsequent production process of the terminal, the terminal downloads and stores the corresponding configuration file through the production system.

The implementation profile is securely passed to the POS terminal for confidentiality.

[0091] S4: The terminal parses the configuration file, and generates a key pair according to a terminal key pair generation manner set in the configuration file.

[0092] Specifically, the POS terminal decrypts the encrypted configuration file, and then parses the configuration file, and checks Ask the configuration file to determine the key customization type:

[0093] if the configuration file is set to generate a key pair by the terminal autonomously, the asymmetric key pair is generated by the terminal; then the terminal sends the RSA public key in the generated asymmetric key pair to the CA center to issue the certificate; The terminal then receives the certificate issued by the CA center according to the public key.

[0094] If the configuration file is set to generate a key pair by the CA center, the terminal sends a certificate issuance request to the CA center.

And generating, by the CA, the public-private key pair and the certificate according to the request, and transmitting the certificate and the private key of the generated public-private key pair to the terminal in a secure transmission manner of the sensitive data.

[0095] Embodiment 2

[0096] This embodiment corresponds to the configurable POS key pair generation method of the first embodiment, and provides a computer readable storage medium on which a computer program is stored, and the program is executed by the processor, and the following steps are implemented.

[0097] a preset configuration file, the parameter in the configuration file includes a terminal key pair generation manner, and the terminal key pair generation manner includes: the terminal generates a key pair autonomously or generates a key pair by the CA center; The first parameter may be set to be autonomously generated by the terminal, and the second parameter is generated by the CA center. Preferably, the configuration file is a readable ini file format or an xml file format, and the parameters further include a name of the configuration file, a path name stored in the terminal, a version number, and a generation date.

[0098] according to the performance of the generated terminal itself, the parameter of the terminal key pair generation mode in the corresponding configuration file is set; preferably, the product manager can set the corresponding according to the performance and device type of the produced terminal. The parameter of the terminal key pair generation mode in the configuration file; the corresponding terminal performance automatic detection mechanism can also be configured to automatically detect and set the parameters of the configuration file, and then securely transfer to the production server. Preferably, the method further comprises the step of encrypting the configuration file: encrypting the configuration file by a production server.

[0099] In the production process, the terminal acquires a corresponding configuration file; preferably, the terminal downloads a corresponding configuration file through the production system, and the terminal stores the configuration file.

[0100] The terminal parses the configuration file, and generates a key pair according to the terminal key pair generation manner set in the configuration file. Specifically, the following steps may be included:

[0101] The terminal decrypts the encrypted configuration file, and then parses the configuration file, and queries the configuration file to determine the key customization type: [0102] if the configuration file is set to generate a key pair by the terminal autonomously, the asymmetric key pair is generated by the terminal; the terminal sends the generated public key in the asymmetric key pair to the CA center; the terminal receives the CA center A certificate issued according to the public key.

[0103] If the configuration file is set to generate a key pair by the CA center, the terminal sends a certificate issuance request to the CA center; the CA center generates a public-private key pair and a certificate according to the request, and the certificate and the generated public-private key are generated. The private key of the pair is delivered to the terminal.

[0104] In summary, the present invention provides a configurable POS key pair generation method and a computer readable storage medium, which can not only fully utilize the performance of the POS terminal, but also reduce the load of the CA center server; It can reduce the number of transmissions of sensitive data and improve data security. Further, it can ensure the consistency of the production process of various devices with different performances, and it is not necessary to design the equipment production process for different asymmetric key pair generation schemes. At the same time, the same can meet various needs; further, the pipeline can obtain configuration files in batches to improve production efficiency.

[0105]

Claims

Claim

A configurable POS key pair generation method, comprising:

a preset configuration file, where the parameters in the configuration file include a terminal key pair generation manner; and setting a terminal key pair generation mode in the corresponding configuration file according to the performance of the generated terminal itself;

In the production process, the terminal obtains the corresponding configuration file;

The terminal parses the configuration file, and generates a key pair according to a terminal key pair generation manner set in the configuration file.

The configurable POS key pair generation method according to claim 1, wherein the terminal key pair generation manner comprises: the terminal autonomously generating a key pair or generating a key pair by the CA center.

The configurable POS key pair generation method according to claim 2, wherein the setting of the first parameter corresponds to a key pair generated by the terminal autonomously, and the second parameter corresponds to generating a key pair by the CA center.

The configurable POS key pair generation method according to claim 1, wherein the parameter in the configuration file further includes a name of the configuration file, a path name stored in the terminal, a version number, and a generation date.

The configurable POS key pair generation method according to claim 1, wherein the configuration file is a readable ini file format or an xml file format.

The configurable POS key pair generation method according to claim 1, wherein the parameter of the terminal key pair generation mode in the corresponding configuration file is set according to the performance of the terminal itself, specifically :

The product manager sets the terminal key pair generation mode parameter in the corresponding configuration file according to the performance and device type of the produced terminal.

The configurable POS key pair generation method according to claim 1, wherein in the production process, the terminal acquires a corresponding configuration file, which is specifically:

In the production process of the terminal, the terminal downloads a corresponding configuration file through the production system; and stores the configuration file. The configurable POS key pair generation method according to claim 1, wherein the parameter of the terminal key pair generation mode in the corresponding configuration file is set according to the performance of the generated terminal itself. And then, further comprising: encrypting the configuration file by the production server.

The method of generating a POS key pair according to claim 1, further comprising:

If the configuration file is set to generate a key pair by the terminal autonomously, an asymmetric key pair is generated by the terminal;

The terminal sends the generated public key of the asymmetric key pair to the CA center;

The terminal receives the certificate issued by the CA center according to the public key.

If the configuration file is set to generate a key pair by the CA center, the terminal sends a certificate issuance request to the CA center;

The CA center generates a public-private key pair and a certificate according to the request, and delivers the certificate and the generated private key of the public-private key pair to the terminal.

A computer readable storage medium having stored thereon a computer program, wherein the program is executed by a processor to implement the following steps:

A computer readable storage medium according to claim 11, wherein the terminal key pair generation manner comprises autonomously generating a key pair by the terminal or generating a key pair by the CA center.

A computer readable storage medium according to claim 12, wherein A parameter correspondingly generates a key pair by the terminal autonomously, and the second parameter corresponds to a key pair generated by the CA center.

[Claim 14] The computer readable storage medium according to claim 11, wherein the parameter in the configuration file further includes a name of the configuration file, a path name stored in the terminal, a version number, and a generation date.

[Claim 15] A computer readable storage medium according to claim 11, wherein the configuration file is a readable ini file format or an xml file format.

[Claim 16] The computer readable storage medium according to claim 11, wherein the step of setting a terminal key pair generation manner in the corresponding configuration file according to the performance of the terminal itself , Specifically:

A computer readable storage medium according to claim 11, wherein in the production process, the terminal acquires a corresponding configuration file, which is specifically:

In the production process of the terminal, the terminal downloads a corresponding configuration file through the production system; and stores the configuration file.

[Claim 18] The computer readable storage medium according to claim 11, wherein the setting of the terminal key pair generation manner in the corresponding configuration file is set according to the performance of the produced terminal itself After a parameter step, the method further includes: encrypting the configuration file by the production server.

[Claim 19] A computer readable storage medium according to claim 11, wherein the program is executed by the processor, and the following steps are further implemented:

[Claim 20] A computer readable storage medium according to claim 11, wherein the program is executed by the processor, and the following steps are further implemented: If the configuration file is set to generate a key pair by the CA center, the terminal sends a certificate issuance request to the CA center;