WO2019165571A1 - 一种传输数据的方法及系统 - Google Patents

一种传输数据的方法及系统 Download PDF

Info

Publication number
WO2019165571A1
WO2019165571A1 PCT/CN2018/077301 CN2018077301W WO2019165571A1 WO 2019165571 A1 WO2019165571 A1 WO 2019165571A1 CN 2018077301 W CN2018077301 W CN 2018077301W WO 2019165571 A1 WO2019165571 A1 WO 2019165571A1
Authority
WO
WIPO (PCT)
Prior art keywords
ciphertext
terminal
account information
private key
pin code
Prior art date
Application number
PCT/CN2018/077301
Other languages
English (en)
French (fr)
Inventor
万文超
洪逸轩
Original Assignee
福建联迪商用设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 福建联迪商用设备有限公司 filed Critical 福建联迪商用设备有限公司
Priority to CN201880000129.9A priority Critical patent/CN108401494B/zh
Priority to PCT/CN2018/077301 priority patent/WO2019165571A1/zh
Publication of WO2019165571A1 publication Critical patent/WO2019165571A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/20—Point-of-sale [POS] network systems
    • G06Q20/204—Point-of-sale [POS] network systems comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3223—Realising banking transactions through M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G06Q20/3278—RFID or NFC payments by means of M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G06Q20/38215—Use of certificates or encrypted proofs of transaction rights
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4012—Verifying personal identification numbers [PIN]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present invention relates to the field of data processing, and in particular, to a method and system for transmitting data.
  • Method 1 Use the POS terminal to input and transmit the PIN code, that is, input the PIN code on the PIN terminal of the POS terminal, and then encrypt it by the POS terminal and directly transmit it to the payment terminal through its communication module.
  • this method requires the POS terminal to configure the PIN pad module and the communication module, which will increase the cost of the POS terminal.
  • Method 2 Use a general-purpose device such as a mobile phone or tablet to store the PIN code encryption key, and use this type of device to input and transmit the PIN code, which is encrypted by the general-purpose device and transmitted to the payment terminal; however, general-purpose devices such as mobile phones and tablets are not dedicated after all. For financial equipment that has undergone strict security testing, the PIN encryption key stored on such devices is easily stolen or even replaced, resulting in insecure PIN encryption.
  • the technical problem to be solved by the present invention is how to reduce the cost while improving the security of PIN code transmission.
  • the technical solution adopted by the present invention is:
  • the invention provides a method for transmitting data, comprising:
  • the mobile terminal acquires a pair of asymmetric keys from the payment terminal;
  • the pair of asymmetric keys includes a public key and a private key ciphertext;
  • the mobile terminal encrypts the PIN code according to the public key to obtain a PIN code ciphertext
  • the mobile terminal sends the PIN code ciphertext and the private key ciphertext to the POS terminal, so that the POS terminal obtains the account information corresponding to the PIN code ciphertext according to the private key ciphertext;
  • the mobile terminal forwards the ciphertext of the account information from the POS terminal to the payment terminal, so that the payment terminal verifies the validity of the account information according to the ciphertext of the account information.
  • the invention also provides a system for transmitting data, comprising:
  • a first acquiring module configured to acquire, by the mobile terminal, a pair of asymmetric keys from the payment terminal; the pair of asymmetric keys includes a public key and a private key ciphertext;
  • a first encryption module configured to: the mobile terminal encrypts the PIN code according to the public key to obtain a PIN code ciphertext;
  • a first sending module configured to send, by the mobile terminal, the PIN code ciphertext and the private key ciphertext to the POS terminal, so that the POS terminal obtains the account information corresponding to the PIN code ciphertext according to the private key ciphertext ;
  • a forwarding module configured to: forward, by the mobile terminal, the ciphertext of the account information from the POS terminal to the payment terminal, so that the payment terminal verifies the validity of the account information according to the ciphertext of the account information.
  • the present invention has the beneficial effects that the present invention obtains a pair of asymmetric keys from the payment terminal in real time through the mobile terminal, and encrypts the PIN code input by the user to the mobile terminal by using the public key of the asymmetric key, and then sends the PIN code to the POS terminal.
  • the POS terminal returns the account information ciphertext that the payment terminal can verify validity according to the PIN code, and the mobile terminal forwards the account information ciphertext to the payment terminal.
  • the mobile terminal of the present invention does not store a fixed encryption key for transmitting the PIN code, and the mobile terminal cannot decrypt the private key ciphertext during the entire data transmission process, and is fed back by the POS terminal.
  • the account information is also present in the mobile terminal in the form of cipher text. Therefore, even if the mobile terminal used by the user does not have the high security of the financial device, the criminal cannot steal and replace the encryption key by invading the mobile terminal, thereby enabling the user to use
  • the built-in mobile terminal input PIN code also has high security, and the POS terminal does not need to install a password keyboard, which reduces the production cost of the POS terminal.
  • FIG. 1 is a flow chart of a specific implementation manner of a method for transmitting data according to the present invention
  • FIG. 2 is a structural block diagram of a specific implementation manner of a terminal for transmitting data according to the present invention
  • the first acquisition module 2. The first encryption module; 3. The first transmission module; 4. The forwarding module.
  • the key idea of the present invention is that the present invention obtains a pair of asymmetric keys from the payment terminal in real time through the mobile terminal, and encrypts the PIN code input by the user to the mobile terminal by using the public key of the asymmetric key, and then sends the PIN code to the POS terminal.
  • the POS terminal returns the account information ciphertext that the payment terminal can verify validity according to the PIN code, and the mobile terminal forwards the account information ciphertext to the payment terminal. Achieve reduced cost while improving PIN code transmission security.
  • FIG. 1 and FIG. 2 Please refer to FIG. 1 and FIG. 2,
  • the present invention provides a method for transmitting data, including:
  • the mobile terminal acquires a pair of asymmetric keys from the payment terminal;
  • the pair of asymmetric keys includes a public key and a private key ciphertext;
  • the mobile terminal encrypts the PIN code according to the public key to obtain a PIN code ciphertext
  • the mobile terminal sends the PIN code ciphertext and the private key ciphertext to the POS terminal, so that the POS terminal obtains the account information corresponding to the PIN code ciphertext according to the private key ciphertext;
  • the mobile terminal forwards the ciphertext of the account information from the POS terminal to the payment terminal, so that the payment terminal verifies the validity of the account information according to the ciphertext of the account information.
  • the mobile terminal acquires a pair of asymmetric keys from the payment terminal, specifically:
  • the mobile terminal sends an asymmetric key acquisition request to the payment terminal;
  • the payment terminal When the payment terminal receives the asymmetric key acquisition request, the payment terminal randomly generates a pair of asymmetric keys; the pair of asymmetric keys includes a public key and a private key;
  • the payment terminal encrypts the private key according to a preset first symmetric key to obtain a private key ciphertext
  • the payment terminal sends the private key ciphertext and the public key to the mobile terminal.
  • the payment terminal randomly generates a pair of asymmetric keys for encrypting the PIN code, one at a time, which improves the security of the PIN code transmission.
  • the POS terminal acquires account information corresponding to the PIN code ciphertext according to the private key ciphertext, specifically:
  • the POS terminal acquires the first symmetric key
  • the POS terminal acquires the account information corresponding to the plaintext of the PIN code.
  • the first symmetric key exists only in the financial device POS terminal and the payment terminal with higher security, and the universal device mobile terminal does not have the first symmetric key for decrypting the private key ciphertext, so that the illegal The numerator cannot replace or steal the private key used to encrypt the PIN code by attacking the mobile terminal, thereby improving the security of the PIN code transmission.
  • the POS terminal encrypts the account information according to the preset second symmetric key, and obtains the ciphertext of the account information.
  • the payment terminal verifies the validity of the account information according to the ciphertext of the account information, specifically:
  • the payment terminal decrypts the ciphertext of the account information according to the second symmetric key, and obtains the plaintext of the account information;
  • the payment terminal verifies the validity of the plaintext of the account information.
  • the second symmetric key used for encrypting and decrypting the account information ciphertext exists only in the financial device POS terminal and the payment terminal with higher security, and the universal device mobile terminal has no information for decrypting the account information.
  • the second symmetric key improves the security of the account information.
  • the payment terminal When the account information is valid, the payment terminal performs a payment operation corresponding to the account information according to the payment request sent by the POS terminal.
  • the method further includes:
  • the mobile terminal deletes the private key ciphertext.
  • the mobile terminal establishes an SSL connection with the payment terminal
  • the mobile terminal establishes a secure Bluetooth connection with the POS terminal.
  • the present invention also provides a system for transmitting data, including:
  • the first obtaining module 1 is configured to acquire, by the mobile terminal, a pair of asymmetric keys from the payment terminal; the pair of asymmetric keys includes a public key and a private key ciphertext;
  • the first encryption module 2 is configured to: the mobile terminal encrypts the PIN code according to the public key to obtain a PIN code ciphertext;
  • the first sending module 3 is configured to send, by the mobile terminal, the PIN code ciphertext and the private key ciphertext to the POS terminal, so that the POS terminal obtains the account corresponding to the PIN code ciphertext according to the private key ciphertext. information;
  • the forwarding module 4 is configured to: the mobile terminal forwards the ciphertext of the account information from the POS terminal to the payment terminal, so that the payment terminal verifies the validity of the account information according to the ciphertext of the account information.
  • the first obtaining module includes:
  • a first sending unit configured to send, by the mobile terminal, an asymmetric key acquisition request to the payment terminal
  • a generating unit configured to: when the payment terminal receives the asymmetric key acquisition request, the payment terminal randomly generates a pair of asymmetric keys; the pair of asymmetric keys include a public key and a private key;
  • An encryption unit configured to encrypt, by the payment terminal, the private key according to a preset first symmetric key to obtain a private key ciphertext
  • a second sending unit configured to send, by the payment terminal, the private key ciphertext and the public key to the mobile terminal.
  • a second acquiring module configured to acquire, by the POS terminal, the first symmetric key
  • a first decryption module configured to decrypt the private key ciphertext according to the first symmetric key, to obtain a private key plaintext; and the POS terminal decrypts the PIN code ciphertext according to the private key plaintext to obtain a PIN code clear text.
  • the third obtaining module is configured to acquire, by the POS terminal, the account information corresponding to the plaintext of the PIN code.
  • the second encryption module is configured to encrypt the account information according to the preset second symmetric key to obtain the ciphertext of the account information.
  • a fourth acquiring module configured to acquire, by the payment terminal, the second symmetric key
  • a second decryption module configured to: the payment terminal decrypts the ciphertext of the account information according to the second symmetric key, and obtains the plaintext of the account information;
  • the verification module is configured to verify, by the payment terminal, the validity of the plaintext information of the account information.
  • a second sending module configured to: when the account information is valid, the payment terminal performs a payment operation corresponding to the account information according to the payment request sent by the POS terminal.
  • the deleting module is used by the mobile terminal to delete the private key ciphertext.
  • a first establishing module configured to establish an SSL connection between the mobile terminal and the payment terminal
  • the second establishing module is configured to establish a secure Bluetooth connection between the mobile terminal and the POS terminal.
  • Embodiment 1 of the present invention is:
  • This embodiment provides a method for transmitting data, including:
  • the mobile terminal establishes an SSL connection with the payment terminal; the mobile terminal establishes a secure Bluetooth connection with the POS terminal.
  • the payment terminal and the POS terminal are configured with a security module, which can perform key management and provide encryption and decryption functions.
  • the mobile terminal acquires a pair of asymmetric keys from the payment terminal; the pair of asymmetric keys includes a public key and a private key ciphertext. Specifically:
  • the mobile terminal sends an asymmetric key acquisition request to the payment terminal;
  • the payment terminal When the payment terminal receives the asymmetric key acquisition request, the payment terminal randomly generates a pair of asymmetric keys; the pair of asymmetric keys includes a public key and a private key;
  • the payment terminal encrypts the private key according to a preset first symmetric key to obtain a private key ciphertext
  • the payment terminal sends the private key ciphertext and the public key to the mobile terminal.
  • the POS terminal and the payment terminal have the first symmetric key.
  • the mobile terminal encrypts the PIN code according to the public key to obtain a PIN code ciphertext.
  • the mobile terminal sends the PIN code ciphertext and the private key ciphertext to the POS terminal.
  • the mobile terminal deletes the private key ciphertext.
  • the POS terminal acquires account information corresponding to the PIN code ciphertext according to the private key ciphertext. Specifically:
  • the POS terminal acquires the first symmetric key
  • the POS terminal acquires the account information corresponding to the plaintext of the PIN code
  • the POS terminal encrypts the account information according to the preset second symmetric key, and obtains the ciphertext of the account information.
  • the security module of the POS terminal uses the standard PINBLOCK algorithm to form the account information (PINBLOCK) of the primary account data PAN and PIN.
  • the first symmetric key is used to protect the private key used to encrypt the PIN code
  • the second symmetric key is used to protect the account information. Because the protected content is different, different symmetric keys are used to protect different used data. Helps improve safety.
  • the mobile terminal forwards the ciphertext of the account information from the POS terminal to the payment terminal.
  • the payment terminal verifies the validity of the account information according to the ciphertext of the account information, specifically:
  • the payment terminal decrypts the ciphertext of the account information according to the second symmetric key, and obtains the plaintext of the account information;
  • the payment terminal verifies the validity of the plaintext of the account information.
  • the payment terminal performs a payment operation corresponding to the account information according to the payment request sent by the POS terminal.
  • the PIN code is to be transmitted securely in this embodiment, and the PIN code is input on the universal device mobile terminal of the non-financial device, but the mobile terminal itself does not store the key used to encrypt the PIN code.
  • the mobile terminal encrypts the PIN code by using the public key of the asymmetric key, and the public key is delivered by the payment terminal once, and the first time is implemented.
  • the security of the key used to encrypt the PIN code is also reflected in the fact that the private key used to decrypt the PIN ciphertext always exists in cipher text during the transmission process. Only the security module of the POS terminal can obtain the ciphertext for decrypting the private key. Key. The security mechanism of the POS terminal can ensure the security of the security module.
  • the PIN code is secure throughout the life cycle.
  • the PIN code is encrypted with the public key immediately after input on the mobile terminal and the PIN buffer is immediately cleared, and is always in the form of ciphertext during transmission. Only the security module of the POS terminal can obtain the plaintext of the PIN code and immediately form a PINBLOCK and encrypt it.
  • the POS terminal and the mobile terminal, the mobile terminal and the payment terminal use a secure channel for communication.
  • Bluetooth 4.2 communication protocol and SSL communication protocol are used to establish communication connections. These open protocols can effectively prevent man-in-the-middle attacks.
  • the existing POS terminal payment scheme can prevent replay attacks.
  • Typical methods include using the UKPT (using a single key for each transaction) key, the message number field in the interactive message, and the use of random numbers.
  • Embodiment 2 of the present invention is:
  • This embodiment provides a system for transmitting data, including:
  • the first establishing module triggers the mobile terminal to establish an SSL connection with the payment terminal; the second establishing module triggers the mobile terminal to establish a secure Bluetooth connection with the POS terminal.
  • the first obtaining module triggers the mobile terminal to acquire a pair of asymmetric keys from the payment terminal; the pair of asymmetric keys includes a public key and a private key ciphertext. Specifically:
  • the first sending unit triggers the mobile terminal to send an asymmetric key acquisition request to the payment terminal; when the payment terminal receives the asymmetric key acquisition request, the generating unit triggers the payment terminal to randomly generate a pair of asymmetric keys;
  • the asymmetric key includes a public key and a private key;
  • the encryption unit triggers the payment terminal to encrypt the private key according to the preset first symmetric key to obtain a private key ciphertext; and the second sending unit triggers the payment terminal to send the private key.
  • the ciphertext and the public key are to the mobile terminal.
  • the first encryption module triggers the mobile terminal to encrypt the PIN code according to the public key to obtain the PIN code ciphertext; the first sending module triggers the mobile terminal to send the PIN code ciphertext and the private key ciphertext to the POS terminal.
  • the deleting module triggers the mobile terminal to delete the private key ciphertext.
  • the second obtaining module triggers the POS terminal to acquire the first symmetric key; the first decrypting module triggers the POS terminal to decrypt the private key ciphertext according to the first symmetric key to obtain a private key plaintext; and the POS terminal according to the private
  • the cryptographic text decrypts the PIN code ciphertext to obtain the PIN code plaintext; the third obtaining module triggers the POS terminal to acquire the account information corresponding to the PIN code plaintext.
  • the second encryption module triggers the POS terminal to encrypt the account information according to the preset second symmetric key to obtain the ciphertext of the account information.
  • the forwarding module triggers the mobile terminal to forward the ciphertext of the account information from the POS terminal to the payment terminal.
  • the fourth obtaining module triggers the payment terminal to acquire the second symmetric key; the second decrypting module triggers the payment terminal to decrypt the ciphertext of the account information according to the second symmetric key, and obtains the clear information of the account information; and the verification module triggers the payment terminal. Verify the validity of the plain text of the account information.
  • the second sending module triggers the payment terminal to perform a payment operation corresponding to the account information according to the payment request sent by the POS terminal.
  • the present invention provides a method and terminal for transmitting data, which acquires a pair of asymmetric keys from a payment terminal in real time through a mobile terminal, and inputs a PIN code input by the user to the mobile terminal using an asymmetric key.
  • the key is encrypted and sent to the POS terminal, and the POS terminal returns the account information ciphertext that the payment terminal can verify and valid according to the PIN code, and the mobile terminal forwards the account information ciphertext to the payment terminal.
  • the mobile terminal of the present invention does not store a fixed encryption key for transmitting the PIN code, and the mobile terminal cannot decrypt the private key ciphertext during the entire data transmission process, and is fed back by the POS terminal.
  • the account information is also present in the mobile terminal in the form of cipher text. Therefore, even if the mobile terminal used by the user does not have the high security of the financial device, the criminal cannot steal and replace the encryption key by invading the mobile terminal, thereby enabling the user to use
  • the built-in mobile terminal input PIN code also has high security, and the POS terminal does not need to install a password keyboard, which reduces the production cost of the POS terminal. Further, each time the mobile terminal needs to transmit the PIN code, the payment terminal randomly generates a bunch of asymmetric keys for encrypting the PIN code, one at a time, improving the security of the PIN code transmission.
  • the first symmetric key exists only in the financial device POS terminal and the payment terminal with higher security, and the universal device mobile terminal does not have the first symmetric key for decrypting the private key ciphertext, so that the criminal cannot
  • the security of the PIN code transmission is improved by attacking the mobile terminal to replace or steal the private key used to encrypt the PIN code.
  • the second symmetric key used for encrypting and decrypting the account information ciphertext exists only in the financial device POS terminal and the payment terminal with higher security, while the universal device mobile terminal has no second symmetry for decrypting the account information. The key improves the security of the account information.
  • the mobile terminal successfully sends the PIN code ciphertext and the ciphertext of the private key used to decrypt the PIN code ciphertext to the POS terminal, the public key and the private key ciphertext of the encrypted PIN code are deleted immediately, which is improved for Decrypt the key of the PIN code ciphertext. Further, a secure and reliable communication connection between the mobile terminal and the POS terminal and the payment terminal improves the security of the PIN code transmission.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Finance (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明涉及数据处理领域，尤其涉及一种传输数据的方法及系统。本发明通过移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文；移动终端根据所述公钥加密PIN码，得到PIN码密文；移动终端发送所述PIN码密文和所述私钥密文至POS终端，以使POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息；移动终端转发来自POS终端的所述账号信息的密文至支付终端，以使支付终端根据所述账号信息的密文验证所述账号信息的有效性。实现在提高PIN码传输安全性的同时降低成本。

Description

一种传输数据的方法及系统 技术领域
本发明涉及数据处理领域，尤其涉及一种传输数据的方法及系统。
 背景技术
随着电子支付产业的迅速发展，银行卡支付、行业卡支付以其快捷方便的特点，越来越受到人们的欢迎。为了确保持卡人账户安全，持卡人通常会通过安全的POS终端输入个人识别码（Personal Identification Number，PIN码），然后由POS传输到到支付终端，由支付终端鉴别持卡人身份。为防止PIN码泄露或者被破解，以保护持卡人的财产安全，整个支付过程中对PIN码必须进行加密保护，避免其以明文形式出现。因此，PIN码的安全传输一直是支付过程中的重要一环。如何将PIN码安全传输到支付终端，目前通常有以下几种方式：
方式一：使用POS终端输入和传输PIN码，即在POS终端的密码键盘（PIN  PAD）上输入PIN码，然后由POS终端加密后通过其通讯模块直接传输到支付终端。但是此种方式要求POS终端必须配置密码键盘模块和通讯模块，会造成POS终端的成本提高。
方式二：使用手机或平板等通用设备存储PIN码加密密钥，并使用这类设备输入和传输PIN码，由通用设备加密后传输到支付终端；但是，手机和平板等通用设备毕竟不是专用的、经过严格安全检测的金融设备，在这类设备上存储的PIN加密密钥容易被窃取甚至替换，造成PIN加密的不安全。
 技术问题
本发明所要解决的技术问题是：如何在提高PIN码传输安全性的同时降低成本。
 技术解决方案
为了解决上述技术问题，本发明采用的技术方案为：
本发明提供一种传输数据的方法，包括：
移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文；
移动终端根据所述公钥加密PIN码，得到PIN码密文；
移动终端发送所述PIN码密文和所述私钥密文至POS终端，以使POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息；
移动终端转发来自POS终端的所述账号信息的密文至支付终端，以使支付终端根据所述账号信息的密文验证所述账号信息的有效性。
本发明还提供一种传输数据的系统，包括：
第一获取模块，用于移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文；
第一加密模块，用于移动终端根据所述公钥加密PIN码，得到PIN码密文；
第一发送模块，用于移动终端发送所述PIN码密文和所述私钥密文至POS终端，以使POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息；
转发模块，用于移动终端转发来自POS终端的所述账号信息的密文至支付终端，以使支付终端根据所述账号信息的密文验证所述账号信息的有效性。
 有益效果
本发明的有益效果在于：本发明通过移动终端实时从支付终端获取一对非对称密钥，并将用户输入至移动终端的PIN码使用非对称密钥的公钥进行加密后发送给POS终端，由POS终端根据PIN码返回支付终端可验证有效性的账号信息密文，并由移动终端转发账号信息密文至支付终端。区别于现有技术，本发明的移动终端中不存储固定的用于传输PIN码的加密密钥，且在整个数据传输的过程中，移动终端无法解密私钥密文，且由POS终端反馈的账号信息也是以密文的形式存在于移动终端中，因此，即使用户使用的移动终端不具有金融设备的高度安全性，不法分子也无法通过入侵手机终端窃取和替换加密密钥，从而使得用户使用自带的移动终端输入PIN码也具有较高的安全性，POS终端无需安装密码键盘，降低了POS终端的生产成本。
 附图说明
图1为本发明提供的一种传输数据的方法的具体实施方式的流程框图；
图2为本发明提供的一种传输数据的终端的具体实施方式的结构框图；
标号说明：
1、第一获取模块；2、第一加密模块；3、第一发送模块；4、转发模块。
具体实施方式
本发明的关键构思在于：本发明通过移动终端实时从支付终端获取一对非对称密钥，并将用户输入至移动终端的PIN码使用非对称密钥的公钥进行加密后发送给POS终端，由POS终端根据PIN码返回支付终端可验证有效性的账号信息密文，并由移动终端转发账号信息密文至支付终端。实现在提高PIN码传输安全性的同时降低成本。
请参照图1以及图2，
如图1所示，本发明提供一种传输数据的方法，包括：
移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文；
移动终端根据所述公钥加密PIN码，得到PIN码密文；
移动终端发送所述PIN码密文和所述私钥密文至POS终端，以使POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息；
移动终端转发来自POS终端的所述账号信息的密文至支付终端，以使支付终端根据所述账号信息的密文验证所述账号信息的有效性。
进一步地，移动终端从支付终端获取一对非对称密钥，具体为：
移动终端发送非对称密钥获取请求至支付终端；
当支付终端接收到所述非对称密钥获取请求时，支付终端随机生成一对非对称密钥；所述一对非对称密钥包括公钥和私钥；
支付终端根据预设的第一对称密钥加密所述私钥，得到私钥密文；
支付终端发送所述私钥密文和所述公钥至移动终端。
由上述描述可知，移动终端每次需传输PIN码时，支付终端都随机生成一对非对称密钥用于加密PIN码，一次一密，提高了PIN码传输的安全性。
进一步地，POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息，具体为：
POS终端获取所述第一对称密钥；
POS终端根据所述第一对称密钥解密所述私钥密文，得到私钥明文；
POS终端根据所述私钥明文解密所述PIN码密文，得到PIN码明文；
POS终端获取与所述PIN码明文对应的所述账号信息。
由上述描述可知，第一对称密钥只存在于具有较高安全性的金融设备POS终端和支付终端中，而通用设备移动终端中无用于解密私钥密文的第一对称密钥，使得不法分子无法通过攻击移动终端替换或窃取用于加密PIN码的私钥，提高了PIN码传输的安全性。
进一步地，还包括：
POS终端根据预设的第二对称密钥加密所述账号信息，得到所述账号信息的密文。
进一步地，支付终端根据所述账号信息的密文验证所述账号信息的有效性，具体为：
支付终端获取所述第二对称密钥；
支付终端根据所述第二对称密钥解密所述账号信息的密文，得到账号信息明文；
支付终端验证所述账号信息明文的有效性。
由上述描述可知，用于加解密账号信息密文的第二对称密钥只存在于具有较高安全性的金融设备POS终端和支付终端中，而通用设备移动终端中无用于解密账号信息的第二对称密钥，提高了账号信息的安全性。
进一步地，还包括：
当所述账号信息有效时，支付终端根据POS终端发送的支付请求执行与所述账号信息对应的支付操作。
进一步地，移动终端发送所述PIN码密文和所述私钥密文至POS终端之后，还包括：
移动终端删除所述私钥密文。
由上述描述可知，当移动终端成功将PIN码密文和用于解密PIN码密文的私钥的密文发送至POS终端后，立即删除加密PIN码的公钥和私钥密文，提高了用于解密PIN码密文的密钥的安全性。
进一步地，还包括：
移动终端与支付终端建立SSL连接；
移动终端与POS终端建立安全的蓝牙连接。
由上述描述可知，移动终端和POS终端、支付终端之间采用安全可靠的通信连接方式，提高了PIN码传输的安全性。
如图2所示，本发明还提供一种传输数据的系统，包括：
第一获取模块1，用于移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文；
第一加密模块2，用于移动终端根据所述公钥加密PIN码，得到PIN码密文；
第一发送模块3，用于移动终端发送所述PIN码密文和所述私钥密文至POS终端，以使POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息；
转发模块4，用于移动终端转发来自POS终端的所述账号信息的密文至支付终端，以使支付终端根据所述账号信息的密文验证所述账号信息的有效性。
进一步地，所述第一获取模块包括：
第一发送单元，用于移动终端发送非对称密钥获取请求至支付终端；
生成单元，用于当支付终端接收到所述非对称密钥获取请求时，支付终端随机生成一对非对称密钥；所述一对非对称密钥包括公钥和私钥；
加密单元，用于支付终端根据预设的第一对称密钥加密所述私钥，得到私钥密文；
第二发送单元，用于支付终端发送所述私钥密文和所述公钥至移动终端。
进一步地，还包括：
第二获取模块，用于POS终端获取所述第一对称密钥；
第一解密模块，用于POS终端根据所述第一对称密钥解密所述私钥密文，得到私钥明文；POS终端根据所述私钥明文解密所述PIN码密文，得到PIN码明文；
第三获取模块，用于POS终端获取与所述PIN码明文对应的所述账号信息。
进一步地，还包括：
第二加密模块，用于POS终端根据预设的第二对称密钥加密所述账号信息，得到所述账号信息的密文。
进一步地，还包括：
第四获取模块，用于支付终端获取所述第二对称密钥；
第二解密模块，用于支付终端根据所述第二对称密钥解密所述账号信息的密文，得到账号信息明文；
验证模块，用于支付终端验证所述账号信息明文的有效性。
进一步地，还包括：
第二发送模块，用于当所述账号信息有效时，支付终端根据POS终端发送的支付请求执行与所述账号信息对应的支付操作。
进一步地，还包括：
删除模块，用于移动终端删除所述私钥密文。
进一步地，还包括：
第一建立模块，用于移动终端与支付终端建立SSL连接；
第二建立模块，用于移动终端与POS终端建立安全的蓝牙连接。
本发明的实施例一为：
本实施例提供一种传输数据的方法，包括：
S1、移动终端与支付终端建立SSL连接；移动终端与POS终端建立安全的蓝牙连接。
其中，支付终端和POS终端配置有安全模块，能进行密钥的管理，提供加解密功能。
S2、移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文。具体为：
移动终端发送非对称密钥获取请求至支付终端；
当支付终端接收到所述非对称密钥获取请求时，支付终端随机生成一对非对称密钥；所述一对非对称密钥包括公钥和私钥；
支付终端根据预设的第一对称密钥加密所述私钥，得到私钥密文；
支付终端发送所述私钥密文和所述公钥至移动终端。
其中，只有POS终端和支付终端具有所述第一对称密钥。
S3、移动终端根据所述公钥加密PIN码，得到PIN码密文。
S4、移动终端发送所述PIN码密文和所述私钥密文至POS终端。
S5、移动终端删除所述私钥密文。
S6、POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息。具体为：
POS终端获取所述第一对称密钥；
POS终端根据所述第一对称密钥解密所述私钥密文，得到私钥明文；
POS终端根据所述私钥明文解密所述PIN码密文，得到PIN码明文；
POS终端获取与所述PIN码明文对应的所述账号信息；
POS终端根据预设的第二对称密钥加密所述账号信息，得到所述账号信息的密文。
其中，POS终端的安全模块使用标准的PINBLOCK算法，将主账号数据PAN和PIN组成账号信息（PINBLOCK）。
其中，只有POS终端和支付终端具有所述第二对称密钥。
其中，第一对称密钥用于保护用于加密PIN码的私钥，第二对称密钥用于保护账号信息，由于保护的内容不同，因此，采用不同的对称密钥保护不同用于的数据有利于提高安全性。
S7、移动终端转发来自POS终端的所述账号信息的密文至支付终端。
S8、支付终端根据所述账号信息的密文验证所述账号信息的有效性，具体为：
支付终端获取所述第二对称密钥；
支付终端根据所述第二对称密钥解密所述账号信息的密文，得到账号信息明文；
支付终端验证所述账号信息明文的有效性。
S9、当所述账号信息有效时，支付终端根据POS终端发送的支付请求执行与所述账号信息对应的支付操作。
由上述描述可知，本实施例待安全传输的是PIN码，PIN码在非金融设备的通用设备移动终端上输入，但移动终端本身不存储用于加密PIN码的密钥。移动终端采用非对称密钥的公钥对PIN码进行加密操作，公钥每次由支付终端下发，实现了一次一密。
用于加密PIN码的密钥的安全性还体现在解密PIN密文用的私钥在传输过程中一直以密文形式存在，只有在POS终端的安全模块才能获取到用于解密私钥密文的密钥。POS终端的安全机制能保证安全模块的安全性。
PIN码在整个生命周期内都是安全的，PIN码在移动终端上输入后立即使用公钥加密且立即清除PIN缓存，且在传输过程中一直以密文形式存在。只有在POS终端的安全模块才能获取PIN码的明文并立即组成PINBLOCK并加密。
POS终端和移动终端，移动终端和支付终端间均使用安全通道进行通讯。例如，采用蓝牙4.2通讯协议和SSL通讯协议建立通讯连接，这些开放协议能有效防止中间人攻击。
现有的POS终端支付方案能防止重放攻击，典型的做法有使用UKPT（每笔交易使用单钥）密钥、交互报文中带报文序号字段、使用随机数参与等。
本发明的实施例二为：
本实施例提供一种传输数据的系统，包括：
第一建立模块触发移动终端与支付终端建立SSL连接；第二建立模块触发移动终端与POS终端建立安全的蓝牙连接。
第一获取模块触发移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文。具体为：
第一发送单元触发移动终端发送非对称密钥获取请求至支付终端；当支付终端接收到所述非对称密钥获取请求时，生成单元触发支付终端随机生成一对非对称密钥；所述一对非对称密钥包括公钥和私钥；加密单元触发支付终端根据预设的第一对称密钥加密所述私钥，得到私钥密文；第二发送单元触发支付终端发送所述私钥密文和所述公钥至移动终端。
第一加密模块触发移动终端根据所述公钥加密PIN码，得到PIN码密文；第一发送模块触发移动终端发送所述PIN码密文和所述私钥密文至POS终端。
删除模块触发移动终端删除所述私钥密文。
第二获取模块触发POS终端获取所述第一对称密钥；第一解密模块触发POS终端根据所述第一对称密钥解密所述私钥密文，得到私钥明文；POS终端根据所述私钥明文解密所述PIN码密文，得到PIN码明文；第三获取模块触发POS终端获取与所述PIN码明文对应的所述账号信息。第二加密模块触发POS终端根据预设的第二对称密钥加密所述账号信息，得到所述账号信息的密文。
转发模块触发移动终端转发来自POS终端的所述账号信息的密文至支付终端。
第四获取模块触发支付终端获取所述第二对称密钥；第二解密模块触发支付终端根据所述第二对称密钥解密所述账号信息的密文，得到账号信息明文；验证模块触发支付终端验证所述账号信息明文的有效性。当所述账号信息有效时，第二发送模块触发支付终端根据POS终端发送的支付请求执行与所述账号信息对应的支付操作。
综上所述，本发明提供的一种传输数据的方法及终端，通过移动终端实时从支付终端获取一对非对称密钥，并将用户输入至移动终端的PIN码使用非对称密钥的公钥进行加密后发送给POS终端，由POS终端根据PIN码返回支付终端可验证有效性的账号信息密文，并由移动终端转发账号信息密文至支付终端。区别于现有技术，本发明的移动终端中不存储固定的用于传输PIN码的加密密钥，且在整个数据传输的过程中，移动终端无法解密私钥密文，且由POS终端反馈的账号信息也是以密文的形式存在于移动终端中，因此，即使用户使用的移动终端不具有金融设备的高度安全性，不法分子也无法通过入侵手机终端窃取和替换加密密钥，从而使得用户使用自带的移动终端输入PIN码也具有较高的安全性，POS终端无需安装密码键盘，降低了POS终端的生产成本。进一步地，移动终端每次需传输PIN码时，支付终端都随机生成一堆非对称密钥用于加密PIN码，一次一密，提高了PIN码传输的安全性。进一步地，第一对称密钥只存在于具有较高安全性的金融设备POS终端和支付终端中，而通用设备移动终端中无用于解密私钥密文的第一对称密钥，使得不法分子无法通过攻击移动终端替换或窃取用于加密PIN码的私钥，提高了PIN码传输的安全性。进一步地，用于加解密账号信息密文的第二对称密钥只存在于具有较高安全性的金融设备POS终端和支付终端中，而通用设备移动终端中无用于解密账号信息的第二对称密钥，提高了账号信息的安全性。进一步地，当移动终端成功将PIN码密文和用于解密PIN码密文的私钥的密文发送至POS终端后，立即删除加密PIN码的公钥和私钥密文，提高了用于解密PIN码密文的密钥的安全性。进一步地，移动终端和POS终端、支付终端之间采用安全可靠的通信连接方式，提高了PIN码传输的安全性。

Claims (16)

  1. 一种传输数据的方法，其特征在于，包括：
    移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文；
    移动终端根据所述公钥加密PIN码，得到PIN码密文；
    移动终端发送所述PIN码密文和所述私钥密文至POS终端，以使POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息；
    移动终端转发来自POS终端的所述账号信息的密文至支付终端，以使支付终端根据所述账号信息的密文验证所述账号信息的有效性。
  2. 根据权利要求1所述的传输数据的方法，其特征在于，移动终端从支付终端获取一对非对称密钥，具体为：
    移动终端发送非对称密钥获取请求至支付终端；
    当支付终端接收到所述非对称密钥获取请求时，支付终端随机生成一对非对称密钥；所述一对非对称密钥包括公钥和私钥；
    支付终端根据预设的第一对称密钥加密所述私钥，得到私钥密文；
    支付终端发送所述私钥密文和所述公钥至移动终端。
  3. 根据权利要求2所述的传输数据的方法，其特征在于，POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息，具体为：
    POS终端获取所述第一对称密钥；
    POS终端根据所述第一对称密钥解密所述私钥密文，得到私钥明文；
    POS终端根据所述私钥明文解密所述PIN码密文，得到PIN码明文；
    POS终端获取与所述PIN码明文对应的所述账号信息。
  4. 根据权利要求1所述的传输数据的方法，其特征在于，还包括：
    POS终端根据预设的第二对称密钥加密所述账号信息，得到所述账号信息的密文。
  5. 根据权利要求4所述的传输数据的方法，其特征在于，支付终端根据所述账号信息的密文验证所述账号信息的有效性，具体为：
    支付终端获取所述第二对称密钥；
    支付终端根据所述第二对称密钥解密所述账号信息的密文，得到账号信息明文；
    支付终端验证所述账号信息明文的有效性。
  6. 根据权利要求1所述的传输数据的方法，其特征在于，还包括：
    当所述账号信息有效时，支付终端根据POS终端发送的支付请求执行与所述账号信息对应的支付操作。
  7. 根据权利要求1所述的传输数据的方法，其特征在于，移动终端发送所述PIN码密文和所述私钥密文至POS终端之后，还包括：
    移动终端删除所述私钥密文。
  8. 根据权利要求1所述的传输数据的方法，其特征在于，还包括：
    移动终端与支付终端建立SSL连接；
    移动终端与POS终端建立安全的蓝牙连接。
  9. 一种传输数据的系统，其特征在于，包括：
    第一获取模块，用于移动终端从支付终端获取一对非对称密钥；所述一对非对称密钥包括公钥和私钥密文；
    第一加密模块，用于移动终端根据所述公钥加密PIN码，得到PIN码密文；
    第一发送模块，用于移动终端发送所述PIN码密文和所述私钥密文至POS终端，以使POS终端根据所述私钥密文获取与所述PIN码密文对应的账号信息；
    转发模块，用于移动终端转发来自POS终端的所述账号信息的密文至支付终端，以使支付终端根据所述账号信息的密文验证所述账号信息的有效性。
  10. 根据权利要求9所述的传输数据的系统，其特征在于，所述第一获取模块包括：
    第一发送单元，用于移动终端发送非对称密钥获取请求至支付终端；
    生成单元，用于当支付终端接收到所述非对称密钥获取请求时，支付终端随机生成一对非对称密钥；所述一对非对称密钥包括公钥和私钥；
    加密单元，用于支付终端根据预设的第一对称密钥加密所述私钥，得到私钥密文；
    第二发送单元，用于支付终端发送所述私钥密文和所述公钥至移动终端。
  11. 根据权利要求10所述的传输数据的系统，其特征在于，还包括：
    第二获取模块，用于POS终端获取所述第一对称密钥；
    第一解密模块，用于POS终端根据所述第一对称密钥解密所述私钥密文，得到私钥明文；POS终端根据所述私钥明文解密所述PIN码密文，得到PIN码明文；
    第三获取模块，用于POS终端获取与所述PIN码明文对应的所述账号信息。
  12. 根据权利要求9所述的传输数据的系统，其特征在于，还包括：
    第二加密模块，用于POS终端根据预设的第二对称密钥加密所述账号信息，得到所述账号信息的密文。
  13. 根据权利要求12所述的传输数据的系统，其特征在于，还包括：
    第四获取模块，用于支付终端获取所述第二对称密钥；
    第二解密模块，用于支付终端根据所述第二对称密钥解密所述账号信息的密文，得到账号信息明文；
    验证模块，用于支付终端验证所述账号信息明文的有效性。
  14. 根据权利要求9所述的传输数据的系统，其特征在于，还包括：
    第二发送模块，用于当所述账号信息有效时，支付终端根据POS终端发送的支付请求执行与所述账号信息对应的支付操作。
  15. 根据权利要求9所述的传输数据的系统，其特征在于，还包括：
    删除模块，用于移动终端删除所述私钥密文。
  16. 根据权利要求9所述的传输数据的系统，其特征在于，还包括：
    第一建立模块，用于移动终端与支付终端建立SSL连接；
    第二建立模块，用于移动终端与POS终端建立安全的蓝牙连接。
PCT/CN2018/077301 2018-02-27 2018-02-27 一种传输数据的方法及系统 WO2019165571A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201880000129.9A CN108401494B (zh) 2018-02-27 2018-02-27 一种传输数据的方法及系统
PCT/CN2018/077301 WO2019165571A1 (zh) 2018-02-27 2018-02-27 一种传输数据的方法及系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/077301 WO2019165571A1 (zh) 2018-02-27 2018-02-27 一种传输数据的方法及系统

Publications (1)

Publication Number Publication Date
WO2019165571A1 true WO2019165571A1 (zh) 2019-09-06

Family

ID=63093362

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077301 WO2019165571A1 (zh) 2018-02-27 2018-02-27 一种传输数据的方法及系统

Country Status (2)

Country Link
CN (1) CN108401494B (zh)
WO (1) WO2019165571A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109995786B (zh) * 2019-04-08 2020-11-13 北京深思数盾科技股份有限公司 在组织中对数据授权的方法及装置
CN110071940A (zh) * 2019-05-06 2019-07-30 深圳市网心科技有限公司 软件包加解密方法、服务器、用户设备及存储介质
CN113596811B (zh) * 2021-06-30 2022-06-21 荣耀终端有限公司 一种数据传输方法及终端设备
CN113806749B (zh) * 2021-09-23 2024-04-05 航天信息股份有限公司 一种升级方法、装置及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102136172A (zh) * 2011-04-02 2011-07-27 方园 一种个人或家庭使用的刷卡终端及其实现方法
CN102469081A (zh) * 2010-11-11 2012-05-23 中国移动通信集团公司 智能卡片操作的方法、设备及系统
US20160027006A1 (en) * 2014-07-23 2016-01-28 Diebold Self-Service Systems, Division Of Diebold, Incorporated Encrypting pin receiver
CN105761066A (zh) * 2016-02-04 2016-07-13 福建联迪商用设备有限公司 银行卡密码保护方法及系统
CN106920091A (zh) * 2015-12-25 2017-07-04 北京数码视讯科技股份有限公司 一种支付方法及安全操作系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103136668A (zh) * 2011-11-28 2013-06-05 中兴通讯股份有限公司 终端支付方法、终端和支付平台
US20140289129A1 (en) * 2013-03-25 2014-09-25 iAXEPT Ltd Method for secure contactless communication of a smart card and a point of sale terminal
CN106131037A (zh) * 2016-07-25 2016-11-16 四川易想电子商务有限公司 一种网上贸易方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102469081A (zh) * 2010-11-11 2012-05-23 中国移动通信集团公司 智能卡片操作的方法、设备及系统
CN102136172A (zh) * 2011-04-02 2011-07-27 方园 一种个人或家庭使用的刷卡终端及其实现方法
US20160027006A1 (en) * 2014-07-23 2016-01-28 Diebold Self-Service Systems, Division Of Diebold, Incorporated Encrypting pin receiver
CN106920091A (zh) * 2015-12-25 2017-07-04 北京数码视讯科技股份有限公司 一种支付方法及安全操作系统
CN105761066A (zh) * 2016-02-04 2016-07-13 福建联迪商用设备有限公司 银行卡密码保护方法及系统

Also Published As

Publication number Publication date
CN108401494B (zh) 2020-10-30
CN108401494A (zh) 2018-08-14

Similar Documents

Publication Publication Date Title
CN109728909B (zh) 基于USBKey的身份认证方法和系统
EP3251284B1 (en) Methods for secure credential provisioning
CN110535868A (zh) 基于混合加密算法的数据传输方法及系统
CN107896147B (zh) 一种基于国密算法协商临时会话密钥的方法及其系统
CN103020825B (zh) 一种基于软体客户端的安全支付认证方法
WO2018127081A1 (zh) 一种加密密钥获取方法及系统
CN107679847B (zh) 一种基于近场通信双向身份认证的移动交易隐私保护方法
EP1277299A1 (en) Method for securing communications between a terminal and an additional user equipment
KR20160119803A (ko) 인증 시스템 및 방법
CN103763631A (zh) 认证方法、服务器和电视机
CN108401494B (zh) 一种传输数据的方法及系统
CN108323230B (zh) 一种传输密钥的方法、接收终端和分发终端
CN109754241B (zh) 一种硬钱包及基于硬钱包的验证方法
CN106411926A (zh) 一种数据加密通信方法及系统
CN104424446A (zh) 一种安全认证和传输的方法和系统
WO2014201907A1 (zh) 电子签名方法及系统
US11888832B2 (en) System and method to improve user authentication for enhanced security of cryptographically protected communication sessions
CN104901803A (zh) 一种基于cpk标识认证技术的数据交互安全保护方法
CN103905388A (zh) 一种认证方法、认证装置、智能卡、服务器
CN105407467A (zh) 短消息加密方法、装置和系统
CN113507372A (zh) 一种接口请求的双向认证方法
WO2015109958A1 (zh) 一种基于协商密钥的数据处理方法和手机
TWI827906B (zh) 訊息傳輸系統以及應用其中之使用者裝置與資訊安全硬體模組
CN102056156B (zh) 将计算机数据安全下载至移动终端的方法及系统
US9876774B2 (en) Communication security system and method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18908062

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18908062

Country of ref document: EP

Kind code of ref document: A1